Merge branch 'bugfix/i2s_param_comments' into 'release/v3.0'

modify i2s param and comments See merge request idf/esp-idf!2266
fix zero dma buffer bug: must be 4-bytes aligned
2026-06-14 05:02:17 +02:00 · 2018-04-24 10:47:56 +08:00 · 2018-04-23 19:33:11 +08:00 · 2018-04-23 14:30:55 +08:00 · 2018-04-19 17:30:16 +08:00 · 2018-04-19 15:00:01 +08:00
332 changed files with 18280 additions and 8371 deletions
@@ -0,0 +1,34 @@
+# EditorConfig helps developers define and maintain consistent
+# coding styles between different editors and IDEs
+# http://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[{*.md,*.rst}]
+trim_trailing_whitespace = false
+
+[{Makefile,*.mk,*.bat}]
+indent_style = tab
+indent_size = 2
+
+[*/freertos/**]
+indent_style = tab
+indent_size = 4
+
+[{*/freertos/**.S,**/FreeRTOSConfig.h}]
+indent_style = space
+indent_size = 4
+
+[*.pem]
+insert_final_newline = false
+
+[*.py]
+max_line_length = 119
@@ -109,17 +109,29 @@ build_template_app:
    BATCH_BUILD: "1"
    V: "0"

-build_ssc:
+.build_ssc_template: &build_ssc_template
  <<: *build_template
  artifacts:
    paths:
      - SSC/ssc_bin
-    expire_in: 6 mos
+    expire_in: 1 mos
+  variables:
+    SSC_CONFIG_FOLDER: "$CI_PROJECT_DIR/SSC/configs/ESP32_IDF"
  script:
    - git clone $SSC_REPOSITORY
    - cd SSC
    - python $CHECKOUT_REF_SCRIPT SSC
-    - MAKEFLAGS= ./gen_misc_ng.sh
+    - MAKEFLAGS= ./ci_build_ssc.sh "${CI_JOB_NAME}" "${IDF_PATH}/.gitlab-ci.yml"
+
+# don't forget to add to dependency to test_template when adding new build_ssc jobs
+build_ssc_00:
+  <<: *build_ssc_template
+
+build_ssc_01:
+  <<: *build_ssc_template
+
+build_ssc_02:
+  <<: *build_ssc_template

 build_esp_idf_tests:
  <<: *build_template
@@ -141,15 +153,18 @@ build_esp_idf_tests:
 .build_examples_template: &build_examples_template
  <<: *build_template
  artifacts:
+    when: always
    paths:
      - build_examples/*/*/*/build/*.bin
      - build_examples/*/*/*/build/*.elf
      - build_examples/*/*/*/build/*.map
      - build_examples/*/*/*/build/download.config
      - build_examples/*/*/*/build/bootloader/*.bin
+      - $LOG_PATH
    expire_in: 1 week
  variables:
    IDF_CI_BUILD: "1"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples"
  script:
    # it's not possible to build 100% out-of-tree and have the "artifacts"
    # mechanism work, but this is the next best thing
@@ -157,6 +172,7 @@ build_esp_idf_tests:
    - mkdir build_examples
    - cd build_examples
    # build some of examples
+    - mkdir -p ${LOG_PATH}
    - ${IDF_PATH}/tools/ci/build_examples.sh "${CI_JOB_NAME}"

 build_examples_00:
@@ -246,7 +262,7 @@ test_multi_heap_on_host:
    - wl_host_test
  script:
    - cd components/heap/test_multi_heap_host
-    - make test
+    - ./test_all_configs.sh

 test_build_system:
  stage: test
@@ -438,7 +454,7 @@ assign_test:
    EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
  artifacts:
    paths:
-      - test_bins
+      - $OUTPUT_BIN_PATH
      - components/idf_test/*/CIConfigs
      - components/idf_test/*/TC.sqlite
      - $EXAMPLE_CONFIG_OUTPUT_PATH
@@ -459,7 +475,7 @@ assign_test:
    # assign unit test cases
    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/unit_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/test_bins
    # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/test_bins
+    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin

 .example_test_template: &example_test_template
  stage: test
@@ -500,6 +516,9 @@ assign_test:
  allow_failure: true
  dependencies:
    - assign_test
+    - build_ssc_00
+    - build_ssc_01
+    - build_ssc_02
  artifacts:
    when: always
    paths:
@@ -751,6 +770,13 @@ UT_003_08:
    - UT_T1_1
    - UT_single_core

+UT_003_09:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_single_core
+
 UT_004_01:
  <<: *unit_test_template
  tags:
@@ -33,3 +33,7 @@
 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
 	url = https://github.com/pellepl/spiffs.git
+
+[submodule "components/json/cJSON"]
+	path = components/json/cJSON
+	url = https://github.com/DaveGamble/cJSON.git
@@ -64,33 +64,37 @@ config SYSVIEW_ENABLE
        Enables supporrt for SEGGER SystemView tracing functionality.

 choice SYSVIEW_TS_SOURCE
-    prompt "ESP32 timer to use as SystemView timestamp source"
+    prompt "Timer to use as timestamp source"
    depends on SYSVIEW_ENABLE
-    default SYSVIEW_TS_SOURCE_TIMER_00
+    default SYSVIEW_TS_SOURCE_CCOUNT if FREERTOS_UNICORE && !PM_ENABLE
+    default SYSVIEW_TS_SOURCE_TIMER_00 if !FREERTOS_UNICORE && !PM_ENABLE
+    default SYSVIEW_TS_SOURCE_ESP_TIMER if PM_ENABLE
    help
        SystemView needs to use a hardware timer as the source of timestamps
-        when tracing 
-        This option selects HW timer for it.
+        when tracing. This option selects the timer for it.
+
+config SYSVIEW_TS_SOURCE_CCOUNT
+	bool "CPU cycle counter (CCOUNT)"
+	depends on FREERTOS_UNICORE && !PM_ENABLE

 config SYSVIEW_TS_SOURCE_TIMER_00
    bool "Timer 0, Group 0"
-    help
-        Select this to use timer 0 of group 0
+    depends on !PM_ENABLE

 config SYSVIEW_TS_SOURCE_TIMER_01
    bool "Timer 1, Group 0"
-    help
-        Select this to use timer 1 of group 0
+    depends on !PM_ENABLE

 config SYSVIEW_TS_SOURCE_TIMER_10
    bool "Timer 0, Group 1"
-    help
-        Select this to use timer 0 of group 1
+    depends on !PM_ENABLE

 config SYSVIEW_TS_SOURCE_TIMER_11
    bool "Timer 1, Group 1"
-    help
-        Select this to use timer 1 of group 1
+    depends on !PM_ENABLE
+
+config SYSVIEW_TS_SOURCE_ESP_TIMER
+	bool "esp_timer high resolution timer"

 endchoice

@@ -64,9 +64,6 @@ Revision: $Rev: 3734 $
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
 #include "rom/ets_sys.h"
-#if CONFIG_FREERTOS_UNICORE == 0
-#include "driver/timer.h"
-#endif
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
 #include "esp_intr_alloc.h"
@@ -86,10 +83,49 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // The target device name
 #define SYSVIEW_DEVICE_NAME     "ESP32"

+// Determine which timer to use as timestamp source
+#if CONFIG_SYSVIEW_TS_SOURCE_CCOUNT
+#define TS_USE_CCOUNT 1
+#elif CONFIG_SYSVIEW_TS_SOURCE_ESP_TIMER
+#define TS_USE_ESP_TIMER 1
+#else
+#define TS_USE_TIMERGROUP 1
+#endif
+
+#if TS_USE_TIMERGROUP
+#include "driver/timer.h"
+
 // Timer group timer divisor
 #define SYSVIEW_TIMER_DIV       2
+
 // Frequency of the timestamp.
 #define SYSVIEW_TIMESTAMP_FREQ  (esp_clk_apb_freq() / SYSVIEW_TIMER_DIV)
+
+// Timer ID and group ID
+#if defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_00) || defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_01)
+#define TS_TIMER_ID 0
+#else
+#define TS_TIMER_ID 1
+#endif // TIMER_00 || TIMER_01
+
+#if defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_00) || defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_10)
+#define TS_TIMER_GROUP 0
+#else
+#define TS_TIMER_GROUP 1
+#endif // TIMER_00 || TIMER_10
+
+#endif // TS_USE_TIMERGROUP
+
+#if TS_USE_ESP_TIMER
+// esp_timer provides 1us resolution
+#define SYSVIEW_TIMESTAMP_FREQ  (1000000)
+#endif // TS_USE_ESP_TIMER
+
+#if TS_USE_CCOUNT
+// CCOUNT is incremented at CPU frequency
+#define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
+#endif // TS_USE_CCOUNT
+
 // System Frequency.
 #define SYSVIEW_CPU_FREQ        (esp_clk_cpu_freq())

@@ -103,11 +139,8 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
    #define SYSTICK_INTR_ID (ETS_INTERNAL_TIMER1_INTR_SOURCE+ETS_INTERNAL_INTR_SOURCE_OFF)
 #endif

-static timer_idx_t s_ts_timer_idx;
-static timer_group_t s_ts_timer_group;
-
 // SystemView is single core specific: it implies that SEGGER_SYSVIEW_LOCK()
-// disables IRQs (disables rescheduling globaly). So we can not use finite timeouts for locks and return error
+// disables IRQs (disables rescheduling globally). So we can not use finite timeouts for locks and return error
 // in case of expiration, because error will not be handled and SEGGER's code will go further implying that
 // everything is fine, so for multi-core env we have to wait on underlying lock forever
 #define SEGGER_LOCK_WAIT_TMO  ESP_APPTRACE_TMO_INFINITE
@@ -213,35 +246,24 @@ static void _cbSendSystemDesc(void) {
 */
 static void SEGGER_SYSVIEW_TS_Init()
 {
-    timer_config_t config;
-
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_00
-    s_ts_timer_group = TIMER_GROUP_0;
-    s_ts_timer_idx = TIMER_0;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_01
-    s_ts_timer_group = TIMER_GROUP_0;
-    s_ts_timer_idx = TIMER_1;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_10
-    s_ts_timer_group = TIMER_GROUP_1;
-    s_ts_timer_idx = TIMER_0;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_11
-    s_ts_timer_group = TIMER_GROUP_1;
-    s_ts_timer_idx = TIMER_1;
-#endif
-    config.alarm_en = 0;
-    config.auto_reload = 0;
-    config.counter_dir = TIMER_COUNT_UP;
-    config.divider = SYSVIEW_TIMER_DIV;
-    config.counter_en = 0;
-    /*Configure timer*/
-    timer_init(s_ts_timer_group, s_ts_timer_idx, &config);
-    /*Load counter value */
-    timer_set_counter_value(s_ts_timer_group, s_ts_timer_idx, 0x00000000ULL);
-    /*Enable timer interrupt*/
-    timer_start(s_ts_timer_group, s_ts_timer_idx);
+    /* We only need to initialize something if we use Timer Group.
+     * esp_timer and ccount can be used as is.
+     */
+#if TS_USE_TIMERGROUP
+    timer_config_t config = {
+        .alarm_en = 0,
+        .auto_reload = 0,
+        .counter_dir = TIMER_COUNT_UP,
+        .divider = SYSVIEW_TIMER_DIV,
+        .counter_en = 0
+    };
+    /* Configure timer */
+    timer_init(TS_TIMER_GROUP, TS_TIMER_ID, &config);
+    /* Load counter value */
+    timer_set_counter_value(TS_TIMER_GROUP, TS_TIMER_ID, 0x00000000ULL);
+    /* Start counting */
+    timer_start(TS_TIMER_GROUP, TS_TIMER_ID);
+#endif // TS_USE_TIMERGROUP
 }

 void SEGGER_SYSVIEW_Conf(void) {
@@ -296,12 +318,14 @@ void SEGGER_SYSVIEW_Conf(void) {

 U32 SEGGER_SYSVIEW_X_GetTimestamp()
 {
-#if CONFIG_FREERTOS_UNICORE == 0
+#if TS_USE_TIMERGROUP
    uint64_t ts = 0;
-    timer_get_counter_value(s_ts_timer_group, s_ts_timer_idx, &ts);
-    return (U32)ts; // return lower part of counter value
-#else
+    timer_get_counter_value(TS_TIMER_GROUP, TS_TIMER_ID, &ts);
+    return (U32) ts; // return lower part of counter value
+#elif TS_USE_CCOUNT
    return portGET_RUN_TIME_COUNTER_VALUE();
+#elif TS_USE_ESP_TIMER
+    return (U32) esp_timer_get_time(); // return lower part of counter value
 #endif
 }

@@ -43,9 +43,9 @@ config BOOTLOADER_SPI_WP_PIN

        The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.

-config BOOTLOADER_VDDSDIO_BOOST
-    bool "Increase VDDSDIO 1.8V LDO voltage to 1.9V"
-    default y
+choice BOOTLOADER_VDDSDIO_BOOST
+    bool "VDDSDIO LDO voltage"
+    default BOOTLOADER_VDDSDIO_BOOST_1_9V
    help
        If this option is enabled, and VDDSDIO LDO is set to 1.8V (using EFUSE
        or MTDI bootstrapping pin), bootloader will change LDO settings to
@@ -55,6 +55,13 @@ config BOOTLOADER_VDDSDIO_BOOST
        This option has no effect if VDDSDIO is set to 3.3V, or if the internal
        VDDSDIO regulator is disabled via efuse.

+config BOOTLOADER_VDDSDIO_BOOST_1_8V
+    bool "1.8V"
+    depends on !ESPTOOLPY_FLASHFREQ_80M
+config BOOTLOADER_VDDSDIO_BOOST_1_9V
+    bool "1.9V"
+endchoice
+
 endmenu  # Bootloader


@@ -121,4 +121,6 @@ endif

 bootloader-clean: $(SDKCONFIG_MAKEFILE)
 	$(BOOTLOADER_MAKE) app-clean
+ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 	rm -f $(SECURE_BOOTLOADER_KEY) $(BOOTLOADER_DIGEST_BIN)
+endif
@@ -48,6 +48,7 @@
 #include "bootloader_flash.h"
 #include "bootloader_random.h"
 #include "bootloader_config.h"
+#include "bootloader_clock.h"

 #include "flash_qio_mode.h"

@@ -75,7 +76,6 @@ static void set_cache_and_start_app(uint32_t drom_addr,
 static void update_flash_config(const esp_image_header_t* pfhdr);
 static void vddsdio_configure();
 static void flash_gpio_configure();
-static void clock_configure(void);
 static void uart_console_configure(void);
 static void wdt_reset_check(void);

@@ -447,7 +447,7 @@ void bootloader_main()
 {
    vddsdio_configure();
    flash_gpio_configure();
-    clock_configure();
+    bootloader_clock_configure();
    uart_console_configure();
    wdt_reset_check();
    ESP_LOGI(TAG, "ESP-IDF %s 2nd stage bootloader", IDF_VER);
@@ -743,7 +743,7 @@ static void print_flash_info(const esp_image_header_t* phdr)

 static void vddsdio_configure()
 {
-#if CONFIG_BOOTLOADER_VDDSDIO_BOOST
+#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
    rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
    if (cfg.enable == 1 && cfg.tieh == 0) {    // VDDSDIO regulator is enabled @ 1.8V
        cfg.drefh = 3;
@@ -796,24 +796,20 @@ static void IRAM_ATTR flash_gpio_configure()

    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
        // For ESP32D2WD the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32D2WD");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
        // For ESP32PICOD2 the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32PICOD2");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
        // For ESP32PICOD4 the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32PICOD4");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
    } else {
-        ESP_LOGI(TAG, "Detected ESP32");
        const uint32_t spiconfig = ets_efuse_get_spiconfig();
        if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
            gpio_matrix_out(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
@@ -839,46 +835,6 @@ static void IRAM_ATTR flash_gpio_configure()
    }
 }

-static void clock_configure(void)
-{
-    // ROM bootloader may have put a lot of text into UART0 FIFO.
-    // Wait for it to be printed.
-    // This is not needed on power on reset, when ROM bootloader is running at
-    // 40 MHz. But in case of TG WDT reset, CPU may still be running at >80 MHZ,
-    // and will be done with the bootloader much earlier than UART FIFO is empty.
-    uart_tx_wait_idle(0);
-
-    /* Set CPU to 80MHz. Keep other clocks unmodified. */
-    rtc_cpu_freq_t cpu_freq = RTC_CPU_FREQ_80M;
-
-    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
-     * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
-     * document). For rev. 0, switch to 240 instead if it was chosen in
-     * menuconfig.
-     */
-    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
-    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
-            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
-        cpu_freq = RTC_CPU_FREQ_240M;
-    }
-
-    rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
-    clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
-    clk_cfg.cpu_freq = cpu_freq;
-    clk_cfg.slow_freq = rtc_clk_slow_freq_get();
-    clk_cfg.fast_freq = rtc_clk_fast_freq_get();
-    rtc_clk_init(clk_cfg);
-    /* As a slight optimization, if 32k XTAL was enabled in sdkconfig, we enable
-     * it here. Usually it needs some time to start up, so we amortize at least
-     * part of the start up time by enabling 32k XTAL early.
-     * App startup code will wait until the oscillator has started up.
-     */
-#ifdef CONFIG_ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
-    if (!rtc_clk_32k_enabled()) {
-        rtc_clk_32k_bootstrap();
-    }
-#endif
-}

 static void uart_console_configure(void)
 {
@@ -0,0 +1,21 @@
+// Copyright 2017 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+/** @brief Configure clocks for early boot
+ *
+ * Called by bootloader, or by the app if the bootloader version is old (pre v2.1).
+ */
+void bootloader_clock_configure(void);
@@ -0,0 +1,61 @@
+// Copyright 2017 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "rom/uart.h"
+#include "rom/rtc.h"
+#include "soc/soc.h"
+#include "soc/rtc.h"
+#include "soc/dport_reg.h"
+#include "soc/efuse_reg.h"
+#include "soc/rtc_cntl_reg.h"
+
+void bootloader_clock_configure()
+{
+    // ROM bootloader may have put a lot of text into UART0 FIFO.
+    // Wait for it to be printed.
+    // This is not needed on power on reset, when ROM bootloader is running at
+    // 40 MHz. But in case of TG WDT reset, CPU may still be running at >80 MHZ,
+    // and will be done with the bootloader much earlier than UART FIFO is empty.
+    uart_tx_wait_idle(0);
+
+    /* Set CPU to 80MHz. Keep other clocks unmodified. */
+    rtc_cpu_freq_t cpu_freq = RTC_CPU_FREQ_80M;
+
+    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
+     * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
+     * document). For rev. 0, switch to 240 instead if it was chosen in
+     * menuconfig.
+     */
+    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
+    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
+            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
+        cpu_freq = RTC_CPU_FREQ_240M;
+    }
+
+    rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
+    clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
+    clk_cfg.cpu_freq = cpu_freq;
+    clk_cfg.slow_freq = rtc_clk_slow_freq_get();
+    clk_cfg.fast_freq = rtc_clk_fast_freq_get();
+    rtc_clk_init(clk_cfg);
+    /* As a slight optimization, if 32k XTAL was enabled in sdkconfig, we enable
+     * it here. Usually it needs some time to start up, so we amortize at least
+     * part of the start up time by enabling 32k XTAL early.
+     * App startup code will wait until the oscillator has started up.
+     */
+#ifdef CONFIG_ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
+    if (!rtc_clk_32k_enabled()) {
+        rtc_clk_32k_bootstrap();
+    }
+#endif
+}
@@ -23,7 +23,7 @@
 */
 static const char *TAG = "bootloader_mmap";

-static spi_flash_mmap_memory_t map;
+static spi_flash_mmap_handle_t map;

 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
@@ -36,7 +36,8 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
    size += (src_addr - src_page);
    esp_err_t err = spi_flash_mmap(src_page, size, SPI_FLASH_MMAP_DATA, &result, &map);
    if (err != ESP_OK) {
-        result = NULL;
+        ESP_LOGE(TAG, "spi_flash_mmap failed: 0x%x", err);
+        return NULL;
    }
    return (void *)((intptr_t)result + (src_addr - src_page));
 }
@@ -25,8 +25,6 @@
 #include "esp_system.h"
 #endif

-const char *TAG = "boot_rng";
-
 void bootloader_fill_random(void *buffer, size_t length)
 {
    uint8_t *buffer_bytes = (uint8_t *)buffer;
@@ -19,6 +19,7 @@
 #include <esp_image_format.h>
 #include <esp_secure_boot.h>
 #include <esp_log.h>
+#include <esp_spi_flash.h>
 #include <bootloader_flash.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
@@ -33,6 +34,9 @@ static const char *TAG = "esp_image";
 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
 #define STACK_LOAD_HEADROOM 32768

+/* Mmap source address mask */
+#define MMAP_ALIGNED_MASK 0x0000FFFF
+
 #ifdef BOOTLOADER_BUILD
 /* 64 bits of random data to obfuscate loaded RAM with, until verification is complete
   (Means loaded code isn't executable until after the secure boot check.)
@@ -48,6 +52,9 @@ static bool should_map(uint32_t load_addr);
 /* Load or verify a segment */
 static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);

+/* split segment and verify if data_len is too long */
+static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+
 /* Verify the main image header */
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);

@@ -291,7 +298,36 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
            }
        }
    }
+#ifndef BOOTLOADER_BUILD
+    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
+    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
+    uint32_t offset_page = 0;
+    while (data_len >= free_page_count * SPI_FLASH_MMU_PAGE_SIZE) {
+        offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0)?1:0;
+        err = process_segment_data(load_addr, data_addr, (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE, do_load, sha_handle, checksum);
+        if (err != ESP_OK) {
+            return err;
+        }
+        data_addr += (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
+        data_len -= (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
+    }
+#endif
+    err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
+    if (err != ESP_OK) {
+        return err;
+    }
+    return ESP_OK;

+err:
+    if (err == ESP_OK) {
+        err = ESP_ERR_IMAGE_INVALID;
+    }
+
+    return err;
+}
+
+static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+{
    const uint32_t *data = (const uint32_t *)bootloader_mmap(data_addr, data_len);
    if(!data) {
        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed",
@@ -332,12 +368,6 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
    bootloader_munmap(data);

    return ESP_OK;
-
- err:
-    if (err == ESP_OK) {
-        err = ESP_ERR_IMAGE_INVALID;
-    }
-    return err;
 }

 static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
@@ -113,6 +113,13 @@ config CLASSIC_BT_ENABLED
    help
        For now this option needs "SMP_ENABLE" to be set to yes

+config A2DP_SINK_TASK_STACK_SIZE
+    int "A2DP sink (audio stream decoding) task stack size"
+    depends on CLASSIC_BT_ENABLED
+    default 2048
+    help
+        This affects the stack size of A2DP sink task which invokes the data callback function.
+
 config GATTS_ENABLE
    bool "Include GATT server module(GATTS)"
    depends on BLUEDROID_ENABLED
@@ -16,7 +16,7 @@
 #include "esp_bt_main.h"
 #include "btc_task.h"
 #include "btc_main.h"
-#include "bt.h"
+#include "esp_bt.h"
 #include "future.h"
 #include "allocator.h"

