Merge branch 'bugfix/i2s_param_comments' into 'release/v3.0'

modify i2s param and comments

See merge request idf/esp-idf!2266

.editorconfig

@@ -0,0 +1,34 @@
+# EditorConfig helps developers define and maintain consistent
+# coding styles between different editors and IDEs
+# http://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[{*.md,*.rst}]
+trim_trailing_whitespace = false
+
+[{Makefile,*.mk,*.bat}]
+indent_style = tab
+indent_size = 2
+
+[*/freertos/**]
+indent_style = tab
+indent_size = 4
+
+[{*/freertos/**.S,**/FreeRTOSConfig.h}]
+indent_style = space
+indent_size = 4
+
+[*.pem]
+insert_final_newline = false
+
+[*.py]
+max_line_length = 119

.gitlab-ci.yml

@@ -26,8 +26,16 @@ variables:
 # IDF environment
 
   IDF_PATH: "$CI_PROJECT_DIR"
+  APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
+  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
+
+# before each job, we need to check if this job is filtered by bot stage/job filter
+.apply_bot_filter: &apply_bot_filter
+  python $APPLY_BOT_FILTER_SCRIPT || exit 0
 
 before_script:
+  # apply bot filter in before script
+  - *apply_bot_filter
   # add gitlab ssh key
   - mkdir -p ~/.ssh
   - chmod 700 ~/.ssh
@@ -46,11 +54,15 @@ before_script:
 
 .do_nothing_before:
   before_script: &do_nothing_before
+    # apply bot filter in before script
+    - *apply_bot_filter
     - echo "Not setting up GitLab key, not fetching submodules"
     - source tools/ci/configure_ci_environment.sh
 
 .add_gitlab_key_before:
   before_script: &add_gitlab_key_before
+    # apply bot filter in before script
+    - *apply_bot_filter
     - echo "Not fetching submodules"
     - source tools/ci/configure_ci_environment.sh
     # add gitlab ssh key
@@ -75,7 +87,7 @@ build_template_app:
     # Try to use the same branch name for esp-idf-template that we're
     # using on esp-idf. If it doesn't exist then just stick to the default
     # branch
-    - git checkout ${CI_COMMIT_REF_NAME} || echo "Using esp-idf-template default branch..."
+    - python $CHECKOUT_REF_SCRIPT esp-idf-template
     # Test debug build (default)
     - make all V=1
     # Now test release build
@@ -97,17 +109,29 @@ build_template_app:
     BATCH_BUILD: "1"
     V: "0"
 
-build_ssc:
+.build_ssc_template: &build_ssc_template
   <<: *build_template
   artifacts:
     paths:
       - SSC/ssc_bin
-    expire_in: 6 mos
+    expire_in: 1 mos
+  variables:
+    SSC_CONFIG_FOLDER: "$CI_PROJECT_DIR/SSC/configs/ESP32_IDF"
   script:
     - git clone $SSC_REPOSITORY
     - cd SSC
-    - git checkout ${CI_COMMIT_REF_NAME} || echo "Using SSC default branch..."
-    - MAKEFLAGS= ./gen_misc_ng.sh
+    - python $CHECKOUT_REF_SCRIPT SSC
+    - MAKEFLAGS= ./ci_build_ssc.sh "${CI_JOB_NAME}" "${IDF_PATH}/.gitlab-ci.yml"
+
+# don't forget to add to dependency to test_template when adding new build_ssc jobs
+build_ssc_00:
+  <<: *build_ssc_template
+
+build_ssc_01:
+  <<: *build_ssc_template
+
+build_ssc_02:
+  <<: *build_ssc_template
 
 build_esp_idf_tests:
   <<: *build_template
@@ -129,15 +153,18 @@ build_esp_idf_tests:
 .build_examples_template: &build_examples_template
   <<: *build_template
   artifacts:
+    when: always
     paths:
       - build_examples/*/*/*/build/*.bin
       - build_examples/*/*/*/build/*.elf
       - build_examples/*/*/*/build/*.map
       - build_examples/*/*/*/build/download.config
       - build_examples/*/*/*/build/bootloader/*.bin
+      - $LOG_PATH
     expire_in: 1 week
   variables:
     IDF_CI_BUILD: "1"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples"
   script:
     # it's not possible to build 100% out-of-tree and have the "artifacts"
     # mechanism work, but this is the next best thing
@@ -145,6 +172,7 @@ build_esp_idf_tests:
     - mkdir build_examples
     - cd build_examples
     # build some of examples
+    - mkdir -p ${LOG_PATH}
     - ${IDF_PATH}/tools/ci/build_examples.sh "${CI_JOB_NAME}"
 
 build_examples_00:
@@ -168,6 +196,10 @@ build_examples_05:
 build_examples_06:
   <<: *build_examples_template
 
