diff --git a/.github/test-spec.yml b/.github/test-spec.yml
new file mode 100644
index 00000000000..914846f7154
--- /dev/null
+++ b/.github/test-spec.yml
@@ -0,0 +1,396 @@
+# This is the Jenkins ci variant of the .github/labler.yaml
+
+"CI-run-zephyr-twister":
+  - any:
+      - "!.github/**/*"
+      - "!doc/**/*"
+      - "!CODEOWNERS"
+      - "!LICENSE"
+      - "!**/*.rst"
+      - "!VERSION"
+      - "!submanifests/**/*"
+      - "!MAINTAINERS.yml"
+      - "!version.h.in"
+      - "!Jenkinsfile"
+      - "!**/*.md"
+
+"CI-iot-zephyr-lwm2m-test":
+  - "drivers/console/**/*"
+  - "drivers/flash/**/*"
+  - "subsys/dfu/boot/**/*"
+  - "subsys/net/ip/**/*"
+  - "subsys/net/lib/http/**/*"
+  - "subsys/net/lib/lwm2m//**/*"
+  - "subsys/net/**/*"
+
+"CI-iot-samples-test":
+  - "boards/nordic/nrf9160dk/**/*"
+  - "dts/arm/nordic/nrf9160*"
+  - "include/net/**/*"
+  - "subsys/net/lib/**/*"
+
+"CI-iot-libraries-test":
+  - "boards/nordic/nrf9160dk/**/*"
+  - "dts/arm/nordic/nrf9160*"
+  - "include/net/socket_ncs.h"
+  - "subsys/testsuite/ztest/**/*"
+
+"CI-lwm2m-test": null
+# Not necessary to run tests on changes to this repo.
+
+"CI-boot-test":
+  - "subsys/mgmt/mcumgr/**/*"
+  - "subsys/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "include/dfu/**/*"
+  - "samples/subsys/mgmt/mcumgr/smp_svr/**/*"
+  - "tests/boot/**/*"
+  - "tests/subsys/dfu/**/*"
+  - "tests/subsys/mgmt/mcumgr/**/*"
+
+"CI-tfm-test":
+  - "boards/nordic/nrf5340dk/**/*"
+  - "boards/nordic/nrf9160dk/**/*"
+  - "drivers/entropy/*"
+  - "dts/arm/nordic/nrf5340*"
+  - "dts/arm/nordic/nrf9160*"
+  - "modules/trusted-firmware-m/**/*"
+  - "samples/tfm_integration/**/*"
+
+"CI-ble-test":
+  - any:
+      - "drivers/bluetooth/**/*"
+  - any:
+      - "dts/arm/nordic/nrf5*"
+  - any:
+      - "subsys/bluetooth/**/*"
+      - "!subsys/bluetooth/mesh/**/*"
+      - "!subsys/bluetooth/audio/**/*"
+  - any:
+      - "include/zephyr/bluetooth/**/*"
+      - "!include/zephyr/bluetooth/mesh/**/*"
+  - "samples/bluetooth/hci_ipc/**/*"
+
+"CI-ble-samples-test":
+  - any:
+      - "drivers/bluetooth/**/*"
+  - any:
+      - "dts/arm/nordic/nrf5*"
+  - any:
+      - "subsys/bluetooth/**/*"
+      - "!subsys/bluetooth/mesh/**/*"
+      - "!subsys/bluetooth/audio/**/*"
+  - any:
+      - "include/zephyr/bluetooth/**/*"
+      - "!include/zephyr/bluetooth/mesh/**/*"
+  - "samples/bluetooth/**/*"
+
+"CI-mesh-test":
+  - "subsys/bluetooth/mesh/**/*"
+  - "include/zephyr/bluetooth/mesh/**/*"
+  - "samples/bluetooth/mesh/**/*"
+  - "samples/bluetooth/mesh_demo/**/*"
+  - "samples/bluetooth/mesh_provisioner/**/*"
+  - "tests/bluetooth/mesh/**/*"
+  - "tests/bluetooth/mesh_shell/**/*"
+
+"CI-zigbee-test":
+  - "subsys/mgmt/mcumgr/**/*"
+  - "subsys/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "include/dfu/**/*"
+
+"CI-thingy91-test":
+  - "boards/nordic/nrf9160dk/**/*"
+  - "arch/x86/core/**/*"
+  - "arch/x86/include/**/*"
+  - "drivers/console/**/*"
+  - "drivers/ethernet/**/*"
+  - "drivers/flash/**/*"
+  - "drivers/hwinfo/**/*"
+  - "drivers/interrupt_controller/**/*"
+  - "drivers/net/**/*"
+  - "drivers/serial/**/*"
+  - "drivers/timer/**/*"
+  - "include/**/*"
+  - "kernel/**/*"
+  - "lib/libc/common/source/stdlib/**/*"
+  - "lib/libc/newlib/**/*"
+  - "lib/libc/picolibc/**/*"
+  - "lib/os/**/*"
+  - "lib/posix/**/*"
+  - "misc/**/*"
+  - "modules/mbedtls/**/*"
+  - "soc/x86/ia32/**/*"
+  - "subsys/fs/fcb/**/*"
+  - "subsys/logging/**/*"
+  - "subsys/net/**/*"
+  - "subsys/random/**/*"
+  - "subsys/settings/include/**/*"
+  - "subsys/settings/src/**/*"
+  - "subsys/stats/**/*"
+  - "subsys/storage/flash_map/**/*"
+  - "subsys/storage/stream/**/*"
+  - "subsys/tracing/**/*"
+
+"CI-desktop-test":
+  - "drivers/bluetooth/*"
+  - "subsys/bluetooth/*"
+  - "include/zephyr/bluetooth/*"
+
+"CI-crypto-test":
+  - "boards/nordic/nrf52840dk/**/*"
+  - "boards/nordic/nrf5340dk/**/*"
+  - "boards/nordic/nrf9160dk/**/*"
+  - "drivers/entropy/*"
+  - "drivers/serial/**/*"
+  - "dts/arm/nordic/nrf52840*"
+  - "dts/arm/nordic/nrf5340*"
+  - "dts/arm/nordic/nrf9160*"
+  - "include/drivers/serial/**/*"
+  - "modules/mbedtls/**/*"
+
+"CI-fem-test":
+  - "samples/net/sockets/echo_*/**/*"
+  - any:
+      - "!.github/**/*"
+      - "!doc/**/*"
+      - "!CODEOWNERS"
+      - "!LICENSE"
+      - "!**/*.rst"
+      - "!VERSION"
+      - "!SDK_VERSION"
+      - "!MAINTAINERS.yml"
+      - "!version.h.in"
+      - "!Jenkinsfile"
+      - "!**/*.md"
+      - "!tests/**/*"
+      - "!samples/**/*"
+      - "!scripts/**/*"
+
+"CI-rs-test":
+  - "samples/net/sockets/echo_*/**/*"
+  - any:
+      - "!.github/**/*"
+      - "!doc/**/*"
+      - "!CODEOWNERS"
+      - "!LICENSE"
+      - "!**/*.rst"
+      - "!VERSION"
+      - "!SDK_VERSION"
+      - "!MAINTAINERS.yml"
+      - "!version.h.in"
+      - "!Jenkinsfile"
+      - "!**/*.md"
+      - "!tests/**/*"
+      - "!samples/**/*"
+      - "!scripts/**/*"
+
+"CI-thread-test":
+  - "include/zephyr/net/**/*"
+  - "modules/mbedtls/**/*"
+  - "modules/openthread/**/*"
+  - "samples/net/openthread/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/net/**/*"
+  - "subsys/settings/**/*"
+
+"CI-nfc-test":
+  - "drivers/bluetooth/hci/**/*"
+  - "drivers/entropy/**/*"
+  - "drivers/flash/**/*"
+  - "drivers/mbox/**/*"
+  - "drivers/spi/**/*"
+  - "lib/crc/**/*"
+  - "modules/hal_nordic/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/bluetooth/**/*"
+  - "subsys/ipc/ipc_service/**/*"
+  - "subsys/fs/**/*"
+  - "subsys/mem_mgmt/**/*"
+  - "subsys/net/**/*"
+  - "subsys/random/**/*"
+  - "subsys/settings/**/*"
+  - "subsys/shell/**/*"
+  - "subsys/storage/**/*"
+
+"CI-matter-test":
+  - "include/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/dfu/**/*"
+  - "subsys/settings/**/*"
+  - "subsys/net/**/*"
+  - "subsys/mgmt/mcumgr/**/*"
+  - "drivers/net/**/*"
+  - "samples/bluetooth/hci_ipc/**/*"
+  - any:
+      - "subsys/bluetooth/**/*"
+      - "!subsys/bluetooth/mesh/**/*"
+      - "!subsys/bluetooth/audio/**/*"
+
+"CI-find-my-test":
+  - "boards/nordic/**/*"
+  - "drivers/bluetooth/**/*"
+  - "drivers/entropy/**/*"
+  - "drivers/flash/**/*"
+  - "drivers/usb/**/*"
+  - "drivers/regulator/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/bluetooth/**/*"
+  - "subsys/dfu/**/*"
+  - "subsys/fs/**/*"
+  - "subsys/ipc/**/*"
+  - "subsys/net/**/*"
+  - "subsys/random/**/*"
+  - "subsys/settings/**/*"
+  - "subsys/storage/**/*"
+  - "subsys/tracing/**/*"
+  - "subsys/usb/device/**/*"
+
+"CI-rpc-test":
+  - "subsys/ipc/ipc_service/**/*"
+  - "subsys/random/**/*"
+  - "soc/nordic/nrf53/**/*"
+
+"CI-modemshell-test":
+  - "include/net/**/*"
+  - "include/posix/**/*"
+  - "include/shell/**/*"
+  - "drivers/net/**/*"
+  - "drivers/serial/**/*"
+  - "drivers/wifi/**/*"
+  - "subsys/shell/**/*"
+  - "subsys/net/**/*"
+  - "subsys/settings/**/*"
+
+"CI-positioning-test":
+  - "include/net/**/*"
+  - "include/posix/**/*"
+  - "drivers/net/**/*"
+  - "drivers/wifi/**/*"
+  - "subsys/net/**/*"
+  - "subsys/settings/**/*"
+
+"CI-cloud-test":
+  - "include/zephyr/dfu/**/*"
+  - "include/zephyr/net/**/*"
+  - "include/zephyr/posix/**/*"
+  - "include/zephyr/settings/**/*"
+  - "drivers/led/**/*"
+  - "drivers/net/**/*"
+  - "drivers/sensor/**/*"
+  - "drivers/serial/**/*"
+  - "drivers/wifi/**/*"
+  - "lib/posix/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/dfu/**/*"
+  - "subsys/net/**/*"
+  - "subsys/settings/**/*"
+
+"CI-wifi":
+  - "subsys/net/l2/wifi/**/*"
+  - "subsys/net/l2/ethernet/**/*"
+
+"CI-sidewalk-test":
+  - "include/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/dfu/**/*"
+  - "subsys/settings/**/*"
+  - "subsys/mgmt/mcumgr/**/*"
+  - "samples/bluetooth/hci_ipc/**/*"
+  - any:
+      - "subsys/bluetooth/**/*"
+      - "!subsys/bluetooth/mesh/**/*"
+      - "!subsys/bluetooth/audio/**/*"
+
+"CI-audio-test":
+  - "boards/nordic/nrf5340_audio_dk/**/*"
+  - "drivers/flash/**/*"
+  - "drivers/spi/**/*"
+  - "drivers/gpio/**/*"
+  - "drivers/i2c/**/*"
+  - "drivers/watchdog/**/*"
+  - "include/dfu/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "samples/bluetooth/hci_ipc/**/*"
+  - "soc/nordic/**/*"
+  - "subsys/bluetooth/audio/**/*"
+  - "subsys/bluetooth/host/**/*"
+  - "subsys/dfu/**/*"
+  - "subsys/fs/**/*"
+  - "subsys/mgmt/mcumgr/**/*"
+  - "subsys/sd/**/*"
+  - "subsys/storage/**/*"
+  - "subsys/task_wdt/**/*"
+  - "subsys/usb/**/*"
+  - "subsys/zbus/**/*"
+
+"CI-pmic-samples-test":
+  - "samples/shields/npm1300_ek/**/*"
+  - "boards/shields/npm1300_ek/**/*"
+  - "**/**npm1300**/**"
+  - "drivers/regulator/regulator_common.c"
+  - "drivers/regulator/regulator_shell.c"
+  - "drivers/gpio/gpio_shell.c"
+  - "drivers/sensor/sensor_shell.c"
+
+"CI-test-low-level":
+  - "arch/**/*"
+  - "boards/nordic/nrf54*/**/*"
+  - "drivers/**/*"
+  - "dts/**/*"
+  - "include/zephyr/**/*"
+  - "kernel/**/*"
+  - "modules/hal_nordic/**/*"
+  - "samples/basic/blinky_pwm/**/*"
+  - "samples/basic/fade_led/**/*"
+  - "samples/boards/nrf/**/*"
+  - "samples/boards/nordic/**/*"
+  - "samples/drivers/adc/**/*"
+  - "samples/drivers/jesd216/**/*"
+  - "samples/drivers/mbox/**/*"
+  - "samples/drivers/soc_flash_nrf/**/*"
+  - "samples/drivers/spi_flash/**/*"
+  - "samples/drivers/watchdog/**/*"
+  - "samples/hello_world/**/*"
+  - "samples/sensor/**/*"
+  - "samples/subsys/ipc/**/*"
+  - "samples/subsys/logging/**/*"
+  - "samples/subsys/settings/**/*"
+  - "samples/subsys/usb/cdc_acm/**/*"
+  - "samples/subsys/usb/mass/**/*"
+  - "samples/synchronization/**/*"
+  - "subsys/logging/**/*"
+  - "subsys/settings/**/*"
+  - "tests/arch/**/*"
+  - "tests/boards/nrf/**/*"
+  - "tests/boards/nordic/**/*"
+  - "tests/drivers/**/*"
+  - "tests/kernel/**/*"
+
+"CI-suit-dfu-test":
+  - "subsys/mgmt/mcumgr/**/*"
+  - "include/mgmt/mcumgr/**/*"
+  - "samples/subsys/mgmt/mcumgr/smp_svr/**/*"
+  - "subsys/bluetooth/**/*"
+  - "drivers/bluetooth/**/*"
+  - "drivers/flash/**/*"
+  - "drivers/spi/**/*"
+  - "drivers/mbox/**/*"
+  - "drivers/serial/**/*"
+  - "drivers/console/**/*"
+  - "dts/common/nordic/*"
+  - "dts/arm/nordic/nrf54h*"
+  - "dts/riscv/nordic/nrf54h*"
+  - "boards/nordic/nrf54h*"
+  - "soc/nordic/nrf54h/**/*"
+  - "include/zephyr/**/*"
+  - "subsys/logging/**/*"
+  - "subsys/tracing/**/*"
+  - "scripts/west_commands/build.py"
+  - "scripts/west_commands/flash.py"
+  - "scripts/west_commands/runners/nrfutil.py"
+  - "scripts/west_commands/runners/core.py"
+  - "scripts/west_commands/runners/nrf_common.py"
diff --git a/.github/workflows/commit-tags.yml b/.github/workflows/commit-tags.yml
new file mode 100644
index 00000000000..9e0323f9498
--- /dev/null
+++ b/.github/workflows/commit-tags.yml
@@ -0,0 +1,31 @@
+name: Commit tags
+
+on: pull_request
+
+jobs:
+  commit_tags:
+    runs-on: ubuntu-22.04
+    name: Run commit tags checks on patch series (PR)
+    steps:
+    - name: Update PATH for west
+      run: |
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+    - name: Checkout the code
+      uses: actions/checkout@v3
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        fetch-depth: 0
+
+    - name: Install python dependencies
+      run: |
+        pip3 install setuptools
+        pip3 install wheel
+        pip3 install gitlint
+
+    - name: Run the commit tags
+      uses: nrfconnect/action-commit-tags@main
+      with:
+        target: '.'
+        baserev: origin/${{ github.base_ref }}
+        revrange: 'none'
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index 39815d8baa3..c8ffedcb77b 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -49,8 +49,8 @@ jobs:
         git config --global user.name "Your Name"
         git remote -v
         # Ensure there's no merge commits in the PR
-        [[ "$(git rev-list --merges --count origin/${BASE_REF}..)" == "0" ]] || \
-        (echo "::error ::Merge commits not allowed, rebase instead";false)
+        #[[ "$(git rev-list --merges --count origin/${BASE_REF}..)" == "0" ]] || \
+        #(echo "::error ::Merge commits not allowed, rebase instead";false)
         git rebase origin/${BASE_REF}
         # debug
         git log  --pretty=oneline | head -n 10
@@ -78,8 +78,8 @@ jobs:
         git log  --pretty=oneline | head -n 10
         # Increase rename limit to allow for large PRs
         git config diff.renameLimit 10000
-        ./scripts/ci/check_compliance.py --annotate -e KconfigBasic \
-        -c origin/${BASE_REF}..
+        ./scripts/ci/check_compliance.py --annotate -e KconfigBasic -e Kconfig \
+        -e KconfigBasicNoModules -e ModulesMaintainers -c origin/${BASE_REF}..
 
     - name: upload-results
       uses: actions/upload-artifact@v4
diff --git a/.github/workflows/manifest-PR.yml b/.github/workflows/manifest-PR.yml
new file mode 100644
index 00000000000..a871aa381de
--- /dev/null
+++ b/.github/workflows/manifest-PR.yml
@@ -0,0 +1,17 @@
+name: handle manifest PR
+on:
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches:
+      - main
+
+
+jobs:
+  call-manifest-pr-action:
+    runs-on: ubuntu-latest
+    steps:
+      - name: handle manifest PR
+        uses: nrfconnect/action-manifest-pr@main
+        with:
+          token: ${{ secrets.NCS_GITHUB_TOKEN }}
+          manifest-pr-title-details: ${{ github.event.pull_request.title }}
diff --git a/CODEOWNERS b/CODEOWNERS
index 4c737dc9642..8ba6e3c5b78 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -18,6 +18,7 @@
 # component or code. This file is going to be deprecated and currently only had
 # entries that are not covered by the MAINTAINERS file.
 
+/.github/test-spec.yml                    @nrfconnect/ncs-test-leads
 /soc/arm/aspeed/                          @aspeeddylan
 /soc/atmel/                               @nandojve
 /soc/arm/bcm*/                            @sbranden
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 00000000000..3b9cf002239
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,5 @@
+@Library("CI_LIB") _
+
+def pipeline = new ncs.sdk_zephyr.Main()
+
+pipeline.run(JOB_NAME)
diff --git a/Kconfig.zephyr b/Kconfig.zephyr
index 425d79f4e74..f97819896d9 100644
--- a/Kconfig.zephyr
+++ b/Kconfig.zephyr
@@ -17,13 +17,13 @@ osource "${APPLICATION_SOURCE_DIR}/VERSION"
 # Shield defaults should have precedence over board defaults, which should have
 # precedence over SoC defaults, so include them in that order.
 #
-# $ARCH and $BOARD_DIR will be glob patterns when building documentation.
+# $ARCH and $KCONFIG_BOARD_DIR will be glob patterns when building documentation.
 # This loads custom shields defconfigs (from BOARD_ROOT)
 osource "$(KCONFIG_BINARY_DIR)/Kconfig.shield.defconfig"
 # This loads Zephyr base shield defconfigs
 source "boards/shields/*/Kconfig.defconfig"
 
-osource "$(BOARD_DIR)/Kconfig.defconfig"
+osource "$(KCONFIG_BOARD_DIR)/Kconfig.defconfig"
 
 # This loads Zephyr specific SoC root defconfigs
 source "$(KCONFIG_BINARY_DIR)/soc/Kconfig.defconfig"
diff --git a/MAINTAINERS.yml b/MAINTAINERS.yml
index b4bf261ec29..cc7cb9a1411 100644
--- a/MAINTAINERS.yml
+++ b/MAINTAINERS.yml
@@ -975,7 +975,6 @@ Documentation:
     - doc/images/Zephyr-Kite-in-tree.png
     - doc/index-tex.rst
     - doc/index.rst
-    - doc/kconfig.rst
     - doc/templates/sample.tmpl
     - doc/templates/board.tmpl
     - boards/index.rst
diff --git a/arch/arm/core/mpu/arm_mpu_regions.c b/arch/arm/core/mpu/arm_mpu_regions.c
index 6af62f84078..cfe1230c907 100644
--- a/arch/arm/core/mpu/arm_mpu_regions.c
+++ b/arch/arm/core/mpu/arm_mpu_regions.c
@@ -8,6 +8,9 @@
 #include <zephyr/arch/arm/mpu/arm_mpu.h>
 
 #include <zephyr/arch/arm/cortex_m/arm_mpu_mem_cfg.h>
+#if USE_PARTITION_MANAGER
+#include <pm_config.h>
+#endif
 
 static const struct arm_mpu_region mpu_regions[] = {
 	/* Region 0 */
@@ -21,6 +24,14 @@ static const struct arm_mpu_region mpu_regions[] = {
 #endif
 	/* Region 1 */
 	MPU_REGION_ENTRY("SRAM_0",
+#if USE_PARTITION_MANAGER
+			 PM_SRAM_ADDRESS,
+#if defined(CONFIG_ARMV8_M_BASELINE) || defined(CONFIG_ARMV8_M_MAINLINE)
+			 REGION_RAM_ATTR(PM_SRAM_ADDRESS, PM_SRAM_SIZE)),
+#else
+			 REGION_RAM_ATTR(REGION_SRAM_SIZE)),
+#endif
+#else
 			 CONFIG_SRAM_BASE_ADDRESS,
 #if defined(CONFIG_ARMV8_M_BASELINE) || defined(CONFIG_ARMV8_M_MAINLINE)
 			 REGION_RAM_ATTR(CONFIG_SRAM_BASE_ADDRESS, \
@@ -28,6 +39,8 @@ static const struct arm_mpu_region mpu_regions[] = {
 #else
 			 REGION_RAM_ATTR(REGION_SRAM_SIZE)),
 #endif
+
+#endif /* USE_PARTITION_MANAGER */
 };
 
 const struct arm_mpu_config mpu_config = {
diff --git a/boards/Kconfig b/boards/Kconfig
index 6eb9ca5916d..8f186b32caf 100644
--- a/boards/Kconfig
+++ b/boards/Kconfig
@@ -129,7 +129,7 @@ config QEMU_EXTRA_FLAGS
 	  GDBstub over serial with `-serial tcp:127.0.0.1:5678,server`
 
 # There might not be any board options, hence the optional source
-osource "$(BOARD_DIR)/Kconfig"
+osource "$(KCONFIG_BOARD_DIR)/Kconfig"
 endmenu
 
 config BOARD_HAS_TIMING_FUNCTIONS
diff --git a/boards/Kconfig.v1 b/boards/Kconfig.v1
index 670e2f2376e..c98bd27d2db 100644
--- a/boards/Kconfig.v1
+++ b/boards/Kconfig.v1
@@ -2,9 +2,13 @@
 
 # SPDX-License-Identifier: Apache-2.0
 
+# In HWMv1 the KCONFIG_BOARD_DIR points directly to the BOARD_DIR.
+# Set the BOARD_DIR variable for backwards compatibility to legacy hardware model.
+BOARD_DIR := $(KCONFIG_BOARD_DIR)
+
 choice
 	prompt "Board Selection"
 
-source "$(BOARD_DIR)/Kconfig.board"
+source "$(KCONFIG_BOARD_DIR)/Kconfig.board"
 
 endchoice
diff --git a/boards/Kconfig.v2 b/boards/Kconfig.v2
index 47bb3ae2240..6fce9ccb99d 100644
--- a/boards/Kconfig.v2
+++ b/boards/Kconfig.v2
@@ -25,4 +25,4 @@ config BOARD_QUALIFIERS
 	  For example, if building for ``nrf5340dk/nrf5340/cpuapp`` then this will contain the
 	  value ``nrf5340/cpuapp``.
 
-osource "$(BOARD_DIR)/Kconfig.$(BOARD)"
+osource "$(KCONFIG_BOARD_DIR)/Kconfig.$(BOARD)"
diff --git a/boards/nordic/nrf54h20dk/CMakeLists.txt b/boards/nordic/nrf54h20dk/CMakeLists.txt
new file mode 100644
index 00000000000..a5a06d8805a
--- /dev/null
+++ b/boards/nordic/nrf54h20dk/CMakeLists.txt
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: Apache-2.0
+
+zephyr_library()
+if(CONFIG_NRFS_MRAM_SERVICE_ENABLED)
+  zephyr_library_sources(board.c)
+endif()
diff --git a/boards/nordic/nrf54h20dk/Kconfig.defconfig b/boards/nordic/nrf54h20dk/Kconfig.defconfig
index e37975f96ad..a2be74d3648 100644
--- a/boards/nordic/nrf54h20dk/Kconfig.defconfig
+++ b/boards/nordic/nrf54h20dk/Kconfig.defconfig
@@ -14,3 +14,11 @@ config BT_CTLR
 	default y if BT
 
 endif # BOARD_NRF54H20DK_NRF54H20_CPURAD
+
+if BOARD_NRF54H20DK_NRF54H20_CPUPPR
+
+# As PPR has limited memory most of tests does not fit with asserts enabled.
+config ASSERT
+	default n if ZTEST
+
+endif # BOARD_NRF54H20DK_NRF54H20_CPUPPR
diff --git a/boards/nordic/nrf54h20dk/board.c b/boards/nordic/nrf54h20dk/board.c
new file mode 100644
index 00000000000..0699e93a7c3
--- /dev/null
+++ b/boards/nordic/nrf54h20dk/board.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/init.h>
+
+#define MODULE mram_suspend_off
+#include <zephyr/logging/log.h>
+LOG_MODULE_REGISTER(MODULE);
+
+#include <services/nrfs_mram.h>
+#include <nrfs_backend_ipc_service.h>
+
+#define MRAM_SUSPEND_OFF_INIT_PRIO 90
+
+void mram_latency_handler(nrfs_mram_latency_evt_t const *p_evt, void *context)
+{
+	switch (p_evt->type) {
+	case NRFS_MRAM_LATENCY_REQ_APPLIED:
+		LOG_DBG("MRAM latency handler: response received");
+		break;
+	case NRFS_MRAM_LATENCY_REQ_REJECTED:
+		LOG_ERR("MRAM latency handler - request rejected!");
+		break;
+	default:
+		LOG_ERR("MRAM latency handler - unexpected event: 0x%x", p_evt->type);
+		break;
+	}
+}
+
+static int turn_off_suspend_mram(void)
+{
+	/* Turn off mram automatic suspend as it causes delays in time depended code sections. */
+
+	nrfs_err_t err = NRFS_SUCCESS;
+
+	/* Wait for ipc initialization */
+	nrfs_backend_wait_for_connection(K_FOREVER);
+
+	err = nrfs_mram_init(mram_latency_handler);
+	if (err != NRFS_SUCCESS) {
+		LOG_ERR("MRAM service init failed: %d", err);
+	} else {
+		LOG_DBG("MRAM service initialized");
+	}
+
+	LOG_DBG("MRAM: set latency: NOT ALLOWED");
+	err = nrfs_mram_set_latency(MRAM_LATENCY_NOT_ALLOWED, NULL);
+	if (err) {
+		LOG_ERR("MRAM: set latency failed (%d)", err);
+	}
+
+	return err;
+}
+
+SYS_INIT(turn_off_suspend_mram, APPLICATION, MRAM_SUSPEND_OFF_INIT_PRIO);
diff --git a/boards/nordic/nrf54h20dk/nrf54h20dk_bicr.dtsi b/boards/nordic/nrf54h20dk/nrf54h20dk_bicr.dtsi
new file mode 100644
index 00000000000..34652755564
--- /dev/null
+++ b/boards/nordic/nrf54h20dk/nrf54h20dk_bicr.dtsi
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+ */
+
+/ {
+	bicr: bicr@fff87b0 {
+		compatible = "nordic,nrf-bicr";
+		reg = <0xfff87b0 0x48>;
+
+		power-vddao5v0 = "external";
+		power-vddao1v8 = "internal";
+		power-vdd1v0 = "internal";
+		power-vddrf1v0 = "shorted";
+		power-vddao0v8 = "internal";
+		power-vddvs0v8 = "internal";
+
+		inductor-present;
+
+		ioport-power-rails = <&gpio1 2>, <&gpio2 2>, <&gpio6 2>, <&gpio7 2>, <&gpio9 4>;
+		ioport-drivectrls = <&gpio6 50>, <&gpio7 50>;
+
+		lfosc-mode = "crystal";
+		lfosc-loadcap = <15>;
+
+		lfrc-autocalibration = <20 40 3>;
+
+		hfxo-mode = "crystal";
+		hfxo-loadcap = <56>;
+	};
+};
+
+&gpio1 {
+	#ioport-power-rail-cells = <1>;
+};
+
+&gpio2 {
+	#ioport-power-rail-cells = <1>;
+};
+
+&gpio6 {
+	#ioport-power-rail-cells = <1>;
+	#ioport-drivectrl-cells = <1>;
+};
+
+&gpio7 {
+	#ioport-power-rail-cells = <1>;
+	#ioport-drivectrl-cells = <1>;
+};
+
+&gpio9 {
+	#ioport-power-rail-cells = <1>;
+};
diff --git a/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpuapp.dts b/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpuapp.dts
index 517b6ed853c..3c7a5436a08 100644
--- a/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpuapp.dts
+++ b/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpuapp.dts
@@ -8,6 +8,7 @@
 
 #include <nordic/nrf54h20_cpuapp.dtsi>
 #include "nrf54h20dk_nrf54h20-common.dtsi"
+#include "nrf54h20dk_bicr.dtsi"
 
 /delete-node/ &cpurad_cpusys_ipc;
 /delete-node/ &cpusec_cpurad_ipc;
@@ -26,6 +27,7 @@
 		zephyr,bt-hci = &bt_hci_ipc0;
 		nordic,802154-spinel-ipc = &ipc0;
 		zephyr,canbus = &can120;
+		zephyr,entropy = &prng;
 	};
 
 	aliases {
@@ -106,6 +108,11 @@
 			pwms = <&pwm130 0 PWM_MSEC(20) PWM_POLARITY_NORMAL>;
 		};
 	};
+
+	prng: prng {
+		compatible = "nordic,entropy-prng";
+		status = "okay";
+	};
 };
 
 &cpuapp_ram0x_region {
diff --git a/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpurad.dts b/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpurad.dts
index 31c345899cd..760d7ef34f9 100644
--- a/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpurad.dts
+++ b/boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpurad.dts
@@ -27,6 +27,11 @@
 		zephyr,ieee802154 = &cpurad_ieee802154;
 		zephyr,bt-hci-ipc = &ipc0;
 		nordic,802154-spinel-ipc = &ipc0;
+		zephyr,entropy = &prng;
+	};
+	prng: prng {
+		compatible = "nordic,entropy-prng";
+		status = "okay";
 	};
 	aliases {
 		ipc-to-cpusys = &cpurad_cpusys_ipc;
diff --git a/boards/nordic/nrf54l15dk/Kconfig.defconfig b/boards/nordic/nrf54l15dk/Kconfig.defconfig
index 2b753df3515..06a426bd8ed 100644
--- a/boards/nordic/nrf54l15dk/Kconfig.defconfig
+++ b/boards/nordic/nrf54l15dk/Kconfig.defconfig
@@ -7,6 +7,7 @@ config BT_CTLR
 	default BT
 
 config ROM_START_OFFSET
+	default 0 if PARTITION_MANAGER_ENABLED
 	default 0x800 if BOOTLOADER_MCUBOOT
 
 endif # BOARD_NRF54L15DK_NRF54L15_CPUAPP
diff --git a/boards/nordic/nrf54l15pdk/Kconfig b/boards/nordic/nrf54l15pdk/Kconfig
new file mode 100644
index 00000000000..841c93c51f0
--- /dev/null
+++ b/boards/nordic/nrf54l15pdk/Kconfig
@@ -0,0 +1,43 @@
+# nRF54L15 PDK board configuration
+
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+if BOARD_NRF54L15PDK_NRF54L15_CPUAPP
+
+config BOARD_ENABLE_DCDC
+	bool "DCDC mode"
+	select SOC_NRF54L_VREG_MAIN_DCDC
+	default y
+
+endif # BOARD_NRF54L15PDK_NRF54L15_CPUAPP
+
+if BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS
+
+config NRF_MPC_REGION_SIZE
+	hex
+	default 0x1000
+	help
+	  Region size for the Memory Protection Controller (MPC) in bytes.
+
+config NRF_TRUSTZONE_FLASH_REGION_SIZE
+	hex
+	default NRF_MPC_REGION_SIZE
+	help
+	  This defines the flash region size from the TRUSTZONE perspective.
+	  It is used when configuring the TRUSTZONE and when setting alignments
+	  requirements for the partitions.
+	  This abstraction allows us to configure TRUSTZONE without depending
+	  on peripheral specific symbols.
+
+config NRF_TRUSTZONE_RAM_REGION_SIZE
+	hex
+	default NRF_MPC_REGION_SIZE
+	help
+	  This defines the RAM region size from the TRUSTZONE perspective.
+	  It is used when configuring the TRUSTZONE and when setting alignments
+	  requirements for the partitions.
+	  This abstraction allows us to configure TRUSTZONE without depending
+	  on peripheral specific symbols.
+
+endif #BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS
diff --git a/boards/nordic/nrf54l15pdk/Kconfig.defconfig b/boards/nordic/nrf54l15pdk/Kconfig.defconfig
index 1c83abbb020..819ddf25aba 100644
--- a/boards/nordic/nrf54l15pdk/Kconfig.defconfig
+++ b/boards/nordic/nrf54l15pdk/Kconfig.defconfig
@@ -7,6 +7,33 @@ config BT_CTLR
 	default BT
 
 config ROM_START_OFFSET
+	default 0 if PARTITION_MANAGER_ENABLED
 	default 0x800 if BOOTLOADER_MCUBOOT
 
 endif # BOARD_NRF54L15PDK_NRF54L15_CPUAPP
+
+if BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS
+
+config BT_CTLR
+	default BT
+
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y if BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS
+
+# By default, if we build with TF-M, instruct build system to
+# flash the combined TF-M (Secure) & Zephyr (Non Secure) image
+config TFM_FLASH_MERGED_BINARY
+	default y
+	depends on BUILD_WITH_TFM
+
+endif #BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS
+
+if BOARD_NRF54L15PDK_NRF54L15_CPUFLPR || BOARD_NRF54L15PDK_NRF54L15_CPUFLPR_XIP
+
+# As FLPR has limited memory most of tests does not fit with asserts enabled.
+config ASSERT
+	default n if ZTEST
+
+endif # BOARD_NRF54L15PDK_NRF54L15_CPUFLPR || BOARD_NRF54L15PDK_NRF54L15_CPUFLPR_XIP
diff --git a/boards/nordic/nrf54l15pdk/Kconfig.nrf54l15pdk b/boards/nordic/nrf54l15pdk/Kconfig.nrf54l15pdk
index d5116bd50c6..09afebc2e09 100644
--- a/boards/nordic/nrf54l15pdk/Kconfig.nrf54l15pdk
+++ b/boards/nordic/nrf54l15pdk/Kconfig.nrf54l15pdk
@@ -2,6 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 
 config BOARD_NRF54L15PDK
-	select SOC_NRF54L15_ENGA_CPUAPP if BOARD_NRF54L15PDK_NRF54L15_CPUAPP
+	select SOC_NRF54L15_ENGA_CPUAPP if BOARD_NRF54L15PDK_NRF54L15_CPUAPP || BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS
 	select SOC_NRF54L15_ENGA_CPUFLPR if BOARD_NRF54L15PDK_NRF54L15_CPUFLPR || \
 					    BOARD_NRF54L15PDK_NRF54L15_CPUFLPR_XIP
diff --git a/boards/nordic/nrf54l15pdk/board.cmake b/boards/nordic/nrf54l15pdk/board.cmake
index 4a6a86a8f8a..1427b6e9154 100644
--- a/boards/nordic/nrf54l15pdk/board.cmake
+++ b/boards/nordic/nrf54l15pdk/board.cmake
@@ -7,6 +7,14 @@ elseif (CONFIG_SOC_NRF54L15_ENGA_CPUFLPR)
   board_runner_args(jlink "--speed=4000")
 endif()
 
-include(${ZEPHYR_BASE}/boards/common/nrfutil.board.cmake)
+if(BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS)
+  set(TFM_PUBLIC_KEY_FORMAT "full")
+endif()
+
+if(CONFIG_TFM_FLASH_MERGED_BINARY)
+  set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
+endif()
+
 include(${ZEPHYR_BASE}/boards/common/nrfjprog.board.cmake)
+include(${ZEPHYR_BASE}/boards/common/nrfutil.board.cmake)
 include(${ZEPHYR_BASE}/boards/common/jlink.board.cmake)
diff --git a/boards/nordic/nrf54l15pdk/board.yml b/boards/nordic/nrf54l15pdk/board.yml
index e692040f7bd..5df0270abe3 100644
--- a/boards/nordic/nrf54l15pdk/board.yml
+++ b/boards/nordic/nrf54l15pdk/board.yml
@@ -6,6 +6,8 @@ board:
     variants:
     - name: xip
       cpucluster: cpuflpr
+    - name: ns
+      cpucluster: cpuapp
   revision:
     format: major.minor.patch
     default: "0.3.0"
diff --git a/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns.dts b/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns.dts
new file mode 100644
index 00000000000..6e05c69c5f9
--- /dev/null
+++ b/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns.dts
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+
+#define USE_NON_SECURE_ADDRESS_MAP 1
+
+#include "nrf54l15_cpuapp_common.dtsi"
+
+/ {
+	compatible = "nordic,nrf54l15pdk_nrf54l15-cpuapp";
+	model = "Nordic nRF54L15 PDK nRF54L15 Application MCU";
+
+	chosen {
+		zephyr,code-partition = &slot0_partition;
+		zephyr,sram = &cpuapp_sram;
+	};
+};
+
+&uart30 {
+	/* Disable so that TF-M can use this UART */
+	status = "disabled";
+
+	current-speed = <115200>;
+	pinctrl-0 = <&uart30_default>;
+	pinctrl-1 = <&uart30_sleep>;
+	pinctrl-names = "default", "sleep";
+};
diff --git a/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns.yaml b/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns.yaml
new file mode 100644
index 00000000000..460803eaa53
--- /dev/null
+++ b/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns.yaml
@@ -0,0 +1,22 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+identifier: nrf54l15pdk/nrf54l15/cpuapp/ns
+name: nRF54l15-PDK-nRF54l15-Application-Non-Secure
+type: mcu
+arch: arm
+toolchain:
+  - gnuarmemb
+  - xtools
+  - zephyr
+ram: 256
+flash: 1524
+supported:
+  - adc
+  - gpio
+  - i2c
+  - spi
+  - counter
+  - watchdog
+  - adc
+  - i2s
diff --git a/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns_defconfig b/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns_defconfig
new file mode 100644
index 00000000000..70f01d7c9ba
--- /dev/null
+++ b/boards/nordic/nrf54l15pdk/nrf54l15pdk_nrf54l15_cpuapp_ns_defconfig
@@ -0,0 +1,31 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+# Enable MPU
+CONFIG_ARM_MPU=y
+
+# Enable hardware stack protection
+CONFIG_HW_STACK_PROTECTION=y
+
+CONFIG_NULL_POINTER_EXCEPTION_DETECTION_NONE=y
+
+# Enable TrustZone-M
+CONFIG_ARM_TRUSTZONE_M=y
+
+# This Board implies building Non-Secure firmware
+CONFIG_TRUSTED_EXECUTION_NONSECURE=y
+
+# Don't enable the cache in the non-secure image as it is a
+# secure-only peripheral on 54l
+CONFIG_CACHE_MANAGEMENT=n
+CONFIG_EXTERNAL_CACHE=n
+
+CONFIG_UART_CONSOLE=y
+CONFIG_CONSOLE=y
+CONFIG_SERIAL=y
+
+# Enable GPIO
+CONFIG_GPIO=y
+
+# Start SYSCOUNTER on driver init
+CONFIG_NRF_GRTC_START_SYSCOUNTER=y
diff --git a/boards/nordic/nrf9131ek/Kconfig.defconfig b/boards/nordic/nrf9131ek/Kconfig.defconfig
index b63e7ef8d34..8e0e1d02d1d 100644
--- a/boards/nordic/nrf9131ek/Kconfig.defconfig
+++ b/boards/nordic/nrf9131ek/Kconfig.defconfig
@@ -5,6 +5,21 @@
 
 if BOARD_NRF9131EK_NRF9131 || BOARD_NRF9131EK_NRF9131_NS
 
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y if BOARD_NRF9131EK_NRF9131_NS
+
+if BUILD_WITH_TFM
+
+# By default, if we build with TF-M, instruct build system to
+# flash the combined TF-M (Secure) & Zephyr (Non Secure) image
+config TFM_FLASH_MERGED_BINARY
+	bool
+	default y
+
+endif # BUILD_WITH_TFM
+
 # For the secure version of the board the firmware is linked at the beginning
 # of the flash, or into the code-partition defined in DT if it is intended to
 # be loaded by MCUboot. If the secure firmware is to be combined with a non-
diff --git a/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpuapp.dts b/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpuapp.dts
index ceb4ddc3ff1..c01824a2297 100644
--- a/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpuapp.dts
+++ b/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpuapp.dts
@@ -28,6 +28,7 @@
 		zephyr,bt-hci = &bt_hci_ipc0;
 		nordic,802154-spinel-ipc = &ipc0;
 		zephyr,canbus = &can120;
+		zephyr,entropy = &prng;
 	};
 
 	aliases {
@@ -108,6 +109,11 @@
 			pwms = <&pwm130 0 PWM_MSEC(20) PWM_POLARITY_NORMAL>;
 		};
 	};
+
+	prng: prng {
+		compatible = "nordic,entropy-prng";
+		status = "okay";
+	};
 };
 
 &cpuapp_ram0x_region {
diff --git a/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpurad.dts b/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpurad.dts
index 1235f53df2b..a45a00e5905 100644
--- a/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpurad.dts
+++ b/boards/nordic/nrf9280pdk/nrf9280pdk_nrf9280_cpurad.dts
@@ -28,6 +28,11 @@
 		zephyr,ieee802154 = &cpurad_ieee802154;
 		zephyr,bt-hci-ipc = &ipc0;
 		nordic,802154-spinel-ipc = &ipc0;
+		zephyr,entropy = &prng;
+	};
+	prng: prng {
+		compatible = "nordic,entropy-prng";
+		status = "okay";
 	};
 	aliases {
 		ipc-to-cpusys = &cpurad_cpusys_ipc;
diff --git a/boards/nordic/thingy53/Kconfig.defconfig b/boards/nordic/thingy53/Kconfig.defconfig
index 92eac11503d..31ac0093ba2 100644
--- a/boards/nordic/thingy53/Kconfig.defconfig
+++ b/boards/nordic/thingy53/Kconfig.defconfig
@@ -5,6 +5,12 @@
 
 if BOARD_THINGY53_NRF5340_CPUAPP || BOARD_THINGY53_NRF5340_CPUAPP_NS
 
+config BOOTLOADER_MCUBOOT
+	default y if !MCUBOOT
+
+config BOARD_ENABLE_CPUNET
+	default y if !MCUBOOT
+
 # Code Partition:
 #
 # For the secure version of the board the firmware is linked at the beginning
@@ -132,6 +138,16 @@ endif # LOG
 
 endif # BOARD_SERIAL_BACKEND_CDC_ACM
 
+# By default, a USB CDC ACM instance is already enabled in the board's DTS.
+# It is not necessary for nRF Connect SDK to add another instance if MCUBoot
+# bootloader is built as a child image.
+config MCUBOOT_USB_SUPPORT
+	bool
+	default n
+
+config NORDIC_QSPI_NOR
+	default y
+
 endif # BOARD_THINGY53_NRF5340_CPUAPP || BOARD_THINGY53_NRF5340_CPUAPP_NS
 
 if BOARD_THINGY53_NRF5340_CPUNET
diff --git a/boards/nordic/thingy53/Kconfig.sysbuild b/boards/nordic/thingy53/Kconfig.sysbuild
new file mode 100644
index 00000000000..df489c1dd54
--- /dev/null
+++ b/boards/nordic/thingy53/Kconfig.sysbuild
@@ -0,0 +1,29 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+if BOARD_THINGY53_NRF5340_CPUAPP || BOARD_THINGY53_NRF5340_CPUAPP_NS
+
+choice BOOTLOADER
+	default BOOTLOADER_MCUBOOT
+endchoice
+
+choice MCUBOOT_MODE
+	default MCUBOOT_MODE_OVERWRITE_ONLY
+endchoice
+
+config SECURE_BOOT_NETCORE
+	default y
+
+config NETCORE_APP_UPDATE
+	default y if SECURE_BOOT_NETCORE
+
+config NRF_DEFAULT_EMPTY
+	default y if SECURE_BOOT_NETCORE
+
+config MCUBOOT_USE_ALL_AVAILABLE_RAM
+	default y if BOARD_THINGY53_NRF5340_CPUAPP_NS && BOOTLOADER_MCUBOOT
+
+endif # BOARD_THINGY53_NRF5340_CPUAPP || BOARD_THINGY53_NRF5340_CPUAPP_NS
+
+config PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY
+	default y if BOOTLOADER_MCUBOOT
diff --git a/boards/nordic/thingy53/pm_static_thingy53_nrf5340_cpuapp.yml b/boards/nordic/thingy53/pm_static_thingy53_nrf5340_cpuapp.yml
new file mode 100644
index 00000000000..7a48d51ec33
--- /dev/null
+++ b/boards/nordic/thingy53/pm_static_thingy53_nrf5340_cpuapp.yml
@@ -0,0 +1,55 @@
+app:
+  address: 0x10200
+  region: flash_primary
+  size: 0xdfe00
+mcuboot:
+  address: 0x0
+  region: flash_primary
+  size: 0x10000
+mcuboot_pad:
+  address: 0x10000
+  region: flash_primary
+  size: 0x200
+mcuboot_primary:
+  address: 0x10000
+  orig_span: &id001
+  - mcuboot_pad
+  - app
+  region: flash_primary
+  size: 0xe0000
+  span: *id001
+mcuboot_primary_app:
+  address: 0x10200
+  orig_span: &id002
+  - app
+  region: flash_primary
+  size: 0xdfe00
+  span: *id002
+settings_storage:
+  address: 0xf0000
+  region: flash_primary
+  size: 0x10000
+mcuboot_primary_1:
+  address: 0x0
+  size: 0x40000
+  device: flash_ctrl
+  region: ram_flash
+mcuboot_secondary:
+  address: 0x00000
+  size: 0xe0000
+  device: MX25R64
+  region: external_flash
+mcuboot_secondary_1:
+  address: 0xe0000
+  size: 0x40000
+  device: MX25R64
+  region: external_flash
+external_flash:
+  address: 0x120000
+  size: 0x6e0000
+  device: MX25R64
+  region: external_flash
+pcd_sram:
+  address: 0x20000000
+  size: 0x2000
+  region: sram_primary
diff --git a/boards/nordic/thingy53/pm_static_thingy53_nrf5340_cpuapp_ns.yml b/boards/nordic/thingy53/pm_static_thingy53_nrf5340_cpuapp_ns.yml
new file mode 100644
index 00000000000..70ffe6d9c12
--- /dev/null
+++ b/boards/nordic/thingy53/pm_static_thingy53_nrf5340_cpuapp_ns.yml
@@ -0,0 +1,73 @@
+mcuboot:
+  address: 0x0
+  region: flash_primary
+  size: 0x10000
+mcuboot_pad:
+  address: 0x10000
+  region: flash_primary
+  size: 0x200
+tfm_secure:
+  address: 0x10000
+  size: 0xc000
+  span: [mcuboot_pad, tfm]
+tfm_nonsecure:
+  address: 0x1c000
+  size: 0xd4000
+  span: [app]
+tfm:
+  address: 0x10200
+  region: flash_primary
+  size: 0xbe00
+app:
+  address: 0x1c000
+  region: flash_primary
+  size: 0xd4000
+mcuboot_primary:
+  address: 0x10000
+  orig_span: &id001
+  - mcuboot_pad
+  - tfm
+  - app
+  region: flash_primary
+  size: 0xe0000
+  span: *id001
+mcuboot_primary_app:
+  address: 0x10200
+  orig_span: &id002
+  - tfm
+  - app
+  region: flash_primary
+  size: 0xdfe00
+  span: *id002
+nonsecure_storage:
+  address: 0xf0000
+  size: 0x10000
+  span: [settings_storage]
+settings_storage:
+  address: 0xf0000
+  region: flash_primary
+  size: 0x10000
+mcuboot_primary_1:
+  address: 0x0
+  size: 0x40000
+  device: flash_ctrl
+  region: ram_flash
+mcuboot_secondary:
+  address: 0x00000
+  size: 0xe0000
+  device: MX25R64
+  region: external_flash
+mcuboot_secondary_1:
+  address: 0xe0000
+  size: 0x40000
+  device: MX25R64
+  region: external_flash
+external_flash:
+  address: 0x120000
+  size: 0x6e0000
+  device: MX25R64
+  region: external_flash
+pcd_sram:
+  address: 0x20000000
+  size: 0x2000
+  region: sram_primary
diff --git a/boards/nordic/thingy53/thingy53_nrf5340_common.dtsi b/boards/nordic/thingy53/thingy53_nrf5340_common.dtsi
index 13a58443871..926d6377f5c 100644
--- a/boards/nordic/thingy53/thingy53_nrf5340_common.dtsi
+++ b/boards/nordic/thingy53/thingy53_nrf5340_common.dtsi
@@ -18,6 +18,7 @@
 		zephyr,bt-hci = &bt_hci_ipc0;
 		nordic,802154-spinel-ipc = &ipc0;
 		zephyr,ieee802154 = &ieee802154;
+		nordic,pm-ext-flash = &mx25r64;
 	};
 
 	buttons {
diff --git a/boards/shields/nrf7002eb/Kconfig.shield b/boards/shields/nrf7002eb/Kconfig.shield
new file mode 100644
index 00000000000..e369cfe3de4
--- /dev/null
+++ b/boards/shields/nrf7002eb/Kconfig.shield
@@ -0,0 +1,8 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+config SHIELD_NRF7002EB
+	def_bool $(shields_list_contains,nrf7002eb)
+
+config SHIELD_NRF7002EB_COEX
+	def_bool $(shields_list_contains,nrf7002eb_coex)
diff --git a/boards/shields/nrf7002eb/boards/thingy53_nrf5340_cpuapp.overlay b/boards/shields/nrf7002eb/boards/thingy53_nrf5340_cpuapp.overlay
new file mode 100644
index 00000000000..ee052ec68ae
--- /dev/null
+++ b/boards/shields/nrf7002eb/boards/thingy53_nrf5340_cpuapp.overlay
@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/*
+ * This uses gpio0 pin 8 which conflicts with STATUS pin of Wi-Fi SR coex
+ */
+&npm1100_force_pwm_mode {
+	status = "disabled";
+};
+
+/*
+ * Pins P0.9, P0.10, P0.11, P0.12 conflict with SPI4 and nrf7002 host irq
+ */
+&uart0 {
+	status = "disabled";
+};
diff --git a/boards/shields/nrf7002eb/doc/index.rst b/boards/shields/nrf7002eb/doc/index.rst
new file mode 100644
index 00000000000..e93c778f87c
--- /dev/null
+++ b/boards/shields/nrf7002eb/doc/index.rst
@@ -0,0 +1,72 @@
+.. _nrf7002eb:
+
+nRF7002 EB
+##########
+
+Overview
+********
+
+The nRF7002 EB is a versatile evaluation kit in the form of a thumbstick shield which connects to
+compatible Nordic host boards, like the Thingy53, using the Nordic edge-connector.
+
+The nRF7002 EB unlocks low-power Wi-Fi 6 capabilities for your host device. It support dual-band Wi-Fi
+2.4GHz and 5GHz, and is based on the nRF7002 SoC.
+Seamlessly connect to Wi-Fi networks and leverage Wi-Fi-based locationing, enabling advanced
+features such as SSID sniffing of local Wi-Fi hubs
+
+.. figure:: nrf7002eb.jpg
+   :alt: nRF7002 EB
+   :align: center
+
+   nRF7002 EB
+
+Requirements
+************
+
+The nRF7002 EB board is designed to fit straight into a Nordic edge-connector and uses SPI as the
+communication interface. Any host board that supports the Nordic edge-connector can be used with
+the nRF7002 EB.
+
+Prerequisites
+-------------
+
+the nRF70 driver requires firmware binary blobs for Wi-Fi operation. Run the command
+below to retrieve those files.
+
+.. code-block:: console
+
+   west update
+   west blobs fetch hal_nordic
+
+Usage
+*****
+
+The shield can be used in any application by setting ``--shield nrf7002eb`` when invoking ``west build``.
+
+Shield Variants
+###############
+
+The nRF7002 EK has a variant which includes the COEX pins. These pins are not be routed to the
+edge-connector on some boards, like earlier revisions of the Thingy53 than v1.0.0.
+
+- ``nrf7002ek``: The default variant.
+- ``nrf7002ek_coex``: Variant which includes the COEX pins.
+
+SR Co-existence
+###############
+
+The nRF7002 EK supports SR co-existence provided the host board supports it. The SR co-existence
+pins are connected to the host board's GPIO pins.
+
+Two Kconfig options are available to enable SR co-existence:
+
+- :kconfig:option:`CONFIG_NRF70_SR_COEX`: Enables SR co-existence.
+- :kconfig:option:`CONFIG_NRF70_SR_COEX_RF_SWITCH`: Control SR side RF switch.
+
+References
+**********
+
+- `Developing with nRF7002 EB <https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf70/nrf7002eb_dev_guide.html>`_
+- `nRF7002 EB product specification <https://infocenter.nordicsemi.com/topic/ug_nrf7002_eb/UG/nrf7002_EB/intro.html>`_
+- `nRF7002 product specification <https://infocenter.nordicsemi.com/index.jsp?topic=%2Fstruct_nrf70%2Fstruct%2Fnrf7002.html&cp=3_0>`_
+- `nRF7002 Co-existence <https://infocenter.nordicsemi.com/index.jsp?topic=%2Fps_nrf7002%2Fchapters%2Ffunctional%2Fdoc%2Fcoexistence.html&cp=3_0_0_7>`_
diff --git a/boards/shields/nrf7002eb/doc/nrf7002eb.jpg b/boards/shields/nrf7002eb/doc/nrf7002eb.jpg
new file mode 100644
index 00000000000..a8afd674135
Binary files /dev/null and b/boards/shields/nrf7002eb/doc/nrf7002eb.jpg differ
diff --git a/boards/shields/nrf7002eb/nrf7002eb.overlay b/boards/shields/nrf7002eb/nrf7002eb.overlay
new file mode 100644
index 00000000000..d580a2efb8c
--- /dev/null
+++ b/boards/shields/nrf7002eb/nrf7002eb.overlay
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <freq.h>
+
+/ {
+	chosen {
+		zephyr,wifi = &wlan0;
+	};
+};
+
+&edge_connector_spi {
+	status = "okay";
+
+	nrf70: nrf7002@0 {
+		compatible = "nordic,nrf7002-spi";
+		status = "okay";
+		reg = <0>;
+		spi-max-frequency = <DT_FREQ_M(8)>;
+
+		bucken-gpios = <&edge_connector 9 (GPIO_ACTIVE_HIGH | GPIO_PULL_DOWN)>;
+		iovdd-ctrl-gpios = <&edge_connector 9 (GPIO_ACTIVE_HIGH | GPIO_PULL_DOWN)>;
+		host-irq-gpios = <&edge_connector 19 GPIO_ACTIVE_HIGH>;
+
+		wlan0: wlan0 {
+			compatible = "nordic,wlan";
+		};
+
+		wifi-max-tx-pwr-2g-dsss = <21>;
+		wifi-max-tx-pwr-2g-mcs0 = <16>;
+		wifi-max-tx-pwr-2g-mcs7 = <16>;
+		wifi-max-tx-pwr-5g-low-mcs0 = <13>;
+		wifi-max-tx-pwr-5g-low-mcs7 = <13>;
+		wifi-max-tx-pwr-5g-mid-mcs0 = <13>;
+		wifi-max-tx-pwr-5g-mid-mcs7 = <13>;
+		wifi-max-tx-pwr-5g-high-mcs0 = <12>;
+		wifi-max-tx-pwr-5g-high-mcs7 = <12>;
+	};
+};
diff --git a/boards/shields/nrf7002eb/nrf7002eb_coex.overlay b/boards/shields/nrf7002eb/nrf7002eb_coex.overlay
new file mode 100644
index 00000000000..a8925c25567
--- /dev/null
+++ b/boards/shields/nrf7002eb/nrf7002eb_coex.overlay
@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "nrf7002eb.overlay"
+
+&nrf70 {
+	status0-gpios = <&edge_connector 5 GPIO_ACTIVE_HIGH>;
+	req-gpios = <&edge_connector 6 GPIO_ACTIVE_HIGH>;
+	grant-gpios = <&edge_connector 15 (GPIO_PULL_DOWN | GPIO_ACTIVE_LOW)>;
+};
diff --git a/cmake/linker/ld/target.cmake b/cmake/linker/ld/target.cmake
index 8c18fce0e9a..ed29e88aa16 100644
--- a/cmake/linker/ld/target.cmake
+++ b/cmake/linker/ld/target.cmake
@@ -80,6 +80,7 @@ macro(configure_linker_script linker_script_gen linker_pass_define)
       ${current_includes}
       ${soc_linker_script_includes}
       ${template_script_defines}
+      -DUSE_PARTITION_MANAGER=$<OR:$<BOOL:${CONFIG_PARTITION_MANAGER_ENABLED}>,$<BOOL:${IMAGE_NAME}>,$<TARGET_EXISTS:partition_manager>>
       -E ${LINKER_SCRIPT}
       -P # Prevent generation of debug `#line' directives.
       -o ${linker_script_gen}
diff --git a/cmake/modules/boards.cmake b/cmake/modules/boards.cmake
index d2c0666f2c5..d13e0a16f2d 100644
--- a/cmake/modules/boards.cmake
+++ b/cmake/modules/boards.cmake
@@ -185,9 +185,7 @@ set(format_str "{NAME}\;{DIR}\;{HWM}\;")
 set(format_str "${format_str}{REVISION_FORMAT}\;{REVISION_DEFAULT}\;{REVISION_EXACT}\;")
 set(format_str "${format_str}{REVISIONS}\;{SOCS}\;{QUALIFIERS}")
 
-if(BOARD_DIR)
-  set(board_dir_arg "--board-dir=${BOARD_DIR}")
-endif()
+list(TRANSFORM BOARD_DIRECTORIES PREPEND "--board-dir=" OUTPUT_VARIABLE board_dir_arg)
 execute_process(${list_boards_commands} --board=${BOARD} ${board_dir_arg}
   --cmakeformat=${format_str}
                 OUTPUT_VARIABLE ret_board
@@ -200,29 +198,15 @@ endif()
 
 if(NOT "${ret_board}" STREQUAL "")
   string(STRIP "${ret_board}" ret_board)
-  string(FIND "${ret_board}" "\n" idx REVERSE)
-  if(idx GREATER -1)
-    while(TRUE)
-      math(EXPR start "${idx} + 1")
-      string(SUBSTRING "${ret_board}" ${start} -1 line)
-      string(SUBSTRING "${ret_board}" 0 ${idx} ret_board)
-
-      cmake_parse_arguments(LIST_BOARD "" "DIR" "" ${line})
-      set(board_dirs "${board_dirs}\n${LIST_BOARD_DIR}")
-
-      if(idx EQUAL -1)
-        break()
-      endif()
-      string(FIND "${ret_board}" "\n" idx REVERSE)
-    endwhile()
-    message(FATAL_ERROR "Multiple boards named '${BOARD}' found in:${board_dirs}")
-  endif()
-
-  set(single_val "NAME;DIR;HWM;REVISION_FORMAT;REVISION_DEFAULT;REVISION_EXACT")
-  set(multi_val  "REVISIONS;SOCS;QUALIFIERS")
+  set(single_val "NAME;HWM;REVISION_FORMAT;REVISION_DEFAULT;REVISION_EXACT")
+  set(multi_val  "DIR;REVISIONS;SOCS;QUALIFIERS")
   cmake_parse_arguments(LIST_BOARD "" "${single_val}" "${multi_val}" ${ret_board})
-  set(BOARD_DIR ${LIST_BOARD_DIR} CACHE PATH "Board directory for board (${BOARD})" FORCE)
-  set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${BOARD_DIR}/board.yml)
+  list(GET LIST_BOARD_DIR 0 BOARD_DIR)
+  set(BOARD_DIR ${BOARD_DIR} CACHE PATH "Main board directory for board (${BOARD})" FORCE)
+  set(BOARD_DIRECTORIES ${LIST_BOARD_DIR} CACHE INTERNAL "List of board directories for board (${BOARD})" FORCE)
+  foreach(dir ${BOARD_DIRECTORIES})
+    set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${dir}/board.yml)
+  endforeach()
 
   # Create two CMake variables identifying the hw model.
   # CMake variable: HWM=[v1,v2]
diff --git a/cmake/modules/dts.cmake b/cmake/modules/dts.cmake
index ec0999d366b..82c5a302fbc 100644
--- a/cmake/modules/dts.cmake
+++ b/cmake/modules/dts.cmake
@@ -70,9 +70,9 @@ find_package(Dtc 1.4.6)
 #
 # Optional variables:
 # - BOARD: board name to use when looking for DTS_SOURCE
-# - BOARD_DIR: board directory to use when looking for DTS_SOURCE
+# - BOARD_DIRECTORIES: list of board directories to use when looking for DTS_SOURCE
 # - BOARD_REVISION_STRING: used when looking for a board revision's
-#   devicetree overlay file in BOARD_DIR
+#   devicetree overlay file in one of the BOARD_DIRECTORIES
 # - DTC_OVERLAY_FILE: list of devicetree overlay files which will be
 #   used to modify or extend the base devicetree.
 # - EXTRA_DTC_OVERLAY_FILE: list of extra devicetree overlay files.
@@ -86,7 +86,7 @@ find_package(Dtc 1.4.6)
 #   C preprocessor when generating the devicetree from DTS_SOURCE
 # - DTS_SOURCE: the devicetree source file to use may be pre-set
 #   with this variable; otherwise, it defaults to
-#   ${BOARD_DIR}/${BOARD}.dts
+#   ${BOARD_DIRECTORIES}/<normalized_board_target>.dts
 #
 # Variables set by this module and not mentioned above are for internal
 # use only, and may be removed, renamed, or re-purposed without prior notice.
@@ -117,6 +117,8 @@ set(GEN_DTS_CMAKE_SCRIPT        ${DT_SCRIPTS}/gen_dts_cmake.py)
 # The generated information itself, which we include() after
 # creating it.
 set(DTS_CMAKE                   ${PROJECT_BINARY_DIR}/dts.cmake)
+# The CMake target to be initialized by including ${DTS_CMAKE}.
+set(DEVICETREE_TARGET           devicetree_target)
 
 # The location of a file containing known vendor prefixes, relative to
 # each element of DTS_ROOT. Users can define their own in their own
@@ -127,28 +129,30 @@ if(NOT DEFINED DTS_SOURCE)
   zephyr_build_string(board_string SHORT shortened_board_string
                       BOARD ${BOARD} BOARD_QUALIFIERS ${BOARD_QUALIFIERS}
   )
-  if(EXISTS ${BOARD_DIR}/${shortened_board_string}.dts AND NOT BOARD_${BOARD}_SINGLE_SOC)
-    message(FATAL_ERROR "Board ${ZFILE_BOARD} defines multiple SoCs.\nShortened file name "
-            "(${shortened_board_string}.dts) not allowed, use '<board>_<soc>.dts' naming"
-    )
-  elseif(EXISTS ${BOARD_DIR}/${board_string}.dts AND EXISTS ${BOARD_DIR}/${shortened_board_string}.dts)
-    message(FATAL_ERROR "Conflicting file names discovered. Cannot use both "
-            "${board_string}.dts and ${shortened_board_string}.dts. "
-            "Please choose one naming style, ${board_string}.dts is recommended."
-    )
-  elseif(EXISTS ${BOARD_DIR}/${board_string}.dts)
-    set(DTS_SOURCE ${BOARD_DIR}/${board_string}.dts)
-  elseif(EXISTS ${BOARD_DIR}/${shortened_board_string}.dts)
-    set(DTS_SOURCE ${BOARD_DIR}/${shortened_board_string}.dts)
-  endif()
+  foreach(dir ${BOARD_DIRECTORIES})
+    if(EXISTS ${dir}/${shortened_board_string}.dts AND NOT BOARD_${BOARD}_SINGLE_SOC)
+      message(FATAL_ERROR "Board ${ZFILE_BOARD} defines multiple SoCs.\nShortened file name "
+              "(${shortened_board_string}.dts) not allowed, use '<board>_<soc>.dts' naming"
+      )
+    elseif(EXISTS ${dir}/${board_string}.dts AND EXISTS ${dir}/${shortened_board_string}.dts)
+      message(FATAL_ERROR "Conflicting file names discovered. Cannot use both "
+              "${board_string}.dts and ${shortened_board_string}.dts. "
+              "Please choose one naming style, ${board_string}.dts is recommended."
+      )
+    elseif(EXISTS ${dir}/${board_string}.dts)
+      set(DTS_SOURCE ${dir}/${board_string}.dts)
+    elseif(EXISTS ${dir}/${shortened_board_string}.dts)
+      set(DTS_SOURCE ${dir}/${shortened_board_string}.dts)
+    endif()
+  endforeach()
 endif()
 
 if(EXISTS ${DTS_SOURCE})
   # We found a devicetree. Append all relevant dts overlays we can find...
-  zephyr_file(CONF_FILES ${BOARD_DIR} DTS DTS_SOURCE)
+  zephyr_file(CONF_FILES ${BOARD_DIRECTORIES} DTS DTS_SOURCE)
 
   zephyr_file(
-    CONF_FILES ${BOARD_DIR}
+    CONF_FILES ${BOARD_DIRECTORIES}
     DTS no_rev_suffix_dts_board_overlays
     BOARD ${BOARD}
     BOARD_QUALIFIERS ${BOARD_QUALIFIERS}
diff --git a/cmake/modules/extensions.cmake b/cmake/modules/extensions.cmake
index 4d8422a3ced..b9812d84379 100644
--- a/cmake/modules/extensions.cmake
+++ b/cmake/modules/extensions.cmake
@@ -3611,6 +3611,9 @@ endfunction()
 #   alias at the beginning of a path interchangeably with the full
 #   path to the aliased node in these functions. The usage comments
 #   will make this clear in each case.
+#
+# - Each of these methods also has a sysbuild_dt_* counterpart.
+#   See share/sysbuild/cmake/modules/sysbuild_extensions.cmake.
 
 # Usage:
 #   dt_nodelabel(<var> NODELABEL <label>)
@@ -3638,6 +3641,10 @@ endfunction()
 # NODELABEL <label>  : Node label
 # REQUIRED           : Generate a fatal error if the node-label is not found
 function(dt_nodelabel var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_nodelabel(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(options "REQUIRED")
   set(req_single_args "NODELABEL")
   cmake_parse_arguments(DT_LABEL "${options}" "${req_single_args}" "" ${ARGN})
@@ -3654,7 +3661,7 @@ function(dt_nodelabel var)
     endif()
   endforeach()
 
-  get_target_property(${var} devicetree_target "DT_NODELABEL|${DT_LABEL_NODELABEL}")
+  get_target_property(${var} "${DEVICETREE_TARGET}" "DT_NODELABEL|${DT_LABEL_NODELABEL}")
   if(${${var}} STREQUAL ${var}-NOTFOUND)
     if(DT_LABEL_REQUIRED)
       message(FATAL_ERROR "required nodelabel not found: ${DT_LABEL_NODELABEL}")
@@ -3686,6 +3693,10 @@ endfunction()
 # PROPERTY <prop> : The alias to check
 # REQUIRED        : Generate a fatal error if the alias is not found
 function(dt_alias var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_alias(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(options "REQUIRED")
   set(req_single_args "PROPERTY")
   cmake_parse_arguments(DT_ALIAS "${options}" "${req_single_args}" "" ${ARGN})
@@ -3702,7 +3713,7 @@ function(dt_alias var)
     endif()
   endforeach()
 
-  get_target_property(${var} devicetree_target "DT_ALIAS|${DT_ALIAS_PROPERTY}")
+  get_target_property(${var} "${DEVICETREE_TARGET}" "DT_ALIAS|${DT_ALIAS_PROPERTY}")
   if(${${var}} STREQUAL ${var}-NOTFOUND)
     if(DT_ALIAS_REQUIRED)
       message(FATAL_ERROR "required alias not found: ${DT_ALIAS_PROPERTY}")
@@ -3730,6 +3741,10 @@ endfunction()
 # <var>       : Return variable where the check result will be returned
 # PATH <path> : Node path
 function(dt_node_exists var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_node_exists(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PATH")
   cmake_parse_arguments(DT_NODE "" "${req_single_args}" "" ${ARGN})
 
@@ -3775,6 +3790,10 @@ endfunction()
 # PATH <path>     : Node path
 # STATUS <status> : Status to check
 function(dt_node_has_status var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_node_has_status(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PATH;STATUS")
   cmake_parse_arguments(DT_NODE "" "${req_single_args}" "" ${ARGN})
 
@@ -3861,6 +3880,10 @@ endfunction()
 # INDEX <idx>    : Optional index when retrieving a value in an array property
 # REQUIRED       : Generate a fatal error if the property is not found
 function(dt_prop var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_prop(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(options "REQUIRED")
   set(req_single_args "PATH;PROPERTY")
   set(single_args "INDEX")
@@ -3879,7 +3902,7 @@ function(dt_prop var)
   endforeach()
 
   dt_path_internal(canonical "${DT_PROP_PATH}")
-  get_property(exists TARGET devicetree_target
+  get_property(exists TARGET "${DEVICETREE_TARGET}"
       PROPERTY "DT_PROP|${canonical}|${DT_PROP_PROPERTY}"
       SET
   )
@@ -3892,7 +3915,7 @@ function(dt_prop var)
     return()
   endif()
 
-  get_target_property(val devicetree_target
+  get_target_property(val "${DEVICETREE_TARGET}"
       "DT_PROP|${canonical}|${DT_PROP_PROPERTY}"
   )
 
@@ -3921,6 +3944,10 @@ endfunction()
 # INDEX <idx>            : Optional index when retrieving a value in an array property
 
 function(dt_comp_path var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_comp_path(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "COMPATIBLE")
   set(single_args "INDEX")
   cmake_parse_arguments(DT_COMP "" "${req_single_args};${single_args}" "" ${ARGN})
@@ -3937,7 +3964,7 @@ function(dt_comp_path var)
     endif()
   endforeach()
 
-  get_property(exists TARGET devicetree_target
+  get_property(exists TARGET "${DEVICETREE_TARGET}"
       PROPERTY "DT_COMP|${DT_COMP_COMPATIBLE}"
       SET
   )
@@ -3947,7 +3974,7 @@ function(dt_comp_path var)
     return()
   endif()
 
-  get_target_property(val devicetree_target
+  get_target_property(val "${DEVICETREE_TARGET}"
       "DT_COMP|${DT_COMP_COMPATIBLE}"
   )
 
@@ -3976,6 +4003,10 @@ endfunction()
 # <var>          : Return variable where the property value will be stored
 # PATH <path>    : Node path
 function(dt_num_regs var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_num_regs(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PATH")
   cmake_parse_arguments(DT_REG "" "${req_single_args}" "" ${ARGN})
 
@@ -3992,7 +4023,7 @@ function(dt_num_regs var)
   endforeach()
 
   dt_path_internal(canonical "${DT_REG_PATH}")
-  get_target_property(${var} devicetree_target "DT_REG|${canonical}|NUM")
+  get_target_property(${var} "${DEVICETREE_TARGET}" "DT_REG|${canonical}|NUM")
 
   set(${var} ${${var}} PARENT_SCOPE)
 endfunction()
@@ -4022,6 +4053,10 @@ endfunction()
 # INDEX <idx>    : Register block index number
 # NAME <name>    : Register block name
 function(dt_reg_addr var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_reg_addr(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PATH")
   set(single_args "INDEX;NAME")
   cmake_parse_arguments(DT_REG "" "${req_single_args};${single_args}" "" ${ARGN})
@@ -4051,7 +4086,7 @@ function(dt_reg_addr var)
   endif()
 
   dt_path_internal(canonical "${DT_REG_PATH}")
-  get_target_property(${var}_list devicetree_target "DT_REG|${canonical}|ADDR")
+  get_target_property(${var}_list "${DEVICETREE_TARGET}" "DT_REG|${canonical}|ADDR")
 
   list(GET ${var}_list ${DT_REG_INDEX} ${var})
 
@@ -4082,6 +4117,10 @@ endfunction()
 # INDEX <idx>    : Register block index number
 # NAME <name>    : Register block name
 function(dt_reg_size var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_reg_size(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PATH")
   set(single_args "INDEX;NAME")
   cmake_parse_arguments(DT_REG "" "${req_single_args};${single_args}" "" ${ARGN})
@@ -4111,7 +4150,7 @@ function(dt_reg_size var)
   endif()
 
   dt_path_internal(canonical "${DT_REG_PATH}")
-  get_target_property(${var}_list devicetree_target "DT_REG|${canonical}|SIZE")
+  get_target_property(${var}_list "${DEVICETREE_TARGET}" "DT_REG|${canonical}|SIZE")
 
   list(GET ${var}_list ${DT_REG_INDEX} ${var})
 
@@ -4159,6 +4198,10 @@ endfunction()
 # <var>           : Return variable
 # PROPERTY <prop> : Chosen property
 function(dt_has_chosen var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_has_chosen(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PROPERTY")
   cmake_parse_arguments(DT_CHOSEN "" "${req_single_args}" "" ${ARGN})
 
@@ -4174,7 +4217,7 @@ function(dt_has_chosen var)
     endif()
   endforeach()
 
-  get_target_property(exists devicetree_target "DT_CHOSEN|${DT_CHOSEN_PROPERTY}")
+  get_target_property(exists "${DEVICETREE_TARGET}" "DT_CHOSEN|${DT_CHOSEN_PROPERTY}")
 
   if(${exists} STREQUAL exists-NOTFOUND)
     set(${var} FALSE PARENT_SCOPE)
@@ -4194,6 +4237,10 @@ endfunction()
 # <var>           : Return variable where the node path will be stored
 # PROPERTY <prop> : Chosen property
 function(dt_chosen var)
+  if(NOT DEFINED DEVICETREE_TARGET OR NOT TARGET "${DEVICETREE_TARGET}")
+    message(FATAL_ERROR "dt_chosen(${ARGV0} ...) devicetree is not available.")
+  endif()
+
   set(req_single_args "PROPERTY")
   cmake_parse_arguments(DT_CHOSEN "" "${req_single_args}" "" ${ARGN})
 
@@ -4209,7 +4256,7 @@ function(dt_chosen var)
     endif()
   endforeach()
 
-  get_target_property(${var} devicetree_target "DT_CHOSEN|${DT_CHOSEN_PROPERTY}")
+  get_target_property(${var} "${DEVICETREE_TARGET}" "DT_CHOSEN|${DT_CHOSEN_PROPERTY}")
 
   if(${${var}} STREQUAL ${var}-NOTFOUND)
     set(${var} PARENT_SCOPE)
@@ -4281,7 +4328,7 @@ endfunction()
 # to an existing node. Set it to FALSE otherwise. See
 # dt_path_internal for a definition and examples of 'canonical' paths.
 function(dt_path_internal_exists var path)
-  get_target_property(path_prop devicetree_target "DT_NODE|${path}")
+  get_target_property(path_prop "${DEVICETREE_TARGET}" "DT_NODE|${path}")
   if (path_prop)
     set(${var} TRUE PARENT_SCOPE)
   else()
diff --git a/cmake/modules/hwm_v2.cmake b/cmake/modules/hwm_v2.cmake
index 45238f212b3..a440c95c832 100644
--- a/cmake/modules/hwm_v2.cmake
+++ b/cmake/modules/hwm_v2.cmake
@@ -24,9 +24,11 @@ if(NOT HWMv2)
 endif()
 
 # Internal helper function for creation of Kconfig files.
-function(kconfig_gen bin_dir file dirs)
-  file(MAKE_DIRECTORY "${bin_dir}")
-  set(kconfig_file ${bin_dir}/${file})
+function(kconfig_gen bin_dir file dirs comment)
+  set(kconfig_header "# Load ${comment} descriptions.\n")
+  set(kconfig_file ${KCONFIG_BINARY_DIR}/${bin_dir}/${file})
+  file(WRITE ${kconfig_file} "${kconfig_header}")
+
   foreach(dir ${dirs})
     cmake_path(CONVERT "${dir}" TO_CMAKE_PATH_LIST dir)
     file(APPEND ${kconfig_file} "osource \"${dir}/${file}\"\n")
@@ -71,19 +73,23 @@ while(TRUE)
     string(TOUPPER "${ARCH_V2_NAME}" ARCH_V2_NAME_UPPER)
     set(ARCH_V2_${ARCH_V2_NAME_UPPER}_DIR ${ARCH_V2_DIR})
   elseif(HWM_TYPE MATCHES "^soc|^series|^family")
-    cmake_parse_arguments(SOC_V2 "" "NAME;DIR;HWM" "" ${line})
+    cmake_parse_arguments(SOC_V2 "" "NAME;HWM" "DIR" ${line})
 
     list(APPEND kconfig_soc_source_dir "${SOC_V2_DIR}")
+    string(TOUPPER "${SOC_V2_NAME}" SOC_V2_NAME_UPPER)
+    string(TOUPPER "${HWM_TYPE}" HWM_TYPE_UPPER)
 
     if(HWM_TYPE STREQUAL "soc")
-      set(setting_name SOC_${SOC_V2_NAME}_DIR)
+      # We support both SOC_foo_DIR and SOC_FOO_DIR.
+      set(SOC_${SOC_V2_NAME}_DIRECTORIES ${SOC_V2_DIR})
+      set(SOC_${SOC_V2_NAME_UPPER}_DIRECTORIES ${SOC_V2_DIR})
+      list(GET SOC_V2_DIR 0 SOC_${SOC_V2_NAME}_DIR)
+      list(GET SOC_V2_DIR 0 SOC_${SOC_V2_NAME_UPPER}_DIR)
     else()
-      set(setting_name SOC_${HWM_TYPE}_${SOC_V2_NAME}_DIR)
+      # We support both SOC_series_foo_DIR and SOC_SERIES_FOO_DIR (and family /  FAMILY).
+      set(SOC_${HWM_TYPE}_${SOC_V2_NAME}_DIR ${SOC_V2_DIR})
+      set(SOC_${HWM_TYPE_UPPER}_${SOC_V2_NAME_UPPER}_DIR ${SOC_V2_DIR})
     endif()
-    # We support both SOC_foo_DIR and SOC_FOO_DIR.
-    set(${setting_name} ${SOC_V2_DIR})
-    string(TOUPPER ${setting_name} setting_name)
-    set(${setting_name} ${SOC_V2_DIR})
   endif()
 
   if(idx EQUAL -1)
@@ -92,28 +98,16 @@ while(TRUE)
 endwhile()
 list(REMOVE_DUPLICATES kconfig_soc_source_dir)
 
-# Support multiple ARCH_ROOT and SOC_ROOT
-set(arch_kconfig_file  Kconfig)
-set(soc_defconfig_file Kconfig.defconfig)
-set(soc_zephyr_file    Kconfig)
-set(soc_kconfig_file   Kconfig.soc)
-set(soc_sysbuild_file  Kconfig.sysbuild)
-set(arch_kconfig_header "# Load arch Kconfig descriptions.\n")
-set(defconfig_header    "# Load Zephyr SoC Kconfig defconfig.\n")
-set(soc_zephyr_header   "# Load Zephyr SoC Kconfig descriptions.\n")
-set(soc_kconfig_header  "# Load SoC Kconfig descriptions.\n")
-set(soc_sysbuild_header "# Load SoC sysbuild Kconfig descriptions.\n")
-file(WRITE ${KCONFIG_BINARY_DIR}/arch/${arch_kconfig_file} "${arch_kconfig_header}")
-file(WRITE ${KCONFIG_BINARY_DIR}/soc/${soc_defconfig_file} "${defconfig_header}")
-file(WRITE ${KCONFIG_BINARY_DIR}/soc/${soc_zephyr_file}    "${soc_zephyr_header}")
-file(WRITE ${KCONFIG_BINARY_DIR}/soc/${soc_kconfig_file}   "${soc_kconfig_header}")
-file(WRITE ${KCONFIG_BINARY_DIR}/soc/${soc_sysbuild_file}  "${soc_sysbuild_header}")
-
-kconfig_gen("${KCONFIG_BINARY_DIR}/arch" "${arch_kconfig_file}" "${kconfig_arch_source_dir}")
-kconfig_gen("${KCONFIG_BINARY_DIR}/soc" "${soc_defconfig_file}" "${kconfig_soc_source_dir}")
-kconfig_gen("${KCONFIG_BINARY_DIR}/soc" "${soc_zephyr_file}" "${kconfig_soc_source_dir}")
-kconfig_gen("${KCONFIG_BINARY_DIR}/soc" "${soc_kconfig_file}" "${kconfig_soc_source_dir}")
-kconfig_gen("${KCONFIG_BINARY_DIR}/soc" "${soc_sysbuild_file}" "${kconfig_soc_source_dir}")
+# Support multiple ARCH_ROOT, SOC_ROOT and BOARD_ROOT
+kconfig_gen("arch" "Kconfig"             "${kconfig_arch_source_dir}" "Zephyr Arch Kconfig")
+kconfig_gen("soc"  "Kconfig.defconfig"   "${kconfig_soc_source_dir}"  "Zephyr SoC defconfig")
+kconfig_gen("soc"  "Kconfig"             "${kconfig_soc_source_dir}"  "Zephyr SoC Kconfig")
+kconfig_gen("soc"  "Kconfig.soc"         "${kconfig_soc_source_dir}"  "SoC Kconfig")
+kconfig_gen("soc"  "Kconfig.sysbuild"    "${kconfig_soc_source_dir}"  "Sysbuild SoC Kconfig")
+kconfig_gen("boards" "Kconfig.defconfig" "${BOARD_DIRECTORIES}"       "Zephyr board defconfig")
+kconfig_gen("boards" "Kconfig.${BOARD}"  "${BOARD_DIRECTORIES}"       "board Kconfig")
+kconfig_gen("boards" "Kconfig"           "${BOARD_DIRECTORIES}"       "Zephyr board Kconfig")
+kconfig_gen("boards" "Kconfig.sysbuild"  "${BOARD_DIRECTORIES}"       "Sysbuild board Kconfig")
 
 # Clear variables created by cmake_parse_arguments
 unset(SOC_V2_NAME)
diff --git a/cmake/modules/kconfig.cmake b/cmake/modules/kconfig.cmake
index 3f374db5aea..1e156bff470 100644
--- a/cmake/modules/kconfig.cmake
+++ b/cmake/modules/kconfig.cmake
@@ -21,9 +21,12 @@ file(MAKE_DIRECTORY ${PROJECT_BINARY_DIR}/kconfig/include/config)
 set_ifndef(KCONFIG_NAMESPACE "CONFIG")
 
 set_ifndef(KCONFIG_BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR}/Kconfig)
+set(KCONFIG_BOARD_DIR ${KCONFIG_BINARY_DIR}/boards)
 file(MAKE_DIRECTORY ${KCONFIG_BINARY_DIR})
 
 if(HWMv1)
+  # HWMv1 only supoorts a single board dir which points directly to the board dir.
+  set(KCONFIG_BOARD_DIR ${BOARD_DIR})
   # Support multiple SOC_ROOT
   file(MAKE_DIRECTORY ${KCONFIG_BINARY_DIR}/soc)
   set(kconfig_soc_root ${SOC_ROOT})
@@ -73,7 +76,7 @@ else()
 endif()
 
 if(NOT DEFINED BOARD_DEFCONFIG)
-  zephyr_file(CONF_FILES ${BOARD_DIR} DEFCONFIG BOARD_DEFCONFIG)
+  zephyr_file(CONF_FILES ${BOARD_DIRECTORIES} DEFCONFIG BOARD_DEFCONFIG)
 endif()
 
 if(DEFINED BOARD_REVISION)
@@ -155,7 +158,7 @@ set(COMMON_KCONFIG_ENV_SETTINGS
   APP_VERSION_TWEAK_STRING=${APP_VERSION_TWEAK_STRING}
   CONFIG_=${KCONFIG_NAMESPACE}_
   KCONFIG_CONFIG=${DOTCONFIG}
-  BOARD_DIR=${BOARD_DIR}
+  KCONFIG_BOARD_DIR=${KCONFIG_BOARD_DIR}
   BOARD=${BOARD}
   BOARD_REVISION=${BOARD_REVISION}
   BOARD_QUALIFIERS=${BOARD_QUALIFIERS}
@@ -166,6 +169,7 @@ set(COMMON_KCONFIG_ENV_SETTINGS
   TOOLCHAIN_KCONFIG_DIR=${TOOLCHAIN_KCONFIG_DIR}
   TOOLCHAIN_HAS_NEWLIB=${_local_TOOLCHAIN_HAS_NEWLIB}
   TOOLCHAIN_HAS_PICOLIBC=${_local_TOOLCHAIN_HAS_PICOLIBC}
+  HIDE_CHILD_PARENT_CONFIG=${SYSBUILD}
   EDT_PICKLE=${EDT_PICKLE}
   # Export all Zephyr modules to Kconfig
   ${ZEPHYR_KCONFIG_MODULES_DIR}
diff --git a/cmake/modules/kernel.cmake b/cmake/modules/kernel.cmake
index 1946e2357ba..db07a04b921 100644
--- a/cmake/modules/kernel.cmake
+++ b/cmake/modules/kernel.cmake
@@ -173,7 +173,9 @@ if(CONFIG_LLEXT AND CONFIG_LLEXT_TYPE_ELF_SHAREDLIB)
   set_property(GLOBAL PROPERTY TARGET_SUPPORTS_SHARED_LIBS TRUE)
 endif()
 
-include(${BOARD_DIR}/board.cmake OPTIONAL)
+foreach(dir ${BOARD_DIRECTORIES})
+  include(${dir}/board.cmake OPTIONAL)
+endforeach()
 
 # If we are using a suitable ethernet driver inside qemu, then these options
 # must be set, otherwise a zephyr instance cannot receive any network packets.
@@ -248,3 +250,7 @@ if("${CMAKE_EXTRA_GENERATOR}" STREQUAL "Eclipse CDT4")
   include(${ZEPHYR_BASE}/cmake/ide/eclipse_cdt4_generator_amendment.cmake)
   eclipse_cdt4_generator_amendment(1)
 endif()
+
+if(ZEPHYR_NRF_MODULE_DIR)
+  include(${ZEPHYR_NRF_MODULE_DIR}/cmake/partition_manager.cmake)
+endif()
diff --git a/cmake/modules/soc_v2.cmake b/cmake/modules/soc_v2.cmake
index 606ed690f77..f98d33e0011 100644
--- a/cmake/modules/soc_v2.cmake
+++ b/cmake/modules/soc_v2.cmake
@@ -28,5 +28,10 @@ if(HWMv2)
   set(SOC_FAMILY ${CONFIG_SOC_FAMILY})
   set(SOC_V2_DIR ${SOC_${SOC_NAME}_DIR})
   set(SOC_FULL_DIR ${SOC_V2_DIR} CACHE PATH "Path to the SoC directory." FORCE)
-  set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${SOC_V2_DIR}/soc.yml)
+  set(SOC_DIRECTORIES ${SOC_${SOC_NAME}_DIRECTORIES} CACHE INTERNAL
+      "List of SoC directories for SoC (${SOC_NAME})" FORCE
+  )
+  foreach(dir ${SOC_DIRECTORIES})
+    set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${dir}/soc.yml)
+  endforeach()
 endif()
diff --git a/doc/_extensions/zephyr/domain.py b/doc/_extensions/zephyr/domain.py
index e4c1ade9642..ccfb5b0f7ad 100644
--- a/doc/_extensions/zephyr/domain.py
+++ b/doc/_extensions/zephyr/domain.py
@@ -339,7 +339,7 @@ def setup(app):
     app.add_post_transform(ProcessRelatedCodeSamplesNode)
 
     # monkey-patching of the DoxygenGroupDirective
-    app.add_directive("doxygengroup", CustomDoxygenGroupDirective, override=True)
+    # app.add_directive("doxygengroup", CustomDoxygenGroupDirective, override=True)
 
     return {
         "version": __version__,
diff --git a/doc/_extensions/zephyr/kconfig/__init__.py b/doc/_extensions/zephyr/kconfig/__init__.py
index 6052db638fa..abbdcc1b9be 100644
--- a/doc/_extensions/zephyr/kconfig/__init__.py
+++ b/doc/_extensions/zephyr/kconfig/__init__.py
@@ -91,7 +91,7 @@ def kconfig_load(app: Sphinx) -> Tuple[kconfiglib.Kconfig, Dict[str, str]]:
         root_args = argparse.Namespace(**{'soc_roots': [Path(ZEPHYR_BASE)]})
         v2_systems = list_hardware.find_v2_systems(root_args)
 
-        soc_folders = {soc.folder for soc in v2_systems.get_socs()}
+        soc_folders = {soc.folder[0] for soc in v2_systems.get_socs()}
         with open(Path(td) / "soc" / "Kconfig.defconfig", "w") as f:
             f.write('')
 
@@ -114,8 +114,9 @@ def kconfig_load(app: Sphinx) -> Tuple[kconfiglib.Kconfig, Dict[str, str]]:
 
         (Path(td) / 'boards').mkdir(exist_ok=True)
         root_args = argparse.Namespace(**{'board_roots': [Path(ZEPHYR_BASE)],
-                                          'soc_roots': [Path(ZEPHYR_BASE)], 'board': None})
-        v2_boards = list_boards.find_v2_boards(root_args)
+                                          'soc_roots': [Path(ZEPHYR_BASE)], 'board': None,
+                                          'board_dir': []})
+        v2_boards = list_boards.find_v2_boards(root_args).values()
 
         with open(Path(td) / "boards" / "Kconfig.boards", "w") as f:
             for board in v2_boards:
@@ -126,7 +127,8 @@ def kconfig_load(app: Sphinx) -> Tuple[kconfiglib.Kconfig, Dict[str, str]]:
                     board_str = 'BOARD_' + re.sub(r"[^a-zA-Z0-9_]", "_", qualifier).upper()
                     f.write('config  ' + board_str + '\n')
                     f.write('\t bool\n')
-                f.write('source "' + (board.dir / ('Kconfig.' + board.name)).as_posix() + '"\n\n')
+                f.write('source "' +
+                        (board.directories[0] / ('Kconfig.' + board.name)).as_posix() + '"\n\n')
 
         # base environment
         os.environ["ZEPHYR_BASE"] = str(ZEPHYR_BASE)
@@ -140,7 +142,7 @@ def kconfig_load(app: Sphinx) -> Tuple[kconfiglib.Kconfig, Dict[str, str]]:
         os.environ["HWM_SCHEME"] = "v2"
 
         os.environ["BOARD"] = "boards"
-        os.environ["BOARD_DIR"] = str(Path(td) / "boards")
+        os.environ["KCONFIG_BOARD_DIR"] = str(Path(td) / "boards")
 
         # insert external Kconfigs to the environment
         module_paths = dict()
diff --git a/doc/_extensions/zephyr/link-roles.py b/doc/_extensions/zephyr/link-roles.py
index 19d2a985487..c1474bab312 100644
--- a/doc/_extensions/zephyr/link-roles.py
+++ b/doc/_extensions/zephyr/link-roles.py
@@ -9,6 +9,7 @@
 import re
 import subprocess
 from docutils import nodes
+from sphinx.util import logging
 
 try:
     import west.manifest
@@ -21,6 +22,9 @@
     west_manifest = None
 
 
+logger = logging.getLogger(__name__)
+
+
 def get_github_rev():
     try:
         output = subprocess.check_output(
@@ -88,9 +92,7 @@ def role(name, rawtext, text, lineno, inliner, options={}, content=[]):
             )
         # Invalid module provided
         elif module != config.link_roles_manifest_project:
-            raise ModuleNotFoundError(
-                f"Module {module} not found in the west manifest\n\t{trace}"
-            )
+            logger.debug(f"Module {module} not found in the west manifest")
         # Baseurl for manifest project not set
         elif baseurl is None:
             raise ValueError(
diff --git a/doc/build/kconfig/setting.rst b/doc/build/kconfig/setting.rst
index 05308589d53..85ae9f4c745 100644
--- a/doc/build/kconfig/setting.rst
+++ b/doc/build/kconfig/setting.rst
@@ -7,8 +7,7 @@ The :ref:`menuconfig and guiconfig interfaces <menuconfig>` can be used to test
 out configurations during application development. This page explains how to
 make settings permanent.
 