@@ -240,7 +240,8 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
    if (ESP_BLE_IS_VALID_PARAM(min_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
        ESP_BLE_IS_VALID_PARAM(max_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
        ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF)) {
+        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+        ((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) {

        msg.sig = BTC_SIG_API_CALL;
        msg.pid = BTC_PID_GAP_BLE;
@@ -67,7 +67,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, bool is_direct)
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
    btc_msg_t msg;
    btc_ble_gattc_args_t arg;
@@ -79,6 +79,7 @@ esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, b
    msg.act = BTC_GATTC_ACT_OPEN;
    arg.open.gattc_if = gattc_if;
    memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    arg.open.remote_addr_type = remote_addr_type;
    arg.open.is_direct = is_direct;

    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -138,9 +138,10 @@ esp_err_t esp_a2d_register_callback(esp_a2d_cb_t callback);

 /**
 * @brief           Register A2DP sink data output function; For now the output is PCM data stream decoded
- *                  from SBC format. This function should be called only after esp_bluedroid_enable() 
- *                  completes successfully
- *                  
+ *                  from SBC format. This function should be called only after esp_bluedroid_enable()
+ *                  completes successfully, used only by A2DP sink. The callback is invoked in the context
+ *                  of A2DP sink task whose stack size is configurable through menuconfig
+ *
 * @param[in]       callback: A2DP data callback function
 *
 * @return
@@ -58,10 +58,10 @@ typedef enum {
    ESP_AVRC_CT_METADATA_RSP_EVT = 2,            /*!< metadata response event */
    ESP_AVRC_CT_PLAY_STATUS_RSP_EVT = 3,         /*!< play status response event */
    ESP_AVRC_CT_CHANGE_NOTIFY_EVT = 4,           /*!< notification event */
-    ESP_AVRC_CT_MAX_EVT
+    ESP_AVRC_CT_REMOTE_FEATURES_EVT = 5,         /*!< feature of remote device indication event */
 } esp_avrc_ct_cb_event_t;

-//AVRC metadata attribute mask
+/// AVRC metadata attribute mask
 typedef enum {
    ESP_AVRC_MD_ATTR_TITLE = 0x1,                 /*!< title of the playing track */
    ESP_AVRC_MD_ATTR_ARTIST = 0x2,                /*!< track artist */
@@ -72,7 +72,7 @@ typedef enum {
    ESP_AVRC_MD_ATTR_PLAYING_TIME = 0x40          /*!< total album playing time in miliseconds */
 } esp_avrc_md_attr_mask_t;

-//AVRC event notification ids
+/// AVRC event notification ids
 typedef enum {
    ESP_AVRC_RN_PLAY_STATUS_CHANGE = 0x01,        /*!< track status change, eg. from playing to paused */
    ESP_AVRC_RN_TRACK_CHANGE = 0x02,              /*!< new track is loaded */
@@ -85,7 +85,7 @@ typedef enum {
    ESP_AVRC_RN_MAX_EVT
 } esp_avrc_rn_event_ids_t;

-//AVRC player setting ids
+/// AVRC player setting ids
 typedef enum {
    ESP_AVRC_PS_EQUALIZER = 0x01,                 /*!< equalizer, on or off */
    ESP_AVRC_PS_REPEAT_MODE = 0x02,               /*!< repeat mode */
@@ -94,32 +94,32 @@ typedef enum {
    ESP_AVRC_PS_MAX_ATTR
 } esp_avrc_ps_attr_ids_t;

-//AVRC equalizer modes
+/// AVRC equalizer modes
 typedef enum {
-    ESP_AVRC_PS_EQUALIZER_OFF = 0x1,
-    ESP_AVRC_PS_EQUALIZER_ON = 0x2
+    ESP_AVRC_PS_EQUALIZER_OFF = 0x1,              /*!< equalizer OFF */
+    ESP_AVRC_PS_EQUALIZER_ON = 0x2                /*!< equalizer ON */
 } esp_avrc_ps_eq_value_ids_t;

-//AVRC repeat modes
+/// AVRC repeat modes
 typedef enum {
-    ESP_AVRC_PS_REPEAT_OFF = 0x1,
-    ESP_AVRC_PS_REPEAT_SINGLE = 0x2,
-    ESP_AVRC_PS_REPEAT_GROUP = 0x3
+    ESP_AVRC_PS_REPEAT_OFF = 0x1,                 /*!< repeat mode off */
+    ESP_AVRC_PS_REPEAT_SINGLE = 0x2,              /*!< single track repeat */
+    ESP_AVRC_PS_REPEAT_GROUP = 0x3                /*!< group repeat */
 } esp_avrc_ps_rpt_value_ids_t;


-//AVRC shuffle modes
+/// AVRC shuffle modes
 typedef enum {
-    ESP_AVRC_PS_SHUFFLE_OFF = 0x1,
-    ESP_AVRC_PS_SHUFFLE_ALL = 0x2,
-    ESP_AVRC_PS_SHUFFLE_GROUP = 0x3
+    ESP_AVRC_PS_SHUFFLE_OFF = 0x1,                /*<! shuffle off */
+    ESP_AVRC_PS_SHUFFLE_ALL = 0x2,                /*<! all trackes shuffle */
+    ESP_AVRC_PS_SHUFFLE_GROUP = 0x3               /*<! group shuffle */
 } esp_avrc_ps_shf_value_ids_t;

-//AVRC scan modes
+/// AVRC scan modes
 typedef enum {
-    ESP_AVRC_PS_SCAN_OFF = 0x1,
-    ESP_AVRC_PS_SCAN_ALL = 0x2,
-    ESP_AVRC_PS_SCAN_GROUP = 0x3
+    ESP_AVRC_PS_SCAN_OFF = 0x1,                   /*!< scan off */
+    ESP_AVRC_PS_SCAN_ALL = 0x2,                   /*!< all tracks scan */
+    ESP_AVRC_PS_SCAN_GROUP = 0x3                  /*!< group scan */
 } esp_avrc_ps_scn_value_ids_t;

 /// AVRC controller callback parameters
@@ -129,7 +129,6 @@ typedef union {
     */
    struct avrc_ct_conn_stat_param {
        bool connected;                          /*!< whether AVRC connection is set up */
-        uint32_t feat_mask;                      /*!< AVRC feature mask of remote device */
        esp_bd_addr_t remote_bda;                /*!< remote bluetooth device address */
    } conn_stat;                                 /*!< AVRC connection status */

@@ -159,6 +158,14 @@ typedef union {
        uint32_t event_parameter;                /*!< event notification parameter */
    } change_ntf;                                /*!< notifications */

+    /**
+     * @brief ESP_AVRC_CT_REMOTE_FEATURES_EVT
+     */
+    struct avrc_ct_rmt_feats_param {
+        uint32_t feat_mask;                      /*!< AVRC feature mask of remote device */
+        esp_bd_addr_t remote_bda;                /*!< remote bluetooth device address */
+    } rmt_feats;                                 /*!< AVRC features discovered from remote SDP server */
+    
 } esp_avrc_ct_cb_param_t;


@@ -212,7 +219,19 @@ esp_err_t esp_avrc_ct_init(void);
 */
 esp_err_t esp_avrc_ct_deinit(void);

-/* add description */
+/**
+ *
+ * @brief           Send player application settings command to AVRCP target. This function should be called
+ *                  after ESP_AVRC_CT_CONNECTION_STATE_EVT is received and AVRCP connection is established.
+ *
+ * @param[in]       tl : transaction label, 0 to 15, consecutive commands should use different values.
+ * @param[in]       attr_id : player application setting attribute IDs from one of esp_avrc_ps_attr_ids_t
+ * @param[in]       value_id : attribute value defined for the specific player application setting attribute
+ * @return
+ *                  - ESP_OK: success
+ *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
+ *                  - ESP_FAIL: others
+ */
 esp_err_t esp_avrc_ct_send_set_player_value_cmd(uint8_t tl, uint8_t attr_id, uint8_t value_id);

 /**
@@ -51,6 +51,7 @@ typedef enum {
    ESP_BT_STATUS_PEER_LE_DATA_LEN_UNSUPPORTED, /* relate to BTM_PEER_LE_DATA_LEN_UNSUPPORTED in btm_api.h */
    ESP_BT_STATUS_CONTROL_LE_DATA_LEN_UNSUPPORTED,/* relate to BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED in btm_api.h */
    ESP_BT_STATUS_ERR_ILLEGAL_PARAMETER_FMT,    /* relate to HCI_ERR_ILLEGAL_PARAMETER_FMT in hcidefs.h */
+    ESP_BT_STATUS_MEMORY_FULL,                  /* relate to BT_STATUS_MEMORY_FULL in bt_def.h */
 } esp_bt_status_t;


@@ -97,9 +97,11 @@ typedef enum {
    ESP_GAP_BLE_CLEAR_BOND_DEV_COMPLETE_EVT,                /*!< When clear the bond device clear complete, the event comes */
    ESP_GAP_BLE_GET_BOND_DEV_COMPLETE_EVT,                  /*!< When get the bond device list complete, the event comes */
    ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT,                     /*!< When read the rssi complete, the event comes */
-    ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT,                 /*!< When add or remove whitelist complete, the event comes */
+    ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT,              /*!< When add or remove whitelist complete, the event comes */
    ESP_GAP_BLE_EVT_MAX,
 } esp_gap_ble_cb_event_t;
+/// This is the old name, just for backwards compatibility
+#define ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT

 /// Advertising data maximum length
 #define ESP_BLE_ADV_DATA_LEN_MAX               31
@@ -239,7 +241,7 @@ typedef struct {
    uint8_t                 flag;                   /*!< Advertising flag of discovery mode, see BLE_ADV_DATA_FLAG detail */
 } esp_ble_adv_data_t;

-/// Ble scan type 
+/// Ble scan type
 typedef enum {
    BLE_SCAN_TYPE_PASSIVE   =   0x0,            /*!< Passive scan */
    BLE_SCAN_TYPE_ACTIVE    =   0x1,            /*!< Active scan */
@@ -249,7 +251,7 @@ typedef enum {
 typedef enum {
    BLE_SCAN_FILTER_ALLOW_ALL           = 0x0,  /*!< Accept all :
                                                  1. advertisement packets except directed advertising packets not addressed to this device (default). */
-    BLE_SCAN_FILTER_ALLOW_ONLY_WLST     = 0x1,  /*!< Accept only : 
+    BLE_SCAN_FILTER_ALLOW_ONLY_WLST     = 0x1,  /*!< Accept only :
                                                  1. advertisement packets from devices where the advertiser’s address is in the White list.
                                                  2. Directed advertising packets which are not addressed for this device shall be ignored. */
    BLE_SCAN_FILTER_ALLOW_UND_RPA_DIR   = 0x2,  /*!< Accept all :
@@ -312,7 +314,7 @@ typedef struct
 } esp_ble_penc_keys_t;                 /*!< The key type*/

 /**
-* @brief  BLE CSRK keys 
+* @brief  BLE CSRK keys
 */
 typedef struct
 {
@@ -322,7 +324,7 @@ typedef struct
 } esp_ble_pcsrk_keys_t;               /*!< The pcsrk key type */

 /**
-* @brief  BLE pid keys 
+* @brief  BLE pid keys
 */
 typedef struct
 {
@@ -354,7 +356,7 @@ typedef struct
 } esp_ble_lcsrk_keys;                       /*!< The csrk key type */

 /**
-* @brief  Structure associated with ESP_KEY_NOTIF_EVT 
+* @brief  Structure associated with ESP_KEY_NOTIF_EVT
 */
 typedef struct
 {
@@ -476,7 +478,7 @@ typedef enum {
 typedef enum{
    ESP_BLE_WHITELIST_REMOVE     = 0X00,    /*!< remove mac from whitelist */
    ESP_BLE_WHITELIST_ADD        = 0X01,    /*!< add address to whitelist */
-}esp_ble_wl_opration;
+}esp_ble_wl_opration_t;
 /**
 * @brief Gap callback parameters union
 */
@@ -486,7 +488,7 @@ typedef union {
     */
    struct ble_adv_data_cmpl_evt_param {
        esp_bt_status_t status;                     /*!< Indicate the set advertising data operation success status */
-    } adv_data_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT */ 
+    } adv_data_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT */
    /**
     * @brief ESP_GAP_BLE_SCAN_RSP_DATA_SET_COMPLETE_EVT
     */
@@ -520,7 +522,7 @@ typedef union {
     */
    struct ble_adv_data_raw_cmpl_evt_param {
        esp_bt_status_t status;                     /*!< Indicate the set raw advertising data operation success status */
-    } adv_data_raw_cmpl;                            /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT */ 
+    } adv_data_raw_cmpl;                            /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT */
    /**
     * @brief ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT
     */
@@ -616,12 +618,12 @@ typedef union {
        esp_bd_addr_t remote_addr;                  /*!< The remote device address */
    } read_rssi_cmpl;                               /*!< Event parameter of ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT */
    /**
-     * @brief ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT
+     * @brief ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT
     */
-    struct ble_add_whitelist_cmpl_evt_param {
+    struct ble_update_whitelist_cmpl_evt_param {
        esp_bt_status_t status;                     /*!< Indicate the add or remove whitelist operation success status */
-        esp_ble_wl_opration wl_opration;            /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
-    } add_whitelist_cmpl;                           /*!< Event parameter of ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT */
+        esp_ble_wl_opration_t wl_opration;          /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
+    } update_whitelist_cmpl;                        /*!< Event parameter of ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT */
 } esp_ble_gap_cb_param_t;

 /**
@@ -983,7 +985,7 @@ int esp_ble_get_bond_device_num(void);
 *                           Suggest that dev_num value equal to esp_ble_get_bond_device_num().
 *
 * @param[out]      dev_list: an array(buffer) of `esp_ble_bond_dev_t` type. Use for storing the bonded devices address.
-*                            The dev_list should be allocated by who call this API. 
+*                            The dev_list should be allocated by who call this API.
 * @return          - ESP_OK : success
 *                  - other  : failed
 *
@@ -283,6 +283,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if);
 *
 * @param[in]       gattc_if: Gatt client access interface.
 * @param[in]       remote_bda: remote device bluetooth device address.
+ * @param[in]       remote_addr_type: remote device bluetooth device the address type.
 * @param[in]       is_direct: direct connection or background auto connection
 *
 * @return
@@ -290,7 +291,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if);
 *                  - other: failed
 *
 */
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, bool is_direct);
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct);


 /**
@@ -162,7 +162,7 @@ typedef union {
        esp_gatt_status_t status;       /*!< Operation status */
        uint16_t attr_handle;           /*!< Descriptor attribute handle */
        uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t char_uuid;        /*!< Characteristic uuid */
+        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor uuid */
    } add_char_descr;                   /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_DESCR_EVT */

    /**
@@ -514,6 +514,9 @@ static void bta_av_proc_stream_evt(UINT8 handle, BD_ADDR bd_addr, UINT8 event, t
            p_msg->disc_rsn = p_data->hdr.err_param;
            break;
            */
+            case AVDT_DISCONNECT_IND_EVT:
+                p_msg->hdr.offset = p_data->hdr.err_param;
+                break;
            default:
                break;
            }
@@ -529,6 +529,7 @@ void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)

    bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
    rc_open.peer_features = p_cb->rcb[i].peer_features;
+    rc_open.sdp_disc_done = TRUE;
    rc_open.status = BTA_AV_SUCCESS;
    APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
                     rc_open.peer_features);
@@ -536,6 +537,7 @@ void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
        /* we have not done SDP on peer RC capabilities.
         * peer must have initiated the RC connection */
        rc_open.peer_features = BTA_AV_FEAT_RCCT;
+        rc_open.sdp_disc_done = FALSE;
        bta_av_rc_disc(disc);
    }
    (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
@@ -1266,6 +1268,11 @@ void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
        hdr.layer_specific = xx + 1;
        bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
    }
+
+    bta_sys_free_timer(&p_cb->sig_tmr);
+    memset(&p_cb->sig_tmr, 0, sizeof(TIMER_LIST_ENT));
+    bta_sys_free_timer(&p_cb->acp_sig_tmr);
+    memset(&p_cb->acp_sig_tmr, 0, sizeof(TIMER_LIST_ENT));
 }

 /*******************************************************************************
@@ -1610,6 +1617,7 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
                p_scb->use_rc = FALSE;
                bdcpy(rc_open.peer_addr, p_scb->peer_addr);
                rc_open.peer_features = 0;
+                rc_open.sdp_disc_done = FALSE;
                rc_open.status = BTA_AV_FAIL_SDP;
                (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
            }
@@ -1839,6 +1847,8 @@ void bta_av_dereg_comp(tBTA_AV_DATA *p_data)

        /* make sure that the timer is not active */
        bta_sys_stop_timer(&p_scb->timer);
+        list_free(p_scb->a2d_list);
+        p_scb->a2d_list = NULL;
        utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
    }

@@ -1237,9 +1237,10 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
        bta_av_sm_execute(&bta_av_cb, p_msg->event, (tBTA_AV_DATA *) p_msg);
    } else {
        APPL_TRACE_VERBOSE("handle=0x%x\n", p_msg->layer_specific);
+        tBTA_AV_SCB *p_scb = bta_av_hndl_to_scb(p_msg->layer_specific);
+        p_scb->disc_rsn = p_msg->offset;
        /* stream state machine events */
-        bta_av_ssm_execute( bta_av_hndl_to_scb(p_msg->layer_specific),
-                            p_msg->event, (tBTA_AV_DATA *) p_msg);
+        bta_av_ssm_execute(p_scb, p_msg->event, (tBTA_AV_DATA *) p_msg);
    }
    return TRUE;
 }
@@ -282,6 +282,47 @@ void bta_dm_enable(tBTA_DM_MSG *p_data)
    }
 }

+/*******************************************************************************
+ *
+ * Function         bta_dm_init_cb
+ *
+ * Description      Initializes the bta_dm_cb control block
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_init_cb(void)
+{
+    memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+}
+
+/*******************************************************************************
+ *
+ * Function         bta_dm_deinit_cb
+ *
+ * Description      De-initializes the bta_dm_cb control block
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_deinit_cb(void)
+{
+    bta_sys_free_timer(&bta_dm_cb.disable_timer);
+#if ( BTA_EIR_CANNED_UUID_LIST != TRUE )
+    bta_sys_free_timer(&bta_dm_cb.app_ready_timer);
+#endif
+#if BTM_SSR_INCLUDED == TRUE
+    for (size_t i = 0; i < BTA_DM_NUM_PM_TIMER; i++) {
+        for (size_t j = 0; j < BTA_DM_PM_MODE_TIMER_MAX; j++) {
+            bta_sys_free_timer(&bta_dm_cb.pm_timer[i].timer[j]);
+        }
+    }
+#endif
+    memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_sys_hw_cback
@@ -318,7 +359,15 @@ static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
        }

        /* reinitialize the control block */
-        memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+        bta_dm_deinit_cb();
+
+        bta_sys_free_timer(&bta_dm_search_cb.search_timer);
+#if ((defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
+#if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE)
+        bta_sys_free_timer(&bta_dm_search_cb.gatt_close_timer);
+#endif
+#endif
+        memset(&bta_dm_search_cb, 0x00, sizeof(bta_dm_search_cb));

        /* unregister from SYS */
        bta_sys_hw_unregister( BTA_SYS_HW_BLUETOOTH );
@@ -332,11 +381,18 @@ static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
        /* save security callback */
        temp_cback = bta_dm_cb.p_sec_cback;
        /* make sure the control block is properly initialized */
-        memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+        bta_dm_init_cb();
+
        /* and retrieve the callback */
        bta_dm_cb.p_sec_cback = temp_cback;
        bta_dm_cb.is_bta_dm_active = TRUE;

+        bta_sys_free_timer(&bta_dm_search_cb.search_timer);
+#if ((defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
+#if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE)
+        bta_sys_free_timer(&bta_dm_search_cb.gatt_close_timer);
+#endif
+#endif
        /* hw is ready, go on with BTA DM initialization */
        memset(&bta_dm_search_cb, 0x00, sizeof(bta_dm_search_cb));
 #if (BTM_SSR_INCLUDED == TRUE)
@@ -2595,7 +2651,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
        return BTM_NOT_AUTHORIZED;
    }
 }
- 
+



@@ -3284,7 +3340,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
        }

        bdcpy(conn.link_down.bd_addr, p_bda);
-        conn.link_down.status = (UINT8) btm_get_acl_disc_reason_code();
+        conn.link_down.reason = (UINT8) btm_get_acl_disc_reason_code();
        if ( bta_dm_cb.p_sec_cback ) {
            bta_dm_cb.p_sec_cback(BTA_DM_LINK_DOWN_EVT, &conn);
            if ( issue_unpair_cb ) {
@@ -4132,6 +4188,8 @@ static void bta_dm_observe_results_cb (tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir)
    result.inq_res.flag             = p_inq->flag;
    result.inq_res.adv_data_len     = p_inq->adv_data_len;
    result.inq_res.scan_rsp_len     = p_inq->scan_rsp_len;
+    memcpy(result.inq_res.dev_class, p_inq->dev_class, sizeof(DEV_CLASS));
+    result.inq_res.ble_evt_type     = p_inq->ble_evt_type;

    /* application will parse EIR to find out remote device name */
    result.inq_res.p_eir = p_eir;
@@ -4288,7 +4346,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
        } else {
            sec_event.auth_cmpl.success = TRUE;
            if (!p_data->complt.smp_over_br) {
-                
+
            }
        }

@@ -4573,14 +4631,18 @@ void bta_dm_ble_disconnect (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data)
 {
-    BOOLEAN set_flag = false;
+    tBTM_STATUS status = BTM_SET_STATIC_RAND_ADDR_FAIL;
    if (p_data->set_addr.addr_type != BLE_ADDR_RANDOM) {
        APPL_TRACE_ERROR("Invalid random adress type = %d\n", p_data->set_addr.addr_type);
+        if(p_data->set_addr.p_set_rand_addr_cback) {
+            (*p_data->set_addr.p_set_rand_addr_cback)(status);
+        }
        return;
    }
    //send the setting random address to BTM layer
-    if ((set_flag = BTM_BleSetRandAddress(p_data->set_addr.address) != TRUE)){
-        APPL_TRACE_ERROR("%s,set random address fail.", __func__);
+    status = BTM_BleSetRandAddress(p_data->set_addr.address);
+    if(p_data->set_addr.p_set_rand_addr_cback) {
+        (*p_data->set_addr.p_set_rand_addr_cback)(status);
    }

 }
@@ -4731,20 +4793,17 @@ void bta_dm_ble_set_adv_params (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_adv_params_all  (tBTA_DM_MSG *p_data)
 {
-    tBTA_STATUS status = BTA_FAILURE;
-
    if (BTM_BleSetAdvParamsStartAdv(p_data->ble_set_adv_params_all.adv_int_min,
                                p_data->ble_set_adv_params_all.adv_int_max,
                                p_data->ble_set_adv_params_all.adv_type,
                                p_data->ble_set_adv_params_all.addr_type_own,
                                p_data->ble_set_adv_params_all.p_dir_bda,
                                p_data->ble_set_adv_params_all.channel_map,
-                                p_data->ble_set_adv_params_all.adv_filter_policy) == BTM_SUCCESS) {
-        status = BTA_SUCCESS;
-    }
-
-    if (p_data->ble_set_adv_params_all.p_start_adv_cback) {
-        (*p_data->ble_set_adv_params_all.p_start_adv_cback)(status);
+                                p_data->ble_set_adv_params_all.adv_filter_policy,
+                                p_data->ble_set_adv_params_all.p_start_adv_cback) == BTM_SUCCESS) {
+        APPL_TRACE_DEBUG("%s(), success to start ble adv.", __func__);
+    } else {
+        APPL_TRACE_ERROR("%s(), fail to start ble adv.", __func__);
    }
 }

