Merge branch 'bugfix/bootloader_iram_overlap_check_v3.1' into 'release/v3.1'

bootloader: verify that loaded image does not overlap bootloader code (backport v3.1) See merge request idf/esp-idf!3526
bootloader: Fix crash enabling flash encryption
2026-06-15 13:52:20 +02:00 · 2018-11-01 16:40:26 +08:00 · 2018-11-01 14:14:18 +08:00 · 2018-11-01 14:14:00 +08:00 · 2018-10-31 13:21:42 +08:00 · 2018-10-30 10:59:39 +11:00
826 changed files with 31764 additions and 5787 deletions
@@ -32,3 +32,8 @@ insert_final_newline = false

 [*.py]
 max_line_length = 119
+
+[{*.cmake,CMakeLists.txt}]
+indent_style = space
+indent_size = 4
+max_line_length = 120
@@ -52,4 +52,11 @@ examples/protocols/aws_iot/*/main/certs/*.pem.*
 coverage.info
 coverage_report/

+# Windows tools installer build
+tools/windows/tool_setup/.*
+tools/windows/tool_setup/input
+tools/windows/tool_setup/dl
+tools/windows/tool_setup/Output
+
 test_multi_heap_host
+
@@ -1,10 +1,11 @@
 stages:
  - build
  - assign_test
+  - host_test
  - unit_test
-  - test
-  - test_report
+  - integration_test
  - deploy
+  - post_check

 variables:
 # System environment
@@ -49,6 +50,7 @@ variables:
  python $APPLY_BOT_FILTER_SCRIPT || exit 0

 before_script:
+  - source tools/ci/setup_python.sh
  - *git_clean_stale_submodules
  # apply bot filter in before script
  - *apply_bot_filter
@@ -70,6 +72,7 @@ before_script:

 .do_nothing_before:
  before_script: &do_nothing_before
+    - source tools/ci/setup_python.sh
    - *git_clean_stale_submodules
    # apply bot filter in before script
    - *apply_bot_filter
@@ -78,6 +81,7 @@ before_script:

 .add_gitlab_key_before:
  before_script: &add_gitlab_key_before
+    - source tools/ci/setup_python.sh
    - *git_clean_stale_submodules
    # apply bot filter in before script
    - *apply_bot_filter
@@ -99,6 +103,11 @@ build_template_app:
  variables:
    BATCH_BUILD: "1"
    IDF_CI_BUILD: "1"
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - git clone https://github.com/espressif/esp-idf-template.git
    - cd esp-idf-template
@@ -135,6 +144,12 @@ build_template_app:
    expire_in: 1 mos
  variables:
    SSC_CONFIG_FOLDER: "$CI_PROJECT_DIR/SSC/configs/ESP32_IDF"
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_INTEGRATION_TEST
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - git clone $SSC_REPOSITORY
    - cd SSC
@@ -151,6 +166,8 @@ build_ssc_01:
 build_ssc_02:
  <<: *build_ssc_template

+# If you want to add new build ssc jobs, please add it into dependencies of `assign_test` and `.test_template`
+
 build_esp_idf_tests:
  <<: *build_template
  artifacts:
@@ -158,7 +175,13 @@ build_esp_idf_tests:
      - tools/unit-test-app/output
      - components/idf_test/unit_test/TestCaseAll.yml
      - components/idf_test/unit_test/CIConfigs/*.yml
-    expire_in: 6 mos
+    expire_in: 1 mos
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_UNIT_TEST
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - cd tools/unit-test-app
    - MAKEFLAGS= make help # make sure kconfig tools are built in single process
@@ -168,7 +191,7 @@ build_esp_idf_tests:
    - make ut-build-all-configs
    - python tools/UnitTestParser.py

-.build_examples_template: &build_examples_template
+.build_examples_make_template: &build_examples_make_template
  <<: *build_template
  retry: 1
  artifacts:
@@ -183,7 +206,13 @@ build_esp_idf_tests:
    expire_in: 1 week
  variables:
    IDF_CI_BUILD: "1"
-    LOG_PATH: "$CI_PROJECT_DIR/log_examples"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples_make"
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_EXAMPLE_TEST
+      - $BOT_LABEL_REGULAR_TEST
  script:
    # it's not possible to build 100% out-of-tree and have the "artifacts"
    # mechanism work, but this is the next best thing
@@ -194,30 +223,82 @@ build_esp_idf_tests:
    - mkdir -p ${LOG_PATH}
    - ${IDF_PATH}/tools/ci/build_examples.sh "${CI_JOB_NAME}"

-build_examples_00:
-  <<: *build_examples_template
+# same as above, but for CMake
+.build_examples_cmake_template: &build_examples_cmake_template
+  <<: *build_template
+  retry: 1
+  artifacts:
+    when: always
+    paths:
+      - build_examples_cmake/*/*/*/build/*.bin
+      - build_examples_cmake/*/*/*/build/*.elf
+      - build_examples_cmake/*/*/*/build/*.map
+      - build_examples_cmake/*/*/*/build/download.config
+      - build_examples_cmake/*/*/*/build/bootloader/*.bin
+      - $LOG_PATH
+    expire_in: 1 week
+  variables:
+    IDF_CI_BUILD: "1"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples_cmake"
+  script:
+    # it's not possible to build 100% out-of-tree and have the "artifacts"
+    # mechanism work, but this is the next best thing
+    - rm -rf build_examples_cmake
+    - mkdir build_examples_cmake
+    - cd build_examples_cmake
+    # build some of examples
+    - mkdir -p ${LOG_PATH}
+    - ${IDF_PATH}/tools/ci/build_examples_cmake.sh "${CI_JOB_NAME}"

-build_examples_01:
-  <<: *build_examples_template
+build_examples_make_00:
+  <<: *build_examples_make_template

-build_examples_02:
-  <<: *build_examples_template
+build_examples_make_01:
+  <<: *build_examples_make_template

-build_examples_03:
-  <<: *build_examples_template
+build_examples_make_02:
+  <<: *build_examples_make_template

-build_examples_04:
-  <<: *build_examples_template
+build_examples_make_03:
+  <<: *build_examples_make_template

-build_examples_05:
-  <<: *build_examples_template
+build_examples_make_04:
+  <<: *build_examples_make_template

-build_examples_06:
-  <<: *build_examples_template
+build_examples_make_05:
+  <<: *build_examples_make_template

-build_examples_07:
-  <<: *build_examples_template
+build_examples_make_06:
+  <<: *build_examples_make_template

+build_examples_make_07:
+  <<: *build_examples_make_template
+
+build_examples_cmake_00:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_01:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_02:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_03:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_04:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_05:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_06:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_07:
+  <<: *build_examples_cmake_template
+
+# If you want to add new build example jobs, please add it into dependencies of `.example_test_template`

 build_docs:
  stage: build
@@ -238,6 +319,12 @@ build_docs:
      - docs/zh_CN/sphinx-warning-log-sanitized.txt
      - docs/zh_CN/_build/html
    expire_in: 1 mos
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_BUILD_DOCS
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - cd docs
    - ./check_lang_folder_sync.sh
@@ -250,92 +337,96 @@ build_docs:
    - make html
    - ../check_doc_warnings.sh

-test_nvs_on_host:
-  stage: test
+verify_cmake_style:
+  stage: build
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_REGULAR_TEST
+  script:
+    tools/cmake/run_cmake_lint.sh
+
+.host_test_template: &host_test_template
+  stage: host_test
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
  tags:
    - host_test
  dependencies: []
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_HOST_TEST
+      - $BOT_LABEL_REGULAR_TEST
+
+test_nvs_on_host:
+  <<: *host_test_template
  script:
    - cd components/nvs_flash/test_nvs_host
    - make test

 test_nvs_coverage:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
+  <<: *host_test_template
  artifacts:
    paths:
      - components/nvs_flash/test_nvs_host/coverage_report
  only:
-    - triggers
-  # This job takes a few hours to finish, so only run it on demand
-  variables:
-    BOT_NEEDS_TRIGGER_BY_NAME: 1
+    refs:
+      - triggers
+    variables:
+      - $BOT_LABEL_NVS_COVERAGE
  script:
    - cd components/nvs_flash/test_nvs_host
    - make coverage_report

 test_partition_table_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  <<: *host_test_template
  tags:
    - build
-  dependencies: []
  script:
    - cd components/partition_table/test_gen_esp32part_host
    - ./gen_esp32part_tests.py

 test_wl_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
+  <<: *host_test_template
  artifacts:
    paths:
      - components/wear_levelling/test_wl_host/coverage_report.zip
-  dependencies: []
  script:
    - cd components/wear_levelling/test_wl_host
    - make test

 test_fatfs_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  <<: *host_test_template
  tags:
    - wl_host_test
-  dependencies: []
  script:
    - cd components/fatfs/test_fatfs_host/
    - make test

 test_spiffs_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  <<: *host_test_template
  tags:
    - wl_host_test
-  dependencies: []
  script:
    - cd components/spiffs/test_spiffs_host/
    - make test

 test_multi_heap_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
+  <<: *host_test_template
  script:
    - cd components/heap/test_multi_heap_host
    - ./test_all_configs.sh

+test_confserver:
+  <<: *host_test_template
+  script:
+    - cd tools/kconfig_new/test
+    - ./test_confserver.py
+
 test_build_system:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
+  <<: *host_test_template
  script:
    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
    - rm -rf test_build_system
@@ -343,73 +434,23 @@ test_build_system:
    - cd test_build_system
    - ${IDF_PATH}/tools/ci/test_build_system.sh

-test_report:
-  stage: test_report
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - report
-  only:
-    - master
-    - triggers
-    - schedules
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-  variables:
-    LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test"
-    REPORT_PATH: "$CI_PROJECT_DIR/CI_Test_Report"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/tools/unit-test-app/tools/ModuleDefinition.yml"
-  #dependencies:
-  #We need all UT* and IT* artifacts except for only a few other
-  artifacts:
-    when: always
-    paths:
-      - $REPORT_PATH
-      - $LOG_PATH
-    expire_in: 12 mos
+test_build_system_cmake:
+  <<: *host_test_template
  script:
-    # calc log path
-    - VER_NUM=`git rev-list HEAD | wc -l | awk '{print $1}'`
-    - SHA_ID=`echo $CI_COMMIT_SHA | cut -c 1-7`
-    - REVISION="${VER_NUM}_${SHA_ID}"
-    # replace / to _ in branch name
-    - ESCAPED_BRANCH_NAME=`echo $CI_COMMIT_REF_NAME | sed 's/\//___/g'`
-    # result path and artifacts path
-    - RESULT_PATH="$CI_PROJECT_NAME/$ESCAPED_BRANCH_NAME/$REVISION"
-    - ARTIFACTS_PATH="$GITLAB_HTTP_SERVER/idf/esp-idf/builds/$CI_JOB_ID/artifacts/browse/$CI_COMMIT_SHA"
-    # clone test bench
-    - git clone $GITLAB_SSH_SERVER/yinling/auto_test_script.git
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
-    # generate report
-    - TEST_RESULT=Pass
-    - python CITestReport.py -l $LOG_PATH -t $TEST_CASE_FILE_PATH -p $REPORT_PATH -r $RESULT_PATH -a $ARTIFACTS_PATH -m $MODULE_UPDATE_FILE || TEST_RESULT=Fail
-    # commit to CI-test-result project
-    - git clone $GITLAB_SSH_SERVER/qa/CI-test-result.git
-    - rm -rf "CI-test-result/RawData/$RESULT_PATH"
-    - cp -R $CI_PROJECT_NAME CI-test-result/RawData
-    - cd CI-test-result
-    # config git user
-    - git config --global user.email "ci-test-result@espressif.com"
-    - git config --global user.name "ci-test-result"
-    # commit test result
-    - git add .
-    - git commit . -m "update test result for $CI_PROJECT_NAME/$CI_COMMIT_REF_NAME/$CI_COMMIT_SHA, pipeline ID $CI_PIPELINE_ID" || exit 0
-    - git push origin master
-    - test "${TEST_RESULT}" = "Pass" || exit 1
+    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
+    - rm -rf test_build_system
+    - mkdir test_build_system
+    - cd test_build_system
+    - ${IDF_PATH}/tools/ci/test_build_system_cmake.sh

 test_esp_err_to_name_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
+  <<: *host_test_template
  script:
    - cd tools/
    - ./gen_esp_err_to_name.py
    - git diff --exit-code -- ../components/esp32/esp_err_to_name.c || (echo 'Differences found. Please run gen_esp_err_to_name.py and commit the changes.'; exit 1)

-push_master_to_github:
+push_to_github:
  stage: deploy
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
  tags:
@@ -420,8 +461,6 @@ push_master_to_github:
    - /^v\d+\.\d+(\.\d+)?($|-)/
  when: on_success
  dependencies: []
-  variables:
-    GITHUB_PUSH_REFS: refs/remotes/origin/release refs/remotes/origin/master
  before_script: *do_nothing_before
  script:
    - mkdir -p ~/.ssh
@@ -432,23 +471,22 @@ push_master_to_github:
    - echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
    - git remote remove github &>/dev/null || true
    - git remote add github git@github.com:espressif/esp-idf.git
-    # What the next line of script does: goes through the list of refs for all branches we push to github,
-    # generates a snippet of shell which is evaluated. The snippet checks CI_COMMIT_SHA against the SHA
-    # (aka objectname) at tip of each branch, and if any SHAs match then it checks out the local branch
-    # and then pushes that ref to a corresponding github branch
-    - eval $(git for-each-ref --shell bash --format 'if [ $CI_COMMIT_SHA == %(objectname) ]; then git checkout -B %(refname:strip=3); git push --follow-tags github %(refname:strip=3); fi;' $GITHUB_PUSH_REFS)
-
+    - tools/ci/push_to_github.sh

 deploy_docs:
-  stage: assign_test
+  stage: deploy
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
  tags:
    - deploy
  only:
-   - master
-   - /^release\/v/
-   - /^v\d+\.\d+(\.\d+)?($|-)/
-   - triggers
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD_DOCS
  dependencies:
    - build_docs
  before_script: *do_nothing_before
@@ -475,13 +513,17 @@ deploy_docs:
    - echo "[document preview][zh_CN] $CI_DOCKER_REGISTRY/docs/esp-idf/zh_CN/${GIT_VER}/index.html"

 check_doc_links:
-  stage: test
+  stage: host_test
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
  tags:
    - check_doc_links
  only:
-    # can only be triggered
-    - triggers
+    refs:
+      # can only be triggered
+      - triggers
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD_DOCS
  artifacts:
    paths:
      - docs/_build/linkcheck
@@ -525,6 +567,20 @@ check_permissions:
  script:
    - tools/ci/check-executable.sh

+check_examples_cmake_make:
+  stage: deploy
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  tags:
+    - build
+  except:
+    - master
+    - /^release\/v/
+    - /^v\d+\.\d+(\.\d+)?($|-)/
+  dependencies: []
+  before_script: *do_nothing_before
+  script:
+    - tools/ci/check_examples_cmake_make.sh
+
 check_submodule_sync:
  stage: deploy
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
@@ -542,6 +598,21 @@ check_submodule_sync:
    # check if all submodules are correctly synced to public repostory
    - git submodule update --init --recursive

+check_pipeline_triggered_by_label:
+  stage: post_check
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  dependencies: []
+  before_script: *do_nothing_before
+  tags:
+    - build
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL
+  script:
+    # If the pipeline is triggered with label, the pipeline will only succeeded if "regular_test" label is added.
+    # We want to make sure some jobs are always executed to detect regression.
+    - test "$BOT_LABEL_REGULAR_TEST" = "true" || exit -1
+
 assign_test:
  tags:
    - assign_test
@@ -563,6 +634,12 @@ assign_test:
      - components/idf_test/*/TC.sqlite
      - $EXAMPLE_CONFIG_OUTPUT_PATH
    expire_in: 1 mos
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_UNIT_TEST
+      - $BOT_LABEL_INTEGRATION_TEST
+      - $BOT_LABEL_EXAMPLE_TEST
  before_script: *add_gitlab_key_before
  script:
    # assign example tests
@@ -577,22 +654,41 @@ assign_test:
    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin

 .example_test_template: &example_test_template
-  stage: test
+  stage: integration_test
  when: on_success
  only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-    - triggers
-    - schedules
-  # gitlab ci do not support match job with RegEx or wildcard now in dependencies.
-  # we have a lot build example jobs and the binaries them exceed the limitation of artifacts.
-  # we can't artifact them in one job. For example test jobs, download all artifacts from previous stages.
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+      - schedules
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_EXAMPLE_TEST
+  dependencies:
+    - assign_test
+    - build_examples_make_00
+    - build_examples_make_01
+    - build_examples_make_02
+    - build_examples_make_03
+    - build_examples_make_04
+    - build_examples_make_05
+    - build_examples_make_06
+    - build_examples_make_07
+    - build_examples_cmake_00
+    - build_examples_cmake_01
+    - build_examples_cmake_02
+    - build_examples_cmake_03
+    - build_examples_cmake_04
+    - build_examples_cmake_05
+    - build_examples_cmake_06
+    - build_examples_cmake_07
  artifacts:
    when: always
    paths:
      - $LOG_PATH
-    expire_in: 6 mos
+    expire_in: 1 mos
  variables:
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
@@ -616,6 +712,16 @@ assign_test:
  dependencies:
    - assign_test
    - build_esp_idf_tests
+  only:
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+      - schedules
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_UNIT_TEST
  variables:
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    TEST_CASE_PATH: "$CI_PROJECT_DIR/tools/unit-test-app"
@@ -624,15 +730,18 @@ assign_test:
    ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"

 .test_template: &test_template
-  stage: test
+  stage: integration_test
  when: on_success
  only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-    - triggers
-    - schedules
-  allow_failure: true
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+      - schedules
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_INTEGRATION_TEST
  dependencies:
    - assign_test
    - build_ssc_00
@@ -642,7 +751,7 @@ assign_test:
    when: always
    paths:
      - $LOG_PATH
-    expire_in: 6 mos
+    expire_in: 1 mos
  variables:
    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
    LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
@@ -671,7 +780,7 @@ nvs_compatible_test:
    paths:
      - $LOG_PATH
      - nvs_wifi.bin
-    expire_in: 6 mos
+    expire_in: 1 mos
  tags:
    - ESP32_IDF
    - NVS_Compatible
@@ -850,7 +959,7 @@ UT_001_25:
  tags:
    - ESP32_IDF
    - UT_T1_1
-    
+
 UT_001_26:
  <<: *unit_test_template
  tags:
@@ -992,7 +1101,7 @@ UT_004_10:
    - ESP32_IDF
    - UT_T1_1
    - psram
-    
+
 UT_005_01:
  <<: *unit_test_template
  tags:
@@ -1082,59 +1191,29 @@ UT_010_04:
    - UT_T1_RMT
    - psram

+UT_601_01:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
 IT_001_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
+    - SSC_T1_4

 IT_001_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
+    - SSC_T1_4

 IT_001_03:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_04:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_05:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_06:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_07:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_08:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_09:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
+    - SSC_T1_4

 IT_002_01:
  <<: *test_template
@@ -1146,85 +1225,79 @@ IT_003_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_03:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_04:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_05:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_06:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_07:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_08:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_09:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_10:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_11:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_12:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_13:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
-
-IT_003_14:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_004_01:
  <<: *test_template
@@ -1236,7 +1309,61 @@ IT_005_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_WEP
+    - SSC_T1_5
+
+IT_005_02:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_5
+
+IT_006_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_02:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_03:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_04:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_05:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_007_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_7
+
+IT_007_02:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_7
+
+IT_008_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_8

 IT_009_01:
  <<: *test_template
@@ -1250,58 +1377,38 @@ IT_010_01:
    - ESP32_IDF
    - SSC_T5_1

-IT_501_01:
+IT_011_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-    - stress_test
+    - SSC_T50_1

-IT_501_02:
+IT_012_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-    - stress_test
+    - SSC_T1_9

-IT_501_03:
+IT_013_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-    - stress_test
+    - SSC_T2_2

-IT_502_01:
+IT_013_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
-    - stress_test
+    - SSC_T2_2

-IT_502_02:
+IT_014_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
-    - stress_test
+    - SSC_T2_3

-IT_503_01:
+IT_015_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T5_1
-    - stress_test
-
-IT_503_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T5_1
-    - stress_test
-
-IT_503_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T5_1
-    - stress_test
+    - SSC_T2_4
@@ -4,6 +4,9 @@
 #
 mainmenu "Espressif IoT Development Framework Configuration"

+config IDF_CMAKE
+    bool
+    option env="IDF_CMAKE"

 menu "SDK tool configuration"
 config TOOLPREFIX
@@ -15,11 +18,15 @@ config TOOLPREFIX

 config PYTHON
    string "Python 2 interpreter"
+    depends on !IDF_CMAKE
    default "python"
    help
        The executable name/path that is used to run python. On some systems Python 2.x
        may need to be invoked as python2.

+        (Note: This option is used with the GNU Make build system only, not idf.py
+        or CMake-based builds.)
+
 config MAKE_WARN_UNDEFINED_VARIABLES
    bool "'make' warns on undefined variables"
    default "y"
@@ -35,7 +42,141 @@ endmenu  # SDK tool configuration

 source "$COMPONENT_KCONFIGS_PROJBUILD"

-source "$IDF_PATH/Kconfig.compiler"
+menu "Compiler options"
+
+choice OPTIMIZATION_COMPILER
+    prompt "Optimization Level"
+    default OPTIMIZATION_LEVEL_DEBUG
+    help
+        This option sets compiler optimization level (gcc -O argument).
+
+        - for "Release" setting, -Os flag is added to CFLAGS.
+        - for "Debug" setting, -Og flag is added to CFLAGS.
+
+        "Release" with -Os produces smaller & faster compiled code but it
+        may be harder to correlated code addresses to source files when debugging.
+
+        To add custom optimization settings, set CFLAGS and/or CPPFLAGS
+        in project makefile, before including $(IDF_PATH)/make/project.mk. Note that
+        custom optimization levels may be unsupported.
+
+config OPTIMIZATION_LEVEL_DEBUG
+    bool "Debug (-Og)"
+config OPTIMIZATION_LEVEL_RELEASE
+    bool "Release (-Os)"
+endchoice
+
+choice OPTIMIZATION_ASSERTION_LEVEL
+    prompt "Assertion level"
+    default OPTIMIZATION_ASSERTIONS_ENABLED
+    help
+        Assertions can be:
+
+        - Enabled. Failure will print verbose assertion details. This is the default.
+
+        - Set to "silent" to save code size (failed assertions will abort() but user
+          needs to use the aborting address to find the line number with the failed assertion.)
+
+        - Disabled entirely (not recommended for most configurations.) -DNDEBUG is added
+          to CPPFLAGS in this case.
+
+config OPTIMIZATION_ASSERTIONS_ENABLED
+    prompt "Enabled"
+    bool
+    help
+        Enable assertions. Assertion content and line number will be printed on failure.
+
+config OPTIMIZATION_ASSERTIONS_SILENT
+    prompt "Silent (saves code size)"
+    bool
+    help
+        Enable silent assertions. Failed assertions will abort(), user needs to
+        use the aborting address to find the line number with the failed assertion.
+
+config OPTIMIZATION_ASSERTIONS_DISABLED
+    prompt "Disabled (sets -DNDEBUG)"
+    bool
+    help
+        If assertions are disabled, -DNDEBUG is added to CPPFLAGS.
+
+endchoice # assertions
+
+menuconfig CXX_EXCEPTIONS
+   bool "Enable C++ exceptions"
+   default n
+   help
+       Enabling this option compiles all IDF C++ files with exception support enabled.
+
+       Disabling this option disables C++ exception support in all compiled files, and any libstdc++ code which throws
+       an exception will abort instead.
+
+       Enabling this option currently adds an additional ~500 bytes of heap overhead
+       when an exception is thrown in user code for the first time.
+
+config CXX_EXCEPTIONS_EMG_POOL_SIZE
+    int "Emergency Pool Size"
+    default 0
+    depends on CXX_EXCEPTIONS
+    help
+       Size (in bytes) of the emergency memory pool for C++ exceptions. This pool will be used to allocate
+       memory for thrown exceptions when there is not enough memory on the heap.
+
+choice STACK_CHECK_MODE
+    prompt "Stack smashing protection mode"
+    default STACK_CHECK_NONE
+    help
+        Stack smashing protection mode. Emit extra code to check for buffer overflows, such as stack
+        smashing attacks. This is done by adding a guard variable to functions with vulnerable objects.
+        The guards are initialized when a function is entered and then checked when the function exits.
+        If a guard check fails, program is halted. Protection has the following modes:
+
+        - In NORMAL mode (GCC flag: -fstack-protector) only functions that call alloca,
+          and functions with buffers larger than 8 bytes are protected.
+        
+        - STRONG mode (GCC flag: -fstack-protector-strong) is like NORMAL, but includes
+          additional functions to be protected -- those that have local array definitions,
+          or have references to local frame addresses.
+        
+        - In OVERALL mode (GCC flag: -fstack-protector-all) all functions are protected.
+
+        Modes have the following impact on code performance and coverage:
+
+        - performance: NORMAL > STRONG > OVERALL
+        
+        - coverage: NORMAL < STRONG < OVERALL
+
+
+config STACK_CHECK_NONE
+    bool "None"
+config STACK_CHECK_NORM
+    bool "Normal"
+config STACK_CHECK_STRONG
+    bool "Strong"
+config STACK_CHECK_ALL
+    bool "Overall"
+endchoice
+
+config STACK_CHECK
+    bool
+    default !STACK_CHECK_NONE
+    help
+        Stack smashing protection.
+
+config WARN_WRITE_STRINGS
+    bool "Enable -Wwrite-strings warning flag"
+    default "n"
+    help
+        Adds -Wwrite-strings flag for the C/C++ compilers.
+
+        For C, this gives string constants the type ``const char[]`` so that
+        copying the address of one into a non-const ``char *`` pointer
+        produces a warning. This warning helps to find at compile time code
+        that tries to write into a string constant.
+
+        For C++, this warns about the deprecated conversion from string
+        literals to ``char *``.
+
+endmenu # Compiler Options

 menu "Component config"
 source "$COMPONENT_KCONFIGS"
@@ -1,135 +0,0 @@
-menu "Compiler options"
-
-choice OPTIMIZATION_COMPILER
-    prompt "Optimization Level"
-    default OPTIMIZATION_LEVEL_DEBUG
-    help
-        This option sets compiler optimization level (gcc -O argument).
-
-        - for "Release" setting, -Os flag is added to CFLAGS.
-        - for "Debug" setting, -Og flag is added to CFLAGS.
-
-        "Release" with -Os produces smaller & faster compiled code but it
-        may be harder to correlated code addresses to source files when debugging.
-
-        To add custom optimization settings, set CFLAGS and/or CPPFLAGS
-        in project makefile, before including $(IDF_PATH)/make/project.mk. Note that
-        custom optimization levels may be unsupported.
-
-config OPTIMIZATION_LEVEL_DEBUG
-    bool "Debug (-Og)"
-config OPTIMIZATION_LEVEL_RELEASE
-    bool "Release (-Os)"
-endchoice
-
-choice OPTIMIZATION_ASSERTION_LEVEL
-    prompt "Assertion level"
-    default OPTIMIZATION_ASSERTIONS_ENABLED
-    help
-        Assertions can be:
-
-        - Enabled. Failure will print verbose assertion details. This is the default.
-
-        - Set to "silent" to save code size (failed assertions will abort() but user
-          needs to use the aborting address to find the line number with the failed assertion.)
-
-        - Disabled entirely (not recommended for most configurations.) -DNDEBUG is added
-          to CPPFLAGS in this case.
-
-config OPTIMIZATION_ASSERTIONS_ENABLED
-    prompt "Enabled"
-    bool
-    help
-        Enable assertions. Assertion content and line number will be printed on failure.
-
-config OPTIMIZATION_ASSERTIONS_SILENT
-    prompt "Silent (saves code size)"
-    bool
-    help
-        Enable silent assertions. Failed assertions will abort(), user needs to
-        use the aborting address to find the line number with the failed assertion.
-
-config OPTIMIZATION_ASSERTIONS_DISABLED
-    prompt "Disabled (sets -DNDEBUG)"
-    bool
-    help
-        If assertions are disabled, -DNDEBUG is added to CPPFLAGS.
-
-endchoice # assertions
-
-menuconfig CXX_EXCEPTIONS
-   bool "Enable C++ exceptions"
-   default n
-   help
-       Enabling this option compiles all IDF C++ files with exception support enabled.
-
-       Disabling this option disables C++ exception support in all compiled files, and any libstdc++ code which throws
-       an exception will abort instead.
-
-       Enabling this option currently adds an additional ~500 bytes of heap overhead
-       when an exception is thrown in user code for the first time.
-
-config CXX_EXCEPTIONS_EMG_POOL_SIZE
-    int "Emergency Pool Size"
-    default 0
-    depends on CXX_EXCEPTIONS
-    help
-       Size (in bytes) of the emergency memory pool for C++ exceptions. This pool will be used to allocate
-       memory for thrown exceptions when there is not enough memory on the heap.
-
-choice STACK_CHECK_MODE
-    prompt "Stack smashing protection mode"
-    default STACK_CHECK_NONE
-    help
-        Stack smashing protection mode. Emit extra code to check for buffer overflows, such as stack
-        smashing attacks. This is done by adding a guard variable to functions with vulnerable objects.
-        The guards are initialized when a function is entered and then checked when the function exits.
-        If a guard check fails, program is halted. Protection has the following modes:
-
-        - In NORMAL mode (GCC flag: -fstack-protector) only functions that call alloca,
-          and functions with buffers larger than 8 bytes are protected.
-        
-        - STRONG mode (GCC flag: -fstack-protector-strong) is like NORMAL, but includes
-          additional functions to be protected -- those that have local array definitions,
-          or have references to local frame addresses.
-        
-        - In OVERALL mode (GCC flag: -fstack-protector-all) all functions are protected.
-
-        Modes have the following impact on code performance and coverage:
-
-        - performance: NORMAL > STRONG > OVERALL
-        
-        - coverage: NORMAL < STRONG < OVERALL
-
-
-config STACK_CHECK_NONE
-    bool "None"
-config STACK_CHECK_NORM
-    bool "Normal"
-config STACK_CHECK_STRONG
-    bool "Strong"
-config STACK_CHECK_ALL
-    bool "Overall"
-endchoice
-
-config STACK_CHECK
-    bool
-    default !STACK_CHECK_NONE
-    help
-        Stack smashing protection.
-
-config WARN_WRITE_STRINGS
-    bool "Enable -Wwrite-strings warning flag"
-    default "n"
-    help
-        Adds -Wwrite-strings flag for the C/C++ compilers.
-
-        For C, this gives string constants the type ``const char[]`` so that
-        copying the address of one into a non-const ``char *`` pointer
-        produces a warning. This warning helps to find at compile time code
-        that tries to write into a string constant.
-
-        For C++, this warns about the deprecated conversion from string
-        literals to ``char *``.
-
-endmenu # Compiler Options
@@ -4,22 +4,27 @@

 ESP-IDF is the official development framework for the [ESP32](https://espressif.com/en/products/hardware/esp32/overview) chip.