-All Kconfig options can be searched in the :ref:`Kconfig search page
-<kconfig-search>`.
+All Kconfig options can be searched in the Kconfig search page.
 
 .. note::
 
@@ -115,8 +114,7 @@ Assignments in configuration files are only respected if the dependencies for
 the symbol are satisfied. A warning is printed otherwise. To figure out what
 the dependencies of a symbol are, use one of the :ref:`interactive
 configuration interfaces <menuconfig>` (you can jump directly to a symbol with
-:kbd:`/`), or look up the symbol in the :ref:`Kconfig search page
-<kconfig-search>`.
+:kbd:`/`), or look up the symbol in the Kconfig search page.
 
 
 .. _initial-conf:
diff --git a/doc/connectivity/networking/api/mqtt.rst b/doc/connectivity/networking/api/mqtt.rst
index b232f125333..79da5abe57b 100644
--- a/doc/connectivity/networking/api/mqtt.rst
+++ b/doc/connectivity/networking/api/mqtt.rst
@@ -150,6 +150,7 @@ additional configuration information:
    tls_config->sec_tag_list = m_sec_tags;
    tls_config->sec_tag_count = ARRAY_SIZE(m_sec_tags);
    tls_config->hostname = MQTT_BROKER_HOSTNAME;
+   tls_config->set_native_tls = true;
 
 In this sample code, the ``m_sec_tags`` array holds a list of tags, referencing TLS
 credentials that the MQTT library should use for authentication. We do not specify
@@ -162,6 +163,8 @@ Note, that TLS credentials referenced by the ``m_sec_tags`` array must be
 registered in the system first. For more information on how to do that, refer
 to :ref:`secure sockets documentation <secure_sockets_interface>`.
 
+Finally, ``set_native_tls`` can be optionally set to enable native TLS support instead of offloading TLS operations to the modem.
+
 An example of how to use TLS with MQTT is also present in
 :zephyr:code-sample:`mqtt-publisher` sample application.
 
diff --git a/doc/develop/application/index.rst b/doc/develop/application/index.rst
index 64d99dc0bcc..bcad2900b88 100644
--- a/doc/develop/application/index.rst
+++ b/doc/develop/application/index.rst
@@ -648,9 +648,8 @@ started.
 
 See :ref:`setting_configuration_values` for detailed documentation on setting
 Kconfig configuration values. The :ref:`initial-conf` section on the same page
-explains how the initial configuration is derived. See :ref:`kconfig-search`
-for a complete list of configuration options.
-See :ref:`hardening` for security information related with Kconfig options.
+explains how the initial configuration is derived. See :ref:`hardening` for
+security information related with Kconfig options.
 
 The other pages in the :ref:`Kconfig section of the manual <kconfig>` are also
 worth going through, especially if you planning to add new configuration
diff --git a/doc/kconfig.rst b/doc/kconfig.rst
deleted file mode 100644
index 1123de2adbd..00000000000
--- a/doc/kconfig.rst
+++ /dev/null
@@ -1,8 +0,0 @@
-:orphan:
-
-.. _kconfig-search:
-
-Kconfig Search
-==============
-
-.. kconfig:search::
diff --git a/drivers/disk/flashdisk.c b/drivers/disk/flashdisk.c
index 1ac3d15ba62..4d8e3f1eee0 100644
--- a/drivers/disk/flashdisk.c
+++ b/drivers/disk/flashdisk.c
@@ -469,6 +469,8 @@ static const struct disk_operations flash_disk_ops = {
 	.ioctl = disk_flash_access_ioctl,
 };
 
+#ifndef USE_PARTITION_MANAGER
+/* The non-Partition manager, DTS based generators below */
 #define DT_DRV_COMPAT zephyr_flash_disk
 
 #define PARTITION_PHANDLE(n) DT_PHANDLE_BY_IDX(DT_DRV_INST(n), partition, 0)
@@ -510,6 +512,82 @@ DT_INST_FOREACH_STATUS_OKAY(VERIFY_CACHE_SIZE_IS_NOT_ZERO_IF_NOT_READ_ONLY)
 		"Devicetree node " DT_NODE_PATH(DT_DRV_INST(n))				\
 		" has cache size which is not a multiple of its sector size");
 DT_INST_FOREACH_STATUS_OKAY(VERIFY_CACHE_SIZE_IS_MULTIPLY_OF_SECTOR_SIZE)
+#else /* ifndef USE_PARTITION_MANAGER */
+/* Partition Manager based generators below */
+
+/* Gets the PM_..._EXTRA_PARAM_##param value */
+#define PM_FLASH_DISK_ENTRY_EXTRA_PARAM(name, param) PM_##name##_EXTRA_PARAM_disk_##param
+
+/* Gets the PM_..._NAME value which is originally cased, as in yaml, partition name */
+#define PM_FLASH_DISK_ENTRY_PARTITION_NAME(name) PM_##name##_NAME
+
+/* Generates flashdiskN_cache variable name, where N is partition ID */
+#define PM_FLASH_DISK_CACHE_VARIABLE(n) UTIL_CAT(flashdisk, UTIL_CAT(FIXED_PARTITION_ID(n), _cache))
+
+/* Generate cache buffers */
+#define CACHE_SIZE(n) (COND_CODE_1(PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, read_only), (0), (1)) * \
+		       PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, cache_size))
+#define DEFINE_FLASHDISKS_CACHE(n) \
+	static uint8_t __aligned(4) PM_FLASH_DISK_CACHE_VARIABLE(n)[CACHE_SIZE(n)];
+
+PM_FOREACH_AFFILIATED_TO_disk(DEFINE_FLASHDISKS_CACHE)
+
+/* Generated single Flash Disk device data from Partition Manager partition.
+ * Partition is required to have type set to disk in partition definitions:
+ *  type: disk
+ * and following extra params can be provided:
+ *  extra_params: {
+ *	name = "<name>",
+ *	cache_size = <size>,
+ *	sector_size = <ssize>,
+ *	read_only = <ro>
+ *  }
+ * where:
+ *  <name> is mandatory device name that will be used by Disk Access and FAT FS to mount device;
+ *  <cache_size> is cache r/w cache size, which is mandatory if read_only = 0 or not present,
+ *  and should be multiple of <ssize>;
+ *  <ssize> is mandatory device sector size information, usually should be erase page size,
+ *  for flash devices, for example 4096 bytes;
+ *  read_only is optional, if not present then assumed false; <ro> can be 0(false) or 1(true).
+ */
+#define DEFINE_FLASHDISKS_DEVICE(n)						\
+{										\
+	.info = {								\
+		.ops = &flash_disk_ops,						\
+		.name = STRINGIFY(PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, name)),		\
+	},									\
+	.area_id = FIXED_PARTITION_ID(n),					\
+	.offset = FIXED_PARTITION_OFFSET(n),					\
+	.cache = PM_FLASH_DISK_CACHE_VARIABLE(n),				\
+	.cache_size = sizeof(PM_FLASH_DISK_CACHE_VARIABLE(n)),			\
+	.size = FIXED_PARTITION_SIZE(n),					\
+	.sector_size = PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, sector_size),		\
+},
+
+/* The bellow used PM_FOREACH_TYPE_disk is generated by Partition Manager foreach
+ * loop macro. The lower case _disk is type name for which the macro has been generated;
+ * partition entry can have multiple types set and foreach macro will be generated
+ * for every type found across partition definitions.
+ */
+static struct flashdisk_data flash_disks[] = {
+	PM_FOREACH_AFFILIATED_TO_disk(DEFINE_FLASHDISKS_DEVICE)
+};
+
+#define VERIFY_CACHE_SIZE_IS_NOT_ZERO_IF_NOT_READ_ONLY(n)				\
+	COND_CODE_1(PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, read_only),			\
+		(/* cache-size is not used for read-only disks */),			\
+		(BUILD_ASSERT(PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, cache_size) != 0,	\
+		"Flash disk partition " STRINGIFY(PM_FLASH_DISK_ENTRY_PARTITION_NAME(n))\
+		" must have non-zero cache-size");))
+PM_FOREACH_AFFILIATED_TO_disk(VERIFY_CACHE_SIZE_IS_NOT_ZERO_IF_NOT_READ_ONLY)
+
+#define VERIFY_CACHE_SIZE_IS_MULTIPLY_OF_SECTOR_SIZE(n)					\
+	BUILD_ASSERT(PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, cache_size) %			\
+		     PM_FLASH_DISK_ENTRY_EXTRA_PARAM(n, sector_size) == 0,		\
+		"Devicetree node " STRINGIFY(PM_FLASH_DISK_ENTRY_PARTITION_NAME(n))	\
+		" has cache size which is not a multiple of its sector size");
+PM_FOREACH_AFFILIATED_TO_disk(VERIFY_CACHE_SIZE_IS_MULTIPLY_OF_SECTOR_SIZE)
+#endif /* USE_PARTITION_MANAGER */
 
 static int disk_flash_init(void)
 {
diff --git a/drivers/entropy/CMakeLists.txt b/drivers/entropy/CMakeLists.txt
index 8a67fc3a03e..ea5e9fb8683 100644
--- a/drivers/entropy/CMakeLists.txt
+++ b/drivers/entropy/CMakeLists.txt
@@ -36,4 +36,11 @@ zephyr_library_sources_ifdef(CONFIG_ENTROPY_NPCX_DRBG                 entropy_np
 zephyr_library_sources_ifdef(CONFIG_ENTROPY_MAX32_TRNG                entropy_max32.c)
 zephyr_library_sources_ifdef(CONFIG_ENTROPY_RENESAS_RA_RSIP_E51A_TRNG entropy_renesas_ra.c)
 
+if (CONFIG_FAKE_ENTROPY_NRF_PRNG)
+  zephyr_library_sources(fake_entropy_nrf_prng.c)
+
+  message(WARNING "\nA nRF PRNG is used, which does not produce real random bits."
+  "This is not secure and should therefore never be used in a product.")
+endif()
+
 zephyr_library_link_libraries_ifdef(CONFIG_BUILD_WITH_TFM tfm_api)
diff --git a/drivers/entropy/Kconfig b/drivers/entropy/Kconfig
index debd0f8d7a1..40571df47f1 100644
--- a/drivers/entropy/Kconfig
+++ b/drivers/entropy/Kconfig
@@ -38,6 +38,7 @@ source "drivers/entropy/Kconfig.psa_crypto"
 source "drivers/entropy/Kconfig.npcx"
 source "drivers/entropy/Kconfig.max32"
 source "drivers/entropy/Kconfig.renesas_ra"
+source "drivers/entropy/Kconfig.nrf_prng"
 
 config ENTROPY_HAS_DRIVER
 	bool
diff --git a/drivers/entropy/Kconfig.nrf_prng b/drivers/entropy/Kconfig.nrf_prng
new file mode 100644
index 00000000000..fb78f5ce013
--- /dev/null
+++ b/drivers/entropy/Kconfig.nrf_prng
@@ -0,0 +1,19 @@
+# nRF fake entropy prng generator driver configuration
+
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+if ENTROPY_GENERATOR
+
+config FAKE_ENTROPY_NRF_PRNG
+	bool "A fake nRF entropy driver"
+	default y
+	depends on DT_HAS_NORDIC_ENTROPY_PRNG_ENABLED
+	depends on (SOC_SERIES_NRF54HX || SOC_SERIES_NRF92X)
+	select ENTROPY_HAS_DRIVER
+	help
+	  This is a super simple PRNG driver that can be used on nRF platforms that
+	  do not have an entropy source.
+	  This is NOT SAFE to use for cryptographic operations!
+
+endif
diff --git a/drivers/entropy/Kconfig.psa_crypto b/drivers/entropy/Kconfig.psa_crypto
index d06001225b0..18514a071d1 100644
--- a/drivers/entropy/Kconfig.psa_crypto
+++ b/drivers/entropy/Kconfig.psa_crypto
@@ -7,6 +7,7 @@ config ENTROPY_PSA_CRYPTO_RNG
 	bool "PSA Crypto Random source Entropy driver"
 	depends on DT_HAS_ZEPHYR_PSA_CRYPTO_RNG_ENABLED
 	select ENTROPY_HAS_DRIVER
+	select PSA_WANT_GENERATE_RANDOM
 	default y
 	help
 	  Enable the PSA Crypto source Entropy driver.
diff --git a/drivers/entropy/fake_entropy_nrf_prng.c b/drivers/entropy/fake_entropy_nrf_prng.c
new file mode 100644
index 00000000000..8624c844405
--- /dev/null
+++ b/drivers/entropy/fake_entropy_nrf_prng.c
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/init.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <zephyr/drivers/entropy.h>
+
+#define DT_DRV_COMPAT nordic_entropy_prng
+
+/* This file implements a pseudo-RNG
+ * https://vigna.di.unimi.it/xorshift/xoshiro128plus.c
+ */
+
+static uint32_t s[4];
+
+static inline uint32_t rotl(const uint32_t x, int k)
+{
+	return (x << k) | (x >> (32 - k));
+}
+
+static uint32_t rng_next(void)
+{
+	const uint32_t result = rotl(s[0] + s[3], 7) + s[0];
+
+	const uint32_t t = s[1] << 9;
+
+	s[2] ^= s[0];
+	s[3] ^= s[1];
+	s[1] ^= s[2];
+	s[0] ^= s[3];
+
+	s[2] ^= t;
+
+	s[3] = rotl(s[3], 11);
+
+	return result;
+}
+
+static int entropy_prng_get_entropy(const struct device *dev, uint8_t *buffer, uint16_t length)
+{
+	ARG_UNUSED(dev);
+
+	while (length) {
+		/*
+		 * Note that only 1 thread (Zephyr thread or HW models), runs at
+		 * a time, therefore there is no need to use random_r()
+		 */
+		uint32_t value = rng_next();
+
+		size_t to_copy = MIN(length, sizeof(long));
+
+		memcpy(buffer, &value, to_copy);
+		buffer += to_copy;
+		length -= to_copy;
+	}
+
+	return 0;
+}
+
+static int entropy_prng_get_entropy_isr(const struct device *dev, uint8_t *buf, uint16_t len,
+					uint32_t flags)
+{
+	ARG_UNUSED(flags);
+
+	int err;
+
+	/*
+	 * entropy_prng_get_entropy() is also safe for ISRs
+	 * and always produces data.
+	 */
+	err = entropy_prng_get_entropy(dev, buf, len);
+	if (err < 0) {
+		return err;
+	} else {
+		return len;
+	}
+}
+
+static int entropy_prng_init(const struct device *dev)
+{
+	ARG_UNUSED(dev);
+
+	/* Picked some arbitrary initial seed. */
+	s[0] = 0xAF568BC0;
+	s[1] = 0xAC34307E;
+	s[2] = 0x9B7F6DD1;
+	s[3] = 0xD84319FC;
+	return 0;
+}
+
+static const struct entropy_driver_api entropy_prng_api_funcs = {
+	.get_entropy = entropy_prng_get_entropy, .get_entropy_isr = entropy_prng_get_entropy_isr};
+
+DEVICE_DT_INST_DEFINE(0, entropy_prng_init, NULL, NULL, NULL, PRE_KERNEL_1,
+		      CONFIG_ENTROPY_INIT_PRIORITY, &entropy_prng_api_funcs);
diff --git a/drivers/flash/Kconfig.nrf_rram b/drivers/flash/Kconfig.nrf_rram
index 6251f2e90b4..8c45f8b36bb 100644
--- a/drivers/flash/Kconfig.nrf_rram
+++ b/drivers/flash/Kconfig.nrf_rram
@@ -70,14 +70,14 @@ config SOC_FLASH_NRF_TIMEOUT_MULTIPLIER
 
 config NRF_RRAM_REGION_ADDRESS_RESOLUTION
 	hex
-	default 0x400
+	default 0x1000
 	help
 	  RRAMC's region protection address resolution.
 	  Applies to region with configurable start address.
 
 config NRF_RRAM_REGION_SIZE_UNIT
 	hex
-	default 0x400
+	default 0x1000
 	help
 	  Base unit for the size of RRAMC's region protection.
 
diff --git a/drivers/flash/soc_flash_nrf.c b/drivers/flash/soc_flash_nrf.c
index c15722082a3..16ab00b9660 100644
--- a/drivers/flash/soc_flash_nrf.c
+++ b/drivers/flash/soc_flash_nrf.c
@@ -37,6 +37,11 @@ LOG_MODULE_REGISTER(flash_nrf);
 
 #define SOC_NV_FLASH_NODE DT_INST(0, soc_nv_flash)
 
+#if CONFIG_TRUSTED_EXECUTION_NONSECURE && USE_PARTITION_MANAGER
+#include <soc_secure.h>
+#include <pm_config.h>
+#endif /* CONFIG_TRUSTED_EXECUTION_NONSECURE && USE_PARTITION_MANAGER */
+
 #ifndef CONFIG_SOC_FLASH_NRF_RADIO_SYNC_NONE
 #define FLASH_SLOT_WRITE     7500
 #if defined(CONFIG_SOC_FLASH_NRF_PARTIAL_ERASE)
@@ -166,6 +171,12 @@ static int flash_nrf_read(const struct device *dev, off_t addr,
 	}
 #endif
 
+#if CONFIG_TRUSTED_EXECUTION_NONSECURE && USE_PARTITION_MANAGER && PM_APP_ADDRESS
+	if (addr < PM_APP_ADDRESS) {
+		return soc_secure_mem_read(data, (void *)addr, len);
+	}
+#endif
+
 	nrf_nvmc_buffer_read(data, (uint32_t)addr, len);
 
 	return 0;
diff --git a/drivers/spi/spi_dw.c b/drivers/spi/spi_dw.c
index 649a13aca01..b4f772b158b 100644
--- a/drivers/spi/spi_dw.c
+++ b/drivers/spi/spi_dw.c
@@ -41,6 +41,10 @@ LOG_MODULE_REGISTER(spi_dw);
 #include <zephyr/drivers/pinctrl.h>
 #endif
 
+#ifdef CONFIG_HAS_NRFX
+#include <nrfx.h>
+#endif
+
 static inline bool spi_dw_is_slave(struct spi_dw_data *spi)
 {
 	return (IS_ENABLED(CONFIG_SPI_SLAVE) &&
@@ -258,6 +262,7 @@ static int spi_dw_configure(const struct device *dev,
 		/* Baud rate and Slave select, for master only */
 		write_baudr(dev, SPI_DW_CLK_DIVIDER(info->clock_frequency,
 						    config->frequency));
+		write_ser(dev, BIT(config->slave));
 	}
 
 	if (spi_dw_is_slave(spi)) {
@@ -500,6 +505,10 @@ void spi_dw_isr(const struct device *dev)
 	uint32_t int_status;
 	int error;
 
+#ifdef CONFIG_HAS_NRFX
+	NRF_EXMIF->EVENTS_CORE = 0;
+#endif
+
 	int_status = read_isr(dev);
 
 	LOG_DBG("SPI %p int_status 0x%x - (tx: %d, rx: %d)", dev, int_status,
@@ -548,6 +557,11 @@ int spi_dw_init(const struct device *dev)
 
 	DEVICE_MMIO_MAP(dev, K_MEM_CACHE_NONE);
 
+#ifdef CONFIG_HAS_NRFX
+	NRF_EXMIF->INTENSET = BIT(0);
+	NRF_EXMIF->TASKS_START = 1;
+#endif
+
 	info->config_func();
 
 	/* Masking interrupt and making sure controller is disabled */
@@ -566,6 +580,11 @@ int spi_dw_init(const struct device *dev)
 	return 0;
 }
 
+#define REG_ADDR(inst) \
+	COND_CODE_1(DT_NODE_HAS_COMPAT(DT_DRV_INST(inst), nordic_nrf_exmif), \
+		    (Z_DEVICE_MMIO_NAMED_ROM_INITIALIZER(core, DT_DRV_INST(inst))), \
+		    (DEVICE_MMIO_ROM_INIT(DT_DRV_INST(inst))))
+
 #define SPI_CFG_IRQS_SINGLE_ERR_LINE(inst)					\
 		IRQ_CONNECT(DT_INST_IRQ_BY_NAME(inst, rx_avail, irq),		\
 			    DT_INST_IRQ_BY_NAME(inst, rx_avail, priority),	\
@@ -638,7 +657,7 @@ COND_CODE_1(IS_EQ(DT_NUM_IRQS(DT_DRV_INST(inst)), 1),              \
 		SPI_CONTEXT_CS_GPIOS_INITIALIZE(DT_DRV_INST(inst), ctx)                     \
 	};                                                                                  \
 	static const struct spi_dw_config spi_dw_config_##inst = {                          \
-		DEVICE_MMIO_ROM_INIT(DT_DRV_INST(inst)),                                    \
+		REG_ADDR(inst),                                                             \
 		.clock_frequency = COND_CODE_1(                                             \
 			DT_NODE_HAS_PROP(DT_INST_PHANDLE(inst, clocks), clock_frequency),   \
 			(DT_INST_PROP_BY_PHANDLE(inst, clocks, clock_frequency)),           \
diff --git a/drivers/spi/spi_nrfx_spim.c b/drivers/spi/spi_nrfx_spim.c
index 3de9f82709c..66316c16312 100644
--- a/drivers/spi/spi_nrfx_spim.c
+++ b/drivers/spi/spi_nrfx_spim.c
@@ -8,6 +8,7 @@
 #include <zephyr/drivers/spi/rtio.h>
 #include <zephyr/cache.h>
 #include <zephyr/pm/device.h>
+#include <zephyr/pm/device_runtime.h>
 #include <zephyr/drivers/pinctrl.h>
 #include <zephyr/mem_mgmt/mem_attr.h>
 #include <soc.h>
@@ -140,15 +141,56 @@ static inline nrf_spim_bit_order_t get_nrf_spim_bit_order(uint16_t operation)
 	}
 }
 
+static int spim_init(const struct device *dev)
+{
+	struct spi_nrfx_data *dev_data = dev->data;
+	const struct spi_nrfx_config *dev_config = dev->config;
+	nrfx_spim_config_t config;
+	struct spi_context *ctx = &dev_data->ctx;
+	const struct spi_config *spi_cfg = ctx->config;
+	uint32_t max_freq = dev_config->max_freq;
+	nrfx_err_t result = NRFX_SUCCESS;
+
+#if defined(CONFIG_SOC_NRF5340_CPUAPP)
+	/* On nRF5340, the 32 Mbps speed is supported by the application core
+	 * when it is running at 128 MHz (see the Timing specifications section
+	 * in the nRF5340 PS).
+	 */
+	if (max_freq > 16000000 &&
+	    nrf_clock_hfclk_div_get(NRF_CLOCK) != NRF_CLOCK_HFCLK_DIV_1) {
+		max_freq = 16000000;
+	}
+#endif
+
+	config = dev_config->def_config;
+
+	/* Limit the frequency to that supported by the SPIM instance. */
+	config.frequency = get_nrf_spim_frequency(MIN(spi_cfg->frequency,
+						max_freq));
+	config.mode      = get_nrf_spim_mode(spi_cfg->operation);
+	config.bit_order = get_nrf_spim_bit_order(spi_cfg->operation);
+
+	if (dev_data->initialized) {
+		nrfx_spim_uninit(&dev_config->spim);
+		dev_data->initialized = false;
+	}
+
+	result = nrfx_spim_init(&dev_config->spim, &config,
+			event_handler, (void *)dev);
+	if (result != NRFX_SUCCESS) {
+		LOG_ERR("Failed to initialize nrfx driver: %08x", result);
+		return -EIO;
+	}
+	return 0;
+}
+
 static int configure(const struct device *dev,
 		     const struct spi_config *spi_cfg)
 {
 	struct spi_nrfx_data *dev_data = dev->data;
 	const struct spi_nrfx_config *dev_config = dev->config;
 	struct spi_context *ctx = &dev_data->ctx;
-	uint32_t max_freq = dev_config->max_freq;
-	nrfx_spim_config_t config;
-	nrfx_err_t result;
+	int ret;
 
 	if (dev_data->initialized && spi_context_configured(ctx, spi_cfg)) {
 		/* Already configured. No need to do it again. */
@@ -186,44 +228,22 @@ static int configure(const struct device *dev,
 		return -EINVAL;
 	}
 
-#if defined(CONFIG_SOC_NRF5340_CPUAPP)
-	/* On nRF5340, the 32 Mbps speed is supported by the application core
-	 * when it is running at 128 MHz (see the Timing specifications section
-	 * in the nRF5340 PS).
-	 */
-	if (max_freq > 16000000 &&
-	    nrf_clock_hfclk_div_get(NRF_CLOCK) != NRF_CLOCK_HFCLK_DIV_1) {
-		max_freq = 16000000;
-	}
-#endif
-
-	config = dev_config->def_config;
-
-	/* Limit the frequency to that supported by the SPIM instance. */
-	config.frequency = get_nrf_spim_frequency(MIN(spi_cfg->frequency,
-						      max_freq));
-	config.mode      = get_nrf_spim_mode(spi_cfg->operation);
-	config.bit_order = get_nrf_spim_bit_order(spi_cfg->operation);
-
 	nrfy_gpio_pin_write(nrfy_spim_sck_pin_get(dev_config->spim.p_reg),
 			    spi_cfg->operation & SPI_MODE_CPOL ? 1 : 0);
 
-	if (dev_data->initialized) {
-		nrfx_spim_uninit(&dev_config->spim);
-		dev_data->initialized = false;
-	}
+	ctx->config = spi_cfg;
+#ifdef CONFIG_PM_DEVICE_RUNTIME
+	ret = pm_device_runtime_get(dev);
+#else
+	ret = spim_init(dev);
+#endif
+	if (ret < 0) {
 
-	result = nrfx_spim_init(&dev_config->spim, &config,
-				event_handler, (void *)dev);
-	if (result != NRFX_SUCCESS) {
-		LOG_ERR("Failed to initialize nrfx driver: %08x", result);
-		return -EIO;
+		return ret;
 	}
 
 	dev_data->initialized = true;
 
-	ctx->config = spi_cfg;
-
 	return 0;
 }
 
@@ -321,6 +341,7 @@ static void finish_transaction(const struct device *dev, int error)
 	dev_data->busy = false;
 
 	finalize_spi_transaction(dev, true);
+	(void)pm_device_runtime_put(dev);
 }
 
 static void transfer_next_chunk(const struct device *dev)
@@ -583,9 +604,7 @@ static int spim_nrfx_pm_action(const struct device *dev,
 		if (ret < 0) {
 			return ret;
 		}
-		/* nrfx_spim_init() will be called at configuration before
-		 * the next transfer.
-		 */
+		ret = spim_init(dev);
 		break;
 
 	case PM_DEVICE_ACTION_SUSPEND:
@@ -616,7 +635,10 @@ static int spi_nrfx_init(const struct device *dev)
 	struct spi_nrfx_data *dev_data = dev->data;
 	int err;
 
-	err = pinctrl_apply_state(dev_config->pcfg, PINCTRL_STATE_DEFAULT);
+	err = pinctrl_apply_state(dev_config->pcfg,
+				  COND_CODE_1(CONFIG_PM_DEVICE_RUNTIME,
+					      (PINCTRL_STATE_SLEEP),
+					      (PINCTRL_STATE_DEFAULT)));
 	if (err < 0) {
 		return err;
 	}
@@ -642,6 +664,11 @@ static int spi_nrfx_init(const struct device *dev)
 
 	spi_context_unlock_unconditionally(&dev_data->ctx);
 
+#ifdef CONFIG_PM_DEVICE_RUNTIME
+	pm_device_init_suspended(dev);
+	pm_device_runtime_enable(dev);
+#endif
+
 #ifdef CONFIG_SOC_NRF52832_ALLOW_SPIM_DESPITE_PAN_58
 	return anomaly_58_workaround_init(dev);
 #else
diff --git a/drivers/usb/common/usb_dwc2_hw.h b/drivers/usb/common/usb_dwc2_hw.h
index f36a2a17ca3..fcb35489a04 100644
--- a/drivers/usb/common/usb_dwc2_hw.h
+++ b/drivers/usb/common/usb_dwc2_hw.h
@@ -350,8 +350,27 @@ USB_DWC2_GET_FIELD_AND_IDX_DEFINE(ghwcfg1_epdir, GHWCFG1_EPDIR)
 
 /* GHWCFG2 register */
 #define USB_DWC2_GHWCFG2			0x0048UL
+#define USB_DWC2_GHWCFG2_TKNQDEPTH_POS		26UL
+#define USB_DWC2_GHWCFG2_TKNQDEPTH_MASK		(0x1FUL << USB_DWC2_GHWCFG2_TKNQDEPTH_POS)
+#define USB_DWC2_GHWCFG2_PTXQDEPTH_POS		24UL
+#define USB_DWC2_GHWCFG2_PTXQDEPTH_MASK		(0x3UL << USB_DWC2_GHWCFG2_PTXQDEPTH_POS)
+#define USB_DWC2_GHWCFG2_PTXQDEPTH_QUE16	3
+#define USB_DWC2_GHWCFG2_PTXQDEPTH_QUE8		2
+#define USB_DWC2_GHWCFG2_PTXQDEPTH_QUE4		1
+#define USB_DWC2_GHWCFG2_PTXQDEPTH_QUE2		0
+#define USB_DWC2_GHWCFG2_NPTXQDEPTH_POS		22UL
+#define USB_DWC2_GHWCFG2_NPTXQDEPTH_MASK	(0x3UL << USB_DWC2_GHWCFG2_NPTXQDEPTH_POS)
+#define USB_DWC2_GHWCFG2_NPTXQDEPTH_EIGHT	2
+#define USB_DWC2_GHWCFG2_NPTXQDEPTH_FOUR	1
+#define USB_DWC2_GHWCFG2_NPTXQDEPTH_TWO		0
+#define USB_DWC2_GHWCFG2_MULTIPROCINTRPT_POS	20UL
+#define USB_DWC2_GHWCFG2_MULTIPROCINTRPT	BIT(USB_DWC2_GHWCFG2_MULTIPROCINTRPT_POS)
 #define USB_DWC2_GHWCFG2_DYNFIFOSIZING_POS	19UL
 #define USB_DWC2_GHWCFG2_DYNFIFOSIZING		BIT(USB_DWC2_GHWCFG2_DYNFIFOSIZING_POS)
+#define USB_DWC2_GHWCFG2_PERIOSUPPORT_POS	18UL
+#define USB_DWC2_GHWCFG2_PERIOSUPPORT		BIT(USB_DWC2_GHWCFG2_PERIOSUPPORT_POS)
+#define USB_DWC2_GHWCFG2_NUMHSTCHNL_POS		14UL
+#define USB_DWC2_GHWCFG2_NUMHSTCHNL_MASK	(0xFUL << USB_DWC2_GHWCFG2_NUMHSTCHNL_POS)
 #define USB_DWC2_GHWCFG2_NUMDEVEPS_POS		10UL
 #define USB_DWC2_GHWCFG2_NUMDEVEPS_MASK		(0xFUL << USB_DWC2_GHWCFG2_NUMDEVEPS_POS)
 #define USB_DWC2_GHWCFG2_FSPHYTYPE_POS		8UL
@@ -366,6 +385,8 @@ USB_DWC2_GET_FIELD_AND_IDX_DEFINE(ghwcfg1_epdir, GHWCFG1_EPDIR)
 #define USB_DWC2_GHWCFG2_HSPHYTYPE_ULPI		2
 #define USB_DWC2_GHWCFG2_HSPHYTYPE_UTMIPLUS	1
 #define USB_DWC2_GHWCFG2_HSPHYTYPE_NO_HS	0
+#define USB_DWC2_GHWCFG2_SINGPNT_POS		5UL
+#define USB_DWC2_GHWCFG2_SINGPNT		BIT(USB_DWC2_GHWCFG2_SINGPNT_POS)
 #define USB_DWC2_GHWCFG2_OTGARCH_POS		3UL
 #define USB_DWC2_GHWCFG2_OTGARCH_MASK		(0x3UL << USB_DWC2_GHWCFG2_OTGARCH_POS)
 #define USB_DWC2_GHWCFG2_OTGARCH_INTERNALDMA	2
@@ -381,6 +402,10 @@ USB_DWC2_GET_FIELD_AND_IDX_DEFINE(ghwcfg1_epdir, GHWCFG1_EPDIR)
 #define USB_DWC2_GHWCFG2_OTGMODE_SRPOTG		1
 #define USB_DWC2_GHWCFG2_OTGMODE_HNPSRP		0
 
+USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_tknqdepth, GHWCFG2_TKNQDEPTH)
+USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_ptxqdepth, GHWCFG2_PTXQDEPTH)
+USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_nptxqdepth, GHWCFG2_NPTXQDEPTH)
+USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_numhstchnl, GHWCFG2_NUMHSTCHNL)
 USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_numdeveps, GHWCFG2_NUMDEVEPS)
 USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_fsphytype, GHWCFG2_FSPHYTYPE)
 USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_hsphytype, GHWCFG2_HSPHYTYPE)
@@ -393,10 +418,20 @@ USB_DWC2_GET_FIELD_DEFINE(ghwcfg2_otgmode, GHWCFG2_OTGMODE)
 #define USB_DWC2_GHWCFG3_DFIFODEPTH_MASK	(0xFFFFUL << USB_DWC2_GHWCFG3_DFIFODEPTH_POS)
 #define USB_DWC2_GHWCFG3_LPMMODE_POS		15UL
 #define USB_DWC2_GHWCFG3_LPMMODE		BIT(USB_DWC2_GHWCFG3_LPMMODE_POS)
+#define USB_DWC2_GHWCFG3_BCSUPPORT_POS		14UL
+#define USB_DWC2_GHWCFG3_BCSUPPORT		BIT(USB_DWC2_GHWCFG3_BCSUPPORT_POS)
+#define USB_DWC2_GHWCFG3_HSICMODE_POS		13UL
+#define USB_DWC2_GHWCFG3_HSICMODE		BIT(USB_DWC2_GHWCFG3_HSICMODE_POS)
+#define USB_DWC2_GHWCFG3_ADPSUPPORT_POS		12UL
+#define USB_DWC2_GHWCFG3_ADPSUPPORT		BIT(USB_DWC2_GHWCFG3_ADPSUPPORT_POS)
+#define USB_DWC2_GHWCFG3_RSTTYPE_POS		11UL
+#define USB_DWC2_GHWCFG3_RSTTYPE		BIT(USB_DWC2_GHWCFG3_RSTTYPE_POS)
 #define USB_DWC2_GHWCFG3_OPTFEATURE_POS		10UL
 #define USB_DWC2_GHWCFG3_OPTFEATURE		BIT(USB_DWC2_GHWCFG3_OPTFEATURE_POS)
 #define USB_DWC2_GHWCFG3_VNDCTLSUPT_POS		9UL
 #define USB_DWC2_GHWCFG3_VNDCTLSUPT		BIT(USB_DWC2_GHWCFG3_VNDCTLSUPT_POS)
+#define USB_DWC2_GHWCFG3_I2CINTSEL_POS		8UL
+#define USB_DWC2_GHWCFG3_I2CINTSEL		BIT(USB_DWC2_GHWCFG3_I2CINTSEL)
 #define USB_DWC2_GHWCFG3_OTGEN_POS		7UL
 #define USB_DWC2_GHWCFG3_OTGEN			BIT(USB_DWC2_GHWCFG3_OTGEN_POS)
 #define USB_DWC2_GHWCFG3_PKTSIZEWIDTH_POS	4UL
diff --git a/drivers/usb/udc/Kconfig.dwc2 b/drivers/usb/udc/Kconfig.dwc2
index 745429a94a1..4c023cfb04d 100644
--- a/drivers/usb/udc/Kconfig.dwc2
+++ b/drivers/usb/udc/Kconfig.dwc2
@@ -7,6 +7,7 @@ config UDC_DWC2
 	depends on DT_HAS_SNPS_DWC2_ENABLED
 	select NRFS if NRFS_HAS_VBUS_DETECTOR_SERVICE
 	select NRFS_VBUS_DETECTOR_SERVICE_ENABLED if NRFS_HAS_VBUS_DETECTOR_SERVICE
+	select EVENTS
 	help
 	  DWC2 USB device controller driver.
 
@@ -37,11 +38,3 @@ config UDC_DWC2_THREAD_PRIORITY
 	default 8
 	help
 	  DWC2 driver thread priority.
-
-config UDC_DWC2_MAX_QMESSAGES
-	int "UDC DWC2 maximum number of ISR event messages"
-	depends on UDC_DWC2
-	range 4 64
-	default 8
-	help
-	  DWC2 maximum number of ISR event messages.
diff --git a/drivers/usb/udc/udc_dwc2.c b/drivers/usb/udc/udc_dwc2.c
index dc520abe78a..2e56a9de180 100644
--- a/drivers/usb/udc/udc_dwc2.c
+++ b/drivers/usb/udc/udc_dwc2.c
@@ -29,32 +29,18 @@ enum dwc2_drv_event_type {
 	DWC2_DRV_EVT_XFER,
 	/* Setup packet received */
 	DWC2_DRV_EVT_SETUP,
-	/* OUT transaction for specific endpoint is finished */
-	DWC2_DRV_EVT_DOUT,
-	/* IN transaction for specific endpoint is finished */
-	DWC2_DRV_EVT_DIN,
-	/* Core should exit hibernation */
-	DWC2_DRV_EVT_HIBERNATION_EXIT,
+	/* Transaction on endpoint is finished */
+	DWC2_DRV_EVT_EP_FINISHED,
+	/* Remote Wakeup should be initiated */
+	DWC2_DRV_EVT_REMOTE_WAKEUP,
+	/* Core should enter hibernation */
+	DWC2_DRV_EVT_ENTER_HIBERNATION,
+	/* Core should exit hibernation due to bus reset */
+	DWC2_DRV_EVT_HIBERNATION_EXIT_BUS_RESET,
+	/* Core should exit hibernation due to host resume */
+	DWC2_DRV_EVT_HIBERNATION_EXIT_HOST_RESUME,
 };
 
-enum dwc2_hibernation_exit_reason {
-	DWC2_HIBERNATION_EXIT_BUS_RESET,
-	DWC2_HIBERNATION_EXIT_HOST_WAKEUP,
-};
-
-struct dwc2_drv_event {
-	const struct device *dev;
-	enum dwc2_drv_event_type type;
-	union {
-		uint8_t ep;
-		enum dwc2_hibernation_exit_reason exit_reason;
-	};
-};
-
-K_MSGQ_DEFINE(drv_msgq, sizeof(struct dwc2_drv_event),
-	      CONFIG_UDC_DWC2_MAX_QMESSAGES, sizeof(void *));
-
-
 /* Minimum RX FIFO size in 32-bit words considering the largest used OUT packet
  * of 512 bytes. The value must be adjusted according to the number of OUT
  * endpoints.
@@ -111,6 +97,12 @@ struct dwc2_reg_backup {
 /* Driver private data per instance */
 struct udc_dwc2_data {
 	struct k_thread thread_data;
+	/* Main events the driver thread waits for */
+	struct k_event drv_evt;
+	/* Transfer triggers (OUT on bits 0-15, IN on bits 16-31) */
+	struct k_event xfer_new;
+	/* Finished transactions (OUT on bits 0-15, IN on bits 16-31) */
+	struct k_event xfer_finished;
 	struct dwc2_reg_backup backup;
 	uint32_t ghwcfg1;
 	uint32_t txf_set;
@@ -125,6 +117,7 @@ struct udc_dwc2_data {
 	/* Configuration flags */
 	unsigned int dynfifosizing : 1;
 	unsigned int bufferdma : 1;
+	unsigned int syncrst : 1;
 	/* Runtime state flags */
 	unsigned int hibernated : 1;
 	unsigned int enumdone : 1;
@@ -139,13 +132,6 @@ struct udc_dwc2_data {
 	uint8_t setup[8];
 };
 
-static void dwc2_on_bus_reset(const struct device *dev);
-static void dwc2_exit_hibernation(const struct device *dev);
-static void dwc2_wait_for_bit(const struct device *dev,
-			      mem_addr_t addr, uint32_t bit);
-static void udc_dwc2_ep_disable(const struct device *dev,
-				struct udc_ep_config *const cfg, bool stall);
-
 #if defined(CONFIG_PINCTRL)
 #include <zephyr/drivers/pinctrl.h>
 
@@ -185,6 +171,33 @@ static inline struct usb_dwc2_reg *dwc2_get_base(const struct device *dev)
 	return config->base;
 }
 
+static void dwc2_wait_for_bit(const struct device *dev,
+			      mem_addr_t addr, uint32_t bit)
+{
+	k_timepoint_t timeout = sys_timepoint_calc(K_MSEC(100));
+
+	/* This could potentially be converted to use proper synchronization
+	 * primitives instead of busy looping, but the number of interrupt bits
+	 * this function can be waiting for is rather high.
+	 *
+	 * Busy looping is most likely fine unless profiling shows otherwise.
+	 */
+	while (!(sys_read32(addr) & bit)) {
+		if (dwc2_quirk_is_phy_clk_off(dev)) {
+			/* No point in waiting, because the bit can only be set
+			 * when the PHY is actively clocked.
+			 */
+			return;
+		}
+
+		if (sys_timepoint_expired(timeout)) {
+			LOG_ERR("Timeout waiting for bit 0x%08X at 0x%08X",
+				bit, (uint32_t)addr);
+			return;
+		}
+	}
+}
+
 /* Get DOEPCTLn or DIEPCTLn register address */
 static mem_addr_t dwc2_get_dxepctl_reg(const struct device *dev, const uint8_t ep)
 {
@@ -834,1934 +847,2098 @@ static int dwc2_handle_evt_din(const struct device *dev,
 	return udc_submit_ep_event(dev, buf, 0);
 }
 
-static ALWAYS_INLINE void dwc2_thread_handler(void *const arg)
+static void dwc2_backup_registers(const struct device *dev)
 {
-	const struct device *dev = (const struct device *)arg;
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
 	const struct udc_dwc2_config *const config = dev->config;
-	struct udc_ep_config *ep_cfg;
-	struct dwc2_drv_event evt;
+	struct usb_dwc2_reg *const base = config->base;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	struct dwc2_reg_backup *backup = &priv->backup;
 
-	/* This is the bottom-half of the ISR handler and the place where
-	 * a new transfer can be fed.
-	 */
-	k_msgq_get(&drv_msgq, &evt, K_FOREVER);
-	ep_cfg = udc_get_ep_cfg(dev, evt.ep);
+	backup->gotgctl = sys_read32((mem_addr_t)&base->gotgctl);
+	backup->gahbcfg = sys_read32((mem_addr_t)&base->gahbcfg);
+	backup->gusbcfg = sys_read32((mem_addr_t)&base->gusbcfg);
+	backup->gintmsk = sys_read32((mem_addr_t)&base->gintmsk);
+	backup->grxfsiz = sys_read32((mem_addr_t)&base->grxfsiz);
+	backup->gnptxfsiz = sys_read32((mem_addr_t)&base->gnptxfsiz);
+	backup->gi2cctl = sys_read32((mem_addr_t)&base->gi2cctl);
+	backup->glpmcfg = sys_read32((mem_addr_t)&base->glpmcfg);
+	backup->gdfifocfg = sys_read32((mem_addr_t)&base->gdfifocfg);
 
-	switch (evt.type) {
-	case DWC2_DRV_EVT_XFER:
-		LOG_DBG("New transfer in the queue");
-		break;
-	case DWC2_DRV_EVT_SETUP:
-		LOG_DBG("SETUP event");
-		dwc2_handle_evt_setup(dev);
-		break;
-	case DWC2_DRV_EVT_DOUT:
-		LOG_DBG("DOUT event ep 0x%02x", ep_cfg->addr);
-		dwc2_handle_evt_dout(dev, ep_cfg);
-		break;
-	case DWC2_DRV_EVT_DIN:
-		LOG_DBG("DIN event");
-		dwc2_handle_evt_din(dev, ep_cfg);
-		break;
-	case DWC2_DRV_EVT_HIBERNATION_EXIT:
-		LOG_DBG("Hibernation exit event");
-		config->irq_disable_func(dev);
+	for (uint8_t i = 1U; i < priv->ineps; i++) {
+		backup->dieptxf[i - 1] = sys_read32((mem_addr_t)&base->dieptxf[i - 1]);
+	}
 
-		if (priv->hibernated) {
-			dwc2_exit_hibernation(dev);
+	backup->dcfg = sys_read32((mem_addr_t)&base->dcfg);
+	backup->dctl = sys_read32((mem_addr_t)&base->dctl);
+	backup->diepmsk = sys_read32((mem_addr_t)&base->diepmsk);
+	backup->doepmsk = sys_read32((mem_addr_t)&base->doepmsk);
+	backup->daintmsk = sys_read32((mem_addr_t)&base->daintmsk);
 
-			/* Let stack know we are no longer suspended */
-			udc_set_suspended(dev, false);
-			udc_submit_event(dev, UDC_EVT_RESUME, 0);
+	for (uint8_t i = 0U; i < 16; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
 
-			if (evt.exit_reason == DWC2_HIBERNATION_EXIT_BUS_RESET) {
-				dwc2_on_bus_reset(dev);
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_IN || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			backup->diepctl[i] = sys_read32((mem_addr_t)&base->in_ep[i].diepctl);
+			if (backup->diepctl[i] & USB_DWC2_DEPCTL_DPID) {
+				backup->diepctl[i] |= USB_DWC2_DEPCTL_SETD1PID;
+			} else {
+				backup->diepctl[i] |= USB_DWC2_DEPCTL_SETD0PID;
 			}
+			backup->dieptsiz[i] = sys_read32((mem_addr_t)&base->in_ep[i].dieptsiz);
+			backup->diepdma[i] = sys_read32((mem_addr_t)&base->in_ep[i].diepdma);
 		}
 
-		config->irq_enable_func(dev);
-		break;
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			backup->doepctl[i] = sys_read32((mem_addr_t)&base->out_ep[i].doepctl);
+			if (backup->doepctl[i] & USB_DWC2_DEPCTL_DPID) {
+				backup->doepctl[i] |= USB_DWC2_DEPCTL_SETD1PID;
+			} else {
+				backup->doepctl[i] |= USB_DWC2_DEPCTL_SETD0PID;
+			}
+			backup->doeptsiz[i] = sys_read32((mem_addr_t)&base->out_ep[i].doeptsiz);
+			backup->doepdma[i] = sys_read32((mem_addr_t)&base->out_ep[i].doepdma);
+		}
 	}
 
-	if (ep_cfg->addr != USB_CONTROL_EP_OUT && !udc_ep_is_busy(dev, ep_cfg->addr)) {
-		dwc2_handle_xfer_next(dev, ep_cfg);
-	} else {
-		LOG_DBG("ep 0x%02x busy", ep_cfg->addr);
-	}
+	backup->pcgcctl = sys_read32((mem_addr_t)&base->pcgcctl);
 }
 
-static void dwc2_on_bus_reset(const struct device *dev)
+static void dwc2_restore_essential_registers(const struct device *dev,
+					     bool rwup)
 {
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	uint32_t doepmsk;
+	struct dwc2_reg_backup *backup = &priv->backup;
+	uint32_t pcgcctl = backup->pcgcctl & USB_DWC2_PCGCCTL_RESTOREVALUE_MASK;
 
-	/* Set the NAK bit for all OUT endpoints */
-	for (uint8_t i = 0U; i < priv->numdeveps; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
-		mem_addr_t doepctl_reg;
+	sys_write32(backup->glpmcfg, (mem_addr_t)&base->glpmcfg);
+	sys_write32(backup->gi2cctl, (mem_addr_t)&base->gi2cctl);
+	sys_write32(pcgcctl, (mem_addr_t)&base->pcgcctl);
 
-		LOG_DBG("ep 0x%02x EPDIR %u", i, epdir);
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT ||
-		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			doepctl_reg = dwc2_get_dxepctl_reg(dev, i);
-			sys_write32(USB_DWC2_DEPCTL_SNAK, doepctl_reg);
-		}
-	}
+	sys_write32(backup->gahbcfg | USB_DWC2_GAHBCFG_GLBINTRMASK,
+		    (mem_addr_t)&base->gahbcfg);
 
-	doepmsk = USB_DWC2_DOEPINT_SETUP | USB_DWC2_DOEPINT_XFERCOMPL;
-	if (priv->bufferdma) {
-		doepmsk |= USB_DWC2_DOEPINT_STSPHSERCVD;
-	}
+	sys_write32(0xFFFFFFFFUL, (mem_addr_t)&base->gintsts);
+	sys_write32(USB_DWC2_GINTSTS_RSTRDONEINT, (mem_addr_t)&base->gintmsk);
 
-	sys_write32(doepmsk, (mem_addr_t)&base->doepmsk);
-	sys_set_bits((mem_addr_t)&base->diepmsk, USB_DWC2_DIEPINT_XFERCOMPL);
+	sys_write32(backup->gusbcfg, (mem_addr_t)&base->gusbcfg);
+	sys_write32(backup->dcfg, (mem_addr_t)&base->dcfg);
 
-	/* Software has to handle RxFLvl interrupt only in Completer mode */
-	if (!priv->bufferdma) {
-		sys_set_bits((mem_addr_t)&base->gintmsk,
-			     USB_DWC2_GINTSTS_RXFLVL);
+	if (!rwup) {
+		pcgcctl |= USB_DWC2_PCGCCTL_RESTOREMODE | USB_DWC2_PCGCCTL_RSTPDWNMODULE;
 	}
+	sys_write32(pcgcctl, (mem_addr_t)&base->pcgcctl);
+	k_busy_wait(1);
 
-	/* Clear device address during reset. */
-	sys_clear_bits((mem_addr_t)&base->dcfg, USB_DWC2_DCFG_DEVADDR_MASK);
-
-	/* Speed enumeration must happen after reset. */
-	priv->enumdone = 0;
-}
-
-static void dwc2_handle_enumdone(const struct device *dev)
-{
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	uint32_t dsts;
-
-	dsts = sys_read32((mem_addr_t)&base->dsts);
-	priv->enumspd = usb_dwc2_get_dsts_enumspd(dsts);
-	priv->enumdone = 1;
+	pcgcctl |= USB_DWC2_PCGCCTL_ESSREGRESTORED;
+	sys_write32(pcgcctl, (mem_addr_t)&base->pcgcctl);
 }
 
-static inline int dwc2_read_fifo_setup(const struct device *dev, uint8_t ep,
-				       const size_t size)
+static void dwc2_restore_device_registers(const struct device *dev, bool rwup)
 {
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	size_t offset;
+	struct dwc2_reg_backup *backup = &priv->backup;
 
-	/* FIFO access is always in 32-bit words */
+	sys_write32(backup->gotgctl, (mem_addr_t)&base->gotgctl);
+	sys_write32(backup->gahbcfg, (mem_addr_t)&base->gahbcfg);
+	sys_write32(backup->gusbcfg, (mem_addr_t)&base->gusbcfg);
+	sys_write32(backup->gintmsk, (mem_addr_t)&base->gintmsk);
+	sys_write32(backup->grxfsiz, (mem_addr_t)&base->grxfsiz);
+	sys_write32(backup->gnptxfsiz, (mem_addr_t)&base->gnptxfsiz);
+	sys_write32(backup->gdfifocfg, (mem_addr_t)&base->gdfifocfg);
 
-	if (size != 8) {
-		LOG_ERR("%d bytes SETUP", size);
+	for (uint8_t i = 1U; i < priv->ineps; i++) {
+		sys_write32(backup->dieptxf[i - 1], (mem_addr_t)&base->dieptxf[i - 1]);
 	}
 
-	/*
-	 * We store the setup packet temporarily in the driver's private data
-	 * because there is always a race risk after the status stage OUT
-	 * packet from the host and the new setup packet. This is fine in
-	 * bottom-half processing because the events arrive in a queue and
-	 * there will be a next net_buf for the setup packet.
-	 */
-	for (offset = 0; offset < MIN(size, 8); offset += 4) {
-		sys_put_le32(sys_read32(UDC_DWC2_EP_FIFO(base, ep)),
-			     &priv->setup[offset]);
+	if (!rwup) {
+		sys_write32(backup->dctl, (mem_addr_t)&base->dctl);
 	}
 
-	/* On protocol error simply discard extra data */
-	while (offset < size) {
-		sys_read32(UDC_DWC2_EP_FIFO(base, ep));
-		offset += 4;
-	}
+	sys_write32(backup->diepmsk, (mem_addr_t)&base->diepmsk);
+	sys_write32(backup->doepmsk, (mem_addr_t)&base->doepmsk);
+	sys_write32(backup->daintmsk, (mem_addr_t)&base->daintmsk);
 
-	return 0;
+	for (uint8_t i = 0U; i < 16; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_IN || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			sys_write32(backup->dieptsiz[i], (mem_addr_t)&base->in_ep[i].dieptsiz);
+			sys_write32(backup->diepdma[i], (mem_addr_t)&base->in_ep[i].diepdma);
+			sys_write32(backup->diepctl[i], (mem_addr_t)&base->in_ep[i].diepctl);
+		}
+
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			sys_write32(backup->doeptsiz[i], (mem_addr_t)&base->out_ep[i].doeptsiz);
+			sys_write32(backup->doepdma[i], (mem_addr_t)&base->out_ep[i].doepdma);
+			sys_write32(backup->doepctl[i], (mem_addr_t)&base->out_ep[i].doepctl);
+		}
+	}
 }
 
-static inline void dwc2_handle_rxflvl(const struct device *dev)
+static void dwc2_enter_hibernation(const struct device *dev)
 {
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	struct udc_ep_config *ep_cfg;
-	struct net_buf *buf;
-	uint32_t grxstsp;
-	uint32_t pktsts;
-	uint32_t bcnt;
-	uint8_t ep;
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	mem_addr_t gpwrdn_reg = (mem_addr_t)&base->gpwrdn;
+	mem_addr_t pcgcctl_reg = (mem_addr_t)&base->pcgcctl;
 
-	grxstsp = sys_read32((mem_addr_t)&base->grxstsp);
-	ep = usb_dwc2_get_grxstsp_epnum(grxstsp);
-	bcnt = usb_dwc2_get_grxstsp_bcnt(grxstsp);
-	pktsts = usb_dwc2_get_grxstsp_pktsts(grxstsp);
+	dwc2_backup_registers(dev);
 
-	LOG_DBG("ep 0x%02x: pktsts %u, bcnt %u", ep, pktsts, bcnt);
+	/* This code currently only supports UTMI+. UTMI+ runs at either 30 or
+	 * 60 MHz and therefore 1 us busy waits have sufficiently large margin.
+	 */
 
-	switch (pktsts) {
-	case USB_DWC2_GRXSTSR_PKTSTS_SETUP:
-		dwc2_read_fifo_setup(dev, ep, bcnt);
-		break;
-	case USB_DWC2_GRXSTSR_PKTSTS_OUT_DATA:
-		ep_cfg = udc_get_ep_cfg(dev, ep);
+	/* Enable PMU Logic */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUACTV);
+	k_busy_wait(1);
 
-		buf = udc_buf_peek(dev, ep_cfg->addr);
+	/* Stop PHY clock */
+	sys_set_bits(pcgcctl_reg, USB_DWC2_PCGCCTL_STOPPCLK);
+	k_busy_wait(1);
 
-		/* RxFIFO data must be retrieved even when buf is NULL */
-		dwc2_read_fifo(dev, ep, buf, bcnt);
-		break;
-	case USB_DWC2_GRXSTSR_PKTSTS_OUT_DATA_DONE:
-		LOG_DBG("RX pktsts DONE");
-		break;
-	case USB_DWC2_GRXSTSR_PKTSTS_SETUP_DONE:
-		LOG_DBG("SETUP pktsts DONE");
-	case USB_DWC2_GRXSTSR_PKTSTS_GLOBAL_OUT_NAK:
-		LOG_DBG("Global OUT NAK");
-		break;
-	default:
-		break;
-	}
-}
+	/* Enable PMU interrupt */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUINTSEL);
+	k_busy_wait(1);
 
-static inline void dwc2_handle_in_xfercompl(const struct device *dev,
-					    const uint8_t ep_idx)
-{
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct udc_ep_config *ep_cfg;
-	struct dwc2_drv_event evt;
-	struct net_buf *buf;
+	/* Unmask PMU interrupt bits */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_LINESTAGECHANGEMSK |
+				 USB_DWC2_GPWRDN_RESETDETMSK |
+				 USB_DWC2_GPWRDN_DISCONNECTDETECTMSK |
+				 USB_DWC2_GPWRDN_STSCHNGINTMSK);
+	k_busy_wait(1);
 
-	ep_cfg = udc_get_ep_cfg(dev, ep_idx | USB_EP_DIR_IN);
-	buf = udc_buf_peek(dev, ep_cfg->addr);
-	if (buf == NULL) {
-		udc_submit_event(dev, UDC_EVT_ERROR, -ENOBUFS);
-		return;
-	}
+	/* Enable power clamps */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNCLMP);
+	k_busy_wait(1);
 
-	net_buf_pull(buf, priv->tx_len[ep_idx]);
-	if (buf->len  && dwc2_tx_fifo_write(dev, ep_cfg, buf) == 0) {
-		return;
-	}
+	/* Switch off power to the controller */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNSWTCH);
 
-	evt.dev = dev;
-	evt.ep = ep_cfg->addr;
-	evt.type = DWC2_DRV_EVT_DIN;
-	k_msgq_put(&drv_msgq, &evt, K_NO_WAIT);
+	/* Mark that the core is hibernated */
+	priv->hibernated = 1;
+	LOG_DBG("Hibernated");
 }
 
-static inline void dwc2_handle_iepint(const struct device *dev)
+static void dwc2_exit_hibernation(const struct device *dev, bool rwup)
 {
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	const uint8_t n_max = 16;
-	uint32_t diepmsk;
-	uint32_t daint;
-
-	diepmsk = sys_read32((mem_addr_t)&base->diepmsk);
-	daint = sys_read32((mem_addr_t)&base->daint);
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	mem_addr_t gpwrdn_reg = (mem_addr_t)&base->gpwrdn;
+	mem_addr_t pcgcctl_reg = (mem_addr_t)&base->pcgcctl;
 
-	for (uint8_t n = 0U; n < n_max; n++) {
-		mem_addr_t diepint_reg = (mem_addr_t)&base->in_ep[n].diepint;
-		uint32_t diepint;
-		uint32_t status;
+	/* Switch on power to the controller */
+	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNSWTCH);
+	k_busy_wait(1);
 
-		if (daint & USB_DWC2_DAINT_INEPINT(n)) {
-			/* Read and clear interrupt status */
-			diepint = sys_read32(diepint_reg);
-			status = diepint & diepmsk;
-			sys_write32(status, diepint_reg);
+	/* Reset the controller */
+	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNRST_N);
+	k_busy_wait(1);
 
-			LOG_DBG("ep 0x%02x interrupt status: 0x%x",
-				n | USB_EP_DIR_IN, status);
+	/* Enable restore from PMU */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_RESTORE);
+	k_busy_wait(1);
 
-			if (status & USB_DWC2_DIEPINT_XFERCOMPL) {
-				dwc2_handle_in_xfercompl(dev, n);
-			}
+	/* Disable power clamps */
+	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNCLMP);
 
+	if (rwup) {
+		if (priv->syncrst) {
+			k_busy_wait(1);
+		} else {
+			k_busy_wait(50);
 		}
 	}
 
-	/* Clear IEPINT interrupt */
-	sys_write32(USB_DWC2_GINTSTS_IEPINT, (mem_addr_t)&base->gintsts);
-}
+	/* Remove reset to the controller */
+	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNRST_N);
+	k_busy_wait(1);
 
-static inline void dwc2_handle_out_xfercompl(const struct device *dev,
-					     const uint8_t ep_idx)
-{
-	struct udc_ep_config *ep_cfg = udc_get_ep_cfg(dev, ep_idx);
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	struct dwc2_drv_event evt;
-	uint32_t bcnt;
-	struct net_buf *buf;
-	uint32_t doeptsiz;
-	const bool is_iso = dwc2_ep_is_iso(ep_cfg);
+	/* Disable PMU interrupt */
+	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUINTSEL);
 
-	doeptsiz = sys_read32((mem_addr_t)&base->out_ep[ep_idx].doeptsiz);
+	dwc2_restore_essential_registers(dev, rwup);
 
-	buf = udc_buf_peek(dev, ep_cfg->addr);
-	if (!buf) {
-		LOG_ERR("No buffer for ep 0x%02x", ep_cfg->addr);
-		udc_submit_event(dev, UDC_EVT_ERROR, -ENOBUFS);
-		return;
-	}
+	/* Note: in Remote Wakeup case 15 ms max signaling time starts now */
 
-	evt.type = DWC2_DRV_EVT_DOUT;
-	evt.ep = ep_cfg->addr;
+	/* Wait for Restore Done Interrupt */
+	dwc2_wait_for_bit(dev, (mem_addr_t)&base->gintsts, USB_DWC2_GINTSTS_RSTRDONEINT);
+	sys_write32(0xFFFFFFFFUL, (mem_addr_t)&base->gintsts);
 
-	/* The original transfer size value is necessary here because controller
-	 * decreases the value for every byte stored.
-	 */
-	bcnt = usb_dwc2_get_doeptsizn_xfersize(priv->rx_siz[ep_idx]) -
-	       usb_dwc2_get_doeptsizn_xfersize(doeptsiz);
+	/* Disable restore from PMU */
+	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_RESTORE);
+	k_busy_wait(1);
 
-	if (is_iso) {
-		uint32_t pkts;
-		bool valid;
+	if (!rwup) {
+		/* Clear reset to power down module */
+		sys_clear_bits(pcgcctl_reg, USB_DWC2_PCGCCTL_RSTPDWNMODULE);
+	}
 
-		pkts = usb_dwc2_get_doeptsizn_pktcnt(priv->rx_siz[ep_idx]) -
-			usb_dwc2_get_doeptsizn_pktcnt(doeptsiz);
-		switch (usb_dwc2_get_doeptsizn_rxdpid(doeptsiz)) {
-		case USB_DWC2_DOEPTSIZN_RXDPID_DATA0:
-			valid = (pkts == 1);
-			break;
-		case USB_DWC2_DOEPTSIZN_RXDPID_DATA1:
-			valid = (pkts == 2);
-			break;
-		case USB_DWC2_DOEPTSIZN_RXDPID_DATA2:
-			valid = (pkts == 3);
-			break;
-		case USB_DWC2_DOEPTSIZN_RXDPID_MDATA:
-		default:
-			valid = false;
-			break;
-		}
+	/* Restore GUSBCFG, DCFG and DCTL */
+	sys_write32(priv->backup.gusbcfg, (mem_addr_t)&base->gusbcfg);
+	sys_write32(priv->backup.dcfg, (mem_addr_t)&base->dcfg);
+	sys_write32(priv->backup.dctl, (mem_addr_t)&base->dctl);
 
-		if (!valid) {
-			if (!priv->bufferdma) {
-				/* RxFlvl added data to net buf, rollback */
-				net_buf_remove_mem(buf, bcnt);
-			}
-			/* Data is not valid, discard it */
-			bcnt = 0;
-		}
+	/* Disable PMU */
+	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUACTV);
+	if (!rwup) {
+		k_busy_wait(5);
+		sys_set_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_PWRONPRGDONE);
+	} else {
+		k_busy_wait(1);
+		sys_write32(USB_DWC2_DCTL_RMTWKUPSIG | priv->backup.dctl,
+			    (mem_addr_t)&base->dctl);
 	}
 
-	if (priv->bufferdma && bcnt) {
-		sys_cache_data_invd_range(buf->data, bcnt);
-		net_buf_add(buf, bcnt);
-	}
+	k_msleep(1);
+	sys_write32(0xFFFFFFFFUL, (mem_addr_t)&base->gintsts);
+}
 
-	if (!is_iso && (bcnt % udc_mps_ep_size(ep_cfg)) == 0 &&
-	    net_buf_tailroom(buf)) {
-		dwc2_prep_rx(dev, buf, ep_cfg);
-	} else {
-		k_msgq_put(&drv_msgq, &evt, K_NO_WAIT);
+static void cancel_hibernation_request(struct udc_dwc2_data *const priv)
+{
+	k_event_clear(&priv->drv_evt, BIT(DWC2_DRV_EVT_ENTER_HIBERNATION));
+}
+
+static void request_hibernation(struct udc_dwc2_data *const priv)
+{
+	if (priv->suspend_type == DWC2_SUSPEND_HIBERNATION) {
+		k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_ENTER_HIBERNATION));
 	}
 }
 
-static inline void dwc2_handle_oepint(const struct device *dev)
+static void dwc2_unset_unused_fifo(const struct device *dev)
 {
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	const uint8_t n_max = 16;
-	uint32_t doepmsk;
-	uint32_t daint;
-
-	doepmsk = sys_read32((mem_addr_t)&base->doepmsk);
-	daint = sys_read32((mem_addr_t)&base->daint);
+	struct udc_ep_config *tmp;
 
-	for (uint8_t n = 0U; n < n_max; n++) {
-		mem_addr_t doepint_reg = (mem_addr_t)&base->out_ep[n].doepint;
-		uint32_t doepint;
-		uint32_t status;
+	for (uint8_t i = priv->ineps - 1U; i > 0; i--) {
+		tmp = udc_get_ep_cfg(dev, i | USB_EP_DIR_IN);
 
-		if (!(daint & USB_DWC2_DAINT_OUTEPINT(n))) {
-			continue;
+		if (tmp->stat.enabled && (priv->txf_set & BIT(i))) {
+			return;
 		}
 
-		/* Read and clear interrupt status */
-		doepint = sys_read32(doepint_reg);
-		status = doepint & doepmsk;
-		sys_write32(status, doepint_reg);
+		if (!tmp->stat.enabled && (priv->txf_set & BIT(i))) {
+			priv->txf_set &= ~BIT(i);
+		}
+	}
+}
 
-		LOG_DBG("ep 0x%02x interrupt status: 0x%x", n, status);
+/*
+ * In dedicated FIFO mode there are i (i = 1 ... ineps - 1) FIFO size registers,
+ * e.g. DIEPTXF1, DIEPTXF2, ... DIEPTXF4. When dynfifosizing is enabled,
+ * the size register is mutable. The offset of DIEPTXF1 registers is 0.
+ */
+static int dwc2_set_dedicated_fifo(const struct device *dev,
+				   struct udc_ep_config *const cfg,
+				   uint32_t *const diepctl)
+{
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
+	const uint32_t addnl = USB_MPS_ADDITIONAL_TRANSACTIONS(cfg->mps);
+	uint32_t reqdep;
+	uint32_t txfaddr;
+	uint32_t txfdep;
+	uint32_t tmp;
 
-		/* StupPktRcvd is not enabled for interrupt, but must be checked
-		 * when XferComp hits to determine if SETUP token was received.
-		 */
-		if (priv->bufferdma && (status & USB_DWC2_DOEPINT_XFERCOMPL) &&
-		    (doepint & USB_DWC2_DOEPINT_STUPPKTRCVD)) {
-			uint32_t addr;
+	/* Keep everything but FIFO number */
+	tmp = *diepctl & ~USB_DWC2_DEPCTL_TXFNUM_MASK;
 
-			sys_write32(USB_DWC2_DOEPINT_STUPPKTRCVD, doepint_reg);
-			status &= ~USB_DWC2_DOEPINT_XFERCOMPL;
+	reqdep = DIV_ROUND_UP(udc_mps_ep_size(cfg), 4U);
+	if (priv->bufferdma) {
+		/* In DMA mode, TxFIFO capable of holding 2 packets is enough */
+		reqdep *= MIN(2, (1 + addnl));
+	} else {
+		reqdep *= (1 + addnl);
+	}
 
-			/* DMAAddr points past the memory location where the
-			 * SETUP data was stored. Copy the received SETUP data
-			 * to temporary location used also in Completer mode
-			 * which allows common SETUP interrupt handling.
-			 */
-			addr = sys_read32((mem_addr_t)&base->out_ep[0].doepdma);
-			sys_cache_data_invd_range((void *)(addr - 8), 8);
-			memcpy(priv->setup, (void *)(addr - 8), sizeof(priv->setup));
+	if (priv->dynfifosizing) {
+		if (priv->txf_set & ~BIT_MASK(ep_idx)) {
+			dwc2_unset_unused_fifo(dev);
 		}
 
-		if (status & USB_DWC2_DOEPINT_SETUP) {
-			struct dwc2_drv_event evt = {
-				.type = DWC2_DRV_EVT_SETUP,
-				.ep = USB_CONTROL_EP_OUT,
-			};
+		if (priv->txf_set & ~BIT_MASK(ep_idx)) {
+			LOG_WRN("Some of the FIFOs higher than %u are set, %lx",
+				ep_idx, priv->txf_set & ~BIT_MASK(ep_idx));
+			return -EIO;
+		}
 
-			k_msgq_put(&drv_msgq, &evt, K_NO_WAIT);
+		if ((ep_idx - 1) != 0U) {
+			txfaddr = dwc2_get_txfdep(dev, ep_idx - 2) +
+				  dwc2_get_txfaddr(dev, ep_idx - 2);
+		} else {
+			txfaddr = priv->rxfifo_depth +
+				MAX(UDC_DWC2_FIFO0_DEPTH, priv->max_txfifo_depth[0]);
 		}
 
-		if (status & USB_DWC2_DOEPINT_STSPHSERCVD) {
-			/* Driver doesn't need any special handling, but it is
-			 * mandatory that the bit is cleared in Buffer DMA mode.
-			 * If the bit is not cleared (i.e. when this interrupt
-			 * bit is masked), then SETUP interrupts will cease
-			 * after first control transfer with data stage from
-			 * device to host.
-			 */
+		/* Make sure to not set TxFIFO greater than hardware allows */
+		txfdep = reqdep;
+		if (txfdep > priv->max_txfifo_depth[ep_idx]) {
+			return -ENOMEM;
 		}
 
-		if (status & USB_DWC2_DOEPINT_XFERCOMPL) {
-			dwc2_handle_out_xfercompl(dev, n);
+		/* Do not allocate TxFIFO outside the SPRAM */
+		if (txfaddr + txfdep > priv->dfifodepth) {
+			return -ENOMEM;
+		}
+
+		/* Set FIFO depth (32-bit words) and address */
+		dwc2_set_txf(dev, ep_idx - 1, txfdep, txfaddr);
+	} else {
+		txfdep = dwc2_get_txfdep(dev, ep_idx - 1);
+		txfaddr = dwc2_get_txfaddr(dev, ep_idx - 1);
+
+		if (reqdep > txfdep) {
+			return -ENOMEM;
 		}
+
+		LOG_DBG("Reuse FIFO%u addr 0x%08x depth %u", ep_idx, txfaddr, txfdep);
 	}
 
-	/* Clear OEPINT interrupt */
-	sys_write32(USB_DWC2_GINTSTS_OEPINT, (mem_addr_t)&base->gintsts);
-}
+	/* Assign FIFO to the IN endpoint */
+	*diepctl = tmp | usb_dwc2_set_depctl_txfnum(ep_idx);
+	priv->txf_set |= BIT(ep_idx);
+	dwc2_flush_tx_fifo(dev, ep_idx);
 
-/* In DWC2 otg context incomplete isochronous IN transfer means that the host
- * did not issue IN token to at least one isochronous endpoint and software has
- * find on which endpoints the data is no longer valid and discard it.
- */
-static void dwc2_handle_incompisoin(const struct device *dev)
-{
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	mem_addr_t gintsts_reg = (mem_addr_t)&base->gintsts;
-	const uint32_t mask =
-		USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPTYPE_MASK |
-		USB_DWC2_DEPCTL_USBACTEP;
-	const uint32_t val =
-		USB_DWC2_DEPCTL_EPENA |
-		usb_dwc2_set_depctl_eptype(USB_DWC2_DEPCTL_EPTYPE_ISO) |
-		USB_DWC2_DEPCTL_USBACTEP;
+	LOG_INF("Set FIFO%u (ep 0x%02x) addr 0x%04x depth %u size %u",
+		ep_idx, cfg->addr, txfaddr, txfdep, dwc2_ftx_avail(dev, ep_idx));
 
-	for (uint8_t i = 1U; i < priv->numdeveps; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+	return 0;
+}
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_IN ||
-		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			mem_addr_t diepctl_reg = dwc2_get_dxepctl_reg(dev, i | USB_EP_DIR_IN);
-			uint32_t diepctl;
+static int dwc2_ep_control_enable(const struct device *dev,
+				  struct udc_ep_config *const cfg)
+{
+	mem_addr_t dxepctl0_reg;
+	uint32_t dxepctl0;
 
-			diepctl = sys_read32(diepctl_reg);
+	dxepctl0_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
+	dxepctl0 = sys_read32(dxepctl0_reg);
 
-			/* Check if endpoint didn't receive ISO OUT data */
-			if ((diepctl & mask) == val) {
-				struct udc_ep_config *cfg;
-				struct net_buf *buf;
+	dxepctl0 &= ~USB_DWC2_DEPCTL0_MPS_MASK;
+	switch (cfg->mps) {
+	case 8:
+		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_8 << USB_DWC2_DEPCTL_MPS_POS;
+		break;
+	case 16:
+		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_16 << USB_DWC2_DEPCTL_MPS_POS;
+		break;
+	case 32:
+		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_32 << USB_DWC2_DEPCTL_MPS_POS;
+		break;
+	case 64:
+		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_64 << USB_DWC2_DEPCTL_MPS_POS;
+		break;
+	default:
+		return -EINVAL;
+	}
 
-				cfg = udc_get_ep_cfg(dev, i | USB_EP_DIR_IN);
-				__ASSERT_NO_MSG(cfg && cfg->stat.enabled &&
-						dwc2_ep_is_iso(cfg));
+	dxepctl0 |= USB_DWC2_DEPCTL_USBACTEP;
 
-				udc_dwc2_ep_disable(dev, cfg, false);
+	if (cfg->addr == USB_CONTROL_EP_OUT) {
+		int ret;
 
-				buf = udc_buf_get(dev, cfg->addr);
-				if (buf) {
-					udc_submit_ep_event(dev, buf, 0);
-				}
-			}
+		dwc2_flush_rx_fifo(dev);
+		ret = dwc2_ctrl_feed_dout(dev, 8);
+		if (ret) {
+			return ret;
 		}
+	} else {
+		dwc2_flush_tx_fifo(dev, 0);
 	}
 
-	sys_write32(USB_DWC2_GINTSTS_INCOMPISOIN, gintsts_reg);
+	sys_write32(dxepctl0, dxepctl0_reg);
+	dwc2_set_epint(dev, cfg, true);
+
+	return 0;
 }
 
-/* In DWC2 otg context incomplete isochronous OUT transfer means that the host
- * did not issue OUT token to at least one isochronous endpoint and software has
- * to find on which endpoint it didn't receive any data and let the stack know.
- */
-static void dwc2_handle_incompisoout(const struct device *dev)
+static int udc_dwc2_ep_activate(const struct device *dev,
+				struct udc_ep_config *const cfg)
 {
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	mem_addr_t gintsts_reg = (mem_addr_t)&base->gintsts;
-	const uint32_t mask =
-		USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPTYPE_MASK |
-		USB_DWC2_DEPCTL_DPID | USB_DWC2_DEPCTL_USBACTEP;
-	const uint32_t val =
-		USB_DWC2_DEPCTL_EPENA |
-		usb_dwc2_set_depctl_eptype(USB_DWC2_DEPCTL_EPTYPE_ISO) |
-		((priv->sof_num & 1) ? USB_DWC2_DEPCTL_DPID : 0) |
-		USB_DWC2_DEPCTL_USBACTEP;
+	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
+	mem_addr_t dxepctl_reg;
+	uint32_t dxepctl;
 
-	for (uint8_t i = 1U; i < priv->numdeveps; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+	LOG_DBG("Enable ep 0x%02x", cfg->addr);
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT ||
-		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			mem_addr_t doepctl_reg = dwc2_get_dxepctl_reg(dev, i);
-			uint32_t doepctl;
+	if (ep_idx == 0U) {
+		return dwc2_ep_control_enable(dev, cfg);
+	}
 
-			doepctl = sys_read32(doepctl_reg);
+	if (USB_EP_DIR_IS_OUT(cfg->addr)) {
+		/* TODO: use dwc2_get_dxepctl_reg() */
+		dxepctl_reg = (mem_addr_t)&base->out_ep[ep_idx].doepctl;
+	} else {
+		if (priv->ineps > 0U && ep_idx > (priv->ineps - 1U)) {
+			LOG_ERR("No resources available for ep 0x%02x", cfg->addr);
+			return -EINVAL;
+		}
 
-			/* Check if endpoint didn't receive ISO OUT data */
-			if ((doepctl & mask) == val) {
-				struct udc_ep_config *cfg;
-				struct net_buf *buf;
+		dxepctl_reg = (mem_addr_t)&base->in_ep[ep_idx].diepctl;
+	}
 
-				cfg = udc_get_ep_cfg(dev, i);
-				__ASSERT_NO_MSG(cfg && cfg->stat.enabled &&
-						dwc2_ep_is_iso(cfg));
+	dxepctl = sys_read32(dxepctl_reg);
+	/* Set max packet size */
+	dxepctl &= ~USB_DWC2_DEPCTL_MPS_MASK;
+	dxepctl |= usb_dwc2_set_depctl_mps(udc_mps_ep_size(cfg));
 
-				udc_dwc2_ep_disable(dev, cfg, false);
+	/* Set endpoint type */
+	dxepctl &= ~USB_DWC2_DEPCTL_EPTYPE_MASK;
 
-				buf = udc_buf_get(dev, cfg->addr);
-				if (buf) {
-					udc_submit_ep_event(dev, buf, 0);
-				}
-			}
+	switch (cfg->attributes & USB_EP_TRANSFER_TYPE_MASK) {
+	case USB_EP_TYPE_BULK:
+		dxepctl |= USB_DWC2_DEPCTL_EPTYPE_BULK <<
+			   USB_DWC2_DEPCTL_EPTYPE_POS;
+		dxepctl |= USB_DWC2_DEPCTL_SETD0PID;
+		break;
+	case USB_EP_TYPE_INTERRUPT:
+		dxepctl |= USB_DWC2_DEPCTL_EPTYPE_INTERRUPT <<
+			   USB_DWC2_DEPCTL_EPTYPE_POS;
+		dxepctl |= USB_DWC2_DEPCTL_SETD0PID;
+		break;
+	case USB_EP_TYPE_ISO:
+		dxepctl |= USB_DWC2_DEPCTL_EPTYPE_ISO <<
+			   USB_DWC2_DEPCTL_EPTYPE_POS;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (USB_EP_DIR_IS_IN(cfg->addr) && udc_mps_ep_size(cfg) != 0U) {
+		int ret = dwc2_set_dedicated_fifo(dev, cfg, &dxepctl);
+
+		if (ret) {
+			return ret;
 		}
 	}
 
-	sys_write32(USB_DWC2_GINTSTS_INCOMPISOOUT, gintsts_reg);
+	dxepctl |= USB_DWC2_DEPCTL_USBACTEP;
+
+	/* Enable endpoint interrupts */
+	dwc2_set_epint(dev, cfg, true);
+	sys_write32(dxepctl, dxepctl_reg);
+
+	for (uint8_t i = 1U; i < priv->ineps; i++) {
+		LOG_DBG("DIEPTXF%u %08x DIEPCTL%u %08x",
+			i, sys_read32((mem_addr_t)&base->dieptxf[i - 1U]), i, dxepctl);
+	}
+
+	return 0;
 }
 