@@ -4853,25 +4912,26 @@ void bta_dm_ble_set_scan_rsp_raw (tBTA_DM_MSG *p_data)
 void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data)
 {
    tACL_CONN *p_acl_cb = btm_bda_to_acl(p_data->ble_set_data_length.remote_bda, BT_TRANSPORT_LE);
-     if (p_acl_cb == NULL) {
-         APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__);
-         return;
-     } else {
-         p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback;
-     }
-     UINT8 status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda,
-                                         p_data->ble_set_data_length.tx_data_length);
-     if (status != BTM_SUCCESS) {
-        APPL_TRACE_ERROR("%s failed\n", __FUNCTION__);
-        if (p_data->ble_set_data_length.p_set_pkt_data_cback) {
-            if (p_acl_cb->data_length_params.tx_len == 0){
-                uint16_t length = controller_get_interface()->get_acl_data_size_ble();
-                p_acl_cb->data_length_params.rx_len = length;
-                p_acl_cb->data_length_params.tx_len = length;
-            }
-            (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params);
-        }
+    if (p_acl_cb == NULL) {
+        APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__);
+        return;
+    } else {
+        p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback;
    }
+    UINT8 status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda,
+                                        p_data->ble_set_data_length.tx_data_length);
+    if (status != BTM_SUCCESS) {
+        APPL_TRACE_ERROR("%s failed\n", __FUNCTION__);
+    }
+    if (p_data->ble_set_data_length.p_set_pkt_data_cback) {
+        if (p_acl_cb->data_length_params.tx_len == 0){
+            uint16_t length = controller_get_interface()->get_acl_data_size_ble();
+            p_acl_cb->data_length_params.rx_len = length;
+            p_acl_cb->data_length_params.tx_len = length;
+        }
+        (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params);
+    }
+
 }

 /*******************************************************************************
@@ -4888,15 +4948,13 @@ void bta_dm_ble_broadcast (tBTA_DM_MSG *p_data)
    tBTM_STATUS status = 0;
    BOOLEAN start = p_data->ble_observe.start;

-    status = BTM_BleBroadcast(start);
+    status = BTM_BleBroadcast(start, p_data->ble_observe.p_stop_adv_cback);

    if (p_data->ble_observe.p_stop_adv_cback){
        if (status != BTM_SUCCESS){
            APPL_TRACE_WARNING("%s, %s, status=0x%x\n", __func__,\
                    (start == TRUE) ? "start adv failed" : "stop adv failed", status);
        }
-        status = (status == BTM_SUCCESS ? BTA_SUCCESS : BTA_FAILURE);
-        p_data->ble_observe.p_stop_adv_cback(status);
    }

 }
@@ -5349,7 +5407,7 @@ static void bta_ble_energy_info_cmpl(tBTM_BLE_TX_TIME_MS tx_time,
    if (BTA_SUCCESS == st) {
        ctrl_state = bta_dm_pm_obtain_controller_state();
    }
-#endif  
+#endif
    if (bta_dm_cb.p_energy_info_cback) {
        bta_dm_cb.p_energy_info_cback(tx_time, rx_time, idle_time, energy_used, ctrl_state, st);
    }
@@ -5583,7 +5641,8 @@ void btm_dm_start_gatt_discovery (BD_ADDR bd_addr)
        bta_sys_stop_timer(&bta_dm_search_cb.gatt_close_timer);
        btm_dm_start_disc_gatt_services(bta_dm_search_cb.conn_id);
    } else {
-        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, TRUE, BTA_GATT_TRANSPORT_LE);
+        //TODO need to add addr_type in future
+        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE);
    }
 }
 #endif /* #if (GATTC_INCLUDED == TRUE) */
@@ -2284,12 +2284,12 @@ extern void BTA_DmBleStopAdvertising(void)
 ** Description      This function set the random address for the APP
 **
 ** Parameters       rand_addr: the random address whith should be setting
-**
+**                  p_set_rand_addr_cback: complete callback
 ** Returns          void
 **
 **
 *******************************************************************************/
-extern void BTA_DmSetRandAddress(BD_ADDR rand_addr)
+extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback)
 {
    tBTA_DM_APT_SET_DEV_ADDR *p_msg;
    APPL_TRACE_API("set the random address ");
@@ -2298,6 +2298,7 @@ extern void BTA_DmSetRandAddress(BD_ADDR rand_addr)
        memcpy(p_msg->address, rand_addr, BD_ADDR_LEN);
        p_msg->hdr.event = BTA_DM_API_SET_RAND_ADDR_EVT;
        p_msg->addr_type = BLE_ADDR_RANDOM;
+        p_msg->p_set_rand_addr_cback = p_set_rand_addr_cback;
        //start sent the msg to the bta system control moudle
        bta_sys_sendmsg(p_msg);
    }
@@ -532,6 +532,7 @@ typedef struct {
    BT_HDR      hdr;
    tBLE_ADDR_TYPE addr_type;
    BD_ADDR address;
+    tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback;
 } tBTA_DM_APT_SET_DEV_ADDR;

 /* set adv parameter for BLE advertising */
@@ -48,8 +48,6 @@

 #if GATTC_INCLUDED == TRUE && BLE_INCLUDED == TRUE

-static osi_mutex_t write_ccc_mutex;
-
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -129,9 +127,9 @@ static void bta_gattc_enable(tBTA_GATTC_CB *p_cb)
        memset(&bta_gattc_cb, 0, sizeof(tBTA_GATTC_CB));
        p_cb->state = BTA_GATTC_STATE_ENABLED;
        // Create a write ccc mutex when the gatt client enable
-        osi_mutex_new(&write_ccc_mutex);
+        osi_mutex_new(&bta_gattc_cb.write_ccc_mutex);
    } else {
-        APPL_TRACE_DEBUG("GATTC is arelady enabled");
+        APPL_TRACE_DEBUG("GATTC is already enabled");
    }
 }

@@ -157,7 +155,7 @@ void bta_gattc_disable(tBTA_GATTC_CB *p_cb)
        return;
    }
    // Free the write ccc mutex when the gatt client disable
-    osi_mutex_free(&write_ccc_mutex);
+    osi_mutex_free(&bta_gattc_cb.write_ccc_mutex);

    for (i = 0; i < BTA_GATTC_CL_MAX; i ++) {
        if (p_cb->cl_rcb[i].in_use) {
@@ -495,9 +493,14 @@ void bta_gattc_open_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
    tBTA_GATTC_DATA gattc_data;
+    BOOLEAN found_app = FALSE;

+    tGATT_TCB *p_tcb = gatt_find_tcb_by_addr(p_data->api_conn.remote_bda, BT_TRANSPORT_LE);
+    if(p_tcb && p_clcb && p_data) {
+        found_app = gatt_find_specific_app_in_hold_link(p_tcb, p_clcb->p_rcb->client_if);
+    }
    /* open/hold a connection */
-    if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
+    if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda, p_data->api_conn.remote_addr_type,
                      TRUE, p_data->api_conn.transport)) {
        APPL_TRACE_ERROR("Connection open failure");

@@ -509,7 +512,7 @@ void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
                                      &p_clcb->bta_conn_id,
                                      p_data->api_conn.transport)) {
            gattc_data.int_conn.hdr.layer_specific = p_clcb->bta_conn_id;
-
+            gattc_data.int_conn.already_connect = found_app;
            bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, &gattc_data);
        }
        /* else wait for the callback event */
@@ -533,7 +536,7 @@ void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *p_clreg

    if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, TRUE, FALSE)) {
        /* always call open to hold a connection */
-        if (!GATT_Connect(p_data->client_if, p_data->remote_bda, FALSE, p_data->transport)) {
+        if (!GATT_Connect(p_data->client_if, p_data->remote_bda, p_data->remote_addr_type, FALSE, p_data->transport)) {
            uint8_t *bda = (uint8_t *)p_data->remote_bda;
            status = BTA_GATT_ERROR;
            APPL_TRACE_ERROR("%s unable to connect to remote bd_addr:%02x:%02x:%02x:%02x:%02x:%02x",
@@ -674,14 +677,14 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
            if (bta_gattc_cache_load(p_clcb)) {
                p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
                bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
-        } else { /* cache is building */
+            } else { /* cache is building */
                p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
                /* cache load failure, start discovery */
                bta_gattc_start_discover(p_clcb, NULL);
+            }
+        } else { /* cache is building */
+            p_clcb->state = BTA_GATTC_DISCOVER_ST;
        }
-    } else { /* cache is building */
-        p_clcb->state = BTA_GATTC_DISCOVER_ST;
-    }
    } else {
        /* a pending service handle change indication */
        if (p_clcb->p_srcb->srvc_hdl_chg) {
@@ -696,9 +699,14 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
        if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
            bta_sys_conn_open(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
        }
-
+        tBTA_GATT_STATUS status = BTA_GATT_OK;
+        if (p_data && p_data->int_conn.already_connect) {
+            //clear already_connect
+            p_data->int_conn.already_connect = FALSE;
+            status = BTA_GATT_ALREADY_OPEN;
+        }
        bta_gattc_send_open_cback(p_clcb->p_rcb,
-                                  BTA_GATT_OK,
+                                  status,
                                  p_clcb->bda,
                                  p_clcb->bta_conn_id,
                                  p_clcb->transport,
@@ -1644,8 +1652,8 @@ static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
    else if ((transport == BT_TRANSPORT_LE) && (connected == FALSE) && (p_conn != NULL)){
            p_conn->service_change_ccc_written = FALSE;
            if (p_conn->ccc_timer_used == TRUE){
-                assert(write_ccc_mutex != NULL);
-                osi_mutex_lock(&write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+                assert(bta_gattc_cb.write_ccc_mutex != NULL);
+                osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);

                if (p_conn->service_change_ccc_timer.param != 0) {
                    osi_free((void *)p_conn->service_change_ccc_timer.param);
@@ -1653,7 +1661,7 @@ static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
                }
                bta_sys_stop_timer(&(p_conn->service_change_ccc_timer));
                p_conn->ccc_timer_used = FALSE;
-                osi_mutex_unlock(&write_ccc_mutex);
+                osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
            }
    }

@@ -1829,7 +1837,10 @@ BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,
        }
        /* notify applicationf or service change */
        if (p_clrcb->p_cback != NULL) {
-            (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)p_srcb->server_bda);
+            tBTA_GATTC_SERVICE_CHANGE srvc_chg= {0};
+            memcpy(srvc_chg.remote_bda, p_srcb->server_bda, sizeof(BD_ADDR));
+            srvc_chg.conn_id = conn_id;
+            (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)&srvc_chg);
        }

    }
@@ -2172,8 +2183,8 @@ void bta_gattc_broadcast(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
    UNUSED(p_cb);

    cb_data.reg_oper.client_if = p_msg->api_listen.client_if;
-    cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start);
-
+    cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start, NULL);
+    //TODO need modify callback if used
    if (p_clreg && p_clreg->p_cback) {
        (*p_clreg->p_cback)(BTA_GATTC_LISTEN_EVT, &cb_data);
    }
@@ -2354,13 +2365,14 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
    BOOLEAN start_ccc_timer = FALSE;
    UINT32 new_timeout;

-    assert(write_ccc_mutex != NULL);
-    osi_mutex_lock(&write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+    assert(bta_gattc_cb.write_ccc_mutex != NULL);
+    osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);

    tBTA_GATTC_WAIT_CCC_TIMER *p_timer_param = (tBTA_GATTC_WAIT_CCC_TIMER*) p_tle->param;
    p_tle->param = (TIMER_PARAM_TYPE)0;
    if (p_timer_param == NULL){
        APPL_TRACE_ERROR("p_timer_param is NULL in %s\n", __func__);
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
        return;
    }

@@ -2368,6 +2380,7 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
    if (p_conn == NULL){
        APPL_TRACE_ERROR("p_conn is NULL in %s\n", __func__);
        osi_free(p_timer_param);
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
        return;
    }

@@ -2399,7 +2412,7 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
    }

    osi_free(p_timer_param);
-    osi_mutex_unlock(&write_ccc_mutex);
+    osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
 }

 #endif
@@ -135,13 +135,14 @@ void BTA_GATTC_AppDeregister(tBTA_GATTC_IF client_if)
 **
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
+**                  remote_addr_type: remote device BD address type.
 **                  is_direct: direct connection or background auto connection
 **                  transport: Transport to be used for GATT connection (BREDR/LE)
 **
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
+void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport)
 {
    tBTA_GATTC_API_OPEN  *p_buf;
@@ -152,6 +153,7 @@ void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
        p_buf->client_if = client_if;
        p_buf->is_direct = is_direct;
        p_buf->transport = transport;
+        p_buf->remote_addr_type = remote_addr_type;
        memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN);


@@ -829,7 +831,7 @@ tBTA_GATT_STATUS BTA_GATTC_RegisterForNotifications (tBTA_GATTC_IF client_if,
            if ( p_clreg->notif_reg[i].in_use &&
                    !memcmp(p_clreg->notif_reg[i].remote_bda, bda, BD_ADDR_LEN) &&
                  p_clreg->notif_reg[i].handle == handle) {
-                APPL_TRACE_WARNING("notification already registered");
+                APPL_TRACE_DEBUG("notification already registered");
                status = BTA_GATT_OK;
                break;
            }
@@ -182,7 +182,7 @@ static const UINT8 bta_gattc_st_connected[][BTA_GATTC_NUM_COLS] = {
    /* BTA_GATTC_API_READ_MULTI_EVT     */   {BTA_GATTC_READ_MULTI,         BTA_GATTC_CONN_ST},
    /* BTA_GATTC_API_REFRESH_EVT        */   {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},

-    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
+    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_CONN,               BTA_GATTC_CONN_ST},
    /* BTA_GATTC_INT_DISCOVER_EVT       */   {BTA_GATTC_START_DISCOVER,     BTA_GATTC_DISCOVER_ST},
    /* BTA_GATTC_DISCOVER_CMPL_EVT       */  {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
    /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_OP_CMPL,            BTA_GATTC_CONN_ST},
@@ -211,7 +211,7 @@ static const UINT8 bta_gattc_st_discover[][BTA_GATTC_NUM_COLS] = {
    /* BTA_GATTC_API_READ_MULTI_EVT     */   {BTA_GATTC_Q_CMD,              BTA_GATTC_DISCOVER_ST},
    /* BTA_GATTC_API_REFRESH_EVT        */   {BTA_GATTC_IGNORE,             BTA_GATTC_DISCOVER_ST},

-    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_IGNORE,             BTA_GATTC_DISCOVER_ST},
+    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_CONN,               BTA_GATTC_DISCOVER_ST},
    /* BTA_GATTC_INT_DISCOVER_EVT       */   {BTA_GATTC_RESTART_DISCOVER,   BTA_GATTC_DISCOVER_ST},
    /* BTA_GATTC_DISCOVER_CMPL_EVT      */   {BTA_GATTC_DISC_CMPL,          BTA_GATTC_CONN_ST},
    /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE_OP_CMPL,     BTA_GATTC_DISCOVER_ST},
@@ -709,6 +709,7 @@ void bta_gattc_send_open_cback( tBTA_GATTC_RCB *p_clreg, tBTA_GATT_STATUS status
                                BD_ADDR remote_bda, UINT16 conn_id,
                                tBTA_TRANSPORT transport, UINT16 mtu)
 {
+
    tBTA_GATTC      cb_data;

    if (p_clreg->p_cback) {
@@ -862,6 +863,10 @@ BOOLEAN bta_gattc_conn_dealloc(BD_ADDR remote_bda)
    if (p_conn != NULL) {
        p_conn->in_use = FALSE;
        memset(p_conn->remote_bda, 0, BD_ADDR_LEN);
+        osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+        bta_sys_free_timer(&p_conn->service_change_ccc_timer);
+        p_conn->ccc_timer_used = FALSE;
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
        return TRUE;
    }
    return FALSE;
@@ -420,7 +420,7 @@ void bta_gatts_add_char(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_msg)
                                      p_msg->api_add_char.perm,
                                      p_msg->api_add_char.property, p_attr_val, p_control);
    cb_data.add_result.server_if = p_rcb->gatt_if;
-    cb_data.add_result.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+    cb_data.add_result.service_id = p_msg->api_add_char.hdr.layer_specific;
    cb_data.add_result.attr_id = attr_id;
 // btla-specific ++
    memcpy(&cb_data.add_result.char_uuid, &p_msg->api_add_char.char_uuid, sizeof(tBT_UUID));
@@ -470,7 +470,7 @@ void bta_gatts_add_char_descr(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_
                                      p_control);

    cb_data.add_result.server_if = p_rcb->gatt_if;
-    cb_data.add_result.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+    cb_data.add_result.service_id = p_msg->api_add_char_descr.hdr.layer_specific;
    cb_data.add_result.attr_id = attr_id;
 // btla-specific ++
    memcpy(&cb_data.add_result.char_uuid, &p_msg->api_add_char_descr.descr_uuid, sizeof(tBT_UUID));
@@ -729,7 +729,7 @@ void bta_gatts_open (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)

    if ((p_rcb = bta_gatts_find_app_rcb_by_app_if(p_msg->api_open.server_if)) != NULL) {
        /* should always get the connection ID */
-        if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda,
+        if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda, BLE_ADDR_UNKNOWN_TYPE,
                         p_msg->api_open.is_direct, p_msg->api_open.transport)) {
            status = BTA_GATT_OK;

@@ -334,7 +334,7 @@ void bta_hh_le_open_conn(tBTA_HH_DEV_CB *p_cb, BD_ADDR remote_bda)
    bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
    p_cb->in_use = TRUE;

-    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, TRUE, BTA_GATT_TRANSPORT_LE);
+    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE);
 }

 /*******************************************************************************
@@ -2600,7 +2600,7 @@ static void bta_hh_le_add_dev_bg_conn(tBTA_HH_DEV_CB *p_cb, BOOLEAN check_bond)
    if (/*p_cb->dscp_info.flag & BTA_HH_LE_NORMAL_CONN &&*/
        !p_cb->in_bg_conn && to_add) {
        /* add device into BG connection to accept remote initiated connection */
-        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, FALSE, BTA_GATT_TRANSPORT_LE);
+        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, BLE_ADDR_UNKNOWN_TYPE, FALSE, BTA_GATT_TRANSPORT_LE);
        p_cb->in_bg_conn = TRUE;

        BTA_DmBleSetBgConnType(BTA_DM_BLE_CONN_AUTO, NULL);
@@ -400,12 +400,17 @@ typedef struct {

 typedef void (tBTA_SET_ADV_DATA_CMPL_CBACK) (tBTA_STATUS status);

-typedef void (tBTA_START_ADV_CMPL_CBACK) (tBTA_STATUS status);
+typedef tBTM_START_ADV_CMPL_CBACK tBTA_START_ADV_CMPL_CBACK;
+
+typedef tBTM_START_STOP_ADV_CMPL_CBACK tBTA_START_STOP_ADV_CMPL_CBACK;
+

 typedef tBTM_ADD_WHITELIST_CBACK tBTA_ADD_WHITELIST_CBACK;

 typedef tBTM_SET_PKT_DATA_LENGTH_CBACK tBTA_SET_PKT_DATA_LENGTH_CBACK;

+typedef tBTM_SET_RAND_ADDR_CBACK tBTA_SET_RAND_ADDR_CBACK;
+
 typedef tBTM_SET_LOCAL_PRIVACY_CBACK tBTA_SET_LOCAL_PRIVACY_CBACK;

 typedef tBTM_CMPL_CB tBTA_CMPL_CB;
@@ -782,6 +787,7 @@ typedef struct {
 typedef struct {
    BD_ADDR         bd_addr;            /* BD address peer device. */
    UINT8           status;             /* connection open/closed */
+    UINT8           reason;             /* link down reason */
    BOOLEAN         is_removed;         /* TRUE if device is removed when link is down */
 #if BLE_INCLUDED == TRUE
    tBTA_TRANSPORT  link_type;
@@ -2056,7 +2062,7 @@ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration,

 extern void BTA_DmBleStopAdvertising(void);

-extern void BTA_DmSetRandAddress(BD_ADDR rand_addr);
+extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback);

 #endif

@@ -375,6 +375,7 @@ typedef struct {
 /* data associated with BTA_AV_RC_OPEN_EVT */
 typedef struct {
    UINT8           rc_handle;
+    BOOLEAN         sdp_disc_done;
    tBTA_AV_FEAT    peer_features;
    BD_ADDR         peer_addr;
    tBTA_AV_STATUS  status;
@@ -188,6 +188,8 @@ typedef UINT8 tBTA_GATTC_EVT;

 typedef tGATT_IF tBTA_GATTC_IF;

+typedef UINT8 tBTA_ADDR_TYPE;
+
 typedef struct {
    UINT16              unit;       /* as UUIUD defined by SIG */
    UINT16              descr;      /* as UUID as defined by SIG */
@@ -387,27 +389,30 @@ typedef struct {
    BD_ADDR             remote_bda;
 } tBTA_GATTC_DISCONNECT;

-
+typedef struct {
+    UINT16              conn_id;
+    BD_ADDR             remote_bda;
+} tBTA_GATTC_SERVICE_CHANGE;

 typedef union {
    tBTA_GATT_STATUS        status;

-    tBTA_GATTC_SEARCH_CMPL  search_cmpl;          /* discovery complete */
-    tBTA_GATTC_SRVC_RES     srvc_res;          /* discovery result */
-    tBTA_GATTC_REG          reg_oper;              /* registration data */
+    tBTA_GATTC_SEARCH_CMPL  search_cmpl;    /* discovery complete */
+    tBTA_GATTC_SRVC_RES     srvc_res;       /* discovery result */
+    tBTA_GATTC_REG          reg_oper;       /* registration data */
    tBTA_GATTC_OPEN         open;
    tBTA_GATTC_CONNECT      connect;
    tBTA_GATTC_CLOSE        close;
    tBTA_GATTC_DISCONNECT   disconnect;
-    tBTA_GATTC_READ         read;             /* read attribute/descriptor data */
-    tBTA_GATTC_WRITE        write;            /* write complete data */
-    tBTA_GATTC_EXEC_CMPL    exec_cmpl;       /*  execute complete */
-    tBTA_GATTC_NOTIFY       notify;           /* notification/indication event data */
+    tBTA_GATTC_READ         read;           /* read attribute/descriptor data */
+    tBTA_GATTC_WRITE        write;          /* write complete data */
+    tBTA_GATTC_EXEC_CMPL    exec_cmpl;      /*  execute complete */
+    tBTA_GATTC_NOTIFY       notify;         /* notification/indication event data */
    tBTA_GATTC_ENC_CMPL_CB  enc_cmpl;
-    BD_ADDR                 remote_bda;     /* service change event */
    tBTA_GATTC_CFG_MTU      cfg_mtu;        /* configure MTU operation */
    tBTA_GATTC_CONGEST      congest;
    tBTA_GATTC_QUEUE_FULL   queue_full;
+    tBTA_GATTC_SERVICE_CHANGE srvc_chg;     /* service change event */
 } tBTA_GATTC;