-# Developing With the ESP-IDF
+# Developing With ESP-IDF

 ## Setting Up ESP-IDF

 See setup guides for detailed instructions to set up the ESP-IDF:

-* [Windows Setup Guide](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/windows-setup.html)
-* [Mac OS Setup Guide](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/macos-setup.html)
-* [Linux Setup Guide](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/linux-setup.html)
+* [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
+* [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)

 ## Finding a Project

-As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in the setup guide, ESP-IDF comes with some example projects in the [examples](examples) directory.
+As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in Getting Started, ESP-IDF comes with some example projects in the [examples](examples) directory.

 Once you've found the project you want to work with, change to its directory and you can configure and build it.

+To start your own project based on an example, copy the example project directory outside of the ESP-IDF directory.
+
+# Quick Reference
+
+See the Getting Started guide links above for a detailed setup guide. This is a quick reference for common commands when working with ESP-IDF projects:
+
 ## Configuring the Project

 `make menuconfig`
@@ -36,15 +41,17 @@ Once done configuring, press Escape multiple times to exit and say "Yes" to save

 ## Compiling the Project

-`make all`
+`make -j4 all`

 ... will compile app, bootloader and generate a partition table based on the config.

+NOTE: The `-j4` option causes `make` to run 4 parallel jobs. This is much faster than the default single job. The recommended number to pass to this option is `-j(number of CPUs + 1)`.
+
 ## Flashing the Project

-When `make all` finishes, it will print a command line to use esptool.py to flash the chip. However you can also do this from make by running:
+When the build finishes, it will print a command line to use esptool.py to flash the chip. However you can also do this automatically by running:

-`make flash`
+`make -j4 flash`

 This will flash the entire project (app, bootloader and partition table) to a new chip. The settings for serial port flashing can be configured with `make menuconfig`.

@@ -56,24 +63,24 @@ The `make monitor` target uses the [idf_monitor tool](https://docs.espressif.com

 Exit the monitor by typing Ctrl-].

-To flash and monitor output in one pass, you can run:
+To build, flash and monitor output in one pass, you can run:

-`make flash monitor`
+`make -j4 flash monitor`

-## Compiling & Flashing Just the App
+## Compiling & Flashing Only the App

 After the initial flash, you may just want to build and flash just your app, not the bootloader and partition table:

 * `make app` - build just the app.
 * `make app-flash` - flash just the app.

-`make app-flash` will automatically rebuild the app if it needs it.
+`make app-flash` will automatically rebuild the app if any source files have changed.

 (In normal development there's no downside to reflashing the bootloader and partition table each time, if they haven't changed.)

 ## Parallel Builds

-ESP-IDF supports compiling multiple files in parallel, so all of the above commands can be run as `make -jN` where `N` is the number of parallel make processes to run (generally N should be equal to or one more than the number of CPU cores in your system.)
+ESP-IDF supports compiling multiple files in parallel, so all of the above commands can be run as `make -jN` where `N` is the number of parallel make processes to run (generally N should be equal to the number of CPU cores in your system, plus one.)

 Multiple make functions can be combined into one. For example: to build the app & bootloader using 5 jobs in parallel, then flash everything, and then display serial output from the ESP32 run:

@@ -81,6 +88,7 @@ Multiple make functions can be combined into one. For example: to build the app
 make -j5 flash monitor
 ```

+
 ## The Partition Table

 Once you've compiled your project, the "build" directory will contain a binary file with a name like "my_app.bin". This is an ESP32 image binary that can be loaded by the bootloader.
@@ -0,0 +1,28 @@
+set(COMPONENT_SRCS "app_trace.c"
+                   "app_trace_util.c"
+                   "host_file_io.c"
+                   "gcov/gcov_rtio.c")
+set(COMPONENT_ADD_INCLUDEDIRS "include")
+
+if(CONFIG_SYSVIEW_ENABLE)
+    list(APPEND COMPONENT_ADD_INCLUDEDIRS
+        sys_view/Config
+        sys_view/SEGGER
+        sys_view/Sample/OS)
+
+    list(APPEND COMPONENT_SRCS "sys_view/SEGGER/SEGGER_SYSVIEW.c"
+                   "sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c"
+                   "sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.c"
+                   "sys_view/esp32/SEGGER_RTT_esp32.c")
+endif()
+
+set(COMPONENT_REQUIRES)
+set(COMPONENT_PRIV_REQUIRES xtensa-debug-module)
+
+register_component()
+
+# disable --coverage for this component, as it is used as transport
+# for gcov
+component_compile_options("-fno-profile-arcs" "-fno-test-coverage")
+
+target_link_libraries(app_trace gcov)
@@ -20,7 +20,6 @@
 #include "rom/ets_sys.h"
 #include "esp_app_trace.h"

-#define LOG_LOCAL_LEVEL ESP_LOG_ERROR
 #include "esp_log.h"
 const static char *TAG = "segger_rtt";

@@ -125,7 +124,7 @@ unsigned SEGGER_RTT_WriteSkipNoLock(unsigned BufferIndex, const void* pBuffer, u
  uint8_t event_id = *pbuf;

  if (NumBytes > SYSVIEW_EVENTS_BUF_SZ) {
-      ESP_LOGE(TAG, "Too large event %d bytes!", NumBytes);
+      ESP_LOGE(TAG, "Too large event %u bytes!", NumBytes);
      return 0;
  }
  if (xPortGetCoreID()) { // dual core specific code
@@ -0,0 +1,7 @@
+set(COMPONENT_SRCS "esp_ota_ops.c")
+set(COMPONENT_ADD_INCLUDEDIRS "include")
+
+set(COMPONENT_REQUIRES spi_flash)
+set(COMPONENT_PRIV_REQUIRES bootloader_support)
+
+register_component()
@@ -28,6 +28,7 @@
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"
 #include "esp_flash_encrypt.h"
+#include "esp_spi_flash.h"
 #include "sdkconfig.h"

 #include "esp_ota_ops.h"
@@ -240,14 +241,6 @@ esp_err_t esp_ota_end(esp_ota_handle_t handle)
        goto cleanup;
    }

-#ifdef CONFIG_SECURE_BOOT_ENABLED
-    ret = esp_secure_boot_verify_signature(it->part->address, data.image_len);
-    if (ret != ESP_OK) {
-        ret = ESP_ERR_OTA_VALIDATE_FAILED;
-        goto cleanup;
-    }
-#endif
-
 cleanup:
    LIST_REMOVE(it, entries);
    free(it);
@@ -299,7 +292,7 @@ static esp_err_t esp_rewrite_ota_data(esp_partition_subtype_t subtype)
    uint16_t ota_app_count = 0;
    uint32_t i = 0;
    uint32_t seq;
-    static spi_flash_mmap_memory_t ota_data_map;
+    spi_flash_mmap_handle_t ota_data_map;
    const void *result = NULL;

    find_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
@@ -384,7 +377,7 @@ esp_err_t esp_ota_set_boot_partition(const esp_partition_t *partition)
        return ESP_ERR_OTA_VALIDATE_FAILED;
    }

-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef CONFIG_SECURE_SIGNED_ON_UPDATE
    esp_err_t ret = esp_secure_boot_verify_signature(partition->address, data.image_len);
    if (ret != ESP_OK) {
        return ESP_ERR_OTA_VALIDATE_FAILED;
@@ -445,7 +438,7 @@ const esp_partition_t *esp_ota_get_boot_partition(void)
 {
    esp_err_t ret;
    const esp_partition_t *find_partition = NULL;
-    static spi_flash_mmap_memory_t ota_data_map;
+    spi_flash_mmap_handle_t ota_data_map;
    const void *result = NULL;
    uint16_t ota_app_count = 0;
    find_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
@@ -501,9 +494,18 @@ const esp_partition_t *esp_ota_get_boot_partition(void)

 const esp_partition_t* esp_ota_get_running_partition(void)
 {
+    static const esp_partition_t *curr_partition = NULL;
+
+    /*
+     * Currently running partition is unlikely to change across reset cycle,
+     * so it can be cached here, and avoid lookup on every flash write operation.
+     */
+    if (curr_partition != NULL) {
+        return curr_partition;
+    }
+
    /* Find the flash address of this exact function. By definition that is part
       of the currently running firmware. Then find the enclosing partition. */
-
    size_t phys_offs = spi_flash_cache2phys(esp_ota_get_running_partition);

    assert (phys_offs != SPI_FLASH_CACHE2PHYS_FAIL); /* indicates cache2phys lookup is buggy */
@@ -517,6 +519,7 @@ const esp_partition_t* esp_ota_get_running_partition(void)
        const esp_partition_t *p = esp_partition_get(it);
        if (p->address <= phys_offs && p->address + p->size > phys_offs) {
            esp_partition_iterator_release(it);
+            curr_partition = p;
            return p;
        }
        it = esp_partition_next(it);
@@ -20,7 +20,6 @@
 #include <stddef.h>
 #include "esp_err.h"
 #include "esp_partition.h"
-#include "esp_spi_flash.h"

 #ifdef __cplusplus
 extern "C"
@@ -0,0 +1,26 @@
+if(CONFIG_AWS_IOT_SDK)
+    set(COMPONENT_ADD_INCLUDEDIRS "include aws-iot-device-sdk-embedded-C/include")
+    set(aws_sdk_src aws-iot-device-sdk-embedded-C/src)
+    set(COMPONENT_SRCS "${aws_sdk_src}/aws_iot_json_utils.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_common_internal.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_connect.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_publish.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_subscribe.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_unsubscribe.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_yield.c"
+                   "${aws_sdk_src}/aws_iot_shadow.c"
+                   "${aws_sdk_src}/aws_iot_shadow_actions.c"
+                   "${aws_sdk_src}/aws_iot_shadow_json.c"
+                   "${aws_sdk_src}/aws_iot_shadow_records.c"
+                   "port/network_mbedtls_wrapper.c"
+                   "port/threads_freertos.c"
+                   "port/timer.c")
+else()
+    message(STATUS "Building empty aws_iot component due to configuration")
+endif()
+
+set(COMPONENT_REQUIRES "mbedtls")
+set(COMPONENT_PRIV_REQUIRES "jsmn")
+
+register_component()
@@ -0,0 +1,7 @@
+# bootloader component logic is all in project_include.cmake,
+# and subproject/CMakeLists.txt.
+#
+# This file is only included so the build system finds the
+# component
+
+
@@ -132,9 +132,59 @@ endmenu  # Bootloader

 menu "Security features"

+# These three are the actual options to check in code,
+# selected by the displayed options
+config SECURE_SIGNED_ON_BOOT
+    bool
+    default y
+    depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
+
+config SECURE_SIGNED_ON_UPDATE
+    bool
+    default y
+    depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
+
+config SECURE_SIGNED_APPS
+   bool
+   default y
+   depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE
+
+
+config SECURE_SIGNED_APPS_NO_SECURE_BOOT
+    bool "Require signed app images"
+    default n
+    depends on !SECURE_BOOT_ENABLED
+    help
+        Require apps to be signed to verify their integrity.
+
+        This option uses the same app signature scheme as hardware secure boot, but unlike hardware secure boot it does not prevent the bootloader from being physically updated. This means that the device can be secured against remote network access, but not physical access. Compared to using hardware Secure Boot this option is much simpler to implement.
+
+config SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
+    bool "Bootloader verifies app signatures"
+    default n
+    depends on SECURE_SIGNED_APPS_NO_SECURE_BOOT
+    help
+        If this option is set, the bootloader will be compiled with code to verify that an app is signed before booting it.
+
+        If hardware secure boot is enabled, this option is always enabled and cannot be disabled.
+        If hardware secure boot is not enabled, this option doesn't add significant security by itself so most users will want to leave it disabled.
+
+config SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
+    bool "Verify app signature on update"
+    default y
+    depends on SECURE_SIGNED_APPS_NO_SECURE_BOOT
+    help
+         If this option is set, any OTA updated apps will have the signature verified before being considered valid.
+
+         When enabled, the signature is automatically checked whenever the esp_ota_ops.h APIs are used for OTA updates,
+         or esp_image_format.h APIs are used to verify apps.
+
+         If hardware secure boot is enabled, this option is always enabled and cannot be disabled.
+         If hardware secure boot is not enabled, this option still adds significant security against network-based attackers by preventing spoofing of OTA updates.
+
 config SECURE_BOOT_ENABLED
-    bool "Enable secure boot in bootloader (READ DOCS FIRST)"
-    default N
+    bool "Enable hardware secure boot in bootloader (READ DOCS FIRST)"
+    default n
    help
        Build a bootloader which enables secure boot on first boot.

@@ -169,12 +219,12 @@ endchoice

 config SECURE_BOOT_BUILD_SIGNED_BINARIES
     bool "Sign binaries during build"
-     depends on SECURE_BOOT_ENABLED
+     depends on SECURE_SIGNED_APPS
     default y
     help
-        Once secure boot is enabled, bootloader will only boot if partition table and app image are signed.
+        Once secure boot or signed app requirement is enabled, app images are required to be signed.

-        If enabled, these binary files are signed as part of the build process. The file named in "Secure boot private signing key" will be used to sign the image.
+        If enabled (default), these binary files are signed as part of the build process. The file named in "Secure boot private signing key" will be used to sign the image.

        If disabled, unsigned app/partition data will be built. They must be signed manually using espsecure.py (for example, on a remote signing server.)

@@ -183,7 +233,7 @@ config SECURE_BOOT_SIGNING_KEY
     depends on SECURE_BOOT_BUILD_SIGNED_BINARIES
     default secure_boot_signing_key.pem
     help
-        Path to the key file used to sign partition tables and app images for secure boot. Once secure boot is enabled, bootloader will only boot if partition table and app image are signed.
+        Path to the key file used to sign app images.

        Key file is an ECDSA private key (NIST256p curve) in PEM format.

@@ -196,11 +246,11 @@ config SECURE_BOOT_SIGNING_KEY

 config SECURE_BOOT_VERIFICATION_KEY
    string "Secure boot public signature verification key"
-    depends on SECURE_BOOT_ENABLED && !SECURE_BOOT_BUILD_SIGNED_BINARIES
+    depends on SECURE_SIGNED_APPS && !SECURE_BOOT_BUILD_SIGNED_BINARIES
    default signature_verification_key.bin
    help
-       Path to a public key file used to verify signed images. This key is compiled into the bootloader,
-       and may also be used to verify signatures on OTA images after download.
+       Path to a public key file used to verify signed images. This key is compiled into the bootloader and/or app,
+       to verify app images.

       Key file is in raw binary format, and can be extracted from a
       PEM formatted private key using the espsecure.py
@@ -208,6 +258,27 @@ config SECURE_BOOT_VERIFICATION_KEY

       Refer to https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html before enabling.

+choice SECURE_BOOTLOADER_KEY_ENCODING
+    bool "Hardware Key Encoding"
+    depends on SECURE_BOOTLOADER_REFLASHABLE
+    default SECURE_BOOTLOADER_NO_ENCODING
+    help
+
+    In reflashable secure bootloader mode, a hardware key is derived from the signing key (with SHA-256) and can be written to efuse
+    with espefuse.py.
+
+    Normally this is a 256-bit key, but if 3/4 Coding Scheme is used on the device then the efuse key is truncated to 192 bits.
+
+    This configuration item doesn't change any firmware code, it only changes the size of key binary which is generated at build time.
+
+config SECURE_BOOTLOADER_KEY_ENCODING_256BIT
+       bool "No encoding (256 bit key)"
+
+config SECURE_BOOTLOADER_KEY_ENCODING_192BIT
+       bool "3/4 encoding (192 bit key)"
+
+endchoice
+
 config SECURE_BOOT_INSECURE
    bool "Allow potentially insecure options"
    depends on SECURE_BOOT_ENABLED
@@ -275,6 +346,13 @@ config SECURE_BOOT_ALLOW_JTAG

          Only set this option in testing environments.

+config SECURE_BOOT_ALLOW_SHORT_APP_PARTITION
+       bool "Allow app partition length not 64KB aligned"
+       depends on SECURE_BOOT_INSECURE
+       help
+           If not set (default), app partition size must be a multiple of 64KB. App images are padded to 64KB length, and the bootloader checks any trailing bytes after the signature (before the next 64KB boundary) have not been written. This is because flash cache maps entire 64KB pages into the address space. This prevents an attacker from appending unverified data after the app image in the flash, causing it to be mapped into the address space.
+
+           Setting this option allows the app partition length to be unaligned, and disables padding of the app image to this length. It is generally not recommended to set this option, unless you have a legacy partitioning scheme which doesn't support 64KB aligned partition lengths.

 config FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_ENCRYPT
    bool "Leave UART bootloader encryption enabled"
@@ -78,12 +78,18 @@ else ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 # Reflashable secure bootloader
 # generates a digest binary (bootloader + digest)

+ifdef CONFIG_SECURE_BOOTLOADER_KEY_ENCODING_192BIT
+KEY_DIGEST_LEN=192
+else
+KEY_DIGEST_LEN=256
+endif
+
 BOOTLOADER_DIGEST_BIN := $(BOOTLOADER_BUILD_DIR)/bootloader-reflash-digest.bin
-SECURE_BOOTLOADER_KEY := $(BOOTLOADER_BUILD_DIR)/secure-bootloader-key.bin
+SECURE_BOOTLOADER_KEY := $(BOOTLOADER_BUILD_DIR)/secure-bootloader-key-$(KEY_DIGEST_LEN).bin

 ifdef CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES
 $(SECURE_BOOTLOADER_KEY): $(SECURE_BOOT_SIGNING_KEY)
-	$(ESPSECUREPY) digest_private_key -k $< $@
+	$(ESPSECUREPY) digest_private_key --keylen $(KEY_DIGEST_LEN) -k $< $@
 else
 $(SECURE_BOOTLOADER_KEY):
 	@echo "No pre-generated key for a reflashable secure bootloader is available, due to signing configuration."
@@ -107,7 +113,7 @@ bootloader: $(BOOTLOADER_DIGEST_BIN)

 $(BOOTLOADER_DIGEST_BIN): $(BOOTLOADER_BIN) $(SECURE_BOOTLOADER_KEY)
 	@echo "DIGEST $(notdir $@)"
-	$(Q) $(ESPSECUREPY) digest_secure_bootloader -k $(SECURE_BOOTLOADER_KEY) -o $@ $<
+	$(ESPSECUREPY) digest_secure_bootloader -k $(SECURE_BOOTLOADER_KEY) -o $@ $<

 else # CONFIG_SECURE_BOOT_ENABLED && !CONFIG_SECURE_BOOTLOADER_REFLASHABLE && !CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH
 bootloader:
@@ -0,0 +1,33 @@
+if(BOOTLOADER_BUILD)
+    return()  # don't keep recursing!
+endif()
+
+# Glue to build the bootloader subproject binary as an external
+# cmake project under this one
+#
+#
+set(bootloader_build_dir "${CMAKE_BINARY_DIR}/bootloader")
+set(bootloader_binary_files
+    "${bootloader_build_dir}/bootloader.elf"
+    "${bootloader_build_dir}/bootloader.bin"
+    "${bootloader_build_dir}/bootloader.map"
+    )
+
+externalproject_add(bootloader
+    # TODO: support overriding the bootloader in COMPONENT_PATHS
+    SOURCE_DIR "${IDF_PATH}/components/bootloader/subproject"
+    BINARY_DIR "${bootloader_build_dir}"
+    CMAKE_ARGS -DSDKCONFIG=${SDKCONFIG} -DIDF_PATH=${IDF_PATH}
+    INSTALL_COMMAND ""
+    BUILD_ALWAYS 1  # no easy way around this...
+    BUILD_BYPRODUCTS ${bootloader_binary_files}
+    )
+
+# this is a hack due to an (annoying) shortcoming in cmake, it can't
+# extend the 'clean' target to the external project
+# see thread: https://cmake.org/pipermail/cmake/2016-December/064660.html
+#
+# So for now we just have the top-level build remove the final build products...
+set_property(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}" APPEND PROPERTY
+    ADDITIONAL_MAKE_CLEAN_FILES
+    ${bootloader_binary_files})
@@ -0,0 +1,28 @@
+cmake_minimum_required(VERSION 3.5)
+
+if(NOT SDKCONFIG)
+    message(FATAL_ERROR "Bootloader subproject expects the SDKCONFIG variable to be passed "
+        "in by the parent build process.")
+endif()
+
+if(NOT IDF_PATH)
+    message(FATAL_ERROR "Bootloader subproject expects the IDF_PATH variable to be passed "
+        "in by the parent build process.")
+endif()
+
+set(COMPONENTS bootloader esptool_py esp32 partition_table soc bootloader_support log spi_flash micro-ecc soc main)
+set(BOOTLOADER_BUILD 1)
+add_definitions(-DBOOTLOADER_BUILD=1)
+
+set(COMPONENT_REQUIRES_COMMON log esp32 soc)
+
+include("${IDF_PATH}/tools/cmake/project.cmake")
+project(bootloader)
+
+target_linker_script(bootloader.elf
+    "main/esp32.bootloader.ld"
+    "main/esp32.bootloader.rom.ld")
+# Imported from esp32 component
+target_linker_script(bootloader.elf ${ESP32_BOOTLOADER_LINKER_SCRIPTS})
+
+target_link_libraries(bootloader.elf gcc)
@@ -0,0 +1,4 @@
+set(COMPONENT_SRCS "bootloader_start.c")
+set(COMPONENT_ADD_INCLUDEDIRS "")
+set(COMPONENT_REQUIRES "bootloader bootloader_support")
+register_component()
@@ -30,25 +30,31 @@ SECTIONS
  .iram_loader.text :
  {
    . = ALIGN (16);
-    _stext = .;
-    _text_start = ABSOLUTE(.);
+    _loader_text_start = ABSOLUTE(.);
    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
    *liblog.a:(.literal .text .literal.* .text.*)
    *libgcc.a:(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_utility.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:esp_image_format.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_random.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_flash.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:flash_partitions.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_sha.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:efuse.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
+    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
+    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
    *(.fini.literal)
    *(.fini)
    *(.gnu.version)
-    _text_end = ABSOLUTE(.);
-    _etext = .;
+    _loader_text_end = ABSOLUTE(.);
  } > iram_loader_seg
-  
+
  .iram.text :
  {
    . = ALIGN (16);
@@ -113,13 +119,13 @@ SECTIONS
    . = (. + 3) & ~ 3;
    /*  C++ constructor and destructor tables, properly ordered:  */
    __init_array_start = ABSOLUTE(.);
-    KEEP (*crtbegin.o(.ctors))
-    KEEP (*(EXCLUDE_FILE (*crtend.o) .ctors))
+    KEEP (*crtbegin.*(.ctors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .ctors))
    KEEP (*(SORT(.ctors.*)))
    KEEP (*(.ctors))
    __init_array_end = ABSOLUTE(.);
-    KEEP (*crtbegin.o(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend.o) .dtors))
+    KEEP (*crtbegin.*(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .dtors))
    KEEP (*(SORT(.dtors.*)))
    KEEP (*(.dtors))
    /*  C++ exception handlers table:  */
@@ -0,0 +1,27 @@
+set(COMPONENT_SRCS "src/bootloader_clock.c"
+                   "src/bootloader_common.c"
+                   "src/bootloader_flash.c"
+                   "src/bootloader_init.c"
+                   "src/bootloader_random.c"
+                   "src/bootloader_sha.c"
+                   "src/bootloader_utility.c"
+                   "src/efuse.c"
+                   "src/esp_image_format.c"
+                   "src/flash_encrypt.c"
+                   "src/flash_partitions.c"
+                   "src/flash_qio_mode.c"
+                   "src/secure_boot.c"
+                   "src/secure_boot_signatures.c")
+
+if(${BOOTLOADER_BUILD})
+    set(COMPONENT_ADD_INCLUDEDIRS "include include_priv")
+    set(COMPONENT_REQUIRES)
+    set(COMPONENT_PRIV_REQUIRES spi_flash micro-ecc)
+else()
+    set(COMPONENT_ADD_INCLUDEDIRS "include")
+    set(COMPONENT_PRIV_INCLUDEDIRS "include_priv")
+    set(COMPONENT_REQUIRES)
+    set(COMPONENT_PRIV_REQUIRES spi_flash mbedtls micro-ecc)
+endif()
+
+register_component()
@@ -12,7 +12,7 @@ COMPONENT_SRCDIRS := src
 #
 # Secure boot signing key support
 #
-ifdef CONFIG_SECURE_BOOT_ENABLED
+ifdef CONFIG_SECURE_SIGNED_APPS

 # this path is created relative to the component build directory
 SECURE_BOOT_VERIFICATION_KEY := $(abspath signature_verification_key.bin)
@@ -0,0 +1,34 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <stddef.h>
+
+/**
+ * @brief Check if half-open intervals overlap
+ *
+ * @param start1  interval 1 start
+ * @param end1    interval 1 end
+ * @param start2  interval 2 start
+ * @param end2    interval 2 end
+ * @return true iff [start1; end1) overlaps [start2; end2)
+ */
+static inline bool bootloader_util_regions_overlap(
+        const intptr_t start1, const intptr_t end1,
+        const intptr_t start2, const intptr_t end2)
+{
+    return (end1 > start2 && end2 > start1) ||
+           !(end1 <= start2 || end2 <= start1);
+}
@@ -15,6 +15,7 @@
 #define _ESP_EFUSE_H

 #include "soc/efuse_reg.h"
+#include "esp_err.h"

 #ifdef __cplusplus
 extern "C" {
@@ -58,6 +59,38 @@ void esp_efuse_reset(void);
 */
 void esp_efuse_disable_basic_rom_console(void);

+/* @brief Encode one or more sets of 6 byte sequences into
+ * 8 bytes suitable for 3/4 Coding Scheme.
+ *
+ * This function is only useful if the CODING_SCHEME efuse
+ * is set to value 1 for 3/4 Coding Scheme.
+ *
+ * @param[in] in_bytes Pointer to a sequence of bytes to encode for 3/4 Coding Scheme. Must have length in_bytes_len. After being written to hardware, these bytes will read back as little-endian words.
+ * @param[out] out_words Pointer to array of words suitable for writing to efuse write registers. Array must contain 2 words (8 bytes) for every 6 bytes in in_bytes_len. Can be a pointer to efuse write registers.
+ * @param in_bytes_len. Length of array pointed to by in_bytes, in bytes. Must be a multiple of 6.
+ *
+ * @return ESP_ERR_INVALID_ARG if either pointer is null or in_bytes_len is not a multiple of 6. ESP_OK otherwise.
+ */
+esp_err_t esp_efuse_apply_34_encoding(const uint8_t *in_bytes, uint32_t *out_words, size_t in_bytes_len);
+
+/* @brief Write random data to efuse key block write registers
+ *
+ * @note Caller is responsible for ensuring efuse
+ * block is empty and not write protected, before calling.
+ *
+ * @note Behaviour depends on coding scheme: a 256-bit key is
+ * generated and written for Coding Scheme "None", a 192-bit key
+ * is generated, extended to 256-bits by the Coding Scheme,
+ * and then writtten for 3/4 Coding Scheme.
+ *
+ * @note This function does not burn the new values, caller should
+ * call esp_efuse_burn_new_values() when ready to do this.
+ *
+ * @param blk_wdata0_reg Address of the first data write register
+ * in the block
+ */
+void esp_efuse_write_random_key(uint32_t blk_wdata0_reg);
+
 #ifdef __cplusplus
 }
 #endif
@@ -17,7 +17,9 @@
 #include <stdbool.h>
 #include "esp_attr.h"
 #include "esp_err.h"
+#ifndef BOOTLOADER_BUILD
 #include "esp_spi_flash.h"
+#endif
 #include "soc/efuse_reg.h"

 /**
@@ -27,7 +27,7 @@
 #define ESP_PARTITION_TABLE_MAX_LEN 0xC00 /* Maximum length of partition table data */
 #define ESP_PARTITION_TABLE_MAX_ENTRIES (ESP_PARTITION_TABLE_MAX_LEN / sizeof(esp_partition_info_t)) /* Maximum length of partition table data, including terminating entry */

-/* @brief Verify the partition table (does not include verifying secure boot cryptographic signature)
+/* @brief Verify the partition table
 *
 * @param partition_table Pointer to at least ESP_PARTITION_TABLE_MAX_ENTRIES of potential partition table data. (ESP_PARTITION_TABLE_MAX_LEN bytes.)
 * @param log_errors Log errors if the partition table is invalid.
@@ -35,6 +35,13 @@
 *
 * @return ESP_OK on success, ESP_ERR_INVALID_STATE if partition table is not valid.
 */
-esp_err_t esp_partition_table_basic_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions);
+esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions);
+
+
+/* This function is included for compatibility with the ESP-IDF v3.x API */
+inline static __attribute__((deprecated)) esp_err_t esp_partition_table_basic_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions)
+{
+    return esp_partition_table_verify(partition_table, log_errors, num_partitions);
+}

 #endif
@@ -81,6 +81,8 @@ typedef struct {

 _Static_assert(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");

+#define ESP_IMAGE_HASH_LEN 32 /* Length of the appended SHA-256 digest */
+
 /* Header of binary image segment */
 typedef struct {
    uint32_t load_addr;
@@ -142,6 +144,16 @@ esp_err_t esp_image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *
 */
 esp_err_t esp_image_verify_bootloader(uint32_t *length);

+/**
+ * @brief Verify the bootloader image.
+ *
+ * @param[out] Metadata for the image. Only valid if result is ESP_OK.
+ *
+ * @return As per esp_image_load_metadata().
+ */
+esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data);
+
+
 typedef struct {
    uint32_t drom_addr;
    uint32_t drom_load_addr;
@@ -17,6 +17,14 @@
 #include <esp_err.h>
 #include "soc/efuse_reg.h"

+#include "sdkconfig.h"
+
+#ifdef CONFIG_SECURE_BOOT_ENABLED
+#if !defined(CONFIG_SECURE_SIGNED_ON_BOOT) || !defined(CONFIG_SECURE_SIGNED_ON_UPDATE) || !defined(CONFIG_SECURE_SIGNED_APPS)
+#error "internal sdkconfig error, secure boot should always enable all signature options"
+#endif
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -26,6 +26,7 @@
 #include "esp_flash_partitions.h"
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
+#include "soc/gpio_periph.h"

 static const char* TAG = "boot_comm";

@@ -42,6 +43,9 @@ bool bootloader_common_ota_select_valid(const esp_ota_select_entry_t *s)
 esp_comm_gpio_hold_t bootloader_common_check_long_hold_gpio(uint32_t num_pin, uint32_t delay_sec)
 {
    gpio_pad_select_gpio(num_pin);
+    if (GPIO_PIN_MUX_REG[num_pin]) {
+        PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[num_pin]);
+    }
    gpio_pad_pullup(num_pin);
    uint32_t tm_start = esp_log_early_timestamp();
    if (GPIO_INPUT_GET(num_pin) == 1) {
@@ -96,18 +100,6 @@ bool bootloader_common_erase_part_type_data(const char *list_erase, bool ota_dat
    int num_partitions;
    bool ret = true;

-#ifdef CONFIG_SECURE_BOOT_ENABLED
-    if (esp_secure_boot_enabled()) {
-        ESP_LOGI(TAG, "Verifying partition table signature...");
-        err = esp_secure_boot_verify_signature(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
-        if (err != ESP_OK) {
-            ESP_LOGE(TAG, "Failed to verify partition table signature.");
-            return false;
-        }
-        ESP_LOGD(TAG, "Partition table signature verified");
-    }
-#endif
-
    partitions = bootloader_mmap(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
    if (!partitions) {
            ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
@@ -115,7 +107,7 @@ bool bootloader_common_erase_part_type_data(const char *list_erase, bool ota_dat
    }
    ESP_LOGD(TAG, "mapped partition table 0x%x at 0x%x", ESP_PARTITION_TABLE_OFFSET, (intptr_t)partitions);

-    err = esp_partition_table_basic_verify(partitions, true, &num_partitions);
+    err = esp_partition_table_verify(partitions, true, &num_partitions);
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Failed to verify partition table");
        ret = false;
@@ -28,7 +28,10 @@ bootloader_sha256_handle_t bootloader_sha256_start()
        return NULL;
    }
    mbedtls_sha256_init(ctx);
-    assert(mbedtls_sha256_starts_ret(ctx, false) == 0);
+    int ret = mbedtls_sha256_starts_ret(ctx, false);
+    if (ret != 0) {
+        return NULL;
+    }
    return ctx;
 }

@@ -36,7 +39,8 @@ void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data,
 {
    assert(handle != NULL);
    mbedtls_sha256_context *ctx = (mbedtls_sha256_context *)handle;
-    assert(mbedtls_sha256_update_ret(ctx, data, data_len) == 0);
+    int ret = mbedtls_sha256_update_ret(ctx, data, data_len);
+    assert(ret == 0);
 }

 void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest)
@@ -44,7 +48,8 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
    assert(handle != NULL);
    mbedtls_sha256_context *ctx = (mbedtls_sha256_context *)handle;
    if (digest != NULL) {
-        assert(mbedtls_sha256_finish_ret(ctx, digest) == 0);
+        int ret = mbedtls_sha256_finish_ret(ctx, digest);
+        assert(ret == 0);
    }
    mbedtls_sha256_free(ctx);
    free(handle);
@@ -72,18 +72,6 @@ bool bootloader_utility_load_partition_table(bootloader_state_t* bs)
    esp_err_t err;
    int num_partitions;

-#ifdef CONFIG_SECURE_BOOT_ENABLED
-    if(esp_secure_boot_enabled()) {
-        ESP_LOGI(TAG, "Verifying partition table signature...");
-        err = esp_secure_boot_verify_signature(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
-        if (err != ESP_OK) {
-            ESP_LOGE(TAG, "Failed to verify partition table signature.");
-            return false;
-        }
-        ESP_LOGD(TAG, "Partition table signature verified");
-    }
-#endif
-
    partitions = bootloader_mmap(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
    if (!partitions) {
        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
@@ -91,7 +79,7 @@ bool bootloader_utility_load_partition_table(bootloader_state_t* bs)
    }
    ESP_LOGD(TAG, "mapped partition table 0x%x at 0x%x", ESP_PARTITION_TABLE_OFFSET, (intptr_t)partitions);

-    err = esp_partition_table_basic_verify(partitions, true, &num_partitions);
+    err = esp_partition_table_verify(partitions, true, &num_partitions);
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Failed to verify partition table");
        return false;
@@ -143,6 +131,9 @@ bool bootloader_utility_load_partition_table(bootloader_state_t* bs)
            case PART_SUBTYPE_DATA_WIFI:
                partition_usage = "WiFi data";
                break;
+            case PART_SUBTYPE_DATA_NVS_KEYS:
+                partition_usage = "NVS keys";
+                break;
            default:
                partition_usage = "Unknown data";
                break;
@@ -222,8 +213,8 @@ int bootloader_utility_get_selected_boot_partition(const bootloader_state_t *bs)
        bootloader_munmap(ota_select_map);

        ESP_LOGD(TAG, "OTA sequence values A 0x%08x B 0x%08x", sa.ota_seq, sb.ota_seq);
-        if(sa.ota_seq == UINT32_MAX && sb.ota_seq == UINT32_MAX) {
-            ESP_LOGD(TAG, "OTA sequence numbers both empty (all-0xFF)");
+        if ((sa.ota_seq == UINT32_MAX && sb.ota_seq == UINT32_MAX) || (bs->app_count == 0)) {
+            ESP_LOGD(TAG, "OTA sequence numbers both empty (all-0xFF) or partition table does not have bootable ota_apps (app_count=%d)", bs->app_count);
            if (bs->factory.offset != 0) {
                ESP_LOGI(TAG, "Defaulting to factory image");
                return FACTORY_INDEX;
@@ -13,6 +13,8 @@
 // limitations under the License.
 #include "esp_efuse.h"
 #include "esp_log.h"
+#include <string.h>
+#include "bootloader_random.h"

 #define EFUSE_CONF_WRITE 0x5A5A /* efuse_pgm_op_ena, force no rd/wr disable */
 #define EFUSE_CONF_READ 0x5AA5 /* efuse_read_op_ena, release force */
@@ -58,3 +60,55 @@ void esp_efuse_disable_basic_rom_console(void)
        esp_efuse_burn_new_values();
    }
 }
+
+esp_err_t esp_efuse_apply_34_encoding(const uint8_t *in_bytes, uint32_t *out_words, size_t in_bytes_len)
+{
+    if (in_bytes == NULL || out_words == NULL || in_bytes_len % 6 != 0) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    while (in_bytes_len > 0) {
+        uint8_t out[8];
+        uint8_t xor = 0;
+        uint8_t mul = 0;
+        for (int i = 0; i < 6; i++) {
+            xor ^= in_bytes[i];