-static void dwc2_backup_registers(const struct device *dev)
+static int dwc2_unset_dedicated_fifo(const struct device *dev,
+				     struct udc_ep_config *const cfg,
+				     uint32_t *const diepctl)
 {
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct dwc2_reg_backup *backup = &priv->backup;
+	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
 
-	backup->gotgctl = sys_read32((mem_addr_t)&base->gotgctl);
-	backup->gahbcfg = sys_read32((mem_addr_t)&base->gahbcfg);
-	backup->gusbcfg = sys_read32((mem_addr_t)&base->gusbcfg);
-	backup->gintmsk = sys_read32((mem_addr_t)&base->gintmsk);
-	backup->grxfsiz = sys_read32((mem_addr_t)&base->grxfsiz);
-	backup->gnptxfsiz = sys_read32((mem_addr_t)&base->gnptxfsiz);
-	backup->gi2cctl = sys_read32((mem_addr_t)&base->gi2cctl);
-	backup->glpmcfg = sys_read32((mem_addr_t)&base->glpmcfg);
-	backup->gdfifocfg = sys_read32((mem_addr_t)&base->gdfifocfg);
+	/* Clear FIFO number field */
+	*diepctl &= ~USB_DWC2_DEPCTL_TXFNUM_MASK;
 
-	for (uint8_t i = 1U; i < priv->ineps; i++) {
-		backup->dieptxf[i - 1] = sys_read32((mem_addr_t)&base->dieptxf[i - 1]);
+	if (priv->dynfifosizing) {
+		if (priv->txf_set & ~BIT_MASK(ep_idx)) {
+			LOG_WRN("Some of the FIFOs higher than %u are set, %lx",
+				ep_idx, priv->txf_set & ~BIT_MASK(ep_idx));
+			return 0;
+		}
+
+		dwc2_set_txf(dev, ep_idx - 1, 0, 0);
 	}
 
-	backup->dcfg = sys_read32((mem_addr_t)&base->dcfg);
-	backup->dctl = sys_read32((mem_addr_t)&base->dctl);
-	backup->diepmsk = sys_read32((mem_addr_t)&base->diepmsk);
-	backup->doepmsk = sys_read32((mem_addr_t)&base->doepmsk);
-	backup->daintmsk = sys_read32((mem_addr_t)&base->daintmsk);
+	priv->txf_set &= ~BIT(ep_idx);
 
-	for (uint8_t i = 0U; i < 16; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+	return 0;
+}
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_IN || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			backup->diepctl[i] = sys_read32((mem_addr_t)&base->in_ep[i].diepctl);
-			if (backup->diepctl[i] & USB_DWC2_DEPCTL_DPID) {
-				backup->diepctl[i] |= USB_DWC2_DEPCTL_SETD1PID;
-			} else {
-				backup->diepctl[i] |= USB_DWC2_DEPCTL_SETD0PID;
-			}
-			backup->dieptsiz[i] = sys_read32((mem_addr_t)&base->in_ep[i].dieptsiz);
-			backup->diepdma[i] = sys_read32((mem_addr_t)&base->in_ep[i].diepdma);
-		}
+/* Disabled IN endpoint means that device will send NAK (isochronous: ZLP) after
+ * receiving IN token from host even if there is packet available in TxFIFO.
+ * Disabled OUT endpoint means that device will NAK (isochronous: discard data)
+ * incoming OUT data (or HS PING) even if there is space available in RxFIFO.
+ *
+ * Set stall parameter to true if caller wants to send STALL instead of NAK.
+ */
+static void udc_dwc2_ep_disable(const struct device *dev,
+				struct udc_ep_config *const cfg, bool stall)
+{
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
+	mem_addr_t dxepctl_reg;
+	uint32_t dxepctl;
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			backup->doepctl[i] = sys_read32((mem_addr_t)&base->out_ep[i].doepctl);
-			if (backup->doepctl[i] & USB_DWC2_DEPCTL_DPID) {
-				backup->doepctl[i] |= USB_DWC2_DEPCTL_SETD1PID;
-			} else {
-				backup->doepctl[i] |= USB_DWC2_DEPCTL_SETD0PID;
-			}
-			backup->doeptsiz[i] = sys_read32((mem_addr_t)&base->out_ep[i].doeptsiz);
-			backup->doepdma[i] = sys_read32((mem_addr_t)&base->out_ep[i].doepdma);
+	dxepctl_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
+	dxepctl = sys_read32(dxepctl_reg);
+
+	if (dxepctl & USB_DWC2_DEPCTL_NAKSTS) {
+		/* Endpoint already sends forced NAKs. STALL if necessary. */
+		if (stall) {
+			dxepctl |= USB_DWC2_DEPCTL_STALL;
+			sys_write32(dxepctl, dxepctl_reg);
 		}
+
+		return;
 	}
 
-	backup->pcgcctl = sys_read32((mem_addr_t)&base->pcgcctl);
-}
+	if (USB_EP_DIR_IS_OUT(cfg->addr)) {
+		mem_addr_t dctl_reg, gintsts_reg, doepint_reg;
+		uint32_t dctl;
 
-static void dwc2_restore_essential_registers(const struct device *dev)
-{
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct dwc2_reg_backup *backup = &priv->backup;
-	uint32_t pcgcctl = backup->pcgcctl & USB_DWC2_PCGCCTL_RESTOREVALUE_MASK;
+		dctl_reg = (mem_addr_t)&base->dctl;
+		gintsts_reg = (mem_addr_t)&base->gintsts;
+		doepint_reg = (mem_addr_t)&base->out_ep[ep_idx].doepint;
 
-	sys_write32(backup->glpmcfg, (mem_addr_t)&base->glpmcfg);
-	sys_write32(backup->gi2cctl, (mem_addr_t)&base->gi2cctl);
-	sys_write32(pcgcctl, (mem_addr_t)&base->pcgcctl);
+		dctl = sys_read32(dctl_reg);
 
-	sys_write32(backup->gahbcfg | USB_DWC2_GAHBCFG_GLBINTRMASK,
-		    (mem_addr_t)&base->gahbcfg);
+		if (sys_read32(gintsts_reg) & USB_DWC2_GINTSTS_GOUTNAKEFF) {
+			LOG_ERR("GOUTNAKEFF already active");
+		} else {
+			dctl |= USB_DWC2_DCTL_SGOUTNAK;
+			sys_write32(dctl, dctl_reg);
+			dctl &= ~USB_DWC2_DCTL_SGOUTNAK;
+		}
 
-	sys_write32(0xFFFFFFFFUL, (mem_addr_t)&base->gintsts);
-	sys_write32(USB_DWC2_GINTSTS_RSTRDONEINT, (mem_addr_t)&base->gintmsk);
+		dwc2_wait_for_bit(dev, gintsts_reg, USB_DWC2_GINTSTS_GOUTNAKEFF);
 
-	sys_write32(backup->gusbcfg, (mem_addr_t)&base->gusbcfg);
-	sys_write32(backup->dcfg, (mem_addr_t)&base->dcfg);
+		/* The application cannot disable control OUT endpoint 0. */
+		if (ep_idx != 0) {
+			dxepctl |= USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPDIS;
+		}
 
-	pcgcctl |= USB_DWC2_PCGCCTL_RESTOREMODE | USB_DWC2_PCGCCTL_RSTPDWNMODULE;
-	sys_write32(pcgcctl, (mem_addr_t)&base->pcgcctl);
-	k_busy_wait(1);
+		if (stall) {
+			/* For OUT endpoints STALL is set instead of SNAK */
+			dxepctl |= USB_DWC2_DEPCTL_STALL;
+		} else {
+			dxepctl |= USB_DWC2_DEPCTL_SNAK;
+		}
+		sys_write32(dxepctl, dxepctl_reg);
 
-	pcgcctl |= USB_DWC2_PCGCCTL_ESSREGRESTORED;
-	sys_write32(pcgcctl, (mem_addr_t)&base->pcgcctl);
-}
+		if (ep_idx != 0) {
+			dwc2_wait_for_bit(dev, doepint_reg, USB_DWC2_DOEPINT_EPDISBLD);
+		}
 
-static void dwc2_restore_device_registers(const struct device *dev)
-{
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct dwc2_reg_backup *backup = &priv->backup;
+		/* Clear Endpoint Disabled interrupt */
+		sys_write32(USB_DWC2_DIEPINT_EPDISBLD, doepint_reg);
 
-	sys_write32(backup->gotgctl, (mem_addr_t)&base->gotgctl);
-	sys_write32(backup->gahbcfg, (mem_addr_t)&base->gahbcfg);
-	sys_write32(backup->gusbcfg, (mem_addr_t)&base->gusbcfg);
-	sys_write32(backup->gintmsk, (mem_addr_t)&base->gintmsk);
-	sys_write32(backup->grxfsiz, (mem_addr_t)&base->grxfsiz);
-	sys_write32(backup->gnptxfsiz, (mem_addr_t)&base->gnptxfsiz);
-	sys_write32(backup->gdfifocfg, (mem_addr_t)&base->gdfifocfg);
+		dctl |= USB_DWC2_DCTL_CGOUTNAK;
+		sys_write32(dctl, dctl_reg);
+	} else {
+		mem_addr_t diepint_reg;
 
-	for (uint8_t i = 1U; i < priv->ineps; i++) {
-		sys_write32(backup->dieptxf[i - 1], (mem_addr_t)&base->dieptxf[i - 1]);
-	}
+		diepint_reg = (mem_addr_t)&base->in_ep[ep_idx].diepint;
 
-	sys_write32(backup->dctl, (mem_addr_t)&base->dctl);
-	sys_write32(backup->diepmsk, (mem_addr_t)&base->diepmsk);
-	sys_write32(backup->doepmsk, (mem_addr_t)&base->doepmsk);
-	sys_write32(backup->daintmsk, (mem_addr_t)&base->daintmsk);
+		dxepctl |= USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_SNAK;
+		if (stall) {
+			/* For IN endpoints STALL is set in addition to SNAK */
+			dxepctl |= USB_DWC2_DEPCTL_STALL;
+		}
+		sys_write32(dxepctl, dxepctl_reg);
 
-	for (uint8_t i = 0U; i < 16; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+		dwc2_wait_for_bit(dev, diepint_reg, USB_DWC2_DIEPINT_INEPNAKEFF);
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_IN || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			sys_write32(backup->dieptsiz[i], (mem_addr_t)&base->in_ep[i].dieptsiz);
-			sys_write32(backup->diepdma[i], (mem_addr_t)&base->in_ep[i].diepdma);
-			sys_write32(backup->diepctl[i], (mem_addr_t)&base->in_ep[i].diepctl);
-		}
+		dxepctl |= USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPDIS;
+		sys_write32(dxepctl, dxepctl_reg);
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT || epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			sys_write32(backup->doeptsiz[i], (mem_addr_t)&base->out_ep[i].doeptsiz);
-			sys_write32(backup->doepdma[i], (mem_addr_t)&base->out_ep[i].doepdma);
-			sys_write32(backup->doepctl[i], (mem_addr_t)&base->out_ep[i].doepctl);
-		}
+		dwc2_wait_for_bit(dev, diepint_reg, USB_DWC2_DIEPINT_EPDISBLD);
+
+		/* Clear Endpoint Disabled interrupt */
+		sys_write32(USB_DWC2_DIEPINT_EPDISBLD, diepint_reg);
+
+		/* TODO: Read DIEPTSIZn here? Programming Guide suggest it to
+		 * let application know how many bytes of interrupted transfer
+		 * were transferred to the host.
+		 */
+
+		dwc2_flush_tx_fifo(dev, usb_dwc2_get_depctl_txfnum(dxepctl));
 	}
+
+	udc_ep_set_busy(dev, cfg->addr, false);
 }
 
-static void dwc2_enter_hibernation(const struct device *dev)
+/* Deactivated endpoint means that there will be a bus timeout when the host
+ * tries to access the endpoint.
+ */
+static int udc_dwc2_ep_deactivate(const struct device *dev,
+				  struct udc_ep_config *const cfg)
 {
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	mem_addr_t gpwrdn_reg = (mem_addr_t)&base->gpwrdn;
-	mem_addr_t pcgcctl_reg = (mem_addr_t)&base->pcgcctl;
+	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
+	mem_addr_t dxepctl_reg;
+	uint32_t dxepctl;
 
-	dwc2_backup_registers(dev);
+	dxepctl_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
+	dxepctl = sys_read32(dxepctl_reg);
 
-	/* This code currently only supports UTMI+. UTMI+ runs at either 30 or
-	 * 60 MHz and therefore 1 us busy waits have sufficiently large margin.
-	 */
+	if (dxepctl & USB_DWC2_DEPCTL_USBACTEP) {
+		LOG_DBG("Disable ep 0x%02x DxEPCTL%u %x",
+			cfg->addr, ep_idx, dxepctl);
 
-	/* Enable PMU Logic */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUACTV);
-	k_busy_wait(1);
+		udc_dwc2_ep_disable(dev, cfg, false);
 
-	/* Stop PHY clock */
-	sys_set_bits(pcgcctl_reg, USB_DWC2_PCGCCTL_STOPPCLK);
-	k_busy_wait(1);
+		dxepctl = sys_read32(dxepctl_reg);
+		dxepctl &= ~USB_DWC2_DEPCTL_USBACTEP;
+	} else {
+		LOG_WRN("ep 0x%02x is not active DxEPCTL%u %x",
+			cfg->addr, ep_idx, dxepctl);
+	}
 
-	/* Enable PMU interrupt */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUINTSEL);
-	k_busy_wait(1);
+	if (USB_EP_DIR_IS_IN(cfg->addr) && udc_mps_ep_size(cfg) != 0U &&
+	    ep_idx != 0U) {
+		dwc2_unset_dedicated_fifo(dev, cfg, &dxepctl);
+	}
 
-	/* Unmask PMU interrupt bits */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_LINESTAGECHANGEMSK |
-				 USB_DWC2_GPWRDN_RESETDETMSK |
-				 USB_DWC2_GPWRDN_DISCONNECTDETECTMSK |
-				 USB_DWC2_GPWRDN_STSCHNGINTMSK);
-	k_busy_wait(1);
+	sys_write32(dxepctl, dxepctl_reg);
+	dwc2_set_epint(dev, cfg, false);
 
-	/* Enable power clamps */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNCLMP);
-	k_busy_wait(1);
+	if (cfg->addr == USB_CONTROL_EP_OUT) {
+		struct net_buf *buf = udc_buf_get_all(dev, cfg->addr);
 
-	/* Switch off power to the controller */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNSWTCH);
+		/* Release the buffer allocated in dwc2_ctrl_feed_dout() */
+		if (buf) {
+			net_buf_unref(buf);
+		}
+	}
 
-	/* Mark that the core is hibernated */
-	priv->hibernated = 1;
-	LOG_DBG("Hibernated");
+	return 0;
 }
 
-static void dwc2_exit_hibernation(const struct device *dev)
+static int udc_dwc2_ep_set_halt(const struct device *dev,
+				struct udc_ep_config *const cfg)
 {
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	mem_addr_t gpwrdn_reg = (mem_addr_t)&base->gpwrdn;
-	mem_addr_t pcgcctl_reg = (mem_addr_t)&base->pcgcctl;
+	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
 
-	/* Switch on power to the controller */
-	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNSWTCH);
-	k_busy_wait(1);
+	udc_dwc2_ep_disable(dev, cfg, true);
 
-	/* Reset the controller */
-	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNRST_N);
-	k_busy_wait(1);
+	LOG_DBG("Set halt ep 0x%02x", cfg->addr);
+	if (ep_idx != 0) {
+		cfg->stat.halted = true;
+	}
 
-	/* Enable restore from PMU */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_RESTORE);
-	k_busy_wait(1);
+	return 0;
+}
 
-	/* Disable power clamps */
-	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNCLMP);
+static int udc_dwc2_ep_clear_halt(const struct device *dev,
+				  struct udc_ep_config *const cfg)
+{
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	mem_addr_t dxepctl_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
+	uint32_t dxepctl;
 
-	/* Remove reset to the controller */
-	sys_set_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PWRDNRST_N);
-	k_busy_wait(1);
+	dxepctl = sys_read32(dxepctl_reg);
+	dxepctl &= ~USB_DWC2_DEPCTL_STALL;
+	dxepctl |= USB_DWC2_DEPCTL_SETD0PID;
+	sys_write32(dxepctl, dxepctl_reg);
 
-	/* Disable PMU interrupt */
-	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUINTSEL);
-
-	dwc2_restore_essential_registers(dev);
-
-	/* Wait for Restore Done Interrupt */
-	dwc2_wait_for_bit(dev, (mem_addr_t)&base->gintsts, USB_DWC2_GINTSTS_RSTRDONEINT);
-	sys_write32(0xFFFFFFFFUL, (mem_addr_t)&base->gintsts);
-
-	/* Disable restore from PMU */
-	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_RESTORE);
-	k_busy_wait(1);
-
-	/* Clear reset to power down module */
-	sys_clear_bits(pcgcctl_reg, USB_DWC2_PCGCCTL_RSTPDWNMODULE);
-
-	/* Restore GUSBCFG, DCFG and DCTL */
-	sys_write32(priv->backup.gusbcfg, (mem_addr_t)&base->gusbcfg);
-	sys_write32(priv->backup.dcfg, (mem_addr_t)&base->dcfg);
-	sys_write32(priv->backup.dctl, (mem_addr_t)&base->dctl);
+	LOG_DBG("Clear halt ep 0x%02x", cfg->addr);
+	cfg->stat.halted = false;
 
-	/* Disable PMU */
-	sys_clear_bits(gpwrdn_reg, USB_DWC2_GPWRDN_PMUACTV);
-	k_busy_wait(5);
+	/* Resume queued transfers if any */
+	if (udc_buf_peek(dev, cfg->addr)) {
+		uint32_t ep_bit;
 
-	sys_set_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_PWRONPRGDONE);
-	k_msleep(1);
-	sys_write32(0xFFFFFFFFUL, (mem_addr_t)&base->gintsts);
+		if (USB_EP_DIR_IS_IN(cfg->addr)) {
+			ep_bit = BIT(16 + USB_EP_GET_IDX(cfg->addr));
+		} else {
+			ep_bit = BIT(USB_EP_GET_IDX(cfg->addr));
+		}
 
-	dwc2_restore_device_registers(dev);
+		k_event_post(&priv->xfer_new, ep_bit);
+		k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_XFER));
+	}
 
-	priv->hibernated = 0;
-	LOG_DBG("Hibernation exit complete");
+	return 0;
 }
 
-static void udc_dwc2_isr_handler(const struct device *dev)
+static int udc_dwc2_ep_enqueue(const struct device *dev,
+			       struct udc_ep_config *const cfg,
+			       struct net_buf *const buf)
 {
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = config->base;
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	mem_addr_t gintsts_reg = (mem_addr_t)&base->gintsts;
-	uint32_t int_status;
-	uint32_t gintmsk;
-
-	if (priv->hibernated) {
-		uint32_t gpwrdn = sys_read32((mem_addr_t)&base->gpwrdn);
-		bool reset, resume = false;
-		enum dwc2_hibernation_exit_reason exit_reason;
 
-		/* Clear interrupts */
-		sys_write32(gpwrdn, (mem_addr_t)&base->gpwrdn);
+	LOG_DBG("%p enqueue %x %p", dev, cfg->addr, buf);
+	udc_buf_put(cfg, buf);
 
-		if (gpwrdn & USB_DWC2_GPWRDN_LNSTSCHNG) {
-			resume = usb_dwc2_get_gpwrdn_linestate(gpwrdn) ==
-				 USB_DWC2_GPWRDN_LINESTATE_DM1DP0;
-			exit_reason = DWC2_HIBERNATION_EXIT_HOST_WAKEUP;
-		}
+	if (!cfg->stat.halted) {
+		uint32_t ep_bit;
 
-		reset = gpwrdn & USB_DWC2_GPWRDN_RESETDETECTED;
-		if (reset) {
-			exit_reason = DWC2_HIBERNATION_EXIT_BUS_RESET;
+		if (USB_EP_DIR_IS_IN(cfg->addr)) {
+			ep_bit = BIT(16 + USB_EP_GET_IDX(cfg->addr));
+		} else {
+			ep_bit = BIT(USB_EP_GET_IDX(cfg->addr));
 		}
 
-		if (reset || resume) {
-			struct dwc2_drv_event evt = {
-				.dev = dev,
-				.type = DWC2_DRV_EVT_HIBERNATION_EXIT,
-				.exit_reason = exit_reason,
-			};
+		k_event_post(&priv->xfer_new, ep_bit);
+		k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_XFER));
+	}
 
-			k_msgq_put(&drv_msgq, &evt, K_NO_WAIT);
-		}
+	return 0;
+}
 
-		(void)dwc2_quirk_irq_clear(dev);
-		return;
-	}
+static int udc_dwc2_ep_dequeue(const struct device *dev,
+			       struct udc_ep_config *const cfg)
+{
+	struct net_buf *buf;
 
-	gintmsk = sys_read32((mem_addr_t)&base->gintmsk);
+	udc_dwc2_ep_disable(dev, cfg, false);
 
-	/*  Read and handle interrupt status register */
-	while ((int_status = sys_read32(gintsts_reg) & gintmsk)) {
+	buf = udc_buf_get_all(dev, cfg->addr);
+	if (buf) {
+		udc_submit_ep_event(dev, buf, -ECONNABORTED);
+	}
 
-		LOG_DBG("GINTSTS 0x%x", int_status);
+	udc_ep_set_busy(dev, cfg->addr, false);
 
-		if (int_status & USB_DWC2_GINTSTS_SOF) {
-			uint32_t dsts;
+	LOG_DBG("dequeue ep 0x%02x", cfg->addr);
 
-			/* Clear USB SOF interrupt. */
-			sys_write32(USB_DWC2_GINTSTS_SOF, gintsts_reg);
+	return 0;
+}
 
-			dsts = sys_read32((mem_addr_t)&base->dsts);
-			priv->sof_num = usb_dwc2_get_dsts_soffn(dsts);
-			udc_submit_event(dev, UDC_EVT_SOF, 0);
-		}
+static int udc_dwc2_set_address(const struct device *dev, const uint8_t addr)
+{
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	mem_addr_t dcfg_reg = (mem_addr_t)&base->dcfg;
+	uint32_t dcfg;
 
-		if (int_status & USB_DWC2_GINTSTS_USBRST) {
-			/* Clear and handle USB Reset interrupt. */
-			sys_write32(USB_DWC2_GINTSTS_USBRST, gintsts_reg);
-			dwc2_on_bus_reset(dev);
-			LOG_DBG("USB Reset interrupt");
-		}
+	if (addr > (USB_DWC2_DCFG_DEVADDR_MASK >> USB_DWC2_DCFG_DEVADDR_POS)) {
+		return -EINVAL;
+	}
 
-		if (int_status & USB_DWC2_GINTSTS_ENUMDONE) {
-			/* Clear and handle Enumeration Done interrupt. */
-			sys_write32(USB_DWC2_GINTSTS_ENUMDONE, gintsts_reg);
-			dwc2_handle_enumdone(dev);
-			udc_submit_event(dev, UDC_EVT_RESET, 0);
-		}
+	dcfg = sys_read32(dcfg_reg);
+	dcfg &= ~USB_DWC2_DCFG_DEVADDR_MASK;
+	dcfg |= usb_dwc2_set_dcfg_devaddr(addr);
+	sys_write32(dcfg, dcfg_reg);
+	LOG_DBG("Set new address %u for %p", addr, dev);
 
-		if (int_status & USB_DWC2_GINTSTS_WKUPINT) {
-			/* Clear Resume/Remote Wakeup Detected interrupt. */
-			sys_write32(USB_DWC2_GINTSTS_WKUPINT, gintsts_reg);
-			udc_set_suspended(dev, false);
-			udc_submit_event(dev, UDC_EVT_RESUME, 0);
-		}
+	return 0;
+}
 
-		if (int_status & USB_DWC2_GINTSTS_IEPINT) {
-			/* Handle IN Endpoints interrupt */
-			dwc2_handle_iepint(dev);
-		}
+static int udc_dwc2_test_mode(const struct device *dev,
+			      const uint8_t mode, const bool dryrun)
+{
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	mem_addr_t dctl_reg = (mem_addr_t)&base->dctl;
+	uint32_t dctl;
 
-		if (int_status & USB_DWC2_GINTSTS_RXFLVL) {
-			/* Handle RxFIFO Non-Empty interrupt */
-			dwc2_handle_rxflvl(dev);
-		}
+	if (mode == 0U || mode > USB_DWC2_DCTL_TSTCTL_TESTFE) {
+		return -EINVAL;
+	}
 
-		if (int_status & USB_DWC2_GINTSTS_OEPINT) {
-			/* Handle OUT Endpoints interrupt */
-			dwc2_handle_oepint(dev);
-		}
+	dctl = sys_read32(dctl_reg);
+	if (usb_dwc2_get_dctl_tstctl(dctl) != USB_DWC2_DCTL_TSTCTL_DISABLED) {
+		return -EALREADY;
+	}
 
-		if (int_status & USB_DWC2_GINTSTS_INCOMPISOIN) {
-			dwc2_handle_incompisoin(dev);
-		}
+	if (dryrun) {
+		LOG_DBG("Test Mode %u supported", mode);
+		return 0;
+	}
 
-		if (int_status & USB_DWC2_GINTSTS_INCOMPISOOUT) {
-			dwc2_handle_incompisoout(dev);
-		}
+	dctl |= usb_dwc2_set_dctl_tstctl(mode);
+	sys_write32(dctl, dctl_reg);
+	LOG_DBG("Enable Test Mode %u", mode);
 
-		if (int_status & USB_DWC2_GINTSTS_USBSUSP) {
-			if (!priv->enumdone) {
-				/* Clear stale suspend interrupt */
-				sys_write32(USB_DWC2_GINTSTS_USBSUSP, gintsts_reg);
-				continue;
-			}
+	return 0;
+}
 
-			/* Notify the stack */
-			udc_set_suspended(dev, true);
-			udc_submit_event(dev, UDC_EVT_SUSPEND, 0);
+static int udc_dwc2_host_wakeup(const struct device *dev)
+{
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
 
-			if (priv->suspend_type == DWC2_SUSPEND_HIBERNATION) {
-				dwc2_enter_hibernation(dev);
-				/* Next interrupt will be from PMU */
-				break;
-			}
+	LOG_DBG("Remote wakeup from %p", dev);
 
-			/* Clear USB Suspend interrupt. */
-			sys_write32(USB_DWC2_GINTSTS_USBSUSP, gintsts_reg);
-		}
-	}
+	k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_REMOTE_WAKEUP));
 
-	(void)dwc2_quirk_irq_clear(dev);
+	return 0;
 }
 
-static void dwc2_unset_unused_fifo(const struct device *dev)
+/* Return actual USB device speed */
+static enum udc_bus_speed udc_dwc2_device_speed(const struct device *dev)
 {
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct udc_ep_config *tmp;
-
-	for (uint8_t i = priv->ineps - 1U; i > 0; i--) {
-		tmp = udc_get_ep_cfg(dev, i | USB_EP_DIR_IN);
 
-		if (tmp->stat.enabled && (priv->txf_set & BIT(i))) {
-			return;
-		}
-
-		if (!tmp->stat.enabled && (priv->txf_set & BIT(i))) {
-			priv->txf_set &= ~BIT(i);
-		}
+	switch (priv->enumspd) {
+	case USB_DWC2_DSTS_ENUMSPD_HS3060:
+		return UDC_BUS_SPEED_HS;
+	case USB_DWC2_DSTS_ENUMSPD_LS6:
+		__ASSERT(false, "Low speed mode not supported");
+		__fallthrough;
+	case USB_DWC2_DSTS_ENUMSPD_FS48:
+		__fallthrough;
+	case USB_DWC2_DSTS_ENUMSPD_FS3060:
+		__fallthrough;
+	default:
+		return UDC_BUS_SPEED_FS;
 	}
 }
 
-/*
- * In dedicated FIFO mode there are i (i = 1 ... ineps - 1) FIFO size registers,
- * e.g. DIEPTXF1, DIEPTXF2, ... DIEPTXF4. When dynfifosizing is enabled,
- * the size register is mutable. The offset of DIEPTXF1 registers is 0.
- */
-static int dwc2_set_dedicated_fifo(const struct device *dev,
-				   struct udc_ep_config *const cfg,
-				   uint32_t *const diepctl)
+static int dwc2_core_soft_reset(const struct device *dev)
 {
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
-	const uint32_t addnl = USB_MPS_ADDITIONAL_TRANSACTIONS(cfg->mps);
-	uint32_t reqdep;
-	uint32_t txfaddr;
-	uint32_t txfdep;
-	uint32_t tmp;
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	mem_addr_t grstctl_reg = (mem_addr_t)&base->grstctl;
+	const unsigned int csr_timeout_us = 10000UL;
+	uint32_t cnt = 0UL;
 
-	/* Keep everything but FIFO number */
-	tmp = *diepctl & ~USB_DWC2_DEPCTL_TXFNUM_MASK;
+	/* Check AHB master idle state */
+	while (!(sys_read32(grstctl_reg) & USB_DWC2_GRSTCTL_AHBIDLE)) {
+		k_busy_wait(1);
 
-	reqdep = DIV_ROUND_UP(udc_mps_ep_size(cfg), 4U);
-	if (priv->bufferdma) {
-		/* In DMA mode, TxFIFO capable of holding 2 packets is enough */
-		reqdep *= MIN(2, (1 + addnl));
-	} else {
-		reqdep *= (1 + addnl);
+		if (++cnt > csr_timeout_us) {
+			LOG_ERR("Wait for AHB idle timeout, GRSTCTL 0x%08x",
+				sys_read32(grstctl_reg));
+			return -EIO;
+		}
 	}
 
-	if (priv->dynfifosizing) {
-		if (priv->txf_set & ~BIT_MASK(ep_idx)) {
-			dwc2_unset_unused_fifo(dev);
-		}
+	/* Apply Core Soft Reset */
+	sys_write32(USB_DWC2_GRSTCTL_CSFTRST, grstctl_reg);
 
-		if (priv->txf_set & ~BIT_MASK(ep_idx)) {
-			LOG_WRN("Some of the FIFOs higher than %u are set, %lx",
-				ep_idx, priv->txf_set & ~BIT_MASK(ep_idx));
+	cnt = 0UL;
+	do {
+		if (++cnt > csr_timeout_us) {
+			LOG_ERR("Wait for CSR done timeout, GRSTCTL 0x%08x",
+				sys_read32(grstctl_reg));
 			return -EIO;
 		}
 
-		if ((ep_idx - 1) != 0U) {
-			txfaddr = dwc2_get_txfdep(dev, ep_idx - 2) +
-				  dwc2_get_txfaddr(dev, ep_idx - 2);
-		} else {
-			txfaddr = priv->rxfifo_depth +
-				MAX(UDC_DWC2_FIFO0_DEPTH, priv->max_txfifo_depth[0]);
-		}
-
-		/* Make sure to not set TxFIFO greater than hardware allows */
-		txfdep = reqdep;
-		if (txfdep > priv->max_txfifo_depth[ep_idx]) {
-			return -ENOMEM;
-		}
+		k_busy_wait(1);
+	} while (sys_read32(grstctl_reg) & USB_DWC2_GRSTCTL_CSFTRST &&
+		 !(sys_read32(grstctl_reg) & USB_DWC2_GRSTCTL_CSFTRSTDONE));
 
-		/* Do not allocate TxFIFO outside the SPRAM */
-		if (txfaddr + txfdep > priv->dfifodepth) {
-			return -ENOMEM;
-		}
+	sys_clear_bits(grstctl_reg, USB_DWC2_GRSTCTL_CSFTRST | USB_DWC2_GRSTCTL_CSFTRSTDONE);
 
-		/* Set FIFO depth (32-bit words) and address */
-		dwc2_set_txf(dev, ep_idx - 1, txfdep, txfaddr);
-	} else {
-		txfdep = dwc2_get_txfdep(dev, ep_idx - 1);
-		txfaddr = dwc2_get_txfaddr(dev, ep_idx - 1);
+	return 0;
+}
 
-		if (reqdep > txfdep) {
-			return -ENOMEM;
-		}
+static int udc_dwc2_init_controller(const struct device *dev)
+{
+	const struct udc_dwc2_config *const config = dev->config;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	struct usb_dwc2_reg *const base = config->base;
+	mem_addr_t grxfsiz_reg = (mem_addr_t)&base->grxfsiz;
+	mem_addr_t gahbcfg_reg = (mem_addr_t)&base->gahbcfg;
+	mem_addr_t gusbcfg_reg = (mem_addr_t)&base->gusbcfg;
+	mem_addr_t dcfg_reg = (mem_addr_t)&base->dcfg;
+	uint32_t dcfg;
+	uint32_t gusbcfg;
+	uint32_t gahbcfg;
+	uint32_t ghwcfg2;
+	uint32_t ghwcfg3;
+	uint32_t ghwcfg4;
+	uint32_t val;
+	int ret;
+	bool hs_phy;
 
-		LOG_DBG("Reuse FIFO%u addr 0x%08x depth %u", ep_idx, txfaddr, txfdep);
+	ret = dwc2_core_soft_reset(dev);
+	if (ret) {
+		return ret;
 	}
 
-	/* Assign FIFO to the IN endpoint */
-	*diepctl = tmp | usb_dwc2_set_depctl_txfnum(ep_idx);
-	priv->txf_set |= BIT(ep_idx);
-	dwc2_flush_tx_fifo(dev, ep_idx);
-
-	LOG_INF("Set FIFO%u (ep 0x%02x) addr 0x%04x depth %u size %u",
-		ep_idx, cfg->addr, txfaddr, txfdep, dwc2_ftx_avail(dev, ep_idx));
+	priv->ghwcfg1 = sys_read32((mem_addr_t)&base->ghwcfg1);
+	ghwcfg2 = sys_read32((mem_addr_t)&base->ghwcfg2);
+	ghwcfg3 = sys_read32((mem_addr_t)&base->ghwcfg3);
+	ghwcfg4 = sys_read32((mem_addr_t)&base->ghwcfg4);
 
-	return 0;
-}
+	if (!(ghwcfg4 & USB_DWC2_GHWCFG4_DEDFIFOMODE)) {
+		LOG_ERR("Only dedicated TX FIFO mode is supported");
+		return -ENOTSUP;
+	}
 
-static int dwc2_ep_control_enable(const struct device *dev,
-				  struct udc_ep_config *const cfg)
-{
-	mem_addr_t dxepctl0_reg;
-	uint32_t dxepctl0;
+	/*
+	 * Force device mode as we do no support role changes.
+	 * Wait 25ms for the change to take effect.
+	 */
+	gusbcfg = USB_DWC2_GUSBCFG_FORCEDEVMODE;
+	sys_write32(gusbcfg, gusbcfg_reg);
+	k_msleep(25);
 
-	dxepctl0_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
-	dxepctl0 = sys_read32(dxepctl0_reg);
+	/* Buffer DMA is always supported in Internal DMA mode.
+	 * TODO: check and support descriptor DMA if available
+	 */
+	priv->bufferdma = (usb_dwc2_get_ghwcfg2_otgarch(ghwcfg2) ==
+			   USB_DWC2_GHWCFG2_OTGARCH_INTERNALDMA);
 
-	dxepctl0 &= ~USB_DWC2_DEPCTL0_MPS_MASK;
-	switch (cfg->mps) {
-	case 8:
-		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_8 << USB_DWC2_DEPCTL_MPS_POS;
-		break;
-	case 16:
-		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_16 << USB_DWC2_DEPCTL_MPS_POS;
-		break;
-	case 32:
-		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_32 << USB_DWC2_DEPCTL_MPS_POS;
-		break;
-	case 64:
-		dxepctl0 |= USB_DWC2_DEPCTL0_MPS_64 << USB_DWC2_DEPCTL_MPS_POS;
-		break;
-	default:
-		return -EINVAL;
+	if (!IS_ENABLED(CONFIG_UDC_DWC2_DMA)) {
+		priv->bufferdma = 0;
+	} else if (priv->bufferdma) {
+		LOG_WRN("Experimental DMA enabled");
 	}
 
-	dxepctl0 |= USB_DWC2_DEPCTL_USBACTEP;
-
-	if (cfg->addr == USB_CONTROL_EP_OUT) {
-		int ret;
+	if (ghwcfg2 & USB_DWC2_GHWCFG2_DYNFIFOSIZING) {
+		LOG_DBG("Dynamic FIFO Sizing is enabled");
+		priv->dynfifosizing = true;
+	}
 
-		dwc2_flush_rx_fifo(dev);
-		ret = dwc2_ctrl_feed_dout(dev, 8);
-		if (ret) {
-			return ret;
-		}
+	if (IS_ENABLED(CONFIG_UDC_DWC2_HIBERNATION) &&
+	    ghwcfg4 & USB_DWC2_GHWCFG4_HIBERNATION) {
+		LOG_INF("Hibernation enabled");
+		priv->suspend_type = DWC2_SUSPEND_HIBERNATION;
 	} else {
-		dwc2_flush_tx_fifo(dev, 0);
+		priv->suspend_type = DWC2_SUSPEND_NO_POWER_SAVING;
 	}
 
-	sys_write32(dxepctl0, dxepctl0_reg);
-	dwc2_set_epint(dev, cfg, true);
+	/* Get the number or endpoints and IN endpoints we can use later */
+	priv->numdeveps = usb_dwc2_get_ghwcfg2_numdeveps(ghwcfg2) + 1U;
+	priv->ineps = usb_dwc2_get_ghwcfg4_ineps(ghwcfg4) + 1U;
+	LOG_DBG("Number of endpoints (NUMDEVEPS + 1) %u", priv->numdeveps);
+	LOG_DBG("Number of IN endpoints (INEPS + 1) %u", priv->ineps);
 
-	return 0;
-}
+	LOG_DBG("Number of periodic IN endpoints (NUMDEVPERIOEPS) %u",
+		usb_dwc2_get_ghwcfg4_numdevperioeps(ghwcfg4));
+	LOG_DBG("Number of additional control endpoints (NUMCTLEPS) %u",
+		usb_dwc2_get_ghwcfg4_numctleps(ghwcfg4));
 
-static int udc_dwc2_ep_activate(const struct device *dev,
-				struct udc_ep_config *const cfg)
-{
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
-	mem_addr_t dxepctl_reg;
-	uint32_t dxepctl;
+	LOG_DBG("OTG architecture (OTGARCH) %u, mode (OTGMODE) %u",
+		usb_dwc2_get_ghwcfg2_otgarch(ghwcfg2),
+		usb_dwc2_get_ghwcfg2_otgmode(ghwcfg2));
 
-	LOG_DBG("Enable ep 0x%02x", cfg->addr);
+	priv->dfifodepth = usb_dwc2_get_ghwcfg3_dfifodepth(ghwcfg3);
+	LOG_DBG("DFIFO depth (DFIFODEPTH) %u bytes", priv->dfifodepth * 4);
 
-	if (ep_idx == 0U) {
-		return dwc2_ep_control_enable(dev, cfg);
+	priv->max_pktcnt = GHWCFG3_PKTCOUNT(usb_dwc2_get_ghwcfg3_pktsizewidth(ghwcfg3));
+	priv->max_xfersize = GHWCFG3_XFERSIZE(usb_dwc2_get_ghwcfg3_xfersizewidth(ghwcfg3));
+	LOG_DBG("Max packet count %u, Max transfer size %u",
+		priv->max_pktcnt, priv->max_xfersize);
+
+	LOG_DBG("Vendor Control interface support enabled: %s",
+		(ghwcfg3 & USB_DWC2_GHWCFG3_VNDCTLSUPT) ? "true" : "false");
+
+	LOG_DBG("PHY interface type: FSPHYTYPE %u, HSPHYTYPE %u, DATAWIDTH %u",
+		usb_dwc2_get_ghwcfg2_fsphytype(ghwcfg2),
+		usb_dwc2_get_ghwcfg2_hsphytype(ghwcfg2),
+		usb_dwc2_get_ghwcfg4_phydatawidth(ghwcfg4));
+
+	LOG_DBG("LPM mode is %s",
+		(ghwcfg3 & USB_DWC2_GHWCFG3_LPMMODE) ? "enabled" : "disabled");
+
+	if (ghwcfg3 & USB_DWC2_GHWCFG3_RSTTYPE) {
+		priv->syncrst = 1;
 	}
 
-	if (USB_EP_DIR_IS_OUT(cfg->addr)) {
-		/* TODO: use dwc2_get_dxepctl_reg() */
-		dxepctl_reg = (mem_addr_t)&base->out_ep[ep_idx].doepctl;
-	} else {
-		if (priv->ineps > 0U && ep_idx > (priv->ineps - 1U)) {
-			LOG_ERR("No resources available for ep 0x%02x", cfg->addr);
-			return -EINVAL;
-		}
+	/* Configure AHB, select Completer or DMA mode */
+	gahbcfg = sys_read32(gahbcfg_reg);
 
-		dxepctl_reg = (mem_addr_t)&base->in_ep[ep_idx].diepctl;
+	if (priv->bufferdma) {
+		gahbcfg |= USB_DWC2_GAHBCFG_DMAEN;
+	} else {
+		gahbcfg &= ~USB_DWC2_GAHBCFG_DMAEN;
 	}
 
-	dxepctl = sys_read32(dxepctl_reg);
-	/* Set max packet size */
-	dxepctl &= ~USB_DWC2_DEPCTL_MPS_MASK;
-	dxepctl |= usb_dwc2_set_depctl_mps(udc_mps_ep_size(cfg));
+	sys_write32(gahbcfg, gahbcfg_reg);
 
-	/* Set endpoint type */
-	dxepctl &= ~USB_DWC2_DEPCTL_EPTYPE_MASK;
+	dcfg = sys_read32(dcfg_reg);
 
-	switch (cfg->attributes & USB_EP_TRANSFER_TYPE_MASK) {
-	case USB_EP_TYPE_BULK:
-		dxepctl |= USB_DWC2_DEPCTL_EPTYPE_BULK <<
-			   USB_DWC2_DEPCTL_EPTYPE_POS;
-		dxepctl |= USB_DWC2_DEPCTL_SETD0PID;
-		break;
-	case USB_EP_TYPE_INTERRUPT:
-		dxepctl |= USB_DWC2_DEPCTL_EPTYPE_INTERRUPT <<
-			   USB_DWC2_DEPCTL_EPTYPE_POS;
-		dxepctl |= USB_DWC2_DEPCTL_SETD0PID;
+	dcfg &= ~USB_DWC2_DCFG_DESCDMA;
+
+	/* Configure PHY and device speed */
+	dcfg &= ~USB_DWC2_DCFG_DEVSPD_MASK;
+	switch (usb_dwc2_get_ghwcfg2_hsphytype(ghwcfg2)) {
+	case USB_DWC2_GHWCFG2_HSPHYTYPE_UTMIPLUSULPI:
+		__fallthrough;
+	case USB_DWC2_GHWCFG2_HSPHYTYPE_ULPI:
+		gusbcfg |= USB_DWC2_GUSBCFG_PHYSEL_USB20 |
+			   USB_DWC2_GUSBCFG_ULPI_UTMI_SEL_ULPI;
+		dcfg |= USB_DWC2_DCFG_DEVSPD_USBHS20
+			<< USB_DWC2_DCFG_DEVSPD_POS;
+		hs_phy = true;
 		break;
-	case USB_EP_TYPE_ISO:
-		dxepctl |= USB_DWC2_DEPCTL_EPTYPE_ISO <<
-			   USB_DWC2_DEPCTL_EPTYPE_POS;
+	case USB_DWC2_GHWCFG2_HSPHYTYPE_UTMIPLUS:
+		gusbcfg |= USB_DWC2_GUSBCFG_PHYSEL_USB20 |
+			   USB_DWC2_GUSBCFG_ULPI_UTMI_SEL_UTMI;
+		dcfg |= USB_DWC2_DCFG_DEVSPD_USBHS20
+			<< USB_DWC2_DCFG_DEVSPD_POS;
+		hs_phy = true;
 		break;
+	case USB_DWC2_GHWCFG2_HSPHYTYPE_NO_HS:
+		__fallthrough;
 	default:
-		return -EINVAL;
-	}
+		if (usb_dwc2_get_ghwcfg2_fsphytype(ghwcfg2) !=
+		    USB_DWC2_GHWCFG2_FSPHYTYPE_NO_FS) {
+			gusbcfg |= USB_DWC2_GUSBCFG_PHYSEL_USB11;
+		}
 
-	if (USB_EP_DIR_IS_IN(cfg->addr) && udc_mps_ep_size(cfg) != 0U) {
-		int ret = dwc2_set_dedicated_fifo(dev, cfg, &dxepctl);
+		dcfg |= USB_DWC2_DCFG_DEVSPD_USBFS1148
+			<< USB_DWC2_DCFG_DEVSPD_POS;
+		hs_phy = false;
+	}
 
-		if (ret) {
-			return ret;
-		}
+	if (usb_dwc2_get_ghwcfg4_phydatawidth(ghwcfg4)) {
+		gusbcfg |= USB_DWC2_GUSBCFG_PHYIF_16_BIT;
 	}
 
-	dxepctl |= USB_DWC2_DEPCTL_USBACTEP;
+	/* Update PHY configuration */
+	sys_write32(gusbcfg, gusbcfg_reg);
+	sys_write32(dcfg, dcfg_reg);
 
-	/* Enable endpoint interrupts */
-	dwc2_set_epint(dev, cfg, true);
-	sys_write32(dxepctl, dxepctl_reg);
+	priv->outeps = 0U;
+	for (uint8_t i = 0U; i < priv->numdeveps; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
 
-	for (uint8_t i = 1U; i < priv->ineps; i++) {
-		LOG_DBG("DIEPTXF%u %08x DIEPCTL%u %08x",
-			i, sys_read32((mem_addr_t)&base->dieptxf[i - 1U]), i, dxepctl);
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT ||
+		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			mem_addr_t doepctl_reg = dwc2_get_dxepctl_reg(dev, i);
+
+			sys_write32(USB_DWC2_DEPCTL_SNAK, doepctl_reg);
+			priv->outeps++;
+		}
 	}
 
-	return 0;
-}
+	LOG_DBG("Number of OUT endpoints %u", priv->outeps);
 
-static int dwc2_unset_dedicated_fifo(const struct device *dev,
-				     struct udc_ep_config *const cfg,
-				     uint32_t *const diepctl)
-{
-	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
+	/* Read and store all TxFIFO depths because Programmed FIFO Depths must
+	 * not exceed the power-on values.
+	 */
+	val = sys_read32((mem_addr_t)&base->gnptxfsiz);
+	priv->max_txfifo_depth[0] = usb_dwc2_get_gnptxfsiz_nptxfdep(val);
+	for (uint8_t i = 1; i < priv->ineps; i++) {
+		priv->max_txfifo_depth[i] = dwc2_get_txfdep(dev, i - 1);
+	}
 
-	/* Clear FIFO number field */
-	*diepctl &= ~USB_DWC2_DEPCTL_TXFNUM_MASK;
+	priv->rxfifo_depth = usb_dwc2_get_grxfsiz(sys_read32(grxfsiz_reg));
 
 	if (priv->dynfifosizing) {
-		if (priv->txf_set & ~BIT_MASK(ep_idx)) {
-			LOG_WRN("Some of the FIFOs higher than %u are set, %lx",
-				ep_idx, priv->txf_set & ~BIT_MASK(ep_idx));
-			return 0;
+		uint32_t gnptxfsiz;
+		uint32_t default_depth;
+
+		/* TODO: For proper runtime FIFO sizing UDC driver would have to
+		 * have prior knowledge of the USB configurations. Only with the
+		 * prior knowledge, the driver will be able to fairly distribute
+		 * available resources. For the time being just use different
+		 * defaults based on maximum configured PHY speed, but this has
+		 * to be revised if e.g. thresholding support would be necessary
+		 * on some target.
+		 */
+		if (hs_phy) {
+			default_depth = UDC_DWC2_GRXFSIZ_HS_DEFAULT;
+		} else {
+			default_depth = UDC_DWC2_GRXFSIZ_FS_DEFAULT;
 		}
+		default_depth += priv->outeps * 2U;
 
-		dwc2_set_txf(dev, ep_idx - 1, 0, 0);
-	}
+		/* Driver does not dynamically resize RxFIFO so there is no need
+		 * to store reset value. Read the reset value and make sure that
+		 * the programmed value is not greater than what driver sets.
+		 */
+		priv->rxfifo_depth = MIN(priv->rxfifo_depth, default_depth);
+		sys_write32(usb_dwc2_set_grxfsiz(priv->rxfifo_depth), grxfsiz_reg);
 
-	priv->txf_set &= ~BIT(ep_idx);
+		/* Set TxFIFO 0 depth */
+		val = MAX(UDC_DWC2_FIFO0_DEPTH, priv->max_txfifo_depth[0]);
+		gnptxfsiz = usb_dwc2_set_gnptxfsiz_nptxfdep(val) |
+			    usb_dwc2_set_gnptxfsiz_nptxfstaddr(priv->rxfifo_depth);
 
-	return 0;
-}
+		sys_write32(gnptxfsiz, (mem_addr_t)&base->gnptxfsiz);
+	}
 
-static void dwc2_wait_for_bit(const struct device *dev,
-			      mem_addr_t addr, uint32_t bit)
-{
-	k_timepoint_t timeout = sys_timepoint_calc(K_MSEC(100));
+	LOG_DBG("RX FIFO size %u bytes", priv->rxfifo_depth * 4);
+	for (uint8_t i = 1U; i < priv->ineps; i++) {
+		LOG_DBG("TX FIFO%u depth %u addr %u",
+			i, priv->max_txfifo_depth[i], dwc2_get_txfaddr(dev, i));
+	}
 
-	/* This could potentially be converted to use proper synchronization
-	 * primitives instead of busy looping, but the number of interrupt bits
-	 * this function can be waiting for is rather high.
-	 *
-	 * Busy looping is most likely fine unless profiling shows otherwise.
-	 */
-	while (!(sys_read32(addr) & bit)) {
-		if (dwc2_quirk_is_phy_clk_off(dev)) {
-			/* No point in waiting, because the bit can only be set
-			 * when the PHY is actively clocked.
-			 */
-			return;
-		}
+	if (udc_ep_enable_internal(dev, USB_CONTROL_EP_OUT,
+				   USB_EP_TYPE_CONTROL, 64, 0)) {
+		LOG_ERR("Failed to enable control endpoint");
+		return -EIO;
+	}
 
-		if (sys_timepoint_expired(timeout)) {
-			LOG_ERR("Timeout waiting for bit 0x%08X at 0x%08X",
-				bit, (uint32_t)addr);
-			return;
-		}
+	if (udc_ep_enable_internal(dev, USB_CONTROL_EP_IN,
+				   USB_EP_TYPE_CONTROL, 64, 0)) {
+		LOG_ERR("Failed to enable control endpoint");
+		return -EIO;
 	}
+
+	/* Unmask interrupts */
+	sys_write32(USB_DWC2_GINTSTS_OEPINT | USB_DWC2_GINTSTS_IEPINT |
+		    USB_DWC2_GINTSTS_ENUMDONE | USB_DWC2_GINTSTS_USBRST |
+		    USB_DWC2_GINTSTS_WKUPINT | USB_DWC2_GINTSTS_USBSUSP |
+		    USB_DWC2_GINTSTS_INCOMPISOOUT | USB_DWC2_GINTSTS_INCOMPISOIN |
+		    USB_DWC2_GINTSTS_SOF,
+		    (mem_addr_t)&base->gintmsk);
+
+	return 0;
 }
 
-/* Disabled IN endpoint means that device will send NAK (isochronous: ZLP) after
- * receiving IN token from host even if there is packet available in TxFIFO.
- * Disabled OUT endpoint means that device will NAK (isochronous: discard data)
- * incoming OUT data (or HS PING) even if there is space available in RxFIFO.
- *
- * Set stall parameter to true if caller wants to send STALL instead of NAK.
- */
-static void udc_dwc2_ep_disable(const struct device *dev,
-				struct udc_ep_config *const cfg, bool stall)
+static int udc_dwc2_enable(const struct device *dev)
 {
+	const struct udc_dwc2_config *const config = dev->config;
 	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
-	mem_addr_t dxepctl_reg;
-	uint32_t dxepctl;
-
-	dxepctl_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
-	dxepctl = sys_read32(dxepctl_reg);
+	int err;
 
-	if (dxepctl & USB_DWC2_DEPCTL_NAKSTS) {
-		/* Endpoint already sends forced NAKs. STALL if necessary. */
-		if (stall) {
-			dxepctl |= USB_DWC2_DEPCTL_STALL;
-			sys_write32(dxepctl, dxepctl_reg);
-		}
+	err = dwc2_quirk_pre_enable(dev);
+	if (err) {
+		LOG_ERR("Quirk pre enable failed %d", err);
+		return err;
+	}
 
-		return;
+	err = udc_dwc2_init_controller(dev);
+	if (err) {
+		return err;
 	}
 
-	if (USB_EP_DIR_IS_OUT(cfg->addr)) {
-		mem_addr_t dctl_reg, gintsts_reg, doepint_reg;
-		uint32_t dctl;
+	err = dwc2_quirk_post_enable(dev);
+	if (err) {
+		LOG_ERR("Quirk post enable failed %d", err);
+		return err;
+	}
 
-		dctl_reg = (mem_addr_t)&base->dctl;
-		gintsts_reg = (mem_addr_t)&base->gintsts;
-		doepint_reg = (mem_addr_t)&base->out_ep[ep_idx].doepint;
+	/* Enable global interrupt */
+	sys_set_bits((mem_addr_t)&base->gahbcfg, USB_DWC2_GAHBCFG_GLBINTRMASK);
+	config->irq_enable_func(dev);
 
-		dctl = sys_read32(dctl_reg);
+	/* Disable soft disconnect */
+	sys_clear_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_SFTDISCON);
+	LOG_DBG("Enable device %p", base);
 
-		if (sys_read32(gintsts_reg) & USB_DWC2_GINTSTS_GOUTNAKEFF) {
-			LOG_ERR("GOUTNAKEFF already active");
-		} else {
-			dctl |= USB_DWC2_DCTL_SGOUTNAK;
-			sys_write32(dctl, dctl_reg);
-			dctl &= ~USB_DWC2_DCTL_SGOUTNAK;
-		}
+	return 0;
+}
 
-		dwc2_wait_for_bit(dev, gintsts_reg, USB_DWC2_GINTSTS_GOUTNAKEFF);
+static int udc_dwc2_disable(const struct device *dev)
+{
+	const struct udc_dwc2_config *const config = dev->config;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	mem_addr_t dctl_reg = (mem_addr_t)&base->dctl;
+	int err;
 
-		/* The application cannot disable control OUT endpoint 0. */
-		if (ep_idx != 0) {
-			dxepctl |= USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPDIS;
-		}
+	/* Enable soft disconnect */
+	sys_set_bits(dctl_reg, USB_DWC2_DCTL_SFTDISCON);
+	LOG_DBG("Disable device %p", dev);
 
-		if (stall) {
-			/* For OUT endpoints STALL is set instead of SNAK */
-			dxepctl |= USB_DWC2_DEPCTL_STALL;
-		} else {
-			dxepctl |= USB_DWC2_DEPCTL_SNAK;
-		}
-		sys_write32(dxepctl, dxepctl_reg);
+	if (udc_ep_disable_internal(dev, USB_CONTROL_EP_OUT)) {
+		LOG_DBG("Failed to disable control endpoint");
+		return -EIO;
+	}
 
-		if (ep_idx != 0) {
-			dwc2_wait_for_bit(dev, doepint_reg, USB_DWC2_DOEPINT_EPDISBLD);
-		}
+	if (udc_ep_disable_internal(dev, USB_CONTROL_EP_IN)) {
+		LOG_DBG("Failed to disable control endpoint");
+		return -EIO;
+	}
 
-		/* Clear Endpoint Disabled interrupt */
-		sys_write32(USB_DWC2_DIEPINT_EPDISBLD, doepint_reg);
+	config->irq_disable_func(dev);
 
-		dctl |= USB_DWC2_DCTL_CGOUTNAK;
-		sys_write32(dctl, dctl_reg);
-	} else {
-		mem_addr_t diepint_reg;
+	if (priv->hibernated) {
+		dwc2_exit_hibernation(dev, false);
+		priv->hibernated = 0;
+	}
 
-		diepint_reg = (mem_addr_t)&base->in_ep[ep_idx].diepint;
+	sys_clear_bits((mem_addr_t)&base->gahbcfg, USB_DWC2_GAHBCFG_GLBINTRMASK);
 
-		dxepctl |= USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_SNAK;
-		if (stall) {
-			/* For IN endpoints STALL is set in addition to SNAK */
-			dxepctl |= USB_DWC2_DEPCTL_STALL;
-		}
-		sys_write32(dxepctl, dxepctl_reg);
+	err = dwc2_quirk_disable(dev);
+	if (err) {
+		LOG_ERR("Quirk disable failed %d", err);
+		return err;
+	}
 
-		dwc2_wait_for_bit(dev, diepint_reg, USB_DWC2_DIEPINT_INEPNAKEFF);
+	return 0;
+}
 
-		dxepctl |= USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPDIS;
-		sys_write32(dxepctl, dxepctl_reg);
+static int udc_dwc2_init(const struct device *dev)
+{
+	int ret;
 
-		dwc2_wait_for_bit(dev, diepint_reg, USB_DWC2_DIEPINT_EPDISBLD);
+	ret = dwc2_quirk_init(dev);
+	if (ret) {
+		LOG_ERR("Quirk init failed %d", ret);
+		return ret;
+	}
 
-		/* Clear Endpoint Disabled interrupt */
-		sys_write32(USB_DWC2_DIEPINT_EPDISBLD, diepint_reg);
+	return dwc2_init_pinctrl(dev);
+}
 
-		/* TODO: Read DIEPTSIZn here? Programming Guide suggest it to
-		 * let application know how many bytes of interrupted transfer
-		 * were transferred to the host.
-		 */
+static int udc_dwc2_shutdown(const struct device *dev)
+{
+	int ret;
 
-		dwc2_flush_tx_fifo(dev, usb_dwc2_get_depctl_txfnum(dxepctl));
+	ret = dwc2_quirk_shutdown(dev);
+	if (ret) {
+		LOG_ERR("Quirk shutdown failed %d", ret);
+		return ret;
 	}
 
-	udc_ep_set_busy(dev, cfg->addr, false);
+	return 0;
 }
 
-/* Deactivated endpoint means that there will be a bus timeout when the host
- * tries to access the endpoint.
- */
-static int udc_dwc2_ep_deactivate(const struct device *dev,
-				  struct udc_ep_config *const cfg)
+static int dwc2_driver_preinit(const struct device *dev)
 {
-	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
-	mem_addr_t dxepctl_reg;
-	uint32_t dxepctl;
-
-	dxepctl_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
-	dxepctl = sys_read32(dxepctl_reg);
+	const struct udc_dwc2_config *config = dev->config;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	struct udc_data *data = dev->data;
+	uint16_t mps = 1023;
+	uint32_t numdeveps;
+	uint32_t ineps;
+	int err;
 
-	if (dxepctl & USB_DWC2_DEPCTL_USBACTEP) {
-		LOG_DBG("Disable ep 0x%02x DxEPCTL%u %x",
-			cfg->addr, ep_idx, dxepctl);
+	k_mutex_init(&data->mutex);
 
-		udc_dwc2_ep_disable(dev, cfg, false);
+	k_event_init(&priv->drv_evt);
+	k_event_init(&priv->xfer_new);
+	k_event_init(&priv->xfer_finished);
 
-		dxepctl = sys_read32(dxepctl_reg);
-		dxepctl &= ~USB_DWC2_DEPCTL_USBACTEP;
-	} else {
-		LOG_WRN("ep 0x%02x is not active DxEPCTL%u %x",
-			cfg->addr, ep_idx, dxepctl);
-	}
+	data->caps.rwup = true;
+	data->caps.addr_before_status = true;
+	data->caps.mps0 = UDC_MPS0_64;
 
-	if (USB_EP_DIR_IS_IN(cfg->addr) && udc_mps_ep_size(cfg) != 0U &&
-	    ep_idx != 0U) {
-		dwc2_unset_dedicated_fifo(dev, cfg, &dxepctl);
+	(void)dwc2_quirk_caps(dev);
+	if (data->caps.hs) {
+		mps = 1024;
 	}
 
-	sys_write32(dxepctl, dxepctl_reg);
-	dwc2_set_epint(dev, cfg, false);
+	/*
+	 * At this point, we cannot or do not want to access the hardware
+	 * registers to get GHWCFGn values. For now, we will use devicetree to
+	 * get GHWCFGn values and use them to determine the number and type of
+	 * configured endpoints in the hardware. This can be considered a
+	 * workaround, and we may change the upper layer internals to avoid it
+	 * in the future.
+	 */
+	ineps = usb_dwc2_get_ghwcfg4_ineps(config->ghwcfg4) + 1U;
+	numdeveps = usb_dwc2_get_ghwcfg2_numdeveps(config->ghwcfg2) + 1U;
+	LOG_DBG("Number of endpoints (NUMDEVEPS + 1) %u", numdeveps);
+	LOG_DBG("Number of IN endpoints (INEPS + 1) %u", ineps);
 
-	if (cfg->addr == USB_CONTROL_EP_OUT) {
-		struct net_buf *buf = udc_buf_get_all(dev, cfg->addr);
+	for (uint32_t i = 0, n = 0; i < numdeveps; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(config->ghwcfg1, i);
 
-		/* Release the buffer allocated in dwc2_ctrl_feed_dout() */
-		if (buf) {
-			net_buf_unref(buf);
+		if (epdir != USB_DWC2_GHWCFG1_EPDIR_OUT &&
+		    epdir != USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			continue;
 		}
-	}
 
-	return 0;
-}
+		if (i == 0) {
+			config->ep_cfg_out[n].caps.control = 1;
+			config->ep_cfg_out[n].caps.mps = 64;
+		} else {
+			config->ep_cfg_out[n].caps.bulk = 1;
+			config->ep_cfg_out[n].caps.interrupt = 1;
+			config->ep_cfg_out[n].caps.iso = 1;
+			config->ep_cfg_out[n].caps.high_bandwidth = data->caps.hs;
+			config->ep_cfg_out[n].caps.mps = mps;
+		}
 
-static int udc_dwc2_ep_set_halt(const struct device *dev,
-				struct udc_ep_config *const cfg)
-{
-	uint8_t ep_idx = USB_EP_GET_IDX(cfg->addr);
+		config->ep_cfg_out[n].caps.out = 1;
+		config->ep_cfg_out[n].addr = USB_EP_DIR_OUT | i;
 
-	udc_dwc2_ep_disable(dev, cfg, true);
+		LOG_DBG("Register ep 0x%02x (%u)", i, n);
+		err = udc_register_ep(dev, &config->ep_cfg_out[n]);
+		if (err != 0) {
+			LOG_ERR("Failed to register endpoint");
+			return err;
+		}
 
-	LOG_DBG("Set halt ep 0x%02x", cfg->addr);
-	if (ep_idx != 0) {
-		cfg->stat.halted = true;
+		n++;
+		/* Also check the number of desired OUT endpoints in devicetree. */
+		if (n >= config->num_out_eps) {
+			break;
+		}
 	}
 
-	return 0;
-}
-
-static int udc_dwc2_ep_clear_halt(const struct device *dev,
-				  struct udc_ep_config *const cfg)
-{
-	mem_addr_t dxepctl_reg = dwc2_get_dxepctl_reg(dev, cfg->addr);
-	uint32_t dxepctl;
-	struct dwc2_drv_event evt = {
-		.ep = cfg->addr,
-		.type = DWC2_DRV_EVT_XFER,
-	};
-
-	dxepctl = sys_read32(dxepctl_reg);
-	dxepctl &= ~USB_DWC2_DEPCTL_STALL;
-	dxepctl |= USB_DWC2_DEPCTL_SETD0PID;
-	sys_write32(dxepctl, dxepctl_reg);
-
-	LOG_DBG("Clear halt ep 0x%02x", cfg->addr);
-	cfg->stat.halted = false;
+	for (uint32_t i = 0, n = 0; i < numdeveps; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(config->ghwcfg1, i);
 
-	/* Resume queued transfers if any */
-	if (udc_buf_peek(dev, cfg->addr)) {
-		k_msgq_put(&drv_msgq, &evt, K_NO_WAIT);
-	}
+		if (epdir != USB_DWC2_GHWCFG1_EPDIR_IN &&
+		    epdir != USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			continue;
+		}
 
-	return 0;
-}
+		if (i == 0) {
+			config->ep_cfg_in[n].caps.control = 1;
+			config->ep_cfg_in[n].caps.mps = 64;
+		} else {
+			config->ep_cfg_in[n].caps.bulk = 1;
+			config->ep_cfg_in[n].caps.interrupt = 1;
+			config->ep_cfg_in[n].caps.iso = 1;
+			config->ep_cfg_in[n].caps.high_bandwidth = data->caps.hs;
+			config->ep_cfg_in[n].caps.mps = mps;
+		}
 
-static int udc_dwc2_ep_enqueue(const struct device *dev,
-			       struct udc_ep_config *const cfg,
-			       struct net_buf *const buf)
-{
-	struct dwc2_drv_event evt = {
-		.ep = cfg->addr,
-		.type = DWC2_DRV_EVT_XFER,
-	};
+		config->ep_cfg_in[n].caps.in = 1;
+		config->ep_cfg_in[n].addr = USB_EP_DIR_IN | i;
 
-	LOG_DBG("%p enqueue %x %p", dev, cfg->addr, buf);
-	udc_buf_put(cfg, buf);
+		LOG_DBG("Register ep 0x%02x (%u)", USB_EP_DIR_IN | i, n);
+		err = udc_register_ep(dev, &config->ep_cfg_in[n]);
+		if (err != 0) {
+			LOG_ERR("Failed to register endpoint");
+			return err;
+		}
 
-	if (!cfg->stat.halted) {
-		k_msgq_put(&drv_msgq, &evt, K_NO_WAIT);
+		n++;
+		/* Also check the number of desired IN endpoints in devicetree. */
+		if (n >= MIN(ineps, config->num_in_eps)) {
+			break;
+		}
 	}
 
+	config->make_thread(dev);
+
 	return 0;
 }
 
-static int udc_dwc2_ep_dequeue(const struct device *dev,
-			       struct udc_ep_config *const cfg)
+static int udc_dwc2_lock(const struct device *dev)
 {
-	struct net_buf *buf;
-
-	udc_dwc2_ep_disable(dev, cfg, false);
-
-	buf = udc_buf_get_all(dev, cfg->addr);
-	if (buf) {
-		udc_submit_ep_event(dev, buf, -ECONNABORTED);
-	}
-
-	udc_ep_set_busy(dev, cfg->addr, false);
-
-	LOG_DBG("dequeue ep 0x%02x", cfg->addr);
-
-	return 0;
+	return udc_lock_internal(dev, K_FOREVER);
 }
 
-static int udc_dwc2_set_address(const struct device *dev, const uint8_t addr)
+static int udc_dwc2_unlock(const struct device *dev)
 {
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	mem_addr_t dcfg_reg = (mem_addr_t)&base->dcfg;
-	uint32_t dcfg;
-
-	if (addr > (USB_DWC2_DCFG_DEVADDR_MASK >> USB_DWC2_DCFG_DEVADDR_POS)) {
-		return -EINVAL;
-	}
-
-	dcfg = sys_read32(dcfg_reg);
-	dcfg &= ~USB_DWC2_DCFG_DEVADDR_MASK;
-	dcfg |= usb_dwc2_set_dcfg_devaddr(addr);
-	sys_write32(dcfg, dcfg_reg);
-	LOG_DBG("Set new address %u for %p", addr, dev);
-
-	return 0;
+	return udc_unlock_internal(dev);
 }
 
-static int udc_dwc2_test_mode(const struct device *dev,
-			      const uint8_t mode, const bool dryrun)
+static void dwc2_on_bus_reset(const struct device *dev)
 {
 	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	mem_addr_t dctl_reg = (mem_addr_t)&base->dctl;
-	uint32_t dctl;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	uint32_t doepmsk;
 
-	if (mode == 0U || mode > USB_DWC2_DCTL_TSTCTL_TESTFE) {
-		return -EINVAL;
+	/* Set the NAK bit for all OUT endpoints */
+	for (uint8_t i = 0U; i < priv->numdeveps; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+		mem_addr_t doepctl_reg;
+
+		LOG_DBG("ep 0x%02x EPDIR %u", i, epdir);
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT ||
+		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			doepctl_reg = dwc2_get_dxepctl_reg(dev, i);
+			sys_write32(USB_DWC2_DEPCTL_SNAK, doepctl_reg);
+		}
 	}
 
-	dctl = sys_read32(dctl_reg);
-	if (usb_dwc2_get_dctl_tstctl(dctl) != USB_DWC2_DCTL_TSTCTL_DISABLED) {
-		return -EALREADY;
+	doepmsk = USB_DWC2_DOEPINT_SETUP | USB_DWC2_DOEPINT_XFERCOMPL;
+	if (priv->bufferdma) {
+		doepmsk |= USB_DWC2_DOEPINT_STSPHSERCVD;
 	}
 
-	if (dryrun) {
-		LOG_DBG("Test Mode %u supported", mode);
-		return 0;
+	sys_write32(doepmsk, (mem_addr_t)&base->doepmsk);
+	sys_set_bits((mem_addr_t)&base->diepmsk, USB_DWC2_DIEPINT_XFERCOMPL);
+
+	/* Software has to handle RxFLvl interrupt only in Completer mode */
+	if (!priv->bufferdma) {
+		sys_set_bits((mem_addr_t)&base->gintmsk,
+			     USB_DWC2_GINTSTS_RXFLVL);
 	}
 
-	dctl |= usb_dwc2_set_dctl_tstctl(mode);
-	sys_write32(dctl, dctl_reg);
-	LOG_DBG("Enable Test Mode %u", mode);
+	/* Clear device address during reset. */
+	sys_clear_bits((mem_addr_t)&base->dcfg, USB_DWC2_DCFG_DEVADDR_MASK);
 
-	return 0;
+	/* Speed enumeration must happen after reset. */
+	priv->enumdone = 0;
 }
 
-static int udc_dwc2_host_wakeup(const struct device *dev)
+static void dwc2_handle_enumdone(const struct device *dev)
 {
-	LOG_DBG("Remote wakeup from %p", dev);
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	uint32_t dsts;
 
-	return -ENOTSUP;
+	dsts = sys_read32((mem_addr_t)&base->dsts);
+	priv->enumspd = usb_dwc2_get_dsts_enumspd(dsts);
+	priv->enumdone = 1;
 }
 
-/* Return actual USB device speed */
-static enum udc_bus_speed udc_dwc2_device_speed(const struct device *dev)
+static inline int dwc2_read_fifo_setup(const struct device *dev, uint8_t ep,
+				       const size_t size)
 {
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	size_t offset;
 
-	switch (priv->enumspd) {
-	case USB_DWC2_DSTS_ENUMSPD_HS3060:
-		return UDC_BUS_SPEED_HS;
-	case USB_DWC2_DSTS_ENUMSPD_LS6:
-		__ASSERT(false, "Low speed mode not supported");
-		__fallthrough;
-	case USB_DWC2_DSTS_ENUMSPD_FS48:
-		__fallthrough;
-	case USB_DWC2_DSTS_ENUMSPD_FS3060:
-		__fallthrough;
+	/* FIFO access is always in 32-bit words */
+
+	if (size != 8) {
+		LOG_ERR("%d bytes SETUP", size);
+	}
+
+	/*
+	 * We store the setup packet temporarily in the driver's private data
+	 * because there is always a race risk after the status stage OUT
+	 * packet from the host and the new setup packet. This is fine in
+	 * bottom-half processing because the events arrive in a queue and
+	 * there will be a next net_buf for the setup packet.
+	 */
+	for (offset = 0; offset < MIN(size, 8); offset += 4) {
+		sys_put_le32(sys_read32(UDC_DWC2_EP_FIFO(base, ep)),
+			     &priv->setup[offset]);
+	}
+
+	/* On protocol error simply discard extra data */
+	while (offset < size) {
+		sys_read32(UDC_DWC2_EP_FIFO(base, ep));
+		offset += 4;
+	}
+
+	return 0;
+}
+
+static inline void dwc2_handle_rxflvl(const struct device *dev)
+{
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	struct udc_ep_config *ep_cfg;
+	struct net_buf *buf;
+	uint32_t grxstsp;
+	uint32_t pktsts;
+	uint32_t bcnt;
+	uint8_t ep;
+
+	grxstsp = sys_read32((mem_addr_t)&base->grxstsp);
+	ep = usb_dwc2_get_grxstsp_epnum(grxstsp);
+	bcnt = usb_dwc2_get_grxstsp_bcnt(grxstsp);
+	pktsts = usb_dwc2_get_grxstsp_pktsts(grxstsp);
+
+	LOG_DBG("ep 0x%02x: pktsts %u, bcnt %u", ep, pktsts, bcnt);
+
+	switch (pktsts) {
+	case USB_DWC2_GRXSTSR_PKTSTS_SETUP:
+		dwc2_read_fifo_setup(dev, ep, bcnt);
+		break;
+	case USB_DWC2_GRXSTSR_PKTSTS_OUT_DATA:
+		ep_cfg = udc_get_ep_cfg(dev, ep);
+
+		buf = udc_buf_peek(dev, ep_cfg->addr);
+
+		/* RxFIFO data must be retrieved even when buf is NULL */
+		dwc2_read_fifo(dev, ep, buf, bcnt);
+		break;
+	case USB_DWC2_GRXSTSR_PKTSTS_OUT_DATA_DONE:
+		LOG_DBG("RX pktsts DONE");
+		break;
+	case USB_DWC2_GRXSTSR_PKTSTS_SETUP_DONE:
+		LOG_DBG("SETUP pktsts DONE");
+	case USB_DWC2_GRXSTSR_PKTSTS_GLOBAL_OUT_NAK:
+		LOG_DBG("Global OUT NAK");
+		break;
 	default:
-		return UDC_BUS_SPEED_FS;
+		break;
 	}
 }
 
-static int dwc2_core_soft_reset(const struct device *dev)
+static inline void dwc2_handle_in_xfercompl(const struct device *dev,
+					    const uint8_t ep_idx)
+{
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	struct udc_ep_config *ep_cfg;
+	struct net_buf *buf;
+
+	ep_cfg = udc_get_ep_cfg(dev, ep_idx | USB_EP_DIR_IN);
+	buf = udc_buf_peek(dev, ep_cfg->addr);
+	if (buf == NULL) {
+		udc_submit_event(dev, UDC_EVT_ERROR, -ENOBUFS);
+		return;
+	}
+
+	net_buf_pull(buf, priv->tx_len[ep_idx]);
+	if (buf->len  && dwc2_tx_fifo_write(dev, ep_cfg, buf) == 0) {
+		return;
+	}
+
+	k_event_post(&priv->xfer_finished, BIT(16 + ep_idx));
+	k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_EP_FINISHED));
+}
+
+static inline void dwc2_handle_iepint(const struct device *dev)
 {
 	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	mem_addr_t grstctl_reg = (mem_addr_t)&base->grstctl;
-	const unsigned int csr_timeout_us = 10000UL;
-	uint32_t cnt = 0UL;
+	const uint8_t n_max = 16;
+	uint32_t diepmsk;
+	uint32_t daint;
 
-	/* Check AHB master idle state */
-	while (!(sys_read32(grstctl_reg) & USB_DWC2_GRSTCTL_AHBIDLE)) {
-		k_busy_wait(1);
+	diepmsk = sys_read32((mem_addr_t)&base->diepmsk);
+	daint = sys_read32((mem_addr_t)&base->daint);
+
+	for (uint8_t n = 0U; n < n_max; n++) {
+		mem_addr_t diepint_reg = (mem_addr_t)&base->in_ep[n].diepint;
+		uint32_t diepint;
+		uint32_t status;
+
+		if (daint & USB_DWC2_DAINT_INEPINT(n)) {
+			/* Read and clear interrupt status */
+			diepint = sys_read32(diepint_reg);
+			status = diepint & diepmsk;
+			sys_write32(status, diepint_reg);
+
+			LOG_DBG("ep 0x%02x interrupt status: 0x%x",
+				n | USB_EP_DIR_IN, status);
+
+			if (status & USB_DWC2_DIEPINT_XFERCOMPL) {
+				dwc2_handle_in_xfercompl(dev, n);
+			}
 
-		if (++cnt > csr_timeout_us) {
-			LOG_ERR("Wait for AHB idle timeout, GRSTCTL 0x%08x",
-				sys_read32(grstctl_reg));
-			return -EIO;
 		}
 	}
 
-	/* Apply Core Soft Reset */
-	sys_write32(USB_DWC2_GRSTCTL_CSFTRST, grstctl_reg);
+	/* Clear IEPINT interrupt */
+	sys_write32(USB_DWC2_GINTSTS_IEPINT, (mem_addr_t)&base->gintsts);
+}
 
-	cnt = 0UL;
-	do {
-		if (++cnt > csr_timeout_us) {
-			LOG_ERR("Wait for CSR done timeout, GRSTCTL 0x%08x",
-				sys_read32(grstctl_reg));
-			return -EIO;
+static inline void dwc2_handle_out_xfercompl(const struct device *dev,
+					     const uint8_t ep_idx)
+{
+	struct udc_ep_config *ep_cfg = udc_get_ep_cfg(dev, ep_idx);
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	uint32_t bcnt;
+	struct net_buf *buf;
+	uint32_t doeptsiz;
+	const bool is_iso = dwc2_ep_is_iso(ep_cfg);
+
+	doeptsiz = sys_read32((mem_addr_t)&base->out_ep[ep_idx].doeptsiz);
+
+	buf = udc_buf_peek(dev, ep_cfg->addr);
+	if (!buf) {
+		LOG_ERR("No buffer for ep 0x%02x", ep_cfg->addr);
+		udc_submit_event(dev, UDC_EVT_ERROR, -ENOBUFS);
+		return;
+	}
+
+	/* The original transfer size value is necessary here because controller
+	 * decreases the value for every byte stored.
+	 */
+	bcnt = usb_dwc2_get_doeptsizn_xfersize(priv->rx_siz[ep_idx]) -
+	       usb_dwc2_get_doeptsizn_xfersize(doeptsiz);
+
+	if (is_iso) {
+		uint32_t pkts;
+		bool valid;
+
+		pkts = usb_dwc2_get_doeptsizn_pktcnt(priv->rx_siz[ep_idx]) -
+			usb_dwc2_get_doeptsizn_pktcnt(doeptsiz);
+		switch (usb_dwc2_get_doeptsizn_rxdpid(doeptsiz)) {
+		case USB_DWC2_DOEPTSIZN_RXDPID_DATA0:
+			valid = (pkts == 1);
+			break;
+		case USB_DWC2_DOEPTSIZN_RXDPID_DATA1:
+			valid = (pkts == 2);
+			break;
+		case USB_DWC2_DOEPTSIZN_RXDPID_DATA2:
+			valid = (pkts == 3);
+			break;
+		case USB_DWC2_DOEPTSIZN_RXDPID_MDATA:
+		default:
+			valid = false;
+			break;
 		}
 
-		k_busy_wait(1);
-	} while (sys_read32(grstctl_reg) & USB_DWC2_GRSTCTL_CSFTRST &&
-		 !(sys_read32(grstctl_reg) & USB_DWC2_GRSTCTL_CSFTRSTDONE));
+		if (!valid) {
+			if (!priv->bufferdma) {
+				/* RxFlvl added data to net buf, rollback */
+				net_buf_remove_mem(buf, bcnt);
+			}
+			/* Data is not valid, discard it */
+			bcnt = 0;
+		}
+	}
 
-	sys_clear_bits(grstctl_reg, USB_DWC2_GRSTCTL_CSFTRST | USB_DWC2_GRSTCTL_CSFTRSTDONE);
+	if (priv->bufferdma && bcnt) {
+		sys_cache_data_invd_range(buf->data, bcnt);
+		net_buf_add(buf, bcnt);
+	}
 
-	return 0;
+	if (!is_iso && (bcnt % udc_mps_ep_size(ep_cfg)) == 0 &&
+	    net_buf_tailroom(buf)) {
+		dwc2_prep_rx(dev, buf, ep_cfg);
+	} else {
+		k_event_post(&priv->xfer_finished, BIT(ep_idx));
+		k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_EP_FINISHED));
+	}
 }
 
-static int udc_dwc2_init_controller(const struct device *dev)
+static inline void dwc2_handle_oepint(const struct device *dev)
 {
-	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
 	struct udc_dwc2_data *const priv = udc_get_private(dev);
-	struct usb_dwc2_reg *const base = config->base;
-	mem_addr_t grxfsiz_reg = (mem_addr_t)&base->grxfsiz;
-	mem_addr_t gahbcfg_reg = (mem_addr_t)&base->gahbcfg;
-	mem_addr_t gusbcfg_reg = (mem_addr_t)&base->gusbcfg;
-	mem_addr_t dcfg_reg = (mem_addr_t)&base->dcfg;
-	uint32_t dcfg;
-	uint32_t gusbcfg;
-	uint32_t gahbcfg;
-	uint32_t ghwcfg2;
-	uint32_t ghwcfg3;
-	uint32_t ghwcfg4;
-	uint32_t val;
-	int ret;
-	bool hs_phy;
+	const uint8_t n_max = 16;
+	uint32_t doepmsk;
+	uint32_t daint;
 
-	ret = dwc2_core_soft_reset(dev);
-	if (ret) {
-		return ret;
-	}
+	doepmsk = sys_read32((mem_addr_t)&base->doepmsk);
+	daint = sys_read32((mem_addr_t)&base->daint);
 
-	priv->ghwcfg1 = sys_read32((mem_addr_t)&base->ghwcfg1);
-	ghwcfg2 = sys_read32((mem_addr_t)&base->ghwcfg2);
-	ghwcfg3 = sys_read32((mem_addr_t)&base->ghwcfg3);
-	ghwcfg4 = sys_read32((mem_addr_t)&base->ghwcfg4);
+	for (uint8_t n = 0U; n < n_max; n++) {
+		mem_addr_t doepint_reg = (mem_addr_t)&base->out_ep[n].doepint;
+		uint32_t doepint;
+		uint32_t status;
 
-	if (!(ghwcfg4 & USB_DWC2_GHWCFG4_DEDFIFOMODE)) {
-		LOG_ERR("Only dedicated TX FIFO mode is supported");
-		return -ENOTSUP;
-	}
+		if (!(daint & USB_DWC2_DAINT_OUTEPINT(n))) {
+			continue;
+		}
 
-	/*
-	 * Force device mode as we do no support role changes.
-	 * Wait 25ms for the change to take effect.
-	 */
-	gusbcfg = USB_DWC2_GUSBCFG_FORCEDEVMODE;
-	sys_write32(gusbcfg, gusbcfg_reg);
-	k_msleep(25);
+		/* Read and clear interrupt status */
+		doepint = sys_read32(doepint_reg);
+		status = doepint & doepmsk;
+		sys_write32(status, doepint_reg);
 
-	/* Buffer DMA is always supported in Internal DMA mode.
-	 * TODO: check and support descriptor DMA if available
-	 */
-	priv->bufferdma = (usb_dwc2_get_ghwcfg2_otgarch(ghwcfg2) ==
-			   USB_DWC2_GHWCFG2_OTGARCH_INTERNALDMA);
+		LOG_DBG("ep 0x%02x interrupt status: 0x%x", n, status);
 
-	if (!IS_ENABLED(CONFIG_UDC_DWC2_DMA)) {
-		priv->bufferdma = 0;
-	} else if (priv->bufferdma) {
-		LOG_WRN("Experimental DMA enabled");
+		/* StupPktRcvd is not enabled for interrupt, but must be checked
+		 * when XferComp hits to determine if SETUP token was received.
+		 */
+		if (priv->bufferdma && (status & USB_DWC2_DOEPINT_XFERCOMPL) &&
+		    (doepint & USB_DWC2_DOEPINT_STUPPKTRCVD)) {
+			uint32_t addr;
+
+			sys_write32(USB_DWC2_DOEPINT_STUPPKTRCVD, doepint_reg);
+			status &= ~USB_DWC2_DOEPINT_XFERCOMPL;
+
+			/* DMAAddr points past the memory location where the
+			 * SETUP data was stored. Copy the received SETUP data
+			 * to temporary location used also in Completer mode
+			 * which allows common SETUP interrupt handling.
+			 */
+			addr = sys_read32((mem_addr_t)&base->out_ep[0].doepdma);
+			sys_cache_data_invd_range((void *)(addr - 8), 8);
+			memcpy(priv->setup, (void *)(addr - 8), sizeof(priv->setup));
+		}
+
+		if (status & USB_DWC2_DOEPINT_SETUP) {
+			k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_SETUP));
+		}
+
+		if (status & USB_DWC2_DOEPINT_STSPHSERCVD) {
+			/* Driver doesn't need any special handling, but it is
+			 * mandatory that the bit is cleared in Buffer DMA mode.
+			 * If the bit is not cleared (i.e. when this interrupt
+			 * bit is masked), then SETUP interrupts will cease
+			 * after first control transfer with data stage from
+			 * device to host.
+			 */
+		}
+
+		if (status & USB_DWC2_DOEPINT_XFERCOMPL) {
+			dwc2_handle_out_xfercompl(dev, n);
+		}
 	}
 