 /* GATTC enable callback function */
@@ -737,13 +742,14 @@ extern void BTA_GATTC_AppDeregister (tBTA_GATTC_IF client_if);
 **
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
+**                  remote_addr_type: remote device BD address type.
 **                  is_direct: direct connection or background auto connection
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
-                           BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport);
+extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
+                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport);

 /*******************************************************************************
 **
@@ -30,6 +30,7 @@
 #include "bta_gattc_ci.h"
 #include "bta_gattc_co.h"
 #include "fixed_queue.h"
+#include "mutex.h"

 /*****************************************************************************
 **  Constants and data types
@@ -115,6 +116,7 @@ typedef tBTA_GATTC_INT_START_IF tBTA_GATTC_INT_DEREG;
 typedef struct {
    BT_HDR                  hdr;
    BD_ADDR                 remote_bda;
+    tBTA_ADDR_TYPE          remote_addr_type;
    tBTA_GATTC_IF           client_if;
    BOOLEAN                 is_direct;
    tBTA_TRANSPORT          transport;
@@ -191,6 +193,7 @@ typedef struct {
    UINT8                   role;
    tBT_TRANSPORT           transport;
    tGATT_DISCONN_REASON    reason;
+    BOOLEAN                 already_connect;
 } tBTA_GATTC_INT_CONN;

 typedef struct {
@@ -357,8 +360,8 @@ enum {
 };

 typedef struct {
-    UINT8             state;
-
+    UINT8               state;
+    osi_mutex_t         write_ccc_mutex;
    tBTA_GATTC_CONN     conn_track[BTA_GATTC_CONN_MAX];
    tBTA_GATTC_BG_TCK   bg_track[BTA_GATTC_KNOWN_SR_MAX];
    tBTA_GATTC_RCB      cl_rcb[BTA_GATTC_CL_MAX];
@@ -224,6 +224,7 @@ extern UINT16 bta_sys_get_sys_features(void);
 extern void bta_sys_sendmsg(void *p_msg);
 extern void bta_sys_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, INT32 timeout_ms);
 extern void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle);
+extern void bta_sys_free_timer(TIMER_LIST_ENT *p_tle);
 extern void bta_sys_disable(tBTA_SYS_HW_MODULE module);
 extern UINT32 bta_sys_get_remaining_ticks(TIMER_LIST_ENT *p_target_tle);

@@ -652,6 +652,28 @@ void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle)
    osi_alarm_cancel(alarm);
 }

+/*******************************************************************************
+**
+** Function         bta_sys_free_timer
+**
+** Description      Stop and free a BTA timer.
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_sys_free_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    osi_alarm_t *alarm = hash_map_get(bta_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s expected alarm was not in bta alarm hash map.", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(bta_alarm_hash_map, p_tle);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_sys_disable
@@ -23,8 +23,13 @@

 #if (SMP_INCLUDED == TRUE)

+//the maximum nubmer of bonded devices
+#define BONED_DEVICES_MAX_COUNT (BTM_SEC_MAX_DEVICE_RECORDS)
+
 static void _btc_storage_save(void)
 {
+    uint16_t addr_section_count = 0;
+    const btc_config_section_iter_t *need_remove_iter = NULL;
    const btc_config_section_iter_t *iter = btc_config_section_begin();

    while (iter != btc_config_section_end()) {
@@ -48,10 +53,25 @@ static void _btc_storage_save(void)
            btc_config_remove_section(section);
            continue;
        }
-
+        if(addr_section_count == BONED_DEVICES_MAX_COUNT) {
+            need_remove_iter = iter;
+        }
+        addr_section_count ++;
        iter = btc_config_section_next(iter);
    }
-
+    /*exceeded the maximum nubmer of bonded devices, delete them */
+    if (need_remove_iter) {
+        while(need_remove_iter != btc_config_section_end()) {
+            const char *need_remove_section = btc_config_section_name(need_remove_iter);
+            if (!string_is_bdaddr(need_remove_section)) {
+                need_remove_iter = btc_config_section_next(need_remove_iter);
+                continue;
+            }
+            need_remove_iter = btc_config_section_next(need_remove_iter);
+            BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
+            btc_config_remove_section(need_remove_section);
+        }
+    }
    btc_config_flush();
 }

@@ -764,7 +784,10 @@ bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev
        //resolve the peer device irk
        if (_btc_storage_get_ble_bonding_key(&bd_addr, BTM_LE_KEY_PID, buffer, sizeof(tBTM_LE_PID_KEYS)) == BT_STATUS_SUCCESS) {
            bond_dev->bond_key.key_mask |= ESP_BLE_ID_KEY_MASK;
-            memcpy(&bond_dev->bond_key.pid_key, buffer, sizeof(tBTM_LE_PID_KEYS));
+            tBTM_LE_PID_KEYS *pid_key = (tBTM_LE_PID_KEYS *) buffer;
+            memcpy(&bond_dev->bond_key.pid_key.irk, pid_key->irk, BT_OCTET16_LEN);
+            bond_dev->bond_key.pid_key.addr_type = pid_key->addr_type;
+            memcpy(&bond_dev->bond_key.pid_key.static_addr, pid_key->static_addr, sizeof(BD_ADDR));
        }
        //serch for the next bond device
        bond_dev++;
@@ -247,12 +247,6 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
         if (btc_storage_get_remote_addr_type(&bdaddr, &addr_type) != BT_STATUS_SUCCESS) {
            btc_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type, true);
        }
-        /* check the irk has been save in the flash or not, if the irk has already save, means that the peer device has bonding
-           before. */
-        if(pairing_cb.ble.is_pid_key_rcvd) {
-            btc_storage_compare_address_key_value(&bdaddr, BTM_LE_KEY_PID,
-                                                  (void *)&pairing_cb.ble.pid_key, sizeof(tBTM_LE_PID_KEYS));
-        }
        btc_dm_save_ble_bonding_keys();
    } else {
        /*Map the HCI fail reason  to  bt status  */
@@ -432,8 +426,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
    switch (msg->act) {
    case BTA_DM_ENABLE_EVT: {
        btc_clear_services_mask();
-        btc_storage_load_bonded_devices();
 #if (SMP_INCLUDED == TRUE)
+        btc_storage_load_bonded_devices();
        //load the bonding device to the btm layer
        btc_storage_load_bonded_ble_devices();
 #endif  ///SMP_INCLUDED == TRUE
@@ -57,8 +57,8 @@ static void btc_init_bluetooth(void)
    osi_alarm_create_mux();
    osi_alarm_init();
    bte_main_boot_entry(btc_init_callback);
-    btc_config_init();
 #if (SMP_INCLUDED)
+    btc_config_init();
    //load the ble local key whitch has been store in the flash
    btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
@@ -68,7 +68,9 @@ static void btc_init_bluetooth(void)
 static void btc_deinit_bluetooth(void)
 {
    bte_main_shutdown();
+#if (SMP_INCLUDED)
    btc_config_clean_up();
+#endif
    osi_alarm_deinit();
    osi_alarm_delete_mux();
    future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);
@@ -141,9 +141,12 @@ int btc_init(void)
 {
    xBtcQueue = xQueueCreate(BTC_TASK_QUEUE_LEN, sizeof(btc_msg_t));
    xTaskCreatePinnedToCore(btc_task, "Btc_task", BTC_TASK_STACK_SIZE, NULL, BTC_TASK_PRIO, &xBtcTaskHandle, BTC_TASK_PINNED_TO_CORE);
+    if (xBtcTaskHandle == NULL || xBtcQueue == 0){
+        return BT_STATUS_NOMEM;
+    }
+
    btc_gap_callback_init();
    /* TODO: initial the profile_tab */
-
    return BT_STATUS_SUCCESS;
 }

@@ -1002,8 +1002,6 @@ static void btc_a2d_sink_deinit(void)
 {
    LOG_DEBUG("%s\n", __FUNCTION__);

-    btc_a2dp_stop_media_task();
-
    btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
 #if (BTA_AV_SINK_INCLUDED == TRUE)
    btc_dm_disable_service(BTA_A2DP_SINK_SERVICE_ID);
@@ -1012,6 +1010,8 @@ static void btc_a2d_sink_deinit(void)
    /* Also shut down the AV state machine */
    btc_sm_shutdown(btc_av_cb.sm_handle);
    btc_av_cb.sm_handle = NULL;
+
+    btc_a2dp_stop_media_task();
 }

 /*******************************************************************************
@@ -52,6 +52,8 @@
 #include "bt_utils.h"
 #include "esp_a2dp_api.h"
 #include "mutex.h"
+#include "future.h"
+#include <assert.h>

 // #if (BTA_AV_SINK_INCLUDED == TRUE)
 #include "oi_codec_sbc.h"
@@ -162,6 +164,7 @@ static void btc_media_thread_cleanup(UNUSED_ATTR void *context);

 static tBTC_MEDIA_CB btc_media_cb;
 static int media_task_running = MEDIA_TASK_STATE_OFF;
+static future_t *media_task_future = NULL;
 static fixed_queue_t *btc_media_cmd_msg_queue = NULL;
 static xTaskHandle  xBtcMediaTaskHandle = NULL;
 static QueueHandle_t xBtcMediaDataQueue = NULL;
@@ -272,13 +275,13 @@ bool btc_a2dp_start_media_task(void)

    APPL_TRACE_EVENT("## A2DP START MEDIA THREAD ##");

-    xBtcMediaQueueSet = xQueueCreateSet(BTC_MEDIA_TASK_QUEUE_SET_LEN);
+    xBtcMediaQueueSet = xQueueCreateSet(BTC_A2DP_SINK_TASK_QUEUE_SET_LEN);
    configASSERT(xBtcMediaQueueSet);
-    xBtcMediaDataQueue = xQueueCreate(BTC_MEDIA_DATA_QUEUE_LEN, sizeof(void *));
+    xBtcMediaDataQueue = xQueueCreate(BTC_A2DP_SINK_DATA_QUEUE_LEN, sizeof(void *));
    configASSERT(xBtcMediaDataQueue);
    xQueueAddToSet(xBtcMediaDataQueue, xBtcMediaQueueSet);

-    xBtcMediaCtrlQueue = xQueueCreate(BTC_MEDIA_CTRL_QUEUE_LEN, sizeof(void *));
+    xBtcMediaCtrlQueue = xQueueCreate(BTC_A2DP_SINK_CTRL_QUEUE_LEN, sizeof(void *));
    configASSERT(xBtcMediaCtrlQueue);
    xQueueAddToSet(xBtcMediaCtrlQueue, xBtcMediaQueueSet);

@@ -286,7 +289,7 @@ bool btc_a2dp_start_media_task(void)
        goto error_exit;
    }

-    xTaskCreatePinnedToCore(btc_media_task_handler, "BtcMediaT\n", 2048, NULL, configMAX_PRIORITIES - 3, &xBtcMediaTaskHandle, 0);
+    xTaskCreatePinnedToCore(btc_media_task_handler, BTC_A2DP_SINK_TASK_NAME, BTC_A2DP_SINK_TASK_STACK_SIZE, NULL, BTC_A2DP_SINK_TASK_PRIO, &xBtcMediaTaskHandle, BTC_A2DP_SINK_TASK_PINNED_TO_CORE);
    if (xBtcMediaTaskHandle == NULL) {
        goto error_exit;
    }
@@ -319,6 +322,11 @@ error_exit:;
        xBtcMediaCtrlQueue = NULL;
    }

+    if (xBtcMediaQueueSet) {
+        vQueueDelete(xBtcMediaQueueSet);
+        xBtcMediaQueueSet = NULL;
+    }
+
    fixed_queue_free(btc_media_cmd_msg_queue, NULL);
    btc_media_cmd_msg_queue = NULL;
    return false;
@@ -329,8 +337,13 @@ void btc_a2dp_stop_media_task(void)
    APPL_TRACE_EVENT("## A2DP STOP MEDIA THREAD ##\n");

    // Exit thread
+    media_task_running = MEDIA_TASK_STATE_SHUTTING_DOWN;
+    media_task_future = future_new();
+    assert(media_task_future);
    btc_media_ctrl_post(SIG_MEDIA_TASK_CLEAN_UP);
-    // TODO: wait until CLEAN up is done, then do task delete
+    future_await(media_task_future);
+    media_task_future = NULL;
+
    vTaskDelete(xBtcMediaTaskHandle);
    xBtcMediaTaskHandle = NULL;

@@ -340,6 +353,9 @@ void btc_a2dp_stop_media_task(void)
    vQueueDelete(xBtcMediaCtrlQueue);
    xBtcMediaCtrlQueue = NULL;

+    vQueueDelete(xBtcMediaQueueSet);
+    xBtcMediaQueueSet = NULL;
+
    fixed_queue_free(btc_media_cmd_msg_queue, NULL);
    btc_media_cmd_msg_queue = NULL;
 }
@@ -527,6 +543,10 @@ static void btc_media_task_avk_data_ready(UNUSED_ATTR void *context)
        }

        while ((p_msg = (tBT_SBC_HDR *)fixed_queue_try_peek_first(btc_media_cb.RxSbcQ)) != NULL ) {
+            if (media_task_running != MEDIA_TASK_STATE_ON){
+                return;
+            }
+
            btc_media_task_handle_inc_media(p_msg);
            p_msg = (tBT_SBC_HDR *)fixed_queue_try_dequeue(btc_media_cb.RxSbcQ);
            if ( p_msg == NULL ) {
@@ -552,14 +572,13 @@ static void btc_media_thread_init(UNUSED_ATTR void *context)

 static void btc_media_thread_cleanup(UNUSED_ATTR void *context)
 {
-    /* make sure no channels are restarted while shutting down */
-    media_task_running = MEDIA_TASK_STATE_SHUTTING_DOWN;
-
    btc_media_cb.data_channel_open = FALSE;
    /* Clear media task flag */
    media_task_running = MEDIA_TASK_STATE_OFF;

    fixed_queue_free(btc_media_cb.RxSbcQ, osi_free_func);
+
+    future_ready(media_task_future, NULL);
 }

 /*******************************************************************************
@@ -894,6 +913,10 @@ UINT8 btc_media_sink_enque_buf(BT_HDR *p_pkt)
 {
    tBT_SBC_HDR *p_msg;

+    if (media_task_running != MEDIA_TASK_STATE_ON){
+        return 0;
+    }
+
    if (btc_media_cb.rx_flush == TRUE) { /* Flush enabled, do not enque*/
        return fixed_queue_length(btc_media_cb.RxSbcQ);
    }
@@ -120,30 +120,11 @@ static inline void btc_avrc_ct_cb_to_app(esp_avrc_ct_cb_event_t event, esp_avrc_

 static void handle_rc_features(void)
 {
-    btrc_remote_features_t rc_features = BTRC_FEAT_NONE;
-    bt_bdaddr_t rc_addr;
-    bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-
-    // TODO(eisenbach): If devices need to be blacklisted for absolute
-    // volume, it should be added to device/include/interop_database.h
-    // For now, everything goes... If blacklisting is necessary, exclude
-    // the following bit here:
-    //    btc_rc_vb.rc_features &= ~BTA_AV_FEAT_ADV_CTRL;
-
-    if (btc_rc_vb.rc_features & BTA_AV_FEAT_BROWSE) {
-        rc_features |= BTRC_FEAT_BROWSE;
-    }
-
-    if ( (btc_rc_vb.rc_features & BTA_AV_FEAT_ADV_CTRL) &&
-            (btc_rc_vb.rc_features & BTA_AV_FEAT_RCTG)) {
-        rc_features |= BTRC_FEAT_ABSOLUTE_VOLUME;
-    }
-
-    if (btc_rc_vb.rc_features & BTA_AV_FEAT_METADATA) {
-        rc_features |= BTRC_FEAT_METADATA;
-    }
-
-    LOG_DEBUG("%s: rc_features=0x%x", __FUNCTION__, rc_features);
+    esp_avrc_ct_cb_param_t param;
+    memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+    param.rmt_feats.feat_mask = btc_rc_vb.rc_features;
+    memcpy(param.rmt_feats.remote_bda, btc_rc_vb.rc_addr, sizeof(esp_bd_addr_t));
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_REMOTE_FEATURES_EVT, &param);
 }


@@ -158,9 +139,7 @@ static void handle_rc_features(void)
 static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
 {
    LOG_DEBUG("%s: rc_handle: %d", __FUNCTION__, p_rc_open->rc_handle);
-#if (AVRC_CTLR_INCLUDED == TRUE)
    bt_bdaddr_t rc_addr;
-#endif

    if (p_rc_open->status == BTA_AV_SUCCESS) {
        //check if already some RC is connected
@@ -182,22 +161,18 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
        btc_rc_vb.rc_connected = TRUE;
        btc_rc_vb.rc_handle = p_rc_open->rc_handle;

+        bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
+
+        esp_avrc_ct_cb_param_t param;
+        memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+        param.conn_stat.connected = true;
+        memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
+        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+
        /* on locally initiated connection we will get remote features as part of connect */
-        if (btc_rc_vb.rc_features != 0) {
+        if (p_rc_open->sdp_disc_done == TRUE) {
            handle_rc_features();
        }
-#if (AVRC_CTLR_INCLUDED == TRUE)
-        bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-        /* report connection state if device is AVRCP target */
-        if (btc_rc_vb.rc_features & BTA_AV_FEAT_RCTG) {
-            esp_avrc_ct_cb_param_t param;
-            memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-            param.conn_stat.connected = true;
-            param.conn_stat.feat_mask = btc_rc_vb.rc_features;
-            memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
-            btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
-        }
-#endif
    } else {
        LOG_ERROR("%s Connect failed with error code: %d",
                  __FUNCTION__, p_rc_open->status);
@@ -215,10 +190,8 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
 ***************************************************************************/
 static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
 {
-#if (AVRC_CTLR_INCLUDED == TRUE)
    bt_bdaddr_t rc_addr;
-    tBTA_AV_FEAT features;
-#endif
+
    LOG_DEBUG("%s: rc_handle: %d", __FUNCTION__, p_rc_close->rc_handle);
    if ((p_rc_close->rc_handle != btc_rc_vb.rc_handle)
            && (bdcmp(btc_rc_vb.rc_addr, p_rc_close->peer_addr))) {
@@ -228,28 +201,23 @@ static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)

    btc_rc_vb.rc_handle = 0;
    btc_rc_vb.rc_connected = FALSE;
-    memset(btc_rc_vb.rc_addr, 0, sizeof(BD_ADDR));
+    memcpy(btc_rc_vb.rc_addr, p_rc_close->peer_addr, sizeof(BD_ADDR));
    memset(btc_rc_vb.rc_notif, 0, sizeof(btc_rc_vb.rc_notif));
-#if (AVRC_CTLR_INCLUDED == TRUE)
-    features = btc_rc_vb.rc_features;
-#endif
+
    btc_rc_vb.rc_features = 0;
    btc_rc_vb.rc_vol_label = MAX_LABEL;
    btc_rc_vb.rc_volume = MAX_VOLUME;
-#if (AVRC_CTLR_INCLUDED == TRUE)
+
    bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-#endif
+
    memset(btc_rc_vb.rc_addr, 0, sizeof(BD_ADDR));
-#if (AVRC_CTLR_INCLUDED == TRUE)
-    /* report connection state if device is AVRCP target */
-    if (features & BTA_AV_FEAT_RCTG) {
-        esp_avrc_ct_cb_param_t param;
-        memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-        param.conn_stat.connected = false;
-        memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
-        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
-    }
-#endif
+
+    /* report connection state */
+    esp_avrc_ct_cb_param_t param;
+    memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+    param.conn_stat.connected = false;
+    memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
 }

 static void handle_rc_attributes_rsp ( tAVRC_MSG_VENDOR *vendor_msg)
@@ -115,6 +115,9 @@ static esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
        case HCI_SUCCESS:
            esp_status = ESP_BT_STATUS_SUCCESS;
            break;
+        case HCI_ERR_ESP_VENDOR_FAIL:
+            esp_status = ESP_BT_STATUS_FAIL;
+            break;
        case HCI_ERR_HOST_TIMEOUT:
            esp_status = ESP_BT_STATUS_TIMEOUT;
            break;
@@ -130,6 +133,9 @@ static esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
        case HCI_ERR_ILLEGAL_PARAMETER_FMT:
            esp_status = ESP_BT_STATUS_ERR_ILLEGAL_PARAMETER_FMT;
            break;
+        case HCI_ERR_MEMORY_FULL:
+            esp_status = ESP_BT_STATUS_MEMORY_FULL;
+            break;
        default:
            esp_status = ESP_BT_STATUS_FAIL;
            break;
@@ -166,6 +172,12 @@ static esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
        case BTM_SET_PRIVACY_FAIL:
            esp_status = ESP_BT_STATUS_FAIL;
            break;
+        case BTM_INVALID_STATIC_RAND_ADDR:
+            esp_status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+            break;
+        case BTM_SET_STATIC_RAND_ADDR_FAIL:
+            esp_status = ESP_BT_STATUS_FAIL;
+            break;
        default:
            esp_status = ESP_BT_STATUS_FAIL;
            break;
@@ -438,7 +450,7 @@ static void btc_ble_set_scan_rsp_data_raw(uint8_t *raw_scan_rsp, uint32_t raw_sc
    BTA_DmBleSetScanRspRaw(raw_scan_rsp, raw_scan_rsp_len, p_scan_rsp_data_cback);
 }

-static void btc_start_adv_callback(tBTA_STATUS status)
+static void btc_start_adv_callback(uint8_t status)
 {
    esp_ble_gap_cb_param_t param;
    bt_status_t ret;
@@ -447,7 +459,7 @@ static void btc_start_adv_callback(tBTA_STATUS status)
    msg.sig = BTC_SIG_API_CB;
    msg.pid = BTC_PID_GAP_BLE;
    msg.act = ESP_GAP_BLE_ADV_START_COMPLETE_EVT;
-    param.adv_start_cmpl.status = status;
+    param.adv_start_cmpl.status = btc_hci_to_esp_status(status);

    ret = btc_transfer_context(&msg, &param,
                               sizeof(esp_ble_gap_cb_param_t), NULL);
@@ -457,7 +469,7 @@ static void btc_start_adv_callback(tBTA_STATUS status)
    }
 }