+            mul += (i + 1) * __builtin_popcount(in_bytes[i]);
+        }
+
+        memcpy(out, in_bytes, 6); // Data bytes
+        out[6] = xor;
+        out[7] = mul;
+
+        memcpy(out_words, out, 8);
+
+        in_bytes_len -= 6;
+        in_bytes += 6;
+        out_words += 2;
+    }
+
+    return ESP_OK;
+}
+
+void esp_efuse_write_random_key(uint32_t blk_wdata0_reg)
+{
+    uint32_t buf[8];
+    uint8_t raw[24];
+    uint32_t coding_scheme = REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_CODING_SCHEME_M;
+
+    if (coding_scheme == EFUSE_CODING_SCHEME_VAL_NONE) {
+        bootloader_fill_random(buf, sizeof(buf));
+    } else { // 3/4 Coding Scheme
+        bootloader_fill_random(raw, sizeof(raw));
+        esp_err_t r = esp_efuse_apply_34_encoding(raw, buf, sizeof(raw));
+        assert(r == ESP_OK);
+    }
+
+    ESP_LOGV(TAG, "Writing random values to address 0x%08x", blk_wdata0_reg);
+    for (int i = 0; i < 8; i++) {
+        ESP_LOGV(TAG, "EFUSE_BLKx_WDATA%d_REG = 0x%08x", i, buf[i]);
+        REG_WRITE(blk_wdata0_reg + 4*i, buf[i]);
+    }
+    bzero(buf, sizeof(buf));
+    bzero(raw, sizeof(raw));
+}
@@ -23,10 +23,25 @@
 #include <bootloader_flash.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
+#include "bootloader_util.h"
+
+/* Checking signatures as part of verifying images is necessary:
+   - Always if secure boot is enabled
+   - Differently in bootloader and/or app, depending on kconfig
+*/
+#ifdef BOOTLOADER_BUILD
+#ifdef CONFIG_SECURE_SIGNED_ON_BOOT
+#define SECURE_BOOT_CHECK_SIGNATURE
+#endif
+#else /* !BOOTLOADER_BUILD */
+#ifdef CONFIG_SECURE_SIGNED_ON_UPDATE
+#define SECURE_BOOT_CHECK_SIGNATURE
+#endif
+#endif

 static const char *TAG = "esp_image";

-#define HASH_LEN 32 /* SHA-256 digest length */
+#define HASH_LEN ESP_IMAGE_HASH_LEN

 #define SIXTEEN_MB 0x1000000
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF
@@ -42,6 +57,10 @@ static const char *TAG = "esp_image";
   (Means loaded code isn't executable until after the secure boot check.)
 */
 static uint32_t ram_obfs_value[2];
+
+/* Range of IRAM used by the loader, defined in ld script */
+extern int _loader_text_start;
+extern int _loader_text_end;
 #endif

 /* Return true if load_addr is an address the bootloader should load into */
@@ -107,7 +126,7 @@ esp_err_t esp_image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *
    }

    // Calculate SHA-256 of image if secure boot is on, or if image has a hash appended
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
    if (1) {
 #else
    if (data->image.hash_appended) {
@@ -174,7 +193,7 @@ goto err;
       rewritten the header - rely on esptool.py having verified the bootloader at flashing time, instead.
    */
    if (!is_bootloader) {
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
        // secure boot images have a signature appended
        err = verify_secure_boot_signature(sha_handle, data);
 #else
@@ -182,7 +201,7 @@ goto err;
        if (sha_handle != NULL && !esp_cpu_in_ocd_debug_mode()) {
            err = verify_simple_hash(sha_handle, data);
        }
-#endif // CONFIG_SECURE_BOOT_ENABLED
+#endif // SECURE_BOOT_CHECK_SIGNATURE
    } else { // is_bootloader
        // bootloader may still have a sha256 digest handle open
        if (sha_handle != NULL) {
@@ -287,18 +306,41 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
                 (do_load)?"load":(is_mapping)?"map":"");
    }

+
+#ifdef BOOTLOADER_BUILD
+    /* Before loading segment, check it doesn't clobber bootloader RAM. */
    if (do_load) {
-        /* Before loading segment, check it doesn't clobber bootloader RAM... */
-        uint32_t end_addr = load_addr + data_len;
-        if (end_addr < 0x40000000) {
+        const intptr_t load_end = load_addr + data_len;
+        if (load_end <= (intptr_t) SOC_DIRAM_DRAM_HIGH) {
+            /* Writing to DRAM */
            intptr_t sp = (intptr_t)get_sp();
-            if (end_addr > sp - STACK_LOAD_HEADROOM) {
-                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x liimit 0x%08x)",
-                         index, end_addr, sp, sp - STACK_LOAD_HEADROOM);
+            if (load_end > sp - STACK_LOAD_HEADROOM) {
+                /* Bootloader .data/.rodata/.bss is above the stack, so this
+                 * also checks that we aren't overwriting these segments.
+                 *
+                 * TODO: This assumes specific arrangement of sections we have
+                 * in the ESP32. Rewrite this in a generic way to support other
+                 * layouts.
+                 */
+                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x limit 0x%08x)",
+                         index, load_end, sp, sp - STACK_LOAD_HEADROOM);
+                return ESP_ERR_IMAGE_INVALID;
+            }
+        } else {
+            /* Writing to IRAM */
+            const intptr_t loader_iram_start = (intptr_t) &_loader_text_start;
+            const intptr_t loader_iram_end = (intptr_t) &_loader_text_end;
+
+            if (bootloader_util_regions_overlap(loader_iram_start, loader_iram_end,
+                    load_addr, load_end)) {
+                ESP_LOGE(TAG, "Segment %d (0x%08x-0x%08x) overlaps bootloader IRAM (0x%08x-0x%08x)",
+                         index, load_addr, load_end, loader_iram_start, loader_iram_end);
                return ESP_ERR_IMAGE_INVALID;
            }
        }
    }
+#endif // BOOTLOADER_BUILD
+
 #ifndef BOOTLOADER_BUILD
    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
@@ -442,19 +484,28 @@ static bool should_load(uint32_t load_addr)
 esp_err_t esp_image_verify_bootloader(uint32_t *length)
 {
    esp_image_metadata_t data;
-    const esp_partition_pos_t bootloader_part = {
-        .offset = ESP_BOOTLOADER_OFFSET,
-        .size = ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET,
-    };
-    esp_err_t err = esp_image_load(ESP_IMAGE_VERIFY,
-                                   &bootloader_part,
-                                   &data);
+    esp_err_t err = esp_image_verify_bootloader_data(&data);
    if (length != NULL) {
        *length = (err == ESP_OK) ? data.image_len : 0;
    }
    return err;
 }

+esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
+{
+    if (data == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    const esp_partition_pos_t bootloader_part = {
+        .offset = ESP_BOOTLOADER_OFFSET,
+        .size = ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET,
+    };
+    return esp_image_load(ESP_IMAGE_VERIFY,
+                          &bootloader_part,
+                          data);
+}
+
+
 static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data)
 {
    uint32_t unpadded_length = data->image_len;
@@ -492,6 +543,8 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
 {
    uint8_t image_hash[HASH_LEN] = { 0 };

+    ESP_LOGI(TAG, "Verifying image signature...");
+
    // For secure boot, we calculate the signature hash over the whole file, which includes any "simple" hash
    // appended to the image for corruption detection
    if (data->image.hash_appended) {
@@ -15,7 +15,6 @@
 #include <strings.h>

 #include "bootloader_flash.h"
-#include "bootloader_random.h"
 #include "esp_image_format.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"
@@ -62,6 +61,12 @@ esp_err_t esp_flash_encrypt_check_and_update(void)

 static esp_err_t initialise_flash_encryption(void)
 {
+    uint32_t coding_scheme = REG_GET_FIELD(EFUSE_BLK0_RDATA6_REG, EFUSE_CODING_SCHEME);
+    if (coding_scheme != EFUSE_CODING_SCHEME_VAL_NONE && coding_scheme != EFUSE_CODING_SCHEME_VAL_34) {
+        ESP_LOGE(TAG, "Unknown/unsupported CODING_SCHEME value 0x%x", coding_scheme);
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
    /* Before first flash encryption pass, need to initialise key & crypto config */

    /* Generate key */
@@ -79,13 +84,7 @@ static esp_err_t initialise_flash_encryption(void)
        && REG_READ(EFUSE_BLK1_RDATA6_REG) == 0
        && REG_READ(EFUSE_BLK1_RDATA7_REG) == 0) {
        ESP_LOGI(TAG, "Generating new flash encryption key...");
-        uint32_t buf[8];
-        bootloader_fill_random(buf, sizeof(buf));
-        for (int i = 0; i < 8; i++) {
-            ESP_LOGV(TAG, "EFUSE_BLK1_WDATA%d_REG = 0x%08x", i, buf[i]);
-            REG_WRITE(EFUSE_BLK1_WDATA0_REG + 4*i, buf[i]);
-        }
-        bzero(buf, sizeof(buf));
+        esp_efuse_write_random_key(EFUSE_BLK1_WDATA0_REG);
        esp_efuse_burn_new_values();

        ESP_LOGI(TAG, "Read & write protecting new key...");
@@ -254,7 +253,7 @@ static esp_err_t encrypt_and_load_partition_table(esp_partition_info_t *partitio
        ESP_LOGE(TAG, "Failed to read partition table data");
        return err;
    }
-    if (esp_partition_table_basic_verify(partition_table, false, num_partitions) == ESP_OK) {
+    if (esp_partition_table_verify(partition_table, false, num_partitions) == ESP_OK) {
        ESP_LOGD(TAG, "partition table is plaintext. Encrypting...");
        esp_err_t err = esp_flash_encrypt_region(ESP_PARTITION_TABLE_OFFSET,
                                                 FLASH_SECTOR_SIZE);
@@ -285,7 +284,8 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
                           &partition->pos,
                           &data_ignored);
      should_encrypt = (err == ESP_OK);
-    } else if (partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA) {
+    } else if ((partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA)
+                || (partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_NVS_KEYS)) {
        /* check if we have ota data partition and the partition should be encrypted unconditionally */
        should_encrypt = true;
    }
@@ -20,7 +20,7 @@

 static const char *TAG = "flash_parts";

-esp_err_t esp_partition_table_basic_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions)
+esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions)
 {
    int md5_found = 0;
    int num_parts;
@@ -35,6 +35,7 @@
 #define CMD_WRDI       0x04
 #define CMD_RDSR       0x05
 #define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */

 static const char *TAG = "qio_mode";

@@ -65,6 +66,11 @@ static void write_status_8b_wrsr2(unsigned new_status);
 /* Write 16 bit status using WRSR */
 static void write_status_16b_wrsr(unsigned new_status);

+/* Read 8 bit status of XM25QU64A  */
+static unsigned read_status_8b_xmc25qu64a();
+/* Write 8 bit status of XM25QU64A */
+static void write_status_8b_xmc25qu64a(unsigned new_status);
+
 #define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD has this GPIO wired to WP pin of flash */

 #ifndef CONFIG_BOOTLOADER_SPI_WP_PIN // Set in menuconfig if SPI flasher config is set to a quad mode
@@ -84,11 +90,12 @@ static void write_status_16b_wrsr(unsigned new_status);
   Searching of this table stops when the first match is found.
 */
 const static qio_info_t chip_data[] = {
-/*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,          QIE Bit */
-    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,  6 },
-    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,  6 }, /* IDs 0x40xx, 0x70xx */
-    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr, 9 },
-    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr, 9 },
+/*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,               QIE Bit */
+    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 },
+    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
+    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
+    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
+    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },

    /* Final entry is default entry, if no other IDs have matched.

@@ -96,7 +103,7 @@ const static qio_info_t chip_data[] = {
       GigaDevice (mfg ID 0xC8, flash IDs including 4016),
       FM25Q32 (QOUT mode only, mfg ID 0xA1, flash IDs including 4016)
    */
-    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2, 1 },
+    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2,      1 },
 };

 #define NUM_CHIPS (sizeof(chip_data) / sizeof(qio_info_t))
@@ -246,6 +253,24 @@ static void write_status_16b_wrsr(unsigned new_status)
    execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }

+static unsigned read_status_8b_xmc25qu64a()
+{
+    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    uint32_t read_status = execute_flash_command(CMD_RDSR, 0, 0, 8);
+    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+    return read_status;
+}
+
+static void write_status_8b_xmc25qu64a(unsigned new_status)
+{
+    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+}
+
 static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
 {
    uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
@@ -50,7 +50,7 @@ static bool secure_boot_generate(uint32_t image_len){
    const uint32_t *image;

    /* hardware secure boot engine only takes full blocks, so round up the
-       image length. The additional data should all be 0xFF.
+       image length. The additional data should all be 0xFF (or the appended SHA, if it falls in the same block).
    */
    if (image_len % sizeof(digest.iv) != 0) {
        image_len = (image_len / sizeof(digest.iv) + 1) * sizeof(digest.iv);
@@ -104,14 +104,21 @@ static inline void burn_efuses()

 esp_err_t esp_secure_boot_permanently_enable(void) {
    esp_err_t err;
-    uint32_t image_len = 0;
    if (esp_secure_boot_enabled())
    {
        ESP_LOGI(TAG, "bootloader secure boot is already enabled, continuing..");
        return ESP_OK;
    }

-    err = esp_image_verify_bootloader(&image_len);
+    uint32_t coding_scheme = REG_GET_FIELD(EFUSE_BLK0_RDATA6_REG, EFUSE_CODING_SCHEME);
+    if (coding_scheme != EFUSE_CODING_SCHEME_VAL_NONE && coding_scheme != EFUSE_CODING_SCHEME_VAL_34) {
+        ESP_LOGE(TAG, "Unknown/unsupported CODING_SCHEME value 0x%x", coding_scheme);
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
+    /* Verify the bootloader */
+    esp_image_metadata_t bootloader_data = { 0 };
+    err = esp_image_verify_bootloader_data(&bootloader_data);
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "bootloader image appears invalid! error %d", err);
        return err;
@@ -131,13 +138,7 @@ esp_err_t esp_secure_boot_permanently_enable(void) {
        && REG_READ(EFUSE_BLK2_RDATA6_REG) == 0
        && REG_READ(EFUSE_BLK2_RDATA7_REG) == 0) {
        ESP_LOGI(TAG, "Generating new secure boot key...");
-        uint32_t buf[8];
-        bootloader_fill_random(buf, sizeof(buf));
-        for (int i = 0; i < 8; i++) {
-            ESP_LOGV(TAG, "EFUSE_BLK2_WDATA%d_REG = 0x%08x", i, buf[i]);
-            REG_WRITE(EFUSE_BLK2_WDATA0_REG + 4*i, buf[i]);
-        }
-        bzero(buf, sizeof(buf));
+        esp_efuse_write_random_key(EFUSE_BLK2_WDATA0_REG);
        burn_efuses();
        ESP_LOGI(TAG, "Read & write protecting new key...");
        REG_WRITE(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_BLK2 | EFUSE_RD_DIS_BLK2);
@@ -150,6 +151,11 @@ esp_err_t esp_secure_boot_permanently_enable(void) {
    }

    ESP_LOGI(TAG, "Generating secure boot digest...");
+    uint32_t image_len = bootloader_data.image_len;
+    if(bootloader_data.image.hash_appended) {
+        /* Secure boot digest doesn't cover the hash */
+        image_len -= ESP_IMAGE_HASH_LEN;
+    }
    if (false == secure_boot_generate(image_len)){
        ESP_LOGE(TAG, "secure boot generation failed");
        return ESP_FAIL;
@@ -84,10 +84,13 @@ esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block
        return ESP_FAIL;
    }

+    ESP_LOGD(TAG, "Verifying secure boot signature");
+
    is_valid = uECC_verify(signature_verification_key_start,
                                image_digest,
                                DIGEST_LEN,
                                sig_block->signature,
                                uECC_secp256r1());
+    ESP_LOGD(TAG, "Verification result %d", is_valid);
    return is_valid ? ESP_OK : ESP_ERR_IMAGE_INVALID;
 }
@@ -0,0 +1,94 @@
+#include <stdint.h>
+#include <strings.h>
+#include "esp_efuse.h"
+#include "unity.h"
+
+typedef struct {
+    uint8_t unencoded[24];
+    uint32_t encoded[8];
+} coding_scheme_test_t;
+
+/* Randomly generated byte strings, encoded and written to ESP32
+   using espefuse algorithm, then verified to have no encoding errors
+   and correct readback.
+*/
+static const coding_scheme_test_t coding_scheme_data[] = {
+    {
+        .unencoded = { 0x96, 0xa9, 0xab, 0xb2, 0xda, 0xdd, 0x21, 0xd2, 0x35, 0x22, 0xd3, 0x30, 0x3b, 0xf8, 0xcb, 0x77, 0x8d, 0x8d, 0xf4, 0x96, 0x25, 0xc4, 0xb9, 0x94 },
+        .encoded = { 0xb2aba996, 0x6821ddda, 0x2235d221, 0x430730d3, 0x77cbf83b, 0x627f8d8d, 0xc42596f4, 0x4dae94b9 },
+    },
+    {
+        .unencoded = { 0x0e, 0x6b, 0x1a, 0x1d, 0xa5, 0x9f, 0x24, 0xcf, 0x91, 0x5b, 0xe7, 0xe1, 0x7c, 0x0a, 0x6e, 0xdc, 0x5e, 0x8e, 0xb1, 0xec, 0xd1, 0xf3, 0x75, 0x48 },
+        .encoded = { 0x1d1a6b0e, 0x5e589fa5, 0x5b91cf24, 0x6127e1e7, 0xdc6e0a7c, 0x5d148e5e, 0xf3d1ecb1, 0x57424875 },
+    },
+    {
+        .unencoded = { 0x0a, 0x79, 0x5a, 0x1c, 0xb1, 0x45, 0x71, 0x2c, 0xb3, 0xda, 0x9e, 0xdc, 0x76, 0x27, 0xf5, 0xca, 0xe7, 0x00, 0x39, 0x95, 0x6c, 0x53, 0xc2, 0x07 },
+        .encoded = { 0x1c5a790a, 0x4ac145b1, 0xdab32c71, 0x6476dc9e, 0xcaf52776, 0x4d8900e7, 0x536c9539, 0x495607c2 },
+    },
+    {
+        .unencoded = { 0x76, 0x46, 0x88, 0x2d, 0x4c, 0xe1, 0x50, 0x5d, 0xd6, 0x7c, 0x41, 0x15, 0xc6, 0x1f, 0xd4, 0x60, 0x10, 0x15, 0x2a, 0x72, 0x2d, 0x89, 0x93, 0x13 },
+        .encoded = { 0x2d884676, 0x4838e14c, 0x7cd65d50, 0x4bf31541, 0x60d41fc6, 0x39681510, 0x892d722a, 0x497c1393 },
+    },
+    {
+        .unencoded = { 0x32, 0xbc, 0x40, 0x92, 0x13, 0x37, 0x1a, 0xae, 0xb6, 0x00, 0xed, 0x30, 0xb8, 0x82, 0xee, 0xfc, 0xcf, 0x6d, 0x7f, 0xc5, 0xfa, 0x0e, 0xdd, 0x84 },
+        .encoded = { 0x9240bc32, 0x49783713, 0x00b6ae1a, 0x46df30ed, 0xfcee82b8, 0x6e8a6dcf, 0x0efac57f, 0x571784dd },
+    },
+    {
+        .unencoded = { 0x29, 0xb3, 0x04, 0x95, 0xf2, 0x3c, 0x81, 0xe6, 0x5a, 0xf3, 0x42, 0x82, 0xd1, 0x79, 0xe2, 0x12, 0xbe, 0xc3, 0xd4, 0x10, 0x63, 0x66, 0x9f, 0xe3 },
+        .encoded = { 0x9504b329, 0x51c53cf2, 0xf35ae681, 0x460e8242, 0x12e279d1, 0x5825c3be, 0x666310d4, 0x5ebde39f },
+    },
+    {
+        .unencoded = { 0xda, 0xda, 0x71, 0x4a, 0x62, 0x33, 0xdd, 0x31, 0x87, 0xf3, 0x70, 0x12, 0x33, 0x3b, 0x3b, 0xe9, 0xed, 0xc4, 0x6e, 0x6a, 0xc7, 0xd5, 0x85, 0xfc },
+        .encoded = { 0x4a71dada, 0x4e6a3362, 0xf38731dd, 0x4bfa1270, 0xe93b3b33, 0x61f3c4ed, 0xd5c76a6e, 0x636ffc85 },
+    },
+    {
+        .unencoded = { 0x45, 0x64, 0x51, 0x34, 0x1c, 0x82, 0x81, 0x77, 0xf8, 0x89, 0xb1, 0x15, 0x82, 0x94, 0xdd, 0x64, 0xa2, 0x46, 0x0e, 0xfb, 0x1a, 0x70, 0x4b, 0x9f },
+        .encoded = { 0x34516445, 0x39da821c, 0x89f87781, 0x4f2315b1, 0x64dd9482, 0x474b46a2, 0x701afb0e, 0x5e4b9f4b },
+    },
+    {
+        .unencoded = { 0x89, 0x87, 0x15, 0xb6, 0x66, 0x34, 0x49, 0x18, 0x8b, 0x7b, 0xb2, 0xf6, 0x96, 0x1e, 0x2e, 0xf1, 0x03, 0x9d, 0x4e, 0x16, 0x32, 0xd6, 0x23, 0x22 },
+        .encoded = { 0xb6158789, 0x4eff3466, 0x7b8b1849, 0x63e5f6b2, 0xf12e1e96, 0x54c99d03, 0xd632164e, 0x42bd2223 },
+    },
+    {
+        .unencoded = { 0xa7, 0xa0, 0xb5, 0x21, 0xd2, 0xa3, 0x9f, 0x65, 0xa9, 0xeb, 0x72, 0xa2, 0x2e, 0xa6, 0xfb, 0x9c, 0x48, 0x7e, 0x68, 0x08, 0x7a, 0xb1, 0x4f, 0xbc },
+        .encoded = { 0x21b5a0a7, 0x4ce2a3d2, 0xeba9659f, 0x5868a272, 0x9cfba62e, 0x5fd97e48, 0xb17a0868, 0x5b58bc4f },
+    },
+    {
+        .unencoded = { 0xf7, 0x05, 0xe3, 0x6c, 0xb1, 0x55, 0xcb, 0x2f, 0x8d, 0x3e, 0x0b, 0x2e, 0x3e, 0xb7, 0x02, 0xf5, 0x91, 0xb1, 0xfe, 0x8b, 0x58, 0x50, 0xb2, 0x40 },
+        .encoded = { 0x6ce305f7, 0x569955b1, 0x3e8d2fcb, 0x56722e0b, 0xf502b73e, 0x535eb191, 0x50588bfe, 0x3a8f40b2 },
+    },
+    {
+        .unencoded = { 0x0f, 0x93, 0xb0, 0xd5, 0x60, 0xba, 0x40, 0x2a, 0x62, 0xa6, 0x92, 0x82, 0xb8, 0x91, 0x2c, 0xd7, 0x23, 0xdc, 0x6f, 0x7f, 0x2f, 0xbe, 0x41, 0xf5 },
+        .encoded = { 0xd5b0930f, 0x5123ba60, 0xa6622a40, 0x3bbe8292, 0xd72c91b8, 0x582ddc23, 0xbe2f7f6f, 0x6935f541 },
+    },
+    {
+        .unencoded = { 0x7f, 0x0c, 0x99, 0xde, 0xff, 0x2e, 0xd2, 0x1c, 0x48, 0x98, 0x70, 0x85, 0x15, 0x01, 0x2a, 0xfb, 0xcd, 0xf2, 0xa0, 0xf9, 0x0e, 0xbc, 0x9f, 0x0c },
+        .encoded = { 0xde990c7f, 0x6fe52eff, 0x98481cd2, 0x3deb8570, 0xfb2a0115, 0x61faf2cd, 0xbc0ef9a0, 0x55780c9f },
+    },
+    {
+        .unencoded = { 0x9a, 0x10, 0x92, 0x03, 0x81, 0xfe, 0x41, 0x57, 0x77, 0x02, 0xcb, 0x20, 0x67, 0xa4, 0x97, 0xf3, 0xf8, 0xc7, 0x0d, 0x65, 0xcd, 0xfc, 0x15, 0xef },
+        .encoded = { 0x0392109a, 0x4b64fe81, 0x02775741, 0x418820cb, 0xf397a467, 0x6998c7f8, 0xfccd650d, 0x6ba3ef15 },
+    },
+};
+
+TEST_CASE("Test 3/4 Coding Scheme Algorithm", "[bootloader_support]")
+{
+    const int num_tests = sizeof(coding_scheme_data)/sizeof(coding_scheme_test_t);
+    for (int i = 0; i < num_tests; i++) {
+        uint32_t result[8];
+        const coding_scheme_test_t *t = &coding_scheme_data[i];
+
+        printf("Test case %d...\n", i);
+        esp_err_t r = esp_efuse_apply_34_encoding(t->unencoded, result, sizeof(t->unencoded));
+        TEST_ASSERT_EQUAL_HEX(ESP_OK, r);
+        TEST_ASSERT_EQUAL_HEX32_ARRAY(t->encoded, result, 8);
+
+        // Do the same, 6 bytes at a time
+        for (int offs = 0; offs < sizeof(t->unencoded); offs += 6) {
+            bzero(result, sizeof(result));
+            r = esp_efuse_apply_34_encoding(t->unencoded + offs, result, 6);
+            TEST_ASSERT_EQUAL_HEX(ESP_OK, r);
+            TEST_ASSERT_EQUAL_HEX32_ARRAY(t->encoded + (offs / 6 * 2), result, 2);
+        }
+    }
+}
@@ -14,6 +14,7 @@
 #include "freertos/xtensa_api.h"
 #include "unity.h"
 #include "bootloader_common.h"
+#include "bootloader_util.h"
 #include "esp_partition.h"
 #include "esp_ota_ops.h"
 #include "esp_image_format.h"
@@ -92,3 +93,23 @@ TEST_CASE("Test label_search", "[bootloader_support]")
    check_label_search(25,  "phy, 1234567890123456, nvs1",  "12345678901234567",    true);

 }
+
+
+TEST_CASE("Test regions_overlap", "[bootloader_support]")
+{
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 1, 2) );
+
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 0, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 1, 3) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 0, 3) );
+
+    TEST_ASSERT( bootloader_util_regions_overlap(0, 2, 1, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 3, 1, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(0, 3, 1, 2) );
+
+    TEST_ASSERT( !bootloader_util_regions_overlap(2, 3, 1, 2) );
+    TEST_ASSERT( !bootloader_util_regions_overlap(1, 2, 2, 3) );
+
+    TEST_ASSERT( !bootloader_util_regions_overlap(3, 4, 1, 2) );
+    TEST_ASSERT( !bootloader_util_regions_overlap(1, 2, 3, 4) );
+}
@@ -0,0 +1,283 @@
+if(CONFIG_BT_ENABLED)
+
+    set(COMPONENT_SRCS "bt.c")
+    set(COMPONENT_ADD_INCLUDEDIRS include)
+
+    if(CONFIG_BLUEDROID_ENABLED)
+
+        list(APPEND COMPONENT_PRIV_INCLUDEDIRS
+            bluedroid/bta/include
+            bluedroid/bta/ar/include
+            bluedroid/bta/av/include
+            bluedroid/bta/dm/include
+            bluedroid/bta/gatt/include
+            bluedroid/bta/hh/include
+            bluedroid/bta/jv/include
+            bluedroid/bta/sdp/include
+            bluedroid/bta/sys/include
+            bluedroid/device/include
+            bluedroid/hci/include
+            bluedroid/osi/include
+            bluedroid/external/sbc/decoder/include
+            bluedroid/external/sbc/encoder/include
+            bluedroid/btc/profile/esp/blufi/include
+            bluedroid/btc/profile/esp/include
+            bluedroid/btc/profile/std/a2dp/include
+            bluedroid/btc/profile/std/include
+            bluedroid/btc/include
+            bluedroid/stack/btm/include
+            bluedroid/stack/gap/include
+            bluedroid/stack/gatt/include
+            bluedroid/stack/l2cap/include
+            bluedroid/stack/sdp/include
+            bluedroid/stack/smp/include
+            bluedroid/stack/avct/include
+            bluedroid/stack/avrc/include
+            bluedroid/stack/avdt/include
+            bluedroid/stack/a2dp/include
+            bluedroid/stack/rfcomm/include
+            bluedroid/stack/include
+            bluedroid/common/include)
+
+        list(APPEND COMPONENT_ADD_INCLUDEDIRS bluedroid/api/include/api)
+
+        list(APPEND COMPONENT_SRCS "bluedroid/api/esp_a2dp_api.c"
+                   "bluedroid/api/esp_avrc_api.c"
+                   "bluedroid/api/esp_blufi_api.c"
+                   "bluedroid/api/esp_bt_device.c"
+                   "bluedroid/api/esp_bt_main.c"
+                   "bluedroid/api/esp_gap_ble_api.c"
+                   "bluedroid/api/esp_gap_bt_api.c"
+                   "bluedroid/api/esp_gatt_common_api.c"
+                   "bluedroid/api/esp_gattc_api.c"
+                   "bluedroid/api/esp_gatts_api.c"
+                   "bluedroid/api/esp_hf_client_api.c"
+                   "bluedroid/api/esp_spp_api.c"
+                   "bluedroid/bta/ar/bta_ar.c"
+                   "bluedroid/bta/av/bta_av_aact.c"
+                   "bluedroid/bta/av/bta_av_act.c"
+                   "bluedroid/bta/av/bta_av_api.c"
+                   "bluedroid/bta/av/bta_av_cfg.c"
+                   "bluedroid/bta/av/bta_av_ci.c"
+                   "bluedroid/bta/av/bta_av_main.c"
+                   "bluedroid/bta/av/bta_av_sbc.c"
+                   "bluedroid/bta/av/bta_av_ssm.c"
+                   "bluedroid/bta/dm/bta_dm_act.c"
+                   "bluedroid/bta/dm/bta_dm_api.c"
+                   "bluedroid/bta/dm/bta_dm_cfg.c"
+                   "bluedroid/bta/dm/bta_dm_ci.c"
+                   "bluedroid/bta/dm/bta_dm_co.c"
+                   "bluedroid/bta/dm/bta_dm_main.c"
+                   "bluedroid/bta/dm/bta_dm_pm.c"
+                   "bluedroid/bta/dm/bta_dm_sco.c"
+                   "bluedroid/bta/gatt/bta_gatt_common.c"
+                   "bluedroid/bta/gatt/bta_gattc_act.c"
+                   "bluedroid/bta/gatt/bta_gattc_api.c"
+                   "bluedroid/bta/gatt/bta_gattc_cache.c"
+                   "bluedroid/bta/gatt/bta_gattc_ci.c"
+                   "bluedroid/bta/gatt/bta_gattc_co.c"
+                   "bluedroid/bta/gatt/bta_gattc_main.c"
+                   "bluedroid/bta/gatt/bta_gattc_utils.c"
+                   "bluedroid/bta/gatt/bta_gatts_act.c"
+                   "bluedroid/bta/gatt/bta_gatts_api.c"
+                   "bluedroid/bta/gatt/bta_gatts_co.c"
+                   "bluedroid/bta/gatt/bta_gatts_main.c"
+                   "bluedroid/bta/gatt/bta_gatts_utils.c"
+                   "bluedroid/bta/hh/bta_hh_act.c"
+                   "bluedroid/bta/hh/bta_hh_api.c"
+                   "bluedroid/bta/hh/bta_hh_cfg.c"
+                   "bluedroid/bta/hh/bta_hh_le.c"
+                   "bluedroid/bta/hh/bta_hh_main.c"
+                   "bluedroid/bta/hh/bta_hh_utils.c"
+                   "bluedroid/bta/jv/bta_jv_act.c"
+                   "bluedroid/bta/jv/bta_jv_api.c"
+                   "bluedroid/bta/jv/bta_jv_cfg.c"
+                   "bluedroid/bta/jv/bta_jv_main.c"
+                   "bluedroid/bta/sdp/bta_sdp.c"
+                   "bluedroid/bta/sdp/bta_sdp_act.c"
+                   "bluedroid/bta/sdp/bta_sdp_api.c"
+                   "bluedroid/bta/sdp/bta_sdp_cfg.c"
+                   "bluedroid/bta/sys/bta_sys_conn.c"
+                   "bluedroid/bta/sys/bta_sys_main.c"
+                   "bluedroid/bta/sys/utl.c"
+                   "bluedroid/btc/core/btc_alarm.c"
+                   "bluedroid/btc/core/btc_ble_storage.c"
+                   "bluedroid/btc/core/btc_config.c"
+                   "bluedroid/btc/core/btc_dev.c"
+                   "bluedroid/btc/core/btc_dm.c"
+                   "bluedroid/btc/core/btc_main.c"
+                   "bluedroid/btc/core/btc_manage.c"
+                   "bluedroid/btc/core/btc_profile_queue.c"
+                   "bluedroid/btc/core/btc_sec.c"
+                   "bluedroid/btc/core/btc_sm.c"
+                   "bluedroid/btc/core/btc_storage.c"
+                   "bluedroid/btc/core/btc_task.c"
+                   "bluedroid/btc/core/btc_util.c"
+                   "bluedroid/btc/profile/esp/blufi/blufi_prf.c"
+                   "bluedroid/btc/profile/esp/blufi/blufi_protocol.c"
+                   "bluedroid/btc/profile/std/a2dp/bta_av_co.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_av.c"
+                   "bluedroid/btc/profile/std/avrc/btc_avrc.c"
+                   "bluedroid/btc/profile/std/gap/btc_gap_ble.c"
+                   "bluedroid/btc/profile/std/gap/btc_gap_bt.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gatt_common.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gatt_util.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gattc.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gatts.c"
+                   "bluedroid/btc/profile/std/spp/btc_spp.c"
+                   "bluedroid/device/bdaddr.c"
+                   "bluedroid/device/controller.c"
+                   "bluedroid/device/interop.c"
+                   "bluedroid/external/sbc/decoder/srce/alloc.c"
+                   "bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c"
+                   "bluedroid/external/sbc/decoder/srce/bitalloc.c"
+                   "bluedroid/external/sbc/decoder/srce/bitstream-decode.c"
+                   "bluedroid/external/sbc/decoder/srce/decoder-oina.c"
+                   "bluedroid/external/sbc/decoder/srce/decoder-private.c"
+                   "bluedroid/external/sbc/decoder/srce/decoder-sbc.c"
+                   "bluedroid/external/sbc/decoder/srce/dequant.c"
+                   "bluedroid/external/sbc/decoder/srce/framing-sbc.c"
+                   "bluedroid/external/sbc/decoder/srce/framing.c"
+                   "bluedroid/external/sbc/decoder/srce/oi_codec_version.c"
+                   "bluedroid/external/sbc/decoder/srce/synthesis-8-generated.c"
+                   "bluedroid/external/sbc/decoder/srce/synthesis-dct8.c"
+                   "bluedroid/external/sbc/decoder/srce/synthesis-sbc.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_analysis.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_dct.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_dct_coeffs.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_enc_coeffs.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_encoder.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_packing.c"
+                   "bluedroid/hci/buffer_allocator.c"
+                   "bluedroid/hci/hci_audio.c"
+                   "bluedroid/hci/hci_hal_h4.c"
+                   "bluedroid/hci/hci_layer.c"
+                   "bluedroid/hci/hci_packet_factory.c"
+                   "bluedroid/hci/hci_packet_parser.c"
+                   "bluedroid/hci/packet_fragmenter.c"
+                   "bluedroid/main/bte_init.c"
+                   "bluedroid/main/bte_main.c"
+                   "bluedroid/osi/alarm.c"
+                   "bluedroid/osi/allocator.c"
+                   "bluedroid/osi/buffer.c"
+                   "bluedroid/osi/config.c"
+                   "bluedroid/osi/fixed_queue.c"
+                   "bluedroid/osi/future.c"
+                   "bluedroid/osi/hash_functions.c"
+                   "bluedroid/osi/hash_map.c"
+                   "bluedroid/osi/list.c"
+                   "bluedroid/osi/mutex.c"
+                   "bluedroid/osi/osi.c"
+                   "bluedroid/osi/semaphore.c"
+                   "bluedroid/stack/a2dp/a2d_api.c"