-	if (ghwcfg2 & USB_DWC2_GHWCFG2_DYNFIFOSIZING) {
-		LOG_DBG("Dynamic FIFO Sizing is enabled");
-		priv->dynfifosizing = true;
-	}
+	/* Clear OEPINT interrupt */
+	sys_write32(USB_DWC2_GINTSTS_OEPINT, (mem_addr_t)&base->gintsts);
+}
+
+/* In DWC2 otg context incomplete isochronous IN transfer means that the host
+ * did not issue IN token to at least one isochronous endpoint and software has
+ * find on which endpoints the data is no longer valid and discard it.
+ */
+static void dwc2_handle_incompisoin(const struct device *dev)
+{
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	mem_addr_t gintsts_reg = (mem_addr_t)&base->gintsts;
+	const uint32_t mask =
+		USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPTYPE_MASK |
+		USB_DWC2_DEPCTL_USBACTEP;
+	const uint32_t val =
+		USB_DWC2_DEPCTL_EPENA |
+		usb_dwc2_set_depctl_eptype(USB_DWC2_DEPCTL_EPTYPE_ISO) |
+		USB_DWC2_DEPCTL_USBACTEP;
+
+	for (uint8_t i = 1U; i < priv->numdeveps; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
 
-	if (IS_ENABLED(CONFIG_UDC_DWC2_HIBERNATION) &&
-	    ghwcfg4 & USB_DWC2_GHWCFG4_HIBERNATION) {
-		LOG_INF("Hibernation enabled");
-		priv->suspend_type = DWC2_SUSPEND_HIBERNATION;
-	} else {
-		priv->suspend_type = DWC2_SUSPEND_NO_POWER_SAVING;
-	}
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_IN ||
+		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			mem_addr_t diepctl_reg = dwc2_get_dxepctl_reg(dev, i | USB_EP_DIR_IN);
+			uint32_t diepctl;
 
-	/* Get the number or endpoints and IN endpoints we can use later */
-	priv->numdeveps = usb_dwc2_get_ghwcfg2_numdeveps(ghwcfg2) + 1U;
-	priv->ineps = usb_dwc2_get_ghwcfg4_ineps(ghwcfg4) + 1U;
-	LOG_DBG("Number of endpoints (NUMDEVEPS + 1) %u", priv->numdeveps);
-	LOG_DBG("Number of IN endpoints (INEPS + 1) %u", priv->ineps);
+			diepctl = sys_read32(diepctl_reg);
 
-	LOG_DBG("Number of periodic IN endpoints (NUMDEVPERIOEPS) %u",
-		usb_dwc2_get_ghwcfg4_numdevperioeps(ghwcfg4));
-	LOG_DBG("Number of additional control endpoints (NUMCTLEPS) %u",
-		usb_dwc2_get_ghwcfg4_numctleps(ghwcfg4));
+			/* Check if endpoint didn't receive ISO OUT data */
+			if ((diepctl & mask) == val) {
+				struct udc_ep_config *cfg;
+				struct net_buf *buf;
 
-	LOG_DBG("OTG architecture (OTGARCH) %u, mode (OTGMODE) %u",
-		usb_dwc2_get_ghwcfg2_otgarch(ghwcfg2),
-		usb_dwc2_get_ghwcfg2_otgmode(ghwcfg2));
+				cfg = udc_get_ep_cfg(dev, i | USB_EP_DIR_IN);
+				__ASSERT_NO_MSG(cfg && cfg->stat.enabled &&
+						dwc2_ep_is_iso(cfg));
 
-	priv->dfifodepth = usb_dwc2_get_ghwcfg3_dfifodepth(ghwcfg3);
-	LOG_DBG("DFIFO depth (DFIFODEPTH) %u bytes", priv->dfifodepth * 4);
+				udc_dwc2_ep_disable(dev, cfg, false);
 
-	priv->max_pktcnt = GHWCFG3_PKTCOUNT(usb_dwc2_get_ghwcfg3_pktsizewidth(ghwcfg3));
-	priv->max_xfersize = GHWCFG3_XFERSIZE(usb_dwc2_get_ghwcfg3_xfersizewidth(ghwcfg3));
-	LOG_DBG("Max packet count %u, Max transfer size %u",
-		priv->max_pktcnt, priv->max_xfersize);
+				buf = udc_buf_get(dev, cfg->addr);
+				if (buf) {
+					udc_submit_ep_event(dev, buf, 0);
+				}
+			}
+		}
+	}
 
-	LOG_DBG("Vendor Control interface support enabled: %s",
-		(ghwcfg3 & USB_DWC2_GHWCFG3_VNDCTLSUPT) ? "true" : "false");
+	sys_write32(USB_DWC2_GINTSTS_INCOMPISOIN, gintsts_reg);
+}
 
-	LOG_DBG("PHY interface type: FSPHYTYPE %u, HSPHYTYPE %u, DATAWIDTH %u",
-		usb_dwc2_get_ghwcfg2_fsphytype(ghwcfg2),
-		usb_dwc2_get_ghwcfg2_hsphytype(ghwcfg2),
-		usb_dwc2_get_ghwcfg4_phydatawidth(ghwcfg4));
+/* In DWC2 otg context incomplete isochronous OUT transfer means that the host
+ * did not issue OUT token to at least one isochronous endpoint and software has
+ * to find on which endpoint it didn't receive any data and let the stack know.
+ */
+static void dwc2_handle_incompisoout(const struct device *dev)
+{
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	mem_addr_t gintsts_reg = (mem_addr_t)&base->gintsts;
+	const uint32_t mask =
+		USB_DWC2_DEPCTL_EPENA | USB_DWC2_DEPCTL_EPTYPE_MASK |
+		USB_DWC2_DEPCTL_DPID | USB_DWC2_DEPCTL_USBACTEP;
+	const uint32_t val =
+		USB_DWC2_DEPCTL_EPENA |
+		usb_dwc2_set_depctl_eptype(USB_DWC2_DEPCTL_EPTYPE_ISO) |
+		((priv->sof_num & 1) ? USB_DWC2_DEPCTL_DPID : 0) |
+		USB_DWC2_DEPCTL_USBACTEP;
 
-	LOG_DBG("LPM mode is %s",
-		(ghwcfg3 & USB_DWC2_GHWCFG3_LPMMODE) ? "enabled" : "disabled");
+	for (uint8_t i = 1U; i < priv->numdeveps; i++) {
+		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
 
-	/* Configure AHB, select Completer or DMA mode */
-	gahbcfg = sys_read32(gahbcfg_reg);
+		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT ||
+		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
+			mem_addr_t doepctl_reg = dwc2_get_dxepctl_reg(dev, i);
+			uint32_t doepctl;
 
-	if (priv->bufferdma) {
-		gahbcfg |= USB_DWC2_GAHBCFG_DMAEN;
-	} else {
-		gahbcfg &= ~USB_DWC2_GAHBCFG_DMAEN;
-	}
+			doepctl = sys_read32(doepctl_reg);
 
-	sys_write32(gahbcfg, gahbcfg_reg);
+			/* Check if endpoint didn't receive ISO OUT data */
+			if ((doepctl & mask) == val) {
+				struct udc_ep_config *cfg;
+				struct net_buf *buf;
 
-	dcfg = sys_read32(dcfg_reg);
+				cfg = udc_get_ep_cfg(dev, i);
+				__ASSERT_NO_MSG(cfg && cfg->stat.enabled &&
+						dwc2_ep_is_iso(cfg));
 
-	dcfg &= ~USB_DWC2_DCFG_DESCDMA;
+				udc_dwc2_ep_disable(dev, cfg, false);
 
-	/* Configure PHY and device speed */
-	dcfg &= ~USB_DWC2_DCFG_DEVSPD_MASK;
-	switch (usb_dwc2_get_ghwcfg2_hsphytype(ghwcfg2)) {
-	case USB_DWC2_GHWCFG2_HSPHYTYPE_UTMIPLUSULPI:
-		__fallthrough;
-	case USB_DWC2_GHWCFG2_HSPHYTYPE_ULPI:
-		gusbcfg |= USB_DWC2_GUSBCFG_PHYSEL_USB20 |
-			   USB_DWC2_GUSBCFG_ULPI_UTMI_SEL_ULPI;
-		dcfg |= USB_DWC2_DCFG_DEVSPD_USBHS20
-			<< USB_DWC2_DCFG_DEVSPD_POS;
-		hs_phy = true;
-		break;
-	case USB_DWC2_GHWCFG2_HSPHYTYPE_UTMIPLUS:
-		gusbcfg |= USB_DWC2_GUSBCFG_PHYSEL_USB20 |
-			   USB_DWC2_GUSBCFG_ULPI_UTMI_SEL_UTMI;
-		dcfg |= USB_DWC2_DCFG_DEVSPD_USBHS20
-			<< USB_DWC2_DCFG_DEVSPD_POS;
-		hs_phy = true;
-		break;
-	case USB_DWC2_GHWCFG2_HSPHYTYPE_NO_HS:
-		__fallthrough;
-	default:
-		if (usb_dwc2_get_ghwcfg2_fsphytype(ghwcfg2) !=
-		    USB_DWC2_GHWCFG2_FSPHYTYPE_NO_FS) {
-			gusbcfg |= USB_DWC2_GUSBCFG_PHYSEL_USB11;
+				buf = udc_buf_get(dev, cfg->addr);
+				if (buf) {
+					udc_submit_ep_event(dev, buf, 0);
+				}
+			}
 		}
-
-		dcfg |= USB_DWC2_DCFG_DEVSPD_USBFS1148
-			<< USB_DWC2_DCFG_DEVSPD_POS;
-		hs_phy = false;
 	}
 
-	if (usb_dwc2_get_ghwcfg4_phydatawidth(ghwcfg4)) {
-		gusbcfg |= USB_DWC2_GUSBCFG_PHYIF_16_BIT;
-	}
+	sys_write32(USB_DWC2_GINTSTS_INCOMPISOOUT, gintsts_reg);
+}
 
-	/* Update PHY configuration */
-	sys_write32(gusbcfg, gusbcfg_reg);
-	sys_write32(dcfg, dcfg_reg);
+static void udc_dwc2_isr_handler(const struct device *dev)
+{
+	const struct udc_dwc2_config *const config = dev->config;
+	struct usb_dwc2_reg *const base = config->base;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	mem_addr_t gintsts_reg = (mem_addr_t)&base->gintsts;
+	uint32_t int_status;
+	uint32_t gintmsk;
 
-	priv->outeps = 0U;
-	for (uint8_t i = 0U; i < priv->numdeveps; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(priv->ghwcfg1, i);
+	if (priv->hibernated) {
+		uint32_t gpwrdn = sys_read32((mem_addr_t)&base->gpwrdn);
+		bool reset, resume = false;
 
-		if (epdir == USB_DWC2_GHWCFG1_EPDIR_OUT ||
-		    epdir == USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			mem_addr_t doepctl_reg = dwc2_get_dxepctl_reg(dev, i);
+		/* Clear interrupts */
+		sys_write32(gpwrdn, (mem_addr_t)&base->gpwrdn);
 
-			sys_write32(USB_DWC2_DEPCTL_SNAK, doepctl_reg);
-			priv->outeps++;
+		if (gpwrdn & USB_DWC2_GPWRDN_LNSTSCHNG) {
+			resume = usb_dwc2_get_gpwrdn_linestate(gpwrdn) ==
+				 USB_DWC2_GPWRDN_LINESTATE_DM1DP0;
 		}
-	}
 
-	LOG_DBG("Number of OUT endpoints %u", priv->outeps);
+		reset = gpwrdn & USB_DWC2_GPWRDN_RESETDETECTED;
 
-	/* Read and store all TxFIFO depths because Programmed FIFO Depths must
-	 * not exceed the power-on values.
-	 */
-	val = sys_read32((mem_addr_t)&base->gnptxfsiz);
-	priv->max_txfifo_depth[0] = usb_dwc2_get_gnptxfsiz_nptxfdep(val);
-	for (uint8_t i = 1; i < priv->ineps; i++) {
-		priv->max_txfifo_depth[i] = dwc2_get_txfdep(dev, i - 1);
+		if (resume) {
+			k_event_post(&priv->drv_evt,
+				     BIT(DWC2_DRV_EVT_HIBERNATION_EXIT_HOST_RESUME));
+		}
+
+		if (reset) {
+			k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_HIBERNATION_EXIT_BUS_RESET));
+		}
+
+		(void)dwc2_quirk_irq_clear(dev);
+		return;
 	}
 
-	priv->rxfifo_depth = usb_dwc2_get_grxfsiz(sys_read32(grxfsiz_reg));
+	gintmsk = sys_read32((mem_addr_t)&base->gintmsk);
 
-	if (priv->dynfifosizing) {
-		uint32_t gnptxfsiz;
-		uint32_t default_depth;
+	/*  Read and handle interrupt status register */
+	while ((int_status = sys_read32(gintsts_reg) & gintmsk)) {
 
-		/* TODO: For proper runtime FIFO sizing UDC driver would have to
-		 * have prior knowledge of the USB configurations. Only with the
-		 * prior knowledge, the driver will be able to fairly distribute
-		 * available resources. For the time being just use different
-		 * defaults based on maximum configured PHY speed, but this has
-		 * to be revised if e.g. thresholding support would be necessary
-		 * on some target.
-		 */
-		if (hs_phy) {
-			default_depth = UDC_DWC2_GRXFSIZ_HS_DEFAULT;
-		} else {
-			default_depth = UDC_DWC2_GRXFSIZ_FS_DEFAULT;
+		LOG_DBG("GINTSTS 0x%x", int_status);
+
+		if (int_status & USB_DWC2_GINTSTS_SOF) {
+			uint32_t dsts;
+
+			/* Clear USB SOF interrupt. */
+			sys_write32(USB_DWC2_GINTSTS_SOF, gintsts_reg);
+
+			dsts = sys_read32((mem_addr_t)&base->dsts);
+			priv->sof_num = usb_dwc2_get_dsts_soffn(dsts);
+			udc_submit_event(dev, UDC_EVT_SOF, 0);
 		}
-		default_depth += priv->outeps * 2U;
 
-		/* Driver does not dynamically resize RxFIFO so there is no need
-		 * to store reset value. Read the reset value and make sure that
-		 * the programmed value is not greater than what driver sets.
-		 */
-		priv->rxfifo_depth = MIN(priv->rxfifo_depth, default_depth);
-		sys_write32(usb_dwc2_set_grxfsiz(priv->rxfifo_depth), grxfsiz_reg);
+		if (int_status & USB_DWC2_GINTSTS_USBRST) {
+			/* Clear and handle USB Reset interrupt. */
+			sys_write32(USB_DWC2_GINTSTS_USBRST, gintsts_reg);
+			dwc2_on_bus_reset(dev);
+			LOG_DBG("USB Reset interrupt");
 
-		/* Set TxFIFO 0 depth */
-		val = MAX(UDC_DWC2_FIFO0_DEPTH, priv->max_txfifo_depth[0]);
-		gnptxfsiz = usb_dwc2_set_gnptxfsiz_nptxfdep(val) |
-			    usb_dwc2_set_gnptxfsiz_nptxfstaddr(priv->rxfifo_depth);
+			cancel_hibernation_request(priv);
+		}
 
-		sys_write32(gnptxfsiz, (mem_addr_t)&base->gnptxfsiz);
-	}
+		if (int_status & USB_DWC2_GINTSTS_ENUMDONE) {
+			/* Clear and handle Enumeration Done interrupt. */
+			sys_write32(USB_DWC2_GINTSTS_ENUMDONE, gintsts_reg);
+			dwc2_handle_enumdone(dev);
+			udc_submit_event(dev, UDC_EVT_RESET, 0);
+		}
 
-	LOG_DBG("RX FIFO size %u bytes", priv->rxfifo_depth * 4);
-	for (uint8_t i = 1U; i < priv->ineps; i++) {
-		LOG_DBG("TX FIFO%u depth %u addr %u",
-			i, priv->max_txfifo_depth[i], dwc2_get_txfaddr(dev, i));
-	}
+		if (int_status & USB_DWC2_GINTSTS_WKUPINT) {
+			/* Clear Resume/Remote Wakeup Detected interrupt. */
+			sys_write32(USB_DWC2_GINTSTS_WKUPINT, gintsts_reg);
+			udc_set_suspended(dev, false);
+			udc_submit_event(dev, UDC_EVT_RESUME, 0);
 
-	if (udc_ep_enable_internal(dev, USB_CONTROL_EP_OUT,
-				   USB_EP_TYPE_CONTROL, 64, 0)) {
-		LOG_ERR("Failed to enable control endpoint");
-		return -EIO;
-	}
+			cancel_hibernation_request(priv);
+		}
 
-	if (udc_ep_enable_internal(dev, USB_CONTROL_EP_IN,
-				   USB_EP_TYPE_CONTROL, 64, 0)) {
-		LOG_ERR("Failed to enable control endpoint");
-		return -EIO;
-	}
+		if (int_status & USB_DWC2_GINTSTS_IEPINT) {
+			/* Handle IN Endpoints interrupt */
+			dwc2_handle_iepint(dev);
+		}
 
-	/* Unmask interrupts */
-	sys_write32(USB_DWC2_GINTSTS_OEPINT | USB_DWC2_GINTSTS_IEPINT |
-		    USB_DWC2_GINTSTS_ENUMDONE | USB_DWC2_GINTSTS_USBRST |
-		    USB_DWC2_GINTSTS_WKUPINT | USB_DWC2_GINTSTS_USBSUSP |
-		    USB_DWC2_GINTSTS_INCOMPISOOUT | USB_DWC2_GINTSTS_INCOMPISOIN |
-		    USB_DWC2_GINTSTS_SOF,
-		    (mem_addr_t)&base->gintmsk);
+		if (int_status & USB_DWC2_GINTSTS_RXFLVL) {
+			/* Handle RxFIFO Non-Empty interrupt */
+			dwc2_handle_rxflvl(dev);
+		}
 
-	return 0;
-}
+		if (int_status & USB_DWC2_GINTSTS_OEPINT) {
+			/* Handle OUT Endpoints interrupt */
+			dwc2_handle_oepint(dev);
+		}
 
-static int udc_dwc2_enable(const struct device *dev)
-{
-	const struct udc_dwc2_config *const config = dev->config;
-	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	int err;
+		if (int_status & USB_DWC2_GINTSTS_INCOMPISOIN) {
+			dwc2_handle_incompisoin(dev);
+		}
 
-	err = dwc2_quirk_pre_enable(dev);
-	if (err) {
-		LOG_ERR("Quirk pre enable failed %d", err);
-		return err;
-	}
+		if (int_status & USB_DWC2_GINTSTS_INCOMPISOOUT) {
+			dwc2_handle_incompisoout(dev);
+		}
 
-	err = udc_dwc2_init_controller(dev);
-	if (err) {
-		return err;
-	}
+		if (int_status & USB_DWC2_GINTSTS_USBSUSP) {
+			/* Clear USB Suspend interrupt. */
+			sys_write32(USB_DWC2_GINTSTS_USBSUSP, gintsts_reg);
 
-	err = dwc2_quirk_post_enable(dev);
-	if (err) {
-		LOG_ERR("Quirk post enable failed %d", err);
-		return err;
-	}
+			if (!priv->enumdone) {
+				/* Ignore stale suspend interrupt */
+				continue;
+			}
 
-	/* Enable global interrupt */
-	sys_set_bits((mem_addr_t)&base->gahbcfg, USB_DWC2_GAHBCFG_GLBINTRMASK);
-	config->irq_enable_func(dev);
+			/* Notify the stack */
+			udc_set_suspended(dev, true);
+			udc_submit_event(dev, UDC_EVT_SUSPEND, 0);
 
-	/* Disable soft disconnect */
-	sys_clear_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_SFTDISCON);
-	LOG_DBG("Enable device %p", base);
+			request_hibernation(priv);
+		}
+	}
 
-	return 0;
+	(void)dwc2_quirk_irq_clear(dev);
 }
 
-static int udc_dwc2_disable(const struct device *dev)
+static void dwc2_handle_hibernation_exit(const struct device *dev,
+					 bool rwup, bool bus_reset)
 {
-	const struct udc_dwc2_config *const config = dev->config;
 	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
-	mem_addr_t dctl_reg = (mem_addr_t)&base->dctl;
-	int err;
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
 
-	/* Enable soft disconnect */
-	sys_set_bits(dctl_reg, USB_DWC2_DCTL_SFTDISCON);
-	LOG_DBG("Disable device %p", dev);
+	dwc2_exit_hibernation(dev, rwup);
+	dwc2_restore_device_registers(dev, rwup);
 
-	if (udc_ep_disable_internal(dev, USB_CONTROL_EP_OUT)) {
-		LOG_DBG("Failed to disable control endpoint");
-		return -EIO;
+	priv->hibernated = 0;
+	if (!rwup) {
+		LOG_DBG("Hibernation exit complete");
 	}
 
-	if (udc_ep_disable_internal(dev, USB_CONTROL_EP_IN)) {
-		LOG_DBG("Failed to disable control endpoint");
-		return -EIO;
-	}
+	/* Let stack know we are no longer suspended */
+	udc_set_suspended(dev, false);
+	udc_submit_event(dev, UDC_EVT_RESUME, 0);
 
-	config->irq_disable_func(dev);
-	sys_clear_bits((mem_addr_t)&base->gahbcfg, USB_DWC2_GAHBCFG_GLBINTRMASK);
+	if (rwup) {
+		/* Resume has been driven for at least 1 ms now, do 1 ms more to
+		 * have sufficient margin.
+		 */
+		k_msleep(1);
 
-	err = dwc2_quirk_disable(dev);
-	if (err) {
-		LOG_ERR("Quirk disable failed %d", err);
-		return err;
+		sys_clear_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_RMTWKUPSIG);
 	}
 
-	return 0;
-}
+	if (rwup) {
+		LOG_DBG("Hibernation exit on Remote Wakeup complete");
+	}
 
-static int udc_dwc2_init(const struct device *dev)
-{
-	int ret;
+	if (bus_reset) {
+		/* Clear all pending transfers */
+		k_event_clear(&priv->xfer_new, UINT32_MAX);
+		k_event_clear(&priv->xfer_finished, UINT32_MAX);
+		dwc2_on_bus_reset(dev);
+	} else {
+		/* Resume any pending transfer handling */
+		if (k_event_test(&priv->xfer_new, UINT32_MAX)) {
+			k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_XFER));
+		}
 
-	ret = dwc2_quirk_init(dev);
-	if (ret) {
-		LOG_ERR("Quirk init failed %d", ret);
-		return ret;
+		if (k_event_test(&priv->xfer_finished, UINT32_MAX)) {
+			k_event_post(&priv->drv_evt, BIT(DWC2_DRV_EVT_EP_FINISHED));
+		}
 	}
-
-	return dwc2_init_pinctrl(dev);
 }
 
-static int udc_dwc2_shutdown(const struct device *dev)
+static uint8_t pull_next_ep_from_bitmap(uint32_t *bitmap)
 {
-	int ret;
+	unsigned int bit;
 
-	ret = dwc2_quirk_shutdown(dev);
-	if (ret) {
-		LOG_ERR("Quirk shutdown failed %d", ret);
-		return ret;
-	}
+	__ASSERT_NO_MSG(bitmap && *bitmap);
 
-	return 0;
+	bit = find_lsb_set(*bitmap) - 1;
+	*bitmap &= ~BIT(bit);
+
+	if (bit >= 16) {
+		return USB_EP_DIR_IN | (bit - 16);
+	} else {
+		return USB_EP_DIR_OUT | bit;
+	}
 }
 
-static int dwc2_driver_preinit(const struct device *dev)
+static ALWAYS_INLINE void dwc2_thread_handler(void *const arg)
 {
-	const struct udc_dwc2_config *config = dev->config;
-	struct udc_data *data = dev->data;
-	uint16_t mps = 1023;
-	uint32_t numdeveps;
-	uint32_t ineps;
-	int err;
+	const struct device *dev = (const struct device *)arg;
+	struct usb_dwc2_reg *const base = dwc2_get_base(dev);
+	struct udc_dwc2_data *const priv = udc_get_private(dev);
+	const struct udc_dwc2_config *const config = dev->config;
+	struct udc_ep_config *ep_cfg;
+	const uint32_t hibernation_exit_events = (BIT(DWC2_DRV_EVT_HIBERNATION_EXIT_BUS_RESET) |
+						  BIT(DWC2_DRV_EVT_HIBERNATION_EXIT_HOST_RESUME));
+	uint32_t prev;
+	uint32_t evt;
+	uint32_t eps;
+	uint8_t ep;
 
-	k_mutex_init(&data->mutex);
+	/* This is the bottom-half of the ISR handler and the place where
+	 * a new transfer can be fed.
+	 */
+	evt = k_event_wait(&priv->drv_evt, UINT32_MAX, false, K_FOREVER);
 
-	data->caps.addr_before_status = true;
-	data->caps.mps0 = UDC_MPS0_64;
+	udc_lock_internal(dev, K_FOREVER);
 
-	(void)dwc2_quirk_caps(dev);
-	if (data->caps.hs) {
-		mps = 1024;
-	}
+	if (evt & BIT(DWC2_DRV_EVT_XFER)) {
+		k_event_clear(&priv->drv_evt, BIT(DWC2_DRV_EVT_XFER));
 
-	/*
-	 * At this point, we cannot or do not want to access the hardware
-	 * registers to get GHWCFGn values. For now, we will use devicetree to
-	 * get GHWCFGn values and use them to determine the number and type of
-	 * configured endpoints in the hardware. This can be considered a
-	 * workaround, and we may change the upper layer internals to avoid it
-	 * in the future.
-	 */
-	ineps = usb_dwc2_get_ghwcfg4_ineps(config->ghwcfg4) + 1U;
-	numdeveps = usb_dwc2_get_ghwcfg2_numdeveps(config->ghwcfg2) + 1U;
-	LOG_DBG("Number of endpoints (NUMDEVEPS + 1) %u", numdeveps);
-	LOG_DBG("Number of IN endpoints (INEPS + 1) %u", ineps);
+		if (!priv->hibernated) {
+			LOG_DBG("New transfer(s) in the queue");
+			eps = k_event_test(&priv->xfer_new, UINT32_MAX);
+			k_event_clear(&priv->xfer_new, eps);
+		} else {
+			/* Events will be handled after hibernation exit */
+			eps = 0;
+		}
 
-	for (uint32_t i = 0, n = 0; i < numdeveps; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(config->ghwcfg1, i);
+		while (eps) {
+			ep = pull_next_ep_from_bitmap(&eps);
+			ep_cfg = udc_get_ep_cfg(dev, ep);
 
-		if (epdir != USB_DWC2_GHWCFG1_EPDIR_OUT &&
-		    epdir != USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			continue;
+			if (!udc_ep_is_busy(dev, ep_cfg->addr)) {
+				dwc2_handle_xfer_next(dev, ep_cfg);
+			} else {
+				LOG_DBG("ep 0x%02x busy", ep_cfg->addr);
+			}
 		}
+	}
 
-		if (i == 0) {
-			config->ep_cfg_out[n].caps.control = 1;
-			config->ep_cfg_out[n].caps.mps = 64;
+	if (evt & BIT(DWC2_DRV_EVT_EP_FINISHED)) {
+		k_event_clear(&priv->drv_evt, BIT(DWC2_DRV_EVT_EP_FINISHED));
+
+		if (!priv->hibernated) {
+			eps = k_event_test(&priv->xfer_finished, UINT32_MAX);
+			k_event_clear(&priv->xfer_finished, eps);
 		} else {
-			config->ep_cfg_out[n].caps.bulk = 1;
-			config->ep_cfg_out[n].caps.interrupt = 1;
-			config->ep_cfg_out[n].caps.iso = 1;
-			config->ep_cfg_out[n].caps.high_bandwidth = data->caps.hs;
-			config->ep_cfg_out[n].caps.mps = mps;
+			/* Events will be handled after hibernation exit */
+			eps = 0;
 		}
 
-		config->ep_cfg_out[n].caps.out = 1;
-		config->ep_cfg_out[n].addr = USB_EP_DIR_OUT | i;
+		while (eps) {
+			ep = pull_next_ep_from_bitmap(&eps);
+			ep_cfg = udc_get_ep_cfg(dev, ep);
 
-		LOG_DBG("Register ep 0x%02x (%u)", i, n);
-		err = udc_register_ep(dev, &config->ep_cfg_out[n]);
-		if (err != 0) {
-			LOG_ERR("Failed to register endpoint");
-			return err;
-		}
+			if (USB_EP_DIR_IS_IN(ep)) {
+				LOG_DBG("DIN event ep 0x%02x", ep);
+				dwc2_handle_evt_din(dev, ep_cfg);
+			} else {
+				LOG_DBG("DOUT event ep 0x%02x", ep_cfg->addr);
+				dwc2_handle_evt_dout(dev, ep_cfg);
+			}
 
-		n++;
-		/* Also check the number of desired OUT endpoints in devicetree. */
-		if (n >= config->num_out_eps) {
-			break;
+			if (!udc_ep_is_busy(dev, ep_cfg->addr)) {
+				dwc2_handle_xfer_next(dev, ep_cfg);
+			} else {
+				LOG_DBG("ep 0x%02x busy", ep_cfg->addr);
+			}
 		}
 	}
 
-	for (uint32_t i = 0, n = 0; i < numdeveps; i++) {
-		uint32_t epdir = usb_dwc2_get_ghwcfg1_epdir(config->ghwcfg1, i);
+	if (evt & BIT(DWC2_DRV_EVT_SETUP)) {
+		k_event_clear(&priv->drv_evt, BIT(DWC2_DRV_EVT_SETUP));
 
-		if (epdir != USB_DWC2_GHWCFG1_EPDIR_IN &&
-		    epdir != USB_DWC2_GHWCFG1_EPDIR_BDIR) {
-			continue;
-		}
+		LOG_DBG("SETUP event");
+		dwc2_handle_evt_setup(dev);
+	}
 
-		if (i == 0) {
-			config->ep_cfg_in[n].caps.control = 1;
-			config->ep_cfg_in[n].caps.mps = 64;
+	if (evt & BIT(DWC2_DRV_EVT_REMOTE_WAKEUP)) {
+		k_event_clear(&priv->drv_evt, BIT(DWC2_DRV_EVT_REMOTE_WAKEUP) |
+			      BIT(DWC2_DRV_EVT_ENTER_HIBERNATION));
+
+		if (priv->hibernated) {
+			config->irq_disable_func(dev);
+
+			dwc2_handle_hibernation_exit(dev, true, false);
+
+			config->irq_enable_func(dev);
 		} else {
-			config->ep_cfg_in[n].caps.bulk = 1;
-			config->ep_cfg_in[n].caps.interrupt = 1;
-			config->ep_cfg_in[n].caps.iso = 1;
-			config->ep_cfg_in[n].caps.high_bandwidth = data->caps.hs;
-			config->ep_cfg_in[n].caps.mps = mps;
-		}
+			sys_set_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_RMTWKUPSIG);
 
-		config->ep_cfg_in[n].caps.in = 1;
-		config->ep_cfg_in[n].addr = USB_EP_DIR_IN | i;
+			udc_set_suspended(dev, false);
+			udc_submit_event(dev, UDC_EVT_RESUME, 0);
 
-		LOG_DBG("Register ep 0x%02x (%u)", USB_EP_DIR_IN | i, n);
-		err = udc_register_ep(dev, &config->ep_cfg_in[n]);
-		if (err != 0) {
-			LOG_ERR("Failed to register endpoint");
-			return err;
+			/* Drive resume for 2 ms to have sufficient margin */
+			k_msleep(2);
+
+			sys_clear_bits((mem_addr_t)&base->dctl, USB_DWC2_DCTL_RMTWKUPSIG);
 		}
+	}
 
-		n++;
-		/* Also check the number of desired IN endpoints in devicetree. */
-		if (n >= MIN(ineps, config->num_in_eps)) {
-			break;
+	if (evt & BIT(DWC2_DRV_EVT_ENTER_HIBERNATION)) {
+		config->irq_disable_func(dev);
+
+		prev = k_event_clear(&priv->drv_evt, BIT(DWC2_DRV_EVT_ENTER_HIBERNATION));
+
+		/* Only enter hibernation if IRQ did not cancel the request */
+		if (prev & BIT(DWC2_DRV_EVT_ENTER_HIBERNATION)) {
+			dwc2_enter_hibernation(dev);
 		}
+
+		config->irq_enable_func(dev);
 	}
 
-	config->make_thread(dev);
+	if (evt & hibernation_exit_events) {
+		bool bus_reset;
 
-	return 0;
-}
+		LOG_DBG("Hibernation exit event");
+		config->irq_disable_func(dev);
 
-static int udc_dwc2_lock(const struct device *dev)
-{
-	return udc_lock_internal(dev, K_FOREVER);
-}
+		prev = k_event_clear(&priv->drv_evt, hibernation_exit_events);
+		bus_reset = prev & BIT(DWC2_DRV_EVT_HIBERNATION_EXIT_BUS_RESET);
 
-static int udc_dwc2_unlock(const struct device *dev)
-{
-	return udc_unlock_internal(dev);
+		if (priv->hibernated) {
+			dwc2_handle_hibernation_exit(dev, false, bus_reset);
+		}
+
+		config->irq_enable_func(dev);
+	}
+
+	udc_unlock_internal(dev);
 }
 
 static const struct udc_api udc_dwc2_api = {
diff --git a/drivers/wifi/nrfwifi/Kconfig.nrfwifi b/drivers/wifi/nrfwifi/Kconfig.nrfwifi
index cf423082b4e..e7ee0169300 100644
--- a/drivers/wifi/nrfwifi/Kconfig.nrfwifi
+++ b/drivers/wifi/nrfwifi/Kconfig.nrfwifi
@@ -664,13 +664,6 @@ config NET_MGMT_EVENT_QUEUE_SIZE
 	default 16
 endif # NRF_WIFI_RPU_RECOVERY
 
-config NRF_WIFI_COMBINED_BUCKEN_IOVDD_GPIO
-	bool
-	help
-	  Enable this option to use a single GPIO to control both buck enable and IOVDD enable,
-	  there will be a internal hardware switch to add delay between the two operations. This
-	  is typically 4ms delay for nRF70.
-
 config NRF_WIFI_FEAT_WMM
 	bool "WMM/QoS support"
 	default y
@@ -707,4 +700,37 @@ config NRF_WIFI_BUILD_ONLY_MODE
 	  dependency on firmware binary and patches.
 	  This is useful to check the build and link errors.
 
+# TODO: Temporary WAR, implement these options in the future
+config NRF_WIFI_PATCHES_EXT_FLASH_DISABLED
+	bool "nRF70 firmware patch external flash support"
+	help
+	  Select this option to disable external flash support for nRF70 firmware patches
+
+config NRF_WIFI_FW_PATCH_DFU
+	bool "nRF70 firmware patch DFU"
+	help
+	  Select this option to enable DFU for nRF70 firmware patches
+
+config NRF_WIFI_PATCHES_EXT_FLASH_STORE
+	bool "nRF70 firmware patch external flash store"
+	help
+	  Select this option to enable external flash store for nRF70 firmware patches
+
+config NRF_WIFI_FW_FLASH_CHUNK_SIZE
+	int "nRF70 firmware patch flash chunk size"
+	default 8192
+	help
+	  Select this option to set the flash chunk size for nRF70 firmware patches
+
+config NRF_WIFI_PATCHES_EXT_FLASH_XIP
+	bool "nRF70 firmware patch external flash XIP"
+	help
+	  Select this option to enable external flash XIP for nRF70 firmware patches
+
+config NRF_WIFI_FEAT_WMM
+	bool "WMM/QoS support"
+	default y
+	help
+	  This option controls disable/enable of the WMM(Wireless Multi-Media) feature.
+
 endif # WIFI_NRF70
diff --git a/drivers/wifi/nrfwifi/src/qspi/src/rpu_hw_if.c b/drivers/wifi/nrfwifi/src/qspi/src/rpu_hw_if.c
index b8b45d7f811..c5f909b4c3a 100644
--- a/drivers/wifi/nrfwifi/src/qspi/src/rpu_hw_if.c
+++ b/drivers/wifi/nrfwifi/src/qspi/src/rpu_hw_if.c
@@ -242,7 +242,8 @@ static int rpu_pwron(void)
 	/* Settling time for iovdd nRF7002 DK/EK - switch (TCK106AG): ~600us */
 	k_msleep(1);
 
-	if (IS_ENABLED(CONFIG_NRF_WIFI_COMBINED_BUCKEN_IOVDD_GPIO)) {
+	if ((bucken_spec.port == iovdd_ctrl_spec.port) &&
+	    (bucken_spec.pin == iovdd_ctrl_spec.pin)) {
 		/* When a single GPIO is used, we need a total wait time after bucken assertion
 		 * to be 6ms (1ms + 1ms + 4ms).
 		 */
diff --git a/dts/arm/nordic/nrf52805.dtsi b/dts/arm/nordic/nrf52805.dtsi
index 07f3e8ed7d3..6c59acc8004 100644
--- a/dts/arm/nordic/nrf52805.dtsi
+++ b/dts/arm/nordic/nrf52805.dtsi
@@ -10,7 +10,7 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -96,12 +96,13 @@
 			status = "okay";
 			ble-2mbps-supported;
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf52810.dtsi b/dts/arm/nordic/nrf52810.dtsi
index 3acbf81c56c..b73978f9962 100644
--- a/dts/arm/nordic/nrf52810.dtsi
+++ b/dts/arm/nordic/nrf52810.dtsi
@@ -6,7 +6,7 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -100,12 +100,13 @@
 			status = "okay";
 			ble-2mbps-supported;
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf52811.dtsi b/dts/arm/nordic/nrf52811.dtsi
index 2f1660c052e..3861194a337 100644
--- a/dts/arm/nordic/nrf52811.dtsi
+++ b/dts/arm/nordic/nrf52811.dtsi
@@ -10,7 +10,7 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -112,12 +112,13 @@
 				status = "disabled";
 			};
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf52820.dtsi b/dts/arm/nordic/nrf52820.dtsi
index 1553a6481d2..601a4f8c7ed 100644
--- a/dts/arm/nordic/nrf52820.dtsi
+++ b/dts/arm/nordic/nrf52820.dtsi
@@ -11,7 +11,7 @@
 / {
 
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -115,12 +115,13 @@
 				status = "disabled";
 			};
 
-			/* Note: In the nRF Connect SDK another Bluetooth controller
-			 * is added and set as the default.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf52832.dtsi b/dts/arm/nordic/nrf52832.dtsi
index ccd8bda3ab3..40011ad9630 100644
--- a/dts/arm/nordic/nrf52832.dtsi
+++ b/dts/arm/nordic/nrf52832.dtsi
@@ -6,7 +6,7 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -100,12 +100,13 @@
 			status = "okay";
 			ble-2mbps-supported;
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf52833.dtsi b/dts/arm/nordic/nrf52833.dtsi
index 1029d2a4239..ecbb82cfb56 100644
--- a/dts/arm/nordic/nrf52833.dtsi
+++ b/dts/arm/nordic/nrf52833.dtsi
@@ -10,7 +10,7 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -114,12 +114,13 @@
 				status = "disabled";
 			};
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf52840.dtsi b/dts/arm/nordic/nrf52840.dtsi
index 718f8a562b7..92931a1c40e 100644
--- a/dts/arm/nordic/nrf52840.dtsi
+++ b/dts/arm/nordic/nrf52840.dtsi
@@ -6,8 +6,8 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
-		zephyr,entropy = &rng;
+		zephyr,bt-hci = &bt_hci_sdc;
+		zephyr,entropy = &cryptocell;
 		zephyr,flash-controller = &flash_controller;
 	};
 
@@ -102,12 +102,13 @@
 				status = "disabled";
 			};
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
@@ -564,7 +565,7 @@
 			reg = <0x5002a000 0x1000>, <0x5002b000 0x1000>;
 			reg-names = "wrapper", "core";
 			interrupts = <42 NRF_DEFAULT_IRQ_PRIORITY>;
-			status = "disabled";
+			status = "okay";
 		};
 	};
 };
diff --git a/dts/arm/nordic/nrf5340_cpuapp.dtsi b/dts/arm/nordic/nrf5340_cpuapp.dtsi
index e40f6241d91..d48f0ce62dc 100644
--- a/dts/arm/nordic/nrf5340_cpuapp.dtsi
+++ b/dts/arm/nordic/nrf5340_cpuapp.dtsi
@@ -33,7 +33,7 @@
 	};
 
 	chosen {
-		zephyr,entropy = &rng_hci;
+		zephyr,entropy = &cryptocell;
 		zephyr,flash-controller = &flash_controller;
 	};
 
@@ -102,7 +102,7 @@
 			reg = <0x50844000 0x1000>, <0x50845000 0x1000>;
 			reg-names = "wrapper", "core";
 			interrupts = <68 NRF_DEFAULT_IRQ_PRIORITY>;
-			status = "disabled";
+			status = "okay";
 		};
 	};
 
diff --git a/dts/arm/nordic/nrf5340_cpunet.dtsi b/dts/arm/nordic/nrf5340_cpunet.dtsi
index 77b77759b22..0da1e06866f 100644
--- a/dts/arm/nordic/nrf5340_cpunet.dtsi
+++ b/dts/arm/nordic/nrf5340_cpunet.dtsi
@@ -9,7 +9,7 @@
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
 		zephyr,entropy = &rng;
 		zephyr,flash-controller = &flash_controller;
 	};
@@ -102,12 +102,13 @@
 				status = "disabled";
 			};
 
-			/* Note: In the nRF Connect SDK the SoftDevice Controller
-			 * is added and set as the default Bluetooth Controller.
-			 */
+			bt_hci_sdc: bt_hci_sdc {
+				compatible = "nordic,bt-hci-sdc";
+				status = "okay";
+			};
 			bt_hci_controller: bt_hci_controller {
 				compatible = "zephyr,bt-hci-ll-sw-split";
-				status = "okay";
+				status = "disabled";
 			};
 		};
 
diff --git a/dts/arm/nordic/nrf54h20_cpurad.dtsi b/dts/arm/nordic/nrf54h20_cpurad.dtsi
index 2d2fdee8d27..e8ff2dac3a4 100644
--- a/dts/arm/nordic/nrf54h20_cpurad.dtsi
+++ b/dts/arm/nordic/nrf54h20_cpurad.dtsi
@@ -23,6 +23,10 @@ wdt011: &cpurad_wdt011 {};
 /delete-node/ &cpuflpr;
 
 / {
+	chosen {
+		zephyr,bt-hci = &bt_hci_sdc;
+	};
+
 	soc {
 		compatible = "simple-bus";
 		interrupt-parent = <&cpurad_nvic>;
@@ -99,3 +103,7 @@ wdt011: &cpurad_wdt011 {};
 &dppic020 {
 	status = "okay";
 };
+
+&bt_hci_sdc {
+	status = "okay";
+};
diff --git a/dts/arm/nordic/nrf54l15_cpuapp.dtsi b/dts/arm/nordic/nrf54l15_cpuapp.dtsi
index 458d5a2e12a..2c60d7c1739 100644
--- a/dts/arm/nordic/nrf54l15_cpuapp.dtsi
+++ b/dts/arm/nordic/nrf54l15_cpuapp.dtsi
@@ -17,7 +17,8 @@ nvic: &cpuapp_nvic {};
 
 / {
 	chosen {
-		zephyr,bt-hci = &bt_hci_controller;
+		zephyr,bt-hci = &bt_hci_sdc;
+		zephyr,entropy = &psa_rng;
 	};
 
 	soc {
@@ -28,11 +29,11 @@ nvic: &cpuapp_nvic {};
 
 	psa_rng: psa-rng {
 		compatible = "zephyr,psa-crypto-rng";
-		status = "disabled";
+		status = "okay";
 	};
 };
 
-&bt_hci_controller {
+&bt_hci_sdc {
 	status = "okay";
 };
 
diff --git a/dts/arm/nordic/nrf91.dtsi b/dts/arm/nordic/nrf91.dtsi
index 78502d3f086..0fb4c4addf4 100644
--- a/dts/arm/nordic/nrf91.dtsi
+++ b/dts/arm/nordic/nrf91.dtsi
@@ -27,6 +27,7 @@
 	};
 
 	chosen {
+		zephyr,entropy = &cryptocell;
 		zephyr,flash-controller = &flash_controller;
 	};
 
@@ -50,7 +51,7 @@
 			reg = <0x50840000 0x1000>, <0x50841000 0x1000>;
 			reg-names = "wrapper", "core";
 			interrupts = <64 NRF_DEFAULT_IRQ_PRIORITY>;
-			status = "disabled";
+			status = "okay";
 		};
 
 		ctrlap: ctrlap@50006000 {
diff --git a/dts/bindings/gpio/nordic,nrf-gpio.yaml b/dts/bindings/gpio/nordic,nrf-gpio.yaml
index 097a99d8fa9..0ba8a14e132 100644
--- a/dts/bindings/gpio/nordic,nrf-gpio.yaml
+++ b/dts/bindings/gpio/nordic,nrf-gpio.yaml
@@ -5,7 +5,7 @@ description: NRF5 GPIO node
 
 compatible: "nordic,nrf-gpio"
 
-include: [gpio-controller.yaml, base.yaml]
+include: [gpio-controller.yaml, base.yaml, "nordic,nrf-port-configs.yaml"]
 
 properties:
   reg:
diff --git a/dts/bindings/gpio/nordic,nrf-port-configs.yaml b/dts/bindings/gpio/nordic,nrf-port-configs.yaml
new file mode 100644
index 00000000000..fd6754e53a0
--- /dev/null
+++ b/dts/bindings/gpio/nordic,nrf-port-configs.yaml
@@ -0,0 +1,35 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-4-Clause
+
+description: |
+  Nordic Port Configs
+
+  Hardware configurations that apply to IO ports.
+
+properties:
+  ioport-power-rails:
+    type: phandle-array
+    description: |
+      Power supply configurations for GPIO ports. The configuration is board-
+      specific and stored in BICR.
+      The property is encoded as <&phandle rail>, where:
+
+      - phandle is the phandle of the associated GPIO port
+      - rail is the 8-bit power rail configuration to apply to the port
+
+  ioport-drivectrls:
+    type: phandle-array
+    description: |
+      Drive control settings for GPIO ports. The configuration is board-specific
+      and stored in BICR.
+      The property is encoded as <&phandle resistance>, where:
+
+      - phandle is the phandle of the associated GPIO port
+      - resistance is the resistance in ohms to adjust in the port's drive
+      control, and can be one of the following: [33, 40, 50, 66, 100].
+
+ioport-power-rail-cells:
+  - rail
+
+ioport-drivectrl-cells:
+  - resistance
diff --git a/dts/bindings/misc/nordic,nrf-bicr.yaml b/dts/bindings/misc/nordic,nrf-bicr.yaml
new file mode 100644
index 00000000000..60894ee2e1d
--- /dev/null
+++ b/dts/bindings/misc/nordic,nrf-bicr.yaml
@@ -0,0 +1,118 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-4-Clause
+
+description: |
+  Nordic Board Information Configuration Registers (BICR)
+
+compatible: "nordic,nrf-bicr"
+
+include: [base.yaml, "nordic,nrf-port-configs.yaml"]
+
+properties:
+  power-vddao5v0:
+    type: string
+    description: VDD_AO_5V0 power rail configuration.
+    enum:
+      - "external"
+      - "shorted"
+
+  power-vddao1v8:
+    type: string
+    description: VDD_AO_1V8 power rail configuration.
+    enum:
+      - "internal"
+      - "external"
+
+  power-vdd1v0:
+    type: string
+    description: VDD_1V0 power rail configuration.
+    enum:
+      - "internal"
+      - "external"
+
+  power-vddrf1v0:
+    type: string
+    description: VDD_RF_1V0 power rail configuration.
+    enum:
+      - "external"
+      - "shorted"
+
+  power-vddao0v8:
+    type: string
+    description: VDD_AO_0V8 power rail configuration.
+    enum:
+      - "internal"
+      - "external"
+
+  power-vddvs0v8:
+    type: string
+    description: VDD_VS_0V8 power rail configuration.
+    enum:
+      - "internal"
+      - "external"
+
+  inductor-present:
+    type: boolean
+    description: DC/DC inductor present.
+
+  lfosc-accuracy:
+    type: int
+    description: LFXO crystal or external signal accuracy in ppm.
+    enum:
+      - 500
+      - 250
+      - 150
+      - 100
+      - 75
+      - 50
+      - 30
+      - 20
+
+  lfosc-mode:
+    type: string
+    description: |
+      LFXO operational mode.
+    enum:
+      - "crystal"
+      - "external-sine"
+      - "external-square"
+      - "disabled"
+
+  lfosc-loadcap:
+    type: int
+    description: |
+      Built-in load capacitors selection in 1pF steps, up to 25pF max. If 0,
+      only external capacitors will be used.
+
+  lfosc-startup:
+    type: int
+    description: LFXO startup time in milliseconds.
+
+  lfrc-autocalibration:
+    type: array
+    description: |
+      A list of values pertaining to LFRC autocalibration settings. The prop
+      is encoded as <temp-interval temp-delta interval-max-count>, where:
+      - temp-interval is the temperature measurement interval in 0.25s steps
+      - temp-delta is the temperature delta that should trigger a calibration
+        in 0.25 degree steps
+      - interval-max-count are the max number of temp-interval periods in
+        between calibrations, independent of temperature changes.
+
+  hfxo-mode:
+    type: string
+    description: |
+      HFXO operational mode.
+    enum:
+      - "crystal"
+      - "external-square"
+
+  hfxo-loadcap:
+    type: int
+    description: |
+      Built-in load capacitors selection in 0.25 pF steps, up to 25.75 pF max.
+      If 0, only external capacitors will be used.
+
+  hfxo-startup:
+    type: int
+    description: HFXO startup time in milliseconds.
diff --git a/dts/bindings/rng/nordic,nrf-prng.yaml b/dts/bindings/rng/nordic,nrf-prng.yaml
new file mode 100644
index 00000000000..8936393a0b6
--- /dev/null
+++ b/dts/bindings/rng/nordic,nrf-prng.yaml
@@ -0,0 +1,8 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+description: This is a super simple PRNG
+
+compatible: "nordic,entropy-prng"
+
+include: base.yaml
diff --git a/dts/common/nordic/nrf54h20.dtsi b/dts/common/nordic/nrf54h20.dtsi
index a5241adb6dc..a3eab249bb8 100644
--- a/dts/common/nordic/nrf54h20.dtsi
+++ b/dts/common/nordic/nrf54h20.dtsi
@@ -408,6 +408,15 @@
 					compatible = "nordic,nrf-ieee802154";
 					status = "disabled";
 				};
+
+				bt_hci_sdc: bt_hci_sdc {
+					compatible = "nordic,bt-hci-sdc";
+					status = "disabled";
+				};
+				bt_hci_controller: bt_hci_controller {
+					compatible = "zephyr,bt-hci-ll-sw-split";
+					status = "disabled";
+				};
 			};
 
 			ccm030: ccm@3a000 {
@@ -477,7 +486,7 @@
 			};
 
 			exmif: spi@95000 {
-				compatible = "nordic,nrf-exmif";
+				compatible = "nordic,nrf-exmif", "snps,designware-spi";
 				#address-cells = <1>;
 				#size-cells = <0>;
 				reg = <0x95000 0x500 0x95500 0xb00>;
diff --git a/dts/common/nordic/nrf54l15.dtsi b/dts/common/nordic/nrf54l15.dtsi
index 4eaac53d0eb..0e9b3435b1c 100644
--- a/dts/common/nordic/nrf54l15.dtsi
+++ b/dts/common/nordic/nrf54l15.dtsi
@@ -217,9 +217,10 @@
 					status = "disabled";
 				};
 
-				/* Note: In the nRF Connect SDK the SoftDevice Controller
-				 * is added and set as the default Bluetooth Controller.
-				 */
+				bt_hci_sdc: bt_hci_sdc {
+					compatible = "nordic,bt-hci-sdc";
+					status = "disabled";
+				};
 				bt_hci_controller: bt_hci_controller {
 					compatible = "zephyr,bt-hci-ll-sw-split";
 					status = "disabled";
diff --git a/include/zephyr/arch/arm/cortex_m/scripts/linker.ld b/include/zephyr/arch/arm/cortex_m/scripts/linker.ld
index fb26e91cf61..cb27c8f6303 100644
--- a/include/zephyr/arch/arm/cortex_m/scripts/linker.ld
+++ b/include/zephyr/arch/arm/cortex_m/scripts/linker.ld
@@ -34,6 +34,35 @@
 #define ROMSTART_REGION ROMABLE_REGION
 #endif
 
+#if USE_PARTITION_MANAGER
+
+#include <pm_config.h>
+
+#if CONFIG_NCS_IS_VARIANT_IMAGE && defined(PM_S0_ID)
+/* We are linking against S1, create symbol containing the flash ID of S0.
+ * This is used when writing code operating on the "other" slot.
+ */
+_image_1_primary_slot_id = PM_S0_ID;
+
+#else /* ! CONFIG_NCS_IS_VARIANT_IMAGE */
+
+#ifdef PM_S1_ID
+/* We are linking against S0, create symbol containing the flash ID of S1.
+ * This is used when writing code operating on the "other" slot.
+ */
+_image_1_primary_slot_id = PM_S1_ID;
+#endif /* PM_S1_ID */
+
+#endif /* CONFIG_NCS_IS_VARIANT_IMAGE */
+
+#define ROM_ADDR PM_ADDRESS
+#define ROM_SIZE PM_SIZE
+
+#define RAM_SIZE PM_SRAM_SIZE
+#define RAM_ADDR PM_SRAM_ADDRESS
+
+#else /* ! USE_PARTITION_MANAGER */
+
 #if !defined(CONFIG_XIP) && (CONFIG_FLASH_SIZE == 0)
 #define ROM_ADDR RAM_ADDR
 #else
@@ -66,6 +95,23 @@
 #define RAM_ADDR CONFIG_SRAM_BASE_ADDRESS
 #endif
 
+#endif /* USE_PARTITION_MANAGER */
+
+#if DT_NODE_HAS_STATUS(DT_CHOSEN(zephyr_ccm), okay)
+#define CCM_SIZE DT_REG_SIZE(DT_CHOSEN(zephyr_ccm))
+#define CCM_ADDR DT_REG_ADDR(DT_CHOSEN(zephyr_ccm))
+#endif
+
+#if DT_NODE_HAS_STATUS(DT_CHOSEN(zephyr_itcm), okay)
+#define ITCM_SIZE DT_REG_SIZE(DT_CHOSEN(zephyr_itcm))
+#define ITCM_ADDR DT_REG_ADDR(DT_CHOSEN(zephyr_itcm))
+#endif
+
+#if DT_NODE_HAS_STATUS(DT_CHOSEN(zephyr_dtcm), okay)
+#define DTCM_SIZE DT_REG_SIZE(DT_CHOSEN(zephyr_dtcm))
+#define DTCM_ADDR DT_REG_ADDR(DT_CHOSEN(zephyr_dtcm))
+#endif
+
 #if defined(CONFIG_CUSTOM_SECTION_ALIGN)
 _region_min_align = CONFIG_CUSTOM_SECTION_MIN_ALIGN_SIZE;
 #else
diff --git a/include/zephyr/bluetooth/conn.h b/include/zephyr/bluetooth/conn.h
index fa741715504..6ddc9835ceb 100644
--- a/include/zephyr/bluetooth/conn.h
+++ b/include/zephyr/bluetooth/conn.h
@@ -262,6 +262,157 @@ enum __packed bt_conn_type {
 			   BT_CONN_TYPE_SCO | BT_CONN_TYPE_ISO,
 };
 
+/** Supported AA-Only RTT precision. */
+enum bt_conn_le_cs_capability_rtt_aa_only {
+	/** AA-Only RTT variant is not supported. */
+	BT_CONN_LE_CS_RTT_AA_ONLY_NOT_SUPP = 0,
+	/** 10ns time-of-flight accuracy. */
+	BT_CONN_LE_CS_RTT_AA_ONLY_10NS,
+	/** 150ns time-of-flight accuracy. */
+	BT_CONN_LE_CS_RTT_AA_ONLY_150NS,
+};
+
+/** Supported Sounding Sequence RTT precision. */
+enum bt_conn_le_cs_capability_rtt_sounding {
+	/** Sounding Sequence RTT variant is not supported. */
+	BT_CONN_LE_CS_RTT_SOUNDING_NOT_SUPP = 0,
+	/** 10ns time-of-flight accuracy. */
+	BT_CONN_LE_CS_RTT_SOUNDING_10NS,
+	/** 150ns time-of-flight accuracy. */
+	BT_CONN_LE_CS_RTT_SOUNDING_150NS,
+};
+
+/** Supported Random Payload RTT precision. */
+enum bt_conn_le_cs_capability_rtt_random_payload {
+	/** Random Payload RTT variant is not supported. */
+	BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_NOT_SUPP = 0,
+	/** 10ns time-of-flight accuracy. */
+	BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_10NS,
+	/** 150ns time-of-flight accuracy. */
+	BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_150NS,
+};
+
+/** Remote channel sounding capabilities for LE connections supporting CS */
+struct bt_conn_le_cs_capabilities {
+	/** Number of CS configurations */
+	uint8_t num_config_supported;
+	/** Maximum number of consecutive CS procedures.
+	 *
+	 * When set to zero, indicates support for both fixed and indefinite
+	 * numbers of CS procedures before termination.
+	 */
+	uint16_t max_consecutive_procedures_supported;
+	/** Number of antennas. */
+	uint8_t num_antennas_supported;
+	/** Maximum number of antenna paths. */
+	uint8_t max_antenna_paths_supported;
+	/** Initiator role. */
+	bool initiator_supported;
+	/** Reflector role. */
+	bool reflector_supported;
+	/** Mode-3 */
+	bool mode_3_supported;
+	/** RTT AA-Only */
+	enum bt_conn_le_cs_capability_rtt_aa_only rtt_aa_only_precision;
+	/** RTT Sounding */
+	enum bt_conn_le_cs_capability_rtt_sounding rtt_sounding_precision;
+	/** RTT Random Payload */
+	enum bt_conn_le_cs_capability_rtt_random_payload rtt_random_payload_precision;
+	/** Number of CS steps needed to achieve the
+	 * accuracy requirements for RTT AA Only.
+	 *
+	 * Set to 0 if RTT AA Only isn't supported.
+	 */
+	uint8_t rtt_aa_only_n;
+	/** Number of CS steps needed to achieve the
+	 * accuracy requirements for RTT Sounding.
+	 *
+	 * Set to 0 if RTT Sounding isn't supported
+	 */
+	uint8_t rtt_sounding_n;
+	/** Number of CS steps needed to achieve the
+	 * accuracy requirements for RTT Random Payload.
+	 *
+	 * Set to 0 if RTT Random Payload isn't supported.
+	 */
+	uint8_t rtt_random_payload_n;
+	/** Phase-based normalized attack detector metric
+	 * when a CS_SYNC with sounding sequence is received.
+	 */
+	bool phase_based_nadm_sounding_supported;
+	/** Phase-based normalized attack detector metric
+	 * when a CS_SYNC with random sequence is received.
+	 */
+	bool phase_based_nadm_random_supported;
+	/** CS_SYNC LE 2M PHY. */
+	bool cs_sync_2m_phy_supported;
+	/** CS_SYNC LE 2M 2BT PHY. */
+	bool cs_sync_2m_2bt_phy_supported;
+	/** Subfeature: CS with no Frequency Actuation Error. */
+	bool cs_without_fae_supported;
+	/** Subfeature: Channel Selection Algorithm #3c */
+	bool chsel_alg_3c_supported;
+	/** Subfeature: Phase-based Ranging from RTT sounding sequence. */
+	bool pbr_from_rtt_sounding_seq_supported;
+	/** Optional T_IP1 time durations during CS steps.
+	 *
+	 *  - Bit 0: 10 us
+	 *  - Bit 1: 20 us
+	 *  - Bit 2: 30 us
+	 *  - Bit 3: 40 us
+	 *  - Bit 4: 50 us
+	 *  - Bit 5: 60 us
+	 *  - Bit 6: 80 us
+	 */
+	uint16_t t_ip1_times_supported;
+	/** Optional T_IP2 time durations during CS steps.
+	 *
+	 *  - Bit 0: 10 us
+	 *  - Bit 1: 20 us
+	 *  - Bit 2: 30 us
+	 *  - Bit 3: 40 us
+	 *  - Bit 4: 50 us
+	 *  - Bit 5: 60 us
+	 *  - Bit 6: 80 us
+	 */
+	uint16_t t_ip2_times_supported;
+	/** Optional T_FCS time durations during CS steps.
+	 *
+	 *  - Bit 0: 15 us
+	 *  - Bit 1: 20 us
+	 *  - Bit 2: 30 us
+	 *  - Bit 3: 40 us
+	 *  - Bit 4: 50 us
+	 *  - Bit 5: 60 us
+	 *  - Bit 6: 80 us
+	 *  - Bit 7: 100 us
+	 *  - Bit 8: 120 us
+	 */
+	uint16_t t_fcs_times_supported;
+	/** Optional T_PM time durations during CS steps.
+	 *
+	 *  - Bit 0: 10 us
+	 *  - Bit 1: 20 us
+	 */
+	uint16_t t_pm_times_supported;
+	/** Time in microseconds for the antenna switch period of the CS tones. */
+	uint8_t t_sw_time;
+	/** Supported SNR levels used in RTT packets.
+	 *
+	 *  - Bit 0: 18dB
+	 *  - Bit 1: 21dB
+	 *  - Bit 2: 24dB
+	 *  - Bit 3: 27dB
+	 *  - Bit 4: 30dB
+	 */
+	uint8_t tx_snr_capability;
+};
+
+/** Remote FAE Table for LE connections supporting CS */
+struct bt_conn_le_cs_fae_table {
+	uint8_t *remote_fae_table;
+};
+
 /** @brief Increment a connection's reference count.
  *
  *  Increment the reference count of a connection object.
@@ -1359,6 +1510,30 @@ struct bt_conn_cb {
 				const struct bt_conn_le_subrate_changed *params);
 #endif /* CONFIG_BT_SUBRATING */
 
+#if defined(CONFIG_BT_CHANNEL_SOUNDING)
+	/** @brief LE CS Read Remote Supported Capabilities Complete event.
+	 *
+	 *  This callback notifies the application that the remote channel
+	 *  sounding capabilities have been received from the peer.
+	 *
+	 *  @param conn Connection object.
+	 *  @param remote_cs_capabilities Remote Channel Sounding Capabilities.
+	 */
+	void (*remote_cs_capabilities_available)(struct bt_conn *conn,
+						 struct bt_conn_le_cs_capabilities *params);
+
+	/** @brief LE CS Read Remote FAE Table Complete event.
+	 *
+	 *  This callback notifies the application that the remote mode-0
+	 *  FAE Table has been received from the peer.
+	 *
+	 *  @param conn Connection object.
+	 *  @param params FAE Table.
+	 */
+	void (*remote_cs_fae_table_available)(struct bt_conn *conn,
+					      struct bt_conn_le_cs_fae_table *params);
+#endif
+
 	/** @internal Internally used field for list handling */
 	sys_snode_t _node;
 };
diff --git a/include/zephyr/bluetooth/cs.h b/include/zephyr/bluetooth/cs.h
index 903f32eccb0..17331290e32 100644
--- a/include/zephyr/bluetooth/cs.h
+++ b/include/zephyr/bluetooth/cs.h
@@ -60,6 +60,465 @@ struct bt_cs_set_default_settings_param {
 	int8_t max_tx_power;
 };
 
+/** CS Test Main Mode */
+enum bt_cs_test_main_mode {
+	/** CS Test Mode-1 */
+	BT_CS_TEST_MAIN_MODE_1 = BT_HCI_OP_LE_CS_MAIN_MODE_1,
+	/** CS Test Mode-2 */
+	BT_CS_TEST_MAIN_MODE_2 = BT_HCI_OP_LE_CS_MAIN_MODE_2,
+	/** CS Test Mode-3 */
+	BT_CS_TEST_MAIN_MODE_3 = BT_HCI_OP_LE_CS_MAIN_MODE_3,
+};
+
+/** CS Test Sub-Mode */
+enum bt_cs_test_sub_mode {
+	/** CS Test sub-mode-1 */
+	BT_CS_TEST_SUB_MODE_1 = BT_HCI_OP_LE_CS_SUB_MODE_1,
+	/** CS Test sub-mode-2 */
+	BT_CS_TEST_SUB_MODE_2 = BT_HCI_OP_LE_CS_SUB_MODE_2,
+	/** CS Test sub-mode-3 */
+	BT_CS_TEST_SUB_MODE_3 = BT_HCI_OP_LE_CS_SUB_MODE_3,
+	/** No CS Test sub-mode. */
+	BT_CS_TEST_SUB_MODE_UNUSED = BT_HCI_OP_LE_CS_SUB_MODE_UNUSED,
+};
+
+/** CS Test Role */
+enum bt_cs_test_role {
+	BT_CS_TEST_ROLE_INITIATOR = BT_HCI_OP_LE_CS_INITIATOR_ROLE,
+	BT_CS_TEST_ROLE_REFLECTOR = BT_HCI_OP_LE_CS_REFLECTOR_ROLE,
+};
+
+/** CS Test RTT type */
+enum bt_cs_test_rtt_type {
+	/** RTT AA Only */
+	BT_CS_TEST_RTT_AA_ONLY = BT_HCI_OP_LE_CS_RTT_TYPE_AA_ONLY,
+	/** RTT with 32-bit sounding sequence */
+	BT_CS_TEST_RTT_32_BIT_SOUNDING = BT_HCI_OP_LE_CS_RTT_TYPE_32BIT_SOUND,
+	/** RTT with 96-bit sounding sequence */
+	BT_CS_TEST_RTT_96_BIT_SOUNDING = BT_HCI_OP_LE_CS_RTT_TYPE_96BIT_SOUND,
+	/** RTT with 32-bit random sequence */
+	BT_CS_TEST_RTT_32_BIT_RANDOM = BT_HCI_OP_LE_CS_RTT_TYPE_32BIT_RAND,
+	/** RTT with 64-bit random sequence */
+	BT_CS_TEST_RTT_64_BIT_RANDOM = BT_HCI_OP_LE_CS_RTT_TYPE_64BIT_RAND,
+	/** RTT with 96-bit random sequence */
+	BT_CS_TEST_RTT_96_BIT_RANDOM = BT_HCI_OP_LE_CS_RTT_TYPE_96BIT_RAND,
+	/** RTT with 128-bit random sequence */
+	BT_CS_TEST_RTT_128_BIT_RANDOM = BT_HCI_OP_LE_CS_RTT_TYPE_128BIT_RAND,
+};
+
+/** CS Test CS_SYNC PHY */
+enum bt_cs_test_cs_sync_phy {
+	BT_CS_TEST_CS_SYNC_LE_1M_PHY = BT_HCI_OP_LE_CS_CS_SYNC_1M,
+	BT_CS_TEST_CS_SYNC_LE_2M_PHY = BT_HCI_OP_LE_CS_CS_SYNC_2M,
+	BT_CS_TEST_CS_SYNC_LE_2M_2BT_PHY = BT_HCI_OP_LE_CS_CS_SYNC_2M_2BT,
+};
+
+/** CS Test CS_SYNC Antenna Identifier */
+enum bt_cs_test_cs_sync_antenna_selection {
+	BT_CS_TEST_CS_SYNC_ANTENNA_SELECTION_ONE = BT_HCI_OP_LE_CS_ANTENNA_SEL_ONE,
+	BT_CS_TEST_CS_SYNC_ANTENNA_SELECTION_TWO = BT_HCI_OP_LE_CS_ANTENNA_SEL_TWO,
+	BT_CS_TEST_CS_SYNC_ANTENNA_SELECTION_THREE = BT_HCI_OP_LE_CS_ANTENNA_SEL_THREE,
+	BT_CS_TEST_CS_SYNC_ANTENNA_SELECTION_FOUR = BT_HCI_OP_LE_CS_ANTENNA_SEL_FOUR,
+};
+
+/** CS Test Tone Antennna Config Selection.
+ *
+ *  These enum values are indices in the following table, where N_AP is the maximum
+ *  number of antenna paths (in the range [1, 4]).
+ *
+ * +--------------+-------------+-------------------+-------------------+--------+
+ * | Config Index | Total Paths | Dev A: # Antennas | Dev B: # Antennas | Config |
+ * +--------------+-------------+-------------------+-------------------+--------+
+ * |            0 |           1 |                 1 |                 1 | 1:1    |
+ * |            1 |           2 |                 2 |                 1 | N_AP:1 |
+ * |            2 |           3 |                 3 |                 1 | N_AP:1 |
+ * |            3 |           4 |                 4 |                 1 | N_AP:1 |
+ * |            4 |           2 |                 1 |                 2 | 1:N_AP |
+ * |            5 |           3 |                 1 |                 3 | 1:N_AP |
+ * |            6 |           4 |                 1 |                 4 | 1:N_AP |
+ * |            7 |           4 |                 2 |                 2 | 2:2    |
+ * +--------------+-------------+-------------------+-------------------+--------+
+ *
+ *  There are therefore four groups of possible antenna configurations:
+ *
+ *  - 1:1 configuration, where both A and B support 1 antenna each
+ *  - 1:N_AP configuration, where A supports 1 antenna, B supports N_AP antennas, and
+ *    N_AP is a value in the range [2, 4]
+ *  - N_AP:1 configuration, where A supports N_AP antennas, B supports 1 antenna, and
+ *    N_AP is a value in the range [2, 4]
+ *  - 2:2 configuration, where both A and B support 2 antennas and N_AP = 4
+ */
+enum bt_cs_test_tone_antenna_config_selection {
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_ONE = BT_HCI_OP_LE_CS_TEST_ACI_0,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_TWO = BT_HCI_OP_LE_CS_TEST_ACI_1,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_THREE = BT_HCI_OP_LE_CS_TEST_ACI_2,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_FOUR = BT_HCI_OP_LE_CS_TEST_ACI_3,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_FIVE = BT_HCI_OP_LE_CS_TEST_ACI_4,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_SIX = BT_HCI_OP_LE_CS_TEST_ACI_5,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_SEVEN = BT_HCI_OP_LE_CS_TEST_ACI_6,
+	BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_EIGHT = BT_HCI_OP_LE_CS_TEST_ACI_7,
+};
+
+/** CS Test Initiator SNR control options */
+enum bt_cs_test_initiator_snr_control {
+	BT_CS_TEST_INITIATOR_SNR_CONTROL_18dB = BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_18,
+	BT_CS_TEST_INITIATOR_SNR_CONTROL_21dB = BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_21,
+	BT_CS_TEST_INITIATOR_SNR_CONTROL_24dB = BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_24,
+	BT_CS_TEST_INITIATOR_SNR_CONTROL_27dB = BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_27,
+	BT_CS_TEST_INITIATOR_SNR_CONTROL_30dB = BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_30,
+	BT_CS_TEST_INITIATOR_SNR_CONTROL_NOT_USED = BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_NOT_USED,
+};
+
+/** CS Test Reflector SNR control options */
+enum bt_cs_test_reflector_snr_control {
+	BT_CS_TEST_REFLECTOR_SNR_CONTROL_18dB = BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_18,
+	BT_CS_TEST_REFLECTOR_SNR_CONTROL_21dB = BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_21,
+	BT_CS_TEST_REFLECTOR_SNR_CONTROL_24dB = BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_24,
+	BT_CS_TEST_REFLECTOR_SNR_CONTROL_27dB = BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_27,
+	BT_CS_TEST_REFLECTOR_SNR_CONTROL_30dB = BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_30,
+	BT_CS_TEST_REFLECTOR_SNR_CONTROL_NOT_USED = BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_NOT_USED,
+};
+
+/** CS Test Override 0 channel selection algorithm selection */
+enum bt_cs_test_override_0_chsel_alg {
+	BT_CS_TEST_OVERRIDE_0_CHSEL_ALG_3B = BT_HCI_OP_LE_CS_TEST_CHSEL_TYPE_3B,
+	BT_CS_TEST_OVERRIDE_0_CHSEL_ALG_3C = BT_HCI_OP_LE_CS_TEST_CHSEL_TYPE_3C,
+};
+
+/** CS Test Override 0 chsel #3c shape */
+enum bt_cs_test_override_0_ch3c_shape {
+	BT_CS_TEST_OVERRIDE_0_CHSEL_ALG_3C_HAT_SHAPE = BT_HCI_OP_LE_CS_TEST_CH3C_SHAPE_HAT,
+	BT_CS_TEST_OVERRIDE_0_CHSEL_ALG_3C_X_SHAPE = BT_HCI_OP_LE_CS_TEST_CH3C_SHAPE_X,
+};
+
+/** CS Test Override 3 T_PM Tone Extension */
+enum bt_cs_test_override_3_pm_tone_ext {
+	/** Initiator and reflector tones sent without tone extension */
+	BT_CS_TEST_OVERRIDE_3_NO_TONE_EXT = BT_HCI_OP_LE_CS_TEST_TONE_EXT_NONE,
+	/** Initiator tone sent with extension, reflector tone sent without tone extension */
+	BT_CS_TEST_OVERRIDE_3_INITIATOR_TONE_EXT_ONLY = BT_HCI_OP_LE_CS_TEST_TONE_EXT_INIT,
+	/** Initiator tone sent without extension, reflector tone sent with tone extension */
+	BT_CS_TEST_OVERRIDE_3_REFLECTOR_TONE_EXT_ONLY = BT_HCI_OP_LE_CS_TEST_TONE_EXT_REFL,
+	/** Initiator and reflector tones sent with tone extension */
+	BT_CS_TEST_OVERRIDE_3_INITIATOR_AND_REFLECTOR_TONE_EXT = BT_HCI_OP_LE_CS_TEST_TONE_EXT_BOTH,
+	/** Applicable for mode-2 and mode-3 only:
+	 *
+	 *  Loop through:
+	 *   - @ref BT_CS_TEST_OVERRIDE_3_NO_TONE_EXT
+	 *   - @ref BT_CS_TEST_OVERRIDE_3_INITIATOR_TONE_EXT_ONLY
+	 *   - @ref BT_CS_TEST_OVERRIDE_3_REFLECTOR_TONE_EXT_ONLY
+	 *   - @ref BT_CS_TEST_OVERRIDE_3_INITIATOR_AND_REFLECTOR_TONE_EXT
+	 */
+	BT_CS_TEST_OVERRIDE_3_REPETITIVE_TONE_EXT = BT_HCI_OP_LE_CS_TEST_TONE_EXT_REPEAT,
+};
+
+/** CS Test Override 4 Tone Antenna Permutation.
+ *
+ *  These values represent indices in an antenna path permutation table.
+ *
+ *  Which table is applicable (and which indices are valid)
+ *  depends on the maximum number of antenna paths (N_AP).
+ *
+ *  If N_AP = 2, the permutation table is:
+ *
+ * +--------------------------------+------------------------------------------+
+ * | Antenna Path Permutation Index | Antenna Path Positions After Permutation |
+ * +--------------------------------+------------------------------------------+
+ * | 0                              | A1 A2                                    |
+ * | 1                              | A2 A1                                    |
+ * +--------------------------------+------------------------------------------+
+ *
+ * If N_AP = 3, the permutation table is:
+ *
+ * +--------------------------------+------------------------------------------+
+ * | Antenna Path Permutation Index | Antenna Path Positions After Permutation |
+ * +--------------------------------+------------------------------------------+
+ * | 0                              | A1 A2 A3                                 |
+ * | 1                              | A2 A1 A3                                 |
+ * | 2                              | A1 A3 A2                                 |
+ * | 3                              | A3 A1 A2                                 |
+ * | 4                              | A3 A2 A1                                 |
+ * | 5                              | A2 A3 A1                                 |
+ * +--------------------------------+------------------------------------------+
+ *
+ * If N_AP = 4, the permutation table is:
+ *
+ * +--------------------------------+------------------------------------------+
+ * | Antenna Path Permutation Index | Antenna Path Positions After Permutation |
+ * +--------------------------------+------------------------------------------+
+ * | 0                              | A1 A2 A3 A4                              |
+ * | 1                              | A2 A1 A3 A4                              |
+ * | 2                              | A1 A3 A2 A4                              |
+ * | 3                              | A3 A1 A2 A4                              |
+ * | 4                              | A3 A2 A1 A4                              |
+ * | 5                              | A2 A3 A1 A4                              |
+ * | 6                              | A1 A2 A4 A3                              |
+ * | 7                              | A2 A1 A4 A3                              |
+ * | 8                              | A1 A4 A2 A3                              |
+ * | 9                              | A4 A1 A2 A3                              |
+ * | 10                             | A4 A2 A1 A3                              |
+ * | 11                             | A2 A4 A1 A3                              |
+ * | 12                             | A1 A4 A3 A2                              |
+ * | 13                             | A4 A1 A3 A2                              |
+ * | 14                             | A1 A3 A4 A2                              |
+ * | 15                             | A3 A1 A4 A2                              |
+ * | 16                             | A3 A4 A1 A2                              |
+ * | 17                             | A4 A3 A1 A2                              |
+ * | 18                             | A4 A2 A3 A1                              |
+ * | 19                             | A2 A4 A3 A1                              |
+ * | 20                             | A4 A3 A2 A1                              |
+ * | 21                             | A3 A4 A2 A1                              |
+ * | 22                             | A3 A2 A4 A1                              |
+ * | 23                             | A2 A3 A4 A1                              |
+ * +--------------------------------+------------------------------------------+
+ */
+enum bt_cs_test_override_4_tone_antenna_permutation {
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_00 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_00,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_01 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_01,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_02 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_02,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_03 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_03,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_04 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_04,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_05 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_05,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_06 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_06,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_07 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_07,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_08 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_08,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_09 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_09,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_10 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_10,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_11 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_11,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_12 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_12,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_13 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_13,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_14 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_14,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_15 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_15,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_16 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_16,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_17 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_17,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_18 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_18,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_19 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_19,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_20 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_20,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_21 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_21,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_22 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_22,
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_23 = BT_HCI_OP_LE_CS_TEST_AP_INDEX_23,
+	/** Loop through all valid Antenna Permuation Indices starting
+	 *  from the lowest index.
+	 */
+	BT_CS_TEST_OVERRIDE_4_ANTENNA_PERMUTATION_INDEX_LOOP = BT_HCI_OP_LE_CS_TEST_AP_INDEX_LOOP,
+};
+
+/** CS Test Override 7 Sounding Sequence Marker Value */
+enum bt_cs_test_override_7_ss_marker_value {
+	BT_CS_TEST_OVERRIDE_7_SS_MARKER_VAL_0011 = BT_HCI_OP_LE_CS_TEST_SS_MARKER_VAL_0011,
+	BT_CS_TEST_OVERRIDE_7_SS_MARKER_VAL_1100 = BT_HCI_OP_LE_CS_TEST_SS_MARKER_VAL_1100,
+	/** Loop through pattern '0011' and '1100' (in transmission order) */
+	BT_CS_TEST_OVERRIDE_7_SS_MARKER_VAL_LOOP = BT_HCI_OP_LE_CS_TEST_SS_MARKER_VAL_LOOP,
+};
+
+/** CS Test Override 8 CS_SYNC Payload Pattern */
+enum bt_cs_test_override_8_cs_sync_payload_pattern {
+	/** PRBS9 payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_PRBS9 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_PRBS9,
+	/** Repeated '11110000' payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_11110000 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_11110000,
+	/** Repeated '10101010' payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_10101010 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_10101010,
+	/** PRBS15 payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_PRBS15 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_PRBS15,
+	/** Repeated '11111111' payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_11111111 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_11111111,
+	/** Repeated '00000000' payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_00000000 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_00000000,
+	/** Repeated '00001111' payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_00001111 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_00001111,
+	/** Repeated '01010101' payload sequence. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_01010101 = BT_HCI_OP_LE_CS_TEST_PAYLOAD_01010101,
+	/** Custom payload provided by the user. */
+	BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_USER = BT_HCI_OP_LE_CS_TEST_PAYLOAD_USER,
+};
+
+/** CS Test parameters */
+struct bt_cs_test_param {
+	/** CS mode to be used during the CS procedure. */
+	enum bt_cs_test_main_mode main_mode;
+	/** CS sub-mode to be used during the CS procedure. */
+	enum bt_cs_test_sub_mode sub_mode;
+	/** Number of main mode steps taken from the end of the last CS subevent
+	 * to be repeated at the beginning of the current CS subevent directly
+	 * after the last mode-0 step of that event.
+	 */
+	uint8_t main_mode_repetition;
+	/** Number of CS mode-0 steps at the beginning of the test CS subevent. */
+	uint8_t mode_0_steps;
+	/** CS Test role */
+	enum bt_cs_test_role role;
+	/** RTT variant */
+	enum bt_cs_test_rtt_type rtt_type;
+	/** CS_SYNC PHY */
+	enum bt_cs_test_cs_sync_phy cs_sync_phy;
+	/** Antenna identifier to be used for CS_SYNC packets. */
+	enum bt_cs_test_cs_sync_antenna_selection cs_sync_antenna_selection;
+	/** CS subevent length in microseconds.
+	 *
+	 *  Range: 1250us to 4s
+	 */
+	uint32_t subevent_len;
+	/** Gap between the start of two consecutive CS subevents (N * 0.625 ms)
+	 *
+	 *  A value of 0 means that there is only one CS subevent.
+	 */
+	uint16_t subevent_interval;
+	/** Maximum allowed number of subevents in the procedure.
+	 *
+	 *  A value of 0 means that this parameter is ignored.
+	 */
+	uint8_t max_num_subevents;
+	/** Desired TX power level for the CS procedure.
+	 *
+	 *  Value range is @ref BT_HCI_OP_LE_CS_MIN_MAX_TX_POWER to
+	 *  @ref BT_HCI_OP_LE_CS_MAX_MAX_TX_POWER.
+	 *
+	 *  Special values:
+	 *    - @ref BT_HCI_OP_LE_CS_TEST_MAXIMIZE_TX_POWER tells the controller
+	 *      it should use as high a transmit power as possible
+	 *    - @ref BT_HCI_OP_LE_CS_TEST_MINIMIZE_TX_POWER tells the controller
+	 *      it should use as low a transmit power as possible
+	 */
+	uint8_t transmit_power_level;
+	/** Interlude time in microseconds between the RTT packets. */
+	uint8_t t_ip1_time;
+	/** Interlude time in microseconds between the CS tones. */
+	uint8_t t_ip2_time;
+	/** Time in microseconds for frequency changes. */
+	uint8_t t_fcs_time;
+	/** Time in microseconds for the phase measurement period of the CS tones. */
+	uint8_t t_pm_time;
+	/** Time in microseconds for the antenna switch period of the CS tones. */
+	uint8_t t_sw_time;
+	/** Antenna Configuration Index used during antenna switching during
+	 *  the tone phases of CS steps.
+	 */
+	enum bt_cs_test_tone_antenna_config_selection tone_antenna_config_selection;
+	/** Initiator SNR control options */
+	enum bt_cs_test_initiator_snr_control initiator_snr_control;
+	/** Reflector SNR control options */
+	enum bt_cs_test_reflector_snr_control reflector_snr_control;
+	/** Determines octets 14 and 15 of the initial value of the DRBG nonce. */
+	uint16_t drbg_nonce;
+
+	/** Override configuration.
+	 *
+	 *  This parameter is used to override CS parameters from the DRBG.
+	 *  Each bit configures a different set of parameters.
+	 *
+	 *  All overrides are optional, except for those configured by bit 0.
+	 *
+	 *  These are:
+	 *    - Bit 0 set: Override using list of channels
+	 *    - Bit 0 not set: Override using channel map
+	 *    - Bit 2 set: Override main mode steps
+	 *    - Bit 3 set: Override T_PM_Tone_Ext
+	 *    - Bit 4 set: Override tone antenna permutation
+	 *    - Bit 5 set: Override CS_SYNC AA
+	 *    - Bit 6 set: Override SS marker positions
+	 *    - Bit 7 set: Override SS marker value
+	 *    - Bit 8 set: Override CS_SYNC payload pattern and user payload
+	 *    - Bit 10 set: Procedure is replaced with a stable phase test
+	 */
+	uint16_t override_config;
+
+	/** override config bit 0. */
+	struct {
+		/** Number of times the channels indicated by the channel map or channel field
+		 *  are cycled through for non-mode-0 steps within a CS procedure.
+		 */
+		uint8_t channel_map_repetition;
+		union {
+			struct {
+				uint8_t num_channels;
+				uint8_t *channels;
+			} set;
+			struct {
+				uint8_t channel_map[10];
+				enum bt_cs_test_override_0_chsel_alg channel_selection_type;
+				enum bt_cs_test_override_0_ch3c_shape ch3c_shape;
+				uint8_t ch3c_jump;
+			} not_set;
+		};
+	} override_config_0;
+
+	/** Override config bit 2. These parameters are ignored if the bit is not set. */
+	struct {
+		uint8_t main_mode_steps;
+	} override_config_2;
+
+	/** Override config bit 3. These parameters are ignored if the bit is not set.  */
+	struct {
+		enum bt_cs_test_override_3_pm_tone_ext t_pm_tone_ext;
+	} override_config_3;
+
+	/** Override config bit 4. These parameters are ignored if the bit is not set. */
+	struct {
+		enum bt_cs_test_override_4_tone_antenna_permutation tone_antenna_permutation;
+	} override_config_4;
+
+	/** Override config bit 5. These parameters are ignored if the bit is not set.  */
+	struct {
+		/** Access Address used in CS_SYNC packets sent by the initiator. */
+		uint32_t cs_sync_aa_initiator;
+		/** Access Address used in CS_SYNC packets sent by the reflector. */
+		uint32_t cs_sync_aa_reflector;
+	} override_config_5;
+
+	/** Override config bit 6. These parameters are ignored if the bit is not set. */
+	struct {
+		/** Bit number where the first marker in the channel sounding sequence starts.
+		 *
+		 *  Must be between 0 and 28 when using @ref BT_CS_TEST_RTT_32_BIT_SOUNDING.
+		 */
+		uint8_t ss_marker1_position;
+		/** Bit number where the second marker in the channel sounding sequence starts.
+		 *
+		 *  Must be between 67 and 92 when using @ref BT_CS_TEST_RTT_96_BIT_SOUNDING.
+		 *
+		 *  A value of @ref BT_HCI_OP_LE_CS_TEST_SS_MARKER_2_POSITION_NOT_PRESENT
+		 *  indicates that this sounding sequence or marker is not present.
+		 */
+		uint8_t ss_marker2_position;
+	} override_config_6;
+
+	/** Override config bit 7. These parameters are ignored if the bit is not set. */
+	struct {
+		/** Value of the Sounding Sequence marker. */
+		enum bt_cs_test_override_7_ss_marker_value ss_marker_value;
+	} override_config_7;
+
+	/** Override config bit 8. These parameters are ignored if the bit is not set.  */
+	struct {
+		/** CS_SYNC payload pattern selection. */
+		enum bt_cs_test_override_8_cs_sync_payload_pattern cs_sync_payload_pattern;
+		/** User payload for CS_SYNC packets.
+		 *
+		 *  This parameter is only used when using
+		 *  @ref BT_CS_TEST_OVERRIDE_8_PAYLOAD_PATTERN_USER
+		 *
+		 *  The least significant bit corresponds to the most significant bit
+		 *  of the CS payload. When the sequence is less than 16 octets,
+		 *  the least significant octets shall be padded with zeros.
+		 */
+		uint8_t cs_sync_user_payload[16];
+	} override_config_8;
+};
+
+/** @brief Read Remote Supported Capabilities
+ *
+ * This command is used to query the CS capabilities that are supported
+ * by the remote controller.
+ *
+ * @note To use this API @kconfig{CONFIG_BT_CHANNEL_SOUNDING} must be set.
+ *
+ * @param conn   Connection Object.
+ *
+ * @return Zero on success or (negative) error code on failure.
+ */
+int bt_cs_read_remote_supported_capabilities(struct bt_conn *conn);
+
 /** @brief Set Channel Sounding default settings.
  *
  * This command is used to set default Channel Sounding settings for this
@@ -75,6 +534,41 @@ struct bt_cs_set_default_settings_param {
 int bt_cs_set_default_settings(struct bt_conn *conn,
 			       const struct bt_cs_set_default_settings_param *params);
 