-static void btc_stop_adv_callback(tBTA_STATUS status)
+static void btc_stop_adv_callback(uint8_t status)
 {
    esp_ble_gap_cb_param_t param;
    bt_status_t ret;
@@ -466,7 +478,7 @@ static void btc_stop_adv_callback(tBTA_STATUS status)
    msg.sig = BTC_SIG_API_CB;
    msg.pid = BTC_PID_GAP_BLE;
    msg.act = ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT;
-    param.adv_stop_cmpl.status = status;
+    param.adv_stop_cmpl.status = btc_hci_to_esp_status(status);

    ret = btc_transfer_context(&msg, &param,
                               sizeof(esp_ble_gap_cb_param_t), NULL);
@@ -479,24 +491,36 @@ static void btc_stop_adv_callback(tBTA_STATUS status)
 static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBTA_START_ADV_CMPL_CBACK start_adv_cback)
 {
    tBLE_BD_ADDR peer_addr;
-
+    esp_bt_status_t status = ESP_BT_STATUS_SUCCESS;
    if (!BLE_ISVALID_PARAM(ble_adv_params->adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
            !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+        status = ESP_BT_STATUS_PARM_INVALID;
        LOG_ERROR("Invalid advertisting interval parameters.\n");
-        return ;
    }

-    if ((ble_adv_params->adv_type < ADV_TYPE_IND) &&
+    if ((ble_adv_params->adv_type < ADV_TYPE_IND) ||
            (ble_adv_params->adv_type > ADV_TYPE_DIRECT_IND_LOW) ) {
+        status = ESP_BT_STATUS_PARM_INVALID;
        LOG_ERROR("Invalid advertisting type parameters.\n");
-        return;
    }

-    if ((ble_adv_params->adv_filter_policy < ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY) &&
+    if ((ble_adv_params->adv_filter_policy < ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY) ||
            (ble_adv_params->adv_filter_policy > ADV_FILTER_ALLOW_SCAN_WLST_CON_WLST) ) {
+        status = ESP_BT_STATUS_PARM_INVALID;
        LOG_ERROR("Invalid advertisting type parameters.\n");
+    }
+
+    if((ble_adv_params->channel_map | ADV_CHNL_ALL) != ADV_CHNL_ALL || ble_adv_params->channel_map == 0) {
+        status = ESP_BT_STATUS_PARM_INVALID;
+        LOG_ERROR("Invalid advertisting channel map parameters.\n");
+    }
+    if(status != ESP_BT_STATUS_SUCCESS) {
+        if(start_adv_cback) {
+            start_adv_cback(status);
+        }
        return;
    }
+    
    LOG_DEBUG("API_Ble_AppStartAdvertising\n");

    memcpy(peer_addr.bda, ble_adv_params->peer_addr, ESP_BD_ADDR_LEN);
@@ -546,8 +570,8 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA
                                     scan_params->own_addr_type,
                                     scan_param_setup_cback);
    } else {
-		btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE);
-	}
+        btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE);
+    }
 }

 static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
@@ -566,7 +590,7 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
        param.scan_rst.dev_type = p_data->inq_res.device_type;
        param.scan_rst.rssi = p_data->inq_res.rssi;
        param.scan_rst.ble_addr_type = p_data->inq_res.ble_addr_type;
-		param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
+        param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
        param.scan_rst.flag = p_data->inq_res.flag;
        param.scan_rst.num_resps = 1;
        param.scan_rst.adv_data_len = p_data->inq_res.adv_data_len;
@@ -601,7 +625,7 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
    btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), NULL);
 }

-static void btc_start_scan_callback(tBTA_STATUS status)
+static void btc_start_scan_callback(uint8_t status)
 {
    esp_ble_gap_cb_param_t param;
    bt_status_t ret;
@@ -688,9 +712,9 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
    btc_msg_t msg;
    msg.sig = BTC_SIG_API_CB;
    msg.pid = BTC_PID_GAP_BLE;
-    msg.act = ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT;
-    param.add_whitelist_cmpl.status = btc_hci_to_esp_status(status);
-    param.add_whitelist_cmpl.wl_opration = wl_opration;
+    msg.act = ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT;
+    param.update_whitelist_cmpl.status = btc_hci_to_esp_status(status);
+    param.update_whitelist_cmpl.wl_opration = wl_opration;
    ret = btc_transfer_context(&msg, &param,
                               sizeof(esp_ble_gap_cb_param_t), NULL);

@@ -699,6 +723,24 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
    }
 }

+static void btc_set_rand_addr_callback(UINT8 status) 
+{
+    esp_ble_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+    param.set_rand_addr_cmpl.status = btc_btm_status_to_esp_status(status); //todo status 
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT;
+    ret = btc_transfer_context(&msg, &param,
+                               sizeof(esp_ble_gap_cb_param_t), NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        LOG_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+
+}
+
 static void btc_set_local_privacy_callback(UINT8 status)
 {
    esp_ble_gap_cb_param_t param;
@@ -806,13 +848,8 @@ static void btc_ble_set_pkt_data_len(BD_ADDR remote_device, uint16_t tx_data_len
    BTA_DmBleSetDataLength(remote_device, tx_data_length, p_set_pkt_data_cback);
 }

-static void btc_ble_set_rand_addr (BD_ADDR rand_addr)
+static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback)
 {
-    esp_ble_gap_cb_param_t param;
-    bt_status_t ret;
-    btc_msg_t msg;
-    param.set_rand_addr_cmpl.status = ESP_BT_STATUS_SUCCESS;
-
    if (rand_addr != NULL) {
        /*
        A static address is a 48-bit randomly generated address and shall meet the following requirements:
@@ -827,25 +864,15 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr)
        if((rand_addr[0] & BT_STATIC_RAND_ADDR_MASK) == BT_STATIC_RAND_ADDR_MASK
            && memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0
            && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0){
-            BTA_DmSetRandAddress(rand_addr);
+            BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
        } else {
-            param.set_rand_addr_cmpl.status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+            btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
            LOG_ERROR("Invalid random address, the high bit should be 0b11, all bits of the random part shall not be to 1 or 0");
        }
    } else {
-        param.set_rand_addr_cmpl.status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+        btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
        LOG_ERROR("Invalid random addressm, the address value is NULL");
    }
-
-    msg.sig = BTC_SIG_API_CB;
-    msg.pid = BTC_PID_GAP_BLE;
-    msg.act = ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT;
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_ble_gap_cb_param_t), NULL);
-
-    if (ret != BT_STATUS_SUCCESS) {
-        LOG_ERROR("%s btc_transfer_context failed\n", __func__);
-    }
 }

 static void btc_ble_config_local_privacy(bool privacy_enable, tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback)
@@ -1042,12 +1069,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
    case BTC_GAP_BLE_ACT_SET_RAND_ADDRESS: {
        BD_ADDR bd_addr;
        memcpy(bd_addr, arg->set_rand_addr.rand_addr, sizeof(BD_ADDR));
-        btc_ble_set_rand_addr(bd_addr);
+        btc_ble_set_rand_addr(bd_addr, btc_set_rand_addr_callback);
        break;
    }
    case BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY:
        btc_ble_config_local_privacy(arg->cfg_local_privacy.privacy_enable, btc_set_local_privacy_callback);
-        break;    
+        break;
    case BTC_GAP_BLE_ACT_UPDATE_WHITE_LIST:
        BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, btc_add_whitelist_complete_callback);
        break;
@@ -1113,12 +1140,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                STREAM_TO_UINT8(key_size, arg->set_security_param.value);
                bta_dm_co_ble_set_max_key_size(key_size);
                break;
-            }        
+            }
            default:
                break;
        }
        break;
-    }        
+    }
    case BTC_GAP_BLE_SECURITY_RSP_EVT: {
        BD_ADDR bd_addr;
        tBTA_DM_BLE_SEC_GRANT res = arg->sec_rsp.accept ? BTA_DM_SEC_GRANTED : BTA_DM_SEC_PAIR_NOT_SPT;
@@ -196,7 +196,7 @@ static void btc_gattc_app_unregister(btc_ble_gattc_args_t *arg)
 static void btc_gattc_open(btc_ble_gattc_args_t *arg)
 {
    tBTA_GATT_TRANSPORT transport = BTA_GATT_TRANSPORT_LE;
-    BTA_GATTC_Open(arg->open.gattc_if, arg->open.remote_bda, arg->open.is_direct, transport);
+    BTA_GATTC_Open(arg->open.gattc_if, arg->open.remote_bda, arg->open.remote_addr_type, arg->open.is_direct, transport);
 }

 static void btc_gattc_close(btc_ble_gattc_args_t *arg)
@@ -914,8 +914,10 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
        break;
    }
    case BTA_GATTC_SRVC_CHG_EVT: {
-        memcpy(param.srvc_chg.remote_bda, arg->remote_bda, sizeof(esp_bd_addr_t));
-        btc_gattc_cb_to_app(ESP_GATTC_SRVC_CHG_EVT, ESP_GATT_IF_NONE, &param);
+        tBTA_GATTC_SERVICE_CHANGE *srvc_change = &arg->srvc_chg;
+        gattc_if = BTC_GATT_GET_GATT_IF(srvc_change->conn_id);
+        memcpy(param.srvc_chg.remote_bda, srvc_change->remote_bda, sizeof(esp_bd_addr_t));
+        btc_gattc_cb_to_app(ESP_GATTC_SRVC_CHG_EVT, gattc_if, &param);
        break;
    }
    case BTA_GATTC_QUEUE_FULL_EVT: {
@@ -832,7 +832,7 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
        param.add_char_descr.status = p_data->add_result.status;
        param.add_char_descr.attr_handle = p_data->add_result.attr_id;
        param.add_char_descr.service_handle = p_data->add_result.service_id;
-        bta_to_btc_uuid(&param.add_char_descr.char_uuid, &p_data->add_result.char_uuid);
+        bta_to_btc_uuid(&param.add_char_descr.descr_uuid, &p_data->add_result.char_uuid);

        btc_gatts_cb_to_app(ESP_GATTS_ADD_CHAR_DESCR_EVT, gatts_if, &param);
        break;
@@ -28,14 +28,6 @@
 #define BTC_AVRC_TGT_INCLUDED      FALSE
 #endif

-/* Macros */
-typedef enum {
-    BTRC_FEAT_NONE = 0x00,    /* AVRCP 1.0 */
-    BTRC_FEAT_METADATA = 0x01,    /* AVRCP 1.3 */
-    BTRC_FEAT_ABSOLUTE_VOLUME = 0x02,    /* Supports TG role and volume sync */
-    BTRC_FEAT_BROWSE = 0x04,    /* AVRCP 1.4 and up, with Browsing support */
-} btrc_remote_features_t;
-
 typedef enum {
    BTC_AVRC_CTRL_API_INIT_EVT = 0,
    BTC_AVRC_CTRL_API_DEINIT_EVT,
@@ -54,6 +54,7 @@ typedef union {
    struct open_arg {
        esp_gatt_if_t gattc_if;
        esp_bd_addr_t remote_bda;
+        esp_ble_addr_type_t remote_addr_type;
        bool is_direct;
    } open;
    //BTC_GATTC_ACT_CLOSE,
@@ -102,10 +102,13 @@ bool string_to_bdaddr(const char *string, bt_bdaddr_t *addr)

    bt_bdaddr_t new_addr;
    uint8_t *ptr = new_addr.address;
-    bool ret = sscanf(string, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
-                      &ptr[0], &ptr[1], &ptr[2], &ptr[3], &ptr[4], &ptr[5]) == 6;
-
+    uint32_t ptr_32[6];
+    bool ret  = sscanf(string, "%02x:%02x:%02x:%02x:%02x:%02x",
+                      &ptr_32[0], &ptr_32[1], &ptr_32[2], &ptr_32[3], &ptr_32[4], &ptr_32[5]) == 6;
    if (ret) {
+        for (uint8_t i = 0; i < 6; i++){
+            ptr[i] = (uint8_t) ptr_32[i];
+        }
        memcpy(addr, &new_addr, sizeof(bt_bdaddr_t));
    }

@@ -492,7 +492,7 @@ void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key)
 {
 #if (SMP_INCLUDED == TRUE)
   rsp_key &= 0x0f;  // 4~7bit reservd, only used the 0~3bit
-   bte_appl_cfg.ble_init_key &= rsp_key;
+   bte_appl_cfg.ble_resp_key &= rsp_key;
 #endif  ///SMP_INCLUDED == TRUE
 }

@@ -66,6 +66,7 @@ static uint8_t ble_resolving_list_max_size;
 static uint8_t ble_supported_states[BLE_SUPPORTED_STATES_SIZE];
 static bt_device_features_t features_ble;
 static uint16_t ble_suggested_default_data_length;
+static uint16_t ble_suggested_default_data_txtime;

 static bool readable;
 static bool ble_supported;
@@ -228,7 +229,8 @@ static void start_up(void)
            response = AWAIT_COMMAND(packet_factory->make_ble_read_suggested_default_data_length());
            packet_parser->parse_ble_read_suggested_default_data_length_response(
                response,
-                &ble_suggested_default_data_length);
+                &ble_suggested_default_data_length,
+                &ble_suggested_default_data_txtime);
        }

        // Set the ble event mask next
@@ -404,6 +406,13 @@ static uint16_t get_ble_suggested_default_data_length(void)
    return ble_suggested_default_data_length;
 }

+static uint16_t get_ble_suggested_default_data_txtime(void)
+{
+    assert(readable);
+    assert(ble_supported);
+    return ble_suggested_default_data_txtime;
+}
+
 static uint16_t get_acl_buffer_count_classic(void)
 {
    assert(readable);
@@ -472,6 +481,7 @@ static const controller_t interface = {
    get_acl_packet_size_classic,
    get_acl_packet_size_ble,
    get_ble_suggested_default_data_length,
+    get_ble_suggested_default_data_txtime,

    get_acl_buffer_count_classic,
    get_acl_buffer_count_ble,
@@ -69,6 +69,7 @@ typedef struct controller_t {
    uint16_t (*get_acl_packet_size_ble)(void);

    uint16_t (*get_ble_default_data_packet_length)(void);
+    uint16_t (*get_ble_default_data_packet_txtime)(void);

    // Get the number of acl packets the controller can buffer.
    uint16_t (*get_acl_buffer_count_classic)(void);
@@ -25,7 +25,7 @@
 #include "hci_internals.h"
 #include "hci_layer.h"
 #include "thread.h"
-#include "bt.h"
+#include "esp_bt.h"

 #define HCI_HAL_SERIAL_BUFFER_SIZE 1026
 #define HCI_BLE_EVENT 0x3e
@@ -16,7 +16,7 @@
 *
 ******************************************************************************/
 #include <string.h>
-#include "bt.h"
+#include "esp_bt.h"
 #include "bt_defs.h"
 #include "bt_trace.h"
 #include "hcidefs.h"
@@ -183,12 +183,13 @@ static void parse_ble_read_resolving_list_size_response(

 static void parse_ble_read_suggested_default_data_length_response(
    BT_HDR *response,
-    uint16_t *ble_default_packet_length_ptr)
+    uint16_t *ble_default_packet_length_ptr,
+    uint16_t *ble_default_packet_txtime_ptr)
 {

    uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
-    STREAM_TO_UINT8(*ble_default_packet_length_ptr, stream);
-
+    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
+    STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
    buffer_allocator->free(response);
 }

@@ -90,7 +90,8 @@ typedef struct {

    void (*parse_ble_read_suggested_default_data_length_response)(
        BT_HDR *response,
-        uint16_t *ble_default_packet_length_ptr
+        uint16_t *ble_default_packet_length_ptr,
+        uint16_t *ble_default_packet_txtime_ptr
    );
 } hci_packet_parser_t;

@@ -90,6 +90,7 @@ typedef enum {
    BT_STATUS_UNACCEPT_CONN_INTERVAL,
    BT_STATUS_PARAM_OUT_OF_RANGE,
    BT_STATUS_TIMEOUT,
+    BT_STATUS_MEMORY_FULL,
 } bt_status_t;

 #ifndef CPU_LITTLE_ENDIAN
@@ -647,7 +647,8 @@

 /* 4.1/4.2 secure connections feature */
 #ifndef SC_MODE_INCLUDED
-#define SC_MODE_INCLUDED                TRUE
+// Disable AES-CCM (BT 4.1) for BT Classic to workaround controller AES issue. E0 encryption (BT 4.0) will be used.
+#define SC_MODE_INCLUDED                FALSE
 #endif

 /* Used for conformance testing ONLY */
@@ -67,11 +67,11 @@ int osi_alarm_delete_mux(void)
    osi_mutex_free(&alarm_mutex);
    return 0;
 }
-    
+
 void osi_alarm_init(void)
 {
    assert(alarm_mutex != NULL);
-    
+
    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
    if (alarm_state != ALARM_STATE_IDLE) {
        LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
@@ -79,7 +79,7 @@ void osi_alarm_init(void)
    }
    memset(alarm_cbs, 0x00, sizeof(alarm_cbs));
    alarm_state = ALARM_STATE_OPEN;
-    
+
 end:
    osi_mutex_unlock(&alarm_mutex);
 }
@@ -87,13 +87,13 @@ end:
 void osi_alarm_deinit(void)
 {
    assert(alarm_mutex != NULL);
-    
+
    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
    if (alarm_state != ALARM_STATE_OPEN) {
        LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
        goto end;
    }
-    
+
    for (int i = 0; i < ALARM_CBS_NUM; i++) {
        if (alarm_cbs[i].alarm_hdl != NULL) {
            alarm_free(&alarm_cbs[i]);
@@ -122,6 +122,10 @@ static struct alarm_t *alarm_cbs_lookfor_available(void)
 static void alarm_cb_handler(struct alarm_t *alarm)
 {
    LOG_DEBUG("TimerID %p\n", alarm);
+    if (alarm_state != ALARM_STATE_OPEN) {
+        LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
+        return;
+    }
    btc_msg_t msg;
    btc_alarm_args_t arg;
    msg.sig = BTC_SIG_API_CALL;
@@ -136,14 +140,14 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
    assert(alarm_mutex != NULL);

    struct alarm_t *timer_id = NULL;
-    
+
    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
    if (alarm_state != ALARM_STATE_OPEN) {
        LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
        timer_id = NULL;
        goto end;
    }
-    
+
    timer_id = alarm_cbs_lookfor_available();

    if (!timer_id) {
@@ -161,7 +165,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
    timer_id->cb = callback;
    timer_id->cb_data = data;
    timer_id->deadline_us = 0;
-    
+
    esp_err_t stat = esp_timer_create(&tca, &timer_id->alarm_hdl);
    if (stat != ESP_OK) {
        LOG_ERROR("%s failed to create timer, err 0x%x\n", __func__, stat);
@@ -181,12 +185,13 @@ static osi_alarm_err_t alarm_free(osi_alarm_t *alarm)
        return OSI_ALARM_ERR_INVALID_ARG;
    }

+    esp_timer_stop(alarm->alarm_hdl);
    esp_err_t stat = esp_timer_delete(alarm->alarm_hdl);
    if (stat != ESP_OK) {
        LOG_ERROR("%s failed to delete timer, err 0x%x\n", __func__, stat);
        return OSI_ALARM_ERR_FAIL;
    }
-    
+
    memset(alarm, 0, sizeof(osi_alarm_t));
    return OSI_ALARM_ERR_PASS;
 }
@@ -194,7 +199,7 @@ static osi_alarm_err_t alarm_free(osi_alarm_t *alarm)
 void osi_alarm_free(osi_alarm_t *alarm)
 {
    assert(alarm_mutex != NULL);
-    
+
    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
    if (alarm_state != ALARM_STATE_OPEN) {
        LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
@@ -210,7 +215,7 @@ end:
 osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
 {
    assert(alarm_mutex != NULL);
-    
+
    osi_alarm_err_t ret = OSI_ALARM_ERR_PASS;
    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
    if (alarm_state != ALARM_STATE_OPEN) {
@@ -218,7 +223,7 @@ osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
        ret = OSI_ALARM_ERR_INVALID_STATE;
        goto end;
    }
-    
+
    if (!alarm || alarm->alarm_hdl == NULL) {
        LOG_ERROR("%s null\n", __func__);
        ret = OSI_ALARM_ERR_INVALID_ARG;
@@ -233,7 +238,7 @@ osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
        goto end;
    }
    alarm->deadline_us = timeout_us + esp_timer_get_time();
-    
+
 end:
    osi_mutex_unlock(&alarm_mutex);
    return ret;
@@ -248,7 +253,7 @@ osi_alarm_err_t osi_alarm_cancel(osi_alarm_t *alarm)
        ret = OSI_ALARM_ERR_INVALID_STATE;
        goto end;
    }
-    
+
    if (!alarm || alarm->alarm_hdl == NULL) {
        LOG_ERROR("%s null\n", __func__);
        ret = OSI_ALARM_ERR_INVALID_ARG;
@@ -270,7 +275,7 @@ period_ms_t osi_alarm_get_remaining_ms(const osi_alarm_t *alarm)
 {
    assert(alarm_mutex != NULL);
    int64_t dt_us = 0;
-    
+
    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
    dt_us = alarm->deadline_us - esp_timer_get_time();
    osi_mutex_unlock(&alarm_mutex);
@@ -28,8 +28,9 @@
 #include "list.h"
 #include "bt_trace.h"

-#define CONFIG_FILE_MAX_SIZE      (2048)
-#define CONFIG_KEY                "bt_cfg_key"
+#define CONFIG_FILE_MAX_SIZE             (1536)//1.5k
+#define CONFIG_FILE_DEFAULE_LENGTH       (2048)
+#define CONFIG_KEY                       "bt_cfg_key"
 typedef struct {
    char *key;
    char *value;
@@ -134,7 +135,7 @@ bool config_has_key(const config_t *config, const char *section, const char *key
 }

 bool config_has_key_in_section(config_t *config, char *key, char *key_value)
-{
+{
    LOG_DEBUG("key = %s, value = %s", key, key_value);
    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
        const section_t *section = (const section_t *)list_node(node);
@@ -302,6 +303,78 @@ const char *config_section_name(const config_section_node_t *node)
    return section->name;
 }