+build_examples_07:
+  <<: *build_examples_template
+
+
 build_docs:
   stage: build
   image: $CI_DOCKER_REGISTRY/esp32-ci-env
@@ -230,7 +262,7 @@ test_multi_heap_on_host:
     - wl_host_test
   script:
     - cd components/heap/test_multi_heap_host
-    - make test
+    - ./test_all_configs.sh
 
 test_build_system:
   stage: test
@@ -281,6 +313,7 @@ test_report:
     # clone test bench
     - git clone $GITLAB_SSH_SERVER/yinling/auto_test_script.git
     - cd auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script
     # generate report
     - TEST_RESULT=Pass
     - python CITestReport.py -l $LOG_PATH -t $TEST_CASE_FILE_PATH -p $REPORT_PATH -r $RESULT_PATH -a $ARTIFACTS_PATH -m $MODULE_UPDATE_FILE || TEST_RESULT=Fail
@@ -421,7 +454,7 @@ assign_test:
     EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
   artifacts:
     paths:
-      - test_bins
+      - $OUTPUT_BIN_PATH
       - components/idf_test/*/CIConfigs
       - components/idf_test/*/TC.sqlite
       - $EXAMPLE_CONFIG_OUTPUT_PATH
@@ -438,11 +471,11 @@ assign_test:
     # clone test script to assign tests
     - git clone $TEST_SCRIPT_REPOSITORY
     - cd auto_test_script
-    - git checkout ${CI_COMMIT_REF_NAME} || echo "Using default branch..."
+    - python $CHECKOUT_REF_SCRIPT auto_test_script
     # assign unit test cases
     - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/unit_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/test_bins
     # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/test_bins
+    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
 
 .example_test_template: &example_test_template
   stage: test
@@ -483,6 +516,9 @@ assign_test:
   allow_failure: true
   dependencies:
     - assign_test
+    - build_ssc_00
+    - build_ssc_01
+    - build_ssc_02
   artifacts:
     when: always
     paths:
@@ -500,10 +536,12 @@ assign_test:
     - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
     - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - cd ci-test-runner-configs
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
     # clone test bench
     - git clone $TEST_SCRIPT_REPOSITORY
     - cd auto_test_script
-    - git checkout ${CI_COMMIT_REF_NAME} || echo "Using default branch..."
+    - python $CHECKOUT_REF_SCRIPT auto_test_script
     # run test
     - python CIRunner.py -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH -m $MODULE_UPDATE_FILE
 
@@ -533,6 +571,8 @@ nvs_compatible_test:
   script:
     # clone local test env configs
     - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - cd ci-test-runner-configs
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
     # clone test bench
     - git clone $TEST_SCRIPT_REPOSITORY
     - cd auto_test_script
@@ -604,6 +644,13 @@ UT_001_08:
     - UT_T1_1
     - UT_default
 
+UT_001_09:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_default
+
 UT_002_01:
   <<: *unit_test_template
   tags:
@@ -660,6 +707,13 @@ UT_002_08:
     - UT_T1_1
     - UT_release
 
+UT_002_09:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_release
+
 UT_003_01:
   <<: *unit_test_template
   tags:
@@ -716,6 +770,76 @@ UT_003_08:
     - UT_T1_1
     - UT_single_core
 
+UT_003_09:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_single_core
+
+UT_004_01:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
+UT_004_02:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
+UT_004_03:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
+UT_004_04:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
+UT_004_05:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_SDMODE
+    - UT_psram
+
+UT_004_06:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_SPIMODE
+    - UT_psram
+
+UT_004_07:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
+UT_004_08:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
+UT_004_09:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_psram
+
 IT_001_01:
   <<: *test_template
   tags:

.gitmodules

@@ -33,3 +33,7 @@
 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
 	url = https://github.com/pellepl/spiffs.git
+
+[submodule "components/json/cJSON"]
+	path = components/json/cJSON
+	url = https://github.com/DaveGamble/cJSON.git

Kconfig

@@ -93,7 +93,7 @@ config OPTIMIZATION_ASSERTIONS_DISABLED
 
 endchoice # assertions
 
-config CXX_EXCEPTIONS
+menuconfig CXX_EXCEPTIONS
    bool "Enable C++ exceptions"
    default n
    help
@@ -102,8 +102,51 @@ config CXX_EXCEPTIONS
        Disabling this option disables C++ exception support in all compiled files, and any libstdc++ code which throws
        an exception will abort instead.
 