+/** @brief Read Remote FAE Table
+ *
+ * This command is used to read the per-channel mode-0 Frequency Actuation Error
+ * table of the remote Controller.
+ *
+ * @note To use this API @kconfig{CONFIG_BT_CHANNEL_SOUNDING} must be set.
+ *
+ * @param conn   Connection Object.
+ *
+ * @return Zero on success or (negative) error code on failure.
+ */
+int bt_cs_read_remote_fae_table(struct bt_conn *conn);
+
+/** @brief Start a CS test
+ *
+ * This command is used to start a CS test where the IUT is placed in the role
+ * of either the initiator or reflector.
+ *
+ * The first mode-0 channel in the list is used as the starting channel for
+ * the test. At the beginning of any test, the IUT in the flector role shall
+ * listen on the first mode-0 channel until it receives the first transmission
+ * from the initiator. Similarly, with the IUT in the initiator role, the tester
+ * will start by listening on the first mode-0 channel and the IUT shall transmit
+ * on that channel for the first half of the first CS step. Thereafter, the
+ * parameters of this command describe the required transmit and receive behavior
+ * for the CS test.
+ *
+ * @note To use this API @kconfig{CONFIG_BT_CHANNEL_SOUNDING} must be set.
+ *
+ * @param params CS Test parameters
+ *
+ * @return Zero on success or (negative) error code on failure.
+ */
+int bt_cs_start_test(const struct bt_cs_test_param *params);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/zephyr/bluetooth/hci_types.h b/include/zephyr/bluetooth/hci_types.h
index afdb03f0ce9..31b30bbcf96 100644
--- a/include/zephyr/bluetooth/hci_types.h
+++ b/include/zephyr/bluetooth/hci_types.h
@@ -201,6 +201,9 @@ struct bt_hci_cmd_hdr {
 #define BT_LE_FEAT_BIT_PAWR_ADVERTISER          43
 #define BT_LE_FEAT_BIT_PAWR_SCANNER             44
 
+#define BT_LE_FEAT_BIT_CHANNEL_SOUNDING         46
+#define BT_LE_FEAT_BIT_CHANNEL_SOUNDING_HOST    47
+
 #define BT_LE_FEAT_TEST(feat, n)                (feat[(n) >> 3] & \
 						 BIT((n) & 7))
 
@@ -268,6 +271,10 @@ struct bt_hci_cmd_hdr {
 						  BT_LE_FEAT_BIT_PAWR_ADVERTISER)
 #define BT_FEAT_LE_PAWR_SCANNER(feat)             BT_LE_FEAT_TEST(feat, \
 						  BT_LE_FEAT_BIT_PAWR_SCANNER)
+#define BT_FEAT_LE_CHANNEL_SOUNDING(feat)         BT_LE_FEAT_TEST(feat, \
+						  BT_LE_FEAT_BIT_CHANNEL_SOUNDING)
+#define BT_FEAT_LE_CHANNEL_SOUNDING_HOST(feat)    BT_LE_FEAT_TEST(feat, \
+						  BT_LE_FEAT_BIT_CHANNEL_SOUNDING_HOST)
 
 #define BT_FEAT_LE_CIS(feat)            (BT_FEAT_LE_CIS_CENTRAL(feat) | \
 					BT_FEAT_LE_CIS_PERIPHERAL(feat))
@@ -2395,6 +2402,12 @@ struct bt_hci_cp_le_tx_test_v4_tx_power {
 	int8_t tx_power;
 } __packed;
 
+#define BT_HCI_OP_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES BT_OP(BT_OGF_LE, 0x008A) /* 0x208A */
+
+struct bt_hci_cp_le_read_remote_supported_capabilities {
+	uint16_t handle;
+} __packed;
+
 #define BT_HCI_OP_LE_CS_SET_DEFAULT_SETTINGS BT_OP(BT_OGF_LE, 0x008D) /* 0x208D */
 
 #define BT_HCI_OP_LE_CS_INITIATOR_ROLE_MASK BIT(0)
@@ -2417,6 +2430,158 @@ struct bt_hci_cp_le_cs_set_default_settings {
 	int8_t max_tx_power;
 } __packed;
 
+#define BT_HCI_OP_LE_CS_READ_REMOTE_FAE_TABLE BT_OP(BT_OGF_LE, 0x008E) /* 0x208E */
+
+struct bt_hci_cp_le_read_remote_fae_table {
+	uint16_t handle;
+} __packed;
+
+
+#define BT_HCI_OP_LE_CS_TEST BT_OP(BT_OGF_LE, 0x0095) /* 0x2095 */
+
+#define BT_HCI_OP_LE_CS_MAIN_MODE_1 0x1
+#define BT_HCI_OP_LE_CS_MAIN_MODE_2 0x2
+#define BT_HCI_OP_LE_CS_MAIN_MODE_3 0x3
+
+#define BT_HCI_OP_LE_CS_SUB_MODE_1 0x1
+#define BT_HCI_OP_LE_CS_SUB_MODE_2 0x2
+#define BT_HCI_OP_LE_CS_SUB_MODE_3 0x3
+#define BT_HCI_OP_LE_CS_SUB_MODE_UNUSED 0xFF
+
+#define BT_HCI_OP_LE_CS_INITIATOR_ROLE 0x0
+#define BT_HCI_OP_LE_CS_REFLECTOR_ROLE 0x1
+
+#define BT_HCI_OP_LE_CS_RTT_TYPE_AA_ONLY     0x0
+#define BT_HCI_OP_LE_CS_RTT_TYPE_32BIT_SOUND 0x1
+#define BT_HCI_OP_LE_CS_RTT_TYPE_96BIT_SOUND 0x2
+#define BT_HCI_OP_LE_CS_RTT_TYPE_32BIT_RAND  0x3
+#define BT_HCI_OP_LE_CS_RTT_TYPE_64BIT_RAND  0x4
+#define BT_HCI_OP_LE_CS_RTT_TYPE_96BIT_RAND  0x5
+#define BT_HCI_OP_LE_CS_RTT_TYPE_128BIT_RAND 0x6
+
+#define BT_HCI_OP_LE_CS_CS_SYNC_1M     0x1
+#define BT_HCI_OP_LE_CS_CS_SYNC_2M     0x2
+#define BT_HCI_OP_LE_CS_CS_SYNC_2M_2BT 0x3
+
+#define BT_HCI_OP_LE_CS_TEST_MAXIMIZE_TX_POWER 0x7E
+#define BT_HCI_OP_LE_CS_TEST_MINIMIZE_TX_POWER 0x7F
+
+#define BT_HCI_OP_LE_CS_TEST_ACI_0 0x0
+#define BT_HCI_OP_LE_CS_TEST_ACI_1 0x1
+#define BT_HCI_OP_LE_CS_TEST_ACI_2 0x2
+#define BT_HCI_OP_LE_CS_TEST_ACI_3 0x3
+#define BT_HCI_OP_LE_CS_TEST_ACI_4 0x4
+#define BT_HCI_OP_LE_CS_TEST_ACI_5 0x5
+#define BT_HCI_OP_LE_CS_TEST_ACI_6 0x6
+#define BT_HCI_OP_LE_CS_TEST_ACI_7 0x7
+
+#define BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_18 0x0
+#define BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_21 0x1
+#define BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_24 0x2
+#define BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_27 0x3
+#define BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_30 0x4
+#define BT_HCI_OP_LE_CS_TEST_INITIATOR_SNR_NOT_USED 0xFF
+
+#define BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_18 0x0
+#define BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_21 0x1
+#define BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_24 0x2
+#define BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_27 0x3
+#define BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_30 0x4
+#define BT_HCI_OP_LE_CS_TEST_REFLECTOR_SNR_NOT_USED 0xFF
+
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_0_MASK BIT(0)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_2_MASK BIT(2)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_3_MASK BIT(3)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_4_MASK BIT(4)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_5_MASK BIT(5)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_6_MASK BIT(6)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_7_MASK BIT(7)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_8_MASK BIT(8)
+#define BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_10_MASK BIT(10)
+
+#define BT_HCI_OP_LE_CS_TEST_CHSEL_TYPE_3B 0x0
+#define BT_HCI_OP_LE_CS_TEST_CHSEL_TYPE_3C 0x1
+
+#define BT_HCI_OP_LE_CS_TEST_CH3C_SHAPE_HAT 0x0
+#define BT_HCI_OP_LE_CS_TEST_CH3C_SHAPE_X   0x1
+
+#define BT_HCI_OP_LE_CS_TEST_TONE_EXT_NONE 0x0
+#define BT_HCI_OP_LE_CS_TEST_TONE_EXT_INIT 0x1
+#define BT_HCI_OP_LE_CS_TEST_TONE_EXT_REFL 0x2
+#define BT_HCI_OP_LE_CS_TEST_TONE_EXT_BOTH 0x3
+#define BT_HCI_OP_LE_CS_TEST_TONE_EXT_REPEAT 0x4
+
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_00 0x0
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_01 0x1
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_02 0x2
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_03 0x3
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_04 0x4
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_05 0x5
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_06 0x6
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_07 0x7
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_08 0x8
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_09 0x9
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_10 0xA
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_11 0xB
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_12 0xC
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_13 0xD
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_14 0xE
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_15 0xF
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_16 0x10
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_17 0x11
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_18 0x12
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_19 0x13
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_20 0x14
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_21 0x15
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_22 0x16
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_23 0x17
+#define BT_HCI_OP_LE_CS_TEST_AP_INDEX_LOOP 0xFF
+
+#define BT_HCI_OP_LE_CS_TEST_SS_MARKER_2_POSITION_NOT_PRESENT 0xFF
+
+#define BT_HCI_OP_LE_CS_TEST_SS_MARKER_VAL_0011 0x0
+#define BT_HCI_OP_LE_CS_TEST_SS_MARKER_VAL_1100 0x1
+#define BT_HCI_OP_LE_CS_TEST_SS_MARKER_VAL_LOOP 0x2
+
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_PRBS9    0x00
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_11110000 0x01
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_10101010 0x02
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_PRBS15   0x03
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_11111111 0x04
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_00000000 0x05
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_00001111 0x06
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_01010101 0x07
+#define BT_HCI_OP_LE_CS_TEST_PAYLOAD_USER     0x80
+
+struct bt_hci_op_le_cs_test {
+	uint8_t main_mode_type;
+	uint8_t sub_mode_type;
+	uint8_t main_mode_repetition;
+	uint8_t mode_0_steps;
+	uint8_t role;
+	uint8_t rtt_type;
+	uint8_t cs_sync_phy;
+	uint8_t cs_sync_antenna_selection;
+	uint8_t subevent_len[3];
+	uint16_t subevent_interval;
+	uint8_t max_num_subevents;
+	uint8_t transmit_power_level;
+	uint8_t t_ip1_time;
+	uint8_t t_ip2_time;
+	uint8_t t_fcs_time;
+	uint8_t t_pm_time;
+	uint8_t t_sw_time;
+	uint8_t tone_antenna_config_selection;
+	uint8_t reserved;
+	uint8_t snr_control_initiator;
+	uint8_t snr_control_reflector;
+	uint16_t drbg_nonce;
+	uint8_t channel_map_repetition;
+	uint16_t override_config;
+	uint8_t override_parameters_length;
+	uint8_t override_parameters_data[];
+} __packed;
+
 /* Event definitions */
 
 #define BT_HCI_EVT_UNKNOWN                      0x00
@@ -3151,6 +3316,93 @@ struct bt_hci_evt_le_subrate_change {
 	uint16_t supervision_timeout;
 } __packed;
 
+#define BT_HCI_LE_CS_INITIATOR_ROLE_MASK BIT(0)
+#define BT_HCI_LE_CS_REFLECTOR_ROLE_MASK BIT(1)
+
+#define BT_HCI_LE_CS_MODES_SUPPORTED_MODE_3_MASK BIT(0)
+
+#define BT_HCI_LE_CS_RTT_AA_ONLY_N_10NS_MASK        BIT(0)
+#define BT_HCI_LE_CS_RTT_SOUNDING_N_10NS_MASK       BIT(1)
+#define BT_HCI_LE_CS_RTT_RANDOM_PAYLOAD_N_10NS_MASK BIT(2)
+
+#define BT_HCI_LE_CS_NADM_SOUNDING_CAPABILITY_PHASE_BASED_MASK BIT(0)
+#define BT_HCI_LE_CS_NADM_RANDOM_CAPABILITY_PHASE_BASED_MASK BIT(0)
+
+#define BT_HCI_LE_CS_SYNC_PHYS_2M_MASK BIT(1)
+#define BT_HCI_LE_CS_SYNC_PHYS_2M_2BT_MASK BIT(2)
+
+#define BT_HCI_LE_CS_SUBFEATURE_NO_TX_FAE_MASK BIT(1)
+#define BT_HCI_LE_CS_SUBFEATURE_CHSEL_ALG_3C_MASK BIT(2)
+#define BT_HCI_LE_CS_SUBFEATURE_PBR_FROM_RTT_SOUNDING_SEQ_MASK BIT(3)
+
+#define BT_HCI_LE_CS_T_IP1_TIME_10US_MASK BIT(0)
+#define BT_HCI_LE_CS_T_IP1_TIME_20US_MASK BIT(1)
+#define BT_HCI_LE_CS_T_IP1_TIME_30US_MASK BIT(2)
+#define BT_HCI_LE_CS_T_IP1_TIME_40US_MASK BIT(3)
+#define BT_HCI_LE_CS_T_IP1_TIME_50US_MASK BIT(4)
+#define BT_HCI_LE_CS_T_IP1_TIME_60US_MASK BIT(5)
+#define BT_HCI_LE_CS_T_IP1_TIME_80US_MASK BIT(6)
+
+#define BT_HCI_LE_CS_T_IP2_TIME_10US_MASK BIT(0)
+#define BT_HCI_LE_CS_T_IP2_TIME_20US_MASK BIT(1)
+#define BT_HCI_LE_CS_T_IP2_TIME_30US_MASK BIT(2)
+#define BT_HCI_LE_CS_T_IP2_TIME_40US_MASK BIT(3)
+#define BT_HCI_LE_CS_T_IP2_TIME_50US_MASK BIT(4)
+#define BT_HCI_LE_CS_T_IP2_TIME_60US_MASK BIT(5)
+#define BT_HCI_LE_CS_T_IP2_TIME_80US_MASK BIT(6)
+
+#define BT_HCI_LE_CS_T_FCS_TIME_15US_MASK   BIT(0)
+#define BT_HCI_LE_CS_T_FCS_TIME_20US_MASK   BIT(1)
+#define BT_HCI_LE_CS_T_FCS_TIME_30US_MASK   BIT(2)
+#define BT_HCI_LE_CS_T_FCS_TIME_40US_MASK   BIT(3)
+#define BT_HCI_LE_CS_T_FCS_TIME_50US_MASK   BIT(4)
+#define BT_HCI_LE_CS_T_FCS_TIME_60US_MASK   BIT(5)
+#define BT_HCI_LE_CS_T_FCS_TIME_80US_MASK   BIT(6)
+#define BT_HCI_LE_CS_T_FCS_TIME_100US_MASK  BIT(7)
+#define BT_HCI_LE_CS_T_FCS_TIME_1200US_MASK BIT(8)
+
+#define BT_HCI_LE_CS_T_PM_TIME_10US_MASK BIT(0)
+#define BT_HCI_LE_CS_T_PM_TIME_20US_MASK BIT(1)
+
+#define BT_HCI_LE_CS_TX_SNR_CAPABILITY_18DB_MASK BIT(0)
+#define BT_HCI_LE_CS_TX_SNR_CAPABILITY_21DB_MASK BIT(1)
+#define BT_HCI_LE_CS_TX_SNR_CAPABILITY_24DB_MASK BIT(2)
+#define BT_HCI_LE_CS_TX_SNR_CAPABILITY_27DB_MASK BIT(3)
+#define BT_HCI_LE_CS_TX_SNR_CAPABILITY_30DB_MASK BIT(4)
+
+#define BT_HCI_EVT_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES_COMPLETE 0x2C
+struct bt_hci_evt_le_cs_read_remote_supported_capabilities_complete {
+	uint8_t status;
+	uint16_t conn_handle;
+	uint8_t num_config_supported;
+	uint16_t max_consecutive_procedures_supported;
+	uint8_t num_antennas_supported;
+	uint8_t max_antenna_paths_supported;
+	uint8_t roles_supported;
+	uint8_t modes_supported;
+	uint8_t rtt_capability;
+	uint8_t rtt_aa_only_n;
+	uint8_t rtt_sounding_n;
+	uint8_t rtt_random_payload_n;
+	uint16_t nadm_sounding_capability;
+	uint16_t nadm_random_capability;
+	uint8_t cs_sync_phys_supported;
+	uint16_t subfeatures_supported;
+	uint16_t t_ip1_times_supported;
+	uint16_t t_ip2_times_supported;
+	uint16_t t_fcs_times_supported;
+	uint16_t t_pm_times_supported;
+	uint8_t t_sw_time_supported;
+	uint8_t tx_snr_capability;
+} __packed;
+
+#define BT_HCI_EVT_LE_CS_READ_REMOTE_FAE_TABLE_COMPLETE 0x2D
+struct bt_hci_evt_le_cs_read_remote_fae_table_complete {
+	uint8_t status;
+	uint16_t conn_handle;
+	uint8_t remote_fae_table[72];
+} __packed;
+
 /* Event mask bits */
 
 #define BT_EVT_BIT(n) (1ULL << (n))
@@ -3240,6 +3492,9 @@ struct bt_hci_evt_le_subrate_change {
 #define BT_EVT_MASK_LE_PER_ADV_RESPONSE_REPORT     BT_EVT_BIT(39)
 #define BT_EVT_MASK_LE_ENH_CONN_COMPLETE_V2        BT_EVT_BIT(40)
 
+#define BT_EVT_MASK_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES_COMPLETE BT_EVT_BIT(43)
+#define BT_EVT_MASK_LE_CS_READ_REMOTE_FAE_TABLE_COMPLETE              BT_EVT_BIT(44)
+
 /** HCI Error Codes, BT Core Spec v5.4 [Vol 1, Part F]. */
 #define BT_HCI_ERR_SUCCESS                      0x00
 #define BT_HCI_ERR_UNKNOWN_CMD                  0x01
diff --git a/include/zephyr/net/mqtt.h b/include/zephyr/net/mqtt.h
index 2514fc709c2..9c09069b107 100644
--- a/include/zephyr/net/mqtt.h
+++ b/include/zephyr/net/mqtt.h
@@ -372,6 +372,9 @@ struct mqtt_sec_config {
 	uint32_t alpn_protocol_name_count;
 #endif
 
+	/** Indicates the preference for enabling TLS session caching. */
+	int session_cache;
+
 	/** Peer hostname for ceritificate verification.
 	 *  May be NULL to skip hostname verification.
 	 */
@@ -379,6 +382,9 @@ struct mqtt_sec_config {
 
 	/** Indicates the preference for copying certificates to the heap. */
 	int cert_nocopy;
+
+	/** Set socket to native TLS */
+	bool set_native_tls;
 };
 
 /** @brief MQTT transport type. */
diff --git a/include/zephyr/net/socket.h b/include/zephyr/net/socket.h
index d62b12719ab..34211d83759 100644
--- a/include/zephyr/net/socket.h
+++ b/include/zephyr/net/socket.h
@@ -34,6 +34,7 @@
 #include <zephyr/sys/iterable_sections.h>
 #include <zephyr/sys/fdtable.h>
 #include <zephyr/net/dns_resolve.h>
+#include <zephyr/net/socket_ncs.h>
 #include <stdlib.h>
 
 #ifdef __cplusplus
diff --git a/include/zephyr/net/socket_ncs.h b/include/zephyr/net/socket_ncs.h
new file mode 100644
index 00000000000..db3e0649c9f
--- /dev/null
+++ b/include/zephyr/net/socket_ncs.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2021 Nordic Semiconductor
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef ZEPHYR_INCLUDE_NET_SOCKET_NCS_H_
+#define ZEPHYR_INCLUDE_NET_SOCKET_NCS_H_
+
+/**
+ * @file
+ * @brief NCS specific additions to the BSD sockets API definitions
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* When CONFIG_NET_SOCKETS_OFFLOAD is enabled, offloaded sockets take precedence
+ * when creating a new socket. Combine this flag with a socket type when
+ * creating a socket, to enforce native socket creation (e. g. SOCK_STREAM | SOCK_NATIVE).
+ * If it's desired to create a native TLS socket, but still offload the
+ * underlying TCP/UDP socket, use e. g. SOCK_STREAM | SOCK_NATIVE_TLS.
+ */
+#define SOCK_NATIVE 0x80000000
+#define SOCK_NATIVE_TLS 0x40000000
+
+/* NCS specific TLS level socket options */
+
+/** Socket option to set DTLS handshake timeout, specifically for nRF sockets.
+ *  The option accepts an integer, indicating the total handshake timeout,
+ *  including retransmissions, in seconds.
+ *  Accepted values for the option are: 1, 3, 7, 15, 31, 63, 123.
+ */
+#define TLS_DTLS_HANDSHAKE_TIMEO 18
+
+/** Socket option to save DTLS connection, specifically for nRF sockets.
+ */
+#define TLS_DTLS_CONN_SAVE 19
+
+/** Socket option to load DTLS connection, specifically for nRF sockets.
+ */
+#define TLS_DTLS_CONN_LOAD 20
+
+/** Socket option to get result of latest TLS/DTLS completed handshakes end status,
+ *  specifically for nRF sockets.
+ *  The option accepts an integer, indicating the setting.
+ *  Accepted vaules for the option are: 0 and 1.
+ */
+#define TLS_DTLS_HANDSHAKE_STATUS 21
+
+/* Valid values for TLS_SESSION_CACHE option */
+#define TLS_SESSION_CACHE_DISABLED 0 /**< Disable TLS session caching. */
+#define TLS_SESSION_CACHE_ENABLED 1 /**< Enable TLS session caching. */
+
+/* Valid values for TLS_DTLS_HANDSHAKE_TIMEO option */
+#define TLS_DTLS_HANDSHAKE_TIMEO_NONE 0 /**< No timeout */
+#define TLS_DTLS_HANDSHAKE_TIMEO_1S 1 /**< 1 second */
+#define TLS_DTLS_HANDSHAKE_TIMEO_3S 3 /**< 1s + 2s */
+#define TLS_DTLS_HANDSHAKE_TIMEO_7S 7 /**< 1s + 2s + 4s */
+#define TLS_DTLS_HANDSHAKE_TIMEO_15S 15 /**< 1s + 2s + 4s + 8s */
+#define TLS_DTLS_HANDSHAKE_TIMEO_31S 31 /**< 1s + 2s + 4s + 8s + 16s */
+#define TLS_DTLS_HANDSHAKE_TIMEO_63S 63 /**< 1s + 2s + 4s + 8s + 16s + 32s */
+#define TLS_DTLS_HANDSHAKE_TIMEO_123S 123 /**< 1s + 2s + 4s + 8s + 16s + 32s + 60s */
+
+/* Valid values for TLS_DTLS_HANDSHAKE_STATUS option */
+#define TLS_DTLS_HANDSHAKE_STATUS_FULL		0
+#define TLS_DTLS_HANDSHAKE_STATUS_CACHED	1
+
+/* NCS specific socket options */
+
+/** sockopt: enable sending data as part of exceptional events */
+#define SO_EXCEPTIONAL_DATA 33
+/** sockopt: Keep socket open when its PDN connection is lost
+ *           or the device is put into flight mode.
+ */
+#define SO_KEEPOPEN 34
+/** sockopt: bind to PDN */
+#define SO_BINDTOPDN 40
+
+/** sockopt: Release assistance indication (RAI).
+ *  The option accepts an integer, indicating the type of RAI.
+ *  Accepted values for the option are: @ref RAI_NO_DATA, @ref RAI_LAST, @ref RAI_ONE_RESP,
+ *  @ref RAI_ONGOING, @ref RAI_WAIT_MORE.
+ */
+#define SO_RAI 61
+
+/** Release assistance indication (RAI).
+ *  Indicate that the application does not intend to send more data.
+ *  This applies immediately and lets the modem exit connected mode more
+ *  quickly.
+ *
+ *  @note This requires the socket to be connected.
+ */
+#define RAI_NO_DATA 1
+/** Release assistance indication (RAI).
+ *  Indicate that the application does not intend to send more data
+ *  after the next call to send() or sendto().
+ *  This lets the modem exit connected mode more quickly after sending the data.
+ */
+#define RAI_LAST 2
+/** Release assistance indication (RAI).
+ *  Indicate that the application is expecting to receive just one data packet
+ *  after the next call to send() or sendto().
+ *  This lets the modem exit connected mode more quickly after having received the data.
+ */
+#define RAI_ONE_RESP 3
+/** Release assistance indication (RAI).
+ *  Indicate that the socket is in active use by a client application.
+ *  This lets the modem stay in connected mode longer.
+ */
+#define RAI_ONGOING 4
+/** Release assistance indication (RAI).
+ *  Indicate that the socket is in active use by a server application.
+ *  This lets the modem stay in connected mode longer.
+ */
+#define RAI_WAIT_MORE 5
+
+/* NCS specific IPPROTO_ALL level socket options */
+
+/** IPv4 and IPv6 protocol level (pseudo-val) for nRF sockets. */
+#define IPPROTO_ALL 512
+/** sockopt: disable all replies to unexpected traffics */
+#define SO_SILENCE_ALL 30
+
+/* NCS specific IPPROTO_IP level socket options */
+
+/** sockopt: enable IPv4 ICMP replies */
+#define SO_IP_ECHO_REPLY 31
+
+/* NCS specific IPPROTO_IPV6 level socket options */
+
+/** sockopt: enable IPv6 ICMP replies */
+#define SO_IPV6_ECHO_REPLY 32
+
+/* NCS specific TCP level socket options */
+
+/** sockopt: Configurable TCP server session timeout in minutes.
+ * Range is 0 to 135. 0 is no timeout and 135 is 2 h 15 min. Default is 0 (no timeout).
+ */
+#define SO_TCP_SRV_SESSTIMEO 55
+
+/* NCS specific gettaddrinfo() flags */
+
+/** Assume `service` contains a Packet Data Network (PDN) ID.
+ *  When specified together with the AI_NUMERICSERV flag,
+ *  `service` shall be formatted as follows: "port:pdn_id"
+ *  where "port" is the port number and "pdn_id" is the PDN ID.
+ *  Example: "8080:1", port 8080 PDN ID 1.
+ *  Example: "42:0", port 42 PDN ID 0.
+ */
+#define AI_PDNSERV 0x1000
+
+/* NCS specific send() and sendto() flags */
+
+/** Request a blocking send operation until the request is acknowledged.
+ *  When used in send() or sendto(), the request will not return until the
+ *  send operation is completed by lower layers, or until the timeout, given by the SO_SNDTIMEO
+ *  socket option, is reached. Valid timeout values are 1 to 600 seconds.
+ */
+#define MSG_WAITACK 0x200
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ZEPHYR_INCLUDE_NET_SOCKET_NCS_H_ */
diff --git a/include/zephyr/storage/flash_map.h b/include/zephyr/storage/flash_map.h
index 937e242830a..8943d082861 100644
--- a/include/zephyr/storage/flash_map.h
+++ b/include/zephyr/storage/flash_map.h
@@ -296,6 +296,10 @@ const char *flash_area_label(const struct flash_area *fa);
  */
 uint8_t flash_area_erased_val(const struct flash_area *fa);
 
+#if USE_PARTITION_MANAGER
+#include <flash_map_pm.h>
+#else
+
 /**
  * Returns non-0 value if fixed-partition of given DTS node label exists.
  *
@@ -381,6 +385,8 @@ uint8_t flash_area_erased_val(const struct flash_area *fa);
 #define FIXED_PARTITION_NODE_DEVICE(node) \
 	DEVICE_DT_GET(DT_MTD_FROM_FIXED_PARTITION(node))
 
+#endif /* USE_PARTITION_MANAGER */
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/kernel/Kconfig b/kernel/Kconfig
index 54e0ccf1f2d..e826de402b1 100644
--- a/kernel/Kconfig
+++ b/kernel/Kconfig
@@ -441,6 +441,7 @@ config SKIP_BSS_CLEAR
 config BOOT_BANNER
 	bool "Boot banner"
 	default y
+	depends on !NCS_BOOT_BANNER
 	select PRINTK
 	select EARLY_CONSOLE
 	help
diff --git a/kernel/banner.c b/kernel/banner.c
index 5cadda0a5e9..a16784cb975 100644
--- a/kernel/banner.c
+++ b/kernel/banner.c
@@ -24,7 +24,7 @@
 #endif /* BUILD_VERSION */
 #endif /* !BANNER_VERSION */
 
-void boot_banner(void)
+__weak void boot_banner(void)
 {
 #if defined(CONFIG_BOOT_DELAY) && (CONFIG_BOOT_DELAY > 0)
 #ifdef CONFIG_BOOT_BANNER
diff --git a/lib/heap/Kconfig b/lib/heap/Kconfig
index 89ede278006..147659f96a9 100644
--- a/lib/heap/Kconfig
+++ b/lib/heap/Kconfig
@@ -69,7 +69,7 @@ config HEAP_LISTENER
 choice
 	prompt "Supported heap sizes"
 	depends on !64BIT
-	default SYS_HEAP_SMALL_ONLY if (SRAM_SIZE <= 256)
+	default SYS_HEAP_SMALL_ONLY if (SRAM_SIZE <= 256) && !PARTITION_MANAGER_ENABLED
 	default SYS_HEAP_AUTO
 	help
 	  Heaps using reduced-size chunk headers can accommodate so called
diff --git a/lib/libc/common/source/stdlib/malloc.c b/lib/libc/common/source/stdlib/malloc.c
index a75b028000d..505bd50bad0 100644
--- a/lib/libc/common/source/stdlib/malloc.c
+++ b/lib/libc/common/source/stdlib/malloc.c
@@ -25,6 +25,20 @@
 #include <zephyr/logging/log.h>
 LOG_MODULE_DECLARE(os, CONFIG_KERNEL_LOG_LEVEL);
 
+#if USE_PARTITION_MANAGER
+
+#include <pm_config.h>
+
+#define RAM_SIZE PM_SRAM_SIZE
+#define RAM_ADDR PM_SRAM_ADDRESS
+
+#else /* ! USE_PARTITION_MANAGER */
+
+#define RAM_SIZE (KB((size_t) CONFIG_SRAM_SIZE))
+#define RAM_ADDR CONFIG_SRAM_BASE_ADDRESS
+
+#endif /* USE_PARTITION_MANAGER */
+
 #ifdef CONFIG_COMMON_LIBC_MALLOC
 
 #if (CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE != 0)
@@ -106,8 +120,8 @@ static POOL_SECTION unsigned char __aligned(HEAP_ALIGN) malloc_arena[HEAP_SIZE];
 extern char _heap_sentry[];
 #    define HEAP_SIZE  ROUND_DOWN((POINTER_TO_UINT(_heap_sentry) - HEAP_BASE), HEAP_ALIGN)
 #   else
-#    define HEAP_SIZE	ROUND_DOWN((KB((size_t) CONFIG_SRAM_SIZE) -	\
-		((size_t) HEAP_BASE - (size_t) CONFIG_SRAM_BASE_ADDRESS)), HEAP_ALIGN)
+#    define HEAP_SIZE	ROUND_DOWN((RAM_SIZE -	\
+		((size_t) HEAP_BASE - (size_t) RAM_ADDR)), HEAP_ALIGN)
 #   endif /* else CONFIG_XTENSA */
 
 #  endif /* else CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE > 0 */
diff --git a/lib/os/zvfs/Kconfig b/lib/os/zvfs/Kconfig
index 7f50ff52bef..64808b7ce36 100644
--- a/lib/os/zvfs/Kconfig
+++ b/lib/os/zvfs/Kconfig
@@ -6,7 +6,6 @@
 menuconfig ZVFS
 	bool "Zephyr virtual filesystem (ZVFS) support [EXPERIMENTAL]"
 	select FDTABLE
-	select EXPERIMENTAL
 	help
 	  ZVFS is a central, Zephyr-native library that provides a common interoperable API for all
 	  types of file descriptors such as those from the non-virtual FS, sockets, eventfds, FILE *'s
diff --git a/modules/hal_nordic/CMakeLists.txt b/modules/hal_nordic/CMakeLists.txt
index a9384a03633..eb85fd58f5e 100644
--- a/modules/hal_nordic/CMakeLists.txt
+++ b/modules/hal_nordic/CMakeLists.txt
@@ -11,6 +11,9 @@ add_subdirectory_ifdef(CONFIG_HAS_NRFS nrfs)
 if(CONFIG_NRF_REGTOOL_GENERATE_UICR)
   list(APPEND nrf_regtool_components GENERATE:UICR)
 endif()
+if(CONFIG_NRF_REGTOOL_GENERATE_BICR)
+  list(APPEND nrf_regtool_components GENERATE:BICR)
+endif()
 if(DEFINED nrf_regtool_components)
   find_package(nrf-regtool 5.6.0 REQUIRED
     COMPONENTS ${nrf_regtool_components}
diff --git a/modules/hal_nordic/Kconfig.nrf_regtool b/modules/hal_nordic/Kconfig.nrf_regtool
index 791971452fe..77944c5bb05 100644
--- a/modules/hal_nordic/Kconfig.nrf_regtool
+++ b/modules/hal_nordic/Kconfig.nrf_regtool
@@ -11,6 +11,13 @@ config NRF_REGTOOL_GENERATE_UICR
 	  CPU domains that require UICR allocation aren't bootable without it
 	  being programmed alongside the firmware.
 
+config NRF_REGTOOL_GENERATE_BICR
+	bool "Generate BICR"
+	help
+	  Generate a BICR hex based on devicetree contents using nrf-regtool.
+	  If not already present, the BICR must be included alongside
+	  any firmware programmed to the board for the first time.
+
 config NRF_REGTOOL_VERBOSITY
 	int "Verbosity level of console output"
 	range 0 3
diff --git a/modules/hal_nordic/nrf-regtool/nrf-regtoolConfig.cmake b/modules/hal_nordic/nrf-regtool/nrf-regtoolConfig.cmake
index 0ff0a8ba6dd..099f44673f5 100644
--- a/modules/hal_nordic/nrf-regtool/nrf-regtoolConfig.cmake
+++ b/modules/hal_nordic/nrf-regtool/nrf-regtoolConfig.cmake
@@ -26,6 +26,10 @@ function(nrf_regtool_generate_hex_from_dts peripheral)
   )
   message(STATUS "Generated ${peripheral} hex file: ${generated_hex_file}")
 
+  if(NOT peripheral STREQUAL "UICR")
+    return()
+  endif()
+
   set(merged_hex_file ${PROJECT_BINARY_DIR}/${merged_hex_name})
   set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
     COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
diff --git a/modules/hal_nordic/nrfs/Kconfig b/modules/hal_nordic/nrfs/Kconfig
index b027febd2a5..49ffc2595e1 100644
--- a/modules/hal_nordic/nrfs/Kconfig
+++ b/modules/hal_nordic/nrfs/Kconfig
@@ -38,6 +38,8 @@ config NRFS
 	bool "nRF Services Support"
 	select NRFS_LOCAL_DOMAIN if (SOC_NRF54H20_CPUAPP || SOC_NRF54H20_CPURAD || SOC_NRF9280_CPUAPP || SOC_NRF9280_CPURAD)
 	depends on HAS_NRFS
+	depends on !MISRA_SANE
+	default y if !ZTEST
 	help
 	  This option enables the nRF Services library.
 
@@ -72,6 +74,7 @@ config NRFS_RESET_SERVICE_ENABLED
 config NRFS_MRAM_SERVICE_ENABLED
 	bool "MRAM latency service"
 	depends on NRFS_HAS_MRAM_SERVICE
+	default y
 
 config NRFS_TEMP_SERVICE_ENABLED
 	bool "Temperature service"
diff --git a/modules/hal_nordic/nrfx/Kconfig b/modules/hal_nordic/nrfx/Kconfig
index 3313e033c7c..6f3bd8a984e 100644
--- a/modules/hal_nordic/nrfx/Kconfig
+++ b/modules/hal_nordic/nrfx/Kconfig
@@ -9,6 +9,10 @@ menu "nrfx drivers"
 
 rsource "Kconfig.logging"
 
+config MPSL
+	bool
+	# Dummy kconfig to allow compiling outside of NCS
+
 config NRFX_ADC
 	bool "ADC driver"
 	depends on $(dt_has_compat,$(DT_COMPAT_NORDIC_NRF_ADC))
diff --git a/modules/hal_nordic/nrfx/nrfe_config.h b/modules/hal_nordic/nrfx/nrfe_config.h
new file mode 100644
index 00000000000..c85d22a14a3
--- /dev/null
+++ b/modules/hal_nordic/nrfx/nrfe_config.h
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2024, Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef NRFE_CONFIG_H__
+#define NRFE_CONFIG_H__
+
+#ifdef CONFIG_GPIO_NRFE
+#include <drivers/gpio/nrfe_gpio.h>
+#else
+#error "NRFE config header included, even though no SW-define IO device is enabled."
+#endif
+
+#ifndef NRFE_RESERVED_PPI_CHANNELS
+#define NRFE_RESERVED_PPI_CHANNELS 0
+#endif
+
+#endif /* NRFE_CONFIG_H__ */
diff --git a/modules/hal_nordic/nrfx/nrfx_glue.h b/modules/hal_nordic/nrfx/nrfx_glue.h
index b7365e5163a..72764c66f04 100644
--- a/modules/hal_nordic/nrfx/nrfx_glue.h
+++ b/modules/hal_nordic/nrfx/nrfx_glue.h
@@ -317,12 +317,14 @@ void nrfx_busy_wait(uint32_t usec_to_wait);
 /** @brief Bitmask that defines DPPI channels that are reserved for use outside of the nrfx library. */
 #define NRFX_DPPI_CHANNELS_USED   (NRFX_PPI_CHANNELS_USED_BY_BT_CTLR |    \
 				   NRFX_PPI_CHANNELS_USED_BY_802154_DRV | \
-				   NRFX_PPI_CHANNELS_USED_BY_MPSL)
+				   NRFX_PPI_CHANNELS_USED_BY_MPSL |       \
+				   NRFX_PPI_CHANNELS_USED_BY_NRFE)
 
 /** @brief Bitmask that defines DPPI groups that are reserved for use outside of the nrfx library. */
 #define NRFX_DPPI_GROUPS_USED     (NRFX_PPI_GROUPS_USED_BY_BT_CTLR |    \
 				   NRFX_PPI_GROUPS_USED_BY_802154_DRV | \
-				   NRFX_PPI_GROUPS_USED_BY_MPSL)
+				   NRFX_PPI_GROUPS_USED_BY_MPSL |       \
+				   NRFX_PPI_GROUPS_USED_BY_NRFE)
 
 /** @brief Bitmask that defines PPI channels that are reserved for use outside of the nrfx library. */
 #define NRFX_PPI_CHANNELS_USED    (NRFX_PPI_CHANNELS_USED_BY_BT_CTLR |    \
@@ -386,7 +388,7 @@ void nrfx_busy_wait(uint32_t usec_to_wait);
 #define NRFX_PPI_GROUPS_USED_BY_802154_DRV     0
 #endif // CONFIG_NRF_802154_RADIO_DRIVER
 
-#if defined(CONFIG_NRF_802154_RADIO_DRIVER) && !defined(CONFIG_NRF_802154_SL_OPENSOURCE)
+#if defined(CONFIG_MPSL)
 #include <mpsl.h>
 #define NRFX_PPI_CHANNELS_USED_BY_MPSL   MPSL_RESERVED_PPI_CHANNELS
 #define NRFX_PPI_GROUPS_USED_BY_MPSL     0
@@ -395,6 +397,15 @@ void nrfx_busy_wait(uint32_t usec_to_wait);
 #define NRFX_PPI_GROUPS_USED_BY_MPSL     0
 #endif
 
+#if defined(CONFIG_NRFE)
+#include <nrfe_config.h>
+#define NRFX_PPI_CHANNELS_USED_BY_NRFE   NRFE_RESERVED_PPI_CHANNELS
+#define NRFX_PPI_GROUPS_USED_BY_NRFE     0
+#else
+#define NRFX_PPI_CHANNELS_USED_BY_NRFE   0
+#define NRFX_PPI_GROUPS_USED_BY_NRFE     0
+#endif
+
 #if defined(NRF_802154_VERIFY_PERIPHS_ALLOC_AGAINST_MPSL)
 BUILD_ASSERT(
 	(NRFX_PPI_CHANNELS_USED_BY_802154_DRV & NRFX_PPI_CHANNELS_USED_BY_MPSL) == 0,
diff --git a/modules/hostap/CMakeLists.txt b/modules/hostap/CMakeLists.txt
index 1f30ee34416..6d6d61cfef4 100644
--- a/modules/hostap/CMakeLists.txt
+++ b/modules/hostap/CMakeLists.txt
@@ -105,7 +105,6 @@ zephyr_library_sources(
 	${HOSTAP_SRC_BASE}/drivers/driver_common.c
 	${HOSTAP_SRC_BASE}/drivers/drivers.c
 	${HOSTAP_SRC_BASE}/utils/crc32.c
-	${HOSTAP_SRC_BASE}/utils/base64.c
 	${HOSTAP_SRC_BASE}/utils/common.c
 	${HOSTAP_SRC_BASE}/utils/wpabuf.c
 	${HOSTAP_SRC_BASE}/utils/bitfield.c
@@ -435,8 +434,10 @@ zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_DPP
 	${HOSTAP_SRC_BASE}/tls/asn1.c
 )
 
-# crypto mbedtls related
-if(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO)
+# crypto mbedtls related CRYPTO OR LEGACY_NCS
+if(DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO OR
+   DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS OR
+   DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS_PSA)
 zephyr_library_sources(
 	${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls-bignum.c
 	${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls-ec.c
@@ -514,4 +515,8 @@ if(CONFIG_SAE_PWE_EARLY_EXIT)
 	"please use it carefully and do not use it production.")
 endif()
 
+zephyr_library_compile_definitions_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
+	MBEDTLS_NIST_KW_C
+)
+
 endif()
diff --git a/modules/hostap/Kconfig b/modules/hostap/Kconfig
index c49cee46973..b329cd2e4f0 100644
--- a/modules/hostap/Kconfig
+++ b/modules/hostap/Kconfig
@@ -109,7 +109,8 @@ config WIFI_NM_WPA_SUPPLICANT_WEP
 
 choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND
 	prompt "WPA supplicant crypto implementation"
-	default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
+	default WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS
+	default WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS_PSA if SOC_SERIES_NRF54LX
 	help
 	  Select the crypto implementation to use for WPA supplicant.
 	  WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT supports enterprise mode
@@ -135,6 +136,7 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO
 	select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 	select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
 	select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
+	select MBEDTLS_ECP_DP_SECP256R1_ENABLED
 
 config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
 	bool "Crypto Mbedtls alt support for WiFi"
@@ -149,19 +151,65 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
 	select MBEDTLS_CIPHER
 	select MBEDTLS_ECP_C
 	select MBEDTLS_ECP_ALL_ENABLED
-	select MBEDTLS_CMAC
+	select MBEDTLS_CMAC_C
 	select MBEDTLS_PKCS5_C
 	select MBEDTLS_PK_WRITE_C
 	select MBEDTLS_ECDH_C
 	select MBEDTLS_ECDSA_C
 	select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
 	select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
-	select MBEDTLS_NIST_KW_C
 	select MBEDTLS_DHM_C
 	select MBEDTLS_HKDF_C
 	select MBEDTLS_SERVER_NAME_INDICATION
 	select MBEDTLS_X509_CRL_PARSE_C
 	select MBEDTLS_TLS_VERSION_1_2
+	select MBEDTLS_ECP_DP_SECP256R1_ENABLED
+
+config WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS
+	bool "Legacy Crypto support for WiFi using nRF security"
+	select MBEDTLS
+	select NRF_SECURITY
+	select MBEDTLS_CIPHER_MODE_CBC
+	select MBEDTLS_CIPHER_MODE_CTR
+	select MBEDTLS_LEGACY_CRYPTO_C
+	select MBEDTLS_SHA1_C
+	select MBEDTLS_ECP_C
+	select MBEDTLS_CTR_DRBG_C
+	select MBEDTLS_PK_C
+	select MBEDTLS_PKCS5_C
+	select MBEDTLS_PK_PARSE_C
+	select MBEDTLS_CMAC_C
+	select MBEDTLS_CIPHER_PADDING_PKCS7
+	select MBEDTLS_PK_WRITE_C
+	select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
+	select MBEDTLS_ECP_DP_SECP256R1_ENABLED
+
+config WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS_PSA
+	bool "PSA Crypto support for WiFi using nRF security"
+	select MBEDTLS
+	select NRF_SECURITY
+	select PSA_WANT_GENERATE_RANDOM
+	# Legacy crypto, still needed
+	select MBEDTLS_SHA1_C
+	select MBEDTLS_LEGACY_CRYPTO_C
+	select MBEDTLS_CMAC_C
+	select MBEDTLS_GCM_C
+	select MBEDTLS_TLS_LIBRARY
+	select MBEDTLS_PK_C
+	select MBEDTLS_PK_WRITE_C
+	select MBEDTLS_X509_LIBRARY
+	select MBEDTLS_X509_CRT_PARSE_C
+	select MBEDTLS_CIPHER_C
+	select MBEDTLS_CIPHER_MODE_CTR
+	select MBEDTLS_CIPHER_MODE_CBC
+	select MBEDTLS_SSL_TLS_C
+	select MBEDTLS_ECP_C
+	select MBEDTLS_CTR_DRBG_C
+	select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
+	select MBEDTLS_MD_C
+	select MBEDTLS_CIPHER_PADDING_PKCS7
+	select MBEDTLS_PKCS5_C
+	select MBEDTLS_ECP_DP_SECP256R1_ENABLED
 
 config WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE
 	bool "No Crypto support for WiFi"
diff --git a/modules/mbedtls/CMakeLists.txt b/modules/mbedtls/CMakeLists.txt
index aab4ad5316c..6a8f564e725 100644
--- a/modules/mbedtls/CMakeLists.txt
+++ b/modules/mbedtls/CMakeLists.txt
@@ -39,6 +39,8 @@ zephyr_interface_library_named(mbedTLS)
     # Add regular includes
     target_include_directories(mbedTLS INTERFACE
         ${ZEPHYR_CURRENT_MODULE_DIR}/include
+        ${ZEPHYR_CURRENT_MODULE_DIR}/include/library
+        ${ZEPHYR_CURRENT_MODULE_DIR}/library
         configs
         include
     )
@@ -170,7 +172,6 @@ zephyr_interface_library_named(mbedTLS)
       ${ZEPHYR_CURRENT_MODULE_DIR}/library/pkparse.c
       ${ZEPHYR_CURRENT_MODULE_DIR}/library/pkwrite.c
       ${ZEPHYR_CURRENT_MODULE_DIR}/library/pk.c
-      ${ZEPHYR_CURRENT_MODULE_DIR}/library/pk_ecc.c
       ${ZEPHYR_CURRENT_MODULE_DIR}/library/pk_wrap.c
     )
 
diff --git a/modules/mbedtls/Kconfig b/modules/mbedtls/Kconfig
index d15c420f507..7faa4ec7a16 100644
--- a/modules/mbedtls/Kconfig
+++ b/modules/mbedtls/Kconfig
@@ -14,6 +14,8 @@ config MBEDTLS_PROMPTLESS
 	  dependent sub-configurations and thus prevent stuck symbol behavior.
 
 rsource "Kconfig.psa"
+# Add nordic additions to Kconfigs
+rsource "Kconfig.psa.nordic"
 
 menuconfig MBEDTLS
 	bool "mbed TLS Support" if !MBEDTLS_PROMPTLESS
@@ -28,6 +30,7 @@ choice MBEDTLS_IMPLEMENTATION
 
 config MBEDTLS_BUILTIN
 	bool "Use Zephyr in-tree mbedTLS version"
+	depends on ! DISABLE_MBEDTLS_BUILTIN
 	help
 	  Link with mbedTLS sources included with Zephyr distribution.
 	  Included mbedTLS version is well integrated with and supported
@@ -41,6 +44,12 @@ config MBEDTLS_LIBRARY
 
 endchoice
 
+config DISABLE_MBEDTLS_BUILTIN
+	bool
+	help
+	  Subsystems cannot deselect MBEDTLS_BUILTIN, but they can select
+	  DISABLE_MBEDTLS_BUILTIN.
+
 config CUSTOM_MBEDTLS_CFG_FILE
 	bool "Custom mbed TLS configuration file"
 	help
diff --git a/modules/mbedtls/Kconfig.psa b/modules/mbedtls/Kconfig.psa
index 7562032bf3d..ff3c488e212 100644
--- a/modules/mbedtls/Kconfig.psa
+++ b/modules/mbedtls/Kconfig.psa
@@ -36,10 +36,6 @@ config PSA_WANT_ALG_CMAC
 	bool "PSA_WANT_ALG_CMAC" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
 
-config PSA_WANT_ALG_CFB
-	bool "PSA_WANT_ALG_CFB" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
 config PSA_WANT_ALG_CHACHA20_POLY1305
 	bool "PSA_WANT_ALG_CHACHA20_POLY1305" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
@@ -60,10 +56,6 @@ config PSA_WANT_ALG_ECDH
 	bool "PSA_WANT_ALG_ECDH" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
 
-config PSA_WANT_ALG_FFDH
-	bool "PSA_WANT_ALG_FFDH" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
 config PSA_WANT_ALG_ECDSA
 	bool "PSA_WANT_ALG_ECDSA" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
@@ -79,6 +71,7 @@ config PSA_WANT_ALG_GCM
 config PSA_WANT_ALG_HKDF
 	bool "PSA_WANT_ALG_HKDF" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_HMAC
 
 config PSA_WANT_ALG_HKDF_EXTRACT
 	bool "PSA_WANT_ALG_HKDF_EXTRACT" if !MBEDTLS_PROMPTLESS
@@ -95,22 +88,19 @@ config PSA_WANT_ALG_HMAC
 config PSA_WANT_ALG_MD5
 	bool "PSA_WANT_ALG_MD5" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_ALG_OFB
-	bool "PSA_WANT_ALG_OFB" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  Warning: The MD5 hash is weak and deprecated and is only recommended
+	  for use in legacy protocols.
 
 config PSA_WANT_ALG_PBKDF2_HMAC
 	bool "PSA_WANT_ALG_PBKDF2_HMAC" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_HMAC
 
 config PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
 	bool "PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_ALG_RIPEMD160
-	bool "PSA_WANT_ALG_RIPEMD160" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_CMAC
 
 config PSA_WANT_ALG_RSA_OAEP
 	bool "PSA_WANT_ALG_RSA_OAEP" if !MBEDTLS_PROMPTLESS
@@ -131,6 +121,9 @@ config PSA_WANT_ALG_RSA_PSS
 config PSA_WANT_ALG_SHA_1
 	bool "PSA_WANT_ALG_SHA_1" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  Warning: The SHA-1 hash is weak and deprecated and is only recommended
+	  for use in legacy protocols.
 
 config PSA_WANT_ALG_SHA_224
 	bool "PSA_WANT_ALG_SHA_224" if !MBEDTLS_PROMPTLESS
@@ -167,18 +160,22 @@ config PSA_WANT_ALG_SHA3_512
 config PSA_WANT_ALG_STREAM_CIPHER
 	bool "PSA_WANT_ALG_STREAM_CIPHER" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	select PSA_WANT_KEY_TYPE_CHACHA20
 
 config PSA_WANT_ALG_TLS12_PRF
 	bool "PSA_WANT_ALG_TLS12_PRF" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_HMAC
 
 config PSA_WANT_ALG_TLS12_PSK_TO_MS
 	bool "PSA_WANT_ALG_TLS12_PSK_TO_MS" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_HMAC
 
 config PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
 	bool "PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_SHA_256
 
 config PSA_WANT_ECC_BRAINPOOL_P_R1_256
 	bool "PSA_WANT_ECC_BRAINPOOL_P_R1_256" if !MBEDTLS_PROMPTLESS
@@ -228,26 +225,6 @@ config PSA_WANT_ECC_SECP_R1_521
 	bool "PSA_WANT_ECC_SECP_R1_521" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
 
-config PSA_WANT_DH_RFC7919_2048
-	bool "PSA_WANT_DH_RFC7919_2048" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_DH_RFC7919_3072
-	bool "PSA_WANT_DH_RFC7919_3072" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_DH_RFC7919_4096
-	bool "PSA_WANT_DH_RFC7919_4096" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_DH_RFC7919_6144
-	bool "PSA_WANT_DH_RFC7919_6144" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_DH_RFC7919_8192
-	bool "PSA_WANT_DH_RFC7919_8192" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
 config PSA_WANT_KEY_TYPE_DERIVE
 	bool "PSA_WANT_KEY_TYPE_DERIVE" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
@@ -268,30 +245,16 @@ config PSA_WANT_KEY_TYPE_AES
 	bool "PSA_WANT_KEY_TYPE_AES" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
 
-config PSA_WANT_KEY_TYPE_ARIA
-	bool "PSA_WANT_KEY_TYPE_ARIA" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_KEY_TYPE_CAMELLIA
-	bool "PSA_WANT_KEY_TYPE_CAMELLIA" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
 config PSA_WANT_KEY_TYPE_CHACHA20
 	bool "PSA_WANT_KEY_TYPE_CHACHA20" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_KEY_TYPE_DES
-	bool "PSA_WANT_KEY_TYPE_DES" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_CHACHA20_POLY1305 || \
+		   PSA_WANT_ALG_STREAM_CIPHER
 
 config PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
 	bool "PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
 
-config PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
-	bool "PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
 config PSA_WANT_KEY_TYPE_RAW_DATA
 	bool "PSA_WANT_KEY_TYPE_RAW_DATA" if !MBEDTLS_PROMPTLESS
 	default y if PSA_CRYPTO_ENABLE_ALL
@@ -301,55 +264,59 @@ config PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC
-	bool "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
+	bool
+	default y
+	depends on PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 	|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 	|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
 
 config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
 	bool "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
 	bool "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE
 	bool "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
 	bool "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
-	bool "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
+	bool
+	default y
+	depends on PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 	|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 	|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE
 
 config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
 	bool "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT
 	bool "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
 	bool "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
-config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
-	bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
-	bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
-	bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT" if !MBEDTLS_PROMPTLESS
-	default y if PSA_CRYPTO_ENABLE_ALL
-
-config PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
-	bool "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE" if !MBEDTLS_PROMPTLESS
+config PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE
+	bool "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 	default y if PSA_CRYPTO_ENABLE_ALL
 
 endif # PSA_CRYPTO_CLIENT
diff --git a/modules/mbedtls/Kconfig.psa.nordic b/modules/mbedtls/Kconfig.psa.nordic
new file mode 100644
index 00000000000..419ccbe07f2
--- /dev/null
+++ b/modules/mbedtls/Kconfig.psa.nordic
@@ -0,0 +1,391 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+comment "Nordic added meta types"
+
+config PSA_HAS_AEAD_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_CCM || \
+		   PSA_WANT_ALG_GCM || \
+		   PSA_WANT_ALG_CHACHA20_POLY1305
+	help
+	  Prompt-less configuration that states that AEAD is supported.
+
+config PSA_HAS_ASYM_ENCRYPT_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_RSA_OAEP || \
+		   PSA_WANT_ALG_RSA_PKCS1V15_CRYPT
+	help
+	  Prompt-less configuration that states that asymmetric encryption
+	  is supported.
+
+config PSA_HAS_ASYM_SIGN_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_DETERMINISTIC_ECDSA	|| \
+		   PSA_WANT_ALG_ECDSA 			|| \
+		   PSA_WANT_ALG_ECDSA_ANY		|| \
+		   PSA_WANT_ALG_ED25519PH               || \
+		   PSA_WANT_ALG_ED448PH                 || \
+		   PSA_WANT_ALG_PURE_EDDSA              || \
+		   PSA_WANT_ALG_RSA_PKCS1V15_SIGN	|| \
+		   PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW   || \
+		   PSA_WANT_ALG_RSA_PSS                 || \
+		   PSA_WANT_ALG_RSA_PSS_ANY_SALT
+	help
+	  Prompt-less configuration that states that asymmetric signing
+	  is supported.
+
+config PSA_HAS_CIPHER_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_ECB_NO_PADDING		|| \
+		   PSA_WANT_ALG_CBC_NO_PADDING		|| \
+		   PSA_WANT_ALG_CBC_PKCS7		|| \
+		   PSA_WANT_ALG_CCM_STAR_NO_TAG 	|| \
+		   PSA_WANT_ALG_CTR			|| \
+		   PSA_WANT_ALG_XTS			|| \
+		   PSA_WANT_ALG_STREAM_CIPHER
+	help
+	  Prompt-less configuration that states that cipher is supported.
+
+config PSA_HAS_HASH_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_MD5		|| \
+		   PSA_WANT_ALG_SHA_1		|| \
+		   PSA_WANT_ALG_SHA_224		|| \
+		   PSA_WANT_ALG_SHA_256		|| \
+		   PSA_WANT_ALG_SHA_384		|| \
+		   PSA_WANT_ALG_SHA_512		|| \
+		   PSA_WANT_ALG_SHA_512_224	|| \
+		   PSA_WANT_ALG_SHA_512_256	|| \
+		   PSA_WANT_ALG_SHA3_224	|| \
+		   PSA_WANT_ALG_SHA3_256	|| \
+		   PSA_WANT_ALG_SHA3_384	|| \
+		   PSA_WANT_ALG_SHA3_512
+	help
+	  Prompt-less configuration that states that hash is supported.
+
+config PSA_HAS_KEY_AGREEMENT
+	bool
+	default y
+	depends on PSA_WANT_ALG_ECDH
+	help
+	  Promt-less configuration that states that key agreement is supported.
+
+config PSA_HAS_KEY_DERIVATION
+	bool
+	default y
+	depends on PSA_WANT_ALG_HKDF			|| \
+		   PSA_WANT_ALG_HKDF_EXPAND		|| \
+		   PSA_WANT_ALG_HKDF_EXTRACT		|| \
+		   PSA_WANT_ALG_PBKDF2_HMAC		|| \
+		   PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128	|| \
+		   PSA_WANT_ALG_TLS12_PRF		|| \
+		   PSA_WANT_ALG_TLS12_PSK_TO_MS		|| \
+		   PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
+	help
+	  Prompt-less configuration that states that key derivation is supported.
+
+config PSA_HAS_KEY_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_KEY_TYPE_AES 			|| \
+		   PSA_WANT_KEY_TYPE_CHACHA20			|| \
+		   PSA_WANT_KEY_TYPE_DERIVE			|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT	|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE	|| \
+		   PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY		|| \
+		   PSA_WANT_KEY_TYPE_HMAC			|| \
+		   PSA_WANT_KEY_TYPE_PASSWORD			|| \
+		   PSA_WANT_KEY_TYPE_PASSWORD_HASH		|| \
+		   PSA_WANT_KEY_TYPE_PEPPER			|| \
+		   PSA_WANT_KEY_TYPE_RAW_DATA			|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT	|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE	|| \
+		   PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY		|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_IMPORT	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_DERIVE	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY		|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_IMPORT	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_DERIVE	|| \
+		   PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
+	help
+	  Prompt-less configuration that states that key types are supported.
+
+config PSA_HAS_MAC_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_CMAC	|| \
+		   PSA_WANT_ALG_HMAC
+	help
+	  Prompt-less configuration that states that MAC is supported.
+
+config PSA_HAS_PAKE_SUPPORT
+	bool
+	default y
+	depends on PSA_WANT_ALG_JPAKE			|| \
+		   PSA_WANT_ALG_SPAKE2P_HMAC		|| \
+		   PSA_WANT_ALG_SPAKE2P_CMAC		|| \
+		   PSA_WANT_ALG_SPAKE2P_MATTER 		|| \
+		   PSA_WANT_ALG_SRP_6 			|| \
+		   PSA_WANT_ALG_SRP_PASSWORD_HASH
+	help
+	  Prompt-less configuration that states that PAKE is supported.
+
+comment "Nordic added alg types"
+
+config PSA_WANT_ALG_ECDSA_ANY
+	bool "PSA ECDSA support, without hashing" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_ED25519PH
+	bool "PSA ED25519PH support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_ED448PH
+	bool "PSA ED448PH support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_PURE_EDDSA
+	bool "PSA PURE_EDDSA support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW
+	bool "PSA RSA raw PKCS#1 v1.5 message signature support, without hashing)" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_RSA_PSS_ANY_SALT
+	bool "PSA RSA PSS message signature support, any salt length" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SHA_512_224
+	bool "PSA SHA-512/224 support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SHA_512_256
+	bool "PSA SHA-512/256 support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SPAKE2P_HMAC
+	bool "PSA SPAKE2+ HMAC support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SPAKE2P_CMAC
+	bool "PSA SPAKE2+ CMAC support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SPAKE2P_MATTER
+	bool "PSA SPAKE2+ MATTER support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SP800_108_COUNTER_HMAC
+	bool "Add PSA SP800-108r1 CTR HMAC KBKDF support"
+	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_HMAC
+
+config PSA_WANT_ALG_SP800_108_COUNTER_CMAC
+	bool "Add PSA SP800-108r1 CTR CMAC KBKDF support"
+	default y if PSA_CRYPTO_ENABLE_ALL
+	depends on PSA_WANT_ALG_CMAC
+
+config PSA_WANT_ALG_SRP_6
+	bool "PSA SRP-6 support" if !PSA_PROMPTLESS
+	select EXPERIMENTAL
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_SRP_PASSWORD_HASH
+	bool "PSA SRP password hash support" if !PSA_PROMPTLESS
+	select EXPERIMENTAL
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_ALG_XTS
+	bool "PSA XTS block cipher mode support" if !PSA_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+comment "Nordic added ECC curve types"
+
+config PSA_WANT_ECC_BRAINPOOL_P_R1_160
+	bool "PSA ECC BrainpoolP160r1 support (weak)"  if !PSA_PROMPTLESS
+	help
+	  Warning: The 160-bit curve brainpoolP160r1 is weak and deprecated and
+	  is only recommended for use in legacy protocols.
+
+config PSA_WANT_ECC_BRAINPOOL_P_R1_192
+	bool "PSA ECC BrainpoolP192r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_BRAINPOOL_P_R1_224
+	bool "PSA ECC BrainpoolP224r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_BRAINPOOL_P_R1_320
+	bool "PSA ECC BrainpoolP320r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_TWISTED_EDWARDS_255
+	bool "PSA ECC Edwards25519 (Ed25519) support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_TWISTED_EDWARDS_448
+	bool "PSA ECC Edwards448 (Ed448) support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECP_K1_224
+	bool "PSA ECC secp224k1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECP_R2_160
+	bool "PSA ECC secp160r2 support (weak)" if !PSA_PROMPTLESS
+	help
+	  Warning: his family of curves is weak and deprecated.
+
+config PSA_WANT_ECC_SECT_K1_163
+	bool "PSA ECC sect163k1 support (weak)" if !PSA_PROMPTLESS
+	help
+	  Warning: The 163-bit curve sect163k1 is weak and deprecated and is
+	  only recommended for use in legacy protocols.
+
+config PSA_WANT_ECC_SECT_K1_233
+	bool "PSA ECC sect233k1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_K1_239
+	bool "PSA ECC sect239k1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_K1_283
+	bool "PSA ECC sect283k1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_K1_409
+	bool "PSA ECC sect409k1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_K1_571
+	bool "PSA ECC sect571k1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_R1_163
+	bool "PSA ECC sect163r1 support (weak)" if !PSA_PROMPTLESS
+	help
+	  Warning: The 163-bit curve sect163r1 is weak and deprecated and is
+	  only recommended for use in legacy protocols.
+
+config PSA_WANT_ECC_SECT_R1_233
+	bool "PSA ECC sect233r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_R1_283
+	bool "PSA ECC sect283r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_R1_409
+	bool "PSA ECC sect409r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_R1_571
+	bool "PSA ECC sect571r1 support" if !PSA_PROMPTLESS
+
+config PSA_WANT_ECC_SECT_R2_163
+	bool "PSA ECC sect163r2 support (weak)" if !PSA_PROMPTLESS
+	help
+	  Warning: The 163-bit curve sect163r2 is weak and deprecated and is
+	  only recommended for use in legacy protocols.
+
+config PSA_WANT_ECC_FRP_V1_256
+	bool "PSA ECC FRP256v1 support" if !PSA_PROMPTLESS
+
+comment "Nordic addded RNG configuration"
+
+config PSA_WANT_GENERATE_RANDOM
+	bool "PSA RNG support" if !MBEDTLS_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+comment "Nordic added key types"
+
+config PSA_WANT_KEY_TYPE_PEPPER
+	bool "PSA pepper key type support" if !MBEDTLS_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+
+config PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_BASIC
+	bool
+	default y
+	depends on PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_IMPORT	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_DERIVE
+	help
+	  SPAKE2+ key pair: Basic key support
+
+config PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_IMPORT
+	bool "SPAKE2+ key pair import support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SPAKE2+ key pair: Import key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_EXPORT
+	bool "SPAKE2+ key pair export support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SPAKE2+ key pair: Export key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_GENERATE
+	bool "SPAKE2+ key pair generate support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SPAKE2+ key pair: Generate key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_DERIVE
+	bool "SPAKE2+ key pair derive support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SPAKE2+ key pair: Derive key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SPAKE2P_PUBLIC_KEY
+	bool "SPAKE2+ public key support" if !MBEDTLS_PROMPTLESS
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SPAKE2+ public key support.
+
+config PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_BASIC
+	bool
+	default y
+	depends on PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_IMPORT	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_EXPORT	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_GENERATE	|| \
+		   PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_DERIVE
+
+config PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_IMPORT
+	bool "SRP key pair import support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SRP key pair: import key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_EXPORT
+	bool "SRP key pair export support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SRP key pair: export key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_GENERATE
+	bool "SRP key pair export support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SRP key pair: export key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_DERIVE
+	bool "SRP key pair derive support" if !MBEDTLS_PROMPTLESS
+	select PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
+	default y if PSA_CRYPTO_ENABLE_ALL
+	help
+	  SRP key pair: derive key for both the private and public key.
+
+config PSA_WANT_KEY_TYPE_SRP_PUBLIC_KEY
+	bool "SRP public key support" if !MBEDTLS_PROMPTLESS
+	help
+	  SRP public key support.
diff --git a/modules/mbedtls/Kconfig.tls-generic b/modules/mbedtls/Kconfig.tls-generic
index 3ea0a49dd34..4300b0f03e6 100644
--- a/modules/mbedtls/Kconfig.tls-generic
+++ b/modules/mbedtls/Kconfig.tls-generic
@@ -7,6 +7,8 @@
 menu "Mbed TLS configuration"
 	depends on MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 menu "TLS"
 
 config MBEDTLS_TLS_VERSION_1_2
@@ -40,10 +42,14 @@ endif # MBEDTLS_TLS_VERSION_1_2 || MBEDTLS_TLS_VERSION_1_3
 
 endmenu # TLS
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 menu "Ciphersuite configuration"
 
 comment "Supported key exchange modes"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
 	bool "All available ciphersuite modes"
 	select MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
@@ -71,6 +77,8 @@ config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
 config MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
 	bool "RSA-PSK based ciphersuite modes"
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_PSK_MAX_LEN
 	int "Max size of TLS pre-shared keys"
 	default 32
@@ -78,6 +86,8 @@ config MBEDTLS_PSK_MAX_LEN
 	  Max size of TLS pre-shared keys, in bytes. It has no effect if no
 	  PSK key exchange is used.
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
 	bool "RSA-only based ciphersuite modes"
 	default y if UOSCORE || UEDHOC
@@ -86,6 +96,7 @@ config MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
 	select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT if PSA_CRYPTO_CLIENT
 	select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT if PSA_CRYPTO_CLIENT
 	select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE if PSA_CRYPTO_CLIENT
+	select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE if PSA_CRYPTO_CLIENT
 
 config MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
 	bool "DHE-RSA based ciphersuite modes"
@@ -214,8 +225,12 @@ config MBEDTLS_ECP_NIST_OPTIM
 
 endif
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 comment "Supported ciphers and cipher modes"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_CIPHER_ALL_ENABLED
 	bool "All available ciphers and modes"
 	select MBEDTLS_CIPHER_AES_ENABLED
@@ -306,8 +321,12 @@ config MBEDTLS_CMAC
 	bool "CMAC (Cipher-based Message Authentication Code) mode for block ciphers."
 	depends on MBEDTLS_CIPHER_AES_ENABLED || MBEDTLS_CIPHER_DES_ENABLED
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 comment "Supported hash algorithms"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_HASH_ALL_ENABLED
 	bool "All available MAC methods"
 	select MBEDTLS_MD5
@@ -348,10 +367,14 @@ config MBEDTLS_SHA512
 config MBEDTLS_POLY1305
 	bool "Poly1305 hash family"
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 endmenu
 
 comment "Random number generators"
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_CTR_DRBG_ENABLED
 	bool "CTR_DRBG AES-256-based random generator"
 	depends on MBEDTLS_CIPHER_AES_ENABLED
@@ -361,15 +384,21 @@ config MBEDTLS_HMAC_DRBG_ENABLED
 	bool "HMAC_DRBG random generator"
 	select MBEDTLS_MD
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 comment "Other configurations"
 
 config MBEDTLS_CIPHER
 	bool "generic cipher layer."
 	default y if PSA_WANT_ALG_CMAC
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_MD
 	bool "generic message digest layer."
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_GENPRIME_ENABLED
 	bool "prime-number generation code."
 
@@ -387,6 +416,8 @@ config MBEDTLS_HAVE_ASM
 	  of asymmetric cryptography, however this might have an impact on the
 	  code size.
 
+if !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_ENTROPY_C
 	bool "Mbed TLS entropy accumulator"
 	depends on MBEDTLS_SHA256 || MBEDTLS_SHA384 || MBEDTLS_SHA512
@@ -395,6 +426,8 @@ config MBEDTLS_ENTROPY_C
 	  mostly used in conjunction with CTR_DRBG or HMAC_DRBG to create
 	  a deterministic random number generator.
 
+endif # !(NRF_SECURITY || NORDIC_SECURITY_BACKEND)
+
 config MBEDTLS_ENTROPY_POLL_ZEPHYR
 	bool "Provide entropy data to Mbed TLS through entropy driver or random generator"
 	depends on MBEDTLS_ENTROPY_C
diff --git a/modules/trusted-firmware-m/Kconfig.tfm.crypto_modules b/modules/trusted-firmware-m/Kconfig.tfm.crypto_modules
index 1d70a2c44d2..9604319ca01 100644
--- a/modules/trusted-firmware-m/Kconfig.tfm.crypto_modules
+++ b/modules/trusted-firmware-m/Kconfig.tfm.crypto_modules
@@ -10,6 +10,7 @@ if TFM_PARTITION_CRYPTO
 config TFM_CRYPTO_RNG_MODULE_ENABLED
 	bool "Random number generator crypto module"
 	default y
+	depends on PSA_WANT_GENERATE_RANDOM && NRF_SECURITY
 	help
 	  Enables the random number generator  module within the crypto partition.
 	  Unset this option if 'psa_generate_random' is not used.
@@ -17,6 +18,7 @@ config TFM_CRYPTO_RNG_MODULE_ENABLED
 config TFM_CRYPTO_KEY_MODULE_ENABLED
 	bool "KEY crypto module"
 	default y
+	depends on PSA_HAS_KEY_SUPPORT && NRF_SECURITY
 	help
 	  Enables the KEY crypto module within the crypto partition.
 	  Unset this option if the functionality provided by 'crypto_key_management.c'
@@ -25,6 +27,7 @@ config TFM_CRYPTO_KEY_MODULE_ENABLED
 config TFM_CRYPTO_AEAD_MODULE_ENABLED
 	bool "AEAD crypto module"
 	default y
+	depends on PSA_HAS_AEAD_SUPPORT && NRF_SECURITY
 	help
 	  Enables the AEAD crypto module within the crypto partition.
 	  Unset this option if the functionality provided by 'crypto_aead.c'
@@ -33,6 +36,7 @@ config TFM_CRYPTO_AEAD_MODULE_ENABLED
 config TFM_CRYPTO_MAC_MODULE_ENABLED
 	bool "MAC crypto module"
 	default y
+	depends on PSA_HAS_MAC_SUPPORT && NRF_SECURITY
 	help
 	  Enables the MAC crypto module within the crypto partition.
 	  Unset this option if the functionality provided by 'crypto_mac.c'
@@ -41,6 +45,7 @@ config TFM_CRYPTO_MAC_MODULE_ENABLED
 config TFM_CRYPTO_HASH_MODULE_ENABLED
 	bool "HASH crypto module"
 	default y
+	depends on PSA_HAS_HASH_SUPPORT && NRF_SECURITY
 	help
 	  Enables the HASH crypto module within the crypto partition.
 	  Unset this option if the functionality provided by 'crypto_hash.c'
@@ -49,6 +54,7 @@ config TFM_CRYPTO_HASH_MODULE_ENABLED
 config TFM_CRYPTO_CIPHER_MODULE_ENABLED
 	bool "CIPHER crypto module"
 	default y
+	depends on PSA_HAS_CIPHER_SUPPORT && NRF_SECURITY
 	help
 	  Enables the CIPHER crypto module within the crypto partition.
 	  Unset this option if the functionality provided by 'crypto_cipher.c'
@@ -57,6 +63,7 @@ config TFM_CRYPTO_CIPHER_MODULE_ENABLED
 config TFM_CRYPTO_ASYM_ENCRYPT_MODULE_ENABLED
 	bool "ASYM ENCRYPT crypto module"
 	default y
+	depends on PSA_HAS_ASYM_ENCRYPT_SUPPORT && NRF_SECURITY
 	help
 	  Enables the ASYM ENCRYPT crypto module within the crypto partition.
 	  Unset this option if the encrypt functionality provided by 'crypto_asymmetric.c'
@@ -65,6 +72,7 @@ config TFM_CRYPTO_ASYM_ENCRYPT_MODULE_ENABLED
 config TFM_CRYPTO_ASYM_SIGN_MODULE_ENABLED
 	bool "ASYM SIGN crypto module"
 	default y
+	depends on PSA_HAS_ASYM_SIGN_SUPPORT && NRF_SECURITY
 	help
 	  Enables the ASYM SIGN crypto module within the crypto partition.
 	  Unset this option if the sign functionality provided by 'crypto_asymmetric.c'
@@ -73,10 +81,23 @@ config TFM_CRYPTO_ASYM_SIGN_MODULE_ENABLED
 config TFM_CRYPTO_KEY_DERIVATION_MODULE_ENABLED
 	bool "KEY DERIVATION crypto module"
 	default y
+	depends on (PSA_HAS_KEY_DERIVATION || PSA_HAS_KEY_AGREEMENT) && NRF_SECURITY
 	help
 	  Enables the KEY_DERIVATION crypto module within the crypto partition.
 	  Unset this option if the functionality provided by 'crypto_key_derivation.c'
 	  is not used.
+	  Note that key agreement is under key derivation in the current implementation.
+
+config TFM_CRYPTO_PAKE_MODULE_ENABLED
+	bool "PAKE crypto module"
+	default y
+	depends on PSA_HAS_PAKE_SUPPORT
+	depends on NRF_SECURITY
+	depends on PSA_CRYPTO_DRIVER_OBERON || PSA_CRYPTO_DRIVER_CRACEN
+	help
+	  Enables the PAKE crypto module within the crypto partition.
+	  Unset this option if the functionality provided by 'crypto_pake.c'
+	  is not used.
 
 endif # TFM_PARTITION_CRYPTO
 
diff --git a/samples/bluetooth/bap_broadcast_sink/sample.yaml b/samples/bluetooth/bap_broadcast_sink/sample.yaml
index b6360768f0a..e19e17d57a0 100644
--- a/samples/bluetooth/bap_broadcast_sink/sample.yaml
+++ b/samples/bluetooth/bap_broadcast_sink/sample.yaml
@@ -24,5 +24,7 @@ tests:
       - nrf52_bsim
       - nrf52833dk/nrf52833
       - nrf52840dongle/nrf52840
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/bap_broadcast_source/sample.yaml b/samples/bluetooth/bap_broadcast_source/sample.yaml
index 27262103b29..4b9b7c705e5 100644
--- a/samples/bluetooth/bap_broadcast_source/sample.yaml
+++ b/samples/bluetooth/bap_broadcast_source/sample.yaml
@@ -25,5 +25,7 @@ tests:
       - nrf52_bsim
       - nrf52833dk/nrf52833
       - nrf52840dongle/nrf52840
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/bap_broadcast_source/sysbuild.cmake b/samples/bluetooth/bap_broadcast_source/sysbuild.cmake
index 2523aac8ea7..d5d260789ff 100644
--- a/samples/bluetooth/bap_broadcast_source/sysbuild.cmake
+++ b/samples/bluetooth/bap_broadcast_source/sysbuild.cmake
@@ -18,6 +18,10 @@ if(SB_CONFIG_NET_CORE_IMAGE_HCI_IPC)
 	 CACHE INTERNAL ""
 	)
 
+	list(APPEND ${NET_APP}_SNIPPET ${SNIPPET})
+	list(APPEND ${NET_APP}_SNIPPET bt-ll-sw-split)
+	set(${NET_APP}_SNIPPET ${${NET_APP}_SNIPPET} CACHE STRING "" FORCE)
+
 	native_simulator_set_child_images(${DEFAULT_IMAGE} ${NET_APP})
 endif()
 
diff --git a/samples/bluetooth/bap_unicast_client/sample.yaml b/samples/bluetooth/bap_unicast_client/sample.yaml
index 536ab9144f0..e69083f2669 100644
--- a/samples/bluetooth/bap_unicast_client/sample.yaml
+++ b/samples/bluetooth/bap_unicast_client/sample.yaml
@@ -22,5 +22,7 @@ tests:
       - nrf52840dk/nrf52840
     integration_platforms:
       - nrf52dk/nrf52832
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/bap_unicast_client/src/stream_tx.c b/samples/bluetooth/bap_unicast_client/src/stream_tx.c
index 06ea3a3c349..eba7273a0c6 100644
--- a/samples/bluetooth/bap_unicast_client/src/stream_tx.c
+++ b/samples/bluetooth/bap_unicast_client/src/stream_tx.c
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include <autoconf.h>
+#include <zephyr/autoconf.h>
 #include <errno.h>
 #include <stdbool.h>
 #include <stddef.h>
diff --git a/samples/bluetooth/bap_unicast_client/sysbuild.cmake b/samples/bluetooth/bap_unicast_client/sysbuild.cmake
index 2523aac8ea7..d5d260789ff 100644
--- a/samples/bluetooth/bap_unicast_client/sysbuild.cmake
+++ b/samples/bluetooth/bap_unicast_client/sysbuild.cmake
@@ -18,6 +18,10 @@ if(SB_CONFIG_NET_CORE_IMAGE_HCI_IPC)
 	 CACHE INTERNAL ""
 	)
 
+	list(APPEND ${NET_APP}_SNIPPET ${SNIPPET})
+	list(APPEND ${NET_APP}_SNIPPET bt-ll-sw-split)
+	set(${NET_APP}_SNIPPET ${${NET_APP}_SNIPPET} CACHE STRING "" FORCE)
+
 	native_simulator_set_child_images(${DEFAULT_IMAGE} ${NET_APP})
 endif()
 
diff --git a/samples/bluetooth/bap_unicast_server/sample.yaml b/samples/bluetooth/bap_unicast_server/sample.yaml
index fc14175a2d1..744833234b9 100644
--- a/samples/bluetooth/bap_unicast_server/sample.yaml
+++ b/samples/bluetooth/bap_unicast_server/sample.yaml
@@ -22,5 +22,7 @@ tests:
       - nrf52840dk/nrf52840
     integration_platforms:
       - nrf52dk/nrf52832
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/bap_unicast_server/sysbuild.cmake b/samples/bluetooth/bap_unicast_server/sysbuild.cmake
index 2523aac8ea7..d5d260789ff 100644
--- a/samples/bluetooth/bap_unicast_server/sysbuild.cmake
+++ b/samples/bluetooth/bap_unicast_server/sysbuild.cmake
@@ -18,6 +18,10 @@ if(SB_CONFIG_NET_CORE_IMAGE_HCI_IPC)
 	 CACHE INTERNAL ""
 	)
 
+	list(APPEND ${NET_APP}_SNIPPET ${SNIPPET})
+	list(APPEND ${NET_APP}_SNIPPET bt-ll-sw-split)
+	set(${NET_APP}_SNIPPET ${${NET_APP}_SNIPPET} CACHE STRING "" FORCE)
+
 	native_simulator_set_child_images(${DEFAULT_IMAGE} ${NET_APP})
 endif()
 
diff --git a/samples/bluetooth/beacon/sample.yaml b/samples/bluetooth/beacon/sample.yaml
index d76a16eb566..a7ac9c0315a 100644
--- a/samples/bluetooth/beacon/sample.yaml
+++ b/samples/bluetooth/beacon/sample.yaml
@@ -16,7 +16,9 @@ tests:
       - nrf52dk/nrf52832
       - nrf54l15pdk/nrf54l15/cpuapp
   sample.bluetooth.beacon-coex:
-    extra_args: CONF_FILE="prj-coex.conf"
+    extra_args:
+      - CONF_FILE="prj-coex.conf"
+      - SNIPPET="bt-ll-sw-split"
     harness: bluetooth
     platform_allow:
       - nrf52840dk/nrf52840
diff --git a/samples/bluetooth/cap_acceptor/src/cap_acceptor_unicast.c b/samples/bluetooth/cap_acceptor/src/cap_acceptor_unicast.c
index cbdb859eb8f..aad077a0aed 100644
--- a/samples/bluetooth/cap_acceptor/src/cap_acceptor_unicast.c
+++ b/samples/bluetooth/cap_acceptor/src/cap_acceptor_unicast.c
@@ -7,7 +7,7 @@
  *  SPDX-License-Identifier: Apache-2.0
  */
 
-#include <autoconf.h>
+#include <zephyr/autoconf.h>
 #include <errno.h>
 #include <stdbool.h>
 #include <stddef.h>
diff --git a/samples/bluetooth/cap_acceptor/src/main.c b/samples/bluetooth/cap_acceptor/src/main.c
index 6ca5f59282e..df4600f09bb 100644
--- a/samples/bluetooth/cap_acceptor/src/main.c
+++ b/samples/bluetooth/cap_acceptor/src/main.c
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include <autoconf.h>
+#include <zephyr/autoconf.h>
 #include <errno.h>
 #include <stdbool.h>
 #include <stddef.h>
diff --git a/samples/bluetooth/cap_initiator/src/cap_initiator_unicast.c b/samples/bluetooth/cap_initiator/src/cap_initiator_unicast.c
index 39b7a68aef6..60509beb258 100644
--- a/samples/bluetooth/cap_initiator/src/cap_initiator_unicast.c
+++ b/samples/bluetooth/cap_initiator/src/cap_initiator_unicast.c
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include <autoconf.h>
+#include <zephyr/autoconf.h>
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
diff --git a/samples/bluetooth/cap_initiator/src/main.c b/samples/bluetooth/cap_initiator/src/main.c
index 1b35ea7981f..8eab76938bc 100644
--- a/samples/bluetooth/cap_initiator/src/main.c
+++ b/samples/bluetooth/cap_initiator/src/main.c
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-#include <autoconf.h>
+#include <zephyr/autoconf.h>
 #include <stddef.h>
 
 #include <zephyr/bluetooth/bluetooth.h>
diff --git a/samples/bluetooth/cap_initiator/sysbuild.cmake b/samples/bluetooth/cap_initiator/sysbuild.cmake
index 2523aac8ea7..d5d260789ff 100644
--- a/samples/bluetooth/cap_initiator/sysbuild.cmake
+++ b/samples/bluetooth/cap_initiator/sysbuild.cmake
@@ -18,6 +18,10 @@ if(SB_CONFIG_NET_CORE_IMAGE_HCI_IPC)
 	 CACHE INTERNAL ""
 	)
 