+static int get_config_size(const config_t *config)
+{
+    assert(config != NULL);
+
+    int w_len = 0, total_size = 0;
+
+    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
+        const section_t *section = (const section_t *)list_node(node);
+        w_len = strlen(section->name) + strlen("[]\n");// format "[section->name]\n"
+        total_size += w_len;
+
+        for (const list_node_t *enode = list_begin(section->entries); enode != list_end(section->entries); enode = list_next(enode)) {
+            const entry_t *entry = (const entry_t *)list_node(enode);
+            w_len = strlen(entry->key) + strlen(entry->value) + strlen(" = \n");// format "entry->key = entry->value\n"
+            total_size += w_len;
+        }
+
+        // Only add a separating newline if there are more sections.
+        if (list_next(node) != list_end(config->sections)) {
+                total_size ++;  //'\n'
+        } else {
+            break;
+        }
+    }
+    total_size ++; //'\0'
+    return total_size;
+}
+
+static int get_config_size_from_flash(nvs_handle fp)
+{
+    assert(fp != 0);
+
+    esp_err_t err;
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    if (!keyname){
+        LOG_ERROR("%s, malloc error\n", __func__);
+        return 0;
+    }
+    size_t length = CONFIG_FILE_DEFAULE_LENGTH;
+    size_t total_length = 0;
+    uint16_t i = 0;
+    snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, 0);
+    err = nvs_get_blob(fp, keyname, NULL, &length);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        osi_free(keyname);
+        return 0;
+    }
+    if (err != ESP_OK) {
+        LOG_ERROR("%s, error %d\n", __func__, err);
+        osi_free(keyname);
+        return 0;
+    }
+    total_length += length;
+    while (length == CONFIG_FILE_MAX_SIZE) {
+        length = CONFIG_FILE_DEFAULE_LENGTH;
+        snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, ++i);
+        err = nvs_get_blob(fp, keyname, NULL, &length);
+
+        if (err == ESP_ERR_NVS_NOT_FOUND) {
+            break;
+        }
+        if (err != ESP_OK) {
+            LOG_ERROR("%s, error %d\n", __func__, err);
+            osi_free(keyname);
+            return 0;
+        }
+        total_length += length;
+    }
+    osi_free(keyname);
+    return total_length;
+}
+
 bool config_save(const config_t *config, const char *filename)
 {
    assert(config != NULL);
@@ -312,8 +385,10 @@ bool config_save(const config_t *config, const char *filename)
    int err_code = 0;
    nvs_handle fp;
    char *line = osi_calloc(1024);
-    char *buf = osi_calloc(CONFIG_FILE_MAX_SIZE);
-    if (!line || !buf) {
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    int config_size = get_config_size(config);
+    char *buf = osi_calloc(config_size + 100);
+    if (!line || !buf || !keyname) {
        err_code |= 0x01;
        goto error;
    }
@@ -333,45 +408,53 @@ bool config_save(const config_t *config, const char *filename)
        const section_t *section = (const section_t *)list_node(node);
        w_cnt = snprintf(line, 1024, "[%s]\n", section->name);
        LOG_DEBUG("section name: %s, w_cnt + w_cnt_total = %d\n", section->name, w_cnt + w_cnt_total);
-        if (w_cnt + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-            memcpy(buf + w_cnt_total, line, w_cnt);
-            w_cnt_total += w_cnt;
-        } else {
-            break;
-        }
+        memcpy(buf + w_cnt_total, line, w_cnt);
+        w_cnt_total += w_cnt;

        for (const list_node_t *enode = list_begin(section->entries); enode != list_end(section->entries); enode = list_next(enode)) {
            const entry_t *entry = (const entry_t *)list_node(enode);
            LOG_DEBUG("(key, val): (%s, %s)\n", entry->key, entry->value);
            w_cnt = snprintf(line, 1024, "%s = %s\n", entry->key, entry->value);
            LOG_DEBUG("%s, w_cnt + w_cnt_total = %d", __func__, w_cnt + w_cnt_total);
-            if (w_cnt + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-                memcpy(buf + w_cnt_total, line, w_cnt);
-                w_cnt_total += w_cnt;
-            } else {
-                break;
-            }
+            memcpy(buf + w_cnt_total, line, w_cnt);
+            w_cnt_total += w_cnt;
        }

        // Only add a separating newline if there are more sections.
        if (list_next(node) != list_end(config->sections)) {
-            if (1 + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-                buf[w_cnt_total] = '\n';
-                w_cnt_total += 1;
-            }
+            buf[w_cnt_total] = '\n';
+            w_cnt_total += 1;
        } else {
            break;
        }
    }
-
    buf[w_cnt_total] = '\0';
-
-    err = nvs_set_blob(fp, CONFIG_KEY, buf, w_cnt_total);
-
-    if (err != ESP_OK) {
-        nvs_close(fp);
-        err_code |= 0x04;
-        goto error;
+    if (w_cnt_total < CONFIG_FILE_MAX_SIZE) {
+        snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, 0);
+        err = nvs_set_blob(fp, keyname, buf, w_cnt_total);
+        if (err != ESP_OK) {
+            nvs_close(fp);
+            err_code |= 0x04;
+            goto error;
+        }
+    }else {
+        uint count = (w_cnt_total / CONFIG_FILE_MAX_SIZE);
+        for (int i = 0; i <= count; i++)
+        {
+            snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, i);
+            if (i == count) {
+                err = nvs_set_blob(fp, keyname, buf + i*CONFIG_FILE_MAX_SIZE, w_cnt_total - i*CONFIG_FILE_MAX_SIZE);
+                LOG_DEBUG("save keyname = %s, i = %d, %d\n", keyname, i, w_cnt_total - i*CONFIG_FILE_MAX_SIZE);
+            }else {
+                err = nvs_set_blob(fp, keyname, buf + i*CONFIG_FILE_MAX_SIZE, CONFIG_FILE_MAX_SIZE);
+                LOG_DEBUG("save keyname = %s, i = %d, %d\n", keyname, i, CONFIG_FILE_MAX_SIZE);
+            }
+            if (err != ESP_OK) {
+                nvs_close(fp);
+                err_code |= 0x04;
+                goto error;
+            }
+        }
    }

    err = nvs_commit(fp);
@@ -384,6 +467,7 @@ bool config_save(const config_t *config, const char *filename)
    nvs_close(fp);
    osi_free(line);
    osi_free(buf);
+    osi_free(keyname);
    return true;

 error:
@@ -393,6 +477,9 @@ error:
    if (line) {
        osi_free(line);
    }
+    if (keyname) {
+        osi_free(keyname);
+    }
    if (err_code) {
        LOG_ERROR("%s, err_code: 0x%x\n", __func__, err_code);
    }
@@ -423,29 +510,50 @@ static void config_parse(nvs_handle fp, config_t *config)
    assert(fp != 0);
    assert(config != NULL);

+    esp_err_t err;
    int line_num = 0;
    int err_code = 0;
+    uint16_t i = 0;
+    size_t length = CONFIG_FILE_DEFAULE_LENGTH;
+    size_t total_length = 0;
    char *line = osi_calloc(1024);
    char *section = osi_calloc(1024);
-    char *buf = osi_calloc(CONFIG_FILE_MAX_SIZE);
-    if (!line || !section || !buf) {
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    int buf_size = get_config_size_from_flash(fp);
+    char *buf = osi_calloc(buf_size + 100);
+    if (!line || !section || !buf || !keyname) {
        err_code |= 0x01;
        goto error;
    }
-
-    esp_err_t err;
-    size_t length = CONFIG_FILE_MAX_SIZE;
-    err = nvs_get_blob(fp, CONFIG_KEY, buf, &length);
+    snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, 0);
+    err = nvs_get_blob(fp, keyname, buf, &length);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        goto error;
+    }
    if (err != ESP_OK) {
        err_code |= 0x02;
        goto error;
    }
+    total_length += length;
+    while (length == CONFIG_FILE_MAX_SIZE) {
+        length = CONFIG_FILE_DEFAULE_LENGTH;
+        snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, ++i);
+        err = nvs_get_blob(fp, keyname, buf + CONFIG_FILE_MAX_SIZE * i, &length);

+        if (err == ESP_ERR_NVS_NOT_FOUND) {
+            break;
+        }
+        if (err != ESP_OK) {
+            err_code |= 0x02;
+            goto error;
+        }
+        total_length += length;
+    }
    char *p_line_end;
    char *p_line_bgn = buf;
    strcpy(section, CONFIG_DEFAULT_SECTION);

-    while ( (p_line_bgn < buf + length - 1) && (p_line_end = strchr(p_line_bgn, '\n'))) {
+    while ( (p_line_bgn < buf + total_length - 1) && (p_line_end = strchr(p_line_bgn, '\n'))) {

        // get one line
        int line_len = p_line_end - p_line_bgn;
@@ -493,6 +601,9 @@ error:
    if (section) {
        osi_free(section);
    }
+    if (keyname) {
+        osi_free(keyname);
+    }
    if (err_code) {
        LOG_ERROR("%s returned with err code: %d\n", __func__, err_code);
    }
@@ -83,13 +83,14 @@ typedef enum {
 #define BTC_TASK_PRIO                   (configMAX_PRIORITIES - 6)
 #define BTC_TASK_QUEUE_LEN              60

-#define BTC_MEDIA_TASK_PINNED_TO_CORE   (TASK_PINNED_TO_CORE)
-#define BTC_MEDIA_TASK_STACK_SIZE       (CONFIG_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)
-#define BTC_MEDIA_TASK_NAME             "BtcMediaT"
-#define BTC_MEDIA_TASK_PRIO             (configMAX_PRIORITIES - 3)
-#define BTC_MEDIA_DATA_QUEUE_LEN        (1)
-#define BTC_MEDIA_CTRL_QUEUE_LEN        (5)
-#define BTC_MEDIA_TASK_QUEUE_SET_LEN    (BTC_MEDIA_DATA_QUEUE_LEN + BTC_MEDIA_CTRL_QUEUE_LEN)
+#define BTC_A2DP_SINK_TASK_PINNED_TO_CORE     (TASK_PINNED_TO_CORE)
+#define BTC_A2DP_SINK_TASK_STACK_SIZE         (CONFIG_A2DP_SINK_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE) // by menuconfig
+#define BTC_A2DP_SINK_TASK_NAME               "BtA2dSinkT"
+#define BTC_A2DP_SINK_TASK_PRIO               (configMAX_PRIORITIES - 3)
+#define BTC_A2DP_SINK_DATA_QUEUE_LEN          (1)
+#define BTC_A2DP_SINK_CTRL_QUEUE_LEN          (5)
+#define BTC_A2DP_SINK_TASK_QUEUE_SET_LEN      (BTC_A2DP_SINK_DATA_QUEUE_LEN + BTC_A2DP_SINK_CTRL_QUEUE_LEN)
+

 #define TASK_POST_NON_BLOCKING          (0)
 #define TASK_POST_BLOCKING              (portMAX_DELAY)
@@ -407,7 +407,7 @@ void avdt_ccb_dealloc(tAVDT_CCB *p_ccb, tAVDT_CCB_EVT *p_data)
    UNUSED(p_data);

    AVDT_TRACE_DEBUG("avdt_ccb_dealloc %d\n", avdt_ccb_to_idx(p_ccb));
-    btu_stop_timer(&p_ccb->timer_entry);
+    btu_free_timer(&p_ccb->timer_entry);
    fixed_queue_free(p_ccb->cmd_q, NULL);
    fixed_queue_free(p_ccb->rsp_q, NULL);
    memset(p_ccb, 0, sizeof(tAVDT_CCB));
@@ -644,7 +644,7 @@ void avdt_scb_dealloc(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    UNUSED(p_data);

    AVDT_TRACE_DEBUG("avdt_scb_dealloc hdl=%d\n", avdt_scb_to_hdl(p_scb));
-    btu_stop_timer(&p_scb->timer_entry);
+    btu_free_timer(&p_scb->timer_entry);

 #if AVDT_MULTIPLEXING == TRUE
    /* free fragments we're holding, if any; it shouldn't happen */
@@ -906,6 +906,11 @@ void btm_read_remote_version_complete (UINT8 *p)
            }
 #if BLE_INCLUDED == TRUE
            if (p_acl_cb->transport == BT_TRANSPORT_LE) {
+                if (HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl_cb->peer_le_features)) {
+                    uint16_t data_length = controller_get_interface()->get_ble_default_data_packet_length();
+                    uint16_t data_txtime = controller_get_interface()->get_ble_default_data_packet_txtime();
+                    btsnd_hcic_ble_set_data_length(p_acl_cb->hci_handle, data_length, data_txtime);
+                }
                l2cble_notify_le_connection (p_acl_cb->remote_addr);
            }
 #endif
@@ -2073,7 +2078,7 @@ void BTM_BleGetWhiteListSize(uint16_t *length)
 {
    tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
    if (p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_ERROR("%s Whitelist full.", __func__);
+        BTM_TRACE_DEBUG("%s Whitelist full.", __func__);
    }
    *length = p_cb->white_list_avail_size;
    return;
@@ -180,11 +180,7 @@ BOOLEAN BTM_SecAddBleKey (BD_ADDR bd_addr, tBTM_LE_KEY_VALUE *p_le_key, tBTM_LE_

 #if (BLE_PRIVACY_SPT == TRUE)
    if (key_type == BTM_LE_KEY_PID || key_type == BTM_LE_KEY_LID) {
-        /* It will cause that scanner doesn't send scan request to advertiser
-         * which has sent IRK to us and we have stored the IRK in controller.
-         * It is a design problem of hardware. The temporal solution is not to 
-         * send the key to the controller and then resolve the random address in host. */
-        //btm_ble_resolving_list_load_dev (p_dev_rec);
+        btm_ble_resolving_list_load_dev (p_dev_rec);
    }
 #endif

@@ -609,18 +605,23 @@ void BTM_ReadDevInfo (BD_ADDR remote_bda, tBT_DEVICE_TYPE *p_dev_type, tBLE_ADDR
 {
    tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (remote_bda);
    tBTM_INQ_INFO     *p_inq_info = BTM_InqDbRead(remote_bda);
+    tBLE_ADDR_TYPE    temp_addr_type = (*p_addr_type);

    *p_addr_type = BLE_ADDR_PUBLIC;

-    if (!p_dev_rec) {
+    if (!p_dev_rec) {  
        *p_dev_type = BT_DEVICE_TYPE_BREDR;
        /* Check with the BT manager if details about remote device are known */
        if (p_inq_info != NULL) {
            *p_dev_type = p_inq_info->results.device_type ;
            *p_addr_type = p_inq_info->results.ble_addr_type;
        } else {
-            /* unknown device, assume BR/EDR */
-            BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
+            if(temp_addr_type <= BLE_ADDR_TYPE_MAX) {
+                *p_addr_type = temp_addr_type;
+            } else {
+                /* unknown device, assume BR/EDR */
+                BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
+            }
        }
    } else { /* there is a security device record exisitng */
        /* new inquiry result, overwrite device type in security device record */
@@ -665,6 +666,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT tran

    /* if no device can be located, return */
    if (p_dev_rec == NULL) {
+        memset(remote_bda, 0, BD_ADDR_LEN);
        return FALSE;
    }

@@ -812,7 +814,7 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length)
    }

    if (!HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl->peer_le_features)) {
-        BTM_TRACE_DEBUG("%s failed, peer does not support request", __FUNCTION__);
+        BTM_TRACE_ERROR("%s failed, peer does not support request", __FUNCTION__);
        return BTM_PEER_LE_DATA_LEN_UNSUPPORTED;
    }

@@ -1221,6 +1223,14 @@ void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY
            p_rec->ble.keys.key_size = p_keys->lenc_key.key_size;
            p_rec->ble.key_type |= BTM_LE_KEY_LENC;

+            /* Set that link key is known since this shares field with BTM_SEC_FLAG_LKEY_KNOWN flag in btm_api.h*/
+            p_rec->sec_flags |=  BTM_SEC_LE_LINK_KEY_KNOWN;
+            if ( p_keys->pcsrk_key.sec_level == SMP_SEC_AUTHENTICATED) {
+                p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
+            } else {
+                p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
+            }
+
            BTM_TRACE_DEBUG("BTM_LE_KEY_LENC key_type=0x%x DIV=0x%x key_size=0x%x sec_level=0x%x",
                            p_rec->ble.key_type,
                            p_rec->ble.keys.div,
@@ -1907,7 +1917,17 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)

        /* possiblly receive connection complete with resolvable random on
           slave role while the device has been paired */
-        if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) {
+
+        /* It will cause that scanner doesn't send scan request to advertiser
+        * which has sent IRK to us and we have stored the IRK in controller.
+        * It is a design problem of hardware. The temporal solution is not to 
+        * send the key to the controller and then resolve the random address in host.
+        * so we need send the real address information to controller to connect. 
+        * Once the connection is successful, resolve device address whether it is 
+        * slave or master*/
+
+        /* if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) { */
+        if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) {
            // save the enhanced value to used in btm_ble_resolve_random_addr_on_conn_cmpl func.
            temp_enhanced = enhanced;
            btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_conn_cmpl, p_data);
@@ -1922,7 +1942,14 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
            handle = HCID_GET_HANDLE (handle);

            btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
-
+            if(role == HCI_ROLE_SLAVE) {
+                //clear p_cb->state, controller will stop adv when ble connected.
+                tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
+                if(p_cb) {
+                    p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
+                    p_cb->state = BTM_BLE_STOP_ADV; 
+                }
+            }
            l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
                              conn_latency, conn_timeout);

@@ -2066,11 +2093,7 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
                    p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
                    /* add all bonded device into resolving list if IRK is available*/
-                    /* It will cause that scanner doesn't send scan request to advertiser
-                     * which has sent IRK to us and we have stored the IRK in controller.
-                     * It is a design problem of hardware. The temporal solution is not to 
-                     * send the key to the controller and then resolve the random address in host. */
-                    //btm_ble_resolving_list_load_dev(p_dev_rec);
+                    btm_ble_resolving_list_load_dev(p_dev_rec);
 #endif
                }

@@ -596,7 +596,12 @@ void btm_ble_refresh_local_resolvable_private_addr(BD_ADDR pseudo_addr,
    BD_ADDR     dummy_bda = {0};

    if (p != NULL) {
-        if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
+/*
+ *  Temporary solutions for pair with random address:
+ *  use BLE_ADDR_RANDOM when adverting with random adress or in privacy mode
+ *  We will do futher work here
+ */
+        if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE || btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM) {
            p->conn_addr_type = BLE_ADDR_RANDOM;
            if (memcmp(local_rpa, dummy_bda, BD_ADDR_LEN)) {
                memcpy(p->conn_addr, local_rpa, BD_ADDR_LEN);
@@ -69,7 +69,7 @@ static void background_connections_lazy_init()
    }
 }

-static void background_connection_add(bt_bdaddr_t *address)
+static BOOLEAN background_connection_add(bt_bdaddr_t *address)
 {
    assert(address);
    background_connections_lazy_init();
@@ -78,14 +78,17 @@ static void background_connection_add(bt_bdaddr_t *address)
        connection = osi_calloc(sizeof(background_connection_t));
        connection->address = *address;
        hash_map_set(background_connections, &(connection->address), connection);
+        return TRUE;
    }
+    return FALSE;
 }

-static void background_connection_remove(bt_bdaddr_t *address)
+static BOOLEAN background_connection_remove(bt_bdaddr_t *address)
 {
    if (address && background_connections) {
-        hash_map_erase(background_connections, address);
+        return hash_map_erase(background_connections, address);
    }
+    return FALSE;
 }

 static void background_connections_clear()
@@ -259,20 +262,36 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBTM_ADD_W
    tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;

    if (to_add && p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_DEBUG("%s Whitelist full, unable to add device", __func__);
+        BTM_TRACE_ERROR("%s Whitelist full, unable to add device", __func__);
+        if (add_wl_cb){
+            add_wl_cb(HCI_ERR_MEMORY_FULL,to_add);
+        }
        return FALSE;
    }
-    if (add_wl_cb){
-        //save add whitelist complete callback
-        p_cb->add_wl_cb = add_wl_cb;
-    }

    if (to_add) {
        /* added the bd_addr to the connection hash map queue */
-        background_connection_add((bt_bdaddr_t *)bd_addr);
+        if(!background_connection_add((bt_bdaddr_t *)bd_addr)) {
+            /* if the bd_addr already exist in whitelist, just callback return TRUE */
+            if (add_wl_cb){
+                add_wl_cb(HCI_SUCCESS,to_add);
+            }
+            return TRUE;
+        }
    } else {
        /* remove the bd_addr to the connection hash map queue */
-        background_connection_remove((bt_bdaddr_t *)bd_addr);
+        if(!background_connection_remove((bt_bdaddr_t *)bd_addr)){
+            /* if the bd_addr don't exist in whitelist, just callback return TRUE */
+            if (add_wl_cb){
+                add_wl_cb(HCI_SUCCESS,to_add);
+            }
+            return TRUE;
+        }
+    }
+
+    if (add_wl_cb){
+        //save add whitelist complete callback
+        p_cb->add_wl_cb = add_wl_cb;
    }
    /* stop the auto connect */
    btm_suspend_wl_activity(p_cb->wl_state);
@@ -552,7 +571,7 @@ void btm_ble_initiate_select_conn(BD_ADDR bda)
    BTM_TRACE_EVENT ("btm_ble_initiate_select_conn");

    /* use direct connection procedure to initiate connection */
-    if (!L2CA_ConnectFixedChnl(L2CAP_ATT_CID, bda)) {
+    if (!L2CA_ConnectFixedChnl(L2CAP_ATT_CID, bda, BLE_ADDR_UNKNOWN_TYPE)) {
        BTM_TRACE_ERROR("btm_ble_initiate_select_conn failed");
    }
 }
@@ -501,7 +501,7 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration,
 ** Returns          status.
 **
 *******************************************************************************/
-tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
+tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK  *p_stop_adv_cback)
 {
    tBTM_STATUS status = BTM_NO_RESOURCES;
    tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
@@ -517,7 +517,13 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
        evt_type = p_cb->scan_rsp ? BTM_BLE_CONNECT_EVT : BTM_BLE_NON_CONNECT_EVT;
    }
 #endif
-
+    // if adv state is BTM_BLE_ADV_PENDING, return immediately
+    if (p_cb->state == BTM_BLE_ADV_PENDING) {
+        if (p_stop_adv_cback) {
+            (*p_stop_adv_cback)(HCI_ERR_ILLEGAL_COMMAND);
+        }
+        return BTM_BUSY;
+    }
    if (start && p_cb->adv_mode == BTM_BLE_ADV_DISABLE) {
        /* update adv params */
        if (!btsnd_hcic_ble_write_adv_params ((UINT16)(p_cb->adv_interval_min ? p_cb->adv_interval_min :
@@ -538,15 +544,22 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
        }

        status = btm_ble_start_adv ();
-    } else if (!start) {
+    } else if (!start && p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        //save the stop adv callback to the BTM env.
+        p_cb->p_stop_adv_cb = p_stop_adv_cback;
        status = btm_ble_stop_adv();
 #if BLE_PRIVACY_SPT == TRUE
        btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE);
 #endif
    } else {
-        status = BTM_WRONG_MODE;
-        BTM_TRACE_ERROR("Can not %s Broadcast, device %s in Broadcast mode",
-                        (start ? "Start" : "Stop"), (start ? "already" : "not"));
+        /*
+            1. start adv when adv has already started (not used)
+            2. stop adv shen adv has already stoped
+        */
+        status = BTM_SUCCESS;
+        if (p_stop_adv_cback) {
+            (*p_stop_adv_cback)(status);
+        }
    }
    return status;
 }
@@ -734,6 +747,30 @@ BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK
    if (!controller_get_interface()->supports_ble()) {
        return FALSE;
    }
+
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set privacy when advertising, scaning or using static random address
+ *  We will do futher work here
+ */
+    if (p_cb->privacy_mode == BTM_PRIVACY_NONE
+        && random_cb->own_addr_type == BLE_ADDR_RANDOM) {
+        BTM_TRACE_ERROR("Have set random adress, can't set privacy ");
+        if (random_cb && random_cb->set_local_privacy_cback){
+            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
+            random_cb->set_local_privacy_cback = NULL;
+        }
+        return FALSE;
+    }
+    if (!(p_cb->inq_var.state == BTM_BLE_STOP_SCAN || p_cb->inq_var.state == BTM_BLE_STOP_ADV || p_cb->inq_var.state == BTM_BLE_IDLE)) {
+        BTM_TRACE_ERROR("Advertising or scaning now, can't set privacy ");
+        if (random_cb && random_cb->set_local_privacy_cback){
+            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
+            random_cb->set_local_privacy_cback = NULL;
+        }
+        return FALSE;
+    }
+
 #if (defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE)
    uint8_t addr_resolution = 0;
 #endif  /* defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */
@@ -1152,7 +1189,7 @@ tBTM_STATUS BTM_BleSetAdvParams(UINT16 adv_int_min, UINT16 adv_int_max,
 *******************************************************************************/
 tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type,
                                        tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda,
-                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp)
+                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb)
 {
    tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
    tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
@@ -1163,8 +1200,25 @@ tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max,
        return BTM_ILLEGAL_VALUE;
    }