+                   "bluedroid/stack/a2dp/a2d_sbc.c"
+                   "bluedroid/stack/avct/avct_api.c"
+                   "bluedroid/stack/avct/avct_ccb.c"
+                   "bluedroid/stack/avct/avct_l2c.c"
+                   "bluedroid/stack/avct/avct_lcb.c"
+                   "bluedroid/stack/avct/avct_lcb_act.c"
+                   "bluedroid/stack/avdt/avdt_ad.c"
+                   "bluedroid/stack/avdt/avdt_api.c"
+                   "bluedroid/stack/avdt/avdt_ccb.c"
+                   "bluedroid/stack/avdt/avdt_ccb_act.c"
+                   "bluedroid/stack/avdt/avdt_l2c.c"
+                   "bluedroid/stack/avdt/avdt_msg.c"
+                   "bluedroid/stack/avdt/avdt_scb.c"
+                   "bluedroid/stack/avdt/avdt_scb_act.c"
+                   "bluedroid/stack/avrc/avrc_api.c"
+                   "bluedroid/stack/avrc/avrc_bld_ct.c"
+                   "bluedroid/stack/avrc/avrc_bld_tg.c"
+                   "bluedroid/stack/avrc/avrc_opt.c"
+                   "bluedroid/stack/avrc/avrc_pars_ct.c"
+                   "bluedroid/stack/avrc/avrc_pars_tg.c"
+                   "bluedroid/stack/avrc/avrc_sdp.c"
+                   "bluedroid/stack/avrc/avrc_utils.c"
+                   "bluedroid/stack/btm/btm_acl.c"
+                   "bluedroid/stack/btm/btm_ble.c"
+                   "bluedroid/stack/btm/btm_ble_addr.c"
+                   "bluedroid/stack/btm/btm_ble_adv_filter.c"
+                   "bluedroid/stack/btm/btm_ble_batchscan.c"
+                   "bluedroid/stack/btm/btm_ble_bgconn.c"
+                   "bluedroid/stack/btm/btm_ble_cont_energy.c"
+                   "bluedroid/stack/btm/btm_ble_gap.c"
+                   "bluedroid/stack/btm/btm_ble_multi_adv.c"
+                   "bluedroid/stack/btm/btm_ble_privacy.c"
+                   "bluedroid/stack/btm/btm_dev.c"
+                   "bluedroid/stack/btm/btm_devctl.c"
+                   "bluedroid/stack/btm/btm_inq.c"
+                   "bluedroid/stack/btm/btm_main.c"
+                   "bluedroid/stack/btm/btm_pm.c"
+                   "bluedroid/stack/btm/btm_sco.c"
+                   "bluedroid/stack/btm/btm_sec.c"
+                   "bluedroid/stack/btu/btu_hcif.c"
+                   "bluedroid/stack/btu/btu_init.c"
+                   "bluedroid/stack/btu/btu_task.c"
+                   "bluedroid/stack/gap/gap_api.c"
+                   "bluedroid/stack/gap/gap_ble.c"
+                   "bluedroid/stack/gap/gap_conn.c"
+                   "bluedroid/stack/gap/gap_utils.c"
+                   "bluedroid/stack/gatt/att_protocol.c"
+                   "bluedroid/stack/gatt/gatt_api.c"
+                   "bluedroid/stack/gatt/gatt_attr.c"
+                   "bluedroid/stack/gatt/gatt_auth.c"
+                   "bluedroid/stack/gatt/gatt_cl.c"
+                   "bluedroid/stack/gatt/gatt_db.c"
+                   "bluedroid/stack/gatt/gatt_main.c"
+                   "bluedroid/stack/gatt/gatt_sr.c"
+                   "bluedroid/stack/gatt/gatt_utils.c"
+                   "bluedroid/stack/hcic/hciblecmds.c"
+                   "bluedroid/stack/hcic/hcicmds.c"
+                   "bluedroid/stack/l2cap/l2c_api.c"
+                   "bluedroid/stack/l2cap/l2c_ble.c"
+                   "bluedroid/stack/l2cap/l2c_csm.c"
+                   "bluedroid/stack/l2cap/l2c_fcr.c"
+                   "bluedroid/stack/l2cap/l2c_link.c"
+                   "bluedroid/stack/l2cap/l2c_main.c"
+                   "bluedroid/stack/l2cap/l2c_ucd.c"
+                   "bluedroid/stack/l2cap/l2c_utils.c"
+                   "bluedroid/stack/l2cap/l2cap_client.c"
+                   "bluedroid/stack/rfcomm/port_api.c"
+                   "bluedroid/stack/rfcomm/port_rfc.c"
+                   "bluedroid/stack/rfcomm/port_utils.c"
+                   "bluedroid/stack/rfcomm/rfc_l2cap_if.c"
+                   "bluedroid/stack/rfcomm/rfc_mx_fsm.c"
+                   "bluedroid/stack/rfcomm/rfc_port_fsm.c"
+                   "bluedroid/stack/rfcomm/rfc_port_if.c"
+                   "bluedroid/stack/rfcomm/rfc_ts_frames.c"
+                   "bluedroid/stack/rfcomm/rfc_utils.c"
+                   "bluedroid/stack/sdp/sdp_api.c"
+                   "bluedroid/stack/sdp/sdp_db.c"
+                   "bluedroid/stack/sdp/sdp_discovery.c"
+                   "bluedroid/stack/sdp/sdp_main.c"
+                   "bluedroid/stack/sdp/sdp_server.c"
+                   "bluedroid/stack/sdp/sdp_utils.c"
+                   "bluedroid/stack/smp/aes.c"
+                   "bluedroid/stack/smp/p_256_curvepara.c"
+                   "bluedroid/stack/smp/p_256_ecc_pp.c"
+                   "bluedroid/stack/smp/p_256_multprecision.c"
+                   "bluedroid/stack/smp/smp_act.c"
+                   "bluedroid/stack/smp/smp_api.c"
+                   "bluedroid/stack/smp/smp_br_main.c"
+                   "bluedroid/stack/smp/smp_cmac.c"
+                   "bluedroid/stack/smp/smp_keys.c"
+                   "bluedroid/stack/smp/smp_l2c.c"
+                   "bluedroid/stack/smp/smp_main.c"
+                   "bluedroid/stack/smp/smp_utils.c")
+    endif()
+endif()
+
+# requirements can't depend on config
+set(COMPONENT_PRIV_REQUIRES nvs_flash)
+
+register_component()
+
+if(CONFIG_BT_ENABLED)
+    target_link_libraries(bt "-L${CMAKE_CURRENT_LIST_DIR}/lib")
+    target_link_libraries(bt btdm_app)
+endif()
@@ -70,7 +70,7 @@ menu "MODEM SLEEP Options"
 config BTDM_CONTROLLER_MODEM_SLEEP
    bool "Bluetooth modem sleep"
    depends on BT_ENABLED
-    default n
+    default y
    help
        Enable/disable bluetooth controller low power mode.
        Note that currently there is problem in the combination use of bluetooth modem sleep and Dynamic Frequency Scaling(DFS). So do not enable DFS if bluetooth modem sleep is in use.
@@ -1004,8 +1004,17 @@ config BT_BLE_DYNAMIC_ENV_MEMORY
    help
        This select can make the allocation of memory will become more flexible

+config BLE_HOST_QUEUE_CONGESTION_CHECK
+    bool "BLE queue congestion check"
+    depends on BLUEDROID_ENABLED
+    default n
+    help
+        When scanning and scan duplicate is not enabled, if there are a lot of adv packets around or application layer 
+        handling adv packets is slow, it will cause the controller memory to run out. if enabled, adv packets will be 
+        lost when host queue is congested.
+
 config BLE_SCAN_DUPLICATE
-    bool "BLE Scan Duplicate Options "
+    bool "BLE Scan Duplicate Options"
    depends on BLUEDROID_ENABLED
    default y
    help
@@ -1014,8 +1023,8 @@ config BLE_SCAN_DUPLICATE
 config DUPLICATE_SCAN_CACHE_SIZE
    int "Maximum number of devices in scan duplicate filter"
    depends on BLE_SCAN_DUPLICATE
-    range 10 200
-    default 20
+    range 10 1000
+    default 50
    help
        Maximum number of devices which can be recorded in scan duplicate filter.
        When the maximum amount of device in the filter is reached, the cache will be refreshed.
@@ -1030,8 +1039,8 @@ config BLE_MESH_SCAN_DUPLICATE_EN
 config MESH_DUPLICATE_SCAN_CACHE_SIZE
    int "Maximum number of Mesh adv packets in scan duplicate filter"
    depends on BLE_MESH_SCAN_DUPLICATE_EN
-    range 10 200
-    default 50
+    range 10 1000
+    default 100
    help
        Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
        When the maximum amount of device in the filter is reached, the cache will be refreshed.
@@ -240,4 +240,50 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
    return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, esp_bt_pin_code_t pin_code)
+{
+    btc_msg_t msg;
+    btc_gap_bt_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_ACT_SET_PIN_TYPE;
+    arg.set_pin_type.pin_type = pin_type;
+    if (pin_type == ESP_BT_PIN_TYPE_FIXED){
+        arg.set_pin_type.pin_code_len = pin_code_len;
+        memcpy(arg.set_pin_type.pin_code, pin_code, pin_code_len);
+    } else {
+        arg.set_pin_type.pin_code_len = 0;
+        memset(arg.set_pin_type.pin_code, 0, ESP_BT_PIN_CODE_LEN);
+    }
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_code_len, esp_bt_pin_code_t pin_code)
+{
+    btc_msg_t msg;
+    btc_gap_bt_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_ACT_PIN_REPLY;
+    arg.pin_reply.accept = accept;
+    arg.pin_reply.pin_code_len = pin_code_len;
+    memcpy(arg.pin_reply.bda.address, bd_addr, sizeof(esp_bd_addr_t));
+    memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 #endif /* #if BTC_GAP_BT_INCLUDED == TRUE */
@@ -164,6 +164,7 @@ esp_gatt_status_t esp_ble_gattc_get_all_char(esp_gatt_if_t gattc_if,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

    if ((start_handle == 0) && (end_handle == 0)) {
+        *count = 0;
        return ESP_GATT_INVALID_HANDLE;
    }

@@ -206,6 +207,7 @@ esp_gatt_status_t esp_ble_gattc_get_char_by_uuid(esp_gatt_if_t gattc_if,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

    if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
        return ESP_GATT_INVALID_HANDLE;
    }

@@ -247,6 +249,7 @@ esp_gatt_status_t esp_ble_gattc_get_descr_by_char_handle(esp_gatt_if_t gattc_if,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

    if (char_handle == 0) {
+        *count = 0;
        return ESP_GATT_INVALID_HANDLE;
    }
    
@@ -269,6 +272,7 @@ esp_gatt_status_t esp_ble_gattc_get_include_service(esp_gatt_if_t gattc_if,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

    if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
        return ESP_GATT_INVALID_HANDLE;
    }

@@ -291,6 +295,7 @@ esp_gatt_status_t esp_ble_gattc_get_attr_count(esp_gatt_if_t gattc_if,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

    if ((start_handle == 0 && end_handle == 0) && (type != ESP_GATT_DB_DESCRIPTOR)) {
+        *count = 0;
        return ESP_GATT_INVALID_HANDLE;
    }

@@ -308,6 +313,7 @@ esp_gatt_status_t esp_ble_gattc_get_db(esp_gatt_if_t gattc_if, uint16_t conn_id,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

    if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
        return ESP_GATT_INVALID_HANDLE;
    }

@@ -261,7 +261,7 @@ esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id,
    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
    
    if (L2CA_CheckIsCongest(L2CAP_ATT_CID, conn_id)) {
-        LOG_ERROR("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
        return ESP_FAIL;
    }
    
@@ -102,6 +102,14 @@ typedef enum {
    ESP_BT_COD_SRVC_INFORMATION              = 0x400,    /*!< Information, e.g., WEB-server, WAP-server */
 } esp_bt_cod_srvc_t;

+typedef enum{
+    ESP_BT_PIN_TYPE_VARIABLE = 0,                       /*!< Refer to BTM_PIN_TYPE_VARIABLE */
+    ESP_BT_PIN_TYPE_FIXED    = 1,                       /*!< Refer to BTM_PIN_TYPE_FIXED */
+} esp_bt_pin_type_t;
+
+#define ESP_BT_PIN_CODE_LEN        16                   /*!< Max pin code length */
+typedef uint8_t esp_bt_pin_code_t[ESP_BT_PIN_CODE_LEN]; /*!< Pin Code (upto 128 bits) MSB is 0 */
+
 /// Bits of major service class field
 #define ESP_BT_COD_SRVC_BIT_MASK              (0xffe000) /*!< Major service bit mask */
 #define ESP_BT_COD_SRVC_BIT_OFFSET            (13)       /*!< Major service bit offset */
@@ -149,6 +157,7 @@ typedef enum {
    ESP_BT_GAP_RMT_SRVCS_EVT,                       /*!< get remote services event */
    ESP_BT_GAP_RMT_SRVC_REC_EVT,                    /*!< get remote service record event */
    ESP_BT_GAP_AUTH_CMPL_EVT,                       /*!< AUTH complete event */
+    ESP_BT_GAP_PIN_REQ_EVT,                         /*!< Legacy Pairing Pin code request */
    ESP_BT_GAP_READ_RSSI_DELTA_EVT,                 /*!< read rssi event */
    ESP_BT_GAP_EVT_MAX,
 } esp_bt_gap_cb_event_t;
@@ -216,6 +225,15 @@ typedef union {
        esp_bt_status_t stat;                  /*!< authentication complete status */
        uint8_t device_name[ESP_BT_GAP_MAX_BDNAME_LEN + 1]; /*!< device name */
    } auth_cmpl;                               /*!< authentication complete parameter struct */
+
+    /**
+     * @brief ESP_BT_GAP_PIN_REQ_EVT
+     */
+    struct pin_req_param {
+        esp_bd_addr_t bda;                     /*!< remote bluetooth device address*/
+        bool min_16_digit;                     /*!< TRUE if the pin returned must be at least 16 digits */
+    } pin_req;                                 /*!< pin request parameter struct */
+
 } esp_bt_gap_cb_param_t;

 /**
@@ -447,6 +465,38 @@ int esp_bt_gap_get_bond_device_num(void);
 */
 esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list);

+/**
+* @brief            Set pin type and default pin code for legacy pairing.
+*
+* @param[in]        pin_type:       Use variable or fixed pin.
+*                                   If pin_type is ESP_BT_PIN_TYPE_VARIABLE, pin_code and pin_code_len
+*                                   will be ignored, and ESP_BT_GAP_PIN_REQ_EVT will come when control
+*                                   requests for pin code.
+*                                   Else, will use fixed pin code and not callback to users.
+* @param[in]        pin_code_len:   Length of pin_code
+* @param[in]        pin_code:       Pin_code
+*
+* @return           - ESP_OK : success
+*                   - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
+*                   - other  : failed
+*/
+esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, esp_bt_pin_code_t pin_code);
+
+/**
+* @brief            Reply the pin_code to the peer device for legacy pairing
+*                   when ESP_BT_GAP_PIN_REQ_EVT is coming.
+*
+* @param[in]        bd_addr:        BD address of the peer
+* @param[in]        accept:         Pin_code reply successful or declined.
+* @param[in]        pin_code_len:   Length of pin_code
+* @param[in]        pin_code:       Pin_code
+*
+* @return           - ESP_OK : success
+*                   - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
+*                   - other  : failed
+*/
+esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_code_len, esp_bt_pin_code_t pin_code);
+
 #ifdef __cplusplus
 }
 #endif
@@ -350,7 +350,8 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
                                            uint8_t max_nb_attr,
                                            uint8_t srvc_inst_id);
 /**
- * @brief           This function is called to add an included service. After included
+ * @brief           This function is called to add an included service. This function have to be called between 
+ *                  'esp_ble_gatts_create_service' and 'esp_ble_gatts_add_char'.  After included
 *                  service is included, a callback event BTA_GATTS_ADD_INCL_SRVC_EVT
 *                  is reported the included service ID.
 *
@@ -143,6 +143,7 @@ const tBTA_AV_SACT bta_av_a2d_action[] = {
    bta_av_role_res,        /* BTA_AV_ROLE_RES */
    bta_av_delay_co,        /* BTA_AV_DELAY_CO */
    bta_av_open_at_inc,     /* BTA_AV_OPEN_AT_INC */
+    bta_av_open_fail_sdp,   /* BTA_AV_OPEN_FAIL_SDP */
    NULL
 };

@@ -1060,6 +1061,35 @@ void bta_av_free_sdb(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
    utl_freebuf((void **) &p_scb->p_disc_db);
 }

+/*******************************************************************************
+**
+** Function         bta_av_open_fail_sdp
+**
+** Description      report BTA_AV_OPEN_EVT with service discovery failed status
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_av_open_fail_sdp(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
+{
+    tBTA_AV_OPEN open;
+
+    bdcpy(open.bd_addr, p_scb->peer_addr);
+    open.chnl   = p_scb->chnl;
+    open.hndl   = p_scb->hndl;
+    open.status = BTA_AV_FAIL_SDP;
+
+    if (p_scb->seps[p_scb->sep_idx].tsep == AVDT_TSEP_SRC ) {
+        open.sep = AVDT_TSEP_SNK;
+    } else if (p_scb->seps[p_scb->sep_idx].tsep == AVDT_TSEP_SNK ) {
+        open.sep = AVDT_TSEP_SRC;
+    }
+
+    (*bta_av_cb.p_cback)(BTA_AV_OPEN_EVT, (tBTA_AV *) &open);
+
+    UNUSED(p_data);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_av_config_ind
@@ -1544,6 +1574,17 @@ void bta_av_disc_results (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
    /* store number of stream endpoints returned */
    p_scb->num_seps = p_data->str_msg.msg.discover_cfm.num_seps;

+    UINT8 num_seps = (p_scb->num_seps < BTA_AV_NUM_SEPS) ? p_scb->num_seps : BTA_AV_NUM_SEPS;
+    memcpy(p_scb->sep_info, p_data->str_msg.msg.discover_cfm.p_sep_info, sizeof(tAVDT_SEP_INFO) * num_seps);
+    for (i = 0; i < p_data->str_msg.msg.discover_cfm.num_seps; i++) {
+        APPL_TRACE_DEBUG("peer sep %d, in use %d, seid %d, media type %d,  tsep %d",
+                           i,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].in_use,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].seid,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].media_type,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].tsep
+                           );
+    }
    for (i = 0; i < p_scb->num_seps; i++) {
        /* steam not in use, is a sink, and is audio */
        if ((p_scb->sep_info[i].in_use == FALSE) &&
@@ -1557,7 +1598,7 @@ void bta_av_disc_results (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
                    (uuid_int == UUID_SERVCLASS_AUDIO_SINK)) {
                num_srcs++;
            }
-
+            APPL_TRACE_DEBUG("num srcs: %d, num_snks: %d\n", num_snks, num_srcs);
        }
    }

@@ -105,7 +105,7 @@ void BTA_AvDisable(void)
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos)
+void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep)
 {
    tBTA_AV_API_REG  *p_buf;

@@ -122,6 +122,7 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
        p_buf->app_id = app_id;
        p_buf->p_app_data_cback = p_data_cback;
        p_buf->bta_av_cos = bta_av_cos;
+        p_buf->tsep = tsep;
        bta_sys_sendmsg(p_buf);
    }
 }
@@ -578,18 +578,20 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            }

            /* Set the Capturing service class bit */
+            if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                cod.service = BTM_COD_SERVICE_CAPTURING;
+            } else {
 #if (BTA_AV_SINK_INCLUDED == TRUE)
-            cod.service = BTM_COD_SERVICE_CAPTURING | BTM_COD_SERVICE_RENDERING;
-#else
-            cod.service = BTM_COD_SERVICE_CAPTURING;
+                cod.service = BTM_COD_SERVICE_RENDERING;
 #endif
+            }
            utl_set_device_class(&cod, BTA_UTL_SET_COD_SERVICE_CLASS);
        } /* if 1st channel */

        /* get stream configuration and create stream */
        /* memset(&cs.cfg,0,sizeof(tAVDT_CFG)); */
        cs.cfg.num_codec = 1;
-        cs.tsep = AVDT_TSEP_SRC;
+        cs.tsep = p_data->api_reg.tsep;

        /*
         * memset of cs takes care setting call back pointers to null.
@@ -637,11 +639,10 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            memcpy(&p_scb->cfg, &cs.cfg, sizeof(tAVDT_CFG));
            while (index < BTA_AV_MAX_SEPS &&
                    (p_scb->p_cos->init)(&codec_type, cs.cfg.codec_info,
-                                         &cs.cfg.num_protect, cs.cfg.protect_info, index) == TRUE) {
+                                         &cs.cfg.num_protect, cs.cfg.protect_info, p_data->api_reg.tsep) == TRUE) {

 #if (BTA_AV_SINK_INCLUDED == TRUE)
-                if (index == 1) {
-                    cs.tsep = AVDT_TSEP_SNK;
+                if (p_data->api_reg.tsep == AVDT_TSEP_SNK) {
                    cs.p_data_cback = bta_av_stream_data_cback;
                }
                APPL_TRACE_DEBUG(" SEP Type = %d\n", cs.tsep);
@@ -667,18 +668,20 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            }

            if (!bta_av_cb.reg_audio) {
-                /* create the SDP records on the 1st audio channel */
-                bta_av_cb.sdp_a2d_handle = SDP_CreateRecord();
-                A2D_AddRecord(UUID_SERVCLASS_AUDIO_SOURCE, p_service_name, NULL,
-                              A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_handle);
-                bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
-
+                if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                    /* create the SDP records on the 1st audio channel */
+                    bta_av_cb.sdp_a2d_handle = SDP_CreateRecord();
+                    A2D_AddRecord(UUID_SERVCLASS_AUDIO_SOURCE, p_service_name, NULL,
+                                  A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_handle);
+                    bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
+                } else {
 #if (BTA_AV_SINK_INCLUDED == TRUE)
-                bta_av_cb.sdp_a2d_snk_handle = SDP_CreateRecord();
-                A2D_AddRecord(UUID_SERVCLASS_AUDIO_SINK, p_avk_service_name, NULL,
-                              A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_snk_handle);
-                bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SINK);
+                    bta_av_cb.sdp_a2d_snk_handle = SDP_CreateRecord();
+                    A2D_AddRecord(UUID_SERVCLASS_AUDIO_SINK, p_avk_service_name, NULL,
+                                  A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_snk_handle);
+                    bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SINK);
 #endif
+                }
                /* start listening when A2DP is registered */
                if (bta_av_cb.features & BTA_AV_FEAT_RCTG) {
                    bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
@@ -94,6 +94,7 @@ enum {
    BTA_AV_ROLE_RES,
    BTA_AV_DELAY_CO,
    BTA_AV_OPEN_AT_INC,
+    BTA_AV_OPEN_FAIL_SDP,
    BTA_AV_NUM_SACTIONS
 };

@@ -199,7 +200,7 @@ static const UINT8 bta_av_sst_opening[][BTA_AV_NUM_COLS] = {
    /* CI_SETCONFIG_OK_EVT */   {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
    /* CI_SETCONFIG_FAIL_EVT */ {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
    /* SDP_DISC_OK_EVT */       {BTA_AV_CONNECT_REQ,    BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
-    /* SDP_DISC_FAIL_EVT */     {BTA_AV_CONNECT_REQ,    BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
+    /* SDP_DISC_FAIL_EVT */     {BTA_AV_FREE_SDB,       BTA_AV_OPEN_FAIL_SDP,  BTA_AV_INIT_SST },
    /* STR_DISC_OK_EVT */       {BTA_AV_DISC_RESULTS,   BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
    /* STR_DISC_FAIL_EVT */     {BTA_AV_OPEN_FAILED,    BTA_AV_SIGNORE,        BTA_AV_CLOSING_SST },
    /* STR_GETCAP_OK_EVT */     {BTA_AV_GETCAP_RESULTS, BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
@@ -158,44 +158,6 @@ enum {
 /*****************************************************************************
 **  Data types
 *****************************************************************************/
-#if 0
-/* function types for call-out functions */
-typedef BOOLEAN (*tBTA_AV_CO_INIT) (UINT8 *p_codec_type, UINT8 *p_codec_info,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 index);
-typedef void (*tBTA_AV_CO_DISC_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
-                                     UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
-typedef UINT8 (*tBTA_AV_CO_GETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
-                                    UINT8 *p_codec_info, UINT8 *p_sep_info_idx, UINT8 seid,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info);
-typedef void (*tBTA_AV_CO_SETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
-                                   UINT8 *p_codec_info, UINT8 seid, BD_ADDR addr,
-                                   UINT8 num_protect, UINT8 *p_protect_info,
-                                   UINT8 t_local_sep, UINT8 avdt_handle);
-typedef void (*tBTA_AV_CO_OPEN) (tBTA_AV_HNDL hndl,
-                                 tBTA_AV_CODEC codec_type, UINT8 *p_codec_info,
-                                 UINT16 mtu);
-typedef void (*tBTA_AV_CO_CLOSE) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type, UINT16 mtu);
-typedef void (*tBTA_AV_CO_START) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type, UINT8 *p_codec_info, BOOLEAN *p_no_rtp_hdr);
-typedef void (*tBTA_AV_CO_STOP) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type);
-typedef void *(*tBTA_AV_CO_DATAPATH) (tBTA_AV_CODEC codec_type,
-                                      UINT32 *p_len, UINT32 *p_timestamp);
-typedef void (*tBTA_AV_CO_DELAY) (tBTA_AV_HNDL hndl, UINT16 delay);
-
-/* the call-out functions for one stream */
-typedef struct {
-    tBTA_AV_CO_INIT     init;
-    tBTA_AV_CO_DISC_RES disc_res;
-    tBTA_AV_CO_GETCFG   getcfg;
-    tBTA_AV_CO_SETCFG   setcfg;
-    tBTA_AV_CO_OPEN     open;
-    tBTA_AV_CO_CLOSE    close;
-    tBTA_AV_CO_START    start;
-    tBTA_AV_CO_STOP     stop;
-    tBTA_AV_CO_DATAPATH data;
-    tBTA_AV_CO_DELAY    delay;
-} tBTA_AV_CO_FUNCTS;
-#endif
-
 /* data type for BTA_AV_API_ENABLE_EVT */
 typedef struct {
    BT_HDR              hdr;
@@ -209,7 +171,8 @@ typedef struct {
    BT_HDR              hdr;
    char                p_service_name[BTA_SERVICE_NAME_LEN + 1];
    UINT8               app_id;
-    tBTA_AV_DATA_CBACK       *p_app_data_cback;
+    UINT8               tsep; // local SEP type
+    tBTA_AV_DATA_CBACK  *p_app_data_cback;
    tBTA_AV_CO_FUNCTS   *bta_av_cos;
 } tBTA_AV_API_REG;

@@ -698,6 +661,7 @@ extern void bta_av_switch_role (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
 extern void bta_av_role_res (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
 extern void bta_av_delay_co (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
 extern void bta_av_open_at_inc (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
+extern void bta_av_open_fail_sdp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);

 /* ssm action functions - vdp specific */
 extern void bta_av_do_disc_vdp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
@@ -602,16 +602,16 @@ void bta_dm_ble_read_adv_tx_power(tBTA_DM_MSG *p_data)
    if (p_data->read_tx_power.read_tx_power_cb != NULL) {
        BTM_BleReadAdvTxPower(p_data->read_tx_power.read_tx_power_cb);
    } else {
-        APPL_TRACE_ERROR("%s(), the callback function cann't be NULL.", __func__);
+        APPL_TRACE_ERROR("%s(), the callback function can't be NULL.", __func__);
    }
 }

 void bta_dm_ble_read_rssi(tBTA_DM_MSG *p_data)
 {
    if (p_data->rssi.read_rssi_cb != NULL) {
-        BTM_ReadRSSI(p_data->rssi.remote_addr, p_data->rssi.read_rssi_cb);
+        BTM_ReadRSSI(p_data->rssi.remote_addr, p_data->rssi.transport, p_data->rssi.read_rssi_cb);
    } else {
-        APPL_TRACE_ERROR("%s(), the callback function cann't be NULL.", __func__);
+        APPL_TRACE_ERROR("%s(), the callback function can't be NULL.", __func__);
    }
 }

@@ -698,25 +698,29 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
 ** Description      Removes device, Disconnects ACL link if required.
 ****
 *******************************************************************************/
-void bta_dm_process_remove_device(BD_ADDR bd_addr)
+static void bta_dm_process_remove_device(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 {
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
    /* need to remove all pending background connection before unpair */
    BTA_GATTC_CancelOpen(0, bd_addr, FALSE);
 #endif

-    BTM_SecDeleteDevice(bd_addr);
+    BTM_SecDeleteDevice(bd_addr, transport);

 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
    /* remove all cached GATT information */
    BTA_GATTC_Refresh(bd_addr, false);
 #endif
-
    if (bta_dm_cb.p_sec_cback) {
        tBTA_DM_SEC sec_event;
        bdcpy(sec_event.link_down.bd_addr, bd_addr);
        sec_event.link_down.status = HCI_SUCCESS;
-        bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &sec_event);
+        if (transport == BT_TRANSPORT_LE){
+            bta_dm_cb.p_sec_cback(BTA_DM_BLE_DEV_UNPAIRED_EVT, &sec_event);
+        } else {
+            bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &sec_event);
+        }
+
    }
 }

@@ -734,32 +738,22 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
        return;
    }

-    BD_ADDR other_address;
-    bdcpy(other_address, p_dev->bd_addr);
-
    /* If ACL exists for the device in the remove_bond message*/
    BOOLEAN continue_delete_dev = FALSE;
-    UINT8 other_transport = BT_TRANSPORT_INVALID;
+    UINT8 transport = p_dev->transport;

-    if (BTM_IsAclConnectionUp(p_dev->bd_addr, BT_TRANSPORT_LE) ||
-            BTM_IsAclConnectionUp(p_dev->bd_addr, BT_TRANSPORT_BR_EDR)) {
+    if (BTM_IsAclConnectionUp(p_dev->bd_addr, transport)) {
        APPL_TRACE_DEBUG("%s: ACL Up count  %d", __func__, bta_dm_cb.device_list.count);
        continue_delete_dev = FALSE;

        /* Take the link down first, and mark the device for removal when disconnected */
        for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
-            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_dev->bd_addr)) {
+            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_dev->bd_addr)
+                && bta_dm_cb.device_list.peer_device[i].transport == transport) {
                bta_dm_cb.device_list.peer_device[i].conn_state = BTA_DM_UNPAIRING;
                btm_remove_acl( p_dev->bd_addr, bta_dm_cb.device_list.peer_device[i].transport);
                APPL_TRACE_DEBUG("%s:transport = %d", __func__,
                                 bta_dm_cb.device_list.peer_device[i].transport);
-
-                /* save the other transport to check if device is connected on other_transport */
-                if (bta_dm_cb.device_list.peer_device[i].transport == BT_TRANSPORT_LE) {
-                    other_transport = BT_TRANSPORT_BR_EDR;
-                } else {
-                    other_transport = BT_TRANSPORT_LE;
-                }
                break;
            }
        }
@@ -767,35 +761,9 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
        continue_delete_dev = TRUE;
    }

-    // If it is DUMO device and device is paired as different address, unpair that device
-    // if different address
-    BOOLEAN continue_delete_other_dev = FALSE;
-    if ((other_transport && (BTM_ReadConnectedTransportAddress(other_address, other_transport))) ||
-            (!other_transport && (BTM_ReadConnectedTransportAddress(other_address, BT_TRANSPORT_BR_EDR) ||
-                                  BTM_ReadConnectedTransportAddress(other_address, BT_TRANSPORT_LE)))) {
-        continue_delete_other_dev = FALSE;
-        /* Take the link down first, and mark the device for removal when disconnected */
-        for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
-            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, other_address)) {
-                bta_dm_cb.device_list.peer_device[i].conn_state = BTA_DM_UNPAIRING;
-                btm_remove_acl(other_address, bta_dm_cb.device_list.peer_device[i].transport);
-                break;
-            }
-        }
-    } else {
-        APPL_TRACE_DEBUG("%s: continue to delete the other dev ", __func__);
-        continue_delete_other_dev = TRUE;
-    }
-
    /* Delete the device mentioned in the msg */
    if (continue_delete_dev) {
-        bta_dm_process_remove_device(p_dev->bd_addr);
-    }
-
-    /* Delete the other paired device too */
-    BD_ADDR dummy_bda = {0};
-    if (continue_delete_other_dev && (bdcmp(other_address, dummy_bda) != 0)) {
-        bta_dm_process_remove_device(other_address);
+        bta_dm_process_remove_device(p_dev->bd_addr, transport);
    }
 }

@@ -886,7 +854,7 @@ void bta_dm_close_acl(tBTA_DM_MSG *p_data)