+	list(APPEND ${NET_APP}_SNIPPET ${SNIPPET})
+	list(APPEND ${NET_APP}_SNIPPET bt-ll-sw-split)
+	set(${NET_APP}_SNIPPET ${${NET_APP}_SNIPPET} CACHE STRING "" FORCE)
+
 	native_simulator_set_child_images(${DEFAULT_IMAGE} ${NET_APP})
 endif()
 
diff --git a/samples/bluetooth/direction_finding_central/sample.yaml b/samples/bluetooth/direction_finding_central/sample.yaml
index b0c94537b51..c1d1adae2c4 100644
--- a/samples/bluetooth/direction_finding_central/sample.yaml
+++ b/samples/bluetooth/direction_finding_central/sample.yaml
@@ -14,15 +14,24 @@ tests:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
       - nrf5340dk/nrf5340/cpuapp
-  sample.bluetooth.direction_finding.central.aod:
+  sample.bluetooth.direction_finding.central.aod_with_controller:
     harness: bluetooth
-    extra_args: OVERLAY_CONFIG="overlay-aod.conf"
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aod.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
-      - nrf5340dk/nrf5340/cpuapp
     tags: bluetooth
     integration_platforms:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
+  sample.bluetooth.direction_finding.central.aod_host_only:
+    harness: bluetooth
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aod.conf"
+    platform_allow:
+      - nrf5340dk/nrf5340/cpuapp
+    tags: bluetooth
+    integration_platforms:
       - nrf5340dk/nrf5340/cpuapp
diff --git a/samples/bluetooth/direction_finding_connectionless_rx/sample.yaml b/samples/bluetooth/direction_finding_connectionless_rx/sample.yaml
index 1c79df41275..97d4fea9e69 100644
--- a/samples/bluetooth/direction_finding_connectionless_rx/sample.yaml
+++ b/samples/bluetooth/direction_finding_connectionless_rx/sample.yaml
@@ -12,14 +12,22 @@ tests:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
       - nrf5340dk/nrf5340/cpuapp
-  sample.bluetooth.direction_finding_connectionless_rx.aod:
+  sample.bluetooth.direction_finding_connectionless_rx.aod_with_controller:
     harness: bluetooth
-    extra_args: OVERLAY_CONFIG="overlay-aod.conf"
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aod.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
-      - nrf5340dk/nrf5340/cpuapp
     integration_platforms:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
+  sample.bluetooth.direction_finding_connectionless_rx.aod_host_only:
+    harness: bluetooth
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aod.conf"
+    platform_allow:
+      - nrf5340dk/nrf5340/cpuapp
+    integration_platforms:
       - nrf5340dk/nrf5340/cpuapp
diff --git a/samples/bluetooth/direction_finding_connectionless_tx/sample.yaml b/samples/bluetooth/direction_finding_connectionless_tx/sample.yaml
index 1ea189f5088..e1833b9be8a 100644
--- a/samples/bluetooth/direction_finding_connectionless_tx/sample.yaml
+++ b/samples/bluetooth/direction_finding_connectionless_tx/sample.yaml
@@ -12,14 +12,22 @@ tests:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
       - nrf5340dk/nrf5340/cpuapp
-  sample.bluetooth.direction_finding_connectionless.aoa:
+  sample.bluetooth.direction_finding_connectionless.aoa_with_controller:
     harness: bluetooth
-    extra_args: OVERLAY_CONFIG="overlay-aoa.conf"
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aoa.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
-      - nrf5340dk/nrf5340/cpuapp
     integration_platforms:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
+  sample.bluetooth.direction_finding_connectionless.aoa_host_only:
+    harness: bluetooth
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aoa.conf"
+    platform_allow:
+      - nrf5340dk/nrf5340/cpuapp
+    integration_platforms:
       - nrf5340dk/nrf5340/cpuapp
diff --git a/samples/bluetooth/direction_finding_peripheral/sample.yaml b/samples/bluetooth/direction_finding_peripheral/sample.yaml
index 126355a735f..00a8c0b79d1 100644
--- a/samples/bluetooth/direction_finding_peripheral/sample.yaml
+++ b/samples/bluetooth/direction_finding_peripheral/sample.yaml
@@ -14,15 +14,24 @@ tests:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
       - nrf5340dk/nrf5340/cpuapp
-  sample.bluetooth.direction_finding.peripheral.aod:
+  sample.bluetooth.direction_finding.peripheral.aod_with_controller:
     harness: bluetooth
-    extra_args: OVERLAY_CONFIG="overlay-aoa.conf"
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aoa.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
-      - nrf5340dk/nrf5340/cpuapp
     tags: bluetooth
     integration_platforms:
       - nrf52833dk/nrf52833
       - nrf52833dk/nrf52820
+  sample.bluetooth.direction_finding.peripheral.aod_host_only:
+    harness: bluetooth
+    extra_args:
+      - OVERLAY_CONFIG="overlay-aoa.conf"
+    platform_allow:
+      - nrf5340dk/nrf5340/cpuapp
+    tags: bluetooth
+    integration_platforms:
       - nrf5340dk/nrf5340/cpuapp
diff --git a/samples/bluetooth/hci_ipc/sample.yaml b/samples/bluetooth/hci_ipc/sample.yaml
index e88726aa45f..15d47e6866e 100644
--- a/samples/bluetooth/hci_ipc/sample.yaml
+++ b/samples/bluetooth/hci_ipc/sample.yaml
@@ -15,7 +15,9 @@ tests:
   sample.bluetooth.hci_ipc.iso_broadcast.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_iso_broadcast-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_iso_broadcast-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340_audio_dk/nrf5340/cpunet
@@ -26,7 +28,9 @@ tests:
   sample.bluetooth.hci_ipc.iso_receive.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_iso_receive-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_iso_receive-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340_audio_dk/nrf5340/cpunet
@@ -36,7 +40,9 @@ tests:
   sample.bluetooth.hci_ipc.bis.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_bis-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_bis-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340_audio_dk/nrf5340/cpunet
@@ -46,7 +52,9 @@ tests:
   sample.bluetooth.hci_ipc.iso_central.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_iso_central-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_iso_central-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340_audio_dk/nrf5340/cpunet
@@ -56,7 +64,9 @@ tests:
   sample.bluetooth.hci_ipc.iso_peripheral.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_iso_peripheral-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_iso_peripheral-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340_audio_dk/nrf5340/cpunet
@@ -66,7 +76,9 @@ tests:
   sample.bluetooth.hci_ipc.cis.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_cis-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_cis-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340_audio_dk/nrf5340/cpunet
@@ -76,7 +88,9 @@ tests:
   sample.bluetooth.hci_ipc.iso.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_iso-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_iso-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf5340bsim/nrf5340/cpunet
@@ -88,6 +102,7 @@ tests:
     extra_args:
       - CONF_FILE="nrf5340_cpunet_df-bt_ll_sw_split.conf"
       - DTC_OVERLAY_FILE="nrf5340_cpunet_df-bt_ll_sw_split.overlay"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow: nrf5340dk/nrf5340/cpunet
     integration_platforms:
       - nrf5340dk/nrf5340/cpunet
@@ -98,13 +113,16 @@ tests:
       - CONF_FILE="nrf5340_cpunet_df-bt_ll_sw_split.conf"
       - DTC_OVERLAY_FILE="nrf5340_cpunet_df-bt_ll_sw_split.overlay"
       - CONFIG_BT_CTLR_PHY_CODED=n
+      - SNIPPET="bt-ll-sw-split"
     platform_allow: nrf5340dk/nrf5340/cpunet
     integration_platforms:
       - nrf5340dk/nrf5340/cpunet
   sample.bluetooth.hci_ipc.mesh.bt_ll_sw_split:
     harness: bluetooth
     tags: bluetooth
-    extra_args: CONF_FILE="nrf5340_cpunet_bt_mesh-bt_ll_sw_split.conf"
+    extra_args:
+      - CONF_FILE="nrf5340_cpunet_bt_mesh-bt_ll_sw_split.conf"
+      - SNIPPET="bt-ll-sw-split"
     platform_allow: nrf5340dk/nrf5340/cpunet
     integration_platforms:
       - nrf5340dk/nrf5340/cpunet
diff --git a/samples/bluetooth/hci_pwr_ctrl/sysbuild/hci_rpmsg.conf b/samples/bluetooth/hci_pwr_ctrl/sysbuild/hci_rpmsg.conf
new file mode 100644
index 00000000000..e6749ae6399
--- /dev/null
+++ b/samples/bluetooth/hci_pwr_ctrl/sysbuild/hci_rpmsg.conf
@@ -0,0 +1 @@
+CONFIG_BT_CTLR_TX_PWR_DYNAMIC_CONTROL=y
diff --git a/samples/bluetooth/hci_vs_scan_req/sample.yaml b/samples/bluetooth/hci_vs_scan_req/sample.yaml
index 245a83aa0d9..49526522d16 100644
--- a/samples/bluetooth/hci_vs_scan_req/sample.yaml
+++ b/samples/bluetooth/hci_vs_scan_req/sample.yaml
@@ -9,4 +9,6 @@ tests:
       - nrf52dk/nrf52832
     extra_configs:
       - CONFIG_BT_LL_SW_SPLIT=y
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/iso_central/sample.yaml b/samples/bluetooth/iso_central/sample.yaml
index d4350e0d9cf..fd5ec7ac4fe 100644
--- a/samples/bluetooth/iso_central/sample.yaml
+++ b/samples/bluetooth/iso_central/sample.yaml
@@ -11,11 +11,11 @@ tests:
   sample.bluetooth.iso_central.bt_ll_sw_split:
     harness: bluetooth
     platform_allow:
-      - qemu_cortex_m3
-      - qemu_x86
       - nrf52_bsim
       - nrf52833dk/nrf52833
     integration_platforms:
       - nrf52833dk/nrf52833
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/pbp_public_broadcast_sink/sample.yaml b/samples/bluetooth/pbp_public_broadcast_sink/sample.yaml
index 2c4d31fd4b9..daa63336080 100644
--- a/samples/bluetooth/pbp_public_broadcast_sink/sample.yaml
+++ b/samples/bluetooth/pbp_public_broadcast_sink/sample.yaml
@@ -23,5 +23,7 @@ tests:
     integration_platforms:
       - nrf52_bsim
       - nrf52833dk/nrf52833
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/pbp_public_broadcast_sink/sysbuild.cmake b/samples/bluetooth/pbp_public_broadcast_sink/sysbuild.cmake
index 2523aac8ea7..d5d260789ff 100644
--- a/samples/bluetooth/pbp_public_broadcast_sink/sysbuild.cmake
+++ b/samples/bluetooth/pbp_public_broadcast_sink/sysbuild.cmake
@@ -18,6 +18,10 @@ if(SB_CONFIG_NET_CORE_IMAGE_HCI_IPC)
 	 CACHE INTERNAL ""
 	)
 
+	list(APPEND ${NET_APP}_SNIPPET ${SNIPPET})
+	list(APPEND ${NET_APP}_SNIPPET bt-ll-sw-split)
+	set(${NET_APP}_SNIPPET ${${NET_APP}_SNIPPET} CACHE STRING "" FORCE)
+
 	native_simulator_set_child_images(${DEFAULT_IMAGE} ${NET_APP})
 endif()
 
diff --git a/samples/bluetooth/pbp_public_broadcast_source/sample.yaml b/samples/bluetooth/pbp_public_broadcast_source/sample.yaml
index 31809027f29..75cdc80ec6f 100644
--- a/samples/bluetooth/pbp_public_broadcast_source/sample.yaml
+++ b/samples/bluetooth/pbp_public_broadcast_source/sample.yaml
@@ -23,5 +23,7 @@ tests:
     integration_platforms:
       - nrf52_bsim
       - nrf52833dk/nrf52833
-    extra_args: OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+    extra_args:
+      - OVERLAY_CONFIG=overlay-bt_ll_sw_split.conf
+      - SNIPPET="bt-ll-sw-split"
     tags: bluetooth
diff --git a/samples/bluetooth/pbp_public_broadcast_source/sysbuild.cmake b/samples/bluetooth/pbp_public_broadcast_source/sysbuild.cmake
index d3bf7be5b6c..e0a7fd9d175 100644
--- a/samples/bluetooth/pbp_public_broadcast_source/sysbuild.cmake
+++ b/samples/bluetooth/pbp_public_broadcast_source/sysbuild.cmake
@@ -18,6 +18,10 @@ if(NOT("${SB_CONFIG_NET_CORE_BOARD}" STREQUAL ""))
 	 CACHE INTERNAL ""
 	)
 
+	list(APPEND ${NET_APP}_SNIPPET ${SNIPPET})
+	list(APPEND ${NET_APP}_SNIPPET bt-ll-sw-split)
+	set(${NET_APP}_SNIPPET ${${NET_APP}_SNIPPET} CACHE STRING "" FORCE)
+
 	native_simulator_set_child_images(${DEFAULT_IMAGE} ${NET_APP})
 endif()
 
diff --git a/samples/boards/nordic/nrf53_sync_rtc/sysbuild.conf b/samples/boards/nordic/nrf53_sync_rtc/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/samples/boards/nordic/nrf53_sync_rtc/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/samples/drivers/mbox/sysbuild.conf b/samples/drivers/mbox/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/samples/drivers/mbox/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/samples/net/dhcpv4_client/overlay-nrf700x.conf b/samples/net/dhcpv4_client/overlay-nrf700x.conf
new file mode 100644
index 00000000000..2d552e9c623
--- /dev/null
+++ b/samples/net/dhcpv4_client/overlay-nrf700x.conf
@@ -0,0 +1,14 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/dns_resolve/overlay-nrf700x.conf b/samples/net/dns_resolve/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/dns_resolve/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/ipv4_autoconf/overlay-nrf700x.conf b/samples/net/ipv4_autoconf/overlay-nrf700x.conf
new file mode 100644
index 00000000000..2d552e9c623
--- /dev/null
+++ b/samples/net/ipv4_autoconf/overlay-nrf700x.conf
@@ -0,0 +1,14 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/lwm2m_client/overlay-nrf700x.conf b/samples/net/lwm2m_client/overlay-nrf700x.conf
new file mode 100644
index 00000000000..2409886fe42
--- /dev/null
+++ b/samples/net/lwm2m_client/overlay-nrf700x.conf
@@ -0,0 +1,68 @@
+# General
+CONFIG_MAIN_STACK_SIZE=4096
+CONFIG_ENTROPY_GENERATOR=y
+CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
+
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WIFI_MGMT_EXT=y
+CONFIG_NRF_WIFI_IF_AUTO_START=n
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
+
+# WPA
+CONFIG_WPA_SUPP=y
+CONFIG_WPA_SUPP_LOG_LEVEL_ERR=y
+
+CONFIG_NET_NATIVE=y
+CONFIG_NET_L2_ETHERNET=y
+CONFIG_NET_UDP=y
+CONFIG_NET_SOCKETS=y
+CONFIG_NET_SOCKETS_OFFLOAD=n
+CONFIG_NET_BUF_RX_COUNT=18
+CONFIG_NET_BUF_TX_COUNT=18
+CONFIG_NET_DEFAULT_IF_WIFI=y
+
+# DNS
+CONFIG_DNS_RESOLVER=y
+
+# DHCPv4
+CONFIG_NET_DHCPV4=y
+CONFIG_NET_CONFIG_AUTO_INIT=n
+CONFIG_NET_CONFIG_NEED_IPV6=n
+CONFIG_NET_CONFIG_NEED_IPV4=n
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Zephyr NET Connection Manager Connectivity layer.
+CONFIG_L2_WIFI_CONNECTIVITY=y
+CONFIG_L2_WIFI_CONNECTIVITY_AUTO_DOWN=n
+CONFIG_L2_WIFI_CONNECTIVITY_AUTO_CONNECT=n
+
+CONFIG_LWM2M_APP_ID="nrf700x"
+CONFIG_LWM2M_APP_SERVER="coaps://leshan.eclipseprojects.io:5684"
+CONFIG_LWM2M_DNS_SUPPORT=y
+
+# Enable DTLS support
+CONFIG_LWM2M_DTLS_SUPPORT=y
+CONFIG_LWM2M_TLS_SESSION_CACHING=y
+
+# TLS networking
+CONFIG_NET_SOCKETS_ENABLE_DTLS=y
+CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=4
+CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
+
+# nRF Security
+CONFIG_NRF_SECURITY=y
+
+# mbedTLS
+CONFIG_MBEDTLS=y
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=120000
+CONFIG_MBEDTLS_RSA_C=y
diff --git a/samples/net/lwm2m_client/overlay-nrf91x.conf b/samples/net/lwm2m_client/overlay-nrf91x.conf
new file mode 100644
index 00000000000..9597791c10e
--- /dev/null
+++ b/samples/net/lwm2m_client/overlay-nrf91x.conf
@@ -0,0 +1,53 @@
+# Configuration file for nRF91x
+# This file is merged with prj.conf in the application folder, and options
+# set here will take precedence if they are present in both files.
+
+# General
+CONFIG_MAIN_STACK_SIZE=4096
+
+CONFIG_NET_SOCKETS=y
+CONFIG_NET_NATIVE=y
+CONFIG_NET_SOCKETS_OFFLOAD=y
+
+CONFIG_NET_CONFIG_MY_IPV6_ADDR=""
+CONFIG_NET_CONFIG_PEER_IPV6_ADDR=""
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_CONFIG_MY_IPV4_GW=""
+
+CONFIG_NET_CONFIG_NEED_IPV6=n
+CONFIG_NET_CONFIG_NEED_IPV4=n
+CONFIG_NET_CONFIG_AUTO_INIT=n
+
+# Modem related configurations
+CONFIG_NRF_MODEM_LIB_NET_IF=y
+CONFIG_NRF_MODEM_LIB_NET_IF_AUTO_DOWN=n
+CONFIG_NRF_MODEM_LIB_NET_IF_AUTO_CONNECT=n
+CONFIG_NRF_MODEM_LIB_NET_IF_AUTO_START=n
+CONFIG_NRF_MODEM_LIB_ON_FAULT_APPLICATION_SPECIFIC=y
+
+CONFIG_LTE_LINK_CONTROL_LOG_LEVEL_DBG=n
+CONFIG_NRF_MODEM_LIB_NET_IF_LOG_LEVEL_DBG=n
+
+# Disable Duplicate Address Detection (DAD)
+# due to not being properly implemented for offloaded interfaces.
+CONFIG_NET_IPV6_NBR_CACHE=n
+CONFIG_NET_IPV6_MLD=n
+
+# Zephyr NET Connection Manager and Connectivity layer.
+CONFIG_NET_CONNECTION_MANAGER=y
+CONFIG_NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE=1024
+
+CONFIG_LWM2M_APP_ID="nrf91x"
+CONFIG_LWM2M_APP_SERVER="coaps://leshan.eclipseprojects.io:5684"
+CONFIG_LWM2M_DNS_SUPPORT=y
+
+## Enable DTLS support
+CONFIG_LWM2M_DTLS_SUPPORT=y
+CONFIG_LWM2M_TLS_SESSION_CACHING=y
+CONFIG_LWM2M_DTLS_CID=y
+CONFIG_TLS_CREDENTIALS=y
+
+## Crypto
+CONFIG_OBERON_BACKEND=y
+CONFIG_NORDIC_SECURITY_BACKEND=y
+CONFIG_MBEDTLS_SHA256_C=y
diff --git a/samples/net/mdns_responder/overlay-nrf700x.conf b/samples/net/mdns_responder/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/mdns_responder/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/mqtt_publisher/overlay-nrf700x.conf b/samples/net/mqtt_publisher/overlay-nrf700x.conf
new file mode 100644
index 00000000000..a812c7896f6
--- /dev/null
+++ b/samples/net/mqtt_publisher/overlay-nrf700x.conf
@@ -0,0 +1,19 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_CONFIG_NEED_IPV4=y
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/mqtt_sn_publisher/overlay-nrf700x.conf b/samples/net/mqtt_sn_publisher/overlay-nrf700x.conf
new file mode 100644
index 00000000000..cbc47b96572
--- /dev/null
+++ b/samples/net/mqtt_sn_publisher/overlay-nrf700x.conf
@@ -0,0 +1,20 @@
+CONFIG_POSIX_MAX_FDS=16
+
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/big_http_download/prj.conf b/samples/net/sockets/big_http_download/prj.conf
index a406f314dfb..8677e7113e4 100644
--- a/samples/net/sockets/big_http_download/prj.conf
+++ b/samples/net/sockets/big_http_download/prj.conf
@@ -3,6 +3,7 @@ CONFIG_REQUIRES_FULL_LIBC=y
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_ENABLE_HEAP=y
 CONFIG_MBEDTLS_MD=y
+CONFIG_MBEDTLS_LEGACY_CRYPTO_C=y
 CONFIG_MAIN_STACK_SIZE=2536
 
 # Networking config
diff --git a/samples/net/sockets/coap_client/overlay-nrf700x.conf b/samples/net/sockets/coap_client/overlay-nrf700x.conf
new file mode 100644
index 00000000000..a0e436e3537
--- /dev/null
+++ b/samples/net/sockets/coap_client/overlay-nrf700x.conf
@@ -0,0 +1,16 @@
+CONFIG_HEAP_MEM_POOL_SIZE=153000
+
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/coap_server/overlay-nrf700x.conf b/samples/net/sockets/coap_server/overlay-nrf700x.conf
new file mode 100644
index 00000000000..4817a4f73ba
--- /dev/null
+++ b/samples/net/sockets/coap_server/overlay-nrf700x.conf
@@ -0,0 +1,26 @@
+CONFIG_HEAP_MEM_POOL_SIZE=153000
+
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# The sample can run either IPv4 or IPv6, not both
+CONFIG_NET_IPV6=n
+CONFIG_NET_CONFIG_NEED_IPV6=n
+CONFIG_NET_IPV4=y
+CONFIG_NET_CONFIG_NEED_IPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/echo/overlay-nrf700x.conf b/samples/net/sockets/echo/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/sockets/echo/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/echo_async/overlay-nrf700x.conf b/samples/net/sockets/echo_async/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/sockets/echo_async/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/echo_client/overlay-nrf700x.conf b/samples/net/sockets/echo_client/overlay-nrf700x.conf
new file mode 100644
index 00000000000..cbc47b96572
--- /dev/null
+++ b/samples/net/sockets/echo_client/overlay-nrf700x.conf
@@ -0,0 +1,20 @@
+CONFIG_POSIX_MAX_FDS=16
+
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/echo_server/overlay-nrf700x.conf b/samples/net/sockets/echo_server/overlay-nrf700x.conf
new file mode 100644
index 00000000000..cbc47b96572
--- /dev/null
+++ b/samples/net/sockets/echo_server/overlay-nrf700x.conf
@@ -0,0 +1,20 @@
+CONFIG_POSIX_MAX_FDS=16
+
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/http_get/overlay-nrf700x.conf b/samples/net/sockets/http_get/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/sockets/http_get/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/sockets/sntp_client/overlay-nrf700x.conf b/samples/net/sockets/sntp_client/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/sockets/sntp_client/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/syslog_net/overlay-nrf700x.conf b/samples/net/syslog_net/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/syslog_net/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/telnet/overlay-nrf700x.conf b/samples/net/telnet/overlay-nrf700x.conf
new file mode 100644
index 00000000000..aa59e5d5ea2
--- /dev/null
+++ b/samples/net/telnet/overlay-nrf700x.conf
@@ -0,0 +1,18 @@
+# Wi-Fi
+CONFIG_WIFI=y
+CONFIG_WIFI_NRF700X=y
+CONFIG_WPA_SUPP=y
+CONFIG_NET_L2_ETHERNET=y
+
+# DHCPv4
+CONFIG_NET_CONFIG_MY_IPV4_ADDR=""
+CONFIG_NET_DHCPV4=y
+
+# Connection manager
+CONFIG_NET_CONNECTION_MANAGER=y
+
+# Credentials
+CONFIG_WIFI_CREDENTIALS=y
+CONFIG_WIFI_CREDENTIALS_STATIC=y
+CONFIG_WIFI_CREDENTIALS_STATIC_SSID=""
+CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD=""
diff --git a/samples/net/wifi/sample.yaml b/samples/net/wifi/sample.yaml
index 694a4d68f92..1c106e4897a 100644
--- a/samples/net/wifi/sample.yaml
+++ b/samples/net/wifi/sample.yaml
@@ -62,3 +62,11 @@ tests:
     integration_platforms:
       - nrf5340dk/nrf5340/cpuapp
       - nucleo_h723zg
+  sample.net.wifi.nrf7002eb:
+    extra_args:
+      - CONFIG_NRF_WIFI_BUILD_ONLY_MODE=y
+      - SHIELD=nrf7002eb
+    platform_allow:
+      - thingy53/nrf5340/cpuapp
+    integration_platforms:
+      - thingy53/nrf5340/cpuapp
diff --git a/samples/subsys/ipc/ipc_service/icmsg/sysbuild.conf b/samples/subsys/ipc/ipc_service/icmsg/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/samples/subsys/ipc/ipc_service/icmsg/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/samples/subsys/ipc/ipc_service/multi_endpoint/sysbuild.conf b/samples/subsys/ipc/ipc_service/multi_endpoint/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/samples/subsys/ipc/ipc_service/multi_endpoint/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/samples/subsys/ipc/ipc_service/static_vrings/sysbuild.conf b/samples/subsys/ipc/ipc_service/static_vrings/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/samples/subsys/ipc/ipc_service/static_vrings/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/samples/subsys/logging/multidomain/sysbuild.conf b/samples/subsys/logging/multidomain/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/samples/subsys/logging/multidomain/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/samples/subsys/mgmt/mcumgr/smp_svr/boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay b/samples/subsys/mgmt/mcumgr/smp_svr/boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay
new file mode 100644
index 00000000000..ddbd39f4bde
--- /dev/null
+++ b/samples/subsys/mgmt/mcumgr/smp_svr/boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay
@@ -0,0 +1,46 @@
+/ {
+	chosen {
+		nordic,pm-ext-flash = &mx25r64;
+	};
+};
+
+/delete-node/ &boot_partition;
+/delete-node/ &slot0_partition;
+/delete-node/ &slot1_partition;
+
+/delete-node/ &slot0_ns_partition;
+/delete-node/ &slot1_ns_partition;
+
+/delete-node/ &storage_partition;
+
+&cpuapp_rram {
+	reg = < 0x0 DT_SIZE_K(1524) >;
+	partitions {
+		boot_partition: partition@0 {
+			label = "mcuboot";
+			reg = <0x000000000 0x00014000>;
+		};
+		slot0_partition: partition@14000 {
+			label = "image-0";
+			reg = <0x000014000 0x0015A000>;
+		};
+		storage_partition: partition@16E000 {
+			label = "storage";
+			reg = < 0x16E000 0x9000 >;
+		};
+	};
+};
+
+&mx25r64 {
+	status = "okay";
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		slot1_partition: partition@0 {
+			label = "image-1";
+			reg = <0x000000000 0x0015A000>;
+		};
+	};
+};
diff --git a/samples/subsys/mgmt/mcumgr/smp_svr/sample.yaml b/samples/subsys/mgmt/mcumgr/smp_svr/sample.yaml
index 6a3669b2438..3aa3ca449e5 100644
--- a/samples/subsys/mgmt/mcumgr/smp_svr/sample.yaml
+++ b/samples/subsys/mgmt/mcumgr/smp_svr/sample.yaml
@@ -12,9 +12,11 @@ tests:
       - nrf52840dk/nrf52840
       - pinnacle_100_dvk
       - mg100
+      - nrf54l15pdk/nrf54l15/cpuapp
     integration_platforms:
       - nrf52dk/nrf52832
       - nrf52840dk/nrf52840
+      - nrf54l15pdk/nrf54l15/cpuapp
   sample.mcumgr.smp_svr.bt_static_svc:
     extra_args: OVERLAY_CONFIG="overlay-bt.conf"
     extra_configs:
@@ -102,3 +104,26 @@ tests:
       - mg100
     integration_platforms:
       - nrf52840dk/nrf52840
+  sample.mcumgr.smp_svr.bt.nrf54l15pdk.ext_flash:
+    extra_args:
+      - OVERLAY_CONFIG="overlay-bt.conf"
+      - DTC_OVERLAY_FILE="boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay"
+      - mcuboot_CONF_FILE="boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.conf"
+      - mcuboot_EXTRA_DTC_OVERLAY_FILE="boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay"
+    extra_configs:
+      - CONFIG_PM_OVERRIDE_EXTERNAL_DRIVER_CHECK=y
+    platform_allow:
+      - nrf54l15pdk/nrf54l15/cpuapp
+    integration_platforms:
+      - nrf54l15pdk/nrf54l15/cpuapp
+  sample.mcumgr.smp_svr.bt.nrf54l15pdk.ext_flash.pure_dts:
+    extra_args:
+      - OVERLAY_CONFIG="overlay-bt.conf"
+      - DTC_OVERLAY_FILE="boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay"
+      - mcuboot_CONF_FILE="boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.conf"
+      - mcuboot_EXTRA_DTC_OVERLAY_FILE="boards/nrf54l15pdk_nrf54l15_cpuapp_ext_flash.overlay"
+      - SB_CONFIG_PARTITION_MANAGER=n
+    platform_allow:
+      - nrf54l15pdk/nrf54l15/cpuapp
+    integration_platforms:
+      - nrf54l15pdk/nrf54l15/cpuapp
diff --git a/samples/subsys/mgmt/mcumgr/smp_svr/sysbuild/hci_rpmsg.conf b/samples/subsys/mgmt/mcumgr/smp_svr/sysbuild/hci_rpmsg.conf
new file mode 100644
index 00000000000..98260877332
--- /dev/null
+++ b/samples/subsys/mgmt/mcumgr/smp_svr/sysbuild/hci_rpmsg.conf
@@ -0,0 +1,10 @@
+#
+# Copyright (c) 2022 Nordic Semiconductor
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+CONFIG_BT_MAX_CONN=2
+CONFIG_BT_BUF_ACL_RX_SIZE=502
+CONFIG_BT_BUF_ACL_TX_SIZE=502
+CONFIG_BT_CTLR_DATA_LENGTH_MAX=251
diff --git a/samples/sysbuild/hello_world/sysbuild.cmake b/samples/sysbuild/hello_world/sysbuild.cmake
index c7c2615c665..01fd1949274 100644
--- a/samples/sysbuild/hello_world/sysbuild.cmake
+++ b/samples/sysbuild/hello_world/sysbuild.cmake
@@ -13,3 +13,10 @@ ExternalZephyrProject_Add(
 
 add_dependencies(${DEFAULT_IMAGE} remote)
 sysbuild_add_dependencies(FLASH ${DEFAULT_IMAGE} remote)
+
+if(SB_CONFIG_SOC_SERIES_NRF53X)
+  set_property(GLOBAL APPEND PROPERTY PM_DOMAINS CPUNET)
+  set_property(GLOBAL APPEND PROPERTY PM_CPUNET_IMAGES remote)
+  set_property(GLOBAL PROPERTY DOMAIN_APP_CPUNET remote)
+  set(CPUNET_PM_DOMAIN_DYNAMIC_PARTITION remote CACHE INTERNAL "")
+endif()
diff --git a/samples/tfm_integration/psa_crypto/sample.yaml b/samples/tfm_integration/psa_crypto/sample.yaml
index 37a6aeaf234..9f067c7be0d 100644
--- a/samples/tfm_integration/psa_crypto/sample.yaml
+++ b/samples/tfm_integration/psa_crypto/sample.yaml
@@ -16,8 +16,6 @@ tests:
     platform_allow:
       - mps2/an521/cpu0/ns
       - v2m_musca_s1/musca_s1/ns
-      - nrf5340dk/nrf5340/cpuapp/ns
-      - nrf9160dk/nrf9160/ns
       - stm32l562e_dk/stm32l562xx/ns
       - bl5340_dvk/nrf5340/cpuapp/ns
     harness: console
diff --git a/scripts/ci/check_compliance.py b/scripts/ci/check_compliance.py
index 1a45e32a741..3b9439a6d96 100755
--- a/scripts/ci/check_compliance.py
+++ b/scripts/ci/check_compliance.py
@@ -408,6 +408,13 @@ def get_modules(self, modules_file, settings_file):
         modules = [name for name in os.listdir(modules_dir) if
                    os.path.exists(os.path.join(modules_dir, name, 'Kconfig'))]
 
+        nrf_modules_dir = ZEPHYR_BASE + '/../nrf/modules'
+        nrf_modules = []
+        if os.path.exists(nrf_modules_dir):
+            nrf_modules = [name for name in os.listdir(nrf_modules_dir) if
+                           os.path.exists(os.path.join(nrf_modules_dir, name,
+                                                       'Kconfig'))]
+
         with open(modules_file, 'r') as fp_module_file:
             content = fp_module_file.read()
 
@@ -417,6 +424,15 @@ def get_modules(self, modules_file, settings_file):
                     re.sub('[^a-zA-Z0-9]', '_', module).upper(),
                     modules_dir + '/' + module + '/Kconfig'
                 ))
+            for module in nrf_modules:
+                fp_module_file.write("ZEPHYR_{}_KCONFIG = {}\n".format(
+                    re.sub('[^a-zA-Z0-9]', '_', module).upper(),
+                    nrf_modules_dir + '/' + module + '/Kconfig'
+                ))
+                fp_module_file.write("NCS_{}_KCONFIG = {}\n".format(
+                    re.sub('[^a-zA-Z0-9]', '_', module).upper(),
+                    modules_dir + '/' + module + '/Kconfig'
+                ))
             fp_module_file.write(content)
 
     def get_module_setting_root(self, root, settings_file):
@@ -511,12 +527,14 @@ def get_v2_model(self, kconfig_dir, settings_file):
         soc_roots = self.get_module_setting_root('soc', settings_file)
         soc_roots.insert(0, Path(ZEPHYR_BASE))
         root_args = argparse.Namespace(**{'board_roots': board_roots,
-                                          'soc_roots': soc_roots, 'board': None})
-        v2_boards = list_boards.find_v2_boards(root_args)
+                                          'soc_roots': soc_roots, 'board': None,
+                                          'board_dir': []})
+        v2_boards = list_boards.find_v2_boards(root_args).values()
 
         with open(kconfig_defconfig_file, 'w') as fp:
             for board in v2_boards:
-                fp.write('osource "' + (Path(board.dir) / 'Kconfig.defconfig').as_posix() + '"\n')
+                fp.write('osource "' +
+                         (board.directories[0] / 'Kconfig.defconfig').as_posix() + '"\n')
 
         with open(kconfig_boards_file, 'w') as fp:
             for board in v2_boards:
@@ -529,7 +547,8 @@ def get_v2_model(self, kconfig_dir, settings_file):
                     fp.write('config  ' + board_str + '\n')
                     fp.write('\t bool\n')
                 fp.write(
-                    'source "' + (Path(board.dir) / ('Kconfig.' + board.name)).as_posix() + '"\n\n'
+                    'source "' +
+                    (board.directories[0] / ('Kconfig.' + board.name)).as_posix() + '"\n\n'
                 )
 
         with open(kconfig_file, 'w') as fp:
@@ -537,7 +556,7 @@ def get_v2_model(self, kconfig_dir, settings_file):
                 'osource "' + (Path(kconfig_dir) / 'boards' / 'Kconfig.syms.v1').as_posix() + '"\n'
             )
             for board in v2_boards:
-                fp.write('osource "' + (Path(board.dir) / 'Kconfig').as_posix() + '"\n')
+                fp.write('osource "' + (Path(board.directories[0]) / 'Kconfig').as_posix() + '"\n')
 
         kconfig_defconfig_file = os.path.join(kconfig_dir, 'soc', 'Kconfig.defconfig')
         kconfig_soc_file = os.path.join(kconfig_dir, 'soc', 'Kconfig.soc')
@@ -546,7 +565,7 @@ def get_v2_model(self, kconfig_dir, settings_file):
         root_args = argparse.Namespace(**{'soc_roots': soc_roots})
         v2_systems = list_hardware.find_v2_systems(root_args)
 
-        soc_folders = {soc.folder for soc in v2_systems.get_socs()}
+        soc_folders = {soc.folder[0] for soc in v2_systems.get_socs()}
         with open(kconfig_defconfig_file, 'w') as fp:
             for folder in soc_folders:
                 fp.write('osource "' + (Path(folder) / 'Kconfig.defconfig').as_posix() + '"\n')
@@ -616,7 +635,7 @@ def parse_kconfig(self, filename="Kconfig", hwm=None):
         os.makedirs(os.path.join(kconfiglib_dir, 'soc'), exist_ok=True)
         os.makedirs(os.path.join(kconfiglib_dir, 'arch'), exist_ok=True)
 
-        os.environ["BOARD_DIR"] = kconfiglib_boards_dir
+        os.environ["KCONFIG_BOARD_DIR"] = kconfiglib_boards_dir
         self.get_v2_model(kconfiglib_dir, os.path.join(kconfiglib_dir, "settings_file.txt"))
 
         # Tells Kconfiglib to generate warnings for all references to undefined
@@ -926,6 +945,9 @@ def check_no_undef_outside_kconfig(self, kconf):
         "BOOT_RAM_LOAD", # Used in sysbuild for MCUboot configuration
         "BOOT_SWAP_USING_MOVE", # Used in sysbuild for MCUboot configuration
         "BOOT_SWAP_USING_SCRATCH", # Used in sysbuild for MCUboot configuration
+        "BOARD_MPS2_AN521_CPUTEST", # Used for board and SoC extension feature tests
+        "BOARD_NATIVE_SIM_NATIVE_64_TWO", # Used for board and SoC extension feature tests
+        "BOARD_NATIVE_SIM_NATIVE_ONE", # Used for board and SoC extension feature tests
         "BOOT_ENCRYPTION_KEY_FILE", # Used in sysbuild
         "BOOT_ENCRYPT_IMAGE", # Used in sysbuild
         "BOOT_MAX_IMG_SECTORS_AUTO", # Used in sysbuild
diff --git a/scripts/ci/test_plan.py b/scripts/ci/test_plan.py
index 61305a75f45..3e3cf8ee4c7 100755
--- a/scripts/ci/test_plan.py
+++ b/scripts/ci/test_plan.py
@@ -239,12 +239,12 @@ def find_boards(self):
         # Look for boards in monitored repositories
         lb_args = argparse.Namespace(**{'arch_roots': roots, 'board_roots': roots, 'board': None, 'soc_roots':roots,
                                         'board_dir': None})
-        known_boards = list_boards.find_v2_boards(lb_args)
+        known_boards = list_boards.find_v2_boards(lb_args).values()
 
         for changed in changed_boards:
             for board in known_boards:
                 c = (zephyr_base / changed).resolve()
-                if c.is_relative_to(board.dir.resolve()):
+                if c.is_relative_to(board.directories[0].resolve()):
                     for file in glob.glob(os.path.join(board.dir, f"{board.name}*.yaml")):
                         with open(file, 'r') as f:
                             b = yaml.load(f.read(), Loader=SafeLoader)
diff --git a/scripts/dts/gen_dts_cmake.py b/scripts/dts/gen_dts_cmake.py
index 6fa4a347880..653910cbf8d 100755
--- a/scripts/dts/gen_dts_cmake.py
+++ b/scripts/dts/gen_dts_cmake.py
@@ -11,12 +11,13 @@
 
 The generated CMake file looks like this:
 
-  add_custom_target(devicetree_target)
-  set_target_properties(devicetree_target PROPERTIES
+  add_custom_target(${DEVICETREE_TARGET})
+  set_target_properties(${DEVICETREE_TARGET} PROPERTIES
                         "DT_PROP|/soc|compatible" "vnd,soc;")
   ...
 
-It defines a special CMake target, and saves various values in the
+It takes an input variable - DEVICETREE_TARGET - and creates a special
+CMake target with this name, which will contain various values in the
 devicetree as CMake target properties.
 
 Be careful:
@@ -154,15 +155,13 @@ def main():
         cmake_comp = f'DT_COMP|{comp}'
         cmake_props.append(f'"{cmake_comp}" "{cmake_path}"')
 
+    cmake_props = map(
+        'set_target_properties(${{DEVICETREE_TARGET}} PROPERTIES {})'.format,
+        cmake_props
+    )
     with open(args.cmake_out, "w", encoding="utf-8") as cmake_file:
-        print('add_custom_target(devicetree_target)', file=cmake_file)
-        print(file=cmake_file)
-
-        for prop in cmake_props:
-            print(
-                f'set_target_properties(devicetree_target PROPERTIES {prop})',
-                file=cmake_file
-            )
+        print('add_custom_target(${DEVICETREE_TARGET})\n', *cmake_props,
+              sep='\n', file=cmake_file)
 
 
 if __name__ == "__main__":
diff --git a/scripts/gitlint/zephyr_commit_rules.py b/scripts/gitlint/zephyr_commit_rules.py
index a2c9cd3cb7f..ef317e22684 100644
--- a/scripts/gitlint/zephyr_commit_rules.py
+++ b/scripts/gitlint/zephyr_commit_rules.py
@@ -78,7 +78,7 @@ class TitleMaxLengthRevert(LineRule):
     name = "title-max-length-no-revert"
     id = "UC5"
     target = CommitMessageTitle
-    options_spec = [IntOption('line-length', 75, "Max line length")]
+    options_spec = [IntOption('line-length', 120, "Max line length")]
     violation_message = "Commit title exceeds max length ({0}>{1})"
 
     def validate(self, line, _commit):
@@ -103,7 +103,7 @@ class MaxLineLengthExceptions(LineRule):
     name = "max-line-length-with-exceptions"
     id = "UC4"
     target = CommitMessageBody
-    options_spec = [IntOption('line-length', 75, "Max line length")]
+    options_spec = [IntOption('line-length', 120, "Max line length")]
     violation_message = "Commit message body line exceeds max length ({0}>{1})"
 
     def validate(self, line, _commit):
diff --git a/scripts/kconfig/lint.py b/scripts/kconfig/lint.py
index 30064c34546..5a123ded42f 100755
--- a/scripts/kconfig/lint.py
+++ b/scripts/kconfig/lint.py
@@ -209,7 +209,7 @@ def init_kconfig():
         ZEPHYR_BASE=TOP_DIR,
         SOC_DIR="soc",
         ARCH_DIR="arch",
-        BOARD_DIR="boards/*/*",
+        KCONFIG_BOARD_DIR="boards/*/*",
         ARCH="*")
 
     kconf = kconfiglib.Kconfig(suppress_traceback=True)
diff --git a/scripts/list_boards.py b/scripts/list_boards.py
index 6b810d0e286..c2b8e3740b3 100755
--- a/scripts/list_boards.py
+++ b/scripts/list_boards.py
@@ -4,13 +4,13 @@
 # SPDX-License-Identifier: Apache-2.0
 
 import argparse
-from collections import defaultdict
+from collections import defaultdict, Counter
 from dataclasses import dataclass, field
 import itertools
 from pathlib import Path
 import pykwalify.core
 import sys
-from typing import List
+from typing import List, Union
 import yaml
 import list_hardware
 from list_hardware import unique_paths
@@ -91,7 +91,8 @@ def from_soc(soc, variants):
 @dataclass(frozen=True)
 class Board:
     name: str
-    dir: Path
+    # HWMv1 only supports a single Path, and requires Board dataclass to be hashable.
+    directories: Union[Path, List[Path]]
     hwm: str
     arch: str = None
     vendor: str = None
@@ -102,6 +103,48 @@ class Board:
     socs: List[Soc] = field(default_factory=list, compare=False)
     variants: List[str] = field(default_factory=list, compare=False)
 
+    @property
+    def dir(self):
+        # Get the main board directory.
+        if isinstance(self.directories, Path):
+            return self.directories
+        return self.directories[0]
+
+    def from_qualifier(self, qualifiers):
+        qualifiers_list = qualifiers.split('/')
+
+        node = Soc(None)
+        n = len(qualifiers_list)
+        if n > 0:
+            soc_qualifier = qualifiers_list.pop(0)
+            for s in self.socs:
+                if s.name == soc_qualifier:
+                    node = s
+                    break
+
+        if n > 1:
+            if node.cpuclusters:
+                cpu_qualifier = qualifiers_list.pop(0)
+                for c in node.cpuclusters:
+                    if c.name == cpu_qualifier:
+                        node = c
+                        break
+                else:
+                    node = Variant(None)
+
+        for q in qualifiers_list:
+            for v in node.variants:
+                if v.name == q:
+                    node = v
+                    break
+            else:
+                node = Variant(None)
+
+        if node in (Soc(None), Variant(None)):
+            sys.exit(f'ERROR: qualifiers {qualifiers} not found when extending board {self.name}')
+
+        return node
+
 
 def board_key(board):
     return board.name
@@ -164,11 +207,10 @@ def find_arch2board_set_in(root, arches, board_dir):
     for arch in arches:
         if not (boards / arch).is_dir():
             continue
-
         for maybe_board in (boards / arch).iterdir():
             if not maybe_board.is_dir():
                 continue
-            if board_dir is not None and board_dir != maybe_board:
+            if board_dir and maybe_board not in board_dir:
                 continue
             for maybe_defconfig in maybe_board.iterdir():
                 file_name = maybe_defconfig.name
@@ -180,7 +222,8 @@ def find_arch2board_set_in(root, arches, board_dir):
 
 
 def load_v2_boards(board_name, board_yml, systems):
-    boards = []
+    boards = {}
+    board_extensions = []
     if board_yml.is_file():
         with board_yml.open('r') as f:
             b = yaml.load(f.read(), Loader=SafeLoader)
@@ -198,6 +241,18 @@ def load_v2_boards(board_name, board_yml, systems):
 
         board_array = b.get('boards', [b.get('board', None)])
         for board in board_array:
+            mutual_exclusive = {'name', 'extend'}
+            if len(mutual_exclusive - board.keys()) < 1:
+                sys.exit(f'ERROR: Malformed "board" section in file: {board_yml.as_posix()}\n'
+                         f'{mutual_exclusive} are mutual exclusive at this level.')
+
+            # This is a extending an existing board, place in array to allow later processing.
+            if 'extend' in board:
+                board.update({'dir': board_yml.parent})
+                board_extensions.append(board)
+                continue
+
+            # Create board
             if board_name is not None:
                 if board['name'] != board_name:
                     # Not the board we're looking for, ignore.
@@ -219,9 +274,9 @@ def load_v2_boards(board_name, board_yml, systems):
             socs = [Soc.from_soc(systems.get_soc(s['name']), s.get('variants', []))
                     for s in board.get('socs', {})]
 
-            board = Board(
+            boards[board['name']] = Board(
                 name=board['name'],
-                dir=board_yml.parent,
+                directories=[board_yml.parent],
                 vendor=board.get('vendor'),
                 revision_format=board.get('revision', {}).get('format'),
                 revision_default=board.get('revision', {}).get('default'),
@@ -232,8 +287,28 @@ def load_v2_boards(board_name, board_yml, systems):
                 variants=[Variant.from_dict(v) for v in board.get('variants', [])],
                 hwm='v2',
             )
-            boards.append(board)
-    return boards
+            board_qualifiers = board_v2_qualifiers(boards[board['name']])
+            duplicates = [q for q, n in Counter(board_qualifiers).items() if n > 1]
+            if duplicates:
+                sys.exit(f'ERROR: Duplicated board qualifiers detected {duplicates} for board: '
+                         f'{board["name"]}.\nPlease check content of: {board_yml.as_posix()}\n')
+    return boards, board_extensions
+
+
+def extend_v2_boards(boards, board_extensions):
+    for e in board_extensions:
+        board = boards.get(e['extend'])
+        if board is None:
+            continue
+        board.directories.append(e['dir'])
+
+        for v in e.get('variants', []):
+            node = board.from_qualifier(v['qualifier'])
+            if str(v['qualifier'] + '/' + v['name']) in board_v2_qualifiers(board):
+                board_yml = e['dir'] / BOARD_YML
+                sys.exit(f'ERROR: Variant: {v["name"]}, defined multiple times for board: '
+                         f'{board.name}.\nLast defined in {board_yml}')
+            node.variants.append(Variant.from_dict(v))
 
 
 # Note that this does not share the args.board functionality of find_v2_boards
@@ -251,14 +326,25 @@ def find_v2_boards(args):
     root_args = argparse.Namespace(**{'soc_roots': args.soc_roots})
     systems = list_hardware.find_v2_systems(root_args)
 
-    boards = []
+    boards = {}
+    board_extensions = []
     board_files = []
-    for root in unique_paths(args.board_roots):
-        board_files.extend((root / 'boards').rglob(BOARD_YML))
+    if args.board_dir:
+        board_files = [d / BOARD_YML for d in args.board_dir]
+    else:
+        for root in unique_paths(args.board_roots):
+            board_files.extend((root / 'boards').rglob(BOARD_YML))
 
     for board_yml in board_files:
-        b = load_v2_boards(args.board, board_yml, systems)
-        boards.extend(b)
+        b, e = load_v2_boards(args.board, board_yml, systems)
+        conflict_boards = set(boards.keys()).intersection(b.keys())
+        if conflict_boards:
+            sys.exit(f'ERROR: Board(s): {conflict_boards}, defined multiple times.\n'
+                     f'Last defined in {board_yml}')
+        boards.update(b)
+        board_extensions.extend(e)
+
+    extend_v2_boards(boards, board_extensions)
     return boards
 
 
@@ -283,7 +369,7 @@ def add_args(parser):
                         help='add a soc root, may be given more than once')
     parser.add_argument("--board", dest='board', default=None,
                         help='lookup the specific board, fail if not found')
-    parser.add_argument("--board-dir", default=None, type=Path,
+    parser.add_argument("--board-dir", default=[], type=Path, action='append',
                         help='Only look for boards at the specific location')
 
 
@@ -325,20 +411,16 @@ def board_v2_qualifiers_csv(board):
 
 
 def dump_v2_boards(args):
-    if args.board_dir:
-        root_args = argparse.Namespace(**{'soc_roots': args.soc_roots})
-        systems = list_hardware.find_v2_systems(root_args)
-        boards = load_v2_boards(args.board, args.board_dir / BOARD_YML, systems)
-    else:
-        boards = find_v2_boards(args)
+    boards = find_v2_boards(args)
 
-    for b in boards:
+    for b in boards.values():
         qualifiers_list = board_v2_qualifiers(b)
         if args.cmakeformat is not None:
             notfound = lambda x: x or 'NOTFOUND'
             info = args.cmakeformat.format(
                 NAME='NAME;' + b.name,
-                DIR='DIR;' + str(b.dir.as_posix()),
+                DIR='DIR;' + ';'.join(
+                    [str(x.as_posix()) for x in b.directories]),
                 VENDOR='VENDOR;' + notfound(b.vendor),
                 HWM='HWM;' + b.hwm,
                 REVISION_DEFAULT='REVISION_DEFAULT;' + notfound(b.revision_default),
@@ -363,7 +445,7 @@ def dump_boards(args):
             if args.cmakeformat is not None:
                 info = args.cmakeformat.format(
                     NAME='NAME;' + board.name,
-                    DIR='DIR;' + str(board.dir.as_posix()),
+                    DIR='DIR;' + str(board.directories.as_posix()),
                     HWM='HWM;' + board.hwm,
                     VENDOR='VENDOR;NOTFOUND',
                     REVISION_DEFAULT='REVISION_DEFAULT;NOTFOUND',
diff --git a/scripts/list_hardware.py b/scripts/list_hardware.py
index 1e994f3fd56..2485985f4b4 100755
--- a/scripts/list_hardware.py
+++ b/scripts/list_hardware.py
@@ -35,6 +35,7 @@ def __init__(self, folder='', soc_yaml=None):
         self._socs = []
         self._series = []
         self._families = []
+        self._extended_socs = []
 
         if soc_yaml is None:
             return
@@ -47,12 +48,12 @@ def __init__(self, folder='', soc_yaml=None):
             sys.exit(f'ERROR: Malformed yaml {soc_yaml.as_posix()}', e)
 
         for f in data.get('family', []):
-            family = Family(f['name'], folder, [], [])
+            family = Family(f['name'], [folder], [], [])
             for s in f.get('series', []):
-                series = Series(s['name'], folder, f['name'], [])
+                series = Series(s['name'], [folder], f['name'], [])
                 socs = [(Soc(soc['name'],
                              [c['name'] for c in soc.get('cpuclusters', [])],
-                             folder, s['name'], f['name']))
+                             [folder], s['name'], f['name']))
                         for soc in s.get('socs', [])]
                 series.socs.extend(socs)
                 self._series.append(series)
@@ -61,26 +62,36 @@ def __init__(self, folder='', soc_yaml=None):
                 family.socs.extend(socs)
             socs = [(Soc(soc['name'],
                          [c['name'] for c in soc.get('cpuclusters', [])],
-                         folder, None, f['name']))
+                         [folder], None, f['name']))
                     for soc in f.get('socs', [])]
             self._socs.extend(socs)
             self._families.append(family)
 
         for s in data.get('series', []):
-            series = Series(s['name'], folder, '', [])
+            series = Series(s['name'], [folder], '', [])
             socs = [(Soc(soc['name'],
                          [c['name'] for c in soc.get('cpuclusters', [])],
-                         folder, s['name'], ''))
+                         [folder], s['name'], ''))
                     for soc in s.get('socs', [])]
             series.socs.extend(socs)
             self._series.append(series)
             self._socs.extend(socs)
 
-        socs = [(Soc(soc['name'],
-                     [c['name'] for c in soc.get('cpuclusters', [])],
-                     folder, '', ''))
-                for soc in data.get('socs', [])]
-        self._socs.extend(socs)
+        for soc in data.get('socs', []):
+            mutual_exclusive = {'name', 'extend'}
+            if len(mutual_exclusive - soc.keys()) < 1:
+                sys.exit(f'ERROR: Malformed content in SoC file: {soc_yaml}\n'
+                         f'{mutual_exclusive} are mutual exclusive at this level.')
+            if soc.get('name') is not None:
+                self._socs.append(Soc(soc['name'], [c['name'] for c in soc.get('cpuclusters', [])],
+                                  [folder], '', ''))
+            elif soc.get('extend') is not None:
+                self._extended_socs.append(Soc(soc['extend'],
+                                           [c['name'] for c in soc.get('cpuclusters', [])],
+                                           [folder], '', ''))
+            else:
+                sys.exit(f'ERROR: Malformed "socs" section in SoC file: {soc_yaml}\n'
+                         f'Cannot find one of required keys {mutual_exclusive}.')
 
         # Ensure that any runner configuration matches socs and cpuclusters declared in the same
         # soc.yml file
@@ -89,25 +100,13 @@ def __init__(self, folder='', soc_yaml=None):
                 for item_data in data['runners']['run_once'][grp]:
                     for group in item_data['groups']:
                         for qualifiers in group['qualifiers']:
-                            soc_name, *components = qualifiers.split('/')
+                            soc_name = qualifiers.split('/')[0]
                             found_match = False
 
-                            # Allow 'ns' as final qualifier until "virtual" CPUs are ported to soc.yml
-                            # https://github.com/zephyrproject-rtos/zephyr/issues/70721
-                            if components and components[-1] == 'ns':
-                                components.pop()
-
-                            for soc in self._socs:
+                            for soc in self._socs + self._extended_socs:
                                 if re.match(fr'^{soc_name}$', soc.name) is not None:
-                                    if soc.cpuclusters and components:
-                                        check_string = '/'.join(components)
-                                        for cpucluster in soc.cpuclusters:
-                                            if re.match(fr'^{check_string}$', cpucluster) is not None:
-                                                found_match = True
-                                                break
-                                    elif not soc.cpuclusters and not components:
-                                        found_match = True
-                                        break
+                                    found_match = True
+                                    break
 
                             if found_match is False:
                                 sys.exit(f'ERROR: SoC qualifier match unresolved: {qualifiers}')
@@ -133,8 +132,23 @@ def from_yaml(socs_yaml):
     def extend(self, systems):
         self._families.extend(systems.get_families())
         self._series.extend(systems.get_series())
+
+        for es in self._extended_socs[:]:
+            for s in systems.get_socs():
+                if s.name == es.name:
+                    s.extend(es)
+                    self._extended_socs.remove(es)
+                    break
         self._socs.extend(systems.get_socs())
 
+        for es in systems.get_extended_socs():
+            for s in self._socs:
+                if s.name == es.name:
+                    s.extend(es)
+                    break
+            else:
+                self._extended_socs.append(es)
+
     def get_families(self):
         return self._families
 
@@ -144,6 +158,9 @@ def get_series(self):
     def get_socs(self):
         return self._socs
 
+    def get_extended_socs(self):
+        return self._extended_socs
+
     def get_soc(self, name):
         try:
             return next(s for s in self._socs if s.name == name)
@@ -156,15 +173,20 @@ def get_soc(self, name):
 class Soc:
     name: str
     cpuclusters: List[str]
-    folder: str
+    folder: List[str]
     series: str = ''
     family: str = ''
 
+    def extend(self, soc):
+        if self.name == soc.name:
+            self.cpuclusters.extend(soc.cpuclusters)
+            self.folder.extend(soc.folder)
+
 
 @dataclass
 class Series:
     name: str
-    folder: str
+    folder: List[str]
     family: str
     socs: List[Soc]
 
@@ -172,7 +194,7 @@ class Series:
 @dataclass
 class Family:
     name: str
-    folder: str
+    folder: List[str]
     series: List[Series]
     socs: List[Soc]
 
@@ -289,7 +311,7 @@ def dump_v2_system(args, type, system):
         info = args.cmakeformat.format(
            TYPE='TYPE;' + type,
            NAME='NAME;' + system.name,
-           DIR='DIR;' + Path(system.folder).as_posix(),
+           DIR='DIR;' + ';'.join([Path(x).as_posix() for x in system.folder]),
            HWM='HWM;' + 'v2'
         )
     else:
diff --git a/scripts/pylib/twister/twisterlib/coverage.py b/scripts/pylib/twister/twisterlib/coverage.py
index 8a0ea95569b..00fc9ddaca3 100644
--- a/scripts/pylib/twister/twisterlib/coverage.py
+++ b/scripts/pylib/twister/twisterlib/coverage.py
@@ -122,8 +122,9 @@ def create_gcda_files(self, extracted_coverage_info):
 
             try:
                 hexdump_val = self.merge_hexdumps(hexdumps)
+                hex_bytes = bytes.fromhex(hexdump_val)
                 with open(filename, 'wb') as fp:
-                    fp.write(bytes.fromhex(hexdump_val))
+                    fp.write(hex_bytes)
             except ValueError:
                 logger.exception("Unable to convert hex data for file: {}".format(filename))
                 gcda_created = False
diff --git a/scripts/pylib/twister/twisterlib/hardwaremap.py b/scripts/pylib/twister/twisterlib/hardwaremap.py
index 61653800280..6ca6dbcdb7d 100644
--- a/scripts/pylib/twister/twisterlib/hardwaremap.py
+++ b/scripts/pylib/twister/twisterlib/hardwaremap.py
@@ -13,7 +13,6 @@
 import scl
 import logging
 from pathlib import Path
-from natsort import natsorted
 
 from twisterlib.environment import ZEPHYR_BASE
 
@@ -358,7 +357,7 @@ def readlink(link):
 
     def save(self, hwm_file):
         # use existing map
-        self.detected = natsorted(self.detected, key=lambda x: x.serial or '')
+        self.detected.sort(key=lambda x: x.serial or '')
         if os.path.exists(hwm_file):
             with open(hwm_file, 'r') as yaml_file:
                 hwm = yaml.load(yaml_file, Loader=SafeLoader)
diff --git a/scripts/quarantine.yaml b/scripts/quarantine.yaml
new file mode 100644
index 00000000000..20c4f9248ea
--- /dev/null
+++ b/scripts/quarantine.yaml
@@ -0,0 +1,88 @@
+# The configurations resulting as a product of scenarios and platforms
+# will be skipped if quarantine is used. More details here:
+# https://docs.zephyrproject.org/latest/guides/test/twister.html#quarantine
+
+- scenarios:
+    - testing.ztest.busy_sim
+    - testing.ztest.busy_sim_nrf52840dk_pin
+  platforms:
+    - nrf52840dk_nrf52840
+
+# Already reported, but will not be fixed (look at the discussion):
+# https://github.com/zephyrproject-rtos/zephyr/issues/44947
+- scenarios:
+    - libraries.cmsis_dsp.matrix.unary_f64
+  platforms:
+    - nrf5340dk_nrf5340_cpunet
+    - qemu_cortex_m3
+  comment: "Flash overflows"
+
+# Already reported, but will not be fixed (look at the discussion):
+# https://github.com/zephyrproject-rtos/zephyr/issues/44947
+- scenarios:
+    - libraries.cmsis_dsp.matrix.binary_f16
+    - libraries.cmsis_dsp.matrix.binary_f16.fpu
+  platforms:
+    - nrf5340dk_nrf5340_cpuapp_ns
+  comment: "Flash overflows"
+
+# Already reported, but will not be fixed (look at the discussion):
+# https://github.com/zephyrproject-rtos/zephyr/issues/44947
+- scenarios:
+    - libraries.cmsis_dsp.matrix.binary_q15
+    - libraries.cmsis_dsp.matrix.binary_q15.fpu
+    - libraries.cmsis_dsp.matrix.unary_f32
+    - libraries.cmsis_dsp.matrix.unary_f32.fpu
+    - libraries.cmsis_dsp.matrix.unary_f64
+    - libraries.cmsis_dsp.matrix.unary_f64.fpu
+  platforms:
+    - nrf5340dk_nrf5340_cpuapp_ns
+    - nrf9160dk_nrf9160_ns
+  comment: "Flash overflows"
+
+# libsdl2-dev package should be added into docker image
+- scenarios:
+    - sample.boards.nrf.nrf_led_matrix
+    - sample.display.lvgl.gui
+  platforms:
+    - native_posix
+  comment: "libsdl2-dev package not available"
+
+- scenarios:
+    - sample.net.sockets.echo_server.usbnet
+    - sample.net.sockets.echo_server.usbnet_composite
+  platforms:
+    - nrf5340dk_nrf5340_cpuapp_ns
+  comment: "Ram/flash overflows, also in the upstream"
+
+- scenarios:
+    - sample.net.zperf.netusb_ecm
+    - sample.net.zperf.netusb_eem
+    - sample.net.zperf.netusb_rndis
+  platforms:
+    - nrf52833dk_nrf52833
+    - nrf5340dk_nrf5340_cpuapp_ns
+  comment: "Ram/flash overflows, also in the upstream"
+
+- scenarios:
+    - net.mqtt.tls
+  platforms:
+    - nrf5340dk_nrf5340_cpuapp_ns
+    - nrf9160dk_nrf9160_ns
+  comment: "Ram/flash overflows, also in the upstream"
+
+- scenarios:
+    - kernel.common.picolibc
+    - libraries.picolibc
+    - libraries.libc.picolibc.mem_alloc
+    - libraries.picolibc.sprintf_new
+  platforms:
+    - nrf52dk_nrf52832
+  comment: "Ram overflows, also in the upstream"
+
+- scenarios:
+    - sample.psa_crypto
+  platforms:
+    - nrf5340dk_nrf5340_cpuapp_ns
+    - nrf9160dk_nrf9160_ns
+  comment: "Due to using sdk-zephyr manifest instead of nrf. Should be fixed after the change"
diff --git a/scripts/requirements-run-test.txt b/scripts/requirements-run-test.txt
index 8b1d01afb09..551ec9d6990 100644
--- a/scripts/requirements-run-test.txt
+++ b/scripts/requirements-run-test.txt
@@ -7,7 +7,6 @@ pyocd>=0.35.0
 
 # used by twister for board/hardware map
 tabulate
-natsort
 
 # used by mcuboot
 cbor>=1.0.0
diff --git a/scripts/schemas/board-schema.yml b/scripts/schemas/board-schema.yml
index 56ee4eab034..3ca85af73c6 100644
--- a/scripts/schemas/board-schema.yml
+++ b/scripts/schemas/board-schema.yml
@@ -23,13 +23,29 @@ schema;variant-schema:
           required: false
           include: variant-schema
 
+schema;extend-variant-schema:
+  required: false
+  type: seq
+  sequence:
+    - type: map
+      mapping:
+        name:
+          required: true
+          type: str
+        qualifier:
+          required: true
+          type: str
+
 schema;board-schema:
   type: map
   mapping:
     name:
-      required: true
+      required: false # Note: either name or extend is required, but that is handled in python
       type: str
       desc: Name of the board
+    extend:
+      required: false # Note: either name or extend is required, but that is handled in python
+      type: str
     vendor:
       required: false
       type: str
@@ -59,7 +75,7 @@ schema;board-schema:
                   required: true
                   type: str
     socs:
-      required: true
+      required: false # Required for name:, but not for extend.
       type: seq
       sequence:
         - type: map
@@ -69,6 +85,8 @@ schema;board-schema:
               type: str
             variants:
               include: variant-schema
+    variants:
+      include: extend-variant-schema
 
 type: map
 mapping:
@@ -81,6 +99,11 @@ mapping:
   runners:
     type: map
     mapping:
+      priority:
+        type: int
+        desc: |
+              Priority of this flash run once configuration. The highest value data will be used
+              instead of any with lower priorities. If omitted, will default to 10.
       run_once:
         type: map
         desc: |
diff --git a/scripts/schemas/soc-schema.yml b/scripts/schemas/soc-schema.yml
index c13b4a4f7e0..060afea3254 100644
--- a/scripts/schemas/soc-schema.yml
+++ b/scripts/schemas/soc-schema.yml
@@ -24,7 +24,22 @@ schema;soc-schema:
     - type: map
       mapping:
         name:
-          required: true
+          required: true # Note: either name or extend is required, but that is handled in python
+          type: str
+        cpuclusters:
+          include: cpucluster-schema
+
+schema;soc-extend-schema:
+  required: false
+  type: seq
+  sequence:
+    - type: map
+      mapping:
+        name:
+          required: false # Note: either name or extend is required, but that is handled in python
+          type: str
+        extend:
+          required: false # Note: either name or extend is required, but that is handled in python
           type: str
         cpuclusters:
           include: cpucluster-schema
@@ -60,7 +75,7 @@ mapping:
   series:
     include: series-schema
   socs:
-    include: soc-schema
+    include: soc-extend-schema
   vendor:
     required: false
     type: str
@@ -73,6 +88,11 @@ mapping:
   runners:
     type: map
     mapping:
+      priority:
+        type: int
+        desc: |
+              Priority of this flash run once configuration. The highest value data will be used
+              instead of any with lower priorities. If omitted, will default to 0.
       run_once:
         type: map
         desc: |
diff --git a/scripts/west_commands/boards.py b/scripts/west_commands/boards.py
index 3bb213ae029..f329ea54217 100644
--- a/scripts/west_commands/boards.py
+++ b/scripts/west_commands/boards.py
@@ -96,7 +96,7 @@ def do_run(self, args, _):
             log.inf(args.format.format(name=board.name, arch=board.arch,
                                        dir=board.dir, hwm=board.hwm, qualifiers=''))
 
-        for board in list_boards.find_v2_boards(args):
+        for board in list_boards.find_v2_boards(args).values():
             if name_re is not None and not name_re.search(board.name):
                 continue
             log.inf(
diff --git a/scripts/west_commands/build.py b/scripts/west_commands/build.py
index 6bedd61937f..57ff2e9beaf 100644
--- a/scripts/west_commands/build.py
+++ b/scripts/west_commands/build.py
@@ -575,7 +575,12 @@ def _run_cmake(self, board, origin, cmake_opts):
         if user_args:
             cmake_opts.extend(shlex.split(user_args))
 
-        config_sysbuild = config_getboolean('sysbuild', False)
+        config_sysbuild = config_getboolean('sysbuild', None)
+
+        if config_sysbuild is None:
+            # If no option is set, then enable sysbuild globally
+            config_sysbuild = True
+
         if self.args.sysbuild or (config_sysbuild and not self.args.no_sysbuild):
             cmake_opts.extend(['-S{}'.format(SYSBUILD_PROJ_DIR),
                                '-DAPP_DIR:PATH={}'.format(self.source_dir)])
diff --git a/scripts/west_commands/run_common.py b/scripts/west_commands/run_common.py
index 772d736c183..012f27359d6 100644
--- a/scripts/west_commands/run_common.py
+++ b/scripts/west_commands/run_common.py
@@ -42,6 +42,10 @@
 # Don't change this, or output from argparse won't match up.
 INDENT = ' ' * 2
 
+IGNORED_RUN_ONCE_PRIORITY = -1
+SOC_FILE_RUN_ONCE_DEFAULT_PRIORITY = 0
+BOARD_FILE_RUN_ONCE_DEFAULT_PRIORITY = 10
+
 if log.VERBOSE >= log.VERBOSE_NORMAL:
     # Using level 1 allows sub-DEBUG levels of verbosity. The
     # west.log module decides whether or not to actually print the
@@ -96,6 +100,13 @@ class ImagesFlashed:
     flashed: int = 0
     total: int = 0
 
+@dataclass
+class SocBoardFilesProcessing:
+    filename: str
+    board: bool = False
+    priority: int = IGNORED_RUN_ONCE_PRIORITY
+    yaml: object = None
+
 def command_verb(command):
     return "flash" if command.name == "flash" else "debug"
 
@@ -178,6 +189,10 @@ def do_run_common(command, user_args, user_runner_args, domain_file=None):
     # images for a given board.
     board_image_count = defaultdict(ImagesFlashed)
 
+    highest_priority = IGNORED_RUN_ONCE_PRIORITY
+    highest_entry = None
+    check_files = []
+
     if user_args.context:
         dump_context(command, user_args, user_runner_args)
         return
@@ -223,48 +238,58 @@ def do_run_common(command, user_args, user_runner_args, domain_file=None):
             # Load board flash runner configuration (if it exists) and store
             # single-use commands in a dictionary so that they get executed
             # once per unique board name.
-            if cache['BOARD_DIR'] not in processed_boards and 'SOC_FULL_DIR' in cache:
-                soc_yaml_file = Path(cache['SOC_FULL_DIR']) / 'soc.yml'
-                board_yaml_file = Path(cache['BOARD_DIR']) / 'board.yml'
-                group_type = 'boards'
-
-                # Search for flash runner configuration, board takes priority over SoC
-                try:
-                    with open(board_yaml_file, 'r') as f:
-                        data_yaml = yaml.safe_load(f.read())
-
-                except FileNotFoundError:
-                    continue
-
-                if 'runners' not in data_yaml:
-                    # Check SoC file
-                    group_type = 'qualifiers'
-                    try:
-                        with open(soc_yaml_file, 'r') as f:
-                            data_yaml = yaml.safe_load(f.read())
-
-                    except FileNotFoundError:
+            for directory in cache.get_list('SOC_DIRECTORIES'):
+                if directory not in processed_boards:
+                    check_files.append(SocBoardFilesProcessing(Path(directory) / 'soc.yml'))
+                    processed_boards.add(directory)
+
+            for directory in cache.get_list('BOARD_DIRECTORIES'):
+                if directory not in processed_boards:
+                    check_files.append(SocBoardFilesProcessing(Path(directory) / 'board.yml', True))
+                    processed_boards.add(directory)
+
+        for check in check_files:
+            try:
+                with open(check.filename, 'r') as f:
+                    check.yaml = yaml.safe_load(f.read())
+
+                    if 'runners' not in check.yaml:
+                        continue
+                    elif check.board is False and 'run_once' not in check.yaml['runners']:
                         continue
 
-                processed_boards.add(cache['BOARD_DIR'])
-
-                if 'runners' not in data_yaml or 'run_once' not in data_yaml['runners']:
-                    continue
-
-                for cmd in data_yaml['runners']['run_once']:
-                    for data in data_yaml['runners']['run_once'][cmd]:
-                        for group in data['groups']:
-                            run_first = bool(data['run'] == 'first')
-                            if group_type == 'qualifiers':
-                                targets = []
-                                for target in group[group_type]:
-                                    # For SoC-based qualifiers, prepend to the beginning of the
-                                    # match to allow for matching any board name
-                                    targets.append('([^/]+)/' + target)
-                            else:
-                                targets = group[group_type]
-
-                            used_cmds.append(UsedFlashCommand(cmd, targets, data['runners'], run_first))
+                    if 'priority' in check.yaml['runners']:
+                        check.priority = check.yaml['runners']['priority']
+                    else:
+                        check.priority = BOARD_FILE_RUN_ONCE_DEFAULT_PRIORITY if check.board is True else SOC_FILE_RUN_ONCE_DEFAULT_PRIORITY
+
+                    if check.priority == highest_priority:
+                        log.die("Duplicate flash run once configuration found with equal priorities")
+
+                    elif check.priority > highest_priority:
+                        highest_priority = check.priority
+                        highest_entry = check
+
+            except FileNotFoundError:
+                continue
+
+        if highest_entry is not None:
+            group_type = 'boards' if highest_entry.board is True else 'qualifiers'
+
+            for cmd in highest_entry.yaml['runners']['run_once']:
+                for data in highest_entry.yaml['runners']['run_once'][cmd]:
+                    for group in data['groups']:
+                        run_first = bool(data['run'] == 'first')
+                        if group_type == 'qualifiers':
+                            targets = []
+                            for target in group[group_type]:
+                                # For SoC-based qualifiers, prepend to the beginning of the
+                                # match to allow for matching any board name
+                                targets.append('([^/]+)/' + target)
+                        else:
+                            targets = group[group_type]
+
+                        used_cmds.append(UsedFlashCommand(cmd, targets, data['runners'], run_first))
 
     # Reduce entries to only those having matching board names (either exact or with regex) and
     # remove any entries with empty board lists
diff --git a/share/sysbuild/Kconfig b/share/sysbuild/Kconfig
index 556462af310..69f2d4cd396 100644
--- a/share/sysbuild/Kconfig
+++ b/share/sysbuild/Kconfig
@@ -6,7 +6,7 @@ rsource "Kconfig.$(HWM_SCHEME)"
 
 comment "Sysbuild image configuration"
 
-osource "$(BOARD_DIR)/Kconfig.sysbuild"
+osource "$(KCONFIG_BOARD_DIR)/Kconfig.sysbuild"
 osource "$(KCONFIG_BINARY_DIR)/soc/Kconfig.sysbuild"
 
 menu "Modules"
diff --git a/share/sysbuild/cmake/modules/sysbuild_extensions.cmake b/share/sysbuild/cmake/modules/sysbuild_extensions.cmake
index c1b2513d192..0853535a911 100644
--- a/share/sysbuild/cmake/modules/sysbuild_extensions.cmake
+++ b/share/sysbuild/cmake/modules/sysbuild_extensions.cmake
@@ -503,6 +503,8 @@ function(ExternalZephyrProject_Cmake)
   endif()
   load_cache(IMAGE ${ZCMAKE_APPLICATION} BINARY_DIR ${BINARY_DIR})
   import_kconfig(CONFIG_ ${BINARY_DIR}/zephyr/.config TARGET ${ZCMAKE_APPLICATION})
+  set(DEVICETREE_TARGET ${ZCMAKE_APPLICATION}_devicetree_target)
+  include(${BINARY_DIR}/zephyr/dts.cmake)
 
   # This custom target informs CMake how the BYPRODUCTS are generated if a target
   # depends directly on the BYPRODUCT instead of depending on the image target.
@@ -750,3 +752,86 @@ function(sysbuild_images_order variable dependency_type)
   topological_sort(TARGETS ${SIS_IMAGES} PROPERTY_NAME ${property_name} RESULT sorted)
   set(${variable} ${sorted} PARENT_SCOPE)
 endfunction()
+
+# Internal macro for defining the sysbuild_dt_* CMake extensions, used to
+# retrieve devicetree information from a Zephyr based build system.
+#
+# It takes a dt_* function <name> and adds common wrapper code, which
+# adds an `IMAGE` argument to select the devicetree of a given <image>,
+# and forwards all other arguments to the original function, including
+# the sole return variable <var> - a common trait of the dt_* API.
+#
+# For additional documentation of each dt_* CMake extension,
+# see section 4.1. of cmake/modules/extensions.cmake.
+#
+macro(sysbuild_dt_function name)
+  function(sysbuild_${name} var)
+    cmake_parse_arguments(PARSE_ARGV 1 SBDT "" "IMAGE" "")
+    zephyr_check_arguments_required_all("sysbuild_${name}" SBDT IMAGE)
+
+    set(DEVICETREE_TARGET ${SBDT_IMAGE}_devicetree_target)
+    if(NOT TARGET ${SBDT_IMAGE} OR NOT TARGET ${DEVICETREE_TARGET})
+      message(FATAL_ERROR "sysbuild_${name}(...) image '${SBDT_IMAGE}' "
+                          "does not exist or its devicetree is not loaded yet"
+      )
+    endif()
+
+    cmake_language(CALL ${name} ${var} ${SBDT_UNPARSED_ARGUMENTS})
+    set(${var} "${${var}}" PARENT_SCOPE)
+  endfunction()
+endmacro()
+
+# Usage:
+#   sysbuild_dt_nodelabel(<var> IMAGE <image> NODELABEL <label>)
+#
+sysbuild_dt_function(dt_nodelabel)
+
+# Usage:
+#   sysbuild_dt_alias(<var> IMAGE <image> PROPERTY <prop>)
+#
+sysbuild_dt_function(dt_alias)
+
+# Usage:
+#   sysbuild_dt_node_exists(<var> IMAGE <image> PATH <path>)
+#
+sysbuild_dt_function(dt_node_exists)
+
+# Usage:
+#   sysbuild_dt_node_has_status(<var> IMAGE <image> PATH <path> STATUS <status>)
+#
+sysbuild_dt_function(dt_node_has_status)
+
+# Usage:
+#   sysbuild_dt_prop(<var> IMAGE <image> PATH <path> PROPERTY <prop> [INDEX <idx>])
+#
+sysbuild_dt_function(dt_prop)
+
+# Usage:
+#   sysbuild_dt_comp_path(<var> IMAGE <image> COMPATIBLE <compatible> [INDEX <idx>])
+#
+sysbuild_dt_function(dt_comp_path)
+
+# Usage:
+#   sysbuild_dt_num_regs(<var> IMAGE <image> PATH <path>)
+#
+sysbuild_dt_function(dt_num_regs)
+
+# Usage:
+#   sysbuild_dt_reg_addr(<var> IMAGE <image> PATH <path> [INDEX <idx>] [NAME <name>])
+#
+sysbuild_dt_function(dt_reg_addr)
+
+# Usage:
+#   sysbuild_dt_reg_size(<var> IMAGE <image> PATH <path> [INDEX <idx>] [NAME <name>])
+#
+sysbuild_dt_function(dt_reg_size)
+
+# Usage:
+#   sysbuild_dt_has_chosen(<var> IMAGE <image> PROPERTY <prop>)
+#
+sysbuild_dt_function(dt_has_chosen)
+
+# Usage:
+#   sysbuild_dt_chosen(<var> IMAGE <image> PROPERTY <prop>)
+#
+sysbuild_dt_function(dt_chosen)
diff --git a/snippets/bt-ll-sw-split/README.rst b/snippets/bt-ll-sw-split/README.rst
new file mode 100644
index 00000000000..490d45be36c
--- /dev/null
+++ b/snippets/bt-ll-sw-split/README.rst
@@ -0,0 +1,21 @@
+.. _snippet-bt-ll-sw-split:
+
+Zephyr Bluetooth LE Controller (bt-ll-sw-split)
+###############################################
+
+.. code-block:: console
+
+   west build -S bt-ll-sw-split [...]
+
+Overview
+********
+
+This snippet changes the default Bluetooth controller to the Zephyr Bluetooth LE Controller.
+
+Requirements
+************
+
+Hardware support for:
+
+- :kconfig:option:`CONFIG_BT`
+- :kconfig:option:`CONFIG_BT_CTLR`
diff --git a/snippets/bt-ll-sw-split/bt-ll-sw-split.conf b/snippets/bt-ll-sw-split/bt-ll-sw-split.conf
new file mode 100644
index 00000000000..f2dd622901b
--- /dev/null
+++ b/snippets/bt-ll-sw-split/bt-ll-sw-split.conf
@@ -0,0 +1,3 @@
+CONFIG_BT=y
+CONFIG_BT_CTLR=y
+CONFIG_BT_LL_SW_SPLIT=y
diff --git a/snippets/bt-ll-sw-split/bt-ll-sw-split.overlay b/snippets/bt-ll-sw-split/bt-ll-sw-split.overlay
new file mode 100644
index 00000000000..a57a0e82ba6
--- /dev/null
+++ b/snippets/bt-ll-sw-split/bt-ll-sw-split.overlay
@@ -0,0 +1,13 @@
+&bt_hci_controller {
+	status = "okay";
+};
+
+&bt_hci_sdc {
+	status = "disabled";
+};
+
+/ {
+	chosen {
+		zephyr,bt-hci = &bt_hci_controller;
+	};
+};
diff --git a/snippets/bt-ll-sw-split/snippet.yml b/snippets/bt-ll-sw-split/snippet.yml
new file mode 100644
index 00000000000..27a7325dc7e
--- /dev/null
+++ b/snippets/bt-ll-sw-split/snippet.yml
@@ -0,0 +1,4 @@
+name: bt-ll-sw-split
+append:
+  EXTRA_CONF_FILE: bt-ll-sw-split.conf
+  EXTRA_DTC_OVERLAY_FILE: bt-ll-sw-split.overlay
diff --git a/soc/nordic/common/Kconfig.peripherals b/soc/nordic/common/Kconfig.peripherals
index 2e77e7bf150..3443d514d16 100644
--- a/soc/nordic/common/Kconfig.peripherals
+++ b/soc/nordic/common/Kconfig.peripherals
@@ -13,10 +13,12 @@ config HAS_HW_NRF_BPROT
 	def_bool $(dt_compat_enabled,$(DT_COMPAT_NORDIC_NRF_BPROT))
 
 config HAS_HW_NRF_CC310
-	def_bool $(dt_compat_enabled,$(DT_COMPAT_ARM_CRYPTOCELL_310))
+	def_bool $(dt_compat_enabled,$(DT_COMPAT_ARM_CRYPTOCELL_310)) || \
+		 ($(dt_nodelabel_enabled,psa_rng) && SOC_SERIES_NRF91X)
 
 config HAS_HW_NRF_CC312
-	def_bool $(dt_compat_enabled,$(DT_COMPAT_ARM_CRYPTOCELL_312))
+	def_bool $(dt_compat_enabled,$(DT_COMPAT_ARM_CRYPTOCELL_312)) || \
+		 ($(dt_nodelabel_enabled,psa_rng) && SOC_NRF5340_CPUAPP)
 
 config HAS_HW_NRF_CCM
 	def_bool $(dt_compat_enabled,$(DT_COMPAT_NORDIC_NRF_CCM))
diff --git a/soc/nordic/nrf53/Kconfig b/soc/nordic/nrf53/Kconfig
index 56676ba6db3..ca1e7403caa 100644
--- a/soc/nordic/nrf53/Kconfig
+++ b/soc/nordic/nrf53/Kconfig
@@ -156,12 +156,32 @@ config NRF_SPU_FLASH_REGION_SIZE
 	help
 	  FLASH region size for the NRF_SPU peripheral
 
+config  NRF_TRUSTZONE_FLASH_REGION_SIZE
+	hex
+	default NRF_SPU_FLASH_REGION_SIZE
+	help
+	  Define the flash region size from a TrustZone perspective.
+	  This is used when we set the security attributes(S/NSC/NS) of a region
+	  in TrustZone enabled devices.
+	  In practice this option defines the granularity of the security attributes,
+	  i.e. the smallest region that can be set to secure or non-secure.
+
 config NRF_SPU_RAM_REGION_SIZE
 	hex
 	default 0x2000
 	help
 	  RAM region size for the NRF_SPU peripheral
 
+config  NRF_TRUSTZONE_RAM_REGION_SIZE
+	hex
+	default NRF_SPU_RAM_REGION_SIZE
+	help
+	  Define the RAM region size from a TrustZone perspective.
+	  This is used when we set the security attributes(S/NSC/NS) of a region
+	  in TrustZone enabled devices.
+	  In practice this option defines the granularity of the security attributes,
+	  i.e. the smallest region that can be set to secure or non-secure.
+
 config SOC_NRF_GPIO_FORWARDER_FOR_NRF5340
 	bool
 	depends on NRF_SOC_SECURE_SUPPORTED
diff --git a/soc/nordic/nrf54h/Kconfig.defconfig.nrf54h20_cpuapp b/soc/nordic/nrf54h/Kconfig.defconfig.nrf54h20_cpuapp
index 1a53fb5ff32..61cc96da71f 100644
--- a/soc/nordic/nrf54h/Kconfig.defconfig.nrf54h20_cpuapp
+++ b/soc/nordic/nrf54h/Kconfig.defconfig.nrf54h20_cpuapp
@@ -11,4 +11,7 @@ config NUM_IRQS
 config NRF_REGTOOL_GENERATE_UICR
 	default y
 
+config NRF_REGTOOL_GENERATE_BICR
+	default y
+
 endif # SOC_NRF54H20_CPUAPP
diff --git a/soc/nordic/nrf54l/CMakeLists.txt b/soc/nordic/nrf54l/CMakeLists.txt
index f1c18291fc6..bf2eaa1d820 100644
--- a/soc/nordic/nrf54l/CMakeLists.txt
+++ b/soc/nordic/nrf54l/CMakeLists.txt
@@ -10,3 +10,12 @@ zephyr_include_directories(.)
 if(CONFIG_ELV_GRTC_LFXO_ALLOWED)
   message(WARNING "WARNING! ELV mode feature is EXPERIMENTAL and may brick your device!")
 endif()
+
+# We need a buffer in memory in a static location which can be used by
+# the KMU peripheral. The KMU has a static destination address, we chose
+# this address to be 0x20000000, which is the first address in the SRAM.
+if(NOT CONFIG_BUILD_WITH_TFM AND CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)
+# Exclamation mark is printable character with the lowest number in ASCII table.
+# We are sure that this file will be included first.
+zephyr_linker_sources(RAM_SECTIONS SORT_KEY ! kmu_push_area_section.ld)
+endif()
diff --git a/soc/nordic/nrf54l/Kconfig b/soc/nordic/nrf54l/Kconfig
index df17dc35d3e..43d914c4de6 100644
--- a/soc/nordic/nrf54l/Kconfig
+++ b/soc/nordic/nrf54l/Kconfig
@@ -51,10 +51,18 @@ config SOC_NRF54L15_CPUFLPR
 if SOC_SERIES_NRF54LX
 
 config SOC_NRF54LX_SKIP_CLOCK_CONFIG
-	bool "Skip clock frequency configuration in system initialization"
+	bool
+	prompt "Skip clock frequency configuration in system initialization" if TRUSTED_EXECUTION_SECURE
+	default y if TRUSTED_EXECUTION_NONSECURE
 	help
-	  With this option, the CPU clock frequency is not set during system initialization.
-	  The CPU runs with the default, hardware-selected frequency.
+	  With this option, the CPU clock frequency is not set during this
+	  Zephyr image's system initialization. The CPU runs with either
+	  the HW reset values, or with the configuration set by an image
+	  earlier in the boot chain.
+
+	  Note that for security reasons it is not supported to configure
+	  the clock peripheral (NRF_OSCILLATORS) from the non-secure
+	  domain.
 
 config SOC_NRF54LX_DISABLE_FICR_TRIMCNF
 	bool "Disable trimming of the device"
diff --git a/soc/nordic/nrf54l/kmu_push_area_section.ld b/soc/nordic/nrf54l/kmu_push_area_section.ld
new file mode 100644
index 00000000000..e8c8cd9f09a
--- /dev/null
+++ b/soc/nordic/nrf54l/kmu_push_area_section.ld
@@ -0,0 +1,19 @@
+# This section must be loaded first of all the
+# custom sections because we want it to be placed
+# at the top address of RAM.
+SECTION_PROLOGUE(NRF_KMU_RESERVED_PUSH_SECTION,(NOLOAD) ,)
+{
+    __nrf_kmu_reserved_push_area = .;
+    *(.nrf_kmu_reserved_push_area)
+    __nrf_kmu_reserved_push_area_end = .;
+} GROUP_NOLOAD_LINK_IN(RAMABLE_REGION, RAMABLE_REGION)
+
+# It doesn't seem to be possible to enforce placing a section
+# at a specific address in memory using the Zephyr SECTION macros.
+# So this assert is necessary to avoid accidentatly moving this
+# section to a different address.
+ASSERT(__nrf_kmu_reserved_push_area == RAM_ADDR, "Error:  \
+ The section NRF_KMU_RESERVED_PUSH_SECTION needs to be    \
+ placed on the top RAM address but it is not, please edit \
+ your linker scripts to make sure that it is placed on    \
+ the to RAM address.")
diff --git a/soc/nordic/nrf54l/soc.c b/soc/nordic/nrf54l/soc.c
index b1e8667a9f1..eaa1531bde4 100644
--- a/soc/nordic/nrf54l/soc.c
+++ b/soc/nordic/nrf54l/soc.c
@@ -12,13 +12,21 @@
  * for the Nordic Semiconductor nRF54L family processor.
  */
 
+#ifdef __NRF_TFM__
+#include <zephyr/autoconf.h>
+#endif
+
 #include <zephyr/devicetree.h>
 #include <zephyr/dt-bindings/regulator/nrf5x.h>
 #include <zephyr/kernel.h>
 #include <zephyr/devicetree.h>
 #include <zephyr/init.h>
 #include <zephyr/logging/log.h>
+
+#ifndef __NRF_TFM__
 #include <zephyr/cache.h>
+#endif
+
 #include <zephyr/dt-bindings/regulator/nrf5x.h>
 
 #if defined(NRF_APPLICATION)
@@ -39,17 +47,9 @@ LOG_MODULE_REGISTER(soc, CONFIG_SOC_LOG_LEVEL);
 #define HFXO_NODE DT_NODELABEL(hfxo)
 #endif
 
-static int nordicsemi_nrf54l_init(void)
-{
-	/* Update the SystemCoreClock global variable with current core clock
-	 * retrieved from hardware state.
-	 */
-	SystemCoreClockUpdate();
-
 #if defined(NRF_APPLICATION)
-	/* Enable ICACHE */
-	sys_cache_instr_enable();
-
+static inline void power_and_clock_configuration(void)
+{
 #if DT_ENUM_HAS_VALUE(LFXO_NODE, load_capacitors, internal)
 	uint32_t xosc32ktrim = NRF_FICR->XOSC32KTRIM;
 
@@ -76,16 +76,16 @@ static int nordicsemi_nrf54l_init(void)
 	 * NOTE: The desired capacitance value is used in encoded from in INTCAP calculation formula
 	 *       That is different than in case of HFXO.
 	 */
-	uint32_t cap_val_encoded = (((DT_PROP(LFXO_NODE, load_capacitance_femtofarad) - 4000UL)
-				     * 2UL) / 1000UL);
+	uint32_t cap_val_encoded =
+		(((DT_PROP(LFXO_NODE, load_capacitance_femtofarad) - 4000UL) * 2UL) / 1000UL);
 
 	/* Calculation of INTCAP code before rounding. Min that calculations here are done on
 	 * values multiplied by 2^9, e.g. 0.765625 * 2^9 = 392.
 	 * offset_k should be divided by 2^6, but to add it to value shifted by 2^9 we have to
 	 * multiply it be 2^3.
 	 */
-	uint32_t mid_val = (cap_val_encoded - 4UL) * (uint32_t)(slope_k + 392UL)
-			   + (offset_k << 3UL);
+	uint32_t mid_val =
+		(cap_val_encoded - 4UL) * (uint32_t)(slope_k + 392UL) + (offset_k << 3UL);
 
 	/* Get integer part of the INTCAP code */
 	uint32_t lfxo_intcap = mid_val >> 9UL;
@@ -131,8 +131,9 @@ static int nordicsemi_nrf54l_init(void)
 	 */
 	uint32_t cap_val_femto_f = DT_PROP(HFXO_NODE, load_capacitance_femtofarad);
 
-	uint32_t mid_val_intcap = (((cap_val_femto_f - 5500UL) * (uint32_t)(slope_m + 791UL))
-		 + (offset_m << 2UL) * 1000UL) >> 8UL;
+	uint32_t mid_val_intcap = (((cap_val_femto_f - 5500UL) * (uint32_t)(slope_m + 791UL)) +
+				   (offset_m << 2UL) * 1000UL) >>
+				  8UL;
 
 	/* Convert the calculated value to piko Farads */
 	uint32_t hfxo_intcap = mid_val_intcap / 1000;
@@ -163,8 +164,40 @@ static int nordicsemi_nrf54l_init(void)
 #if defined(CONFIG_ELV_GRTC_LFXO_ALLOWED)
 	nrf_regulators_elv_mode_allow_set(NRF_REGULATORS, NRF_REGULATORS_ELV_ELVGRTCLFXO_MASK);
 #endif /* CONFIG_ELV_GRTC_LFXO_ALLOWED */
+}
 #endif /* NRF_APPLICATION */
 
+int nordicsemi_nrf54l_init(void)
+{
+	/* Update the SystemCoreClock global variable with current core clock
+	 * retrieved from hardware state.
+	 */
+#if !defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) || defined(__NRF_TFM__)
+	/* Currently not supported for non-secure */
+	SystemCoreClockUpdate();
+#endif
+
+#ifdef __NRF_TFM__
+	/* TF-M enables the instruction cache from target_cfg.c, so we
+	 * don't need to enable it here.
+	 */
+#else
+	/* Enable ICACHE */
+	sys_cache_instr_enable();
+#endif
+
+	/* NRF_REGULATORS and NRF_OSCILLATORS are configured to be secure
+	 * as NRF_REGULATORS.POFCON is needed by the secure domain to
+	 * prevent glitches when the power supply is attacked.
+	 *
+	 * NRF_OSCILLATORS is also configured as secure because of a HW limitation
+	 * that requires them to be configured with the same security property.
+	 */
+#if (defined(NRF_APPLICATION) && !defined(CONFIG_TRUSTED_EXECUTION_NONSECURE)) ||                  \
+	defined(__NRF_TFM__)
+	power_and_clock_configuration();
+#endif
+
 	return 0;
 }
 
diff --git a/soc/nordic/nrf91/Kconfig b/soc/nordic/nrf91/Kconfig
index ed38eff73a2..9f55cdd77ed 100644
--- a/soc/nordic/nrf91/Kconfig
+++ b/soc/nordic/nrf91/Kconfig
@@ -24,6 +24,16 @@ config NRF_SPU_FLASH_REGION_SIZE
 	help
 	  FLASH region size for the NRF_SPU peripheral
 
+config  NRF_TRUSTZONE_FLASH_REGION_SIZE
+	hex
+	default NRF_SPU_FLASH_REGION_SIZE
+	help
+	  Define the flash region size from a TrustZone perspective.
+	  This is used when we set the security attributes(S/NSC/NS) of a region
+	  in TrustZone enabled devices.
+	  In practice this option defines the granularity of the security attributes,
+	  i.e. the smallest region that can be set to secure or non-secure.
+
 config NRF_SPU_RAM_REGION_SIZE
 	hex
 	default 0x2000
@@ -34,4 +44,14 @@ config NRF_ENABLE_ICACHE
 	bool "Instruction cache (I-Cache)"
 	default y
 
+config  NRF_TRUSTZONE_RAM_REGION_SIZE
+	hex
+	default NRF_SPU_RAM_REGION_SIZE
+	help
+	  Define the RAM region size from a TrustZone perspective.
+	  This is used when we set the security attributes(S/NSC/NS) of a region
+	  in TrustZone enabled devices.
+	  In practice this option defines the granularity of the security attributes,
+	  i.e. the smallest region that can be set to secure or non-secure.
+
 endif # SOC_SERIES_NRF91X
diff --git a/subsys/bluetooth/controller/Kconfig b/subsys/bluetooth/controller/Kconfig
index 25f480788e1..a62b8c404a3 100644
--- a/subsys/bluetooth/controller/Kconfig
+++ b/subsys/bluetooth/controller/Kconfig
@@ -137,7 +137,9 @@ choice BT_LL_CHOICE
 	  and set as the default Bluetooth Controller.
 
 config BT_LL_SW_SPLIT
-	bool "Software-based BLE Link Layer"
+	bool "Software-based BLE Link Layer [EXPERIMENTAL]"
+	select EXPERIMENTAL
+	select ENTROPY_GENERATOR
 	help
 	  Use Zephyr software BLE Link Layer ULL LLL split implementation.
 
diff --git a/subsys/bluetooth/host/Kconfig.gatt b/subsys/bluetooth/host/Kconfig.gatt
index 050dab1215c..e0ea43025bd 100644
--- a/subsys/bluetooth/host/Kconfig.gatt
+++ b/subsys/bluetooth/host/Kconfig.gatt
@@ -38,6 +38,23 @@ config BT_ATT_RETRY_ON_SEC_ERR
 	  If an ATT request fails due to insufficient security, the host will
 	  try to elevate the security level and retry the ATT request.
 