+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set advertising with BLE_ADDR_PUBLIC when having set random adress or in privacy mode
+ *  We will do futher work here
+ */
+    if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM && own_bda_type == BLE_ADDR_PUBLIC) {
+        BTM_TRACE_ERROR ("own_addr_type is BLE_ADDR_RANDOM but use BLE_ADDR_PUBLIC\n");
+        if(adv_cb) {
+            (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL);
+        }
+        return BTM_ILLEGAL_VALUE;
+    }
+
    if (!BTM_BLE_ISVALID_PARAM(adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
            !BTM_BLE_ISVALID_PARAM(adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+         BTM_TRACE_ERROR ("adv_int_min or adv_int_max is invalid\n");    
+        if(adv_cb) {
+            (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL);
+        }
        return BTM_ILLEGAL_VALUE;
    }

@@ -1182,14 +1236,30 @@ tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max,
    p_addr_cb->own_addr_type = own_bda_type;
    p_cb->evt_type = adv_type;
    p_cb->afp = afp;
+    p_cb->p_adv_cb = adv_cb;

    if (p_dir_bda) {
        memcpy(&p_cb->direct_bda, p_dir_bda, sizeof(tBLE_BD_ADDR));
    }

    BTM_TRACE_EVENT ("update params for an active adv\n");
-
-    btm_ble_stop_adv();
+    // if adv state is BTM_BLE_ADV_PENDING, return immediately
+    if (p_cb->state == BTM_BLE_ADV_PENDING) {
+        if (p_cb->p_adv_cb) {
+            (*p_cb->p_adv_cb)(HCI_ERR_ILLEGAL_COMMAND);
+        }
+        return BTM_BUSY;
+    }
+    /* host will stop adv first and then  start adv again if adv has already started
+       it will get callback twice.
+    */
+    if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        p_cb->adv_callback_twice = TRUE;
+    }
+    tBTM_STATUS status = btm_ble_stop_adv();
+    if (status != BTM_SUCCESS) {
+        p_cb->adv_callback_twice = FALSE;
+    }

    /* update adv params */
    btsnd_hcic_ble_write_adv_params (adv_int_min,
@@ -1312,6 +1382,19 @@ void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32
        return;
    }

+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set scan with BLE_ADDR_PUBLIC when having set random adress or in privacy mode
+ *  We will do futher work here
+ */
+    if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM && addr_type_own == BLE_ADDR_PUBLIC) {
+        BTM_TRACE_ERROR ("own_addr_type is BLE_ADDR_RANDOM but use BLE_ADDR_PUBLIC\n");
+        if (scan_setup_status_cback != NULL) {
+            scan_setup_status_cback(client_if, BTM_ILLEGAL_VALUE);
+        }
+        return;
+    }
+
    /* If not supporting extended scan support, use the older range for checking */
    if (btm_cb.cmn_ble_vsc_cb.extended_scan_support == 0) {
        max_scan_interval = BTM_BLE_SCAN_INT_MAX;
@@ -1490,16 +1573,35 @@ tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len)
 ** Returns          void
 **
 *******************************************************************************/
-BOOLEAN BTM_BleSetRandAddress(BD_ADDR rand_addr)
+tBTM_STATUS BTM_BleSetRandAddress(BD_ADDR rand_addr)
 {
-    BOOLEAN set_flag = false;
-
 	if (rand_addr == NULL)
-		return set_flag;
+		return BTM_SET_STATIC_RAND_ADDR_FAIL;

+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set rand address when advertising, scaning or in privacy mode
+ *  We will do futher work here
+ */
+#if BLE_PRIVACY_SPT == TRUE
+    if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
+        BTM_TRACE_ERROR("privacy_mode is not BTM_PRIVACY_NONE ");
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
+
+#endif
+    if (!(btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_STOP_SCAN || btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_STOP_ADV || btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_IDLE)) {
+        BTM_TRACE_ERROR("Advertising or scaning now, can't set randaddress %d", btm_cb.ble_ctr_cb.inq_var.state);
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
+    memcpy(btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr, rand_addr, BD_ADDR_LEN);
+    btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type = BLE_ADDR_RANDOM;
    //send the set random address to the controller
-    set_flag = btsnd_hcic_ble_set_random_addr(rand_addr);
-    return set_flag;
+    if(btsnd_hcic_ble_set_random_addr(rand_addr)) {
+        return BTM_SUCCESS;
+    } else {
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
 }

 /*******************************************************************************
@@ -2904,6 +3006,8 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
    UINT8               data_len;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
    BOOLEAN             match = FALSE;
+    BD_ADDR             temp_bda;
+    UINT8               temp_addr_type = 0;
 #endif

    /* Only process the results if the inquiry is still active */
@@ -2922,6 +3026,9 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
        //BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n",
        //                              bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]);
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
+        temp_addr_type = addr_type;
+        memcpy(temp_bda, bda, BD_ADDR_LEN);
+        
        /* map address to security record */
        match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE);

@@ -2932,8 +3039,16 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
            btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, p_data);
        } else
 #endif
-            btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
-
+        btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
+#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
+        //save current adv addr information if p_dev_rec!= NULL
+        tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
+        if(p_dev_rec) {
+            p_dev_rec->ble.current_addr_type = temp_addr_type;
+            memcpy(p_dev_rec->ble.current_addr, temp_bda, BD_ADDR_LEN);
+            p_dev_rec->ble.current_addr_valid = true;
+        }
+#endif
        STREAM_TO_UINT8(data_len, p);

        /* Advance to the next event data_len + rssi byte */
@@ -3294,13 +3409,13 @@ tBTM_STATUS btm_ble_start_adv(void)
 #endif
    if (p_cb->afp != AP_SCAN_CONN_ALL) {
        //find the device in the btm dev buffer and write it to the controller white list
-        btm_execute_wl_dev_operation();    
+        btm_execute_wl_dev_operation();
        btm_cb.ble_ctr_cb.wl_state |= BTM_BLE_WL_ADV;
    }

    if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE)) {
        p_cb->adv_mode = BTM_BLE_ADV_ENABLE;
-        p_cb->state = BTM_BLE_ADVERTISING;
+        p_cb->state = BTM_BLE_ADV_PENDING;
        btm_ble_adv_states_operation(btm_ble_set_topology_mask, p_cb->evt_type);
        rt = BTM_SUCCESS;
        BTM_TRACE_EVENT ("BTM_SUCCESS\n");
@@ -3329,7 +3444,7 @@ tBTM_STATUS btm_ble_stop_adv(void)
        if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) {
            p_cb->fast_adv_on = FALSE;
            p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-            p_cb->state = BTM_BLE_STOP_ADV;
+            p_cb->state = BTM_BLE_ADV_PENDING;
            btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;

            /* clear all adv states */
@@ -3469,9 +3584,13 @@ void btm_ble_read_remote_features_complete(UINT8 *p)
                if (p_acl_cb->link_role == HCI_ROLE_MASTER){
                    btsnd_hcic_rmt_ver_req (p_acl_cb->hci_handle);
                }
-
                else{
                    if (p_acl_cb->transport == BT_TRANSPORT_LE) {
+                        if (HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl_cb->peer_le_features)) {
+                            uint16_t data_length = controller_get_interface()->get_ble_default_data_packet_length();
+                            uint16_t data_txtime = controller_get_interface()->get_ble_default_data_packet_txtime();
+                            btsnd_hcic_ble_set_data_length(p_acl_cb->hci_handle, data_length, data_txtime);
+                        }
                        l2cble_notify_le_connection (p_acl_cb->remote_addr);
                    }
                }
@@ -3495,7 +3614,30 @@ void btm_ble_read_remote_features_complete(UINT8 *p)
 void btm_ble_write_adv_enable_complete(UINT8 *p)
 {
    tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
+    UINT8 status = *p;

+    // callback to the APP after receive the adv complete from the controller.
+    if (p_cb->p_adv_cb && p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        if (p_cb->adv_callback_twice) {
+            p_cb->adv_callback_twice = FALSE;
+        }else {
+            p_cb->state = BTM_BLE_ADVERTISING;
+            (*p_cb->p_adv_cb)(status);
+            p_cb->p_adv_cb = NULL;
+        }
+    } else if (p_cb->p_stop_adv_cb && p_cb->adv_mode == BTM_BLE_ADV_DISABLE) {
+        p_cb->state = BTM_BLE_STOP_ADV;
+        (*p_cb->p_stop_adv_cb)(status);
+        p_cb->p_stop_adv_cb = NULL;
+    }else {
+        // p_cb->p_adv_cb is NULL or p_cb->p_stop_adv_cb is NULL
+        if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+            p_cb->state = BTM_BLE_ADVERTISING;
+        }else {
+            p_cb->state = BTM_BLE_STOP_ADV;
+        }
+        p_cb->adv_callback_twice = FALSE;
+    }
    /* if write adv enable/disbale not succeed */
    if (*p != HCI_SUCCESS) {
        /* toggle back the adv mode */
@@ -3637,6 +3779,9 @@ void btm_ble_init (void)

    BTM_TRACE_DEBUG("%s", __func__);

+    btu_free_timer(&p_cb->obs_timer_ent);
+    btu_free_timer(&p_cb->scan_timer_ent);
+    btu_free_timer(&p_cb->inq_var.fast_adv_timer);
    memset(p_cb, 0, sizeof(tBTM_BLE_CB));
    memset(&(btm_cb.cmn_ble_vsc_cb), 0 , sizeof(tBTM_BLE_VSC_CB));
    btm_cb.cmn_ble_vsc_cb.values_read = FALSE;
@@ -765,18 +765,22 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                btm_ble_update_resolving_list(p_dev_rec->bd_addr, TRUE);
                if (controller_get_interface()->supports_ble_privacy()) {
                    BD_ADDR dummy_bda = {0};
-                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
-                    UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
-
                    if (memcmp(p_dev_rec->ble.static_addr, dummy_bda, BD_ADDR_LEN) == 0) {
                        memcpy(p_dev_rec->ble.static_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
                        p_dev_rec->ble.static_addr_type = p_dev_rec->ble.ble_addr_type;
                    }
-
+                    /* It will cause that scanner doesn't send scan request to advertiser
+                     * which has sent IRK to us and we have stored the IRK in controller.
+                     * It is a design problem of hardware. The temporal solution is not to 
+                     * send the key to the controller and then resolve the random address in host. */
+                    /*
                    BTM_TRACE_DEBUG("%s:adding device to controller resolving list\n", __func__);
-                    // use identical IRK for now
+                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
+                    UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
+                    //use identical IRK for now
                    rt = btsnd_hcic_ble_add_device_resolving_list(p_dev_rec->ble.static_addr_type,
-                            p_dev_rec->ble.static_addr, peer_irk, local_irk);
+                           p_dev_rec->ble.static_addr, peer_irk, local_irk);
+                    */
                } else {
                    UINT8 param[40] = {0};
                    UINT8 *p = param;
@@ -807,7 +811,7 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                }
            }
        } else {
-            BTM_TRACE_ERROR("Device already in Resolving list\n");
+            BTM_TRACE_DEBUG("Device already in Resolving list\n");
            rt = TRUE;
        }
    } else {
@@ -533,7 +533,7 @@ void btm_read_local_name_complete (UINT8 *p, UINT16 evt_len)
    UINT8           status;
    UNUSED(evt_len);

-    btu_stop_timer (&btm_cb.devcb.rln_timer);
+    btu_free_timer (&btm_cb.devcb.rln_timer);

    /* If there was a callback address for read local name, call it */
    btm_cb.devcb.p_rln_cmpl_cb = NULL;
@@ -1359,6 +1359,12 @@ void btm_inq_db_init (void)
 #if 0  /* cleared in btm_init; put back in if called from anywhere else! */
    memset (&btm_cb.btm_inq_vars, 0, sizeof (tBTM_INQUIRY_VAR_ST));
 #endif
+
+    btu_free_timer(&btm_cb.btm_inq_vars.rmt_name_timer_ent);
+    memset(&btm_cb.btm_inq_vars.rmt_name_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+    btu_free_timer(&btm_cb.btm_inq_vars.inq_timer_ent);
+    memset(&btm_cb.btm_inq_vars.inq_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+
    btm_cb.btm_inq_vars.no_inc_ssp = BTM_NO_SSP_ON_INQUIRY;
 }

@@ -2763,7 +2763,9 @@ void btm_sec_check_pending_reqs (void)
        /* Now, re-submit anything in the mux queue */
        bq = btm_cb.sec_pending_q;

-        btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+        if (!btm_cb.sec_pending_q) {
+            btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+        }

        while ((p_e = (tBTM_SEC_QUEUE_ENTRY *)fixed_queue_try_dequeue(bq)) != NULL) {
            /* Check that the ACL is still up before starting security procedures */
@@ -498,6 +498,32 @@ void btu_stop_timer(TIMER_LIST_ENT *p_tle)
    osi_alarm_cancel(alarm);
 }

+
+/*******************************************************************************
+**
+** Function         btu_free_timer
+**
+** Description      Stop and free a timer.
+**
+** Returns          void
+**
+*******************************************************************************/
+void btu_free_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    p_tle->in_use = FALSE;
+
+    // Get the alarm for the timer list entry.
+    osi_alarm_t *alarm = hash_map_get(btu_general_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s Unable to find expected alarm in hashmap", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(btu_general_alarm_hash_map, p_tle);
+}
+
 #if defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0)
 /*******************************************************************************
 **
@@ -585,6 +611,23 @@ void btu_stop_quick_timer(TIMER_LIST_ENT *p_tle)
    }
    osi_alarm_cancel(alarm);
 }
+
+void btu_free_quick_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    p_tle->in_use = FALSE;
+
+    // Get the alarm for the timer list entry.
+    osi_alarm_t *alarm = hash_map_get(btu_l2cap_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s Unable to find expected alarm in hashmap", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(btu_l2cap_alarm_hash_map, p_tle);
+}
+
 #endif /* defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0) */

 void btu_oneshot_alarm_cb(void *data)
@@ -694,7 +694,7 @@ BOOLEAN gap_ble_accept_cl_operation(BD_ADDR peer_bda, UINT16 uuid, tGAP_BLE_CMPL
    }

    /* hold the link here */
-    if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, TRUE, BT_TRANSPORT_LE)) {
+    if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BT_TRANSPORT_LE)) {
        return started;
    }

@@ -1337,12 +1337,13 @@ void GATT_StartIf (tGATT_IF gatt_if)
 **
 ** Parameters       gatt_if: applicaiton interface
 **                  bd_addr: peer device address.
+**                  bd_addr_type: peer device address type.
 **                  is_direct: is a direct conenection or a background auto connection
 **
 ** Returns          TRUE if connection started; FALSE if connection start failure.
 **
 *******************************************************************************/
-BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, BOOLEAN is_direct, tBT_TRANSPORT transport)
+BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, BOOLEAN is_direct, tBT_TRANSPORT transport)
 {
    tGATT_REG    *p_reg;
    BOOLEAN status = FALSE;
@@ -1356,7 +1357,7 @@ BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, BOOLEAN is_direct, tBT_
    }

    if (is_direct) {
-        status = gatt_act_connect (p_reg, bd_addr, transport);
+        status = gatt_act_connect (p_reg, bd_addr, bd_addr_type, transport);
    } else {
        if (transport == BT_TRANSPORT_LE) {
            status = gatt_update_auto_connect_dev(gatt_if, TRUE, bd_addr, TRUE);
@@ -494,7 +494,7 @@ void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable, tBT_TRANSP
        p_clcb->connected = TRUE;
    }
    /* hold the link here */
-    GATT_Connect(gatt_cb.gatt_if, remote_bda, TRUE, transport);
+    GATT_Connect(gatt_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, transport);
    p_clcb->ccc_stage = GATT_SVC_CHANGED_CONNECTING;

    if (!p_clcb->connected) {
@@ -586,7 +586,7 @@ void gatt_process_prep_write_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op
    tGATT_VALUE  value = {0};
    UINT8        *p = p_data;

-    GATT_TRACE_ERROR("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);
+    GATT_TRACE_DEBUG("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);

    if (len < GATT_PREP_WRITE_RSP_MIN_LEN) {
        GATT_TRACE_ERROR("illegal prepare write response length, discard");
@@ -988,8 +988,10 @@ void gatt_process_mtu_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT16 len, UINT
            p_tcb->payload_size = mtu;
        }
    }
-
-    l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+    /* host will set packet data length to 251 automatically if remote device support set packet data length,
+       so l2cble_set_fixed_channel_tx_data_length() is not necessary.
+       l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+    */
    gatt_end_operation(p_clcb, status, NULL);
 }
 /*******************************************************************************
@@ -172,6 +172,12 @@ void gatt_free(void)
        fixed_queue_free(gatt_cb.tcb[i].pending_ind_q, NULL);
        gatt_cb.tcb[i].pending_ind_q = NULL;

+        btu_free_timer(&gatt_cb.tcb[i].conf_timer_ent);
+        memset(&gatt_cb.tcb[i].conf_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+
+        btu_free_timer(&gatt_cb.tcb[i].ind_ack_timer_ent);
+        memset(&gatt_cb.tcb[i].ind_ack_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+    
        fixed_queue_free(gatt_cb.tcb[i].sr_cmd.multi_rsp_q, NULL);
        gatt_cb.tcb[i].sr_cmd.multi_rsp_q = NULL;
    }
@@ -189,11 +195,11 @@ void gatt_free(void)
 ** Description      This function is called to initiate a connection to a peer device.
 **
 ** Parameter        rem_bda: remote device address to connect to.
-**
+**                  bd_addr_type: emote device address type.
 ** Returns          TRUE if connection is started, otherwise return FALSE.
 **
 *******************************************************************************/
-BOOLEAN gatt_connect (BD_ADDR rem_bda, tGATT_TCB *p_tcb, tBT_TRANSPORT transport)
+BOOLEAN gatt_connect (BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type, tGATT_TCB *p_tcb, tBT_TRANSPORT transport)
 {
    BOOLEAN             gatt_ret = FALSE;

@@ -203,7 +209,7 @@ BOOLEAN gatt_connect (BD_ADDR rem_bda, tGATT_TCB *p_tcb, tBT_TRANSPORT transport

    if (transport == BT_TRANSPORT_LE) {
        p_tcb->att_lcid = L2CAP_ATT_CID;
-        gatt_ret = L2CA_ConnectFixedChnl (L2CAP_ATT_CID, rem_bda);
+        gatt_ret = L2CA_ConnectFixedChnl (L2CAP_ATT_CID, rem_bda, bd_addr_type);
 #if (CLASSIC_BT_INCLUDED == TRUE)
    } else {
        if ((p_tcb->att_lcid = L2CA_ConnectReq(BT_PSM_ATT, rem_bda)) != 0) {
@@ -348,7 +354,7 @@ void gatt_update_app_use_link_flag (tGATT_IF gatt_if, tGATT_TCB *p_tcb, BOOLEAN
 ** Returns          void.
 **
 *******************************************************************************/
-BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT transport)
+BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, tBT_TRANSPORT transport)
 {
    BOOLEAN     ret = FALSE;
    tGATT_TCB   *p_tcb;
@@ -361,7 +367,7 @@ BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT trans
        /* before link down, another app try to open a GATT connection */
        if (st == GATT_CH_OPEN &&  gatt_num_apps_hold_link(p_tcb) == 0 &&
                transport == BT_TRANSPORT_LE ) {
-            if (!gatt_connect(bd_addr,  p_tcb, transport)) {
+            if (!gatt_connect(bd_addr, bd_addr_type, p_tcb, transport)) {
                ret = FALSE;
            }
        } else if (st == GATT_CH_CLOSING) {
@@ -370,7 +376,7 @@ BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT trans
        }
    } else {
        if ((p_tcb = gatt_allocate_tcb_by_bdaddr(bd_addr, transport)) != NULL) {
-            if (!gatt_connect(bd_addr,  p_tcb, transport)) {
+            if (!gatt_connect(bd_addr, bd_addr_type, p_tcb, transport)) {
                GATT_TRACE_ERROR("gatt_connect failed");
                fixed_queue_free(p_tcb->pending_enc_clcb, NULL);
                fixed_queue_free(p_tcb->pending_ind_q, NULL);
@@ -359,6 +359,7 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
    tGATT_IF gatt_if;
    UINT16  conn_id;
    UINT16  queue_num = 0;
+    BOOLEAN is_first = TRUE;
    BOOLEAN is_prepare_write_valid = FALSE;
    BOOLEAN is_need_dequeue_sr_cmd = FALSE;
    tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
@@ -420,6 +421,11 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
        queue_data = fixed_queue_dequeue(prepare_record->queue);
        if (is_prepare_write_valid){
            if((queue_data->p_attr->p_value != NULL) && (queue_data->p_attr->p_value->attr_val.attr_val != NULL)){
+                if(is_first) {
+                    //clear attr_val.attr_len before handle prepare write data
+                    queue_data->p_attr->p_value->attr_val.attr_len = 0;
+                    is_first = FALSE;
+                }
                memcpy(queue_data->p_attr->p_value->attr_val.attr_val+queue_data->offset, queue_data->value, queue_data->len);
                //don't forget to increase the attribute value length in the gatts database.
                queue_data->p_attr->p_value->attr_val.attr_len += queue_data->len;
@@ -949,7 +955,10 @@ static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
            p_tcb->payload_size = mtu;
        }

-        l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+        /* host will set packet data length to 251 automatically if remote device support set packet data length,
+            so l2cble_set_fixed_channel_tx_data_length() is not necessary.
+            l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+        */

        if ((p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, (tGATT_SR_MSG *) &p_tcb->payload_size)) != NULL) {
            attp_send_sr_msg (p_tcb, p_buf);
@@ -1683,6 +1683,7 @@ tGATT_CLCB *gatt_clcb_alloc (UINT16 conn_id)
 void gatt_clcb_dealloc (tGATT_CLCB *p_clcb)
 {
    if (p_clcb && p_clcb->in_use) {
+        btu_free_timer(&p_clcb->rsp_timer_ent);
        memset(p_clcb, 0, sizeof(tGATT_CLCB));
    }
 }
@@ -1997,6 +1998,29 @@ BOOLEAN gatt_find_app_hold_link(tGATT_TCB *p_tcb, UINT8 start_idx, UINT8 *p_foun
    return found;
 }