-       Enabling this option currently adds an additional 20KB of heap overhead, and 4KB of additional heap is allocated
-       the first time an exception is thrown in user code.
+       Enabling this option currently adds an additional ~500 bytes of heap overhead
+       when an exception is thrown in user code for the first time.
+
+config CXX_EXCEPTIONS_EMG_POOL_SIZE
+    int "Emergency Pool Size"
+    default 0
+    depends on CXX_EXCEPTIONS
+    help
+       Size (in bytes) of the emergency memory pool for C++ exceptions. This pool will be used to allocate
+       memory for thrown exceptions when there is not enough memory on the heap.
+
+choice STACK_CHECK_MODE
+    prompt "Stack smashing protection mode"
+    default STACK_CHECK_NONE
+    help
+        Stack smashing protection mode. Emit extra code to check for buffer overflows, such as stack
+        smashing attacks. This is done by adding a guard variable to functions with vulnerable objects.
+        The guards are initialized when a function is entered and then checked when the function exits.
+        If a guard check fails, program is halted. Protection has the following modes:
+          - In NORMAL mode (GCC flag: -fstack-protector) only functions that call alloca, and functions with buffers larger than
+            8 bytes are protected.
+          - STRONG mode (GCC flag: -fstack-protector-strong) is like NORMAL, but includes additional functions to be protected -- those that
+            have local array definitions, or have references to local frame addresses.
+          - In OVERALL mode (GCC flag: -fstack-protector-all) all functions are protected.
+
+        Modes have the following impact on code performance and coverage:
+          - performance: NORMAL > STRONG > OVERALL
+          - coverage: NORMAL < STRONG < OVERALL
+
+
+config STACK_CHECK_NONE
+    bool "None"
+config STACK_CHECK_NORM
+    bool "Normal"
+config STACK_CHECK_STRONG
+    bool "Strong"
+config STACK_CHECK_ALL
+    bool "Overall"
+endchoice
+
+config STACK_CHECK
+    bool
+    default !STACK_CHECK_NONE
+    help
+        Stack smashing protection.
 
 endmenu # Compiler Options
 

README.md

@@ -96,7 +96,7 @@ The simplest way to use the partition table is to `make menuconfig` and choose o
 
 In both cases the factory app is flashed at offset 0x10000. If you `make partition_table` then it will print a summary of the partition table.
 
-For more details about partition tables and how to create custom variations, view the `docs/partition-tables.rst` file.
+For more details about partition tables and how to create custom variations, view the [`docs/api-guides/partition-tables.rst`](docs/api-guides/partition-tables.rst) file.
 
 ## Erasing Flash
 

components/app_trace/Kconfig

@@ -64,33 +64,37 @@ config SYSVIEW_ENABLE
         Enables supporrt for SEGGER SystemView tracing functionality.
 
 choice SYSVIEW_TS_SOURCE
-    prompt "ESP32 timer to use as SystemView timestamp source"
+    prompt "Timer to use as timestamp source"
     depends on SYSVIEW_ENABLE
-    default SYSVIEW_TS_SOURCE_TIMER_00
+    default SYSVIEW_TS_SOURCE_CCOUNT if FREERTOS_UNICORE && !PM_ENABLE
+    default SYSVIEW_TS_SOURCE_TIMER_00 if !FREERTOS_UNICORE && !PM_ENABLE
+    default SYSVIEW_TS_SOURCE_ESP_TIMER if PM_ENABLE
     help
         SystemView needs to use a hardware timer as the source of timestamps
-        when tracing 
-        This option selects HW timer for it.
+        when tracing. This option selects the timer for it.
+
+config SYSVIEW_TS_SOURCE_CCOUNT
+	bool "CPU cycle counter (CCOUNT)"
+	depends on FREERTOS_UNICORE && !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_00
     bool "Timer 0, Group 0"
-    help
-        Select this to use timer 0 of group 0
+    depends on !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_01
     bool "Timer 1, Group 0"
-    help
-        Select this to use timer 1 of group 0
+    depends on !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_10
     bool "Timer 0, Group 1"
-    help
-        Select this to use timer 0 of group 1
+    depends on !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_11
     bool "Timer 1, Group 1"
-    help
-        Select this to use timer 1 of group 1
+    depends on !PM_ENABLE
+
+config SYSVIEW_TS_SOURCE_ESP_TIMER
+	bool "esp_timer high resolution timer"
 
 endchoice
 

components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c

@@ -64,9 +64,6 @@ Revision: $Rev: 3734 $
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
 #include "rom/ets_sys.h"
-#if CONFIG_FREERTOS_UNICORE == 0
-#include "driver/timer.h"
-#endif
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
 #include "esp_intr_alloc.h"
@@ -86,10 +83,49 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // The target device name
 #define SYSVIEW_DEVICE_NAME     "ESP32"
 