+config BT_ATT_SENT_CB_AFTER_TX
+	bool "Delay ATT sent callback until data transmission is done by controller [EXPERIMENTAL]"
+	select EXPERIMENTAL
+	help
+	  By default, the BLE stack calls sent callback for ATT data when the
+	  data is passed to BLE controller for transmission. Enabling this
+	  Kconfig option delays calling the sent callback until data
+	  transmission is finished by BLE controller (the callback is called
+	  upon receiving the Number of Completed Packets HCI Event).
+
+	  The feature is not available in Zephyr RTOS (it's specific to NCS
+	  Zephyr fork). It is a temporary solution allowing to control flow of
+	  GATT notifications with HID reports for HID use-case.
+
+	  Enabling this option may require increasing CONFIG_BT_CONN_TX_MAX in
+	  configuration, because ATT would use additional TX contexts.
+
 config BT_EATT
 	bool "Enhanced ATT Bearers support [EXPERIMENTAL]"
 	depends on BT_L2CAP_ECRED
diff --git a/subsys/bluetooth/host/Kconfig.l2cap b/subsys/bluetooth/host/Kconfig.l2cap
index 6499fbb19a8..ed1428aade7 100644
--- a/subsys/bluetooth/host/Kconfig.l2cap
+++ b/subsys/bluetooth/host/Kconfig.l2cap
@@ -52,7 +52,7 @@ config BT_L2CAP_DYNAMIC_CHANNEL
 	  allowing the creation of dynamic L2CAP Channels.
 
 config BT_L2CAP_ECRED
-	bool "L2CAP Enhanced Credit Based Flow Control support"
+	bool "L2CAP Enhanced Credit Based Flow Control support [EXPERIMENTAL]"
 	depends on BT_L2CAP_DYNAMIC_CHANNEL
 	help
 	  This option enables support for LE Connection oriented Channels with
diff --git a/subsys/bluetooth/host/att.c b/subsys/bluetooth/host/att.c
index 5ecb86ce7ef..7af47a6a3b8 100644
--- a/subsys/bluetooth/host/att.c
+++ b/subsys/bluetooth/host/att.c
@@ -316,6 +316,13 @@ static void att_sent(void *user_data)
 	bt_att_sent(chan);
 }
 
+static void chan_sent_cb(struct bt_conn *conn, void *user_data, int err)
+{
+	struct net_buf *nb = user_data;
+
+	net_buf_unref(nb);
+}
+
 /* In case of success the ownership of the buffer is transferred to the stack
  * which takes care of releasing it when it completes transmitting to the
  * controller.
@@ -409,7 +416,15 @@ static int chan_send(struct bt_att_chan *chan, struct net_buf *buf)
 
 	data->att_chan = chan;
 
-	err = bt_l2cap_send_pdu(&chan->chan, buf, NULL, NULL);
+	if (IS_ENABLED(CONFIG_BT_ATT_SENT_CB_AFTER_TX)) {
+		err = bt_l2cap_send_pdu(&chan->chan, buf, chan_sent_cb, net_buf_ref(buf));
+		if (err) {
+			net_buf_unref(buf);
+		}
+	} else {
+		err = bt_l2cap_send_pdu(&chan->chan, buf, NULL, NULL);
+	}
+
 	if (err) {
 		if (err == -ENOBUFS) {
 			LOG_ERR("Ran out of TX buffers or contexts.");
diff --git a/subsys/bluetooth/host/conn.c b/subsys/bluetooth/host/conn.c
index b8c835876c7..9f9c0441dff 100644
--- a/subsys/bluetooth/host/conn.c
+++ b/subsys/bluetooth/host/conn.c
@@ -681,7 +681,17 @@ static int send_buf(struct bt_conn *conn, struct net_buf *buf,
 
 	uint16_t frag_len = MIN(conn_mtu(conn), len);
 
-	__ASSERT_NO_MSG(buf->ref == 1);
+	/* If ATT sent callback is delayed until data transmission is done by BLE controller, the
+	 * transmitted buffer may have an additional reference. The reference is used to extend
+	 * lifetime of the net buffer until the data transmission is confirmed by ACK of the remote.
+	 *
+	 * send_buf function can be called multiple times, if buffer has to be fragmented over HCI.
+	 * In that case, the callback is provided as an argument only for the last transmitted
+	 * fragment. The `buf->ref == 1` check is skipped because it's impossible to properly
+	 * validate number of references for the sent fragments if buffers may have the additional
+	 * reference.
+	 */
+	__ASSERT_NO_MSG(IS_ENABLED(CONFIG_BT_ATT_SENT_CB_AFTER_TX) || (buf->ref == 1));
 
 	if (buf->len > frag_len) {
 		LOG_DBG("keep %p around", buf);
@@ -3320,6 +3330,42 @@ int bt_conn_le_subrate_request(struct bt_conn *conn,
 }
 #endif /* CONFIG_BT_SUBRATING */
 
+#if defined(CONFIG_BT_CHANNEL_SOUNDING)
+void notify_remote_cs_capabilities(struct bt_conn *conn, struct bt_conn_le_cs_capabilities params)
+{
+	struct bt_conn_cb *callback;
+
+	SYS_SLIST_FOR_EACH_CONTAINER(&conn_cbs, callback, _node) {
+		if (callback->remote_cs_capabilities_available) {
+			callback->remote_cs_capabilities_available(conn, &params);
+		}
+	}
+
+	STRUCT_SECTION_FOREACH(bt_conn_cb, cb) {
+		if (cb->remote_cs_capabilities_available) {
+			cb->remote_cs_capabilities_available(conn, &params);
+		}
+	}
+}
+
+void notify_remote_cs_fae_table(struct bt_conn *conn, struct bt_conn_le_cs_fae_table params)
+{
+	struct bt_conn_cb *callback;
+
+	SYS_SLIST_FOR_EACH_CONTAINER(&conn_cbs, callback, _node) {
+		if (callback->remote_cs_fae_table_available) {
+			callback->remote_cs_fae_table_available(conn, &params);
+		}
+	}
+
+	STRUCT_SECTION_FOREACH(bt_conn_cb, cb) {
+		if (cb->remote_cs_fae_table_available) {
+			cb->remote_cs_fae_table_available(conn, &params);
+		}
+	}
+}
+#endif /* CONFIG_BT_CHANNEL_SOUNDING */
+
 int bt_conn_le_param_update(struct bt_conn *conn,
 			    const struct bt_le_conn_param *param)
 {
diff --git a/subsys/bluetooth/host/conn_internal.h b/subsys/bluetooth/host/conn_internal.h
index 58228588d0c..4cc4e70d858 100644
--- a/subsys/bluetooth/host/conn_internal.h
+++ b/subsys/bluetooth/host/conn_internal.h
@@ -492,6 +492,12 @@ void notify_path_loss_threshold_report(struct bt_conn *conn,
 void notify_subrate_change(struct bt_conn *conn,
 			   struct bt_conn_le_subrate_changed params);
 
+void notify_remote_cs_capabilities(struct bt_conn *conn,
+			   struct bt_conn_le_cs_capabilities params);
+
+void notify_remote_cs_fae_table(struct bt_conn *conn,
+			   struct bt_conn_le_cs_fae_table params);
+
 #if defined(CONFIG_BT_SMP)
 /* If role specific LTK is present */
 bool bt_conn_ltk_present(const struct bt_conn *conn);
diff --git a/subsys/bluetooth/host/cs.c b/subsys/bluetooth/host/cs.c
index 4ec67fd42ce..5a713ad2457 100644
--- a/subsys/bluetooth/host/cs.c
+++ b/subsys/bluetooth/host/cs.c
@@ -13,7 +13,143 @@
 
 #include "conn_internal.h"
 
+#define LOG_LEVEL CONFIG_BT_HCI_CORE_LOG_LEVEL
+#include <zephyr/logging/log.h>
+LOG_MODULE_REGISTER(bt_cs);
+
 #if defined(CONFIG_BT_CHANNEL_SOUNDING)
+int bt_cs_read_remote_supported_capabilities(struct bt_conn *conn)
+{
+	struct bt_hci_cp_le_read_remote_supported_capabilities *cp;
+	struct net_buf *buf;
+
+	buf = bt_hci_cmd_create(BT_HCI_OP_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES, sizeof(*cp));
+	if (!buf) {
+		return -ENOBUFS;
+	}
+
+	cp = net_buf_add(buf, sizeof(*cp));
+	cp->handle = sys_cpu_to_le16(conn->handle);
+
+	return bt_hci_cmd_send_sync(BT_HCI_OP_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES, buf, NULL);
+}
+
+void bt_hci_le_cs_read_remote_supported_capabilities_complete(struct net_buf *buf)
+{
+	struct bt_conn *conn;
+	struct bt_conn_le_cs_capabilities remote_cs_capabilities;
+	struct bt_hci_evt_le_cs_read_remote_supported_capabilities_complete *evt;
+
+	if (buf->len < sizeof(*evt)) {
+		LOG_ERR("Unexpected end of buffer");
+		return;
+	}
+
+	evt = net_buf_pull_mem(buf, sizeof(*evt));
+	if (evt->status) {
+		LOG_INF("Read Remote Supported Capabilities failed (status 0x%02X)", evt->status);
+		return;
+	}
+
+	conn = bt_conn_lookup_handle(sys_le16_to_cpu(evt->conn_handle), BT_CONN_TYPE_LE);
+	if (!conn) {
+		LOG_ERR("Could not lookup connection handle when reading remote CS capabilities");
+		return;
+	}
+
+	remote_cs_capabilities.num_config_supported = evt->num_config_supported;
+	remote_cs_capabilities.max_consecutive_procedures_supported =
+		sys_le16_to_cpu(evt->max_consecutive_procedures_supported);
+	remote_cs_capabilities.num_antennas_supported = evt->num_antennas_supported;
+	remote_cs_capabilities.max_antenna_paths_supported = evt->max_antenna_paths_supported;
+
+	remote_cs_capabilities.initiator_supported =
+		evt->roles_supported & BT_HCI_LE_CS_INITIATOR_ROLE_MASK;
+	remote_cs_capabilities.reflector_supported =
+		evt->roles_supported & BT_HCI_LE_CS_REFLECTOR_ROLE_MASK;
+	remote_cs_capabilities.mode_3_supported =
+		evt->modes_supported & BT_HCI_LE_CS_MODES_SUPPORTED_MODE_3_MASK;
+
+	remote_cs_capabilities.rtt_aa_only_n = evt->rtt_aa_only_n;
+	remote_cs_capabilities.rtt_sounding_n = evt->rtt_sounding_n;
+	remote_cs_capabilities.rtt_random_payload_n = evt->rtt_random_payload_n;
+
+	if (evt->rtt_aa_only_n) {
+		if (evt->rtt_capability & BT_HCI_LE_CS_RTT_AA_ONLY_N_10NS_MASK) {
+			remote_cs_capabilities.rtt_aa_only_precision =
+				BT_CONN_LE_CS_RTT_AA_ONLY_10NS;
+		} else {
+			remote_cs_capabilities.rtt_aa_only_precision =
+				BT_CONN_LE_CS_RTT_AA_ONLY_150NS;
+		}
+	} else {
+		remote_cs_capabilities.rtt_aa_only_precision = BT_CONN_LE_CS_RTT_AA_ONLY_NOT_SUPP;
+	}
+
+	if (evt->rtt_sounding_n) {
+		if (evt->rtt_capability & BT_HCI_LE_CS_RTT_SOUNDING_N_10NS_MASK) {
+			remote_cs_capabilities.rtt_sounding_precision =
+				BT_CONN_LE_CS_RTT_SOUNDING_10NS;
+		} else {
+			remote_cs_capabilities.rtt_sounding_precision =
+				BT_CONN_LE_CS_RTT_SOUNDING_150NS;
+		}
+	} else {
+		remote_cs_capabilities.rtt_sounding_precision = BT_CONN_LE_CS_RTT_SOUNDING_NOT_SUPP;
+	}
+
+	if (evt->rtt_random_payload_n) {
+		if (evt->rtt_capability & BT_HCI_LE_CS_RTT_RANDOM_PAYLOAD_N_10NS_MASK) {
+			remote_cs_capabilities.rtt_random_payload_precision =
+				BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_10NS;
+		} else {
+			remote_cs_capabilities.rtt_random_payload_precision =
+				BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_150NS;
+		}
+	} else {
+		remote_cs_capabilities.rtt_random_payload_precision =
+			BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_NOT_SUPP;
+	}
+
+	remote_cs_capabilities.phase_based_nadm_sounding_supported =
+		sys_le16_to_cpu(evt->nadm_sounding_capability) &
+		BT_HCI_LE_CS_NADM_SOUNDING_CAPABILITY_PHASE_BASED_MASK;
+
+	remote_cs_capabilities.phase_based_nadm_random_supported =
+		sys_le16_to_cpu(evt->nadm_random_capability) &
+		BT_HCI_LE_CS_NADM_RANDOM_CAPABILITY_PHASE_BASED_MASK;
+
+	remote_cs_capabilities.cs_sync_2m_phy_supported =
+		evt->cs_sync_phys_supported & BT_HCI_LE_CS_SYNC_PHYS_2M_MASK;
+
+	remote_cs_capabilities.cs_sync_2m_2bt_phy_supported =
+		evt->cs_sync_phys_supported & BT_HCI_LE_CS_SYNC_PHYS_2M_2BT_MASK;
+
+	remote_cs_capabilities.cs_without_fae_supported =
+		sys_le16_to_cpu(evt->subfeatures_supported) &
+		BT_HCI_LE_CS_SUBFEATURE_NO_TX_FAE_MASK;
+
+	remote_cs_capabilities.chsel_alg_3c_supported =
+		sys_le16_to_cpu(evt->subfeatures_supported) &
+		BT_HCI_LE_CS_SUBFEATURE_CHSEL_ALG_3C_MASK;
+
+	remote_cs_capabilities.pbr_from_rtt_sounding_seq_supported =
+		sys_le16_to_cpu(evt->subfeatures_supported) &
+		BT_HCI_LE_CS_SUBFEATURE_PBR_FROM_RTT_SOUNDING_SEQ_MASK;
+
+	remote_cs_capabilities.t_ip1_times_supported = sys_le16_to_cpu(evt->t_ip1_times_supported);
+	remote_cs_capabilities.t_ip2_times_supported = sys_le16_to_cpu(evt->t_ip2_times_supported);
+	remote_cs_capabilities.t_fcs_times_supported = sys_le16_to_cpu(evt->t_fcs_times_supported);
+	remote_cs_capabilities.t_pm_times_supported = sys_le16_to_cpu(evt->t_pm_times_supported);
+
+	remote_cs_capabilities.t_sw_time = evt->t_sw_time_supported;
+	remote_cs_capabilities.tx_snr_capability = evt->tx_snr_capability;
+
+	notify_remote_cs_capabilities(conn, remote_cs_capabilities);
+
+	bt_conn_unref(conn);
+}
+
 int bt_cs_set_default_settings(struct bt_conn *conn,
 			       const struct bt_cs_set_default_settings_param *params)
 {
@@ -41,4 +177,153 @@ int bt_cs_set_default_settings(struct bt_conn *conn,
 
 	return bt_hci_cmd_send_sync(BT_HCI_OP_LE_CS_SET_DEFAULT_SETTINGS, buf, NULL);
 }
+
+int bt_cs_read_remote_fae_table(struct bt_conn *conn)
+{
+	struct bt_hci_cp_le_read_remote_fae_table *cp;
+	struct net_buf *buf;
+
+	buf = bt_hci_cmd_create(BT_HCI_OP_LE_CS_READ_REMOTE_FAE_TABLE, sizeof(*cp));
+	if (!buf) {
+		return -ENOBUFS;
+	}
+
+	cp = net_buf_add(buf, sizeof(*cp));
+	cp->handle = sys_cpu_to_le16(conn->handle);
+
+	return bt_hci_cmd_send_sync(BT_HCI_OP_LE_CS_READ_REMOTE_FAE_TABLE, buf, NULL);
+}
+
+void bt_hci_le_cs_read_remote_fae_table_complete(struct net_buf *buf)
+{
+	struct bt_conn *conn;
+	struct bt_conn_le_cs_fae_table fae_table;
+	struct bt_hci_evt_le_cs_read_remote_fae_table_complete *evt;
+
+	if (buf->len < sizeof(*evt)) {
+		LOG_ERR("Unexpected end of buffer");
+		return;
+	}
+
+	evt = net_buf_pull_mem(buf, sizeof(*evt));
+	if (evt->status) {
+		LOG_INF("Read Remote FAE Table failed with status 0x%02X", evt->status);
+		return;
+	}
+
+	conn = bt_conn_lookup_handle(sys_le16_to_cpu(evt->conn_handle), BT_CONN_TYPE_LE);
+	if (!conn) {
+		LOG_ERR("Could not lookup connection handle when reading remote FAE Table");
+		return;
+	}
+
+	fae_table.remote_fae_table = evt->remote_fae_table;
+	notify_remote_cs_fae_table(conn, fae_table);
+
+	bt_conn_unref(conn);
+}
+
+int bt_cs_start_test(const struct bt_cs_test_param *params)
+{
+	struct bt_hci_op_le_cs_test *cp;
+	struct net_buf *buf;
+
+	buf = bt_hci_cmd_create(BT_HCI_OP_LE_CS_TEST, sizeof(*cp));
+	if (!buf) {
+		return -ENOBUFS;
+	}
+
+	cp = net_buf_add(buf, sizeof(*cp));
+
+	cp->main_mode_type = params->main_mode;
+	cp->sub_mode_type = params->sub_mode;
+	cp->main_mode_repetition = params->main_mode_repetition;
+	cp->mode_0_steps = params->mode_0_steps;
+	cp->role = params->role;
+	cp->rtt_type = params->rtt_type;
+	cp->cs_sync_phy = params->cs_sync_phy;
+	cp->cs_sync_antenna_selection = params->cs_sync_antenna_selection;
+	sys_put_le24(params->subevent_len, cp->subevent_len);
+	cp->subevent_interval = sys_cpu_to_le16(params->subevent_interval);
+	cp->max_num_subevents = params->max_num_subevents;
+	cp->transmit_power_level = params->transmit_power_level;
+	cp->t_ip1_time = params->t_ip1_time;
+	cp->t_ip2_time = params->t_ip2_time;
+	cp->t_fcs_time = params->t_fcs_time;
+	cp->t_pm_time = params->t_pm_time;
+	cp->t_sw_time = params->t_sw_time;
+	cp->tone_antenna_config_selection = params->tone_antenna_config_selection;
+
+	cp->reserved = 0;
+
+	cp->snr_control_initiator = params->initiator_snr_control;
+	cp->snr_control_reflector = params->reflector_snr_control;
+	cp->drbg_nonce = sys_cpu_to_le16(params->drbg_nonce);
+	cp->channel_map_repetition = params->override_config_0.channel_map_repetition;
+	cp->override_config = sys_cpu_to_le16(params->override_config);
+
+	uint8_t override_parameters_length = 0;
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_0_MASK) {
+		const uint8_t num_channels = params->override_config_0.set.num_channels;
+
+		net_buf_add_u8(buf, num_channels);
+		override_parameters_length++;
+		net_buf_add_mem(buf, params->override_config_0.set.channels, num_channels);
+		override_parameters_length += num_channels;
+	} else {
+		net_buf_add_mem(buf, params->override_config_0.not_set.channel_map,
+				sizeof(params->override_config_0.not_set.channel_map));
+		net_buf_add_u8(buf, params->override_config_0.not_set.channel_selection_type);
+		net_buf_add_u8(buf, params->override_config_0.not_set.ch3c_shape);
+		net_buf_add_u8(buf, params->override_config_0.not_set.ch3c_jump);
+
+		override_parameters_length +=
+			(sizeof(params->override_config_0.not_set.channel_map) +
+			 sizeof(params->override_config_0.not_set.channel_selection_type) +
+			 sizeof(params->override_config_0.not_set.ch3c_shape) +
+			 sizeof(params->override_config_0.not_set.ch3c_jump));
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_2_MASK) {
+		net_buf_add_mem(buf, &params->override_config_2, sizeof(params->override_config_2));
+		override_parameters_length += sizeof(params->override_config_2);
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_3_MASK) {
+		net_buf_add_mem(buf, &params->override_config_3, sizeof(params->override_config_3));
+		override_parameters_length += sizeof(params->override_config_3);
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_4_MASK) {
+		net_buf_add_mem(buf, &params->override_config_4, sizeof(params->override_config_4));
+		override_parameters_length += sizeof(params->override_config_4);
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_5_MASK) {
+		net_buf_add_le32(buf, params->override_config_5.cs_sync_aa_initiator);
+		net_buf_add_le32(buf, params->override_config_5.cs_sync_aa_reflector);
+		override_parameters_length += sizeof(params->override_config_5);
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_6_MASK) {
+		net_buf_add_mem(buf, &params->override_config_6, sizeof(params->override_config_6));
+		override_parameters_length += sizeof(params->override_config_6);
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_7_MASK) {
+		net_buf_add_mem(buf, &params->override_config_7, sizeof(params->override_config_7));
+		override_parameters_length += sizeof(params->override_config_7);
+	}
+
+	if (params->override_config & BT_HCI_OP_LE_CS_TEST_OVERRIDE_CONFIG_8_MASK) {
+		net_buf_add_mem(buf, &params->override_config_8, sizeof(params->override_config_8));
+		override_parameters_length += sizeof(params->override_config_8);
+	}
+
+	cp->override_parameters_length = override_parameters_length;
+
+	return bt_hci_cmd_send_sync(BT_HCI_OP_LE_CS_TEST, buf, NULL);
+}
+
 #endif /* CONFIG_BT_CHANNEL_SOUNDING */
diff --git a/subsys/bluetooth/host/hci_core.c b/subsys/bluetooth/host/hci_core.c
index adc215a67ea..b1ab4fbb664 100644
--- a/subsys/bluetooth/host/hci_core.c
+++ b/subsys/bluetooth/host/hci_core.c
@@ -2821,6 +2821,14 @@ static const struct event_handler meta_events[] = {
 		      sizeof(struct bt_hci_evt_le_enh_conn_complete_v2)),
 #endif /* CONFIG_BT_PER_ADV_RSP || CONFIG_BT_PER_ADV_SYNC_RSP */
 #endif /* CONFIG_BT_CONN */
+#if defined(CONFIG_BT_CHANNEL_SOUNDING)
+	EVENT_HANDLER(BT_HCI_EVT_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES_COMPLETE,
+		      bt_hci_le_cs_read_remote_supported_capabilities_complete,
+		      sizeof(struct bt_hci_evt_le_cs_read_remote_supported_capabilities_complete)),
+	EVENT_HANDLER(BT_HCI_EVT_LE_CS_READ_REMOTE_FAE_TABLE_COMPLETE,
+		      bt_hci_le_cs_read_remote_fae_table_complete,
+		      sizeof(struct bt_hci_evt_le_cs_read_remote_fae_table_complete)),
+#endif /* CONFIG_BT_CHANNEL_SOUNDING */
 
 };
 
@@ -3391,6 +3399,13 @@ static int le_set_event_mask(void)
 		mask |= BT_EVT_MASK_LE_ENH_CONN_COMPLETE_V2;
 	}
 
+
+	if (IS_ENABLED(CONFIG_BT_CHANNEL_SOUNDING) &&
+	    BT_FEAT_LE_CHANNEL_SOUNDING(bt_dev.le.features)) {
+		mask |= BT_EVT_MASK_LE_CS_READ_REMOTE_SUPPORTED_CAPABILITIES_COMPLETE;
+		mask |= BT_EVT_MASK_LE_CS_READ_REMOTE_FAE_TABLE_COMPLETE;
+	}
+
 	sys_put_le64(mask, cp_mask->events);
 	return bt_hci_cmd_send_sync(BT_HCI_OP_LE_SET_EVENT_MASK, buf, NULL);
 }
@@ -3613,6 +3628,14 @@ static int le_init(void)
 		}
 	}
 
+	if (IS_ENABLED(CONFIG_BT_CHANNEL_SOUNDING) &&
+	    BT_FEAT_LE_CHANNEL_SOUNDING(bt_dev.le.features)) {
+		err = le_set_host_feature(BT_LE_FEAT_BIT_CHANNEL_SOUNDING_HOST, 1);
+		if (err) {
+			return err;
+		}
+	}
+
 	return  le_set_event_mask();
 }
 
diff --git a/subsys/bluetooth/host/hci_core.h b/subsys/bluetooth/host/hci_core.h
index b39f219024d..590d85a6c49 100644
--- a/subsys/bluetooth/host/hci_core.h
+++ b/subsys/bluetooth/host/hci_core.h
@@ -538,6 +538,10 @@ void bt_hci_le_vs_df_connectionless_iq_report(struct net_buf *buf);
 void bt_hci_le_past_received(struct net_buf *buf);
 void bt_hci_le_past_received_v2(struct net_buf *buf);
 
+/* CS HCI event handlers */
+void bt_hci_le_cs_read_remote_supported_capabilities_complete(struct net_buf *buf);
+void bt_hci_le_cs_read_remote_fae_table_complete(struct net_buf *buf);
+
 /* Adv HCI event handlers */
 void bt_hci_le_adv_set_terminated(struct net_buf *buf);
 void bt_hci_le_scan_req_received(struct net_buf *buf);
diff --git a/subsys/bluetooth/host/l2cap.c b/subsys/bluetooth/host/l2cap.c
index 1b25f838fa3..8747eae4791 100644
--- a/subsys/bluetooth/host/l2cap.c
+++ b/subsys/bluetooth/host/l2cap.c
@@ -717,13 +717,17 @@ static void cancel_data_ready(struct bt_l2cap_le_chan *le_chan)
 int bt_l2cap_send_pdu(struct bt_l2cap_le_chan *le_chan, struct net_buf *pdu,
 		      bt_conn_tx_cb_t cb, void *user_data)
 {
-	if (pdu->ref != 1) {
+	/* Allow for an additional buffer reference if callback is provided. This can be used to
+	 * extend lifetime of the net buffer until the data transmission is confirmed by ACK of the
+	 * remote.
+	 */
+	if (pdu->ref > 1 + (cb ? 1 : 0)) {
 		/* The host may alter the buf contents when fragmenting. Higher
 		 * layers cannot expect the buf contents to stay intact. Extra
 		 * refs suggests a silent data corruption would occur if not for
 		 * this error.
 		 */
-		LOG_ERR("Expecting 1 ref, got %d", pdu->ref);
+		LOG_ERR("Expecting up to %d refs, got %d", cb ? 2 : 1, pdu->ref);
 		return -EINVAL;
 	}
 
diff --git a/subsys/bluetooth/mesh/Kconfig b/subsys/bluetooth/mesh/Kconfig
index 384033f7908..5ae770a8a41 100644
--- a/subsys/bluetooth/mesh/Kconfig
+++ b/subsys/bluetooth/mesh/Kconfig
@@ -59,12 +59,16 @@ choice BT_MESH_ADV
 
 menuconfig BT_MESH_ADV_LEGACY
 	bool "Legacy advertising"
+	depends on BT_LL_SW_SPLIT
 	help
 	  Use legacy advertising commands for mesh sending. Legacy
-	  advertising is significantly slower than the extended advertising, but
-	  is supported by all controllers.
+	  advertising is significantly slower than the extended advertising.
 
-	  WARNING: The legacy advertiser can occasionally do more message
+	  WARNING: This feature is not supported in NCS. The legacy advertiser will not work
+	  with SDC, as attempting to start an advertisement during the scanner duty cycle
+	  will result in an error. The Zephyr Link Layer can be used experimentally as an
+	  alternative.
+	  The legacy advertiser can occasionally do more message
 	  retransmissions than requested because of limitations of HCI
 	  interface API.
 
@@ -148,6 +152,17 @@ config BT_MESH_ADV_EXT_FRIEND_SEPARATE
 	  messages as close to the start of the ReceiveWindow as possible,
 	  thus reducing the scanning time on the Low Power node.
 
+config BT_MESH_ADV_EXT_ACCEPT_EXT_ADV_PACKETS
+	bool "Reject or accept extended advertising packets"
+	depends on BT_LL_SOFTDEVICE
+	help
+	  Configure the scanner and initiator to either reject or accept extended
+	  advertising packets by the SoftDevice Controller. This is set to false
+	  by default, to prevent loss of scan time when receiving a pointer packet
+	  while scanning for Bluetooth Mesh packets. Set to true if extended
+	  advertising packets are to be received by the SoftDevice Controller for
+	  purposes other than Bluetooth Mesh.
+
 endif # BT_MESH_ADV_EXT
 
 endchoice
@@ -1642,7 +1657,7 @@ config BT_MESH_LPN_INIT_POLL_TIMEOUT
 config BT_MESH_LPN_SCAN_LATENCY
 	int "Latency for enabling scanning"
 	range 0 50
-	default 15
+	default 2
 	help
 	  Latency in milliseconds that it takes to enable scanning. This
 	  is in practice how much time in advance before the Receive Window
diff --git a/subsys/bluetooth/mesh/adv_ext.c b/subsys/bluetooth/mesh/adv_ext.c
index b437e6d91ef..03d2cbb7ea3 100644
--- a/subsys/bluetooth/mesh/adv_ext.c
+++ b/subsys/bluetooth/mesh/adv_ext.c
@@ -13,6 +13,9 @@
 #include <zephyr/bluetooth/bluetooth.h>
 #include <zephyr/bluetooth/hci.h>
 #include <zephyr/bluetooth/mesh.h>
+#if defined(CONFIG_BT_LL_SOFTDEVICE)
+#include <sdc_hci_vs.h>
+#endif
 
 #include "common/bt_str.h"
 
@@ -136,6 +139,28 @@ static inline struct bt_mesh_ext_adv *gatt_adv_get(void)
 	}
 }
 
+static int set_adv_randomness(uint8_t handle, int rand_us)
+{
+#if defined(CONFIG_BT_LL_SOFTDEVICE)
+	struct net_buf *buf;
+	sdc_hci_cmd_vs_set_adv_randomness_t *cmd_params;
+
+	buf = bt_hci_cmd_create(SDC_HCI_OPCODE_CMD_VS_SET_ADV_RANDOMNESS, sizeof(*cmd_params));
+	if (!buf) {
+		LOG_ERR("Could not allocate command buffer");
+		return -ENOMEM;
+	}
+
+	cmd_params = net_buf_add(buf, sizeof(*cmd_params));
+	cmd_params->adv_handle = handle;
+	cmd_params->rand_us = rand_us;
+
+	return bt_hci_cmd_send_sync(SDC_HCI_OPCODE_CMD_VS_SET_ADV_RANDOMNESS, buf, NULL);
+#else
+	return 0;
+#endif /* defined(CONFIG_BT_LL_SOFTDEVICE) */
+}
+
 static int adv_start(struct bt_mesh_ext_adv *ext_adv,
 		     const struct bt_le_adv_param *param,
 		     struct bt_le_ext_adv_start_param *start,
@@ -424,6 +449,18 @@ void bt_mesh_adv_init(void)
 	for (int i = 0; i < ARRAY_SIZE(advs); i++) {
 		(void)memcpy(&advs[i].adv_param, &adv_param, sizeof(adv_param));
 	}
+
+#if defined(CONFIG_BT_LL_SOFTDEVICE)
+	const sdc_hci_cmd_vs_scan_accept_ext_adv_packets_set_t cmd_params = {
+		.accept_ext_adv_packets = IS_ENABLED(CONFIG_BT_MESH_ADV_EXT_ACCEPT_EXT_ADV_PACKETS),
+	};
+
+	int err = sdc_hci_cmd_vs_scan_accept_ext_adv_packets_set(&cmd_params);
+
+	if (err) {
+		LOG_ERR("Failed to set accept_ext_adv_packets: %d", err);
+	}
+#endif
 }
 
 static struct bt_mesh_ext_adv *adv_instance_find(struct bt_le_ext_adv *instance)
@@ -491,6 +528,15 @@ int bt_mesh_adv_enable(void)
 		if (err) {
 			return err;
 		}
+
+		if (IS_ENABLED(CONFIG_BT_LL_SOFTDEVICE) &&
+		    IS_ENABLED(CONFIG_BT_MESH_ADV_EXT_FRIEND_SEPARATE) &&
+		    advs[i].tags == BT_MESH_ADV_TAG_BIT_FRIEND) {
+			err = set_adv_randomness(advs[i].instance->handle, 0);
+			if (err) {
+				LOG_ERR("Failed to set zero randomness: %d", err);
+			}
+		}
 	}
 
 	return 0;
diff --git a/subsys/bluetooth/shell/bt.c b/subsys/bluetooth/shell/bt.c
index 70b3e69941d..25841fd48d6 100644
--- a/subsys/bluetooth/shell/bt.c
+++ b/subsys/bluetooth/shell/bt.c
@@ -982,6 +982,78 @@ void subrate_changed(struct bt_conn *conn,
 }
 #endif
 
+#if defined(CONFIG_BT_CHANNEL_SOUNDING)
+void print_remote_cs_capabilities(struct bt_conn *conn, struct bt_conn_le_cs_capabilities *params)
+{
+	shell_print(
+		ctx_shell,
+		"Received remote channel sounding capabilities:\n"
+		"- Num CS configurations: %d\n"
+		"- Max consecutive CS procedures: %d\n"
+		"- Num antennas supported: %d\n"
+		"- Max antenna paths supported: %d\n"
+		"- Initiator role supported: %s\n"
+		"- Reflector role supported: %s\n"
+		"- Mode 3 supported: %s\n"
+		"- RTT AA only supported: %s\n"
+		"- RTT AA only is 10ns precise: %s\n"
+		"- RTT AA only N: %d\n"
+		"- RTT sounding supported: %s\n"
+		"- RTT sounding is 10ns precise: %s\n"
+		"- RTT sounding N: %d\n"
+		"- RTT random payload supported: %s\n"
+		"- RTT random payload is 10ns precise: %s\n"
+		"- RTT random payload N: %d\n"
+		"- Phase-based NADM with sounding sequences supported: %s\n"
+		"- Phase-based NADM with random sequences supported: %s\n"
+		"- CS Sync 2M PHY supported: %s\n"
+		"- CS Sync 2M 2BT PHY supported: %s\n"
+		"- CS without transmitter FAE supported: %s\n"
+		"- Channel selection algorithm #3c supported: %s\n"
+		"- Phase-based ranging from RTT sounding sequence supported: %s\n"
+		"- T_IP1 times supported: 0x%04x\n"
+		"- T_IP2 times supported: 0x%04x\n"
+		"- T_FCS times supported: 0x%04x\n"
+		"- T_PM times supported: 0x%04x\n"
+		"- T_SW time supported: %d us\n"
+		"- TX SNR capability: 0x%02x",
+		params->num_config_supported, params->max_consecutive_procedures_supported,
+		params->num_antennas_supported, params->max_antenna_paths_supported,
+		params->initiator_supported ? "Yes" : "No",
+		params->reflector_supported ? "Yes" : "No", params->mode_3_supported ? "Yes" : "No",
+		params->rtt_aa_only_precision == BT_CONN_LE_CS_RTT_AA_ONLY_NOT_SUPP ? "No" : "Yes",
+		params->rtt_aa_only_precision == BT_CONN_LE_CS_RTT_AA_ONLY_10NS ? "Yes" : "No",
+		params->rtt_aa_only_n,
+		params->rtt_sounding_precision == BT_CONN_LE_CS_RTT_SOUNDING_NOT_SUPP ? "No"
+										      : "Yes",
+		params->rtt_sounding_precision == BT_CONN_LE_CS_RTT_SOUNDING_10NS ? "Yes" : "No",
+		params->rtt_sounding_n,
+		params->rtt_random_payload_precision == BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_NOT_SUPP
+			? "No"
+			: "Yes",
+		params->rtt_random_payload_precision == BT_CONN_LE_CS_RTT_RANDOM_PAYLOAD_10NS
+			? "Yes"
+			: "No",
+		params->rtt_random_payload_n,
+		params->phase_based_nadm_sounding_supported ? "Yes" : "No",
+		params->phase_based_nadm_random_supported ? "Yes" : "No",
+		params->cs_sync_2m_phy_supported ? "Yes" : "No",
+		params->cs_sync_2m_2bt_phy_supported ? "Yes" : "No",
+		params->cs_without_fae_supported ? "Yes" : "No",
+		params->chsel_alg_3c_supported ? "Yes" : "No",
+		params->pbr_from_rtt_sounding_seq_supported ? "Yes" : "No",
+		params->t_ip1_times_supported, params->t_ip2_times_supported,
+		params->t_fcs_times_supported, params->t_pm_times_supported, params->t_sw_time,
+		params->tx_snr_capability);
+}
+
+void print_remote_cs_fae_table(struct bt_conn *conn, struct bt_conn_le_cs_fae_table *params)
+{
+	shell_print(ctx_shell, "Received FAE Table: ");
+	shell_hexdump(ctx_shell, params->remote_fae_table, 72);
+}
+#endif
+
 static struct bt_conn_cb conn_callbacks = {
 	.connected = connected,
 	.disconnected = disconnected,
@@ -1011,6 +1083,10 @@ static struct bt_conn_cb conn_callbacks = {
 #if defined(CONFIG_BT_SUBRATING)
 	.subrate_changed = subrate_changed,
 #endif
+#if defined(CONFIG_BT_CHANNEL_SOUNDING)
+	.remote_cs_capabilities_available = print_remote_cs_capabilities,
+	.remote_cs_fae_table_available = print_remote_cs_fae_table,
+#endif
 };
 #endif /* CONFIG_BT_CONN */
 
diff --git a/subsys/bluetooth/shell/cs.c b/subsys/bluetooth/shell/cs.c
index 00a16cb4adb..b8f32be61be 100644
--- a/subsys/bluetooth/shell/cs.c
+++ b/subsys/bluetooth/shell/cs.c
@@ -39,6 +39,24 @@ static int check_cs_sync_antenna_selection_input(uint16_t input)
 	return 0;
 }
 
+static int cmd_read_remote_supported_capabilities(const struct shell *sh, size_t argc, char *argv[])
+{
+	int err = 0;
+
+	if (default_conn == NULL) {
+		shell_error(sh, "Conn handle error, at least one connection is required.");
+		return -ENOEXEC;
+	}
+
+	err = bt_cs_read_remote_supported_capabilities(default_conn);
+	if (err) {
+		shell_error(sh, "bt_cs_read_remote_supported_capabilities returned error %d", err);
+		return -ENOEXEC;
+	}
+
+	return 0;
+}
+
 static int cmd_set_default_settings(const struct shell *sh, size_t argc, char *argv[])
 {
 	int err = 0;
@@ -98,13 +116,103 @@ static int cmd_set_default_settings(const struct shell *sh, size_t argc, char *a
 	return 0;
 }
 
+static int cmd_read_remote_fae_table(const struct shell *sh, size_t argc, char *argv[])
+{
+	int err = 0;
+
+	if (default_conn == NULL) {
+		shell_error(sh, "Conn handle error, at least one connection is required.");
+		return -ENOEXEC;
+	}
+
+	err = bt_cs_read_remote_fae_table(default_conn);
+	if (err) {
+		shell_error(sh, "bt_cs_read_remote_fae_table returned error %d", err);
+		return -ENOEXEC;
+	}
+
+	return 0;
+}
+
+static int cmd_cs_test_simple(const struct shell *sh, size_t argc, char *argv[])
+{
+	int err = 0;
+	struct bt_cs_test_param params;
+
+	params.main_mode = BT_CS_TEST_MAIN_MODE_1;
+	params.sub_mode = BT_CS_TEST_SUB_MODE_UNUSED;
+	params.main_mode_repetition = 0;
+	params.mode_0_steps = 0x1;
+
+	params.role = shell_strtoul(argv[1], 16, &err);
+
+	if (err) {
+		shell_help(sh);
+		shell_error(sh, "Could not parse input 1, Role selection");
+		return SHELL_CMD_HELP_PRINTED;
+	}
+
+	if (params.role != BT_CS_TEST_ROLE_INITIATOR && params.role != BT_CS_TEST_ROLE_REFLECTOR) {
+		shell_help(sh);
+		shell_error(sh, "Role selection input invalid");
+		return SHELL_CMD_HELP_PRINTED;
+	}
+
+	params.rtt_type = BT_CS_TEST_RTT_AA_ONLY;
+	params.cs_sync_phy = BT_CS_TEST_CS_SYNC_LE_1M_PHY;
+	params.cs_sync_antenna_selection = BT_CS_TEST_CS_SYNC_ANTENNA_SELECTION_ONE;
+	params.subevent_len = 10000;
+	params.subevent_interval = 0;
+	params.max_num_subevents = 0;
+	params.transmit_power_level = BT_HCI_OP_LE_CS_TEST_MAXIMIZE_TX_POWER;
+	params.t_ip1_time = 80;
+	params.t_ip2_time = 80;
+	params.t_fcs_time = 120;
+	params.t_pm_time = 20;
+	params.t_sw_time = 0;
+	params.tone_antenna_config_selection = BT_CS_TEST_TONE_ANTENNA_CONFIGURATION_INDEX_ONE;
+	params.initiator_snr_control = BT_CS_TEST_INITIATOR_SNR_CONTROL_NOT_USED;
+	params.reflector_snr_control = BT_CS_TEST_REFLECTOR_SNR_CONTROL_NOT_USED;
+	params.drbg_nonce = 0x1234;
+	params.override_config = 0;
+	params.override_config_0.channel_map_repetition = 1;
+	memset(params.override_config_0.not_set.channel_map, 0,
+		sizeof(params.override_config_0.not_set.channel_map));
+	params.override_config_0.not_set.channel_map[1] = 0xFF;
+	params.override_config_0.not_set.channel_selection_type =
+		BT_CS_TEST_OVERRIDE_0_CHSEL_ALG_3B;
+	params.override_config_0.not_set.ch3c_shape =
+		BT_CS_TEST_OVERRIDE_0_CHSEL_ALG_3C_HAT_SHAPE;
+	params.override_config_0.not_set.ch3c_jump = 0x2;
+
+	err = bt_cs_start_test(&params);
+	if (err) {
+		shell_error(sh, "bt_cs_start_test returned error %d", err);
+		return -ENOEXEC;
+	}
+
+	return 0;
+}
+
 SHELL_STATIC_SUBCMD_SET_CREATE(
 	cs_cmds,
+	SHELL_CMD_ARG(
+		read_remote_supported_capabilities, NULL,
+		"<None>",
+		cmd_read_remote_supported_capabilities, 1, 0),
 	SHELL_CMD_ARG(
 		set_default_settings, NULL,
 		"<Enable initiator role: true, false> <Enable reflector role: true, false> "
 		" <CS_SYNC antenna selection: 0x01 - 0x04, 0xFE, 0xFF> <Max TX power: -127 - 20>",
 		cmd_set_default_settings, 5, 0),
+	SHELL_CMD_ARG(
+		read_remote_fae_table, NULL,
+		"<None>",
+		cmd_read_remote_fae_table, 1, 0),
+	SHELL_CMD_ARG(
+		start_simple_cs_test, NULL,
+		"<Role selection (initiator, reflector): 0, 1>",
+		cmd_cs_test_simple, 2, 0),
 	SHELL_SUBCMD_SET_END);
 
 static int cmd_cs(const struct shell *sh, size_t argc, char **argv)
diff --git a/subsys/dfu/boot/mcuboot.c b/subsys/dfu/boot/mcuboot.c
index 20015349dbc..a6e05700ac7 100644
--- a/subsys/dfu/boot/mcuboot.c
+++ b/subsys/dfu/boot/mcuboot.c
@@ -34,8 +34,34 @@
 #define BOOT_HEADER_MAGIC_V1 0x96f3b83d
 #define BOOT_HEADER_SIZE_V1 32
 
+#if USE_PARTITION_MANAGER
+#include <pm_config.h>
+
+#if CONFIG_BUILD_WITH_TFM
+	#define PM_ADDRESS_OFFSET (PM_MCUBOOT_PAD_SIZE + PM_TFM_SIZE)
+#else
+	#define PM_ADDRESS_OFFSET (PM_MCUBOOT_PAD_SIZE)
+#endif
+
+#ifdef CONFIG_MCUBOOT
+	/* lib is part of MCUboot -> operate on the primart application slot */
+	#define ACTIVE_SLOT_ID		PM_MCUBOOT_PRIMARY_ID
+#else
+	/* lib is part of the App -> operate on active slot */
+#if (PM_ADDRESS - PM_ADDRESS_OFFSET) == PM_MCUBOOT_PRIMARY_ADDRESS
+	#define ACTIVE_SLOT_ID		PM_MCUBOOT_PRIMARY_ID
+#elif (PM_ADDRESS - PM_ADDRESS_OFFSET) == PM_MCUBOOT_SECONDARY_ADDRESS
+	#define ACTIVE_SLOT_ID		PM_MCUBOOT_SECONDARY_ID
+#else
+	#error Missing partition definitions.
+#endif
+#endif /* CONFIG_MCUBOOT */
+
+#define ACTIVE_SLOT_FLASH_AREA_ID ACTIVE_SLOT_ID
+#else
 /* Get active partition. zephyr,code-partition chosen node must be defined */
 #define ACTIVE_SLOT_FLASH_AREA_ID DT_FIXED_PARTITION_ID(DT_CHOSEN(zephyr_code_partition))
+#endif /* USE_PARTITION_MANAGER */
 
 /*
  * Raw (on-flash) representation of the v1 image header.
diff --git a/subsys/fs/littlefs_fs.c b/subsys/fs/littlefs_fs.c
index 5989f856ac1..3d0c71e2367 100644
--- a/subsys/fs/littlefs_fs.c
+++ b/subsys/fs/littlefs_fs.c
@@ -1070,7 +1070,12 @@ struct fs_mount_t FS_FSTAB_ENTRY(DT_DRV_INST(inst)) = { \
 	.type = FS_LITTLEFS, \
 	.mnt_point = DT_INST_PROP(inst, mount_point), \
 	.fs_data = &fs_data_##inst, \
-	.storage_dev = (void *)DT_FIXED_PARTITION_ID(FS_PARTITION(inst)), \
+	.storage_dev = (void *) \
+		COND_CODE_1(USE_PARTITION_MANAGER, \
+			    (COND_CODE_1(FIXED_PARTITION_EXISTS(littlefs_storage), \
+					 (FIXED_PARTITION_ID(littlefs_storage)), \
+					 (FIXED_PARTITION_ID(storage)))), \
+			    (DT_FIXED_PARTITION_ID(FS_PARTITION(inst)))), \
 	.flags = FSTAB_ENTRY_DT_MOUNT_FLAGS(DT_DRV_INST(inst)), \
 };
 
diff --git a/subsys/fs/nvs/Kconfig b/subsys/fs/nvs/Kconfig
index 8b7dfdbab40..b3bd46c5b76 100644
--- a/subsys/fs/nvs/Kconfig
+++ b/subsys/fs/nvs/Kconfig
@@ -29,6 +29,15 @@ config NVS_LOOKUP_CACHE_SIZE
 	  Number of entries in Non-volatile Storage lookup cache.
 	  It is recommended that it be a power of 2.
 
+config NVS_LOOKUP_CACHE_FOR_SETTINGS
+	bool "Non-volatile Storage lookup cache optimized for settings"
+	depends on NVS_LOOKUP_CACHE
+	help
+	  Use the lookup cache hash function that results in the least number of
+	  collissions and, in turn, the best NVS performance provided that the NVS
+	  is used as the settings backend only. This option should NOT be enabled
+	  if the NVS is also written to directly, outside the settings layer.
+
 config NVS_DATA_CRC
 	bool "Non-volatile Storage CRC protection on the data"
 	help
diff --git a/subsys/fs/nvs/nvs.c b/subsys/fs/nvs/nvs.c
index 9e6578a5576..28bd5655c14 100644
--- a/subsys/fs/nvs/nvs.c
+++ b/subsys/fs/nvs/nvs.c
@@ -13,6 +13,11 @@
 #include <zephyr/sys/crc.h>
 #include "nvs_priv.h"
 
+#ifdef CONFIG_NVS_LOOKUP_CACHE_FOR_SETTINGS
+#include <zephyr/sys/util.h>
+#include <settings/settings_nvs.h>
+#endif
+
 #include <zephyr/logging/log.h>
 LOG_MODULE_REGISTER(fs_nvs, CONFIG_NVS_LOG_LEVEL);
 
@@ -21,6 +26,45 @@ static int nvs_ate_valid(struct nvs_fs *fs, const struct nvs_ate *entry);
 
 #ifdef CONFIG_NVS_LOOKUP_CACHE
 
+#ifdef CONFIG_NVS_LOOKUP_CACHE_FOR_SETTINGS
+
+static inline size_t nvs_lookup_cache_pos(uint16_t id)
+{
+	/*
+	 * 1. The NVS settings backend uses up to (NVS_NAME_ID_OFFSET - 1) NVS IDs to
+	      store keys and equal number of NVS IDs to store values.
+	 * 2. For each key-value pair, the value is stored at NVS ID greater by exactly
+	 *    NVS_NAME_ID_OFFSET than NVS ID that holds the key.
+	 * 3. The backend tries to minimize the range of NVS IDs used to store keys.
+	 *    That is, NVS IDs are allocated sequentially, and freed NVS IDs are reused
+	 *    before allocating new ones.
+	 *
+	 * Therefore, to assure the least number of collisions in the lookup cache,
+	 * the least significant bit of the hash indicates whether the given NVS ID
+	 * represents a key or a value, and remaining bits of the hash are set to
+	 * the ordinal number of the key-value pair. Consequently, the hash function
+	 * provides the following mapping:
+	 *
+	 * 1st settings key   => hash 0
+	 * 1st settings value => hash 1
+	 * 2nd settings key   => hash 2
+	 * 2nd settings value => hash 3
+	 * ...
+	 */
+	BUILD_ASSERT(IS_POWER_OF_TWO(NVS_NAMECNT_ID), "NVS_NAMECNT_ID is not power of 2");
+	BUILD_ASSERT(IS_POWER_OF_TWO(NVS_NAME_ID_OFFSET), "NVS_NAME_ID_OFFSET is not power of 2");
+
+	uint16_t key_value_bit;
+	uint16_t key_value_ord;
+
+	key_value_bit = (id >> LOG2(NVS_NAME_ID_OFFSET)) & 1;
+	key_value_ord = id & (NVS_NAME_ID_OFFSET - 1);
+
+	return ((key_value_ord << 1) | key_value_bit) % CONFIG_NVS_LOOKUP_CACHE_SIZE;
+}
+
+#else /* CONFIG_NVS_LOOKUP_CACHE_FOR_SETTINGS */
+
 static inline size_t nvs_lookup_cache_pos(uint16_t id)
 {
 	uint16_t hash;
@@ -36,6 +80,8 @@ static inline size_t nvs_lookup_cache_pos(uint16_t id)
 	return hash % CONFIG_NVS_LOOKUP_CACHE_SIZE;
 }
 
+#endif /* CONFIG_NVS_LOOKUP_CACHE_FOR_SETTINGS */
+
 static int nvs_lookup_cache_rebuild(struct nvs_fs *fs)
 {
 	int rc;
diff --git a/subsys/ipc/ipc_service/backends/ipc_icbmsg.c b/subsys/ipc/ipc_service/backends/ipc_icbmsg.c
index 624896d657a..70c4c4c362f 100644
--- a/subsys/ipc/ipc_service/backends/ipc_icbmsg.c
+++ b/subsys/ipc/ipc_service/backends/ipc_icbmsg.c
@@ -139,6 +139,14 @@ enum ept_bounding_state {
 	EPT_READY,		/* Bounding is done. Bound callback was called. */
 };
 
+enum ept_rebound_state {
+	EPT_NORMAL = 0,		/* No endpoint rebounding is needed. */
+	EPT_DEREGISTERED,	/* Endpoint was deregistered. */
+	EPT_REBOUNDING,		/* Rebounding was requested, waiting for work queue to
+				 * start rebounding process.
+				 */
+};
+
 struct channel_config {
 	uint8_t *blocks_ptr;	/* Address where the blocks start. */
 	size_t block_size;	/* Size of one block. */
@@ -159,6 +167,7 @@ struct icbmsg_config {
 struct ept_data {
 	const struct ipc_ept_cfg *cfg;	/* Endpoint configuration. */
 	atomic_t state;			/* Bounding state. */
+	atomic_t rebound_state;		/* Rebounding state. */
 	uint8_t addr;			/* Endpoint address. */
 };
 
@@ -768,6 +777,18 @@ static void ept_bound_process(struct backend_data *dev_data)
 		k_mutex_unlock(&dev_data->mutex);
 #endif
 	}
+
+	/* Check if any endpoint is ready to rebound and call the callback if it is. */
+	for (i = 0; i < NUM_EPT; i++) {
+		ept = &dev_data->ept[i];
+		matching_state = atomic_cas(&ept->rebound_state, EPT_REBOUNDING,
+						EPT_NORMAL);
+		if (matching_state) {
+			if (ept->cfg->cb.bound != NULL) {
+				ept->cfg->cb.bound(ept->cfg->priv);
+			}
+		}
+	}
 }
 
 /**
@@ -791,7 +812,10 @@ static struct ept_data *get_ept_and_rx_validate(struct backend_data *dev_data,
 	state = atomic_get(&ept->state);
 
 	if (state == EPT_READY) {
-		/* Valid state - nothing to do. */
+		/* Ready state, ensure that it is not deregistered nor rebounding. */
+		if (atomic_get(&ept->rebound_state) != EPT_NORMAL) {
+			return NULL;
+		}
 	} else if (state == EPT_BOUNDING) {
 		/* Endpoint bound callback was not called yet - call it. */
 		atomic_set(&ept->state, EPT_READY);
@@ -1053,9 +1077,28 @@ static int register_ept(const struct device *instance, void **token,
 {
 	struct backend_data *dev_data = instance->data;
 	struct ept_data *ept = NULL;
+	bool matching_state;
 	int ept_index;
 	int r = 0;
 
+	/* Try to find endpoint to rebound */
+	for (ept_index = 0; ept_index < NUM_EPT; ept_index++) {
+		ept = &dev_data->ept[ept_index];
+		if (ept->cfg == cfg) {
+			matching_state = atomic_cas(&ept->rebound_state, EPT_DEREGISTERED,
+						   EPT_REBOUNDING);
+			if (!matching_state) {
+				return -EINVAL;
+			}
+#ifdef CONFIG_MULTITHREADING
+			schedule_ept_bound_process(dev_data);
+#else
+			ept_bound_process(dev_data);
+#endif
+			return 0;
+		}
+	}
+
 	/* Reserve new endpoint index. */
 	ept_index = atomic_inc(&dev_data->flags) & FLAG_EPT_COUNT_MASK;
 	if (ept_index >= NUM_EPT) {
@@ -1086,6 +1129,23 @@ static int register_ept(const struct device *instance, void **token,
 	return r;
 }
 
+/**
+ * Backend endpoint deregistration callback.
+ */
+static int deregister_ept(const struct device *instance, void *token)
+{
+	struct ept_data *ept = token;
+	bool matching_state;
+
+	matching_state = atomic_cas(&ept->rebound_state, EPT_NORMAL, EPT_DEREGISTERED);
+
+	if (!matching_state) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 /**
  * Returns maximum TX buffer size.
  */
@@ -1214,7 +1274,7 @@ const static struct ipc_service_backend backend_ops = {
 	.close_instance = NULL, /* not implemented */
 	.send = send,
 	.register_endpoint = register_ept,
-	.deregister_endpoint = NULL, /* not implemented */
+	.deregister_endpoint = deregister_ept,
 	.get_tx_buffer_size = get_tx_buffer_size,
 	.get_tx_buffer = get_tx_buffer,
 	.drop_tx_buffer = drop_tx_buffer,
diff --git a/subsys/ipc/rpmsg_service/rpmsg_backend.h b/subsys/ipc/rpmsg_service/rpmsg_backend.h
index a74e46b8520..9996e1d74d9 100644
--- a/subsys/ipc/rpmsg_service/rpmsg_backend.h
+++ b/subsys/ipc/rpmsg_service/rpmsg_backend.h
@@ -13,8 +13,35 @@
 extern "C" {
 #endif
 
+#if CONFIG_PARTITION_MANAGER_ENABLED
+
+#include "pm_config.h"
+
+#if defined(PM_RPMSG_NRF53_SRAM_ADDRESS) || defined(PM__RPMSG_NRF53_SRAM_ADDRESS)
+
+#if defined(PM_RPMSG_NRF53_SRAM_ADDRESS)
+#define VDEV_START_ADDR PM_RPMSG_NRF53_SRAM_ADDRESS
+#define VDEV_SIZE PM_RPMSG_NRF53_SRAM_SIZE
+#else
+/* The current image is a child image in a different domain than the image
+ * which defined the required values. To reach the values of the parent domain
+ * we use the 'PM__' variant of the define.
+ */
+#define VDEV_START_ADDR PM__RPMSG_NRF53_SRAM_ADDRESS
+#define VDEV_SIZE PM__RPMSG_NRF53_SRAM_SIZE
+#endif /* defined(PM_RPMSG_NRF53_SRAM_ADDRESS) */
+
+#else
 #define VDEV_START_ADDR		DT_REG_ADDR(DT_CHOSEN(zephyr_ipc_shm))
 #define VDEV_SIZE		DT_REG_SIZE(DT_CHOSEN(zephyr_ipc_shm))
+#endif /* defined(PM_RPMSG_NRF53_SRAM_ADDRESS) || defined(PM__RPMSG_NRF53_SRAM_ADDRESS) */
+
+#else
+
+#define VDEV_START_ADDR		DT_REG_ADDR(DT_CHOSEN(zephyr_ipc_shm))
+#define VDEV_SIZE		DT_REG_SIZE(DT_CHOSEN(zephyr_ipc_shm))
+
+#endif /* CONFIG_PARTITION_MANAGER_ENABLED */
 
 #define VDEV_STATUS_ADDR	VDEV_START_ADDR
 #define VDEV_STATUS_SIZE	0x400
diff --git a/subsys/logging/frontends/Kconfig b/subsys/logging/frontends/Kconfig
index e5c3870b1b6..9d4b7a43797 100644
--- a/subsys/logging/frontends/Kconfig
+++ b/subsys/logging/frontends/Kconfig
@@ -95,6 +95,12 @@ config LOG_FRONTEND_STMESP_DEMUX_BUFFER_SIZE
 config LOG_FRONTEND_STMESP_DEMUX_MAX_UTILIZATION
 	bool "Track maximum utilization"
 
+config LOG_FRONTEND_STMESP_DEMUX_GC_TIMEOUT
+	int "Message timeout (in milliseconds)"
+	default 100
+	help
+	  If log message is not completed within that time frame it is discarded.
+
 endif # LOG_FRONTEND_STMESP_DEMUX
 
 config LOG_FRONTEND_STMESP_FLUSH_PORT_ID
diff --git a/subsys/logging/frontends/log_frontend_stmesp.c b/subsys/logging/frontends/log_frontend_stmesp.c
index 389f0f72aeb..4042fac853c 100644
--- a/subsys/logging/frontends/log_frontend_stmesp.c
+++ b/subsys/logging/frontends/log_frontend_stmesp.c
@@ -26,15 +26,19 @@ BUILD_ASSERT(sizeof(void *) == sizeof(uint32_t));
 
 #define STMESP_FLUSH_WORD 0xaabbccdd
 
-#define STM_FLAG(reg) \
+#define STM_FLAG(reg)                                                                              \
 	stmesp_flag(reg, 1, false, IS_ENABLED(CONFIG_LOG_FRONTEND_STMESP_GUARANTEED_ACCESS))
 
-#define STM_D8(reg, data, timestamp, marked)       \
-	stmesp_data8(reg, data, timestamp, marked, \
+#define STM_D8(reg, data, timestamp, marked)                                                       \
+	stmesp_data8(reg, data, timestamp, marked,                                                 \
 		     IS_ENABLED(CONFIG_LOG_FRONTEND_STMESP_GUARANTEED_ACCESS))
 
-#define STM_D32(reg, data, timestamp, marked)       \
-	stmesp_data32(reg, data, timestamp, marked, \
+#define STM_D16(reg, data, timestamp, marked)                                                      \
+	stmesp_data16(reg, data, timestamp, marked,                                                \
+		      IS_ENABLED(CONFIG_LOG_FRONTEND_STMESP_GUARANTEED_ACCESS))
+
+#define STM_D32(reg, data, timestamp, marked)                                                      \
+	stmesp_data32(reg, data, timestamp, marked,                                                \
 		      IS_ENABLED(CONFIG_LOG_FRONTEND_STMESP_GUARANTEED_ACCESS))
 
 /* Buffer for storing frontend data before STM/ETR is ready for usage.
@@ -95,7 +99,7 @@ union stm_log_dict_hdr {
 /* Dictionary header initializer. */
 #define DICT_HDR_INITIALIZER(_level, _source_id, _data_len)                                        \
 	{                                                                                          \
-		.hdr = {.ver = CONFIG_LOG_FRONTEND_STMESP_DICT_VER,                         \
+		.hdr = {.ver = CONFIG_LOG_FRONTEND_STMESP_DICT_VER,                                \
 			.type = STM_MSG_TYPE_LOG_DICT,                                             \
 			.level = _level,                                                           \
 			.data_len = _data_len,                                                     \
@@ -211,18 +215,72 @@ static int early_package_cb(const void *buf, size_t len, void *ctx)
 
 static inline void write_data(const void *data, size_t len, STMESP_Type *const stm_esp)
 {
-	uint32_t *p32 = (uint32_t *)data;
+	const uint8_t *p8 = data;
+	const uint32_t *p32;
+	uint32_t unaligned;
+
+	if (!len) {
+		return;
+	}
 
+	/* Start by writing using D8 or D16 until pointer is word aligned. */
+	unaligned = (uintptr_t)data & 0x00000003UL;
+	if (unaligned != 0) {
+		unaligned = 4 - unaligned;
+		unaligned = MIN(len, unaligned);
+
+		len -= unaligned;
+
+		switch (unaligned) {
+		case 3:
+			STM_D8(stm_esp, *p8++, false, false);
+			STM_D16(stm_esp, *(uint16_t *)p8, false, false);
+			p8 += sizeof(uint16_t);
+			break;
+		case 2:
+			if (len) {
+				STM_D16(stm_esp, *(uint16_t *)p8, false, false);
+				p8 += sizeof(uint16_t);
+			} else {
+				/* If len 0 then it means that even though 2 bytes are
+				 * to be copied we can have address which is not aligned
+				 * to 2 bytes.
+				 */
+				STM_D8(stm_esp, *p8++, false, false);
+				STM_D8(stm_esp, *p8++, false, false);
+			}
+			break;
+		default:
+			/* 1 byte to align. */
+			STM_D8(stm_esp, *p8++, false, false);
+		}
+	}
+
+	p32 = (const uint32_t *)p8;
+
+	/* Use D32 to write as much data as possible. */
 	while (len >= sizeof(uint32_t)) {
 		STM_D32(stm_esp, *p32++, false, false);
 		len -= sizeof(uint32_t);
 	}
 
-	uint8_t *p8 = (uint8_t *)p32;
-
-	while (len > 0) {
-		STM_D8(stm_esp, *p8++, false, false);
-		len--;
+	/* Write tail using D16 or D8. Address is word aligned at that point. */
+	if (len) {
+		p8 = (const uint8_t *)p32;
+		switch (len) {
+		case 2:
+			STM_D16(stm_esp, *(uint16_t *)p8, false, false);
+			p8 += sizeof(uint16_t);
+			break;
+		case 3:
+			STM_D16(stm_esp, *(uint16_t *)p8, false, false);
+			p8 += sizeof(uint16_t);
+			/* fallthrough */
+		default:
+			/* 1 byte to align. */
+			STM_D8(stm_esp, *p8++, false, false);
+			break;
+		}
 	}
 }
 
@@ -281,8 +339,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 	size_t sname_len;
 	int package_len;
 	int total_len;
-	static const uint32_t flags = CBPRINTF_PACKAGE_CONVERT_RW_STR |
-				      CBPRINTF_PACKAGE_CONVERT_RO_STR;
+	static const uint32_t flags =
+		CBPRINTF_PACKAGE_CONVERT_RW_STR | CBPRINTF_PACKAGE_CONVERT_RO_STR;
 
 	sname = log_source_name_get(0, get_source_id(source));
 	if (sname) {
@@ -293,8 +351,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 	}
 	total_len = desc.data_len + sname_len /* null terminator */;
 
-	package_len = cbprintf_package_convert(package, desc.package_len, NULL, NULL, flags,
-					       strl, ARRAY_SIZE(strl));
+	package_len = cbprintf_package_convert(package, desc.package_len, NULL, NULL, flags, strl,
+					       ARRAY_SIZE(strl));
 	hdr.log.total_len = total_len + package_len;
 	hdr.log.package_len = package_len;
 
@@ -308,8 +366,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 		}
 
 		STM_D32(stm_esp, hdr.raw, use_timestamp, true);
-		(void)cbprintf_package_convert(package, desc.package_len,
-					       package_cb, stm_esp, flags, strl, ARRAY_SIZE(strl));
+		(void)cbprintf_package_convert(package, desc.package_len, package_cb, stm_esp,
+					       flags, strl, ARRAY_SIZE(strl));
 		write_data(sname, sname_len, stm_esp);
 		if (data) {
 			write_data(data, desc.data_len, stm_esp);
@@ -327,8 +385,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 		}
 
 		early_buf_put_data((const uint8_t *)&hdr, sizeof(hdr));
-		(void)cbprintf_package_convert(package, desc.package_len, early_package_cb,
-					       NULL, flags, strl, ARRAY_SIZE(strl));
+		(void)cbprintf_package_convert(package, desc.package_len, early_package_cb, NULL,
+					       flags, strl, ARRAY_SIZE(strl));
 		early_buf_put_data(sname, sname_len);
 		if (data) {
 			early_buf_put_data(data, desc.data_len);
@@ -357,8 +415,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 		}
 
 		STM_D32(stm_esp, dict_desc.raw, true, true);
-		(void)cbprintf_package_convert(package, desc.package_len, package_cb,
-					       stm_esp, flags, NULL, 0);
+		(void)cbprintf_package_convert(package, desc.package_len, package_cb, stm_esp,
+					       flags, NULL, 0);
 		if (data) {
 			package_cb(data, desc.data_len, stm_esp);
 		}
@@ -370,8 +428,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 		key = k_spin_lock(&lock);
 		len_loc = early_buf_len_loc();
 		early_package_cb(&dict_desc.raw, sizeof(dict_desc.raw), NULL);
-		(void)cbprintf_package_convert(package, desc.package_len, early_package_cb,
-					       NULL, flags, NULL, 0);
+		(void)cbprintf_package_convert(package, desc.package_len, early_package_cb, NULL,
+					       flags, NULL, 0);
 		if (data) {
 			early_package_cb(data, desc.data_len, NULL);
 		}
@@ -383,8 +441,8 @@ void log_frontend_msg(const void *source, const struct log_msg_desc desc, uint8_
 /* Common function for optimized message (log with 0-2 arguments) which is used in
  * case when STMESP is not yet ready.
  */
-static inline uint32_t *early_msg_start(uint32_t level, const void *source,
-					uint32_t package_hdr, const char *fmt)
+static inline uint32_t *early_msg_start(uint32_t level, const void *source, uint32_t package_hdr,
+					const char *fmt)
 {
 	union stm_log_dict_hdr dict_desc = DICT_HDR_INITIALIZER(level, get_source_id(source), 0);
 	uint32_t fmt32 = (uint32_t)fmt;
@@ -398,8 +456,8 @@ static inline uint32_t *early_msg_start(uint32_t level, const void *source,
 }
 
 /* Common function for optimized message (log with 0-2 arguments) which writes to STMESP */
-static inline void msg_start(STMESP_Type *stm_esp, uint32_t level,
-			     const void *source, uint32_t package_hdr, const char *fmt)
+static inline void msg_start(STMESP_Type *stm_esp, uint32_t level, const void *source,
+			     uint32_t package_hdr, const char *fmt)
 
 {
 	union stm_log_dict_hdr dict_desc = DICT_HDR_INITIALIZER(level, get_source_id(source), 0);
diff --git a/subsys/logging/frontends/log_frontend_stmesp_demux.c b/subsys/logging/frontends/log_frontend_stmesp_demux.c
index ed09f89ec8e..a3c052eab25 100644
--- a/subsys/logging/frontends/log_frontend_stmesp_demux.c
+++ b/subsys/logging/frontends/log_frontend_stmesp_demux.c
@@ -25,6 +25,7 @@ BUILD_ASSERT(sizeof(struct log_frontend_stmesp_demux_log_header) == sizeof(uint3
 struct log_frontend_stmesp_demux_active_entry {
 	sys_snode_t node;
 	uint32_t m_ch;
+	uint32_t ts;
 	struct log_frontend_stmesp_demux_log *packet;
 	int off;
 };
@@ -221,6 +222,36 @@ static void log_frontend_stmesp_demux_hw_event(uint64_t *ts, uint8_t data)
 	mpsc_pbuf_put_data(&demux.pbuf, (const uint32_t *)&packet, wlen);
 }
 
+/* Check if there are any active messages which are not completed for a significant
+ * amount of time. It may indicate that part of message was lost (due to reset,
+ * fault in the core or fault on the bus). In that case message shall be closed as
+ * incomplete to not block processing of other messages.
+ */
+static void garbage_collector(uint32_t now)
+{
+	sys_snode_t *node;
+
+	SYS_SLIST_FOR_EACH_NODE(&demux.active_entries, node) {
+		struct log_frontend_stmesp_demux_active_entry *entry =
+			CONTAINER_OF(node, struct log_frontend_stmesp_demux_active_entry, node);
+
+		if ((now - entry->ts) > CONFIG_LOG_FRONTEND_STMESP_DEMUX_GC_TIMEOUT) {
+			union log_frontend_stmesp_demux_packet p = {.log = entry->packet};
+
+			sys_slist_find_and_remove(&demux.active_entries, node);
+			entry->packet->content_invalid = 1;
+			mpsc_pbuf_commit(&demux.pbuf, p.generic);
+			demux.dropped++;
+			k_mem_slab_free(&demux.mslab, entry);
+			/* After removing one we need to stop as removing disrupts
+			 * iterating over the list as current node is no longer in
+			 * the list.
+			 */
+			break;
+		}
+	}
+}
+
 int log_frontend_stmesp_demux_packet_start(uint32_t *data, uint64_t *ts)
 {
 	if (skip) {
@@ -265,9 +296,10 @@ int log_frontend_stmesp_demux_packet_start(uint32_t *data, uint64_t *ts)
 	union log_frontend_stmesp_demux_header hdr = {.raw = *data};
 	uint32_t pkt_len = hdr.log.total_len + offsetof(struct log_frontend_stmesp_demux_log, data);
 	uint32_t wlen = calc_wlen(pkt_len);
+	uint32_t now = k_uptime_get_32();
 
+	garbage_collector(now);
 	err = k_mem_slab_alloc(&demux.mslab, (void **)&entry, K_NO_WAIT);
-
 	if (err < 0) {
 		goto on_nomem;
 	}
@@ -288,6 +320,7 @@ int log_frontend_stmesp_demux_packet_start(uint32_t *data, uint64_t *ts)
 	}
 	entry->packet->hdr = hdr.log;
 	entry->packet->hdr.major = m;
+	entry->ts = now;
 	demux.curr = entry;
 	sys_slist_append(&demux.active_entries, &entry->node);
 
diff --git a/subsys/mgmt/mcumgr/CMakeLists.txt b/subsys/mgmt/mcumgr/CMakeLists.txt
index 39d4a4ca8ce..ad088eca067 100644
--- a/subsys/mgmt/mcumgr/CMakeLists.txt
+++ b/subsys/mgmt/mcumgr/CMakeLists.txt
@@ -16,3 +16,11 @@ add_subdirectory(transport)
 add_subdirectory_ifdef(CONFIG_SMP_CLIENT    smp_client)
 
 zephyr_library_link_libraries(mgmt_mcumgr)
+
+if (CONFIG_BOOT_IMAGE_ACCESS_HOOKS)
+    zephyr_include_directories(
+        ${ZEPHYR_MCUBOOT_MODULE_DIR}/boot/bootutil/include
+        ${ZEPHYR_MCUBOOT_MODULE_DIR}/boot/zephyr/include
+    )
+    zephyr_library_sources(bootutil_hooks/nrf53_hooks.c)
+endif()
diff --git a/subsys/mgmt/mcumgr/Kconfig b/subsys/mgmt/mcumgr/Kconfig
index 49bd17f4669..1c6a3a2a516 100644
--- a/subsys/mgmt/mcumgr/Kconfig
+++ b/subsys/mgmt/mcumgr/Kconfig
@@ -6,6 +6,7 @@ menuconfig MCUMGR
 	bool "mcumgr Support"
 	depends on NET_BUF
 	depends on ZCBOR
+	imply BOOT_IMAGE_ACCESS_HOOKS if (SOC_NRF5340_CPUAPP_QKAA && MCUMGR_GRP_IMG)
 	help
 	  This option enables the mcumgr management library.
 
diff --git a/subsys/mgmt/mcumgr/bootutil_hooks/nrf53_hooks.c b/subsys/mgmt/mcumgr/bootutil_hooks/nrf53_hooks.c
new file mode 100644
index 00000000000..9971a4e0843
--- /dev/null
+++ b/subsys/mgmt/mcumgr/bootutil_hooks/nrf53_hooks.c
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2022 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/kernel.h>
+#include <zephyr/device.h>
+#include "bootutil/bootutil_public.h"
+
+int boot_read_swap_state_primary_slot_hook(int image_index,
+		struct boot_swap_state *state)
+{
+	if (image_index == 1) {
+		/* Pretend that primary slot of image 1 unpopulated */
+		state->magic = BOOT_MAGIC_UNSET;
+		state->swap_type = BOOT_SWAP_TYPE_NONE;
+		state->image_num = image_index;
+		state->copy_done = BOOT_FLAG_UNSET;
+		state->image_ok = BOOT_FLAG_UNSET;
+
+		/* Prevent bootutil from trying to obtain true info */
+		return 0;
+	}
+
+	return BOOT_HOOK_REGULAR;
+}
diff --git a/subsys/mgmt/mcumgr/grp/img_mgmt/Kconfig b/subsys/mgmt/mcumgr/grp/img_mgmt/Kconfig
index 56030a1cd5c..5e6da1e0ba7 100644
--- a/subsys/mgmt/mcumgr/grp/img_mgmt/Kconfig
+++ b/subsys/mgmt/mcumgr/grp/img_mgmt/Kconfig
@@ -201,6 +201,14 @@ config MCUMGR_GRP_IMG_IMAGE_SLOT_STATE_STATES
 	  The value does not affect memory allocation, it is used by zcbor
 	  to figure out how to encode map depending on its predicted size.
 