+/*******************************************************************************
+**
+** Function         gatt_find_specific_app_in_hold_link
+**
+** Description      find the specific applicaiton that is holding the specified link
+**
+** Returns         Boolean
+**
+*******************************************************************************/
+BOOLEAN gatt_find_specific_app_in_hold_link(tGATT_TCB *p_tcb, tGATT_IF p_gatt_if)
+{
+    UINT8 i;
+    BOOLEAN found = FALSE;
+
+    for (i = 0; i < GATT_MAX_APPS; i ++) {
+        if (p_tcb->app_hold_link[i] && p_tcb->app_hold_link[i] == p_gatt_if) {
+            found = TRUE;
+            break;
+        }
+    }
+    return found;
+}
+
 /*******************************************************************************
 **
 ** Function         gatt_cmd_enq
@@ -2211,8 +2235,8 @@ void gatt_cleanup_upon_disc(BD_ADDR bda, UINT16 reason, tBT_TRANSPORT transport)
            }
        }

-        btu_stop_timer (&p_tcb->ind_ack_timer_ent);
-        btu_stop_timer (&p_tcb->conf_timer_ent);
+        btu_free_timer (&p_tcb->ind_ack_timer_ent);
+        btu_free_timer (&p_tcb->conf_timer_ent);
        gatt_free_pending_ind(p_tcb);
        gatt_free_pending_enc_queue(p_tcb);
        gatt_free_pending_prepare_write_queue(p_tcb);
@@ -572,8 +572,8 @@ extern void gatt_free(void);

 /* from gatt_main.c */
 extern BOOLEAN gatt_disconnect (tGATT_TCB *p_tcb);
-extern BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT transport);
-extern BOOLEAN gatt_connect (BD_ADDR rem_bda,  tGATT_TCB *p_tcb, tBT_TRANSPORT transport);
+extern BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, tBT_TRANSPORT transport);
+extern BOOLEAN gatt_connect (BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type, tGATT_TCB *p_tcb, tBT_TRANSPORT transport);
 extern void gatt_data_process (tGATT_TCB *p_tcb, BT_HDR *p_buf);
 extern void gatt_update_app_use_link_flag ( tGATT_IF gatt_if, tGATT_TCB *p_tcb, BOOLEAN is_add, BOOLEAN check_acl_link);

@@ -682,6 +682,7 @@ extern void gatt_sr_update_cback_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN
 extern void gatt_sr_update_prep_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN is_inc, BOOLEAN is_reset_first);

 extern BOOLEAN gatt_find_app_hold_link(tGATT_TCB *p_tcb, UINT8 start_idx, UINT8 *p_found_idx, tGATT_IF *p_gatt_if);
+extern BOOLEAN gatt_find_specific_app_in_hold_link(tGATT_TCB *p_tcb, tGATT_IF p_gatt_if);
 extern UINT8 gatt_num_apps_hold_link(tGATT_TCB *p_tcb);
 extern UINT8 gatt_num_clcb_by_bd_addr(BD_ADDR bda);
 extern tGATT_TCB *gatt_find_tcb_by_cid(UINT16 lcid);
@@ -499,6 +499,8 @@ typedef struct {
 #define BLE_ADDR_RANDOM         0x01
 #define BLE_ADDR_PUBLIC_ID      0x02
 #define BLE_ADDR_RANDOM_ID      0x03
+#define BLE_ADDR_TYPE_MAX       BLE_ADDR_RANDOM_ID
+#define BLE_ADDR_UNKNOWN_TYPE   0XFF
 typedef UINT8 tBLE_ADDR_TYPE;
 #define BLE_ADDR_TYPE_MASK      (BLE_ADDR_RANDOM | BLE_ADDR_PUBLIC)

@@ -72,6 +72,8 @@ enum {
    BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED,/* 22 controller setting data length is unsupported*/
    BTM_SET_PRIVACY_SUCCESS,            /* 23 enable/disable local privacy success */
    BTM_SET_PRIVACY_FAIL,               /* 24 enable/disable local privacy failed*/
+    BTM_SET_STATIC_RAND_ADDR_FAIL,      /* 25 Command failed */
+    BTM_INVALID_STATIC_RAND_ADDR,       /* 26 invalid static rand addr */
 };

 typedef uint8_t tBTM_STATUS;
@@ -182,6 +184,8 @@ typedef void (tBTM_UPDATE_CONN_PARAM_CBACK) (UINT8 status, BD_ADDR bd_addr, tBTM

 typedef void (tBTM_SET_PKT_DATA_LENGTH_CBACK) (UINT8 status, tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS *data_length_params);

+typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status);
+
 typedef void (tBTM_ADD_WHITELIST_CBACK) (UINT8 status, tBTM_WL_OPERATION wl_opration);

 typedef void (tBTM_SET_LOCAL_PRIVACY_CBACK) (UINT8 status);
@@ -852,6 +852,11 @@ typedef void (*tBLE_SCAN_PARAM_SETUP_CBACK)(tGATT_IF client_if, tBTM_STATUS stat

 tBTM_BLE_SCAN_SETUP_CBACK bta_ble_scan_setup_cb;

+typedef void (tBTM_START_ADV_CMPL_CBACK) (UINT8 status);
+typedef void (tBTM_START_STOP_ADV_CMPL_CBACK) (UINT8 status);
+
+
+
 /*****************************************************************************
 **  EXTERNAL FUNCTION DECLARATIONS
 *****************************************************************************/
@@ -943,7 +948,7 @@ tBTM_STATUS BTM_BleSetAdvParams(UINT16 adv_int_min, UINT16 adv_int_max,
 *******************************************************************************/
 tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type,
                                        tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda,
-                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp);
+                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb);


 /*******************************************************************************
@@ -977,7 +982,7 @@ tBTM_STATUS BTM_BleWriteAdvData(tBTM_BLE_AD_MASK  data_mask,
 tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len);


-BOOLEAN BTM_BleSetRandAddress(BD_ADDR rand_addr);
+tBTM_STATUS BTM_BleSetRandAddress(BD_ADDR rand_addr);


 /*******************************************************************************
@@ -1610,7 +1615,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda,
 **
 *******************************************************************************/
 //extern
-tBTM_STATUS BTM_BleBroadcast(BOOLEAN start);
+tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback);

 /*******************************************************************************
 **
@@ -104,6 +104,7 @@ typedef UINT8   tBTM_BLE_SEC_REQ_ACT;
 #define BTM_VSC_CHIP_CAPABILITY_M_VERSION 95

 typedef enum {
+    BTM_BLE_IDLE,
    BTM_BLE_SCANNING,
    BTM_BLE_SCAN_PENDING,
    BTM_BLE_STOP_SCAN,
@@ -147,8 +148,10 @@ typedef struct {
    UINT16 adv_interval_max;
    tBTM_BLE_AFP afp; /* advertising filter policy */
    tBTM_BLE_SFP sfp; /* scanning filter policy */
-
+    tBTM_START_ADV_CMPL_CBACK *p_adv_cb;
+    tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cb;
    tBLE_ADDR_TYPE adv_addr_type;
+    BOOLEAN adv_callback_twice;
    UINT8 evt_type;
    UINT8 adv_mode;
    tBLE_BD_ADDR direct_bda;
@@ -319,7 +322,6 @@ typedef struct {
    UINT32 scan_int;
    UINT32 scan_win;
    tBTM_BLE_SEL_CBACK *p_select_cback;
-
    /* white list information */
    UINT8 white_list_avail_size;
    tBTM_ADD_WHITELIST_CBACK *add_wl_cb;
@@ -486,6 +486,11 @@ typedef struct {
    tBTM_LE_KEY_TYPE    key_type;       /* bit mask of valid key types in record */
    tBTM_SEC_BLE_KEYS   keys;           /* LE device security info in slave rode */
 #endif
+#if (BLE_PRIVACY_SPT == TRUE)
+    tBLE_ADDR_TYPE      current_addr_type; /* current adv addr type*/  
+    BD_ADDR             current_addr;      /* current adv addr*/
+    bool                current_addr_valid; /* current addr info is valid or not*/
+#endif   
 } tBTM_SEC_BLE;


@@ -234,6 +234,7 @@ extern const BD_ADDR        BT_BD_ANY;
 */
 void btu_start_timer (TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout);
 void btu_stop_timer (TIMER_LIST_ENT *p_tle);
+void btu_free_timer (TIMER_LIST_ENT *p_tle);
 void btu_start_timer_oneshot(TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout);
 void btu_stop_timer_oneshot(TIMER_LIST_ENT *p_tle);

@@ -245,6 +246,7 @@ void btu_uipc_rx_cback(BT_HDR *p_msg);
 #if defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0)
 void btu_start_quick_timer (TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout);
 void btu_stop_quick_timer (TIMER_LIST_ENT *p_tle);
+void btu_free_quick_timer (TIMER_LIST_ENT *p_tle);
 void btu_process_quick_timer_evt (void);
 #endif

@@ -1097,13 +1097,14 @@ extern  void GATT_StartIf (tGATT_IF gatt_if);
 **
 ** Parameters       gatt_if: applicaiton interface
 **                  bd_addr: peer device address.
+**                  bd_addr_type: peer device address type.
 **                  is_direct: is a direct conenection or a background auto connection
 **                  transport : Physical transport for GATT connection (BR/EDR or LE)
 **
 ** Returns          TRUE if connection started; FALSE if connection start failure.
 **
 *******************************************************************************/
-extern BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr,
+extern BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type,
                             BOOLEAN is_direct, tBT_TRANSPORT transport);


@@ -792,6 +792,9 @@

 #define HCI_ERR_MAX_ERR                                 0x43

+//ESP vendor error code
+#define HCI_ERR_ESP_VENDOR_FAIL                         0xE0               
+
 #define HCI_HINT_TO_RECREATE_AMP_PHYS_LINK              0xFF

 /*
@@ -1079,11 +1079,12 @@ extern BOOLEAN  L2CA_RegisterFixedChannel (UINT16 fixed_cid, tL2CAP_FIXED_CHNL_R
 **
 **  Parameters:     Fixed CID
 **                  BD Address of remote
+**                  BD Address type
 **
 **  Return value:   TRUE if connection started
 **
 *******************************************************************************/
-extern BOOLEAN L2CA_ConnectFixedChnl (UINT16 fixed_cid, BD_ADDR bd_addr);
+extern BOOLEAN L2CA_ConnectFixedChnl (UINT16 fixed_cid, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type);

 /*******************************************************************************
 **
@@ -422,6 +422,7 @@ typedef struct t_l2c_linkcb {

    tBT_TRANSPORT       transport;
 #if (BLE_INCLUDED == TRUE)
+    tBLE_ADDR_TYPE      open_addr_type; /* be set by open API */
    tBLE_ADDR_TYPE      ble_addr_type;
    UINT16              tx_data_len;            /* tx data length used in data length extension */
    fixed_queue_t       *le_sec_pending_q;      /* LE coc channels waiting for security check completion */
@@ -767,7 +768,7 @@ extern BOOLEAN  l2c_fcr_renegotiate_chan(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg
 extern UINT8    l2c_fcr_process_peer_cfg_req(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg);
 extern void     l2c_fcr_adj_monitor_retran_timeout (tL2C_CCB *p_ccb);
 extern void     l2c_fcr_stop_timer (tL2C_CCB *p_ccb);
-
+extern void     l2c_fcr_free_timer (tL2C_CCB *p_ccb);
 /* Functions provided by l2c_ble.c
 ************************************
 */
@@ -1631,11 +1631,12 @@ BOOLEAN  L2CA_RegisterFixedChannel (UINT16 fixed_cid, tL2CAP_FIXED_CHNL_REG *p_f
 **
 **  Parameters:     Fixed CID
 **                  BD Address of remote
+**                  BD Address type
 **
 **  Return value:   TRUE if connection started
 **
 *******************************************************************************/
-BOOLEAN L2CA_ConnectFixedChnl (UINT16 fixed_cid, BD_ADDR rem_bda)
+BOOLEAN L2CA_ConnectFixedChnl (UINT16 fixed_cid, BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type)
 {
    tL2C_LCB *p_lcb;
    tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
@@ -1723,7 +1724,9 @@ BOOLEAN L2CA_ConnectFixedChnl (UINT16 fixed_cid, BD_ADDR rem_bda)
        l2cu_release_lcb (p_lcb);
        return FALSE;
    }
-
+#if (BLE_INCLUDED == TRUE)
+    p_lcb->open_addr_type = bd_addr_type;
+#endif
    if (!l2cu_create_conn(p_lcb, transport)) {
        L2CAP_TRACE_WARNING ("%s() - create_conn failed", __func__);
        l2cu_release_lcb (p_lcb);
@@ -766,6 +766,15 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len)
 *******************************************************************************/
 BOOLEAN l2cble_init_direct_conn (tL2C_LCB *p_lcb)
 {
+#if ( (defined BLE_PRIVACY_SPT) && (BLE_PRIVACY_SPT == TRUE))
+    //check for security device information in the cache
+    bool dev_rec_exist = true;
+    tBTM_SEC_DEV_REC *find_dev_rec = btm_find_dev (p_lcb->remote_bd_addr);
+    if(find_dev_rec == NULL) {
+        dev_rec_exist = false;
+    }
+
+#endif
    tBTM_SEC_DEV_REC *p_dev_rec = btm_find_or_alloc_dev (p_lcb->remote_bd_addr);
    tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
    UINT16 scan_int;
@@ -788,6 +797,26 @@ BOOLEAN l2cble_init_direct_conn (tL2C_LCB *p_lcb)

 #if ( (defined BLE_PRIVACY_SPT) && (BLE_PRIVACY_SPT == TRUE))
    own_addr_type = btm_cb.ble_ctr_cb.privacy_mode ? BLE_ADDR_RANDOM : BLE_ADDR_PUBLIC;
+    if(dev_rec_exist) {
+        // if the current address information is valid, get the real address information
+        if(p_dev_rec->ble.current_addr_valid) {
+            peer_addr_type = p_dev_rec->ble.current_addr_type;
+            memcpy(peer_addr, p_dev_rec->ble.current_addr, 6);
+        } else {
+            /* find security device information but not find the real address information
+             * This state may be directly open whithout scanning. In this case, you must 
+             * use the current adv address of the device to open*/
+        } 
+    } else {
+        //not find security device information, We think this is a new device, connect directly
+    }
+
+    /* It will cause that scanner doesn't send scan request to advertiser
+    * which has sent IRK to us and we have stored the IRK in controller.
+    * It is a design problem of hardware. The temporal solution is not to 
+    * send the key to the controller and then resolve the random address in host.
+    * so we need send the real address information to controller. */
+    /*
    if (p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) {
        if (btm_cb.ble_ctr_cb.privacy_mode >=  BTM_PRIVACY_1_2) {
            own_addr_type |= BLE_ADDR_TYPE_ID_BIT;
@@ -798,6 +827,7 @@ BOOLEAN l2cble_init_direct_conn (tL2C_LCB *p_lcb)
    } else {
        btm_ble_disable_resolving_list(BTM_BLE_RL_INIT, TRUE);
    }
+    */
 #endif

    if (!btm_ble_topology_check(BTM_BLE_STATE_INIT)) {
@@ -1025,10 +1055,16 @@ void l2cble_process_rc_param_request_evt(UINT16 handle, UINT16 int_min, UINT16 i
        if ((p_lcb->conn_update_mask & L2C_BLE_CONN_UPDATE_DISABLE) == 0) {
            p_lcb->conn_update_mask |= L2C_BLE_UPDATE_PENDING;
            btsnd_hcic_ble_rc_param_req_reply(handle, int_min, int_max, latency, timeout, 0, 0);
-        } else {
-            L2CAP_TRACE_EVENT ("L2CAP - LE - update currently disabled");
-            p_lcb->conn_update_mask |= L2C_BLE_NEW_CONN_PARAM;
-            btsnd_hcic_ble_rc_param_req_neg_reply (handle, HCI_ERR_UNACCEPT_CONN_INTERVAL);
+        }else {
+            /* always accept connection parameters request which is sent by itself */
+            if (int_max == BTM_BLE_CONN_INT_MIN) {
+                p_lcb->conn_update_mask |= L2C_BLE_UPDATE_PENDING;
+                btsnd_hcic_ble_rc_param_req_reply(handle, int_min, int_max, latency, timeout, 0, 0);
+            }else {
+                L2CAP_TRACE_EVENT ("L2CAP - LE - update currently disabled");
+                p_lcb->conn_update_mask |= L2C_BLE_NEW_CONN_PARAM;
+                btsnd_hcic_ble_rc_param_req_neg_reply (handle, HCI_ERR_UNACCEPT_CONN_INTERVAL);
+            }
        }

    } else {
@@ -201,6 +201,21 @@ void l2c_fcr_stop_timer (tL2C_CCB *p_ccb)
    }
 }

+/*******************************************************************************
+**
+** Function         l2c_fcr_free_timer
+**
+** Description      This function releases the (monitor or transmission) timer.
+**
+** Returns          -
+**
+*******************************************************************************/
+void l2c_fcr_free_timer (tL2C_CCB *p_ccb)
+{
+    assert(p_ccb != NULL);
+    btu_free_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
+}
+
 /*******************************************************************************
 **
 ** Function         l2c_fcr_cleanup
@@ -232,9 +247,12 @@ void l2c_fcr_cleanup (tL2C_CCB *p_ccb)
    fixed_queue_free(p_fcrb->retrans_q, osi_free_func);
    p_fcrb->retrans_q = NULL;
 	
-    btu_stop_quick_timer (&p_fcrb->ack_timer);
-    btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
-
+    btu_free_quick_timer (&p_fcrb->ack_timer);
+    memset(&p_fcrb->ack_timer, 0, sizeof(TIMER_LIST_ENT));
+    
+    btu_free_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
+    memset(&p_fcrb->mon_retrans_timer, 0, sizeof(TIMER_LIST_ENT));
+    
 #if (L2CAP_ERTM_STATS == TRUE)
    if ( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID) && (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) ) {
        UINT32  dur = osi_time_get_os_boottime_ms() - p_ccb->fcrb.connect_tick_count;
@@ -54,8 +54,11 @@ tL2C_LCB *l2cu_allocate_lcb (BD_ADDR p_bd_addr, BOOLEAN is_bonding, tBT_TRANSPOR

    for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_lcb++) {
        if (!p_lcb->in_use) {
+            btu_free_timer(&p_lcb->timer_entry);
+            btu_free_timer(&p_lcb->info_timer_entry);
+            btu_free_timer(&p_lcb->upda_con_timer);
+            
            memset (p_lcb, 0, sizeof (tL2C_LCB));
-
            memcpy (p_lcb->remote_bd_addr, p_bd_addr, BD_ADDR_LEN);

            p_lcb->in_use          = TRUE;
@@ -127,10 +130,14 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb)
    p_lcb->in_use     = FALSE;
    p_lcb->is_bonding = FALSE;

-    /* Stop timers */
-    btu_stop_timer (&p_lcb->timer_entry);
-    btu_stop_timer (&p_lcb->info_timer_entry);
-
+    /* Stop and release timers */
+    btu_free_timer (&p_lcb->timer_entry);
+    memset(&p_lcb->timer_entry, 0, sizeof(TIMER_LIST_ENT));
+    btu_free_timer (&p_lcb->info_timer_entry);
+    memset(&p_lcb->info_timer_entry, 0, sizeof(TIMER_LIST_ENT));
+    btu_free_timer(&p_lcb->upda_con_timer);
+    memset(&p_lcb->upda_con_timer, 0, sizeof(TIMER_LIST_ENT));
+        
    /* Release any unfinished L2CAP packet on this link */
    if (p_lcb->p_hcit_rcv_acl) {
        osi_free(p_lcb->p_hcit_rcv_acl);
@@ -1476,25 +1483,24 @@ tL2C_CCB *l2cu_allocate_ccb (tL2C_LCB *p_lcb, UINT16 cid)
    memset (&p_ccb->ertm_info, 0, sizeof(tL2CAP_ERTM_INFO));
    p_ccb->peer_cfg_already_rejected = FALSE;
    p_ccb->fcr_cfg_tries         = L2CAP_MAX_FCR_CFG_TRIES;
+
+    /* stop and release timers */
+    btu_free_quick_timer(&p_ccb->fcrb.ack_timer);
+    memset(&p_ccb->fcrb.ack_timer, 0, sizeof(TIMER_LIST_ENT));
    p_ccb->fcrb.ack_timer.param  = (TIMER_PARAM_TYPE)p_ccb;
-
-    /* if timer is running, remove it from timer list */
-    if (p_ccb->fcrb.ack_timer.in_use) {
-        btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
-    }
-
+    
+    btu_free_quick_timer(&p_ccb->fcrb.mon_retrans_timer);
+    memset(&p_ccb->fcrb.mon_retrans_timer, 0, sizeof(TIMER_LIST_ENT));
    p_ccb->fcrb.mon_retrans_timer.param  = (TIMER_PARAM_TYPE)p_ccb;

 // btla-specific ++
    /*  CSP408639 Fix: When L2CAP send amp move channel request or receive
      * L2CEVT_AMP_MOVE_REQ do following sequence. Send channel move
      * request -> Stop retrans/monitor timer -> Change channel state to CST_AMP_MOVING. */
-    if (p_ccb->fcrb.mon_retrans_timer.in_use) {
-        btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
-    }
 // btla-specific --
+
 #if (CLASSIC_BT_INCLUDED == TRUE)
-    l2c_fcr_stop_timer (p_ccb);
+    l2c_fcr_free_timer (p_ccb);
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
    p_ccb->ertm_info.preferred_mode  = L2CAP_FCR_BASIC_MODE;        /* Default mode for channel is basic mode */
    p_ccb->ertm_info.allowed_modes   = L2CAP_FCR_CHAN_OPT_BASIC;    /* Default mode for channel is basic mode */
@@ -1531,6 +1537,8 @@ tL2C_CCB *l2cu_allocate_ccb (tL2C_LCB *p_lcb, UINT16 cid)
    p_ccb->is_flushable = FALSE;
 #endif

+    btu_free_timer(&p_ccb->timer_entry);
+    memset(&p_ccb->timer_entry, 0, sizeof(TIMER_LIST_ENT));
    p_ccb->timer_entry.param = (TIMER_PARAM_TYPE)p_ccb;
    p_ccb->timer_entry.in_use = 0;

@@ -1628,9 +1636,8 @@ void l2cu_release_ccb (tL2C_CCB *p_ccb)
        btm_sec_clr_temp_auth_service (p_lcb->remote_bd_addr);
    }

-    /* Stop the timer */
-    btu_stop_timer (&p_ccb->timer_entry);
-
+    /* Stop and free the timer */
+    btu_free_timer (&p_ccb->timer_entry);

    fixed_queue_free(p_ccb->xmit_hold_q, osi_free_func);
    p_ccb->xmit_hold_q = NULL;
@@ -2195,9 +2202,7 @@ BOOLEAN l2cu_create_conn (tL2C_LCB *p_lcb, tBT_TRANSPORT transport)

 #if (BLE_INCLUDED == TRUE)
    tBT_DEVICE_TYPE     dev_type;
-    tBLE_ADDR_TYPE      addr_type;
-
-
+    tBLE_ADDR_TYPE      addr_type = p_lcb->open_addr_type;
    BTM_ReadDevInfo(p_lcb->remote_bd_addr, &dev_type, &addr_type);

    if (transport == BT_TRANSPORT_LE) {
--- a/Show More
+++ b/Show More