+// Determine which timer to use as timestamp source
+#if CONFIG_SYSVIEW_TS_SOURCE_CCOUNT
+#define TS_USE_CCOUNT 1
+#elif CONFIG_SYSVIEW_TS_SOURCE_ESP_TIMER
+#define TS_USE_ESP_TIMER 1
+#else
+#define TS_USE_TIMERGROUP 1
+#endif
+
+#if TS_USE_TIMERGROUP
+#include "driver/timer.h"
+
 // Timer group timer divisor
 #define SYSVIEW_TIMER_DIV       2
+
 // Frequency of the timestamp.
 #define SYSVIEW_TIMESTAMP_FREQ  (esp_clk_apb_freq() / SYSVIEW_TIMER_DIV)
+
+// Timer ID and group ID
+#if defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_00) || defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_01)
+#define TS_TIMER_ID 0
+#else
+#define TS_TIMER_ID 1
+#endif // TIMER_00 || TIMER_01
+
+#if defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_00) || defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_10)
+#define TS_TIMER_GROUP 0
+#else
+#define TS_TIMER_GROUP 1
+#endif // TIMER_00 || TIMER_10
+
+#endif // TS_USE_TIMERGROUP
+
+#if TS_USE_ESP_TIMER
+// esp_timer provides 1us resolution
+#define SYSVIEW_TIMESTAMP_FREQ  (1000000)
+#endif // TS_USE_ESP_TIMER
+
+#if TS_USE_CCOUNT
+// CCOUNT is incremented at CPU frequency
+#define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
+#endif // TS_USE_CCOUNT
+
 // System Frequency.
 #define SYSVIEW_CPU_FREQ        (esp_clk_cpu_freq())
 
@@ -103,11 +139,8 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
     #define SYSTICK_INTR_ID (ETS_INTERNAL_TIMER1_INTR_SOURCE+ETS_INTERNAL_INTR_SOURCE_OFF)
 #endif
 
-static timer_idx_t s_ts_timer_idx;
-static timer_group_t s_ts_timer_group;
-
 // SystemView is single core specific: it implies that SEGGER_SYSVIEW_LOCK()
-// disables IRQs (disables rescheduling globaly). So we can not use finite timeouts for locks and return error
+// disables IRQs (disables rescheduling globally). So we can not use finite timeouts for locks and return error
 // in case of expiration, because error will not be handled and SEGGER's code will go further implying that
 // everything is fine, so for multi-core env we have to wait on underlying lock forever
 #define SEGGER_LOCK_WAIT_TMO  ESP_APPTRACE_TMO_INFINITE
@@ -213,35 +246,24 @@ static void _cbSendSystemDesc(void) {
 */
 static void SEGGER_SYSVIEW_TS_Init()
 {
-    timer_config_t config;
-
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_00
-    s_ts_timer_group = TIMER_GROUP_0;
-    s_ts_timer_idx = TIMER_0;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_01
-    s_ts_timer_group = TIMER_GROUP_0;
-    s_ts_timer_idx = TIMER_1;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_10
-    s_ts_timer_group = TIMER_GROUP_1;
-    s_ts_timer_idx = TIMER_0;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_11
-    s_ts_timer_group = TIMER_GROUP_1;
-    s_ts_timer_idx = TIMER_1;
-#endif
-    config.alarm_en = 0;
-    config.auto_reload = 0;
-    config.counter_dir = TIMER_COUNT_UP;
-    config.divider = SYSVIEW_TIMER_DIV;
-    config.counter_en = 0;
-    /*Configure timer*/
-    timer_init(s_ts_timer_group, s_ts_timer_idx, &config);
-    /*Load counter value */
-    timer_set_counter_value(s_ts_timer_group, s_ts_timer_idx, 0x00000000ULL);
-    /*Enable timer interrupt*/
-    timer_start(s_ts_timer_group, s_ts_timer_idx);
+    /* We only need to initialize something if we use Timer Group.
+     * esp_timer and ccount can be used as is.
+     */
+#if TS_USE_TIMERGROUP
+    timer_config_t config = {
+        .alarm_en = 0,
+        .auto_reload = 0,
+        .counter_dir = TIMER_COUNT_UP,
+        .divider = SYSVIEW_TIMER_DIV,
+        .counter_en = 0
+    };
+    /* Configure timer */
+    timer_init(TS_TIMER_GROUP, TS_TIMER_ID, &config);
+    /* Load counter value */
+    timer_set_counter_value(TS_TIMER_GROUP, TS_TIMER_ID, 0x00000000ULL);
+    /* Start counting */
+    timer_start(TS_TIMER_GROUP, TS_TIMER_ID);
+#endif // TS_USE_TIMERGROUP
 }
 
 void SEGGER_SYSVIEW_Conf(void) {
@@ -296,12 +318,14 @@ void SEGGER_SYSVIEW_Conf(void) {
 