+config MCUMGR_GRP_IMG_QSPI_XIP_SPLIT_IMAGE
+	bool "QSPI XIP Split image mode"
+	depends on MCUBOOT_BOOTLOADER_MODE_DIRECT_XIP
+	help
+	  This option should not be selected by users and should automatically be selected by
+	  sysbuild if needed. This enables selecting the correct slot when running a QSPI XIP
+	  split image application in DirectXIP mode.
+
 module = MCUMGR_GRP_IMG
 module-str = mcumgr_grp_img
 source "subsys/logging/Kconfig.template.log_config"
diff --git a/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt.c b/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt.c
index 467eb03bced..e10953a155a 100644
--- a/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt.c
+++ b/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt.c
@@ -33,6 +33,23 @@
 #include <zephyr/mgmt/mcumgr/mgmt/callbacks.h>
 #endif
 
+#if USE_PARTITION_MANAGER
+#include <flash_map_pm.h>
+
+#ifdef PM_MCUBOOT_SECONDARY_PAD_SIZE
+BUILD_ASSERT(PM_MCUBOOT_PAD_SIZE == PM_MCUBOOT_SECONDARY_PAD_SIZE);
+#endif
+
+#if CONFIG_BUILD_WITH_TFM
+  #define PM_ADDRESS_OFFSET (PM_MCUBOOT_PAD_SIZE + PM_TFM_SIZE)
+#else
+  #define PM_ADDRESS_OFFSET (PM_MCUBOOT_PAD_SIZE)
+#endif
+
+#define FIXED_PARTITION_IS_RUNNING_APP_PARTITION(label)	\
+	(FIXED_PARTITION_OFFSET(label) == (PM_ADDRESS - PM_ADDRESS_OFFSET))
+
+#else /* ! USE_PARTITION_MANAGER */
 #ifndef CONFIG_FLASH_LOAD_OFFSET
 #error MCUmgr requires application to be built with CONFIG_FLASH_LOAD_OFFSET set \
 	to be able to figure out application running slot.
@@ -40,6 +57,7 @@
 
 #define FIXED_PARTITION_IS_RUNNING_APP_PARTITION(label)	\
 	 (FIXED_PARTITION_OFFSET(label) == CONFIG_FLASH_LOAD_OFFSET)
+#endif /* USE_PARTITION_MANAGER */
 
 BUILD_ASSERT(sizeof(struct image_header) == IMAGE_HEADER_SIZE,
 	     "struct image_header not required size");
@@ -141,6 +159,12 @@ int img_mgmt_active_slot(int image)
 	/* Multi image does not support DirectXIP currently */
 #if CONFIG_MCUMGR_GRP_IMG_UPDATABLE_IMAGE_NUMBER > 1
 	slot = (image << 1);
+
+#if CONFIG_MCUMGR_GRP_IMG_QSPI_XIP_SPLIT_IMAGE
+	if (FIXED_PARTITION_IS_RUNNING_APP_PARTITION(slot1_partition)) {
+		slot += 1;
+	}
+#endif
 #else
 	/* This covers single image, including DirectXiP */
 	if (FIXED_PARTITION_IS_RUNNING_APP_PARTITION(slot1_partition)) {
diff --git a/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt_state.c b/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt_state.c
index a580d7af6c3..6a4a0aeeea3 100644
--- a/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt_state.c
+++ b/subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt_state.c
@@ -285,13 +285,14 @@ int img_mgmt_get_next_boot_slot(int image, enum img_mgmt_next_boot_type *type)
 			return_slot = other_slot;
 		}
 	}
+out:
+
 #else
 	if (rcs == 0 && rca == 0 && img_mgmt_vercmp(&aver, &over) < 0) {
 		return_slot = other_slot;
 	}
 #endif /* defined(CONFIG_MCUBOOT_BOOTLOADER_MODE_DIRECT_XIP_WITH_REVERT) */
 
-out:
 	if (type != NULL) {
 		*type = lt;
 	}
diff --git a/subsys/net/conn_mgr/Kconfig b/subsys/net/conn_mgr/Kconfig
index 683634de987..541edf0e63e 100644
--- a/subsys/net/conn_mgr/Kconfig
+++ b/subsys/net/conn_mgr/Kconfig
@@ -24,6 +24,7 @@ source "subsys/net/Kconfig.template.log_config.net"
 
 config NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE
 	int "Size of the stack allocated for the conn_mgr_monitor thread"
+	default 8192 if WPA_SUPP
 	default 512
 	help
 	  Sets the stack size which will be used by the connection manager for connectivity monitoring.
diff --git a/subsys/net/lib/mqtt/mqtt_transport_socket_tls.c b/subsys/net/lib/mqtt/mqtt_transport_socket_tls.c
index a33cee5aecf..c3816e5949f 100644
--- a/subsys/net/lib/mqtt/mqtt_transport_socket_tls.c
+++ b/subsys/net/lib/mqtt/mqtt_transport_socket_tls.c
@@ -22,10 +22,15 @@ int mqtt_client_tls_connect(struct mqtt_client *client)
 {
 	const struct sockaddr *broker = client->broker;
 	struct mqtt_sec_config *tls_config = &client->transport.tls.config;
+	int type = SOCK_STREAM;
 	int ret;
 
+	if (tls_config->set_native_tls) {
+		type |= SOCK_NATIVE_TLS;
+	}
+
 	client->transport.tls.sock = zsock_socket(broker->sa_family,
-						  SOCK_STREAM, IPPROTO_TLS_1_2);
+						  type, IPPROTO_TLS_1_2);
 	if (client->transport.tls.sock < 0) {
 		return -errno;
 	}
@@ -91,6 +96,16 @@ int mqtt_client_tls_connect(struct mqtt_client *client)
 		}
 	}
 
+	if (tls_config->session_cache == TLS_SESSION_CACHE_ENABLED) {
+		ret = zsock_setsockopt(client->transport.tls.sock, SOL_TLS,
+				       TLS_SESSION_CACHE,
+				       &tls_config->session_cache,
+				       sizeof(tls_config->session_cache));
+		if (ret < 0) {
+			goto error;
+		}
+	}
+
 	if (tls_config->cert_nocopy != TLS_CERT_NOCOPY_NONE) {
 		ret = zsock_setsockopt(client->transport.tls.sock, SOL_TLS,
 				       TLS_CERT_NOCOPY, &tls_config->cert_nocopy,
diff --git a/tests/bluetooth/controller/ctrl_api/testcase.yaml b/tests/bluetooth/controller/ctrl_api/testcase.yaml
index 19bf6c9ab49..21f178bf9b2 100644
--- a/tests/bluetooth/controller/ctrl_api/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_api/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_api.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_chmu/testcase.yaml b/tests/bluetooth/controller/ctrl_chmu/testcase.yaml
index f7e8068d60e..9c3ee626433 100644
--- a/tests/bluetooth/controller/ctrl_chmu/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_chmu/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_chmu.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_cis_create/testcase.yaml b/tests/bluetooth/controller/ctrl_cis_create/testcase.yaml
index 99612a89bc3..2371d7063eb 100644
--- a/tests/bluetooth/controller/ctrl_cis_create/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_cis_create/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_cis_create.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_cis_terminate/testcase.yaml b/tests/bluetooth/controller/ctrl_cis_terminate/testcase.yaml
index 956172a89b2..a98229ba45f 100644
--- a/tests/bluetooth/controller/ctrl_cis_terminate/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_cis_terminate/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_cis_terminate.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_collision/testcase.yaml b/tests/bluetooth/controller/ctrl_collision/testcase.yaml
index 6086a9a4ebc..daa8f3bc6c3 100644
--- a/tests/bluetooth/controller/ctrl_collision/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_collision/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_collision.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_conn_update/testcase.yaml b/tests/bluetooth/controller/ctrl_conn_update/testcase.yaml
index 5b0bda4b908..fc4ecb0b647 100644
--- a/tests/bluetooth/controller/ctrl_conn_update/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_conn_update/testcase.yaml
@@ -7,11 +7,18 @@ common:
 tests:
   bluetooth.controller.ctrl_conn_update.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_conn_update.apm_test:
     type: unit
-    extra_args: CONF_FILE=prj_apm.conf
+    extra_args:
+      - CONF_FILE=prj_apm.conf
+      - SNIPPET="bt-ll-sw-split"
+
 
   bluetooth.controller.ctrl_conn_update.no_param_req_test:
     type: unit
-    extra_args: CONF_FILE=prj_no_param_req.conf
+    extra_args:
+      - CONF_FILE=prj_no_param_req.conf
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_cte_req/testcase.yaml b/tests/bluetooth/controller/ctrl_cte_req/testcase.yaml
index fd6ff51118d..c6288aecc43 100644
--- a/tests/bluetooth/controller/ctrl_cte_req/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_cte_req/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_cte_req.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_data_length_update/testcase.yaml b/tests/bluetooth/controller/ctrl_data_length_update/testcase.yaml
index 9778af435b4..c7d1174e12b 100644
--- a/tests/bluetooth/controller/ctrl_data_length_update/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_data_length_update/testcase.yaml
@@ -6,11 +6,17 @@ common:
 tests:
   bluetooth.controller.ctrl_data_length_update.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_data_length_update.test_nocodedphy:
     type: unit
-    extra_args: CONF_FILE=prj_nocoded.conf
+    extra_args:
+      - CONF_FILE=prj_nocoded.conf
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_data_length_update.test_nophy:
     type: unit
-    extra_args: CONF_FILE=prj_nophy.conf
+    extra_args:
+      - CONF_FILE=prj_nophy.conf
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_encrypt/testcase.yaml b/tests/bluetooth/controller/ctrl_encrypt/testcase.yaml
index d5bb2cb8b11..86dd5bfe4d3 100644
--- a/tests/bluetooth/controller/ctrl_encrypt/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_encrypt/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_encrypt.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_feature_exchange/testcase.yaml b/tests/bluetooth/controller/ctrl_feature_exchange/testcase.yaml
index 257542f3612..087e49575ff 100644
--- a/tests/bluetooth/controller/ctrl_feature_exchange/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_feature_exchange/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_feature_exchange.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_hci/testcase.yaml b/tests/bluetooth/controller/ctrl_hci/testcase.yaml
index c750ebc8dd8..5e00c85f6f4 100644
--- a/tests/bluetooth/controller/ctrl_hci/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_hci/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_hci.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_invalid/testcase.yaml b/tests/bluetooth/controller/ctrl_invalid/testcase.yaml
index 2d1741931e3..cee54e6b09e 100644
--- a/tests/bluetooth/controller/ctrl_invalid/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_invalid/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_invalid.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_le_ping/testcase.yaml b/tests/bluetooth/controller/ctrl_le_ping/testcase.yaml
index b6a77528f32..54178905da1 100644
--- a/tests/bluetooth/controller/ctrl_le_ping/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_le_ping/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_le_ping.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_min_used_chans/testcase.yaml b/tests/bluetooth/controller/ctrl_min_used_chans/testcase.yaml
index 0991b0cdd43..a9445cbf8c4 100644
--- a/tests/bluetooth/controller/ctrl_min_used_chans/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_min_used_chans/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_min_used_chans.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_phy_update/testcase.yaml b/tests/bluetooth/controller/ctrl_phy_update/testcase.yaml
index 1d7da169f1d..d5c49d587a8 100644
--- a/tests/bluetooth/controller/ctrl_phy_update/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_phy_update/testcase.yaml
@@ -6,6 +6,10 @@ common:
 tests:
   bluetooth.controller.ctrl_phy_update.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
   bluetooth.controller.ctrl_phy_update.test_reduced_buf:
     type: unit
-    extra_args: CONF_FILE=prj_rx_cnt.conf
+    extra_args:
+      - CONF_FILE=prj_rx_cnt.conf
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_sca_update/testcase.yaml b/tests/bluetooth/controller/ctrl_sca_update/testcase.yaml
index cbf63aa1b57..cbc3c3faf72 100644
--- a/tests/bluetooth/controller/ctrl_sca_update/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_sca_update/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_sca_update.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_sw_privacy/testcase.yaml b/tests/bluetooth/controller/ctrl_sw_privacy/testcase.yaml
index 778606d6954..ac5dd6e957e 100644
--- a/tests/bluetooth/controller/ctrl_sw_privacy/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_sw_privacy/testcase.yaml
@@ -4,3 +4,5 @@ common:
 tests:
   bluetooth.ctrl_sw_privacy.test:
     platform_allow: nrf52_bsim
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_terminate/testcase.yaml b/tests/bluetooth/controller/ctrl_terminate/testcase.yaml
index cbe639401ea..6b1409e9653 100644
--- a/tests/bluetooth/controller/ctrl_terminate/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_terminate/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_terminate.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_tx_buffer_alloc/testcase.yaml b/tests/bluetooth/controller/ctrl_tx_buffer_alloc/testcase.yaml
index 614eb7fe94c..363986bd3d3 100644
--- a/tests/bluetooth/controller/ctrl_tx_buffer_alloc/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_tx_buffer_alloc/testcase.yaml
@@ -6,23 +6,35 @@ common:
 tests:
   bluetooth.controller.ctrl_tx_buffer_alloc.test_0_per_conn:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_tx_buffer_alloc.test_1_per_conn:
     type: unit
-    extra_args: CONF_FILE=prj_1.conf
+    extra_args:
+      - CONF_FILE=prj_1.conf
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_tx_buffer_alloc.test_2_per_conn:
     type: unit
-    extra_args: CONF_FILE=prj_2.conf
+    extra_args:
+      - CONF_FILE=prj_2.conf
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_tx_buffer_alloc.test_3_per_conn:
     type: unit
-    extra_args: CONF_FILE=prj_3.conf
+    extra_args:
+      - CONF_FILE=prj_3.conf
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_tx_buffer_alloc.test_max_per_conn_alloc:
     type: unit
-    extra_args: CONF_FILE=prj_max.conf
+    extra_args:
+      - CONF_FILE=prj_max.conf
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_tx_buffer_alloc.test_max_common_alloc:
     type: unit
-    extra_args: CONF_FILE=prj_max_common.conf
+    extra_args:
+      - CONF_FILE=prj_max_common.conf
+       - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_tx_queue/testcase.yaml b/tests/bluetooth/controller/ctrl_tx_queue/testcase.yaml
index 295ad891a63..282b620b317 100644
--- a/tests/bluetooth/controller/ctrl_tx_queue/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_tx_queue/testcase.yaml
@@ -5,3 +5,5 @@ common:
 tests:
   bluetooth.ctrl_tx_queue.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_unsupported/testcase.yaml b/tests/bluetooth/controller/ctrl_unsupported/testcase.yaml
index 28aba1a752a..48b18af9353 100644
--- a/tests/bluetooth/controller/ctrl_unsupported/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_unsupported/testcase.yaml
@@ -6,7 +6,11 @@ common:
 tests:
   bluetooth.controller.ctrl_unsupported.default.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
 
   bluetooth.controller.ctrl_unsupported.test:
     type: unit
-    extra_args: CONF_FILE=prj_unsupported.conf
+    extra_args:
+      - CONF_FILE=prj_unsupported.conf
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_user_ext/testcase.yaml b/tests/bluetooth/controller/ctrl_user_ext/testcase.yaml
index af319a7a719..be963df24a8 100644
--- a/tests/bluetooth/controller/ctrl_user_ext/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_user_ext/testcase.yaml
@@ -4,3 +4,5 @@ common:
 tests:
   bluetooth.ctrl_user_ext.test:
     platform_allow: nrf52_bsim
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/controller/ctrl_version/testcase.yaml b/tests/bluetooth/controller/ctrl_version/testcase.yaml
index 6badcbc7254..5df86b9bca9 100644
--- a/tests/bluetooth/controller/ctrl_version/testcase.yaml
+++ b/tests/bluetooth/controller/ctrl_version/testcase.yaml
@@ -6,3 +6,5 @@ common:
 tests:
   bluetooth.controller.ctrl_version.test:
     type: unit
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/df/connection_cte_req/testcase.yaml b/tests/bluetooth/df/connection_cte_req/testcase.yaml
index 768aba4a51f..fbfe4b0d9a1 100644
--- a/tests/bluetooth/df/connection_cte_req/testcase.yaml
+++ b/tests/bluetooth/df/connection_cte_req/testcase.yaml
@@ -2,3 +2,5 @@ tests:
   bluetooth.df.conection_cte_req:
     platform_allow: nrf52_bsim
     tags: bluetooth
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/df/connection_cte_tx_params/testcase.yaml b/tests/bluetooth/df/connection_cte_tx_params/testcase.yaml
index 38a23b0950e..a9986c5b0e5 100644
--- a/tests/bluetooth/df/connection_cte_tx_params/testcase.yaml
+++ b/tests/bluetooth/df/connection_cte_tx_params/testcase.yaml
@@ -2,3 +2,5 @@ tests:
   bluetooth.df.conection_cte_tx_params:
     platform_allow: nrf52_bsim
     tags: bluetooth
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/df/connectionless_cte_chains/testcase.yaml b/tests/bluetooth/df/connectionless_cte_chains/testcase.yaml
index 6aa5bb0f0c1..844a7bbb524 100644
--- a/tests/bluetooth/df/connectionless_cte_chains/testcase.yaml
+++ b/tests/bluetooth/df/connectionless_cte_chains/testcase.yaml
@@ -2,3 +2,5 @@ tests:
   bluetooth.df.connectionless_cte_chains:
     platform_allow: nrf52_bsim
     tags: bluetooth
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/df/connectionless_cte_rx/testcase.yaml b/tests/bluetooth/df/connectionless_cte_rx/testcase.yaml
index f839b1910eb..c8f08a90843 100644
--- a/tests/bluetooth/df/connectionless_cte_rx/testcase.yaml
+++ b/tests/bluetooth/df/connectionless_cte_rx/testcase.yaml
@@ -2,3 +2,5 @@ tests:
   bluetooth.df.connectionless_cte_rx:
     platform_allow: nrf52_bsim
     tags: bluetooth
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/df/connectionless_cte_tx/testcase.yaml b/tests/bluetooth/df/connectionless_cte_tx/testcase.yaml
index 77d651d0cbc..491cc0e7e59 100644
--- a/tests/bluetooth/df/connectionless_cte_tx/testcase.yaml
+++ b/tests/bluetooth/df/connectionless_cte_tx/testcase.yaml
@@ -2,3 +2,5 @@ tests:
   bluetooth.df.connectionless_cte_tx:
     platform_allow: nrf52_bsim
     tags: bluetooth
+    extra_args:
+      - SNIPPET="bt-ll-sw-split"
diff --git a/tests/bluetooth/init/testcase.yaml b/tests/bluetooth/init/testcase.yaml
index 69afaaf8b08..d0f917f1fe2 100644
--- a/tests/bluetooth/init/testcase.yaml
+++ b/tests/bluetooth/init/testcase.yaml
@@ -74,7 +74,9 @@ tests:
     extra_args: CONF_FILE=prj_9.conf
     platform_allow: qemu_cortex_m3
   bluetooth.init.test_ctlr:
-    extra_args: CONF_FILE=prj_ctlr.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -86,7 +88,9 @@ tests:
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_4_0:
-    extra_args: CONF_FILE=prj_ctlr_4_0.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_4_0.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -95,7 +99,9 @@ tests:
       - nrf52dk/nrf52832
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_4_0_dbg:
-    extra_args: CONF_FILE=prj_ctlr_4_0_dbg.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_4_0_dbg.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -104,7 +110,9 @@ tests:
       - nrf52dk/nrf52832
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_tiny:
-    extra_args: CONF_FILE=prj_ctlr_tiny.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_tiny.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -116,6 +124,7 @@ tests:
     extra_args:
       - CONF_FILE=prj_ctlr_dbg.conf
       - DTC_OVERLAY_FILE=pa_lna.overlay
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -126,6 +135,7 @@ tests:
     extra_args:
       - CONF_FILE=prj_ctlr_5_x_dbg.conf
       - DTC_OVERLAY_FILE=pa_lna.overlay
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -137,6 +147,7 @@ tests:
       - CONF_FILE=prj_ctlr.conf
       - CONFIG_BT_CTLR_ADVANCED_FEATURES=y
       - CONFIG_BT_CTLR_SW_SWITCH_SINGLE_TIMER=y
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf5340dk/nrf5340/cpunet
       - nrf52840dk/nrf52840
@@ -148,6 +159,7 @@ tests:
   bluetooth.init.test_ctlr_ticker:
     extra_args:
       - CONF_FILE=prj_ctlr_ticker.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -155,28 +167,36 @@ tests:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
   bluetooth.init.test_ctlr_broadcaster:
-    extra_args: CONF_FILE=prj_ctlr_broadcaster.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_broadcaster.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_peripheral:
-    extra_args: CONF_FILE=prj_ctlr_peripheral.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_peripheral.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_peripheral_priv:
-    extra_args: CONF_FILE=prj_ctlr_peripheral_priv.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_peripheral_priv.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_observer:
-    extra_args: CONF_FILE=prj_ctlr_observer.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_observer.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -187,7 +207,9 @@ tests:
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_central:
-    extra_args: CONF_FILE=prj_ctlr_central.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_central.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -198,7 +220,9 @@ tests:
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_central_priv:
-    extra_args: CONF_FILE=prj_ctlr_central_priv.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_central_priv.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -209,7 +233,9 @@ tests:
       - nrf51dk/nrf51822
       - rv32m1_vega/openisa_rv32m1/ri5cy
   bluetooth.init.test_ctlr_broadcaster_ext:
-    extra_args: CONF_FILE=prj_ctlr_broadcaster_ext.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_broadcaster_ext.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -218,7 +244,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_peripheral_ext:
-    extra_args: CONF_FILE=prj_ctlr_peripheral_ext.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_peripheral_ext.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -227,7 +255,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_peripheral_ext_priv:
-    extra_args: CONF_FILE=prj_ctlr_peripheral_ext_priv.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_peripheral_ext_priv.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -236,7 +266,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_oberver_ext:
-    extra_args: CONF_FILE=prj_ctlr_observer_ext.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_observer_ext.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -245,7 +277,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_central_ext:
-    extra_args: CONF_FILE=prj_ctlr_central_ext.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_central_ext.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -254,7 +288,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_central_ext_priv:
-    extra_args: CONF_FILE=prj_ctlr_central_ext_priv.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_central_ext_priv.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -263,7 +299,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_per_adv:
-    extra_args: CONF_FILE=prj_ctlr_per_adv.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_per_adv.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -272,7 +310,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_per_adv_no_adi:
-    extra_args: CONF_FILE=prj_ctlr_per_adv_no_adi.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_per_adv_no_adi.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -281,7 +321,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_per_sync:
-    extra_args: CONF_FILE=prj_ctlr_per_sync.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_per_sync.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -290,7 +332,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_per_sync_no_adi:
-    extra_args: CONF_FILE=prj_ctlr_per_sync_no_adi.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_per_sync_no_adi.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -299,7 +343,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_per_sync_no_filter:
-    extra_args: CONF_FILE=prj_ctlr_per_sync_no_filter.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_per_sync_no_filter.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -308,7 +354,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_peripheral_iso:
-    extra_args: CONF_FILE=prj_ctlr_peripheral_iso.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_peripheral_iso.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -317,7 +365,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf51dk/nrf51822
   bluetooth.init.test_ctlr_central_iso:
-    extra_args: CONF_FILE=prj_ctlr_central_iso.conf
+    extra_args:
+      - CONF_FILE=prj_ctlr_central_iso.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -336,7 +386,9 @@ tests:
       - DTC_OVERLAY_FILE=h5.overlay
     platform_allow: qemu_cortex_m3
   bluetooth.init.test_llcp:
-    extra_args: CONF_FILE=prj_llcp.conf
+    extra_args:
+      - CONF_FILE=prj_llcp.conf
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
       - nrf52dk/nrf52832
@@ -349,5 +401,6 @@ tests:
     extra_args:
       - CONF_FILE=prj_ctlr.conf
       - CONFIG_BT_RECV_WORKQ_BT=y
+      - SNIPPET="bt-ll-sw-split"
     platform_allow:
       - nrf52840dk/nrf52840
diff --git a/tests/boot/mcuboot_recovery_retention/sysbuild.conf b/tests/boot/mcuboot_recovery_retention/sysbuild.conf
index 47f00ff3cff..3b5b3c96380 100644
--- a/tests/boot/mcuboot_recovery_retention/sysbuild.conf
+++ b/tests/boot/mcuboot_recovery_retention/sysbuild.conf
@@ -1 +1,2 @@
 SB_CONFIG_BOOTLOADER_MCUBOOT=y
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/tests/boot/test_mcuboot/sysbuild.conf b/tests/boot/test_mcuboot/sysbuild.conf
index 47f00ff3cff..3b5b3c96380 100644
--- a/tests/boot/test_mcuboot/sysbuild.conf
+++ b/tests/boot/test_mcuboot/sysbuild.conf
@@ -1 +1,2 @@
 SB_CONFIG_BOOTLOADER_MCUBOOT=y
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/tests/cmake/hwm/board_extend/CMakeLists.txt b/tests/cmake/hwm/board_extend/CMakeLists.txt
new file mode 100644
index 00000000000..20bd94d6af0
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/CMakeLists.txt
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (c) 2024 Nordic Semiconductor ASA
+
+cmake_minimum_required(VERSION 3.20.0)
+
+set(BOARD_ROOT  ${CMAKE_CURRENT_LIST_DIR}/oot_root)
+set(SOC_ROOT  ${CMAKE_CURRENT_LIST_DIR}/oot_root)
+
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(native_sim_extend)
+
+FILE(GLOB app_sources src/*.c)
+target_sources(app PRIVATE ${app_sources})
diff --git a/tests/cmake/hwm/board_extend/Kconfig b/tests/cmake/hwm/board_extend/Kconfig
new file mode 100644
index 00000000000..6bbf5b73227
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/Kconfig
@@ -0,0 +1,15 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: Apache-2.0
+
+config BASE_BOARD_SETTING
+	bool "Base board test string"
+	help
+	  This kconfig is set when the base board config fragment is supposed to
+	  be sourced, that is when oot variant defines
+	  'extends:'
+	  '  board: native_sim'
+	  '  qualifier: posix'
+	  '  inherit: 1'
+
+source "Kconfig.zephyr"
diff --git a/tests/cmake/hwm/board_extend/boards/native_sim.conf b/tests/cmake/hwm/board_extend/boards/native_sim.conf
new file mode 100644
index 00000000000..71a2b211d0a
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/boards/native_sim.conf
@@ -0,0 +1 @@
+CONFIG_BASE_BOARD_SETTING=y
diff --git a/tests/cmake/hwm/board_extend/boards/native_sim_native_64_two.conf b/tests/cmake/hwm/board_extend/boards/native_sim_native_64_two.conf
new file mode 100644
index 00000000000..b2dfe184407
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/boards/native_sim_native_64_two.conf
@@ -0,0 +1 @@
+CONFIG_EXTENDED_VARIANT_BOARD_SETTING=y
diff --git a/tests/cmake/hwm/board_extend/boards/native_sim_native_one.conf b/tests/cmake/hwm/board_extend/boards/native_sim_native_one.conf
new file mode 100644
index 00000000000..b2dfe184407
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/boards/native_sim_native_one.conf
@@ -0,0 +1 @@
+CONFIG_EXTENDED_VARIANT_BOARD_SETTING=y
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/Kconfig.mps2 b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/Kconfig.mps2
new file mode 100644
index 00000000000..448c9cc1308
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/Kconfig.mps2
@@ -0,0 +1,5 @@
+# Copyright (c) 2017 Linaro Limited
+# SPDX-License-Identifier: Apache-2.0
+
+config BOARD_MPS2
+	select SOC_MPS2_AN521_CPUTEST if BOARD_MPS2_AN521_CPUTEST
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/board.cmake b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/board.cmake
new file mode 100644
index 00000000000..27c74975756
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/board.cmake
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (c) 2024, Nordic Semiconductor ASA
+
+if(CONFIG_BOARD_MPS2_AN521_CPUTEST)
+  set(QEMU_CPU_TYPE_${ARCH} cortex-m33)
+  set(QEMU_FLAGS_${ARCH}
+    -cpu ${QEMU_CPU_TYPE_${ARCH}}
+    -machine mps2-an521
+    -nographic
+    -m 16
+    -vga none
+    )
+endif()
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/board.yml b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/board.yml
new file mode 100644
index 00000000000..05982ac1bb8
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/board.yml
@@ -0,0 +1,2 @@
+board:
+  extend: mps2
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521-common.dtsi b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521-common.dtsi
new file mode 100644
index 00000000000..5b1959ff5fe
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521-common.dtsi
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2019 Linaro Limited
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+sysclk: system-clock {
+	compatible = "fixed-clock";
+	clock-frequency = <25000000>;
+	#clock-cells = <0>;
+};
+
+timer0: timer@0 {
+	compatible = "arm,cmsdk-timer";
+	reg = <0x0 0x1000>;
+	interrupts = <3 3>;
+};
+
+timer1: timer@1000 {
+	compatible = "arm,cmsdk-timer";
+	reg = <0x1000 0x1000>;
+	interrupts = <4 3>;
+};
+
+dtimer0: dtimer@2000 {
+	compatible = "arm,cmsdk-dtimer";
+	reg = <0x2000 0x1000>;
+	interrupts = <5 3>;
+};
+
+mhu0: mhu@3000 {
+	compatible = "arm,mhu";
+	reg = <0x3000 0x1000>;
+	interrupts = <6 3>;
+};
+
+mhu1: mhu@4000 {
+	compatible = "arm,mhu";
+	reg = <0x4000 0x1000>;
+	interrupts = <7 3>;
+};
+
+gpio0: gpio@100000 {
+	compatible = "arm,cmsdk-gpio";
+	reg = <0x100000 0x1000>;
+	interrupts = <68 3>;
+	gpio-controller;
+	#gpio-cells = <2>;
+};
+
+gpio1: gpio@101000 {
+	compatible = "arm,cmsdk-gpio";
+	reg = <0x101000 0x1000>;
+	interrupts = <69 3>;
+	gpio-controller;
+	#gpio-cells = <2>;
+};
+
+gpio2: gpio@102000 {
+	compatible = "arm,cmsdk-gpio";
+	reg = <0x102000 0x1000>;
+	interrupts = <70 3>;
+	gpio-controller;
+	#gpio-cells = <2>;
+};
+
+gpio3: gpio@103000 {
+	compatible = "arm,cmsdk-gpio";
+	reg = <0x103000 0x1000>;
+	interrupts = <71 3>;
+	gpio-controller;
+	#gpio-cells = <2>;
+};
+
+wdog0: wdog@81000 {
+	compatible = "arm,cmsdk-watchdog";
+	reg = <0x81000 0x1000>;
+	clocks = <&sysclk>;
+};
+
+uart0: uart@200000 {
+	compatible = "arm,cmsdk-uart";
+	reg = <0x200000 0x1000>;
+	interrupts = <33 3 32 3>;
+	interrupt-names = "tx", "rx";
+	clocks = <&sysclk>;
+	current-speed = <115200>;
+};
+
+uart1: uart@201000 {
+	compatible = "arm,cmsdk-uart";
+	reg = <0x201000 0x1000>;
+	interrupts = <35 3 34 3>;
+	interrupt-names = "tx", "rx";
+	clocks = <&sysclk>;
+	current-speed = <115200>;
+};
+
+uart2: uart@202000 {
+	compatible = "arm,cmsdk-uart";
+	reg = <0x202000 0x1000>;
+	interrupts = <37 3 36 3>;
+	interrupt-names = "tx", "rx";
+	clocks = <&sysclk>;
+	current-speed = <115200>;
+};
+
+uart3: uart@203000 {
+	compatible = "arm,cmsdk-uart";
+	reg = <0x203000 0x1000>;
+	interrupts = <39 3 38 3>;
+	interrupt-names = "tx", "rx";
+	clocks = <&sysclk>;
+	current-speed = <115200>;
+};
+
+uart4: uart@204000 {
+	compatible = "arm,cmsdk-uart";
+	reg = <0x204000 0x1000>;
+	interrupts = <41 3 40 3>;
+	interrupt-names = "tx", "rx";
+	clocks = <&sysclk>;
+	current-speed = <115200>;
+};
+
+i2c_touch: i2c@207000 {
+	compatible = "arm,versatile-i2c";
+	clock-frequency = <I2C_BITRATE_STANDARD>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	reg = <0x207000 0x1000>;
+};
+
+i2c_audio_conf: i2c@208000 {
+	compatible = "arm,versatile-i2c";
+	clock-frequency = <I2C_BITRATE_STANDARD>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	reg = <0x208000 0x1000>;
+};
+
+i2c_shield0: i2c@20c000 {
+	compatible = "arm,versatile-i2c";
+	clock-frequency = <I2C_BITRATE_STANDARD>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	reg = <0x20c000 0x1000>;
+};
+
+i2c_shield1: i2c@20d000 {
+	compatible = "arm,versatile-i2c";
+	clock-frequency = <I2C_BITRATE_STANDARD>;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	reg = <0x20d000 0x1000>;
+};
+
+gpio_led0: mps2_fpgaio@302000 {
+	compatible = "arm,mps2-fpgaio-gpio";
+
+	reg = <0x302000 0x4>;
+	gpio-controller;
+	#gpio-cells = <1>;
+	ngpios = <2>;
+};
+
+gpio_button: mps2_fpgaio@302008 {
+	compatible = "arm,mps2-fpgaio-gpio";
+
+	reg = <0x302008 0x4>;
+	gpio-controller;
+	#gpio-cells = <1>;
+	ngpios = <2>;
+};
+
+gpio_misc: mps2_fpgaio@30204c {
+	compatible = "arm,mps2-fpgaio-gpio";
+
+	reg = <0x30204c 0x4>;
+	gpio-controller;
+	#gpio-cells = <1>;
+	ngpios = <10>;
+};
+
+eth0: eth@2000000 {
+	/* Linux has "smsc,lan9115" */
+	compatible = "smsc,lan9220";
+	/* Actual reg range is ~0x200 */
+	reg = <0x2000000 0x100000>;
+	interrupts = <48 3>;
+};
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521_cputest.dts b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521_cputest.dts
new file mode 100644
index 00000000000..2bb956645ca
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521_cputest.dts
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2018-2019 Linaro Limited
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+
+#include <mem.h>
+#include <arm/armv8-m.dtsi>
+#include <zephyr/dt-bindings/i2c/i2c.h>
+#include <zephyr/dt-bindings/input/input-event-codes.h>
+
+/ {
+	compatible = "arm,mps2";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	aliases {
+		led0 = &led_0;
+		led1 = &led_1;
+		sw0 = &user_button_0;
+		sw1 = &user_button_1;
+		uart-1 = &uart1;
+		watchdog0 = &wdog0;
+	};
+
+	chosen {
+		zephyr,console = &uart0;
+		zephyr,shell-uart = &uart0;
+
+		/*
+		 * These SRAM and flash settings give the entire available
+		 * code and data memories to this secure firmware image.
+		 * This may conflict with mps2_an521_remote firmware. Use
+		 * caution when using both targets simultaneously.
+		 */
+		zephyr,sram = &ssram2_3;
+		zephyr,flash = &ssram1;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		led_0: led_0 {
+			gpios = <&gpio_led0 0>;
+			label = "USERLED0";
+		};
+		led_1: led_1 {
+			gpios = <&gpio_led0 1>;
+			label = "USERLED1";
+		};
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		user_button_0: button_0 {
+			label = "USERPB0";
+			gpios = <&gpio_button 0>;
+			zephyr,code = <INPUT_KEY_0>;
+		};
+		user_button_1: button_1 {
+			label = "USERPB1";
+			gpios = <&gpio_button 1>;
+			zephyr,code = <INPUT_KEY_1>;
+		};
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-m33";
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			mpu: mpu@e000ed90 {
+				compatible = "arm,armv8m-mpu";
+				reg = <0xe000ed90 0x40>;
+			};
+		};
+	};
+
+	/*
+	 * The memory regions defined below are according to AN521:
+	 * https://documentation-service.arm.com/static/5fa12fe9b1a7c5445f29017f
+	 *
+	 * Please see tables mentioned in individual comments below for details.
+	 */
+
+	ssram1: memory@10000000 {
+		/* Table 3-2, row 6. */
+		compatible = "zephyr,memory-region", "mmio-sram";
+		reg = <0x10000000 DT_SIZE_M(4)>;
+		zephyr,memory-region = "SSRAM1";
+	};
+
+	ssram2_3: memory@38000000 {
+		/* Table 3-4, rows 16 and 17. */
+		compatible = "zephyr,memory-region", "mmio-sram";
+		reg = <0x38000000 DT_SIZE_M(4)>;
+		zephyr,memory-region = "SSRAM2_3";
+	};
+
+	psram: memory@80000000 {
+		/* Table 3-6, row 1. */
+		device_type = "memory";
+		reg = <0x80000000 DT_SIZE_M(16)>;
+	};
+
+	soc {
+		peripheral@50000000 {
+			#address-cells = <1>;
+			#size-cells = <1>;
+			ranges = <0x0 0x50000000 0x10000000>;
+
+			#include "mps2_an521-common.dtsi"
+		};
+	};
+};
+
+&nvic {
+	arm,num-irq-priority-bits = <3>;
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521_cputest_defconfig b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521_cputest_defconfig
new file mode 100644
index 00000000000..08949950a9e
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/arm/mps2/mps2_an521_cputest_defconfig
@@ -0,0 +1,21 @@
+#
+# Copyright (c) 2018-2019 Linaro Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+#CONFIG_RUNTIME_NMI=y
+#CONFIG_ARM_TRUSTZONE_M=y
+#CONFIG_ARM_MPU=y
+CONFIG_QEMU_ICOUNT_SHIFT=6
+#
+## GPIOs
+CONFIG_GPIO=y
+
+# Serial
+CONFIG_CONSOLE=y
+CONFIG_UART_CONSOLE=y
+CONFIG_SERIAL=y
+
+# Build a non-secure firmware image
+#CONFIG_TRUSTED_EXECUTION_NONSECURE=y
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/Kconfig b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/Kconfig
new file mode 100644
index 00000000000..e724497c3b5
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/Kconfig
@@ -0,0 +1,30 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+config EXTENDED_VARIANT_BOARD_SETTING
+	bool "Extended variant board test string"
+	depends on BOARD_NATIVE_SIM_NATIVE_ONE || BOARD_NATIVE_SIM_NATIVE_64_TWO
+	help
+	  This kconfig is set when the extended variant board config fragment
+	  is supposed to be sourced, that is when oot variant defines 'extends:'
+
+config EXTENDED_VARIANT_BOARD_ONE_SETTING_PROMPTLESS
+	bool
+	depends on BOARD_NATIVE_SIM_NATIVE_ONE
+	help
+	  This kconfig is promptless and is expected to be set through the
+	  Kconfig.defconfig for the extended board.
+
+config EXTENDED_VARIANT_BOARD_TWO_SETTING_PROMPTLESS
+	bool
+	depends on BOARD_NATIVE_SIM_NATIVE_64_TWO
+	help
+	  This kconfig is promptless and is expected to be set through the
+	  Kconfig.defconfig for the extended board.
+
+config EXTENDED_VARIANT_BOARD_SETTING_DEFCONFIG
+	bool "Extended variant board test string defconfig"
+	depends on BOARD_NATIVE_SIM_NATIVE_ONE || BOARD_NATIVE_SIM_NATIVE_64_TWO
+	help
+	  This kconfig is set when the extended variant board defconfig fragment
+	  is supposed to be sourced, that is when oot variant defines 'extends:'
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/Kconfig.defconfig b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/Kconfig.defconfig
new file mode 100644
index 00000000000..343daa1246a
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/Kconfig.defconfig
@@ -0,0 +1,16 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+if BOARD_NATIVE_SIM_NATIVE_ONE
+
+config EXTENDED_VARIANT_BOARD_ONE_SETTING_PROMPTLESS
+	default y
+
+endif # BOARD_NATIVE_SIM_NATIVE_ONE
+
+if BOARD_NATIVE_SIM_NATIVE_64_TWO
+
+config EXTENDED_VARIANT_BOARD_TWO_SETTING_PROMPTLESS
+	default y
+
+endif # BOARD_NATIVE_SIM_NATIVE_64_TWO
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/board.yml b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/board.yml
new file mode 100644
index 00000000000..8df9cf3c433
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/board.yml
@@ -0,0 +1,7 @@
+board:
+  extend: native_sim
+  variants:
+    - name: one
+      qualifier: native
+    - name: two
+      qualifier: native/64
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two.dts b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two.dts
new file mode 100644
index 00000000000..b3fc17d81fb
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two.dts
@@ -0,0 +1,14 @@
+/*
+ * Copyright (c) 2023 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "native_sim_native_one.dts"
+
+/ {
+	/delete-node/ added-by-native-one;
+
+	added-by-native-two{
+	};
+};
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two.yaml b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two.yaml
new file mode 100644
index 00000000000..190d4906cc8
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two.yaml
@@ -0,0 +1,25 @@
+identifier: native_sim_native_64_two
+name: Native Simulation port - 32-bit
+type: native
+simulation: native
+arch: posix
+ram: 65536
+flash: 65536
+toolchain:
+  - host
+  - llvm
+supported:
+  - can
+  - counter
+  - dma
+  - eeprom
+  - netif:eth
+  - usb_device
+  - adc
+  - i2c
+  - spi
+  - gpio
+  - rtc
+testing:
+  default: true
+vendor: zephyr
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two_defconfig b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two_defconfig
new file mode 100644
index 00000000000..d0de015b0df
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_64_two_defconfig
@@ -0,0 +1,7 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+CONFIG_CONSOLE=y
+CONFIG_SYS_CLOCK_HW_CYCLES_PER_SEC=1000000
+
+CONFIG_EXTENDED_VARIANT_BOARD_SETTING_DEFCONFIG=y
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one.dts b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one.dts
new file mode 100644
index 00000000000..652c7605f60
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one.dts
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2019 Jan Van Winkel (jan.van_winkel@dxplore.eu)
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+#include <posix/posix.dtsi>
+#include <zephyr/dt-bindings/adc/adc.h>
+#include <zephyr/dt-bindings/i2c/i2c.h>
+#include <zephyr/dt-bindings/gpio/gpio.h>
+
+/ {
+	model = "Native Sim Board";
+	compatible = "zephyr,posix";
+
+	chosen {
+		zephyr,console = &uart0;
+		zephyr,shell-uart = &uart0;
+		zephyr,uart-mcumgr = &uart0;
+		zephyr,flash = &flash0;
+		zephyr,entropy = &rng;
+		zephyr,flash-controller = &flashcontroller0;
+		zephyr,display = &sdl_dc;
+		zephyr,canbus = &can_loopback0;
+		zephyr,code-partition = &slot0_partition;
+	};
+
+	aliases {
+		eeprom-0 = &eeprom0;
+		i2c-0 = &i2c0;
+		spi-0 = &spi0;
+		led0 = &led0;
+		rtc = &rtc;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		led0: led_0 {
+			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
+			label = "Green LED";
+		};
+	};
+
+	lvgl_pointer {
+		compatible = "zephyr,lvgl-pointer-input";
+		input = <&input_sdl_touch>;
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		cpu0: cpu@0 {
+			compatible = "zephyr,native-posix-cpu";
+			reg = <0>;
+		};
+	};
+
+	flashcontroller0: flash-controller@0 {
+		compatible = "zephyr,sim-flash";
+		reg = <0x00000000 DT_SIZE_K(2048)>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+		erase-value = <0xff>;
+
+		flash0: flash@0 {
+			status = "okay";
+			compatible = "soc-nv-flash";
+			erase-block-size = <4096>;
+			write-block-size = <1>;
+			reg = <0x00000000 DT_SIZE_K(2048)>;
+
+			partitions {
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				boot_partition: partition@0 {
+					label = "mcuboot";
+					reg = <0x00000000 0x0000C000>;
+				};
+				slot0_partition: partition@c000 {
+					label = "image-0";
+					reg = <0x0000C000 0x00069000>;
+				};
+				slot1_partition: partition@75000 {
+					label = "image-1";
+					reg = <0x00075000 0x00069000>;
+				};
+				scratch_partition: partition@de000 {
+					label = "image-scratch";
+					reg = <0x000de000 0x0001e000>;
+				};
+				storage_partition: partition@fc000 {
+					label = "storage";
+					reg = <0x000fc000 0x00004000>;
+				};
+			};
+		};
+	};
+
+	eeprom0: eeprom {
+		status = "okay";
+		compatible = "zephyr,sim-eeprom";
+		size = <DT_SIZE_K(32)>;
+	};
+
+	i2c0: i2c@100 {
+		status = "okay";
+		compatible = "zephyr,i2c-emul-controller";
+		clock-frequency = <I2C_BITRATE_STANDARD>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x100 4>;
+	};
+
+	spi0: spi@200 {
+		status = "okay";
+		compatible = "zephyr,spi-emul-controller";
+		clock-frequency = <50000000>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x200 4>;
+	};
+
+	espi0: espi@300 {
+		status = "okay";
+		compatible = "zephyr,espi-emul-controller";
+		reg = <0x300 4>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	uart0: uart {
+		status = "okay";
+		compatible = "zephyr,native-posix-uart";
+		/* Dummy current-speed entry to comply with serial
+		 * DTS binding
+		 */
+		current-speed = <0>;
+	};
+
+	uart1: uart_1 {
+		status = "okay";
+		compatible = "zephyr,native-posix-uart";
+		/* Dummy current-speed entry to comply with serial
+		 * DTS binding
+		 */
+		current-speed = <0>;
+	};
+
+	rng: rng {
+		status = "okay";
+		compatible = "zephyr,native-posix-rng";
+	};
+
+	counter0: counter {
+		status = "okay";
+		compatible = "zephyr,native-posix-counter";
+	};
+
+	gpio0: gpio@800 {
+		status = "okay";
+		compatible = "zephyr,gpio-emul";
+		reg = <0x800 0x4>;
+		rising-edge;
+		falling-edge;
+		high-level;
+		low-level;
+		gpio-controller;
+		#gpio-cells = <2>;
+	};
+
+	zephyr_udc0: udc0 {
+		compatible = "zephyr,native-posix-udc";
+	};
+
+	sdl_dc: sdl_dc {
+		compatible = "zephyr,sdl-dc";
+		height = <240>;
+		width = <320>;
+	};
+
+	input_sdl_touch: input-sdl-touch {
+		compatible = "zephyr,input-sdl-touch";
+	};
+
+	can_loopback0: can_loopback0 {
+		status = "okay";
+		compatible = "zephyr,can-loopback";
+	};
+
+	can0: can {
+		status = "disabled";
+		compatible = "zephyr,native-linux-can";
+		/* adjust zcan0 to desired host interface or create an alternative
+		 * name, e.g.: sudo ip link property add dev vcan0 altname zcan0
+		 */
+		host-interface = "zcan0";
+	};
+
+	rtc: rtc {
+		status = "okay";
+		compatible = "zephyr,rtc-emul";
+		alarms-count = <2>;
+	};
+
+	dma: dma {
+		compatible = "zephyr,dma-emul";
+		#dma-cells = <1>;
+		stack-size = <4096>;
+	};
+
+	added-by-native-one {
+	};
+};
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one.yaml b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one.yaml
new file mode 100644
index 00000000000..ea2c2d856ae
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one.yaml
@@ -0,0 +1,25 @@
+identifier: native_sim_native_one
+name: Native Simulation port - 32-bit
+type: native
+simulation: native
+arch: posix
+ram: 65536
+flash: 65536
+toolchain:
+  - host
+  - llvm
+supported:
+  - can
+  - counter
+  - dma
+  - eeprom
+  - netif:eth
+  - usb_device
+  - adc
+  - i2c
+  - spi
+  - gpio
+  - rtc
+testing:
+  default: true
+vendor: zephyr
diff --git a/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one_defconfig b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one_defconfig
new file mode 100644
index 00000000000..d0de015b0df
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/boards/native/native_sim_extend/native_sim_native_one_defconfig
@@ -0,0 +1,7 @@
+# Copyright (c) 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+CONFIG_CONSOLE=y
+CONFIG_SYS_CLOCK_HW_CYCLES_PER_SEC=1000000
+
+CONFIG_EXTENDED_VARIANT_BOARD_SETTING_DEFCONFIG=y
diff --git a/tests/cmake/hwm/board_extend/oot_root/soc/arm/Kconfig.soc b/tests/cmake/hwm/board_extend/oot_root/soc/arm/Kconfig.soc
new file mode 100644
index 00000000000..a699e8413a1
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/soc/arm/Kconfig.soc
@@ -0,0 +1,6 @@
+# Copyright (c) 2024, Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+config SOC_MPS2_AN521_CPUTEST
+	bool
+	select SOC_MPS2_AN521
diff --git a/tests/cmake/hwm/board_extend/oot_root/soc/arm/soc.yml b/tests/cmake/hwm/board_extend/oot_root/soc/arm/soc.yml
new file mode 100644
index 00000000000..04b69c75ae4
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/oot_root/soc/arm/soc.yml
@@ -0,0 +1,4 @@
+socs:
+  - extend: an521
+    cpuclusters:
+      - name: cputest
diff --git a/tests/cmake/hwm/board_extend/prj.conf b/tests/cmake/hwm/board_extend/prj.conf
new file mode 100644
index 00000000000..9467c292689
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/prj.conf
@@ -0,0 +1 @@
+CONFIG_ZTEST=y
diff --git a/tests/cmake/hwm/board_extend/src/main.c b/tests/cmake/hwm/board_extend/src/main.c
new file mode 100644
index 00000000000..9795bd8dcb8
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/src/main.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/ztest.h>
+
+#ifdef CONFIG_EXTENDED_VARIANT_BOARD_SETTING
+#define EXTENDED_BOARD_A 1
+#else
+#define EXTENDED_BOARD_A 0
+#endif
+
+#ifdef CONFIG_EXTENDED_VARIANT_BOARD_ONE_SETTING_PROMPTLESS
+#define EXTENDED_BOARD_ONE_B 1
+#else
+#define EXTENDED_BOARD_ONE_B 0
+#endif
+
+#ifdef CONFIG_EXTENDED_VARIANT_BOARD_TWO_SETTING_PROMPTLESS
+#define EXTENDED_BOARD_TWO_C 1
+#else
+#define EXTENDED_BOARD_TWO_C 0
+#endif
+
+#ifdef CONFIG_EXTENDED_VARIANT_BOARD_SETTING_DEFCONFIG
+#define EXTENDED_BOARD_D 1
+#else
+#define EXTENDED_BOARD_D 0
+#endif
+
+#ifdef CONFIG_BASE_BOARD_SETTING
+#define BASE_BOARD_CONFIG 1
+#else
+#define BASE_BOARD_CONFIG 0
+#endif
+
+#ifdef CONFIG_SOC_MPS2_AN521_CPUTEST
+#define EXTENDED_SOC 1
+#else
+#define EXTENDED_SOC 0
+#endif
+
+ZTEST_SUITE(soc_board_extend, NULL, NULL, NULL, NULL, NULL);
+
+#if CONFIG_BOARD_NATIVE_SIM
+ZTEST(soc_board_extend, test_native_sim_extend)
+{
+#if CONFIG_BOARD_NATIVE_SIM_NATIVE_ONE
+	zassert_true(EXTENDED_BOARD_A, "Expected extended board to be set");
+	zassert_true(EXTENDED_BOARD_ONE_B, "Expected extended board to be set");
+	zassert_false(EXTENDED_BOARD_TWO_C, "Did not expect extended board two to be set");
+	zassert_true(EXTENDED_BOARD_D, "Expected extended board to be set");
+	zassert_false(BASE_BOARD_CONFIG, "Did not expect base board to be set");
+	zassert_true(DT_NODE_EXISTS(DT_PATH(added_by_native_one)));
+	zassert_false(DT_NODE_EXISTS(DT_PATH(added_by_native_two)));
+	zassert_false(DT_NODE_EXISTS(DT_PATH(adc)));
+#elif CONFIG_BOARD_NATIVE_SIM_NATIVE_64_TWO
+	zassert_true(EXTENDED_BOARD_A, "Expected extended board to be set");
+	zassert_false(EXTENDED_BOARD_ONE_B, "Did not expect extended board one to be set");
+	zassert_true(EXTENDED_BOARD_TWO_C, "Expected extended board to be set");
+	zassert_true(EXTENDED_BOARD_D, "Expected extended board to be set");
+	zassert_false(BASE_BOARD_CONFIG, "Did not expect base board to be set");
+	zassert_false(DT_NODE_EXISTS(DT_PATH(added_by_native_one)));
+	zassert_true(DT_NODE_EXISTS(DT_PATH(added_by_native_two)));
+	zassert_false(DT_NODE_EXISTS(DT_PATH(adc)));
+#else
+	zassert_true(false, "Did not expect to build for a base native_sim board");
+#endif
+#elif CONFIG_BOARD_MPS2
+ZTEST(soc_board_extend, test_an521_soc_extend)
+{
+#if CONFIG_BOARD_MPS2_AN521_CPUTEST
+	zassert_true(EXTENDED_SOC, "Expected extended SoC to be set");
+#elif CONFIG_BOARD_MPS2
+	zassert_true(false, "Did not expect to build for a base mps2 board");
+#endif
+
+#else
+ZTEST(soc_board_extend, test_failure)
+{
+	zassert_true(false, "Did not expect to build for a regular board");
+#endif
+}
diff --git a/tests/cmake/hwm/board_extend/testcase.yaml b/tests/cmake/hwm/board_extend/testcase.yaml
new file mode 100644
index 00000000000..aae39ce6b2c
--- /dev/null
+++ b/tests/cmake/hwm/board_extend/testcase.yaml
@@ -0,0 +1,33 @@
+common:
+  tags:
+    - cmake
+tests:
+  cmake.board.extend_one:
+    extra_args:
+      # Twister can only lookup known board roots.
+      # Thus platform above is set to native_sim, while at this location
+      # we overrule with the native_sim/native/one board.
+      # Test will fail if we accidentially build for the base native_sim board.
+      - CACHED_BOARD=native_sim/native/one
+    platform_allow:
+      - native_sim
+      - native_sim/native/64
+    integration_platforms:
+      - native_sim
+      - native_sim/native/64
+  cmake.board.extend_two:
+    extra_args:
+      - CACHED_BOARD=native_sim/native/64/two
+    platform_allow:
+      - native_sim
+      - native_sim/native/64
+    integration_platforms:
+      - native_sim
+      - native_sim/native/64
+  cmake.soc.extend_cputest:
+    extra_args:
+      - CACHED_BOARD=mps2/an521/cputest
+    platform_allow:
+      - mps2/an521/cpu0
+    integration_platforms:
+      - mps2/an521/cpu0
diff --git a/tests/crypto/mbedtls/CMakeLists.txt b/tests/crypto/mbedtls/CMakeLists.txt
index 7ebdc9d76a9..47670bead01 100644
--- a/tests/crypto/mbedtls/CMakeLists.txt
+++ b/tests/crypto/mbedtls/CMakeLists.txt
@@ -6,15 +6,5 @@ project(mbedtls)
 
 set(output_file ${PROJECT_BINARY_DIR}/mbedtls-check.timestamp)
 
-add_custom_command(
-    COMMENT "Check Mbed TLS auto-generated files"
-    COMMAND
-        ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/modules/mbedtls/create_psa_files.py --check
-    OUTPUT
-        ${output_file}
-)
-
-add_custom_target(check_mbedtls_auto_generated_files ALL DEPENDS ${output_file})
-
 FILE(GLOB app_sources src/*.c)
 target_sources(app PRIVATE ${app_sources})
diff --git a/tests/drivers/adc/adc_accuracy_test/boards/frdm_kl25z.overlay b/tests/drivers/adc/adc_accuracy_test/boards/frdm_kl25z.overlay
index 148ecda4535..3be90387270 100644
--- a/tests/drivers/adc/adc_accuracy_test/boards/frdm_kl25z.overlay
+++ b/tests/drivers/adc/adc_accuracy_test/boards/frdm_kl25z.overlay
@@ -8,6 +8,7 @@
 	zephyr,user {
 		io-channels = <&adc0 12>;
 		reference_mv = <1100>;
+		expected_accuracy = <32>;
 	};
 };
 
diff --git a/tests/drivers/adc/adc_accuracy_test/boards/nrf52840dk_nrf52840.overlay b/tests/drivers/adc/adc_accuracy_test/boards/nrf52840dk_nrf52840.overlay
new file mode 100644
index 00000000000..08aa282bc60
--- /dev/null
+++ b/tests/drivers/adc/adc_accuracy_test/boards/nrf52840dk_nrf52840.overlay
@@ -0,0 +1,29 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ */
+
+
+/ {
+	zephyr,user {
+		io-channels = <&adc 0>;
+		reference_mv = <3000>;
+		expected_accuracy = <32>;
+	};
+};
+
+&adc {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	channel@0 {
+		reg = <0>;
+		zephyr,gain = "ADC_GAIN_1_6";
+		zephyr,reference = "ADC_REF_INTERNAL";
+		zephyr,acquisition-time = <ADC_ACQ_TIME_DEFAULT>;
+		zephyr,input-positive = <NRF_SAADC_AIN1>; /* P0.03 */
+		zephyr,resolution = <14>;
+	};
+
+};
diff --git a/tests/drivers/adc/adc_accuracy_test/boards/nrf54h20dk_nrf54h20_cpuapp.overlay b/tests/drivers/adc/adc_accuracy_test/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
new file mode 100644
index 00000000000..f6ee92720ca
--- /dev/null
+++ b/tests/drivers/adc/adc_accuracy_test/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
@@ -0,0 +1,27 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ */
+
+/ {
+	zephyr,user {
+		io-channels = <&adc 0>;
+		reference_mv = <1800>;
+		expected_accuracy = <64>;
+	};
+};
+
+&adc {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	channel@0 {
+		reg = <0>;
+		zephyr,gain = "ADC_GAIN_1_2";
+		zephyr,reference = "ADC_REF_INTERNAL";
+		zephyr,acquisition-time = <ADC_ACQ_TIME_DEFAULT>;
+		zephyr,input-positive = <NRF_SAADC_AIN4>;
+		zephyr,resolution = <14>;
+	};
+};
diff --git a/tests/drivers/adc/adc_accuracy_test/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay b/tests/drivers/adc/adc_accuracy_test/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
new file mode 100644
index 00000000000..53facf3dc31
--- /dev/null
+++ b/tests/drivers/adc/adc_accuracy_test/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
@@ -0,0 +1,27 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ */
+
+/ {
+	zephyr,user {
+		io-channels = <&adc 0>;
+		reference_mv = <1800>;
+		expected_accuracy = <64>;
+	};
+};
+
+&adc {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	channel@0 {
+		reg = <0>;
+		zephyr,gain = "ADC_GAIN_1_2";
+		zephyr,reference = "ADC_REF_INTERNAL";
+		zephyr,acquisition-time = <ADC_ACQ_TIME_DEFAULT>;
+		zephyr,input-positive = <NRF_SAADC_AIN2>;
+		zephyr,resolution = <14>;
+	};
+};
diff --git a/tests/drivers/adc/adc_accuracy_test/src/ref_volt.c b/tests/drivers/adc/adc_accuracy_test/src/ref_volt.c
index 1c4806b249e..9679720c51e 100644
--- a/tests/drivers/adc/adc_accuracy_test/src/ref_volt.c
+++ b/tests/drivers/adc/adc_accuracy_test/src/ref_volt.c
@@ -8,6 +8,7 @@
 #include <zephyr/ztest.h>
 
 #define REF_V DT_PROP(DT_PATH(zephyr_user), reference_mv)
+#define EXP_ACC DT_PROP(DT_PATH(zephyr_user), expected_accuracy)
 
 extern const struct adc_dt_spec *get_adc_channel(void);
 
@@ -19,6 +20,7 @@ static int test_ref_to_adc(void)
 	struct adc_sequence sequence = {
 		.buffer      = &sample_buffer,
 		.buffer_size = sizeof(sample_buffer),
+		.calibrate = true,
 	};
 
 	const struct adc_dt_spec *adc_channel = get_adc_channel();
@@ -31,7 +33,7 @@ static int test_ref_to_adc(void)
 	ret = adc_raw_to_millivolts_dt(adc_channel, &sample_buffer);
 	zassert_equal(ret, 0, "adc_raw_to_millivolts_dt() failed with code %d",
 		      ret);
-	zassert_within(sample_buffer, REF_V, 32,
+	zassert_within(sample_buffer, REF_V, EXP_ACC,
 		"Value %d mV read from ADC does not match expected range (%d mV).",
 		sample_buffer, REF_V);
 
diff --git a/tests/drivers/adc/adc_accuracy_test/testcase.yaml b/tests/drivers/adc/adc_accuracy_test/testcase.yaml
index e33f7237339..112ddefd4d8 100644
--- a/tests/drivers/adc/adc_accuracy_test/testcase.yaml
+++ b/tests/drivers/adc/adc_accuracy_test/testcase.yaml
@@ -19,3 +19,6 @@ tests:
     platform_allow:
       - frdm_kl25z
       - ek_ra8m1
+      - nrf52840dk/nrf52840
+      - nrf54l15pdk/nrf54l15/cpuapp
+      - nrf54h20dk/nrf54h20/cpuapp
diff --git a/tests/drivers/adc/adc_api/boards/nrf54h20dk_nrf54h20_cpuapp.overlay b/tests/drivers/adc/adc_api/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
index d9c1f965add..536366ec8d5 100644
--- a/tests/drivers/adc/adc_api/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
+++ b/tests/drivers/adc/adc_api/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
@@ -34,7 +34,7 @@
 
 	channel@2 {
 		reg = <2>;
-		zephyr,gain = "ADC_GAIN_1_2";
+		zephyr,gain = "ADC_GAIN_2_3";
 		zephyr,reference = "ADC_REF_INTERNAL";
 		zephyr,acquisition-time = <ADC_ACQ_TIME(ADC_ACQ_TIME_MICROSECONDS, 10)>;
 		zephyr,input-positive = <NRF_SAADC_AIN2>;
diff --git a/tests/drivers/adc/adc_api/boards/nrf54l15dk_nrf54l15_cpuapp.overlay b/tests/drivers/adc/adc_api/boards/nrf54l15dk_nrf54l15_cpuapp.overlay
index a7252902a0c..87707847eea 100644
--- a/tests/drivers/adc/adc_api/boards/nrf54l15dk_nrf54l15_cpuapp.overlay
+++ b/tests/drivers/adc/adc_api/boards/nrf54l15dk_nrf54l15_cpuapp.overlay
@@ -34,7 +34,7 @@
 
 	channel@2 {
 		reg = <2>;
-		zephyr,gain = "ADC_GAIN_2_5";
+		zephyr,gain = "ADC_GAIN_2_3";
 		zephyr,reference = "ADC_REF_INTERNAL";
 		zephyr,acquisition-time = <ADC_ACQ_TIME(ADC_ACQ_TIME_MICROSECONDS, 10)>;
 		zephyr,input-positive = <NRF_SAADC_AIN2>;
diff --git a/tests/drivers/adc/adc_api/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay b/tests/drivers/adc/adc_api/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
index a7252902a0c..87707847eea 100644
--- a/tests/drivers/adc/adc_api/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
+++ b/tests/drivers/adc/adc_api/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
@@ -34,7 +34,7 @@
 
 	channel@2 {
 		reg = <2>;
-		zephyr,gain = "ADC_GAIN_2_5";
+		zephyr,gain = "ADC_GAIN_2_3";
 		zephyr,reference = "ADC_REF_INTERNAL";
 		zephyr,acquisition-time = <ADC_ACQ_TIME(ADC_ACQ_TIME_MICROSECONDS, 10)>;
 		zephyr,input-positive = <NRF_SAADC_AIN2>;
diff --git a/tests/drivers/adc/adc_error_cases/CMakeLists.txt b/tests/drivers/adc/adc_error_cases/CMakeLists.txt
new file mode 100644
index 00000000000..7b240573c84
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/CMakeLists.txt
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.20.0)
+
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(adc_error_cases)
+
+FILE(GLOB app_sources src/*.c)
+target_sources(app PRIVATE ${app_sources})
diff --git a/tests/drivers/adc/adc_error_cases/boards/nrf52840dk_nrf52840.overlay b/tests/drivers/adc/adc_error_cases/boards/nrf52840dk_nrf52840.overlay
new file mode 100644
index 00000000000..18e74f72ee2
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/boards/nrf52840dk_nrf52840.overlay
@@ -0,0 +1,11 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ */
+
+/ {
+	aliases {
+		adc = &adc;
+	};
+};
diff --git a/tests/drivers/adc/adc_error_cases/boards/nrf54h20dk_nrf54h20_cpuapp.overlay b/tests/drivers/adc/adc_error_cases/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
new file mode 100644
index 00000000000..18e74f72ee2
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/boards/nrf54h20dk_nrf54h20_cpuapp.overlay
@@ -0,0 +1,11 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ */
+
+/ {
+	aliases {
+		adc = &adc;
+	};
+};
diff --git a/tests/drivers/adc/adc_error_cases/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay b/tests/drivers/adc/adc_error_cases/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
new file mode 100644
index 00000000000..18e74f72ee2
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
@@ -0,0 +1,11 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Copyright (c) 2024 Nordic Semiconductor ASA
+ */
+
+/ {
+	aliases {
+		adc = &adc;
+	};
+};
diff --git a/tests/drivers/adc/adc_error_cases/prj.conf b/tests/drivers/adc/adc_error_cases/prj.conf
new file mode 100644
index 00000000000..40f19db980d
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/prj.conf
@@ -0,0 +1,3 @@
+CONFIG_ZTEST=y
+
+CONFIG_ADC=y
diff --git a/tests/drivers/adc/adc_error_cases/src/main.c b/tests/drivers/adc/adc_error_cases/src/main.c
new file mode 100644
index 00000000000..9e01979e801
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/src/main.c
@@ -0,0 +1,244 @@
+/*
+ * Copyright (c) 2024, Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <zephyr/kernel.h>
+#include <zephyr/device.h>
+#include <zephyr/ztest.h>
+#include <zephyr/drivers/adc.h>
+
+static const struct device *dev_adc = DEVICE_DT_GET(DT_ALIAS(adc));
+#define BUFFER_LEN 8
+uint16_t m_sample_buffer[BUFFER_LEN];
+
+static struct adc_channel_cfg valid_channel_cfg = {
+	.gain = ADC_GAIN_1,
+	.channel_id = 0,
+	.reference = ADC_REF_INTERNAL,
+	.acquisition_time = ADC_ACQ_TIME_DEFAULT,
+	.differential = false,
+	#ifdef CONFIG_ADC_CONFIGURABLE_INPUTS
+	.input_positive = 1,
+	#endif
+};
+
+static struct adc_sequence valid_seq = {
+	.buffer = m_sample_buffer,
+	.buffer_size = BUFFER_LEN * sizeof(uint16_t),
+	.options = NULL,
+	.resolution = 8,
+	.oversampling = 0,
+	.channels = 1,
+};
+
+/**
+ * @brief test adc_read() with invalid oversampling value
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_read_invalid_oversampling)
+{
+	int ret;
+
+	adc_channel_setup(dev_adc, &valid_channel_cfg);
+
+	struct adc_sequence invalid_seq = valid_seq;
+	/* Set oversampling to invalid value */
+	invalid_seq.oversampling = 99;
+
+	ret = adc_read(dev_adc, &invalid_seq);
+
+	zassert_true(
+		ret == -EINVAL,
+		"adc_read() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_read() with invalid resolution value
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_read_invalid_resolution)
+{
+	int ret;
+
+	adc_channel_setup(dev_adc, &valid_channel_cfg);
+
+	struct adc_sequence invalid_seq = valid_seq;
+	/* Set resolution to invalid value */
+	invalid_seq.resolution = 99;
+
+	ret = adc_read(dev_adc, &invalid_seq);
+
+	zassert_true(
+		ret == -EINVAL,
+		"adc_read() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_read() with invalid channels value
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_read_invalid_channels)
+{
+	int ret;
+
+	adc_channel_setup(dev_adc, &valid_channel_cfg);
+
+	struct adc_sequence invalid_seq = valid_seq;
+	/* Set channels configuration to invalid value */
+	invalid_seq.channels = 0;
+
+	ret = adc_read(dev_adc, &invalid_seq);
+
+	zassert_true(
+		ret == -EINVAL,
+		"adc_read() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_read() with not configured channel
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_read_not_configured_channel)
+{
+	int ret;
+
+	adc_channel_setup(dev_adc, &valid_channel_cfg);
+
+	struct adc_sequence invalid_seq = valid_seq;
+	/* Set channels configuration to use not configured channel */
+	invalid_seq.channels = 2;
+
+	ret = adc_read(dev_adc, &invalid_seq);
+
+	zassert_true(
+		ret == -EINVAL,
+		"adc_read() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_read() with invalid buffer length
+ *
+ * function should return -ENOMEM
+ */
+
+ZTEST(adc_error_cases, test_adc_read_invalid_buffer)
+{
+	int ret;
+
+	adc_channel_setup(dev_adc, &valid_channel_cfg);
+
+	struct adc_sequence invalid_seq = valid_seq;
+	/* set buffer size to 0 bytes */
+	invalid_seq.buffer_size = 0;
+
+	ret = adc_read(dev_adc, &invalid_seq);
+
+	zassert_true(
+		ret == -ENOMEM,
+		"adc_read() should return -ENOMEM,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_channel_setup() with invalid reference value
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_setup_invalid_reference)
+{
+	int ret;
+
+	struct adc_channel_cfg invalid_channel_cfg = valid_channel_cfg;
+	/* set invalid reference */
+	invalid_channel_cfg.reference = 99;
+
+	ret = adc_channel_setup(dev_adc, &invalid_channel_cfg);
+
+	zassert_true(
+		ret == -EINVAL,
+		"adc_channel_setup() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_read() with invalid gain value
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_setup_invalid_gain)
+{
+	int ret;
+
+	struct adc_channel_cfg invalid_channel_cfg = valid_channel_cfg;
+	/* set invalid gain value */
+	invalid_channel_cfg.gain = 99;
+	ret = adc_channel_setup(dev_adc, &invalid_channel_cfg);
+	zassert_true(
+		ret == -EINVAL,
+		"adc_channel_setup() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+/**
+ * @brief test adc_read() with invalid acquisition time
+ *
+ * function should return -EINVAL
+ */
+
+ZTEST(adc_error_cases, test_adc_setup_invalid_acquisition_time)
+{
+	int ret;
+
+	struct adc_channel_cfg invalid_channel_cfg = valid_channel_cfg;
+	/* set invalid acquisition_time value */
+	invalid_channel_cfg.acquisition_time = 16384;
+
+	ret = adc_channel_setup(dev_adc, &invalid_channel_cfg);
+
+	zassert_true(
+		ret == -EINVAL,
+		"adc_channel_setup() should return -EINVAL,"
+		" got unexpected value of %d",
+		ret
+	);
+}
+
+static void *suite_setup(void)
+{
+	TC_PRINT("Test executed on %s\n", CONFIG_BOARD_TARGET);
+	TC_PRINT("===================================================================\n");
+
+	return NULL;
+}
+
+ZTEST_SUITE(adc_error_cases, NULL, suite_setup, NULL, NULL, NULL);
diff --git a/tests/drivers/adc/adc_error_cases/testcase.yaml b/tests/drivers/adc/adc_error_cases/testcase.yaml
new file mode 100644
index 00000000000..5b12e5f8ae0
--- /dev/null
+++ b/tests/drivers/adc/adc_error_cases/testcase.yaml
@@ -0,0 +1,11 @@
+common:
+  tags:
+    - adc
+    - drivers
+tests:
+  drivers.adc_error_cases:
+    depends_on: adc
+    platform_allow:
+      - nrf52840dk/nrf52840
+      - nrf54l15pdk/nrf54l15/cpuapp
+      - nrf54h20dk/nrf54h20/cpuapp
diff --git a/tests/drivers/build_all/regulator/testcase.yaml b/tests/drivers/build_all/regulator/testcase.yaml
index 58fc0851981..8214a2ca33a 100644
--- a/tests/drivers/build_all/regulator/testcase.yaml
+++ b/tests/drivers/build_all/regulator/testcase.yaml
@@ -3,9 +3,7 @@
 
 tests:
   drivers.regulator.build:
-    tags:
-      - drivers
-      - regulator
+    tags: drivers regulator
     build_only: true
     platform_allow:
       - native_posix
diff --git a/tests/drivers/flash/negative_tests/sysbuild.conf b/tests/drivers/flash/negative_tests/sysbuild.conf
new file mode 100644
index 00000000000..6408669a847
--- /dev/null
+++ b/tests/drivers/flash/negative_tests/sysbuild.conf
@@ -0,0 +1 @@
+SB_CONFIG_PARTITION_MANAGER=n
diff --git a/tests/drivers/pwm/pwm_api/boards/nrf54h20dk_nrf54h20_cpuapp_fast.overlay b/tests/drivers/pwm/pwm_api/boards/nrf54h20dk_nrf54h20_cpuapp_fast.overlay
new file mode 100644
index 00000000000..c4e2cb8c38b
--- /dev/null
+++ b/tests/drivers/pwm/pwm_api/boards/nrf54h20dk_nrf54h20_cpuapp_fast.overlay
@@ -0,0 +1,21 @@
+&pinctrl {
+	pwm_default: pwm_default {
+		group1 {
+			psels = <NRF_PSEL(PWM_OUT0, 7, 0)>;
+		};
+	};
+	pwm_sleep: pwm_sleep {
+		group1 {
+			psels = <NRF_PSEL(PWM_OUT0, 7, 0)>;
+			low-power-enable;
+		};
+	};
+};
+
+&pwm120 {
+	status = "okay";
+	pinctrl-0 = <&pwm_default>;
+	pinctrl-1 = <&pwm_sleep>;
+	pinctrl-names = "default", "sleep";
+	memory-regions = <&dma_fast_region>;
+};
diff --git a/tests/drivers/pwm/pwm_api/testcase.yaml b/tests/drivers/pwm/pwm_api/testcase.yaml
index c9f3ac62e39..b30458cc970 100644
--- a/tests/drivers/pwm/pwm_api/testcase.yaml
+++ b/tests/drivers/pwm/pwm_api/testcase.yaml
@@ -21,3 +21,7 @@ tests:
       or dt_alias_exists("pwm-3")) and CONFIG_DT_HAS_NXP_FLEXIO_ENABLED and
       CONFIG_DT_HAS_NXP_FLEXIO_PWM_ENABLED
     depends_on: pwm
+  drivers.pwm.pwm_fast:
+    extra_args: DTC_OVERLAY_FILE="boards/nrf54h20dk_nrf54h20_cpuapp_fast.overlay"
+    platform_allow:
+      - nrf54h20dk/nrf54h20/cpuapp
diff --git a/tests/drivers/spi/spi_controller_peripheral/boards/nrf52840dk_nrf52840.overlay b/tests/drivers/spi/spi_controller_peripheral/boards/nrf52840dk_nrf52840.overlay
index 97802a7a637..f0909162552 100644
--- a/tests/drivers/spi/spi_controller_peripheral/boards/nrf52840dk_nrf52840.overlay
+++ b/tests/drivers/spi/spi_controller_peripheral/boards/nrf52840dk_nrf52840.overlay
@@ -53,6 +53,7 @@
 	dut_spi_dt: test-spi-dev@0 {
 		compatible = "vnd,spi-device";
 		reg = <0>;
+		spi-max-frequency = <DT_FREQ_M(8)>;
 	};
 };
 
diff --git a/tests/drivers/spi/spi_controller_peripheral/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay b/tests/drivers/spi/spi_controller_peripheral/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
index 73a50a7c6fc..6ba01f86352 100644
--- a/tests/drivers/spi/spi_controller_peripheral/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
+++ b/tests/drivers/spi/spi_controller_peripheral/boards/nrf54l15pdk_nrf54l15_cpuapp.overlay
@@ -57,6 +57,7 @@
 	dut_spi_dt: test-spi-dev@0 {
 		compatible = "vnd,spi-device";
 		reg = <0>;
+		spi-max-frequency = <DT_FREQ_M(8)>;
 	};
 };
 
diff --git a/tests/drivers/spi/spi_controller_peripheral/testcase.yaml b/tests/drivers/spi/spi_controller_peripheral/testcase.yaml
index 18dfb9db1cd..ecf491fed79 100644
--- a/tests/drivers/spi/spi_controller_peripheral/testcase.yaml
+++ b/tests/drivers/spi/spi_controller_peripheral/testcase.yaml
@@ -57,3 +57,9 @@ tests:
       - nrf52840dk/nrf52840
       - nrf54l15pdk/nrf54l15/cpuapp
       - nrf54h20dk/nrf54h20/cpurad
+
+  drivers.spi.pm_runtime:
+    extra_configs:
+      - CONFIG_PM_DEVICE=y
+      - CONFIG_PM_DEVICE_RUNTIME=y
+    filter: CONFIG_SOC_FAMILY_NORDIC_NRF
diff --git a/tests/drivers/spi/spi_loopback/testcase.yaml b/tests/drivers/spi/spi_loopback/testcase.yaml
index 5760aa0d879..c65ec904d37 100644
--- a/tests/drivers/spi/spi_loopback/testcase.yaml
+++ b/tests/drivers/spi/spi_loopback/testcase.yaml
@@ -204,3 +204,8 @@ tests:
   drivers.spi.max32_dma.loopback:
     extra_args: OVERLAY_CONFIG="overlay-max32-spi-dma.conf"
     filter: CONFIG_SOC_FAMILY_MAX32
+  drivers.spi.nrf_pm_runtime:
+    extra_configs:
+      - CONFIG_PM_DEVICE=y
+      - CONFIG_PM_DEVICE_RUNTIME=y
+    filter: CONFIG_SOC_FAMILY_NORDIC_NRF
diff --git a/tests/kernel/interrupt/src/nested_irq.c b/tests/kernel/interrupt/src/nested_irq.c
index 1bcb11c38ea..1650a7b77ec 100644
--- a/tests/kernel/interrupt/src/nested_irq.c
+++ b/tests/kernel/interrupt/src/nested_irq.c
@@ -60,6 +60,12 @@
 #define IRQ0_LINE	16
 #define IRQ1_LINE	17
 
+#define IRQ0_PRIO	1
+#define IRQ1_PRIO	2
+#elif defined(CONFIG_SOC_NRF54H20_CPUPPR)
+#define IRQ0_LINE	14
+#define IRQ1_LINE	15
+
 #define IRQ0_PRIO	1
 #define IRQ1_PRIO	2
 #else
diff --git a/tests/kernel/sched/schedule_api/prj.conf b/tests/kernel/sched/schedule_api/prj.conf
index fe5125047e3..785e9a3987b 100644
--- a/tests/kernel/sched/schedule_api/prj.conf
+++ b/tests/kernel/sched/schedule_api/prj.conf
@@ -7,3 +7,4 @@ CONFIG_MAX_THREAD_BYTES=5
 CONFIG_TEST_USERSPACE=y
 CONFIG_MP_MAX_NUM_CPUS=1
 CONFIG_ZTEST_FATAL_HOOK=y
+CONFIG_MINIMAL_LIBC=y
diff --git a/tests/kernel/sched/schedule_api/prj_dumb.conf b/tests/kernel/sched/schedule_api/prj_dumb.conf
index c0ddfbd7c3f..a1d0cf6dced 100644
--- a/tests/kernel/sched/schedule_api/prj_dumb.conf
+++ b/tests/kernel/sched/schedule_api/prj_dumb.conf
@@ -5,3 +5,4 @@ CONFIG_SCHED_DUMB=y
 CONFIG_MAX_THREAD_BYTES=5
 CONFIG_MP_MAX_NUM_CPUS=1
 CONFIG_ZTEST_FATAL_HOOK=y
+CONFIG_MINIMAL_LIBC=y
diff --git a/tests/kernel/sched/schedule_api/prj_multiq.conf b/tests/kernel/sched/schedule_api/prj_multiq.conf
index 6b28a1f39b2..cfe09fbce47 100644
--- a/tests/kernel/sched/schedule_api/prj_multiq.conf
+++ b/tests/kernel/sched/schedule_api/prj_multiq.conf
@@ -7,3 +7,4 @@ CONFIG_MP_MAX_NUM_CPUS=1
 CONFIG_ZTEST_FATAL_HOOK=y
 CONFIG_NUM_COOP_PRIORITIES=30
 CONFIG_NUM_PREEMPT_PRIORITIES=40
+CONFIG_MINIMAL_LIBC=y
diff --git a/tests/kernel/timer/timer_api/Kconfig b/tests/kernel/timer/timer_api/Kconfig
index 9a0bfb8c74d..7854b2cacd7 100644
--- a/tests/kernel/timer/timer_api/Kconfig
+++ b/tests/kernel/timer/timer_api/Kconfig
@@ -4,4 +4,7 @@
 config SYS_CLOCK_TICKS_PER_SEC
 	default 16384 if NRF_RTC_TIMER && TICKLESS_KERNEL
 
+config ASSERT_VERBOSE
+	default n if SOC_NRF54H20_CPUPPR
+
 source "Kconfig.zephyr"
diff --git a/tests/kernel/timer/timer_api/src/main.c b/tests/kernel/timer/timer_api/src/main.c
index b996baa72e3..90ef86a2986 100644
--- a/tests/kernel/timer/timer_api/src/main.c
+++ b/tests/kernel/timer/timer_api/src/main.c
@@ -28,15 +28,22 @@ struct timer_data {
  */
 #define INEXACT_MS_CONVERT ((CONFIG_SYS_CLOCK_TICKS_PER_SEC % MSEC_PER_SEC) != 0)
 
-#if CONFIG_NRF_RTC_TIMER
-/* On Nordic SOCs one or both of the tick and busy-wait clocks may
- * derive from sources that have slews that sum to +/- 13%.
+#if CONFIG_ARCH_HAS_CUSTOM_BUSY_WAIT && CONFIG_NRF_RTC_TIMER
+/* On Nordic SOCs using RTC_TIMER as the system timer and custom k_busy_wait() implementation,
+ * one or both of the tick and busy-wait clocks may derive from sources that have slews that
+ * sum to +/- 13%.
  */
 #define BUSY_TICK_SLEW_PPM 130000U
+#elif CONFIG_ARCH_HAS_CUSTOM_BUSY_WAIT && CONFIG_NRF_GRTC_TIMER
+/* On Nordic SOCs using GRTC_TIMER as the system timer and custom k_busy_wait() implementation,
+ * one or both of the tick and busy-wait clocks may derive from sources that have slews that
+ * sum to +/- 2%.
+ */
+#define BUSY_TICK_SLEW_PPM 20000U
 #else
-/* On other platforms assume the clocks are perfectly aligned. */
+/* In other cases assume the clocks are perfectly aligned. */
 #define BUSY_TICK_SLEW_PPM 0U
-#endif
+#endif /* CONFIG_ARCH_HAS_CUSTOM_BUSY_WAIT && CONFIG_NRF_RTC_TIMER */
 #define PPM_DIVISOR 1000000U
 
 /* If the tick clock is faster or slower than the busywait clock the
diff --git a/tests/kernel/timer/timer_behavior/testcase.yaml b/tests/kernel/timer/timer_behavior/testcase.yaml
index 7e1b725ffba..40fcde82256 100644
--- a/tests/kernel/timer/timer_behavior/testcase.yaml
+++ b/tests/kernel/timer/timer_behavior/testcase.yaml
@@ -8,6 +8,8 @@ tests:
       - mcu
     simulation_exclude:
       - renode
+    platform_exclude:
+      - nrf54h20dk/nrf54h20/cpuppr
     harness_config:
       record:
         regex: "RECORD:(?P<metrics>.*)"
diff --git a/tests/lib/newlib/heap_listener/prj.conf b/tests/lib/newlib/heap_listener/prj.conf
index e5a5dc6df4c..7282777ff1c 100644
--- a/tests/lib/newlib/heap_listener/prj.conf
+++ b/tests/lib/newlib/heap_listener/prj.conf
@@ -1,3 +1,4 @@
 CONFIG_ZTEST=y
 CONFIG_NEWLIB_LIBC=y
+CONFIG_NEWLIB_LIBC_NANO=n
 CONFIG_NEWLIB_LIBC_HEAP_LISTENER=y
diff --git a/tests/net/ipv6/prj.conf b/tests/net/ipv6/prj.conf
index b2b2f088673..40ba08661b1 100644
--- a/tests/net/ipv6/prj.conf
+++ b/tests/net/ipv6/prj.conf
@@ -33,6 +33,7 @@ CONFIG_NET_IF_MAX_IPV6_COUNT=2
 CONFIG_NET_IPV6_PE=y
 CONFIG_NET_IPV6_PE_FILTER_PREFIX_COUNT=2
 CONFIG_NET_IPV6_PE_PREFER_PUBLIC_ADDRESSES=n
+CONFIG_MBEDTLS_LEGACY_CRYPTO_C=y
 
 # Increase the stack a bit for mps2/an385
 CONFIG_NET_RX_STACK_SIZE=1700
diff --git a/tests/net/lib/http_server/common/testcase.yaml b/tests/net/lib/http_server/common/testcase.yaml
index 8b89a10da97..530fab321bf 100644
--- a/tests/net/lib/http_server/common/testcase.yaml
+++ b/tests/net/lib/http_server/common/testcase.yaml
@@ -1,4 +1,5 @@
 common:
+  depends_on: netif
   min_ram: 40
   tags:
     - net
diff --git a/tests/net/lib/http_server/core/testcase.yaml b/tests/net/lib/http_server/core/testcase.yaml
index 695674768b0..3ecfe659d48 100644
--- a/tests/net/lib/http_server/core/testcase.yaml
+++ b/tests/net/lib/http_server/core/testcase.yaml
@@ -1,4 +1,5 @@
 common:
+  depends_on: netif
   min_ram: 80
   tags:
     - http
diff --git a/tests/net/lib/http_server/crime/testcase.yaml b/tests/net/lib/http_server/crime/testcase.yaml
index 31660759135..5fbcfe5ea27 100644
--- a/tests/net/lib/http_server/crime/testcase.yaml
+++ b/tests/net/lib/http_server/crime/testcase.yaml
@@ -1,4 +1,5 @@
 common:
+  depends_on: netif
   min_ram: 60
   tags:
     - http
diff --git a/tests/net/lib/http_server/tls/testcase.yaml b/tests/net/lib/http_server/tls/testcase.yaml
index 19611844a00..c163efb2526 100644
--- a/tests/net/lib/http_server/tls/testcase.yaml
+++ b/tests/net/lib/http_server/tls/testcase.yaml
@@ -1,4 +1,5 @@
 common:
+  depends_on: netif
   min_ram: 192
   tags:
     - http
diff --git a/west.yml b/west.yml
index 49bc40e1e4f..938784509c6 100644
--- a/west.yml
+++ b/west.yml
@@ -303,7 +303,7 @@ manifest:
       revision: d2a119a9c7600ce06033a794de042e0ad9a38702
       path: modules/bsim_hw_models/nrf_hw_models
     - name: open-amp
-      revision: 76d2168bcdfcd23a9a7dce8c21f2083b90a1e60a
+      revision: pull/21/head
       path: modules/lib/open-amp
     - name: openthread
       revision: e10a92570f94ff1e0bc5e0da9ecf0ee135d955a6