    }
    /* if to remove the device from security database ? do it now */
    else if (p_remove_acl->remove_dev) {
-        if (!BTM_SecDeleteDevice(p_remove_acl->bd_addr)) {
+        if (!BTM_SecDeleteDevice(p_remove_acl->bd_addr, p_remove_acl->transport)) {
            APPL_TRACE_ERROR("delete device from security database failed.");
        }
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
@@ -1006,6 +974,21 @@ void bta_dm_bond_cancel (tBTA_DM_MSG *p_data)

 }

+/*******************************************************************************
+**
+** Function         bta_dm_set_pin_type
+**
+** Description      Set the pin type and fixed pin
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_dm_set_pin_type (tBTA_DM_MSG *p_data)
+{
+    BTM_SetPinType (p_data->set_pin_type.pin_type, p_data->set_pin_type.p_pin, p_data->set_pin_type.pin_len);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_pin_reply
@@ -3289,7 +3272,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
            }

            if ( bta_dm_cb.device_list.peer_device[i].conn_state == BTA_DM_UNPAIRING ) {
-                if (BTM_SecDeleteDevice(bta_dm_cb.device_list.peer_device[i].peer_bdaddr)) {
+                if (BTM_SecDeleteDevice(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, bta_dm_cb.device_list.peer_device[i].transport)) {
                    issue_unpair_cb = TRUE;
                }

@@ -3337,7 +3320,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
            }
        }
        if (conn.link_down.is_removed) {
-            BTM_SecDeleteDevice(p_bda);
+            BTM_SecDeleteDevice(p_bda, p_data->acl_change.transport);
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
            /* need to remove all pending background connection */
            BTA_GATTC_CancelOpen(0, p_bda, FALSE);
@@ -3351,7 +3334,11 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
        if ( bta_dm_cb.p_sec_cback ) {
            bta_dm_cb.p_sec_cback(BTA_DM_LINK_DOWN_EVT, &conn);
            if ( issue_unpair_cb ) {
-                bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &conn);
+                if (p_data->acl_change.transport == BT_TRANSPORT_LE) {
+                    bta_dm_cb.p_sec_cback(BTA_DM_BLE_DEV_UNPAIRED_EVT, &conn);
+                } else {
+                    bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &conn);
+                }
            }
        }
    }
@@ -3511,7 +3498,7 @@ static void bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr)
            APPL_TRACE_ERROR(" %s Device does not exist in DB", __FUNCTION__);
        }
    } else {
-        BTM_SecDeleteDevice (remote_bd_addr);
+        BTM_SecDeleteDevice (remote_bd_addr, bta_dm_cb.device_list.peer_device[index].transport);
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
        /* need to remove all pending background connection */
        BTA_GATTC_CancelOpen(0, remote_bd_addr, FALSE);
@@ -4665,7 +4652,7 @@ void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data)
 void bta_dm_ble_stop_advertising(tBTA_DM_MSG *p_data)
 {
    if (p_data->hdr.event != BTA_DM_API_BLE_STOP_ADV_EVT) {
-        APPL_TRACE_ERROR("Invalid BTA event,cann't stop the BLE adverting\n");
+        APPL_TRACE_ERROR("Invalid BTA event,can't stop the BLE adverting\n");
    }

    btm_ble_stop_adv();
@@ -206,12 +206,13 @@ void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb)
    }
 }

-void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_CMPL_CB *cmpl_cb)
+void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb)
 {
    tBTA_DM_API_READ_RSSI *p_msg;
    if ((p_msg = (tBTA_DM_API_READ_RSSI *)osi_malloc(sizeof(tBTA_DM_API_READ_RSSI))) != NULL) {
        p_msg->hdr.event = BTA_DM_API_BLE_READ_RSSI_EVT;
        memcpy(p_msg->remote_addr, remote_addr, sizeof(BD_ADDR));
+        p_msg->transport = transport;
        p_msg->read_rssi_cb = cmpl_cb;
        bta_sys_sendmsg(p_msg);
    }
@@ -435,6 +436,29 @@ void BTA_DmBondCancel(BD_ADDR bd_addr)

 }

+/*******************************************************************************
+**
+** Function         BTA_DMSetPinType
+**
+** Description      This function set pin type as BTM_PIN_TYPE_FIXED or BTM_PIN_TYPE_VARIABLE
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+void BTA_DMSetPinType (UINT8 pin_type, UINT8 *pin_code, UINT8 pin_code_len)
+{
+    tBTA_DM_API_SET_PIN_TYPE    *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_SET_PIN_TYPE *) osi_malloc(sizeof(tBTA_DM_API_SET_PIN_TYPE))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_SET_PIN_TYPE_EVT;
+        p_msg->pin_type = pin_type;
+        p_msg->pin_len = pin_code_len;
+        memcpy(p_msg->p_pin, pin_code, pin_code_len);
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_DmPinReply
@@ -447,7 +471,6 @@ void BTA_DmBondCancel(BD_ADDR bd_addr)
 **
 *******************************************************************************/
 void BTA_DmPinReply(BD_ADDR bd_addr, BOOLEAN accept, UINT8 pin_len, UINT8 *p_pin)
-
 {
    tBTA_DM_API_PIN_REPLY    *p_msg;

@@ -569,7 +592,7 @@ void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
 ** Returns          void
 **
 *******************************************************************************/
-tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr)
+tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 {
    tBTA_DM_API_REMOVE_DEVICE *p_msg;

@@ -578,6 +601,7 @@ tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr)

        p_msg->hdr.event = BTA_DM_API_REMOVE_DEVICE_EVT;
        bdcpy(p_msg->bd_addr, bd_addr);
+        p_msg->transport = transport;
        bta_sys_sendmsg(p_msg);
    } else {
        return BTA_FAILURE;
@@ -53,42 +53,43 @@ typedef void (*tBTA_DM_ACTION)(tBTA_DM_MSG *p_data);
 const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {

    /* device manager local device API events */
-    bta_dm_enable,                          /* 0  BTA_DM_API_ENABLE_EVT */
-    bta_dm_disable,                         /* 1  BTA_DM_API_DISABLE_EVT */
-    bta_dm_set_dev_name,                    /* 2  BTA_DM_API_SET_NAME_EVT */
-    bta_dm_set_visibility,                  /* 3  BTA_DM_API_SET_VISIBILITY_EVT */
-    bta_dm_acl_change,                      /* 8  BTA_DM_ACL_CHANGE_EVT */
-    bta_dm_add_device,                      /* 9  BTA_DM_API_ADD_DEVICE_EVT */
-    bta_dm_close_acl,                       /* 10  BTA_DM_API_REMOVE_ACL_EVT */
+    bta_dm_enable,                          /* BTA_DM_API_ENABLE_EVT */
+    bta_dm_disable,                         /* BTA_DM_API_DISABLE_EVT */
+    bta_dm_set_dev_name,                    /* BTA_DM_API_SET_NAME_EVT */
+    bta_dm_set_visibility,                  /* BTA_DM_API_SET_VISIBILITY_EVT */
+    bta_dm_acl_change,                      /* BTA_DM_ACL_CHANGE_EVT */
+    bta_dm_add_device,                      /* BTA_DM_API_ADD_DEVICE_EVT */
+    bta_dm_close_acl,                       /* BTA_DM_API_REMOVE_ACL_EVT */
 #if (SMP_INCLUDED == TRUE)
    /* security API events */
-    bta_dm_bond,                            /* 11  BTA_DM_API_BOND_EVT */
-    bta_dm_bond_cancel,                     /* 12  BTA_DM_API_BOND_CANCEL_EVT */
-    bta_dm_pin_reply,                       /* 13 BTA_DM_API_PIN_REPLY_EVT */
+    bta_dm_bond,                            /* BTA_DM_API_BOND_EVT */
+    bta_dm_bond_cancel,                     /* BTA_DM_API_BOND_CANCEL_EVT */
+    bta_dm_set_pin_type,                    /* BTA_DM_API_SET_PIN_TYPE_EVT */
+    bta_dm_pin_reply,                       /* BTA_DM_API_PIN_REPLY_EVT */
 #endif  ///SMP_INCLUDED == TRUE
 #if (BTA_DM_PM_INCLUDED == TRUE)
    /* power manger events */
-    bta_dm_pm_btm_status,                   /* 16 BTA_DM_PM_BTM_STATUS_EVT */
-    bta_dm_pm_timer,                        /* 17 BTA_DM_PM_TIMER_EVT*/
+    bta_dm_pm_btm_status,                   /* BTA_DM_PM_BTM_STATUS_EVT */
+    bta_dm_pm_timer,                        /* BTA_DM_PM_TIMER_EVT */
 #endif /* #if (BTA_DM_PM_INCLUDED == TRUE) */
    /* simple pairing events */
 #if (SMP_INCLUDED == TRUE)
-    bta_dm_confirm,                         /* 18 BTA_DM_API_CONFIRM_EVT */
+    bta_dm_confirm,                         /* BTA_DM_API_CONFIRM_EVT */
    bta_dm_set_encryption,                  /* BTA_DM_API_SET_ENCRYPTION_EVT */
 #endif  ///SMP_INCLUDED == TRUE
 #if (BTM_OOB_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
-    bta_dm_loc_oob,                         /* 20 BTA_DM_API_LOC_OOB_EVT */
-    bta_dm_ci_io_req_act,                   /* 21 BTA_DM_CI_IO_REQ_EVT */
-    bta_dm_ci_rmt_oob_act,                  /* 22 BTA_DM_CI_RMT_OOB_EVT */
+    bta_dm_loc_oob,                         /* BTA_DM_API_LOC_OOB_EVT */
+    bta_dm_ci_io_req_act,                   /* BTA_DM_CI_IO_REQ_EVT */
+    bta_dm_ci_rmt_oob_act,                  /* BTA_DM_CI_RMT_OOB_EVT */
 #endif /* BTM_OOB_INCLUDED */


 #if BLE_INCLUDED == TRUE
 #if SMP_INCLUDED == TRUE
-    bta_dm_add_blekey,                      /*  BTA_DM_API_ADD_BLEKEY_EVT           */
-    bta_dm_add_ble_device,                  /*  BTA_DM_API_ADD_BLEDEVICE_EVT        */
-    bta_dm_ble_passkey_reply,               /*  BTA_DM_API_BLE_PASSKEY_REPLY_EVT    */
-    bta_dm_ble_confirm_reply,               /*  BTA_DM_API_BLE_CONFIRM_REPLY_EVT    */
+    bta_dm_add_blekey,                      /* BTA_DM_API_ADD_BLEKEY_EVT */
+    bta_dm_add_ble_device,                  /* BTA_DM_API_ADD_BLEDEVICE_EVT */
+    bta_dm_ble_passkey_reply,               /* BTA_DM_API_BLE_PASSKEY_REPLY_EVT */
+    bta_dm_ble_confirm_reply,               /* BTA_DM_API_BLE_CONFIRM_REPLY_EVT */
    bta_dm_security_grant,
 #endif  ///SMP_INCLUDED == TRUE
    bta_dm_ble_set_bg_conn_type,
@@ -96,18 +97,18 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_set_conn_scan_params,        /* BTA_DM_API_BLE_CONN_SCAN_PARAM_EVT */
    bta_dm_ble_set_scan_params,             /* BTA_DM_API_BLE_SCAN_PARAM_EVT */
    bta_dm_ble_set_scan_fil_params,         /* BTA_DM_API_BLE_SCAN_FIL_PARAM_EVT */
-    bta_dm_ble_observe,                     /* BTA_DM_API_BLE_OBSERVE_EVT*/
+    bta_dm_ble_observe,                     /* BTA_DM_API_BLE_OBSERVE_EVT */
    bta_dm_ble_scan,                        /* BTA_DM_API_BLE_SCAN_EVT */
    bta_dm_ble_update_conn_params,          /* BTA_DM_API_UPDATE_CONN_PARAM_EVT */
    /* This handler function added by
       Yulong at 2016/9/9 to support the
       random address setting for the APP */
-    bta_dm_ble_set_rand_address,            /* BTA_DM_API_SET_RAND_ADDR_EVT*/
+    bta_dm_ble_set_rand_address,            /* BTA_DM_API_SET_RAND_ADDR_EVT */
    /* This handler function added by
       Yulong at 2016/10/19 to support
       stop the ble advertising setting
       by the APP */
-    bta_dm_ble_stop_advertising,            /* BTA_DM_API_BLE_STOP_ADV_EVT*/
+    bta_dm_ble_stop_advertising,            /* BTA_DM_API_BLE_STOP_ADV_EVT */
 #if BLE_PRIVACY_SPT == TRUE
    bta_dm_ble_config_local_privacy,        /* BTA_DM_API_LOCAL_PRIVACY_EVT */
 #endif
@@ -119,7 +120,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
       data to HCI */
    bta_dm_ble_set_adv_config_raw,          /* BTA_DM_API_BLE_SET_ADV_CONFIG_RAW_EVT */
    bta_dm_ble_set_scan_rsp,                /* BTA_DM_API_BLE_SET_SCAN_RSP_EVT */
-    /* New function to allow set raw scan 
+    /* New function to allow set raw scan
       response data to HCI */
    bta_dm_ble_set_scan_rsp_raw,            /* BTA_DM_API_BLE_SET_SCAN_RSP_RAW_EVT */
    bta_dm_ble_broadcast,                   /* BTA_DM_API_BLE_BROADCAST_EVT */
@@ -129,10 +130,10 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_scan_filter_param_setup,         /* BTA_DM_API_SCAN_FILTER_SETUP_EVT */
    bta_dm_enable_scan_filter,              /* BTA_DM_API_SCAN_FILTER_ENABLE_EVT */
 #endif
-    bta_dm_ble_multi_adv_enb,               /*  BTA_DM_API_BLE_MULTI_ADV_ENB_EVT*/
-    bta_dm_ble_multi_adv_upd_param,         /*  BTA_DM_API_BLE_MULTI_ADV_PARAM_UPD_EVT */
-    bta_dm_ble_multi_adv_data,              /*  BTA_DM_API_BLE_MULTI_ADV_DATA_EVT */
-    btm_dm_ble_multi_adv_disable,           /*  BTA_DM_API_BLE_MULTI_ADV_DISABLE_EVT */
+    bta_dm_ble_multi_adv_enb,               /* BTA_DM_API_BLE_MULTI_ADV_ENB_EVT */
+    bta_dm_ble_multi_adv_upd_param,         /* BTA_DM_API_BLE_MULTI_ADV_PARAM_UPD_EVT */
+    bta_dm_ble_multi_adv_data,              /* BTA_DM_API_BLE_MULTI_ADV_DATA_EVT */
+    btm_dm_ble_multi_adv_disable,           /* BTA_DM_API_BLE_MULTI_ADV_DISABLE_EVT */
    bta_dm_ble_setup_storage,               /* BTA_DM_API_BLE_SETUP_STORAGE_EVT */
    bta_dm_ble_enable_batch_scan,           /* BTA_DM_API_BLE_ENABLE_BATCH_SCAN_EVT */
    bta_dm_ble_disable_batch_scan,          /* BTA_DM_API_BLE_DISABLE_BATCH_SCAN_EVT */
@@ -142,9 +143,9 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_disconnect,                  /* BTA_DM_API_BLE_DISCONNECT_EVT */
 #endif

-    bta_dm_enable_test_mode,                /*  BTA_DM_API_ENABLE_TEST_MODE_EVT     */
-    bta_dm_disable_test_mode,               /*  BTA_DM_API_DISABLE_TEST_MODE_EVT    */
-    bta_dm_execute_callback,                /*  BTA_DM_API_EXECUTE_CBACK_EVT        */
+    bta_dm_enable_test_mode,                /* BTA_DM_API_ENABLE_TEST_MODE_EVT */
+    bta_dm_disable_test_mode,               /* BTA_DM_API_DISABLE_TEST_MODE_EVT */
+    bta_dm_execute_callback,                /* BTA_DM_API_EXECUTE_CBACK_EVT */

    bta_dm_remove_all_acl,                  /* BTA_DM_API_REMOVE_ALL_ACL_EVT */
    bta_dm_remove_device,                   /* BTA_DM_API_REMOVE_DEVICE_EVT */
@@ -61,6 +61,7 @@ enum {
    /* security API events */
    BTA_DM_API_BOND_EVT,
    BTA_DM_API_BOND_CANCEL_EVT,
+    BTA_DM_API_SET_PIN_TYPE_EVT,
    BTA_DM_API_PIN_REPLY_EVT,
 #endif  ///SMP_INCLUDED == TRUE
 #if (BTA_DM_PM_INCLUDED == TRUE)
@@ -196,6 +197,7 @@ typedef struct {
 typedef struct {
    BT_HDR        hdr;
    BD_ADDR       remote_addr;
+    tBTA_TRANSPORT  transport;
    tBTA_CMPL_CB  *read_rssi_cb;
 }tBTA_DM_API_READ_RSSI;

@@ -270,6 +272,14 @@ typedef struct {
    tBTA_TRANSPORT  transport;
 } tBTA_DM_API_BOND_CANCEL;

+/* data type for BTA_DM_API_SET_PIN_TYPE_EVT */
+typedef struct {
+    BT_HDR      hdr;
+    UINT8       pin_type;
+    UINT8       pin_len;
+    UINT8       p_pin[PIN_CODE_LEN];
+} tBTA_DM_API_SET_PIN_TYPE;
+
 /* data type for BTA_DM_API_PIN_REPLY_EVT */
 typedef struct {
    BT_HDR      hdr;
@@ -391,6 +401,7 @@ typedef struct {
 typedef struct {
    BT_HDR              hdr;
    BD_ADDR             bd_addr;
+    UINT8               transport;
 } tBTA_DM_API_REMOVE_DEVICE;

 /* data type for BTA_DM_API_EXECUTE_CBACK_EVT */
@@ -742,6 +753,7 @@ typedef union {

    tBTA_DM_API_BOND_CANCEL bond_cancel;

+    tBTA_DM_API_SET_PIN_TYPE set_pin_type;
    tBTA_DM_API_PIN_REPLY pin_reply;

    tBTA_DM_API_LOC_OOB     loc_oob;
@@ -1164,6 +1176,7 @@ extern void bta_dm_set_scan_config(tBTA_DM_MSG *p_data);
 extern void bta_dm_vendor_spec_command(tBTA_DM_MSG *p_data);
 extern void bta_dm_bond (tBTA_DM_MSG *p_data);
 extern void bta_dm_bond_cancel (tBTA_DM_MSG *p_data);
+extern void bta_dm_set_pin_type (tBTA_DM_MSG *p_data);
 extern void bta_dm_pin_reply (tBTA_DM_MSG *p_data);
 extern void bta_dm_acl_change(tBTA_DM_MSG *p_data);
 extern void bta_dm_add_device (tBTA_DM_MSG *p_data);
@@ -672,6 +672,8 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
            if (bta_gattc_cache_load(p_clcb)) {
                p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
                bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
+                //register service change
+                bta_gattc_register_service_change_notify(p_clcb->bta_conn_id, p_clcb->bda);
            } else 
 #endif
            { /* cache is building */
@@ -1296,6 +1298,7 @@ void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
    cb_data.write.conn_id = p_clcb->bta_conn_id;
    if (p_conn && p_conn->svc_change_descr_handle == cb_data.write.handle) {
        if(cb_data.write.status != BTA_GATT_OK) {
+            p_conn->write_remote_svc_change_ccc_done = FALSE;
            APPL_TRACE_ERROR("service change write ccc failed");
        }
        return;
@@ -1875,6 +1878,10 @@ BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,

            /* if connection available, refresh cache by doing discovery now */
            if (p_clcb != NULL) {
+                tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find(p_clcb->bda);
+                if(p_conn) {
+                    p_conn->write_remote_svc_change_ccc_done = FALSE;
+                }
                bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
            }
        }
@@ -2280,6 +2287,10 @@ tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_
    tBT_UUID gatt_service_uuid = {LEN_UUID_16, {UUID_SERVCLASS_GATT_SERVER}};
    tBT_UUID gatt_service_change_uuid = {LEN_UUID_16, {GATT_UUID_GATT_SRV_CHGD}};
    tBT_UUID gatt_ccc_uuid = {LEN_UUID_16, {GATT_UUID_CHAR_CLIENT_CONFIG}};
+    tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find_alloc(remote_bda);
+    if(p_conn && p_conn->write_remote_svc_change_ccc_done) {
+        return SERVICE_CHANGE_CCC_WRITTEN_SUCCESS;
+    }

    p_srcb = bta_gattc_find_srcb(remote_bda);
    if ((p_srcb != NULL) && (p_srcb->p_srvc_cache != NULL)) {
@@ -2344,9 +2355,9 @@ tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_
    }

    if (gatt_ccc_found == TRUE){
-        tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find_alloc(remote_bda);
        if (p_conn) {
            p_conn->svc_change_descr_handle = p_desc->handle;
+            p_conn->write_remote_svc_change_ccc_done = TRUE;
        }
        result = SERVICE_CHANGE_CCC_WRITTEN_SUCCESS;
        uint16_t indicate_value = GATT_CLT_CONFIG_INDICATION;
@@ -376,14 +376,8 @@ static tBTA_GATT_STATUS bta_gattc_add_attr_to_cache(tBTA_GATTC_SERV *p_srvc_cb,
        isvc->included_service = bta_gattc_find_matching_service(
                                    p_srvc_cb->p_srvc_cache, incl_srvc_s_handle);
        if (!isvc->included_service) {
-            // if it is a secondary service, wait to update later
-            if(property == 0){
-                p_srvc_cb->update_sec_sev = true;   
-            } else {
-                APPL_TRACE_ERROR("%s: Illegal action to add non-existing included service!", __func__);
-                osi_free(isvc);
-                return GATT_WRONG_STATE;
-            }
+            // if can't find included service, wait to update later
+            p_srvc_cb->update_incl_srvc = true;
        }

        list_append(service->included_svc, isvc);
@@ -606,10 +600,10 @@ static void bta_gattc_explore_srvc(UINT16 conn_id, tBTA_GATTC_SERV *p_srvc_cb)
            return;
        }
    }
-    //update include service when have secondary service
-    if(p_srvc_cb->update_sec_sev) {
+    // if update_incl_srvc is true, update include service
+    if(p_srvc_cb->update_incl_srvc) {
        bta_gattc_update_include_service(p_srvc_cb->p_srvc_cache);
-        p_srvc_cb->update_sec_sev = false;
+        p_srvc_cb->update_incl_srvc = false;
    }
    /* no service found at all, the end of server discovery*/
    APPL_TRACE_DEBUG("%s no more services found", __func__);
@@ -1658,7 +1652,8 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
    tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);

    if (p_clcb == NULL) {
-        return NULL;
+        *count = 0;
+        return;
    }
    
    tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
@@ -702,6 +702,10 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                APPL_TRACE_ERROR("%s, malloc failed", __func__);
            }
            (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
+            if (cb_data.req_data.value != NULL) {
+                osi_free(cb_data.req_data.value);
+                cb_data.req_data.value = NULL;
+            }
        }
    } else {
        APPL_TRACE_ERROR("Not an registered servce attribute ID: 0x%04x",
@@ -300,7 +300,7 @@ typedef struct {
    UINT16              attr_index;     /* cahce NV saving/loading attribute index */

    UINT16              mtu;
-    bool                update_sec_sev;
+    bool                update_incl_srvc;
 } tBTA_GATTC_SERV;

 #ifndef BTA_GATTC_NOTIF_REG_MAX
@@ -365,7 +365,8 @@ typedef struct {
 typedef struct {
    BOOLEAN             in_use;
    BD_ADDR             remote_bda;
-    UINT16              svc_change_descr_handle; 
+    UINT16              svc_change_descr_handle;
+    BOOLEAN             write_remote_svc_change_ccc_done;
 } tBTA_GATTC_CONN;

 enum {
@@ -46,7 +46,7 @@ static const tBTM_ESCO_PARAMS bta_hf_client_esco_params[] = {
        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
        BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
-        .retrans_effort = BTM_ESCO_RETRANS_POWER,
+        .retrans_effort = BTM_ESCO_RETRANS_OFF,
    },
    /* ESCO CVSD */
    {
@@ -429,7 +429,6 @@ static void bta_hf_client_sco_event(UINT8 event)
    if (event == BTA_HF_CLIENT_SCO_CI_DATA_E) {
        uint16_t pkt_offset = 1 + HCI_SCO_PREAMBLE_SIZE;
        uint16_t len_to_send = 0;
-        uint8_t *p;
        while (true)
        {
            p_buf = osi_malloc(sizeof(BT_HDR) + pkt_offset + BTM_SCO_DATA_SIZE_MAX);
@@ -439,13 +438,13 @@ static void bta_hf_client_sco_event(UINT8 event)
            }

            p_buf->offset = pkt_offset;
+            p_buf->len = BTM_SCO_DATA_SIZE_MAX;
            len_to_send = bta_hf_client_sco_co_out_data(p_buf->data + pkt_offset, BTM_SCO_DATA_SIZE_MAX);
-            if (len_to_send) {
+            if (len_to_send == BTM_SCO_DATA_SIZE_MAX) {
+                // expect to get the exact size of data from upper layer
                if (bta_hf_client_cb.scb.sco_state == BTA_HF_CLIENT_SCO_OPEN_ST) {
-                    p = (UINT8 *)(p_buf->data + pkt_offset -1);
-                    *p = len_to_send; // set SCO packet length;
                    tBTM_STATUS write_stat = BTM_WriteScoData(p_scb->sco_idx, p_buf);
-                    if (write_stat != BTM_SUCCESS && write_stat != BTM_SCO_BAD_LENGTH) {
+                    if (write_stat != BTM_SUCCESS) {
                        break;
                    }
                } else {
@@ -631,10 +631,11 @@ typedef UINT8 tBTA_SIG_STRENGTH_MASK;
 #define BTA_DM_SP_RMT_OOB_EXT_EVT       23      /* Simple Pairing Remote OOB Extended Data request. */
 #define BTA_DM_BLE_AUTH_CMPL_EVT        24      /* BLE Auth complete */
 // btla-specific --
-#define BTA_DM_DEV_UNPAIRED_EVT         25
+#define BTA_DM_DEV_UNPAIRED_EVT         25      /* BT unpair event */
 #define BTA_DM_HW_ERROR_EVT             26      /* BT Chip H/W error */
 #define BTA_DM_LE_FEATURES_READ         27      /* Cotroller specific LE features are read */
 #define BTA_DM_ENER_INFO_READ           28      /* Energy info read */
+#define BTA_DM_BLE_DEV_UNPAIRED_EVT     29      /* BLE unpair event */
 typedef UINT8 tBTA_DM_SEC_EVT;

 /* Structure associated with BTA_DM_ENABLE_EVT */
@@ -1428,7 +1429,7 @@ extern void BTA_DmUpdateWhiteList(BOOLEAN add_remove,  BD_ADDR remote_addr, tBTA

 extern void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb);

-extern void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_CMPL_CB *cmpl_cb);
+extern void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb);

 /*******************************************************************************
 **
@@ -1559,6 +1560,18 @@ extern void BTA_DmBondByTransport(BD_ADDR bd_addr, tBTA_TRANSPORT transport);
 *******************************************************************************/
 extern void BTA_DmBondCancel(BD_ADDR bd_addr);

+/*******************************************************************************
+**
+** Function         BTA_DMSetPinType
+**
+** Description      This function sets pin type as BTM_PIN_TYPE_FIXED or BTM_PIN_TYPE_VARIABLE
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_DMSetPinType (UINT8 pin_type, UINT8 *pin_code, UINT8 pin_code_len);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmPinReply
@@ -1632,7 +1645,7 @@ extern void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class,
 **                  BTA_FAIL if operation failed.
 **
 *******************************************************************************/
-extern tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr);
+extern tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport);

 /*******************************************************************************
 **
@@ -98,7 +98,7 @@ typedef UINT8 tBTA_AV_HNDL;
 #endif

 #ifndef BTA_AV_MAX_SEPS
-#define BTA_AV_MAX_SEPS         2
+#define BTA_AV_MAX_SEPS         1
 #endif

 #ifndef BTA_AV_MAX_A2DP_MTU
@@ -259,7 +259,7 @@ typedef UINT8 tBTA_AV_ERR;

 /* function types for call-out functions */
 typedef BOOLEAN (*tBTA_AV_CO_INIT) (UINT8 *p_codec_type, UINT8 *p_codec_info,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 index);
+                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 tsep);
 typedef void (*tBTA_AV_CO_DISC_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
                                     UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
 typedef UINT8 (*tBTA_AV_CO_GETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
@@ -580,7 +580,7 @@ void BTA_AvDisable(void);
 **
 *******************************************************************************/
 void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name,
-                    UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos);
+                    UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep);

 /*******************************************************************************
 **
@@ -85,7 +85,7 @@ typedef struct {
 **
 *******************************************************************************/
 extern BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 index);
+                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 tsep);

 /*******************************************************************************
 **
@@ -22,7 +22,6 @@
 *
 ******************************************************************************/

-#include <arpa/inet.h>
 #include <pthread.h>
 #include <stdlib.h>

@@ -29,6 +29,8 @@
 static void _btc_storage_save(void)
 {
    uint16_t addr_section_count = 0;
+    bt_bdaddr_t bd_addr;
+    uint32_t device_type = 0;
    const btc_config_section_iter_t *need_remove_iter = NULL;
    const btc_config_section_iter_t *iter = btc_config_section_begin();

@@ -36,12 +38,9 @@ static void _btc_storage_save(void)
        //store the next iter, if remove section, then will not loss the point

        const char *section = btc_config_section_name(iter);
-        if (!string_is_bdaddr(section)) {
-            iter = btc_config_section_next(iter);
-            continue;
-        }

-        if (!btc_config_exist(section, BTC_BLE_STORAGE_DEV_TYPE_STR) && 
+        if (string_is_bdaddr(section) &&
+                !btc_config_exist(section, BTC_BLE_STORAGE_DEV_TYPE_STR) &&
                !btc_config_exist(section, BTC_BLE_STORAGE_ADDR_TYPE_STR) &&
                !btc_config_exist(section, BTC_BLE_STORAGE_LINK_KEY_STR) &&
                !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_PENC_STR) &&
@@ -53,6 +52,14 @@ static void _btc_storage_save(void)
            btc_config_remove_section(section);
            continue;
        }
+
+        if (!string_is_bdaddr(section) ||
+            !btc_config_get_int(section, BTC_BLE_STORAGE_DEV_TYPE_STR, (int *)&device_type) ||
+            ((device_type & BT_DEVICE_TYPE_BLE) != BT_DEVICE_TYPE_BLE)) {
+            iter = btc_config_section_next(iter);
+            continue;
+        }
+
        if(addr_section_count == BONED_DEVICES_MAX_COUNT) {
            need_remove_iter = iter;
        }
@@ -63,13 +70,20 @@ static void _btc_storage_save(void)
    if (need_remove_iter) {
        while(need_remove_iter != btc_config_section_end()) {
            const char *need_remove_section = btc_config_section_name(need_remove_iter);
-            if (!string_is_bdaddr(need_remove_section)) {
+            if (!string_is_bdaddr(need_remove_section) ||
+                !btc_config_get_int(need_remove_section, BTC_BLE_STORAGE_DEV_TYPE_STR, (int *)&device_type) ||
+                ((device_type & BT_DEVICE_TYPE_BLE) != BT_DEVICE_TYPE_BLE)) {
                need_remove_iter = btc_config_section_next(need_remove_iter);
                continue;
            }
            need_remove_iter = btc_config_section_next(need_remove_iter);
-            BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
-            btc_config_remove_section(need_remove_section);
+            //delete device info
+            string_to_bdaddr(need_remove_section, &bd_addr);
+            BTM_SecDeleteDevice(bd_addr.address, BT_TRANSPORT_LE);
+            //delet config info
+            if(btc_config_remove_section(need_remove_section)) {
+                BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
+            }
        }
    }
    btc_config_flush();
@@ -228,6 +242,9 @@ static bt_status_t _btc_storage_remove_ble_bonding_keys(bt_bdaddr_t *remote_bd_a
    if (btc_config_exist(bdstr, BTC_BLE_STORAGE_LE_KEY_LCSRK_STR)) {
        ret |= btc_config_remove(bdstr, BTC_BLE_STORAGE_LE_KEY_LCSRK_STR);
    }
+    if (btc_config_exist(bdstr, BTC_BLE_STORAGE_LE_KEY_LID_STR)) {
+        ret |= btc_config_remove(bdstr, BTC_BLE_STORAGE_LE_KEY_LID_STR);
+    }
    //here don't remove section, because config_save will check it
    _btc_storage_save();
    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
@@ -750,7 +767,6 @@ bt_status_t btc_storage_load_bonded_ble_devices(void)
 bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev, int dev_num)
 {
    bt_bdaddr_t bd_addr;
-    uint32_t device_type = 0;
    char buffer[sizeof(tBTM_LE_KEY_VALUE)] = {0};

    btc_config_lock();
@@ -760,12 +776,13 @@ bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev
        if (dev_num-- <= 0) {
            break;
        }
-
+        uint32_t device_type = 0;
        const char *name = btc_config_section_name(iter);

        if (!string_is_bdaddr(name) ||
                !btc_config_get_int(name, BTC_BLE_STORAGE_DEV_TYPE_STR, (int *)&device_type) ||
                !(device_type & BT_DEVICE_TYPE_BLE)) {
+            dev_num ++;
            continue;
        }

@@ -54,7 +54,7 @@ static btc_dm_local_key_cb_t ble_local_key_cb;
 **  Externs
 ******************************************************************************/
 #if BTC_AV_INCLUDED
-extern bt_status_t btc_av_execute_service(BOOLEAN b_enable);
+extern bt_status_t btc_av_source_execute_service(BOOLEAN b_enable);
 extern bt_status_t btc_av_sink_execute_service(BOOLEAN b_enable);
 #endif
 #if BTC_HF_CLIENT_INCLUDED
@@ -182,6 +182,10 @@ static void btc_dm_remove_ble_bonding_keys(void)

 static void btc_dm_save_ble_bonding_keys(void)
 {
+    if (!(pairing_cb.ble.is_penc_key_rcvd || pairing_cb.ble.is_pid_key_rcvd || pairing_cb.ble.is_pcsrk_key_rcvd ||
+         pairing_cb.ble.is_lenc_key_rcvd || pairing_cb.ble.is_lcsrk_key_rcvd || pairing_cb.ble.is_lidk_key_rcvd)) {
+        return ;
+    }
    bt_bdaddr_t bd_addr;

    bdcpy(bd_addr.address, pairing_cb.bd_addr);
@@ -193,6 +197,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.penc_key,
                                        BTM_LE_KEY_PENC,
                                        sizeof(tBTM_LE_PENC_KEYS));
+        pairing_cb.ble.is_penc_key_rcvd = false;
    }

    if (pairing_cb.ble.is_pid_key_rcvd) {
@@ -200,6 +205,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.pid_key,
                                        BTM_LE_KEY_PID,