 U32 SEGGER_SYSVIEW_X_GetTimestamp()
 {
-#if CONFIG_FREERTOS_UNICORE == 0
+#if TS_USE_TIMERGROUP
     uint64_t ts = 0;
-    timer_get_counter_value(s_ts_timer_group, s_ts_timer_idx, &ts);
-    return (U32)ts; // return lower part of counter value
-#else
+    timer_get_counter_value(TS_TIMER_GROUP, TS_TIMER_ID, &ts);
+    return (U32) ts; // return lower part of counter value
+#elif TS_USE_CCOUNT
     return portGET_RUN_TIME_COUNTER_VALUE();
+#elif TS_USE_ESP_TIMER
+    return (U32) esp_timer_get_time(); // return lower part of counter value
 #endif
 }
 

components/bootloader/Kconfig.projbuild

@@ -43,15 +43,24 @@ config BOOTLOADER_SPI_WP_PIN
 
         The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
 
-config BOOTLOADER_VDDSDIO_BOOST
-    bool "Increase VDDSDIO LDO voltage to 1.9V"
-    default y
+choice BOOTLOADER_VDDSDIO_BOOST
+    bool "VDDSDIO LDO voltage"
+    default BOOTLOADER_VDDSDIO_BOOST_1_9V
     help
         If this option is enabled, and VDDSDIO LDO is set to 1.8V (using EFUSE
         or MTDI bootstrapping pin), bootloader will change LDO settings to
         output 1.9V instead. This helps prevent flash chip from browning out
         during flash programming operations.
-        For 3.3V flash, this option has no effect.
+
+        This option has no effect if VDDSDIO is set to 3.3V, or if the internal
+        VDDSDIO regulator is disabled via efuse.
+
+config BOOTLOADER_VDDSDIO_BOOST_1_8V
+    bool "1.8V"
+    depends on !ESPTOOLPY_FLASHFREQ_80M
+config BOOTLOADER_VDDSDIO_BOOST_1_9V
+    bool "1.9V"
+endchoice
 
 endmenu  # Bootloader
 

components/bootloader/Makefile.projbuild

@@ -121,4 +121,6 @@ endif
 
 bootloader-clean: $(SDKCONFIG_MAKEFILE)
 	$(BOOTLOADER_MAKE) app-clean
+ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 	rm -f $(SECURE_BOOTLOADER_KEY) $(BOOTLOADER_DIGEST_BIN)
+endif

components/bootloader/subproject/Makefile

@@ -10,6 +10,10 @@ PROJECT_NAME := bootloader
 
 COMPONENTS := esptool_py bootloader_support log spi_flash micro-ecc soc main
 
+# Clear C and CXX from top level project
+CFLAGS =
+CXXFLAGS =
+
 #We cannot include the esp32 component directly but we need its includes.
 CFLAGS += -I $(IDF_PATH)/components/esp32/include
 

components/bootloader/subproject/main/bootloader_start.c

@@ -48,6 +48,7 @@
 #include "bootloader_flash.h"
 #include "bootloader_random.h"
 #include "bootloader_config.h"
+#include "bootloader_clock.h"
 
 #include "flash_qio_mode.h"
 
@@ -75,7 +76,6 @@ static void set_cache_and_start_app(uint32_t drom_addr,
 static void update_flash_config(const esp_image_header_t* pfhdr);
 static void vddsdio_configure();
 static void flash_gpio_configure();
-static void clock_configure(void);
 static void uart_console_configure(void);
 static void wdt_reset_check(void);
 
@@ -447,7 +447,7 @@ void bootloader_main()
 {
     vddsdio_configure();
     flash_gpio_configure();
-    clock_configure();
+    bootloader_clock_configure();
     uart_console_configure();
     wdt_reset_check();
     ESP_LOGI(TAG, "ESP-IDF %s 2nd stage bootloader", IDF_VER);
@@ -743,14 +743,13 @@ static void print_flash_info(const esp_image_header_t* phdr)
 
 static void vddsdio_configure()
 {
-#if CONFIG_BOOTLOADER_VDDSDIO_BOOST
+#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
     rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
-    if (cfg.tieh == 0) {    // 1.8V is used
+    if (cfg.enable == 1 && cfg.tieh == 0) {    // VDDSDIO regulator is enabled @ 1.8V
         cfg.drefh = 3;
         cfg.drefm = 3;
         cfg.drefl = 3;
         cfg.force = 1;
-        cfg.enable = 1;
         rtc_vddsdio_set_config(cfg);
         ets_delay_us(10); // wait for regulator to become stable
     }
@@ -797,24 +796,20 @@ static void IRAM_ATTR flash_gpio_configure()
 
     if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
         // For ESP32D2WD the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32D2WD");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
     } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
         // For ESP32PICOD2 the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32PICOD2");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
     } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
         // For ESP32PICOD4 the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32PICOD4");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
     } else {
-        ESP_LOGI(TAG, "Detected ESP32");
         const uint32_t spiconfig = ets_efuse_get_spiconfig();
         if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
             gpio_matrix_out(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
@@ -840,39 +835,6 @@ static void IRAM_ATTR flash_gpio_configure()
     }
 }
 
-static void clock_configure(void)
-{
-    /* Set CPU to 80MHz. Keep other clocks unmodified. */
-    rtc_cpu_freq_t cpu_freq = RTC_CPU_FREQ_80M;
-
-    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
-     * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
-     * document). For rev. 0, switch to 240 instead if it was chosen in
-     * menuconfig.
-     */
-    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
-    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
-            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
-        cpu_freq = RTC_CPU_FREQ_240M;
-    }
-
-    rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
-    clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
-    clk_cfg.cpu_freq = cpu_freq;
-    clk_cfg.slow_freq = rtc_clk_slow_freq_get();
-    clk_cfg.fast_freq = rtc_clk_fast_freq_get();
-    rtc_clk_init(clk_cfg);
-    /* As a slight optimization, if 32k XTAL was enabled in sdkconfig, we enable
-     * it here. Usually it needs some time to start up, so we amortize at least
-     * part of the start up time by enabling 32k XTAL early.
-     * App startup code will wait until the oscillator has started up.
-     */
-#ifdef CONFIG_ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
-    if (!rtc_clk_32k_enabled()) {
-        rtc_clk_32k_bootstrap();
-    }
-#endif
-}
 
 static void uart_console_configure(void)
 {
@@ -885,8 +847,7 @@ static void uart_console_configure(void)
     uartAttach();
     ets_install_uart_printf();
 
-    // ROM bootloader may have put a lot of text into UART0 FIFO.
-    // Wait for it to be printed.
+    // Wait for UART FIFO to be empty.
     uart_tx_wait_idle(0);
 
 #if CONFIG_CONSOLE_UART_CUSTOM

components/bootloader_support/include/bootloader_clock.h

@@ -0,0 +1,21 @@
+// Copyright 2017 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+/** @brief Configure clocks for early boot
+ *
+ * Called by bootloader, or by the app if the bootloader version is old (pre v2.1).
+ */
+void bootloader_clock_configure(void);

components/bootloader_support/src/bootloader_clock.c

@@ -0,0 +1,61 @@
+// Copyright 2017 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "rom/uart.h"
+#include "rom/rtc.h"
+#include "soc/soc.h"
+#include "soc/rtc.h"
+#include "soc/dport_reg.h"
+#include "soc/efuse_reg.h"
+#include "soc/rtc_cntl_reg.h"
+
+void bootloader_clock_configure()
+{
+    // ROM bootloader may have put a lot of text into UART0 FIFO.
+    // Wait for it to be printed.
+    // This is not needed on power on reset, when ROM bootloader is running at
+    // 40 MHz. But in case of TG WDT reset, CPU may still be running at >80 MHZ,
+    // and will be done with the bootloader much earlier than UART FIFO is empty.
+    uart_tx_wait_idle(0);
+
+    /* Set CPU to 80MHz. Keep other clocks unmodified. */
+    rtc_cpu_freq_t cpu_freq = RTC_CPU_FREQ_80M;
+
+    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
+     * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
+     * document). For rev. 0, switch to 240 instead if it was chosen in
+     * menuconfig.
+     */
+    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
+    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
+            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
+        cpu_freq = RTC_CPU_FREQ_240M;
+    }
+
+    rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
+    clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
+    clk_cfg.cpu_freq = cpu_freq;
+    clk_cfg.slow_freq = rtc_clk_slow_freq_get();
+    clk_cfg.fast_freq = rtc_clk_fast_freq_get();
+    rtc_clk_init(clk_cfg);
+    /* As a slight optimization, if 32k XTAL was enabled in sdkconfig, we enable
+     * it here. Usually it needs some time to start up, so we amortize at least
+     * part of the start up time by enabling 32k XTAL early.
+     * App startup code will wait until the oscillator has started up.
+     */
+#ifdef CONFIG_ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
+    if (!rtc_clk_32k_enabled()) {
+        rtc_clk_32k_bootstrap();
+    }
+#endif
+}

components/bootloader_support/src/bootloader_flash.c

@@ -23,7 +23,7 @@
  */
 static const char *TAG = "bootloader_mmap";
 
-static spi_flash_mmap_memory_t map;
+static spi_flash_mmap_handle_t map;
 