                                        sizeof(tBTM_LE_PID_KEYS));
+        pairing_cb.ble.is_pid_key_rcvd = false;
    }


@@ -208,6 +214,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.pcsrk_key,
                                        BTM_LE_KEY_PCSRK,
                                        sizeof(tBTM_LE_PCSRK_KEYS));
+        pairing_cb.ble.is_pcsrk_key_rcvd = false;
    }


@@ -216,6 +223,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.lenc_key,
                                        BTM_LE_KEY_LENC,
                                        sizeof(tBTM_LE_LENC_KEYS));
+        pairing_cb.ble.is_lenc_key_rcvd = false;
    }

    if (pairing_cb.ble.is_lcsrk_key_rcvd) {
@@ -223,6 +231,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.lcsrk_key,
                                        BTM_LE_KEY_LCSRK,
                                        sizeof(tBTM_LE_LCSRK_KEYS));
+        pairing_cb.ble.is_lcsrk_key_rcvd = false;
    }

    if (pairing_cb.ble.is_lidk_key_rcvd) {
@@ -230,6 +239,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        NULL,
                                        BTM_LE_KEY_LID,
                                        0);
+        pairing_cb.ble.is_lidk_key_rcvd = false;
    }
 }

@@ -375,6 +385,27 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
    (void) status;
 }

+static void btc_dm_pin_req_evt(tBTA_DM_PIN_REQ *p_pin_req)
+{
+#if (BTC_GAP_BT_INCLUDED == TRUE)
+    esp_bt_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_PIN_REQ_EVT;
+    param.pin_req.min_16_digit = p_pin_req->min_16_digit;
+    memcpy(param.pin_req.bda, p_pin_req->bd_addr, ESP_BD_ADDR_LEN);
+
+    ret = btc_transfer_context(&msg, &param,
+                               sizeof(esp_bt_gap_cb_param_t), NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+#endif /// BTC_GAP_BT_INCLUDED == TRUE
+}
+
 tBTA_SERVICE_MASK btc_get_enabled_services_mask(void)
 {
    return btc_enabled_services;
@@ -393,7 +424,7 @@ static bt_status_t btc_in_execute_service_request(tBTA_SERVICE_ID service_id,
    switch (service_id) {
 #if BTC_AV_INCLUDED
    case BTA_A2DP_SOURCE_SERVICE_ID:
-        btc_av_execute_service(b_enable);
+        btc_av_source_execute_service(b_enable);
        break;
    case BTA_A2DP_SINK_SERVICE_ID:
        btc_av_sink_execute_service(b_enable);
@@ -484,6 +515,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
        break;
    }
    case BTA_DM_PIN_REQ_EVT:
+        BTC_TRACE_DEBUG("BTA_DM_PIN_REQ_EVT");
+        btc_dm_pin_req_evt(&p_data->pin_req);
        break;
    case BTA_DM_AUTH_CMPL_EVT:
        btc_dm_auth_cmpl_evt(&p_data->auth_cmpl);
@@ -495,10 +528,23 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
    case BTA_DM_DEV_UNPAIRED_EVT: {
 #if (SMP_INCLUDED == TRUE)
        bt_bdaddr_t bd_addr;
-        rsp_app = true;
        BTC_TRACE_DEBUG("BTA_DM_DEV_UNPAIRED_EVT");
        memcpy(bd_addr.address, p_data->link_down.bd_addr, sizeof(BD_ADDR));
        btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
+        if (p_data->link_down.status == HCI_SUCCESS) {
+            //remove the bonded key in the config and nvs flash.
+            btc_storage_remove_bonded_device(&bd_addr);
+        }
+#endif /* #if (SMP_INCLUDED == TRUE) */
+        break;
+    }
+    case BTA_DM_BLE_DEV_UNPAIRED_EVT: {
+#if (SMP_INCLUDED == TRUE)
+        bt_bdaddr_t bd_addr;
+        rsp_app = true;
+        BTC_TRACE_DEBUG("BTA_DM_BLE_DEV_UNPAIRED_EVT");
+        memcpy(bd_addr.address, p_data->link_down.bd_addr, sizeof(BD_ADDR));
+        btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
        param.remove_bond_dev_cmpl.status = ESP_BT_STATUS_FAIL;

        if (p_data->link_down.status == HCI_SUCCESS) {
@@ -170,6 +170,9 @@ int btc_init(void)
        return BT_STATUS_NOMEM;
    }
    btc_gap_callback_init();
+#if SCAN_QUEUE_CONGEST_CHECK
+    btc_adv_list_init();
+#endif
    /* TODO: initial the profile_tab */
    return BT_STATUS_SUCCESS;
 }
@@ -178,7 +181,18 @@ void btc_deinit(void)
 {
    vTaskDelete(xBtcTaskHandle);
    vQueueDelete(xBtcQueue);
-
+#if SCAN_QUEUE_CONGEST_CHECK
+    btc_adv_list_deinit();
+#endif
    xBtcTaskHandle = NULL;
    xBtcQueue = 0;
 }
+
+bool btc_check_queue_is_congest(void)
+{
+    UBaseType_t wait_size = uxQueueMessagesWaiting(xBtcQueue);
+    if(wait_size >= QUEUE_CONGEST_SIZE) {
+        return true;
+    }
+    return false;
+}
@@ -28,6 +28,11 @@ typedef struct btc_msg {
    void   *arg;    //param for btc function or function param
 } btc_msg_t;

+typedef struct btc_adv_packet {
+    uint8_t addr[6];
+    uint8_t addr_type;
+} btc_adv_packet_t;
+
 typedef enum {
    BTC_SIG_API_CALL = 0,   // APP TO STACK
    BTC_SIG_API_CB,         // STACK TO APP
@@ -72,5 +77,6 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg

 int btc_init(void);
 void btc_deinit(void);
+bool btc_check_queue_is_congest(void);

 #endif /* __BTC_TASK_H__ */
@@ -206,13 +206,10 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        break;
    case BTA_GATTS_MTU_EVT:
        BLUFI_TRACE_DEBUG("MTU size %d\n", p_data->req_data.p_data->mtu);
-        blufi_env.frag_size = p_data->req_data.p_data->mtu - BLUFI_MTU_RESERVED_SIZE;
+        blufi_env.frag_size = (p_data->req_data.p_data->mtu < BLUFI_MAX_DATA_LEN ? p_data->req_data.p_data->mtu : BLUFI_MAX_DATA_LEN) - BLUFI_MTU_RESERVED_SIZE;
        break;
    case BTA_GATTS_CONF_EVT:
-        BLUFI_TRACE_DEBUG("CONIRM EVT\n");
-        if (p_data && p_data->req_data.value){
-            osi_free(p_data->req_data.value);
-        }
+        BLUFI_TRACE_DEBUG("CONFIRM EVT\n");
        /* Nothing */
        break;
    case BTA_GATTS_CREATE_EVT:
@@ -72,6 +72,7 @@ typedef struct blufi_frag_hdr blufi_frag_hdr_t;
 #define BLUFI_DATA_SEC_MODE_ENC_MASK    0x02  
 #define BLUFI_CTRL_SEC_MODE_CHECK_MASK  0x10  
 #define BLUFI_CTRL_SEC_MODE_ENC_MASK    0x20
+#define BLUFI_MAX_DATA_LEN              255

 // packet type
 #define BLUFI_TYPE_MASK         0x03
@@ -267,11 +267,11 @@ static tBTA_AV_CO_PEER *bta_av_co_get_peer(tBTA_AV_HNDL hndl)
 **
 *******************************************************************************/
 BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info, UINT8 *p_num_protect,
-                             UINT8 *p_protect_info, UINT8 index)
+                             UINT8 *p_protect_info, UINT8 tsep)
 {
    FUNC_TRACE();

-    APPL_TRACE_DEBUG("bta_av_co_audio_init: %d", index);
+    APPL_TRACE_DEBUG("bta_av_co_audio_init: %d", tsep);

    /* By default - no content protection info */
    *p_num_protect = 0;
@@ -280,29 +280,24 @@ BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info, UINT8 *p_
    /* reset remote preference through setconfig */
    bta_av_co_cb.codec_cfg_setconfig.id = BTC_AV_CODEC_NONE;

-    switch (index) {
-    case BTC_SV_AV_AA_SBC_INDEX:
+    if (tsep == AVDT_TSEP_SRC) {
 #if defined(BTA_AV_CO_CP_SCMS_T) && (BTA_AV_CO_CP_SCMS_T == TRUE)
-    {
-        UINT8 *p = p_protect_info;
+        do {
+            UINT8 *p = p_protect_info;

-        /* Content protection info - support SCMS-T */
-        *p_num_protect = 1;
-        *p++ = BTA_AV_CP_LOSC;
-        UINT16_TO_STREAM(p, BTA_AV_CP_SCMS_T_ID);
-
-    }
+            /* Content protection info - support SCMS-T */
+            *p_num_protect = 1;
+            *p++ = BTA_AV_CP_LOSC;
+            UINT16_TO_STREAM(p, BTA_AV_CP_SCMS_T_ID);
+        } while (0);
 #endif
        /* Set up for SBC codec  for SRC*/
-    *p_codec_type = BTA_AV_CODEC_SBC;
+        *p_codec_type = BTA_AV_CODEC_SBC;

        /* This should not fail because we are using constants for parameters */
-    A2D_BldSbcInfo(AVDT_MEDIA_AUDIO, (tA2D_SBC_CIE *) &bta_av_co_sbc_caps, p_codec_info);
-
-        /* Codec is valid */
-    return TRUE;
-#if (BTA_AV_SINK_INCLUDED == TRUE)
-    case BTC_SV_AV_AA_SBC_SINK_INDEX:
+        A2D_BldSbcInfo(AVDT_MEDIA_AUDIO, (tA2D_SBC_CIE *) &bta_av_co_sbc_caps, p_codec_info);
+        return TRUE;
+    } else if (tsep == AVDT_TSEP_SNK) {
        *p_codec_type = BTA_AV_CODEC_SBC;

        /* This should not fail because we are using constants for parameters */
@@ -310,9 +305,8 @@ BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info, UINT8 *p_

        /* Codec is valid */
        return TRUE;
-#endif
-    default:
-        /* Not valid */
+    } else {
+        APPL_TRACE_WARNING("invalid SEP type %d", tsep);
        return FALSE;
    }
 }
@@ -586,7 +586,7 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
    OI_STATUS status;
    int num_sbc_frames = p_msg->num_frames_to_be_processed;
    UINT32 sbc_frame_len = p_msg->len - 1;
-    availPcmBytes = 2 * sizeof(pcmData);
+    availPcmBytes = sizeof(pcmData);

    /* XXX: Check if the below check is correct, we are checking for peer to be sink when we are sink */
    if (btc_av_get_peer_sep() == AVDT_TSEP_SNK || (btc_aa_snk_cb.rx_flush)) {
@@ -617,7 +617,7 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
        p_msg->len = sbc_frame_len + 1;
    }

-    btc_a2d_data_cb_to_app((uint8_t *)pcmData, (2 * sizeof(pcmData) - availPcmBytes));
+    btc_a2d_data_cb_to_app((uint8_t *)pcmData, (sizeof(pcmData) - availPcmBytes));
 }

 /*******************************************************************************
@@ -763,7 +763,7 @@ static void btc_a2dp_sink_thread_init(UNUSED_ATTR void *context)

    btc_a2dp_sink_state = BTC_A2DP_SINK_STATE_ON;

-    btc_aa_snk_cb.RxSbcQ = fixed_queue_new(SIZE_MAX);
+    btc_aa_snk_cb.RxSbcQ = fixed_queue_new(QUEUE_SIZE_MAX);

    btc_a2dp_control_init();
 }
@@ -1616,7 +1616,7 @@ static void btc_a2dp_source_thread_init(UNUSED_ATTR void *context)

    btc_a2dp_source_state = BTC_A2DP_SOURCE_STATE_ON;

-    btc_aa_src_cb.TxAaQ = fixed_queue_new(SIZE_MAX);
+    btc_aa_src_cb.TxAaQ = fixed_queue_new(QUEUE_SIZE_MAX);

    btc_a2dp_control_init();
 }
@@ -315,8 +315,10 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
                       TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
        } else if (event == BTA_AV_PENDING_EVT) {
            bdcpy(btc_av_cb.peer_bda.address, ((tBTA_AV *)p_data)->pend.bd_addr);
+            UINT16 uuid = (btc_av_cb.service_id == BTA_A2DP_SOURCE_SERVICE_ID) ? UUID_SERVCLASS_AUDIO_SOURCE :
+                UUID_SERVCLASS_AUDIO_SINK;
            BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
-                       TRUE, BTA_SEC_AUTHENTICATE, UUID_SERVCLASS_AUDIO_SOURCE);
+                       TRUE, BTA_SEC_AUTHENTICATE, uuid);
        }
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_OPENING);
    } break;
@@ -402,8 +404,8 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
        tBTA_AV *p_bta_data = (tBTA_AV *)p_data;
        esp_a2d_connection_state_t state;
        btc_sm_state_t av_state;
-        BTC_TRACE_DEBUG("status:%d, edr 0x%x\n", p_bta_data->open.status,
-                  p_bta_data->open.edr);
+        BTC_TRACE_DEBUG("status:%d, edr 0x%x, peer sep %d\n", p_bta_data->open.status,
+                        p_bta_data->open.edr, p_bta_data->open.sep);

        if (p_bta_data->open.status == BTA_AV_SUCCESS) {
            state = ESP_A2D_CONNECTION_STATE_CONNECTED;
@@ -428,7 +430,8 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
            btc_rc_check_handle_pending_play(p_bta_data->open.bd_addr,
                                             (p_bta_data->open.status == BTA_AV_SUCCESS));
            */
-        } else if (btc_av_cb.peer_sep == AVDT_TSEP_SRC) {
+        } else if (btc_av_cb.peer_sep == AVDT_TSEP_SRC &&
+                   (p_bta_data->open.status == BTA_AV_SUCCESS)) {
            /* Bring up AVRCP connection too */
            BTA_AvOpenRc(btc_av_cb.bta_handle);
        }
@@ -978,10 +981,10 @@ static bt_status_t btc_av_init(int service_id)
        btc_av_cb.sm_handle =
            btc_sm_init((const btc_sm_handler_t *)btc_av_state_handlers, BTC_AV_STATE_IDLE);

-        btc_dm_enable_service(BTA_A2DP_SOURCE_SERVICE_ID);
-
        if (service_id == BTA_A2DP_SINK_SERVICE_ID) {
            btc_dm_enable_service(BTA_A2DP_SINK_SERVICE_ID);
+        } else {
+            btc_dm_enable_service(BTA_A2DP_SOURCE_SERVICE_ID);
        }

        btc_a2dp_on_init();
@@ -1213,7 +1216,7 @@ static void bte_av_media_callback(tBTA_AV_EVT event, tBTA_AV_MEDIA *p_data)
 ** Returns          BT_STATUS_SUCCESS on success, BT_STATUS_FAIL otherwise
 **
 *******************************************************************************/
-bt_status_t btc_av_execute_service(BOOLEAN b_enable)
+bt_status_t btc_av_execute_service(BOOLEAN b_enable, UINT8 tsep)
 {
    if (b_enable) {
        /* TODO: Removed BTA_SEC_AUTHORIZE since the Java/App does not
@@ -1227,7 +1230,7 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
                     | BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR
                     | BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
                     bte_av_callback);
-        BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos);
+        BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos, tsep);
    } else {
        BTA_AvDeregister(btc_av_cb.bta_handle);
        BTA_AvDisable();
@@ -1235,6 +1238,20 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
    return BT_STATUS_SUCCESS;
 }

+/*******************************************************************************
+**
+** Function         btc_av_source_execute_service
+**
+** Description      Initializes/Shuts down the A2DP source service
+**
+** Returns          BT_STATUS_SUCCESS on success, BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_av_source_execute_service(BOOLEAN b_enable)
+{
+    return btc_av_execute_service(b_enable, AVDT_TSEP_SRC);
+}
+
 /*******************************************************************************
 **
 ** Function         btc_av_sink_execute_service
@@ -1246,6 +1263,10 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
 *******************************************************************************/
 bt_status_t btc_av_sink_execute_service(BOOLEAN b_enable)
 {
+    bt_status_t ret = btc_av_execute_service(b_enable, AVDT_TSEP_SNK);
+    if (ret != BT_STATUS_SUCCESS) {
+        return ret;
+    }
 #if (BTA_AV_SINK_INCLUDED == TRUE)
    BTA_AvEnable_Sink(b_enable);
 #endif
@@ -28,9 +28,24 @@
 #include "btc/btc_ble_storage.h"
 #include "btc/btc_dm.h"
 #include "btc/btc_util.h"
+#include "osi/mutex.h"
+#include "esp_bt.h"

 static tBTA_BLE_ADV_DATA gl_bta_adv_data;
 static tBTA_BLE_ADV_DATA gl_bta_scan_rsp_data;
+#if SCAN_QUEUE_CONGEST_CHECK
+static list_t *adv_filter_list;
+static osi_mutex_t adv_list_lock;
+bool btc_check_adv_list(uint8_t * addr, uint8_t addr_type);
+uint32_t btc_get_adv_list_length(void);
+void btc_adv_list_refresh(void);
+void btc_adv_list_lock(void);
+void btc_adv_list_unlock(void);
+static uint16_t btc_adv_list_count = 0;
+
+#define  BTC_ADV_LIST_MAX_LENGTH    50
+#define  BTC_ADV_LIST_MAX_COUNT     200
+#endif

 static inline void btc_gap_ble_cb_to_app(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param)
 {
@@ -128,6 +143,7 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT

    if (p_adv_data->include_txpower) {
        mask |= BTM_BLE_AD_BIT_TX_PWR;
+        bta_adv_data->tx_power = esp_ble_tx_power_get(ESP_BLE_PWR_TYPE_ADV);
    }

    if (p_adv_data->min_interval > 0 && p_adv_data->max_interval > 0 &&
@@ -510,6 +526,19 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
    param.scan_rst.search_evt = event;
    switch (event) {
    case BTA_DM_INQ_RES_EVT: {
+#if SCAN_QUEUE_CONGEST_CHECK
+        if(btc_check_queue_is_congest()) {
+            BTC_TRACE_DEBUG("BtcQueue is congested");
+            if(btc_get_adv_list_length() > BTC_ADV_LIST_MAX_LENGTH || btc_adv_list_count > BTC_ADV_LIST_MAX_COUNT) {
+                btc_adv_list_refresh();
+                btc_adv_list_count = 0;
+            }
+            if(btc_check_adv_list(p_data->inq_res.bd_addr, p_data->inq_res.ble_addr_type)) {
+                return;
+            }
+        }
+        btc_adv_list_count ++;
+#endif
        bdcpy(param.scan_rst.bda, p_data->inq_res.bd_addr);
        param.scan_rst.dev_type = p_data->inq_res.device_type;
        param.scan_rst.rssi = p_data->inq_res.rssi;
@@ -585,6 +614,9 @@ static void btc_stop_scan_callback(tBTA_STATUS status)
    if (ret != BT_STATUS_SUCCESS) {
        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
    }
+#if SCAN_QUEUE_CONGEST_CHECK
+    btc_adv_list_refresh();
+#endif
 }

 void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDATE_CONN_PRAMS *update_conn_params)
@@ -725,6 +757,9 @@ static void btc_ble_start_scanning(uint32_t duration,
                                   tBTA_START_STOP_SCAN_CMPL_CBACK *start_scan_cb)
 {
    if ((results_cb != NULL) && (start_scan_cb != NULL)) {
+#if SCAN_QUEUE_CONGEST_CHECK
+        btc_adv_list_refresh();
+#endif
        //Start scan the device
        BTA_DmBleScan(true, duration, results_cb, start_scan_cb);
    } else {
@@ -1018,7 +1053,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
        BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, btc_add_whitelist_complete_callback);
        break;
    case BTC_GAP_BLE_ACT_READ_RSSI:
-        BTA_DmBleReadRSSI(arg->read_rssi.remote_addr, btc_read_ble_rssi_cmpl_callback);
+        BTA_DmBleReadRSSI(arg->read_rssi.remote_addr, BTA_TRANSPORT_LE, btc_read_ble_rssi_cmpl_callback);
        break;
    case BTC_GAP_BLE_ACT_SET_CONN_PARAMS:
        BTA_DmSetBlePrefConnParams(arg->set_conn_params.bd_addr, arg->set_conn_params.min_conn_int,
@@ -1108,7 +1143,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
    case BTC_GAP_BLE_REMOVE_BOND_DEV_EVT: {
        BD_ADDR bd_addr;
        memcpy(bd_addr, arg->remove_bond_device.bd_addr, sizeof(BD_ADDR));
-        BTA_DmRemoveDevice(bd_addr);
+        BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_LE);
        break;
    }
 #endif  ///SMP_INCLUDED == TRUE
@@ -1134,3 +1169,99 @@ void btc_gap_ble_deinit(void)
    btc_cleanup_adv_data(&gl_bta_adv_data);
    btc_cleanup_adv_data(&gl_bta_scan_rsp_data);
 }
+
+#if SCAN_QUEUE_CONGEST_CHECK
+void btc_adv_list_free(void *data)
+{
+    osi_free(data);
+}
+
+void btc_adv_list_init(void)
+{
+    osi_mutex_new(&adv_list_lock);
+    adv_filter_list = list_new(btc_adv_list_free);
+}
+
+void btc_adv_list_deinit(void)
+{
+    osi_mutex_free(&adv_list_lock);
+    if(adv_filter_list) {
+        list_free(adv_filter_list);
+        adv_filter_list = NULL;
+    }
+}
+void btc_adv_list_add_packet(void * data)
+{
+    if(!data) {
+        BTC_TRACE_ERROR("%s data is NULL", __func__);
+        return;
+    }
+    btc_adv_list_lock();
+    list_prepend(adv_filter_list, data);
+    btc_adv_list_unlock();
+}
+
+uint32_t btc_get_adv_list_length(void)
+{
+    if(!adv_filter_list) {
+        BTC_TRACE_ERROR("%s adv_filter_list is NULL", __func__);
+        return 0;
+    }
+    btc_adv_list_lock();
+    size_t length = list_length(adv_filter_list);
+    btc_adv_list_unlock();
+
+    return length;
+}
+
+void btc_adv_list_refresh(void)
+{
+    if(!adv_filter_list) {
+        BTC_TRACE_ERROR("%s adv_filter_list is NULL", __func__);
+        return ;
+    }
+    btc_adv_list_lock();
+    list_clear(adv_filter_list);
+    btc_adv_list_unlock();
+}
+
+bool btc_check_adv_list(uint8_t * addr, uint8_t addr_type)
+{
+    bool found = false;
+    if(!adv_filter_list || !addr) {
+        BTC_TRACE_ERROR("%s adv_filter_list is NULL", __func__);
+        return found;
+    }
+
+    btc_adv_list_lock();
+    for (const list_node_t *node = list_begin(adv_filter_list); node != list_end(adv_filter_list); node = list_next(node)) {
+        btc_adv_packet_t *packet = (btc_adv_packet_t *)list_node(node);
+        if(!bdcmp(addr, packet->addr) && packet->addr_type == addr_type) {
+            found = true;
+            break;
+        }
+     }
+     btc_adv_list_unlock();
+     if(!found) {
+         btc_adv_packet_t *adv_packet = osi_malloc(sizeof(btc_adv_packet_t));
+         if(adv_packet) {
+             adv_packet->addr_type = addr_type;
+             bdcpy(adv_packet->addr, addr);
+             btc_adv_list_add_packet(adv_packet);
+         } else {
+             BTC_TRACE_ERROR("%s adv_packet malloc failed", __func__);
+         }
+     }
+    return found;
+}
+
+void btc_adv_list_lock(void)
+{
+    osi_mutex_lock(&adv_list_lock, OSI_MUTEX_MAX_TIMEOUT);
+}
+
+void btc_adv_list_unlock(void)
+{
+    osi_mutex_unlock(&adv_list_lock);
+}
+#endif
@@ -151,7 +151,7 @@ static void search_devices_copy_cb(btc_msg_t *msg, void *p_dest, void *p_src)
        switch (p_dest_data->event) {
        case BTA_DM_INQ_RES_EVT: {
            if (p_src_data->p_data->inq_res.p_eir) {
-                p_dest_data->p_data->inq_res.p_eir = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                p_dest_data->p_data->inq_res.p_eir = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                memcpy(p_dest_data->p_data->inq_res.p_eir, p_src_data->p_data->inq_res.p_eir, HCI_EXT_INQ_RESPONSE_LEN);
            }
        }
@@ -159,7 +159,7 @@ static void search_devices_copy_cb(btc_msg_t *msg, void *p_dest, void *p_src)

        case BTA_DM_DISC_RES_EVT: {
            if (p_src_data->p_data->disc_res.raw_data_size && p_src_data->p_data->disc_res.p_raw_data) {
-                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                memcpy(p_dest_data->p_data->disc_res.p_raw_data,
                       p_src_data->p_data->disc_res.p_raw_data,
                       p_src_data->p_data->disc_res.raw_data_size);
@@ -194,7 +194,7 @@ static void search_service_record_copy_cb(btc_msg_t *msg, void *p_dest, void *p_
        switch (p_dest_data->event) {
        case BTA_DM_DISC_RES_EVT: {
            if (p_src_data->p_data->disc_res.p_raw_data && p_src_data->p_data->disc_res.raw_data_size > 0) {
-                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                memcpy(p_dest_data->p_data->disc_res.p_raw_data,
                       p_src_data->p_data->disc_res.p_raw_data,
                       p_src_data->p_data->disc_res.raw_data_size);
@@ -566,7 +566,7 @@ static void search_services_copy_cb(btc_msg_t *msg, void *p_dest, void *p_src)
        case BTA_DM_DISC_RES_EVT: {
            if (p_src_data->p_data->disc_res.result == BTA_SUCCESS) {
                if (p_src_data->p_data->disc_res.num_uuids > 0) {
-                    p_dest_data->p_data->disc_res.p_uuid_list = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                    p_dest_data->p_data->disc_res.p_uuid_list = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                    memcpy(p_dest_data->p_data->disc_res.p_uuid_list, p_src_data->p_data->disc_res.p_uuid_list,
                           p_src_data->p_data->disc_res.num_uuids * MAX_UUID_SIZE);
                    osi_free(p_src_data->p_data->disc_res.p_uuid_list);
@@ -632,20 +632,27 @@ static void btc_gap_bt_read_rssi_delta_cmpl_callback(void *p_data)

 static void btc_gap_bt_read_rssi_delta(btc_gap_bt_args_t *arg)
 {
-    BTA_DmBleReadRSSI(arg->read_rssi_delta.bda.address, btc_gap_bt_read_rssi_delta_cmpl_callback);
+    BTA_DmBleReadRSSI(arg->read_rssi_delta.bda.address, BTA_TRANSPORT_BR_EDR, btc_gap_bt_read_rssi_delta_cmpl_callback);
 }

 esp_err_t btc_gap_bt_remove_bond_device(btc_gap_bt_args_t *arg)
 {
    BD_ADDR bd_addr;
    memcpy(bd_addr, arg->rm_bond_device.bda.address, sizeof(BD_ADDR));
-    if(BTA_DmRemoveDevice(bd_addr) == BTA_SUCCESS){
-        btc_storage_remove_bonded_device(&(arg->rm_bond_device.bda));
+    if(BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS){
        return ESP_BT_STATUS_SUCCESS;
    }
    return ESP_BT_STATUS_FAIL;
 }

+static void btc_gap_bt_set_pin_type(btc_gap_bt_args_t *arg){
+    BTA_DMSetPinType (arg->set_pin_type.pin_type, arg->set_pin_type.pin_code, arg->set_pin_type.pin_code_len);
+}
+
+static void btc_gap_bt_pin_reply(btc_gap_bt_args_t *arg){
+    BTA_DmPinReply(arg->pin_reply.bda.address, arg->pin_reply.accept, arg->pin_reply.pin_code_len, arg->pin_reply.pin_code);
+}
+
 void btc_gap_bt_call_handler(btc_msg_t *msg)
 {
    btc_gap_bt_args_t *arg = (btc_gap_bt_args_t *)msg->arg;
@@ -683,6 +690,14 @@ void btc_gap_bt_call_handler(btc_msg_t *msg)
        btc_gap_bt_remove_bond_device(msg->arg);
        break;
    }
+    case BTC_GAP_BT_ACT_SET_PIN_TYPE:{
+        btc_gap_bt_set_pin_type(arg);
+        break;
+    }
+    case BTC_GAP_BT_ACT_PIN_REPLY: {
+        btc_gap_bt_pin_reply(arg);
+        break;
+    }
    default:
        break;
    }
@@ -716,6 +731,7 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg)
        break;
    case BTC_GAP_BT_READ_RSSI_DELTA_EVT:
    case BTC_GAP_BT_AUTH_CMPL_EVT:
+    case BTC_GAP_BT_PIN_REQ_EVT:
        break;
    default:
        BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
@@ -746,6 +762,10 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg)
        btc_gap_bt_cb_to_app(ESP_BT_GAP_AUTH_CMPL_EVT, (esp_bt_gap_cb_param_t *)msg->arg);
        break;
    }
+    case BTC_GAP_BT_PIN_REQ_EVT:{
+        btc_gap_bt_cb_to_app(ESP_BT_GAP_PIN_REQ_EVT, (esp_bt_gap_cb_param_t *)msg->arg);
+        break;
+    }
    default:
        BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
        break;
@@ -331,6 +331,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
        if (bta_uuid) {
            osi_free(bta_uuid);
        }
+        *count = 0;
        return status;
    } else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)svc_num, ESP_GATT_DB_PRIMARY_SERVICE, offset, (void *)result, db);
@@ -362,6 +363,7 @@ esp_gatt_status_t btc_ble_gattc_get_all_char(uint16_t conn_id,
        if (db) {
            osi_free(db);
        }
+        *count = 0;
        return status;
    } else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, offset, (void *)result, db);
@@ -389,6 +391,7 @@ esp_gatt_status_t btc_ble_gattc_get_all_descr(uint16_t conn_id,
        if (db) {
            osi_free(db);
        }
+        *count = 0;
        return status;
    } else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, offset, (void *)result, db);
@@ -420,6 +423,7 @@ esp_gatt_status_t btc_ble_gattc_get_char_by_uuid(uint16_t conn_id,
        if (db) {
            osi_free(db);
        }
+        *count = 0;
        return status;
    } else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, 0, (void *)result, db);
@@ -456,6 +460,7 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_uuid(uint16_t conn_id,
        if (db) {
            osi_free(db);
        }
+        *count = 0;
        return status;
    } else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
@@ -487,6 +492,7 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_char_handle(uint16_t conn_id,
        if (db) {
            osi_free(db);
        }
+        *count = 0;
        return status;
    } else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
@@ -524,6 +530,7 @@ esp_gatt_status_t btc_ble_gattc_get_include_service(uint16_t conn_id,
        if (db) {
            osi_free(db);
        }
+        *count = 0;
        return status;
    }else {
        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)incl_num, ESP_GATT_DB_INCLUDED_SERVICE, 0, (void *)result, db);
@@ -566,6 +573,7 @@ esp_gatt_status_t btc_ble_gattc_get_db(uint16_t conn_id, uint16_t start_handle,
        if (get_db) {
            osi_free(get_db);
        }
+        *count = 0;
        return ESP_GATT_NOT_FOUND;
    }

@@ -579,7 +587,7 @@ esp_gatt_status_t btc_ble_gattc_get_db(uint16_t conn_id, uint16_t start_handle,
        btc128_to_bta_uuid(&bta_uuid, get_db[i].uuid.uu);
        bta_to_btc_uuid(&db[i].uuid, &bta_uuid);
    }
-    *count = num;
+    *count = db_size;
    //don't forget to free the db buffer after used.
    if (get_db) {
        osi_free(get_db);
@@ -530,9 +530,6 @@ static void btc_gatts_cb_param_copy_free(btc_msg_t *msg, tBTA_GATTS *p_data)
        }
        break;
    case BTA_GATTS_CONF_EVT:
-        if (p_data && p_data->req_data.value){
-            osi_free(p_data->req_data.value);
-        }
        break;
    default:
        break;
@@ -166,5 +166,7 @@ void btc_gap_ble_cb_deep_free(btc_msg_t *msg);
 void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 void btc_gap_callback_init(void);
 void btc_gap_ble_deinit(void);
+void btc_adv_list_init(void);
+void btc_adv_list_deinit(void);

 #endif /* __BTC_GAP_BLE_H__ */
@@ -28,6 +28,7 @@ typedef enum {
    BTC_GAP_BT_SEARCH_SERVICE_RECORD_EVT,
    BTC_GAP_BT_READ_RSSI_DELTA_EVT,
    BTC_GAP_BT_AUTH_CMPL_EVT,
+    BTC_GAP_BT_PIN_REQ_EVT,
 }btc_gap_bt_evt_t;

 typedef enum {
@@ -39,6 +40,8 @@ typedef enum {
    BTC_GAP_BT_ACT_SET_COD,
    BTC_GAP_BT_ACT_READ_RSSI_DELTA,
    BTC_GAP_BT_ACT_REMOVE_BOND_DEVICE,
+    BTC_GAP_BT_ACT_SET_PIN_TYPE,
+    BTC_GAP_BT_ACT_PIN_REPLY,
 } btc_gap_bt_act_t;

 /* btc_bt_gap_args_t */
@@ -79,6 +82,22 @@ typedef union {
    struct rm_bond_device_args {
       bt_bdaddr_t bda;
    } rm_bond_device;
+
+    // BTC_GAP_BT_ACT_SET_PIN_TYPE
+    struct set_pin_type_args {
+        esp_bt_pin_type_t pin_type;
+        uint8_t pin_code_len;
+        esp_bt_pin_code_t pin_code;
+    } set_pin_type;
+
+    // BTC_GAP_BT_ACT_PIN_REPLY
+    struct pin_reply_args {
+        bt_bdaddr_t bda;
+        bool accept;
+        uint8_t pin_code_len;
+        esp_bt_pin_code_t pin_code;
+    } pin_reply;
+
 } btc_gap_bt_args_t;

 void btc_gap_bt_call_handler(btc_msg_t *msg);
@@ -26,9 +26,6 @@

 #define UNUSED(x)                   (void)(x)

-#ifndef SIZE_MAX
-#define SIZE_MAX                    254
-#endif
 /*Timer Related Defination*/

 //by Snake.T
@@ -127,7 +127,7 @@
 #else
 #define SMP_INCLUDED              FALSE
 #define BLE_PRIVACY_SPT           FALSE
-#endif  /* CONFIG_GATTC_ENABLE */
+#endif  /* CONFIG_SMP_ENABLE */

 #if (CONFIG_BT_ACL_CONNECTIONS)
 #define MAX_ACL_CONNECTIONS  CONFIG_BT_ACL_CONNECTIONS
@@ -307,6 +307,16 @@
 #define BTA_AV_CO_CP_SCMS_T  FALSE//FALSE
 #endif

+#ifndef QUEUE_CONGEST_SIZE
+#define  QUEUE_CONGEST_SIZE    40
+#endif
+
+#ifndef CONFIG_BLE_HOST_QUEUE_CONGESTION_CHECK
+#define SCAN_QUEUE_CONGEST_CHECK  FALSE
+#else
+#define SCAN_QUEUE_CONGEST_CHECK  CONFIG_BLE_HOST_QUEUE_CONGESTION_CHECK
+#endif
+
 /* This feature is used to eanble interleaved scan*/
 #ifndef BTA_HOST_INTERLEAVE_SEARCH
 #define BTA_HOST_INTERLEAVE_SEARCH FALSE//FALSE
@@ -581,7 +591,7 @@
 #define BTM_DEFAULT_DISC_INTERVAL   0x0800
 #endif

-/* 
+/*
 * {SERVICE_CLASS, MAJOR_CLASS, MINOR_CLASS}
 *
 * SERVICE_CLASS:0x5A (Bit17 -Networking,Bit19 - Capturing,Bit20 -Object Transfer,Bit22 -Telephony)
@@ -754,6 +764,14 @@
 #define BTM_BLE_CONFORMANCE_TESTING           FALSE
 #endif

+/******************************************************************************
+**
+** CONTROLLER TO HOST FLOW CONTROL
+**
+******************************************************************************/
+
+#define C2H_FLOW_CONTROL_INCLUDED TRUE
+
 /******************************************************************************
 **
 ** L2CAP
@@ -973,7 +991,7 @@
 #endif

 #ifndef BTM_BLE_ADV_TX_POWER
-#define BTM_BLE_ADV_TX_POWER {-21, -15, -7, 1, 9}
+#define BTM_BLE_ADV_TX_POWER {-12, -9, -6, -3, 0, 3, 6, 9}
 #endif


@@ -95,6 +95,12 @@ static void start_up(void)
        response, &acl_data_size_classic, &acl_buffer_count_classic,
        &sco_data_size, &sco_buffer_count);

+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+    // Enable controller to host flow control
+    response = AWAIT_COMMAND(packet_factory->make_set_c2h_flow_control(HCI_HOST_FLOW_CTRL_ACL_ON));
+    packet_parser->parse_generic_command_complete(response);
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