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
@@ -36,7 +36,8 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
     size += (src_addr - src_page);
     esp_err_t err = spi_flash_mmap(src_page, size, SPI_FLASH_MMAP_DATA, &result, &map);
     if (err != ESP_OK) {
-        result = NULL;
+        ESP_LOGE(TAG, "spi_flash_mmap failed: 0x%x", err);
+        return NULL;
     }
     return (void *)((intptr_t)result + (src_addr - src_page));
 }

components/bootloader_support/src/bootloader_random.c

@@ -25,8 +25,6 @@
 #include "esp_system.h"
 #endif
 
-const char *TAG = "boot_rng";
-
 void bootloader_fill_random(void *buffer, size_t length)
 {
     uint8_t *buffer_bytes = (uint8_t *)buffer;

components/bootloader_support/src/esp_image_format.c

@@ -19,6 +19,7 @@
 #include <esp_image_format.h>
 #include <esp_secure_boot.h>
 #include <esp_log.h>
+#include <esp_spi_flash.h>
 #include <bootloader_flash.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
@@ -33,6 +34,9 @@ static const char *TAG = "esp_image";
 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
 #define STACK_LOAD_HEADROOM 32768
 
+/* Mmap source address mask */
+#define MMAP_ALIGNED_MASK 0x0000FFFF
+
 #ifdef BOOTLOADER_BUILD
 /* 64 bits of random data to obfuscate loaded RAM with, until verification is complete
    (Means loaded code isn't executable until after the secure boot check.)
@@ -48,6 +52,9 @@ static bool should_map(uint32_t load_addr);
 /* Load or verify a segment */
 static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
 
+/* split segment and verify if data_len is too long */
+static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+
 /* Verify the main image header */
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);
 
@@ -291,7 +298,36 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
             }
         }
     }
+#ifndef BOOTLOADER_BUILD
+    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
+    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
+    uint32_t offset_page = 0;
+    while (data_len >= free_page_count * SPI_FLASH_MMU_PAGE_SIZE) {
+        offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0)?1:0;
+        err = process_segment_data(load_addr, data_addr, (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE, do_load, sha_handle, checksum);
+        if (err != ESP_OK) {
+            return err;
+        }
+        data_addr += (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
+        data_len -= (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
+    }
+#endif
+    err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
+    if (err != ESP_OK) {
+        return err;
+    }
+    return ESP_OK;
 
+err:
+    if (err == ESP_OK) {
+        err = ESP_ERR_IMAGE_INVALID;
+    }
+
+    return err;
+}
+
+static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+{
     const uint32_t *data = (const uint32_t *)bootloader_mmap(data_addr, data_len);
     if(!data) {
         ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed",
@@ -332,12 +368,6 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
     bootloader_munmap(data);
 
     return ESP_OK;
-
- err:
-    if (err == ESP_OK) {
-        err = ESP_ERR_IMAGE_INVALID;
-    }
-    return err;
 }
 
 static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)

components/bt/Kconfig

@@ -113,6 +113,13 @@ config CLASSIC_BT_ENABLED
     help
         For now this option needs "SMP_ENABLE" to be set to yes
 
+config A2DP_SINK_TASK_STACK_SIZE
+    int "A2DP sink (audio stream decoding) task stack size"
+    depends on CLASSIC_BT_ENABLED
+    default 2048
+    help
+        This affects the stack size of A2DP sink task which invokes the data callback function.
+
 config GATTS_ENABLE
     bool "Include GATT server module(GATTS)"
     depends on BLUEDROID_ENABLED

components/bt/bluedroid/api/esp_avrc_api.c

@@ -27,7 +27,7 @@ esp_err_t esp_avrc_ct_register_callback(esp_avrc_ct_cb_t callback)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
-        
+
     if (callback == NULL) {
         return ESP_FAIL;
     }
@@ -43,7 +43,7 @@ esp_err_t esp_avrc_ct_init(void)
     }
 
     btc_msg_t msg;
-    
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_AVRC;
     msg.act = BTC_AVRC_CTRL_API_INIT_EVT;
@@ -60,7 +60,7 @@ esp_err_t esp_avrc_ct_deinit(void)
     }
 