    // Tell the controller about our buffer sizes and buffer counts next
    // TODO(zachoverflow): factor this out. eww l2cap contamination. And why just a hardcoded 10?
    response = AWAIT_COMMAND(
@@ -252,6 +258,9 @@ static void start_up(void)
 #if (BTM_SCO_HCI_INCLUDED == TRUE)
    response = AWAIT_COMMAND(packet_factory->make_write_sync_flow_control_enable(1));
    packet_parser->parse_generic_command_complete(response);
+
+    response = AWAIT_COMMAND(packet_factory->make_write_default_erroneous_data_report(1));
+    packet_parser->parse_generic_command_complete(response);
 #endif
    readable = true;
    // return future_new_immediate(FUTURE_SUCCESS);
@@ -27,10 +27,16 @@
 #include "osi/thread.h"
 #include "esp_bt.h"

+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+#include "l2c_int.h"
+#include "stack/hcimsgs.h"
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
 #define HCI_HAL_SERIAL_BUFFER_SIZE 1026
 #define HCI_BLE_EVENT 0x3e
 #define PACKET_TYPE_TO_INBOUND_INDEX(type) ((type) - 2)
 #define PACKET_TYPE_TO_INDEX(type) ((type) - 1)
+extern bool BTU_check_queue_is_congest(void);


 static const uint8_t preamble_sizes[] = {
@@ -92,6 +98,7 @@ static void hci_hal_env_init(
 static void hci_hal_env_deinit(void)
 {
    fixed_queue_free(hci_hal_env.rx_q, hci_hal_env.allocator->free);
+    hci_hal_env.rx_q = NULL;
 }

 static bool hal_open(const hci_hal_callbacks_t *upper_callbacks)
@@ -99,7 +106,7 @@ static bool hal_open(const hci_hal_callbacks_t *upper_callbacks)
    assert(upper_callbacks != NULL);
    callbacks = upper_callbacks;

-    hci_hal_env_init(HCI_HAL_SERIAL_BUFFER_SIZE, SIZE_MAX);
+    hci_hal_env_init(HCI_HAL_SERIAL_BUFFER_SIZE, QUEUE_SIZE_MAX);

    xHciH4Queue = xQueueCreate(HCI_H4_QUEUE_LEN, sizeof(BtTaskEvt_t));
    xTaskCreatePinnedToCore(hci_hal_h4_rx_handler, HCI_H4_TASK_NAME, HCI_H4_TASK_STACK_SIZE, NULL, HCI_H4_TASK_PRIO, &xHciH4TaskHandle, HCI_H4_TASK_PINNED_TO_CORE);
@@ -165,6 +172,7 @@ static void hci_hal_h4_rx_handler(void *arg)
        if (pdTRUE == xQueueReceive(xHciH4Queue, &e, (portTickType)portMAX_DELAY)) {
            if (e.sig == SIG_HCI_HAL_RECV_PACKET) {
                fixed_queue_process(hci_hal_env.rx_q);
+
            }
        }
    }
@@ -178,13 +186,51 @@ task_post_status_t hci_hal_h4_task_post(task_post_t timeout)
    evt.par = 0;

    if (xQueueSend(xHciH4Queue, &evt, timeout) != pdTRUE) {
-        HCI_TRACE_ERROR("xHciH4Queue failed\n");
        return TASK_POST_SUCCESS;
    }

    return TASK_POST_FAIL;
 }

+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+static void hci_packet_complete(BT_HDR *packet){
+    uint8_t type, num_handle;
+    uint16_t handle;
+    uint16_t handles[MAX_L2CAP_LINKS + 4];
+    uint16_t num_packets[MAX_L2CAP_LINKS + 4];
+    uint8_t *stream = packet->data + packet->offset;
+    tL2C_LCB  *p_lcb = NULL;
+
+    STREAM_TO_UINT8(type, stream);
+    if (type == DATA_TYPE_ACL/* || type == DATA_TYPE_SCO*/) {
+        STREAM_TO_UINT16(handle, stream);
+        handle = handle & HCI_DATA_HANDLE_MASK;
+        p_lcb = l2cu_find_lcb_by_handle(handle);
+        if (p_lcb) {
+            p_lcb->completed_packets++;
+        }
+        if (esp_vhci_host_check_send_available()){
+            num_handle = l2cu_find_completed_packets(handles, num_packets);
+            if (num_handle > 0){
+                btsnd_hcic_host_num_xmitted_pkts (num_handle, handles, num_packets);
+            }
+        } else {
+            //Send HCI_Host_Number_of_Completed_Packets next time.
+        }
+
+    }
+}
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
+bool host_recv_adv_packet(BT_HDR *packet)
+{
+    assert(packet);
+    if(packet->data[0] == DATA_TYPE_EVENT && packet->data[1] == HCI_BLE_EVENT && packet->data[3] ==  HCI_BLE_ADV_PKT_RPT_EVT) {
+        return true;
+    }
+    return false;
+}
+
 static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
 {
    uint8_t type, hdr_size;
@@ -194,6 +240,11 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
    if (!packet) {
        return;
    }
+
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+    hci_packet_complete(packet);
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
    STREAM_TO_UINT8(type, stream);
    packet->offset++;
    packet->len--;
@@ -233,6 +284,13 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
        hci_hal_env.allocator->free(packet);
        return;
    }
+#if SCAN_QUEUE_CONGEST_CHECK
+    if(BTU_check_queue_is_congest() && host_recv_adv_packet(packet)) {
+        HCI_TRACE_ERROR("BtuQueue is congested");
+        hci_hal_env.allocator->free(packet);
+        return;
+    }
+#endif

    packet->event = outbound_event_types[PACKET_TYPE_TO_INDEX(type)];
    callbacks->packet_ready(packet);
@@ -260,6 +318,10 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
    BT_HDR *pkt;
    size_t pkt_size;

+    if (hci_hal_env.rx_q == NULL) {
+        return 0;
+    }
+
    pkt_size = BT_HDR_SIZE + len;
    pkt = (BT_HDR *)hci_hal_env.allocator->alloc(pkt_size);
    if (!pkt) {
@@ -271,7 +333,7 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
    pkt->layer_specific = 0;
    memcpy(pkt->data, data, len);
    fixed_queue_enqueue(hci_hal_env.rx_q, pkt);
-    hci_hal_h4_task_post(TASK_POST_BLOCKING);
+    hci_hal_h4_task_post(100 / portTICK_PERIOD_MS);

    BTTRC_DUMP_BUFFER("Recv Pkt", pkt->data, len);

@@ -158,7 +158,7 @@ static int hci_layer_init_env(void)
    // as per the Bluetooth spec, Volume 2, Part E, 4.4 (Command Flow Control)
    // This value can change when you get a command complete or command status event.
    hci_host_env.command_credits = 1;
-    hci_host_env.command_queue = fixed_queue_new(SIZE_MAX);
+    hci_host_env.command_queue = fixed_queue_new(QUEUE_SIZE_MAX);
    if (hci_host_env.command_queue) {
        fixed_queue_register_dequeue(hci_host_env.command_queue, event_command_ready);
    } else {
@@ -166,7 +166,7 @@ static int hci_layer_init_env(void)
        return -1;
    }

-    hci_host_env.packet_queue = fixed_queue_new(SIZE_MAX);
+    hci_host_env.packet_queue = fixed_queue_new(QUEUE_SIZE_MAX);
    if (hci_host_env.packet_queue) {
        fixed_queue_register_dequeue(hci_host_env.packet_queue, event_packet_ready);
    } else {
@@ -274,6 +274,7 @@ static void transmit_command(

    fixed_queue_enqueue(hci_host_env.command_queue, wait_entry);
    hci_host_task_post(TASK_POST_BLOCKING);
+
 }

 static future_t *transmit_command_futured(BT_HDR *command)
@@ -317,8 +318,14 @@ static void event_command_ready(fixed_queue_t *queue)
    command_waiting_response_t *cmd_wait_q = &hci_host_env.cmd_waiting_q;

    wait_entry = fixed_queue_dequeue(queue);
-    hci_host_env.command_credits--;

+    if(wait_entry->opcode == HCI_HOST_NUM_PACKETS_DONE){
+        packet_fragmenter->fragment_and_dispatch(wait_entry->command);
+        buffer_allocator->free(wait_entry->command);
+        osi_free(wait_entry);
+        return;
+    }
+    hci_host_env.command_credits--;
    // Move it to the list of commands awaiting response
    osi_mutex_lock(&cmd_wait_q->commands_pending_response_lock, OSI_MUTEX_MAX_TIMEOUT);
    list_append(cmd_wait_q->commands_pending_response, wait_entry);
@@ -435,7 +442,6 @@ static bool filter_incoming_event(BT_HDR *packet)
    if (event_code == HCI_COMMAND_COMPLETE_EVT) {
        STREAM_TO_UINT8(hci_host_env.command_credits, stream);
        STREAM_TO_UINT16(opcode, stream);
-
        wait_entry = get_waiting_command(opcode);
        if (!wait_entry) {
            HCI_TRACE_WARNING("%s command complete event with no matching command. opcode: 0x%x.", __func__, opcode);
@@ -45,6 +45,16 @@ static BT_HDR *make_read_buffer_size(void)
    return make_command_no_params(HCI_READ_BUFFER_SIZE);
 }

+static BT_HDR *make_set_c2h_flow_control(uint8_t enable)
+{
+    uint8_t *stream;
+    const uint8_t parameter_size = 1;
+    BT_HDR *packet = make_command(HCI_SET_HC_TO_HOST_FLOW_CTRL, parameter_size, &stream);
+
+    UINT8_TO_STREAM(stream, enable);
+    return packet;
+}
+
 static BT_HDR *make_host_buffer_size(uint16_t acl_size, uint8_t sco_size, uint16_t acl_count, uint16_t sco_count)
 {
    uint8_t *stream;
@@ -184,6 +194,16 @@ static BT_HDR *make_write_sync_flow_control_enable(uint8_t enable)
    UINT8_TO_STREAM(stream, enable);
    return packet;
 }
+
+static BT_HDR *make_write_default_erroneous_data_report(uint8_t enable)
+{
+    uint8_t *stream;
+    const uint8_t parameter_size = 1;
+    BT_HDR *packet = make_command(HCI_WRITE_ERRONEOUS_DATA_RPT, parameter_size, &stream);
+
+    UINT8_TO_STREAM(stream, enable);
+    return packet;
+}
 // Internal functions

 static BT_HDR *make_command_no_params(uint16_t opcode)
@@ -220,6 +240,7 @@ static BT_HDR *make_packet(size_t data_size)
 static const hci_packet_factory_t interface = {
    make_reset,
    make_read_buffer_size,
+    make_set_c2h_flow_control,
    make_host_buffer_size,
    make_read_local_version_info,
    make_read_bd_addr,
@@ -237,7 +258,8 @@ static const hci_packet_factory_t interface = {
    make_ble_read_suggested_default_data_length,
    make_ble_write_suggested_default_data_length,
    make_ble_set_event_mask,
-    make_write_sync_flow_control_enable
+    make_write_sync_flow_control_enable,
+    make_write_default_erroneous_data_report,
 };

 const hci_packet_factory_t *hci_packet_factory_get_interface()
@@ -25,6 +25,7 @@
 typedef struct {
    BT_HDR *(*make_reset)(void);
    BT_HDR *(*make_read_buffer_size)(void);
+    BT_HDR *(*make_set_c2h_flow_control)(uint8_t enable);
    BT_HDR *(*make_host_buffer_size)(uint16_t acl_size, uint8_t sco_size, uint16_t acl_count, uint16_t sco_count);
    BT_HDR *(*make_read_local_version_info)(void);
    BT_HDR *(*make_read_bd_addr)(void);
@@ -43,6 +44,7 @@ typedef struct {
    BT_HDR *(*make_ble_write_suggested_default_data_length)(uint16_t SuggestedMaxTxOctets, uint16_t SuggestedMaxTxTime);
    BT_HDR *(*make_ble_set_event_mask)(const bt_event_mask_t *event_mask);
    BT_HDR *(*make_write_sync_flow_control_enable)(uint8_t enable);
+    BT_HDR *(*make_write_default_erroneous_data_report)(uint8_t enable);
 } hci_packet_factory_t;

 const hci_packet_factory_t *hci_packet_factory_get_interface();
@@ -22,6 +22,10 @@
 #include <stdbool.h>
 #include "osi/list.h"

+#ifndef QUEUE_SIZE_MAX
+#define QUEUE_SIZE_MAX                    254
+#endif
+
 struct fixed_queue_t;

 typedef struct fixed_queue_t fixed_queue_t;
@@ -69,7 +69,7 @@ typedef enum {
 #define HCI_H4_TASK_STACK_SIZE          (2048 + BT_TASK_EXTRA_STACK_SIZE)
 #define HCI_H4_TASK_PRIO                (configMAX_PRIORITIES - 4)
 #define HCI_H4_TASK_NAME                "hciH4T"
-#define HCI_H4_QUEUE_LEN                60
+#define HCI_H4_QUEUE_LEN                1

 #define BTU_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
 #define BTU_TASK_STACK_SIZE             (4096 + BT_TASK_EXTRA_STACK_SIZE)
@@ -313,7 +313,7 @@ tAVCT_LCB *avct_lcb_alloc(BD_ADDR bd_addr)
            p_lcb->allocated = (UINT8)(i + 1);
            memcpy(p_lcb->peer_addr, bd_addr, BD_ADDR_LEN);
            AVCT_TRACE_DEBUG("avct_lcb_alloc %d", p_lcb->allocated);
-            p_lcb->tx_q = fixed_queue_new(SIZE_MAX);
+            p_lcb->tx_q = fixed_queue_new(QUEUE_SIZE_MAX);
            break;
        }
    }
@@ -376,8 +376,8 @@ tAVDT_CCB *avdt_ccb_alloc(BD_ADDR bd_addr)
        if (!p_ccb->allocated) {
            p_ccb->allocated = TRUE;
            memcpy(p_ccb->peer_addr, bd_addr, BD_ADDR_LEN);
-            p_ccb->cmd_q = fixed_queue_new(SIZE_MAX);
-            p_ccb->rsp_q = fixed_queue_new(SIZE_MAX);
+            p_ccb->cmd_q = fixed_queue_new(QUEUE_SIZE_MAX);
+            p_ccb->rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
            p_ccb->timer_entry.param = (UINT32) p_ccb;
            AVDT_TRACE_DEBUG("avdt_ccb_alloc %d\n", i);
            break;
@@ -412,6 +412,7 @@ void avdt_l2c_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed)
 {
    tAVDT_TC_TBL    *p_tbl;
    UINT16          disc_rsn = AVDT_DISC_RSN_NORMAL;
+    tAVDT_CCB       *p_ccb;
    AVDT_TRACE_DEBUG("avdt_l2c_disconnect_ind_cback lcid: %d, ack_needed: %d\n",
                     lcid, ack_needed);
    /* look up info for this channel */
@@ -420,7 +421,13 @@ void avdt_l2c_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed)
            /* send L2CAP disconnect response */
            L2CA_DisconnectRsp(lcid);
        } else {
-            disc_rsn = AVDT_DISC_RSN_ABNORMAL;
+            if ((p_ccb = avdt_ccb_by_idx(p_tbl->ccb_idx)) != NULL) {
+                UINT16 rsn = L2CA_GetDisconnectReason(p_ccb->peer_addr, BT_TRANSPORT_BR_EDR);
+                if (rsn != 0 && rsn != HCI_ERR_PEER_USER) {
+                    disc_rsn = AVDT_DISC_RSN_ABNORMAL;
+                    AVDT_TRACE_EVENT("avdt link disc rsn 0x%x", rsn);
+                }
+            }
        }

        avdt_ad_tc_close_ind(p_tbl, disc_rsn);
@@ -603,7 +603,7 @@ tAVDT_SCB *avdt_scb_alloc(tAVDT_CS *p_cs)
            memcpy(&p_scb->cs, p_cs, sizeof(tAVDT_CS));
 #if AVDT_MULTIPLEXING == TRUE
            /* initialize fragments gueue */
-            p_scb->frag_q = fixed_queue_new(SIZE_MAX);
+            p_scb->frag_q = fixed_queue_new(QUEUE_SIZE_MAX);

            if (p_cs->cfg.psc_mask & AVDT_PSC_MUX) {
                p_scb->cs.cfg.mux_tcid_media = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
@@ -1522,11 +1522,10 @@ UINT8 BTM_AllocateSCN(void)
 {
    UINT8   x;
    BTM_TRACE_DEBUG ("BTM_AllocateSCN\n");
-    // stack reserves scn 1 for HFP, HSP we still do the correct way
    for (x = 1; x < BTM_MAX_SCN; x++) {
-        if (!btm_cb.btm_scn[x]) {
-            btm_cb.btm_scn[x] = TRUE;
-            return (x + 1);
+        if (!btm_cb.btm_scn[x - 1]) {
+            btm_cb.btm_scn[x - 1] = TRUE;
+            return x;
        }
    }
    return (0);    /* No free ports */
@@ -1545,10 +1544,7 @@ UINT8 BTM_AllocateSCN(void)
 #if (CLASSIC_BT_INCLUDED == TRUE)
 BOOLEAN BTM_TryAllocateSCN(UINT8 scn)
 {
-    /* Make sure we don't exceed max port range.
-     * Stack reserves scn 1 for HFP, HSP we still do the correct way.
-     */
-    if ( (scn >= BTM_MAX_SCN) || (scn == 1) ) {
+    if (scn >= BTM_MAX_SCN) {
        return FALSE;
    }

@@ -1905,14 +1901,10 @@ void btm_qos_setup_complete (UINT8 status, UINT16 handle, FLOW_SPEC *p_flow)
 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
 **
 *******************************************************************************/
-tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
+tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBT_TRANSPORT transport, tBTM_CMPL_CB *p_cb)
 {
    tACL_CONN   *p;
-    tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
-#if BLE_INCLUDED == TRUE
-    tBT_DEVICE_TYPE dev_type;
-    tBLE_ADDR_TYPE  addr_type;
-#endif
+
    BTM_TRACE_API ("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x\n",
                   remote_bda[0], remote_bda[1], remote_bda[2],
                   remote_bda[3], remote_bda[4], remote_bda[5]);
@@ -1924,13 +1916,6 @@ tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
        return (BTM_BUSY);
    }

-#if BLE_INCLUDED == TRUE
-    BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
-    if (dev_type == BT_DEVICE_TYPE_BLE) {
-        transport = BT_TRANSPORT_LE;
-    }
-#endif
-
    p = btm_bda_to_acl(remote_bda, transport);
    if (p != (tACL_CONN *)NULL) {
        btu_start_timer (&btm_cb.devcb.rssi_timer, BTU_TTYPE_BTM_ACL,
@@ -1225,7 +1225,7 @@ void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY

            /* Set that link key is known since this shares field with BTM_SEC_FLAG_LKEY_KNOWN flag in stack/btm_api.h*/
            p_rec->sec_flags |=  BTM_SEC_LE_LINK_KEY_KNOWN;
-            if ( p_keys->pcsrk_key.sec_level == SMP_SEC_AUTHENTICATED) {
+            if ( p_keys->lenc_key.sec_level == SMP_SEC_AUTHENTICATED) {
                p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
            } else {
                p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
@@ -1948,14 +1948,6 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
            handle = HCID_GET_HANDLE (handle);

            btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
-            if(role == HCI_ROLE_SLAVE) {
-                //clear p_cb->state, controller will stop adv when ble connected.
-                tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
-                if(p_cb) {
-                    p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-                    p_cb->state = BTM_BLE_STOP_ADV; 
-                }
-            }
            l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
                              conn_latency, conn_timeout);

@@ -65,6 +65,23 @@ static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p)
            p_cb->set_local_privacy_cback = NULL;
        }

+        if (btm_cb.ble_ctr_cb.inq_var.adv_mode == BTM_BLE_ADV_ENABLE){
+            BTM_TRACE_DEBUG("Advertise with new resolvable private address, now.");
+            /**
+             * Restart advertising, using new resolvable private address
+             */
+            btm_ble_stop_adv();
+            btm_ble_start_adv();
+        }
+        if (btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_SCANNING){
+            BTM_TRACE_DEBUG("Scan with new resolvable private address, now.");
+            /**
+             * Restart scaning, using new resolvable private address
+             */
+            btm_ble_stop_scan();
+            btm_ble_start_scan();
+        }
+
        /* start a periodical timer to refresh random addr */
        btu_stop_timer_oneshot(&p_cb->raddr_timer_ent);
 #if (BTM_BLE_CONFORMANCE_TESTING == TRUE)
@@ -1439,7 +1439,8 @@ void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32

    if (BTM_BLE_ISVALID_PARAM(scan_interval, BTM_BLE_SCAN_INT_MIN, max_scan_interval) &&
            BTM_BLE_ISVALID_PARAM(scan_window, BTM_BLE_SCAN_WIN_MIN, max_scan_window) &&
-            (scan_mode == BTM_BLE_SCAN_MODE_ACTI || scan_mode == BTM_BLE_SCAN_MODE_PASS)) {
+            (scan_mode == BTM_BLE_SCAN_MODE_ACTI || scan_mode == BTM_BLE_SCAN_MODE_PASS) &&
+            (scan_duplicate_filter < BTM_BLE_SCAN_DUPLICATE_MAX)) {
        p_cb->scan_type = scan_mode;
        p_cb->scan_interval = scan_interval;
        p_cb->scan_window = scan_window;
@@ -2637,7 +2638,7 @@ static void btm_ble_parse_adv_data(tBTM_INQ_INFO *p_info, UINT8 *p_data,
 ** Returns          void
 **
 *******************************************************************************/
-void btm_ble_cache_adv_data(tBTM_INQ_RESULTS *p_cur, UINT8 data_len, UINT8 *p, UINT8 evt_type)
+void btm_ble_cache_adv_data(BD_ADDR bda, tBTM_INQ_RESULTS *p_cur, UINT8 data_len, UINT8 *p, UINT8 evt_type)
 {
    tBTM_BLE_INQ_CB     *p_le_inq_cb = &btm_cb.ble_ctr_cb.inq_var;
    UINT8 *p_cache;
@@ -2649,6 +2650,15 @@ void btm_ble_cache_adv_data(tBTM_INQ_RESULTS *p_cur, UINT8 data_len, UINT8 *p, U
        memset(p_le_inq_cb->adv_data_cache, 0, BTM_BLE_CACHE_ADV_DATA_MAX);
        p_cur->adv_data_len = 0;
        p_cur->scan_rsp_len = 0;
+    } 
+
+    //Clear the adv cache if the addresses are not equal
+    if(memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) != 0) {
+        p_le_inq_cb->adv_len = 0;
+        memcpy(p_le_inq_cb->adv_addr, bda, BD_ADDR_LEN);
+        memset(p_le_inq_cb->adv_data_cache, 0, BTM_BLE_CACHE_ADV_DATA_MAX);
+        p_cur->adv_data_len = 0;
+        p_cur->scan_rsp_len = 0;
    }

    if (data_len > 0) {
@@ -2878,7 +2888,7 @@ static void btm_ble_appearance_to_cod(UINT16 appearance, UINT8 *dev_class)
 ** Returns          void
 **
 *******************************************************************************/
-BOOLEAN btm_ble_update_inq_result(tINQ_DB_ENT *p_i, UINT8 addr_type, UINT8 evt_type, UINT8 *p)
+BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type, UINT8 evt_type, UINT8 *p)
 {
    BOOLEAN             to_report = TRUE;
    tBTM_INQ_RESULTS     *p_cur = &p_i->inq_info.results;
@@ -2896,7 +2906,7 @@ BOOLEAN btm_ble_update_inq_result(tINQ_DB_ENT *p_i, UINT8 addr_type, UINT8 evt_t
        BTM_TRACE_WARNING("EIR data too long %d. discard", data_len);
        return FALSE;
    }
-    btm_ble_cache_adv_data(p_cur, data_len, p, evt_type);
+    btm_ble_cache_adv_data(bda, p_cur, data_len, p, evt_type);

    p1 = (p + data_len);
    STREAM_TO_UINT8 (rssi, p1);
@@ -3120,6 +3130,71 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
    }
 }

+/*******************************************************************************
+**
+** Function         btm_ble_process_last_adv_pkt
+**
+** Description      This function is called to report last adv packet
+**
+** Parameters
+**
+** Returns          void
+**
+*******************************************************************************/
+
+static void btm_ble_process_last_adv_pkt(void)
+{
+    UINT8       result = 0;
+    UINT8       null_bda[6] = {0};
+    tBTM_INQUIRY_VAR_ST  *p_inq = &btm_cb.btm_inq_vars;
+    tBTM_INQ_RESULTS_CB  *p_inq_results_cb = p_inq->p_inq_results_cb;
+    tBTM_INQ_RESULTS_CB  *p_obs_results_cb = btm_cb.ble_ctr_cb.p_obs_results_cb;
+    tBTM_INQ_RESULTS_CB  *p_scan_results_cb = btm_cb.ble_ctr_cb.p_scan_results_cb;
+    tBTM_BLE_INQ_CB      *p_le_inq_cb = &btm_cb.ble_ctr_cb.inq_var;
+    tINQ_DB_ENT          *p_i = btm_inq_db_find (p_le_inq_cb->adv_addr);
+
+    if(memcmp(null_bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) == 0) {
+        return;
+    }
+
+    if(p_i == NULL) {
+        BTM_TRACE_DEBUG("no last adv");
+        return;
+    }
+
+    if ((result = btm_ble_is_discoverable(p_le_inq_cb->adv_addr, p_i->inq_info.results.ble_evt_type, NULL)) == 0) {
+        BTM_TRACE_WARNING("%s device is no longer discoverable so discarding advertising packet pkt",
+                 __func__);
+        return;
+    }
+    /* background connection in selective connection mode */
+    if (btm_cb.ble_ctr_cb.bg_conn_type == BTM_BLE_CONN_SELECTIVE) {
+        //do nothing
+    } else {
+        if (p_inq_results_cb && (result & BTM_BLE_INQ_RESULT)) {
+            (p_inq_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
+        }
+        if (p_obs_results_cb && (result & BTM_BLE_OBS_RESULT)) {
+            (p_obs_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
+        }
+        if (p_scan_results_cb && (result & BTM_BLE_DISCO_RESULT)) {
+            (p_scan_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
+        }
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_process_adv_pkt_cont
@@ -3144,6 +3219,13 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
    BOOLEAN     update = TRUE;
    UINT8       result = 0;

+   //if scan duplicate is enabled, the adv packet without scan response is allowed to report to upper layer
+   if(p_le_inq_cb->scan_duplicate_filter == BTM_BLE_SCAN_DUPLICATE_ENABLE) {
+       if(memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) != 0) {
+            btm_ble_process_last_adv_pkt();
+       }
+   }
+
    p_i = btm_inq_db_find (bda);

    /* Check if this address has already been processed for this inquiry */
@@ -3172,7 +3254,7 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
        p_inq->inq_cmpl_info.num_resp++;
    }
    /* update the LE device information in inquiry database */
-    if (!btm_ble_update_inq_result(p_i, addr_type, evt_type, p)) {
+    if (!btm_ble_update_inq_result(bda, p_i, addr_type, evt_type, p)) {
        return;
    }

@@ -3216,12 +3298,24 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
    } else {
        if (p_inq_results_cb && (result & BTM_BLE_INQ_RESULT)) {
            (p_inq_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
        }
        if (p_obs_results_cb && (result & BTM_BLE_OBS_RESULT)) {
            (p_obs_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
        }
        if (p_scan_results_cb && (result & BTM_BLE_DISCO_RESULT)) {
            (p_scan_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
        }
    }
 }
@@ -3492,15 +3586,30 @@ tBTM_STATUS btm_ble_stop_adv(void)
    tBTM_STATUS rt = BTM_SUCCESS;

    if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        UINT8 temp_adv_mode = p_cb->adv_mode;
+        BOOLEAN temp_fast_adv_on = p_cb->fast_adv_on;
+        tBTM_BLE_GAP_STATE temp_state = p_cb->state;
+        tBTM_BLE_WL_STATE temp_wl_state = btm_cb.ble_ctr_cb.wl_state;
+        tBTM_BLE_STATE_MASK temp_mask = btm_ble_get_topology_mask ();
+
+        p_cb->fast_adv_on = FALSE;
+        p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
+        p_cb->state = BTM_BLE_ADV_PENDING;
+        btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;
+
+        /* clear all adv states */
+        btm_ble_clear_topology_mask (BTM_BLE_STATE_ALL_ADV_MASK);
+
        if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) {
-            p_cb->fast_adv_on = FALSE;
-            p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-            p_cb->state = BTM_BLE_ADV_PENDING;
-            btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;

-            /* clear all adv states */
-            btm_ble_clear_topology_mask (BTM_BLE_STATE_ALL_ADV_MASK);
        } else {
+            // reset state
+            p_cb->fast_adv_on = temp_fast_adv_on;
+            p_cb->adv_mode = temp_adv_mode;
+            p_cb->state = temp_state;
+            btm_cb.ble_ctr_cb.wl_state = temp_wl_state;
+            btm_ble_set_topology_mask (temp_mask);
+
            rt = BTM_NO_RESOURCES;
        }
    }
@@ -3745,6 +3854,20 @@ BOOLEAN btm_ble_clear_topology_mask (tBTM_BLE_STATE_MASK request_state_mask)
    return TRUE;
 }

+/*******************************************************************************
+**
+** Function         btm_ble_get_topology_mask
+**
+** Description      Get BLE topology bit mask
+**
+** Returns          state mask.   
+**
+*******************************************************************************/
+tBTM_BLE_STATE_MASK btm_ble_get_topology_mask (void)
+{
+    return btm_cb.ble_ctr_cb.cur_states;
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_update_link_topology_mask
@@ -3838,7 +3961,7 @@ void btm_ble_init (void)
    btm_cb.cmn_ble_vsc_cb.values_read = FALSE;
    p_cb->cur_states       = 0;

-    p_cb->conn_pending_q = fixed_queue_new(SIZE_MAX);
+    p_cb->conn_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);

    p_cb->inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
    p_cb->inq_var.scan_type = BTM_BLE_SCAN_MODE_NONE;
@@ -222,10 +222,10 @@ tBTM_STATUS btm_ble_enable_multi_adv (BOOLEAN enable, UINT8 inst_id, UINT8 cb_ev
 ** Returns          tx power in dBm
 **
 *******************************************************************************/
-int btm_ble_tx_power[BTM_BLE_ADV_TX_POWER_MAX + 1] = BTM_BLE_ADV_TX_POWER;
+static const int btm_ble_tx_power[BTM_BLE_ADV_TX_POWER_MAX + 1] = BTM_BLE_ADV_TX_POWER;
 char btm_ble_map_adv_tx_power(int tx_power_index)
 {
-    if (0 <= tx_power_index && tx_power_index < BTM_BLE_ADV_TX_POWER_MAX) {
+    if (0 <= tx_power_index && tx_power_index <= BTM_BLE_ADV_TX_POWER_MAX) {
        return (char)btm_ble_tx_power[tx_power_index];
    }
    return 0;
@@ -172,22 +172,23 @@ BOOLEAN BTM_SecAddDevice (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name,
 ** Description      Free resources associated with the device.
 **
 ** Parameters:      bd_addr          - BD address of the peer
+**                  transport        - BT_TRANSPORT_BR_EDR or BT_TRANSPORT_LE
 **
 ** Returns          TRUE if removed OK, FALSE if not found or ACL link is active
 **
 *******************************************************************************/
-BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr)
+BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr, tBT_TRANSPORT transport)
 {
+
    tBTM_SEC_DEV_REC *p_dev_rec;

-    if (BTM_IsAclConnectionUp(bd_addr, BT_TRANSPORT_LE) ||
-            BTM_IsAclConnectionUp(bd_addr, BT_TRANSPORT_BR_EDR)) {
+    if (BTM_IsAclConnectionUp(bd_addr, transport)) {
        BTM_TRACE_WARNING("%s FAILED: Cannot Delete when connection is active\n", __func__);
        return FALSE;
    }
-
    if ((p_dev_rec = btm_find_dev(bd_addr)) != NULL) {
-        btm_sec_free_dev(p_dev_rec);
+        btm_sec_free_dev(p_dev_rec, transport);
+
        /* Tell controller to get rid of the link key, if it has one stored */
        BTM_DeleteStoredLinkKey (p_dev_rec->bd_addr, NULL);
    }
@@ -340,17 +341,33 @@ tBTM_SEC_DEV_REC *btm_sec_alloc_dev (BD_ADDR bd_addr)
 ** Description      Mark device record as not used
 **
 *******************************************************************************/
-void btm_sec_free_dev (tBTM_SEC_DEV_REC *p_dev_rec)
+void btm_sec_free_dev (tBTM_SEC_DEV_REC *p_dev_rec, tBT_TRANSPORT transport)
 {
-    p_dev_rec->bond_type = BOND_TYPE_UNKNOWN;
-    p_dev_rec->sec_flags = 0;
+    if (transport == BT_TRANSPORT_BR_EDR) {
+        memset(p_dev_rec->link_key, 0, LINK_KEY_LEN);
+        p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
+                                | BTM_SEC_ENCRYPTED | BTM_SEC_NAME_KNOWN
+                                | BTM_SEC_LINK_KEY_KNOWN | BTM_SEC_LINK_KEY_AUTHED
+                                | BTM_SEC_ROLE_SWITCHED | BTM_SEC_16_DIGIT_PIN_AUTHED);
+    } else if (transport == BT_TRANSPORT_LE) {
+        p_dev_rec->bond_type = BOND_TYPE_UNKNOWN;
+        p_dev_rec->sec_flags &= ~(BTM_SEC_LE_AUTHENTICATED | BTM_SEC_LE_ENCRYPTED
+                                | BTM_SEC_LE_NAME_KNOWN | BTM_SEC_LE_LINK_KEY_KNOWN
+                                | BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_ROLE_SWITCHED);
+#if BLE_INCLUDED == TRUE
+        /* Clear out any saved BLE keys */
+        btm_sec_clear_ble_keys (p_dev_rec);
+#endif
+    } else {
+        p_dev_rec->bond_type = BOND_TYPE_UNKNOWN;
+        memset(p_dev_rec->link_key, 0, LINK_KEY_LEN);
+        p_dev_rec->sec_flags = 0;

 #if BLE_INCLUDED == TRUE
-    /* Clear out any saved BLE keys */
-    btm_sec_clear_ble_keys (p_dev_rec);
+        /* Clear out any saved BLE keys */
+        btm_sec_clear_ble_keys (p_dev_rec);
 #endif
-
-
+    }
 }

 /*******************************************************************************
@@ -170,16 +170,6 @@ tBTM_STATUS BTM_SetDiscoverability (UINT16 inq_mode, UINT16 window, UINT16 inter
    BOOLEAN      cod_limited;

    BTM_TRACE_API ("BTM_SetDiscoverability\n");
-#if (BLE_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
-    if (controller_get_interface()->supports_ble()) {
-        if (btm_ble_set_discoverability((UINT16)(inq_mode))
-                == BTM_SUCCESS) {
-            btm_cb.btm_inq_vars.discoverable_mode &= (~BTM_BLE_DISCOVERABLE_MASK);
-            btm_cb.btm_inq_vars.discoverable_mode |= (inq_mode & BTM_BLE_DISCOVERABLE_MASK);
-        }
-    }
-    inq_mode &= ~BTM_BLE_DISCOVERABLE_MASK;
-#endif

    /*** Check mode parameter ***/
    if (inq_mode > BTM_MAX_DISCOVERABLE) {
@@ -601,17 +591,6 @@ tBTM_STATUS BTM_SetConnectability (UINT16 page_mode, UINT16 window, UINT16 inter

    BTM_TRACE_API ("BTM_SetConnectability\n");

-#if (BLE_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
-    if (controller_get_interface()->supports_ble()) {
-        if (btm_ble_set_connectability(page_mode) != BTM_SUCCESS) {
-            return BTM_NO_RESOURCES;
-        }
-        p_inq->connectable_mode &= (~BTM_BLE_CONNECTABLE_MASK);
-        p_inq->connectable_mode |= (page_mode & BTM_BLE_CONNECTABLE_MASK);
-    }
-    page_mode &= ~BTM_BLE_CONNECTABLE_MASK;
-#endif
-
    /*** Check mode parameter ***/
    if (page_mode != BTM_NON_CONNECTABLE && page_mode != BTM_CONNECTABLE) {
        return (BTM_ILLEGAL_VALUE);
--- a/Show More
+++ b/Show More