     btc_msg_t msg;
-    
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_AVRC;
     msg.act = BTC_AVRC_CTRL_API_DEINIT_EVT;
@@ -70,12 +70,97 @@ esp_err_t esp_avrc_ct_deinit(void)
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
+esp_err_t esp_avrc_ct_send_set_player_value_cmd(uint8_t tl, uint8_t attr_id, uint8_t value_id)
+{
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    if (tl >= 16 || attr_id > ESP_AVRC_PS_MAX_ATTR - 1) {
+        return ESP_FAIL;
+    }
+
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_AVRC;
+    msg.act = BTC_AVRC_CTRL_API_SET_PLAYER_SETTING_EVT;
+
+    btc_avrc_args_t arg;
+    memset(&arg, 0, sizeof(btc_avrc_args_t));
+
+    arg.ps_cmd.tl = tl;
+    arg.ps_cmd.attr_id = attr_id;
+    arg.ps_cmd.value_id = value_id;
+
+    /* Switch to BTC context */
+    bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_avrc_args_t), NULL);
+    return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
+}
+
+
+esp_err_t esp_avrc_ct_send_register_notification_cmd(uint8_t tl, uint8_t event_id, uint32_t event_parameter)
+{
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    if (tl >= 16 || event_id > ESP_AVRC_RN_MAX_EVT - 1) {
+        return ESP_FAIL;
+    }
+
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_AVRC;
+    msg.act = BTC_AVRC_NOTIFY_API_SND_REG_NOTIFY_EVT;
+
+    btc_avrc_args_t arg;
+    memset(&arg, 0, sizeof(btc_avrc_args_t));
+
+    arg.rn_cmd.tl = tl;
+    arg.rn_cmd.event_id = event_id;
+    arg.rn_cmd.event_parameter = event_parameter;
+
+    /* Switch to BTC context */
+    bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_avrc_args_t), NULL);
+    return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
+}
+
+esp_err_t esp_avrc_ct_send_metadata_cmd(uint8_t tl, uint8_t attr_mask)
+{
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    if (tl >= 16) {
+        return ESP_FAIL;
+    }
+
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_AVRC;
+    msg.act = BTC_AVRC_STATUS_API_SND_META_EVT;
+
+    btc_avrc_args_t arg;
+    memset(&arg, 0, sizeof(btc_avrc_args_t));
+
+    arg.md_cmd.tl = tl;
+    arg.md_cmd.attr_mask = attr_mask;
+
+    /* Switch to BTC context */
+    bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_avrc_args_t), NULL);
+    return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
+}
+
 esp_err_t esp_avrc_ct_send_passthrough_cmd(uint8_t tl, uint8_t key_code, uint8_t key_state)
 {
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (tl >= 16 || key_state > ESP_AVRC_PT_CMD_STATE_RELEASED) {
+        return ESP_FAIL;
+    }
+
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_AVRC;
@@ -87,7 +172,7 @@ esp_err_t esp_avrc_ct_send_passthrough_cmd(uint8_t tl, uint8_t key_code, uint8_t
     arg.pt_cmd.tl = tl;
     arg.pt_cmd.key_code = key_code;
     arg.pt_cmd.key_state = key_state;
-    
+
     /* Switch to BTC context */
     bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_avrc_args_t), NULL);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;

components/bt/bluedroid/api/esp_bt_main.c

@@ -16,7 +16,7 @@
 #include "esp_bt_main.h"
 #include "btc_task.h"
 #include "btc_main.h"
-#include "bt.h"
+#include "esp_bt.h"
 #include "future.h"
 #include "allocator.h"
 

components/bt/bluedroid/api/esp_gap_ble_api.c

@@ -240,7 +240,8 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
     if (ESP_BLE_IS_VALID_PARAM(min_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(max_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF)) {
+        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+        ((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) {
 
         msg.sig = BTC_SIG_API_CALL;
         msg.pid = BTC_PID_GAP_BLE;

components/bt/bluedroid/api/esp_gattc_api.c

@@ -67,7 +67,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, bool is_direct)
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
     btc_msg_t msg;
     btc_ble_gattc_args_t arg;
@@ -79,6 +79,7 @@ esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, b
     msg.act = BTC_GATTC_ACT_OPEN;
     arg.open.gattc_if = gattc_if;
     memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    arg.open.remote_addr_type = remote_addr_type;
     arg.open.is_direct = is_direct;
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);

components/bt/bluedroid/api/include/esp_a2dp_api.h

@@ -138,9 +138,10 @@ esp_err_t esp_a2d_register_callback(esp_a2d_cb_t callback);
 
 /**
  * @brief           Register A2DP sink data output function; For now the output is PCM data stream decoded
- *                  from SBC format. This function should be called only after esp_bluedroid_enable() 
- *                  completes successfully
- *                  
+ *                  from SBC format. This function should be called only after esp_bluedroid_enable()
+ *                  completes successfully, used only by A2DP sink. The callback is invoked in the context
+ *                  of A2DP sink task whose stack size is configurable through menuconfig
+ *
  * @param[in]       callback: A2DP data callback function
  *
  * @return

components/bt/bluedroid/api/include/esp_avrc_api.h

@@ -40,7 +40,9 @@ typedef enum {
     ESP_AVRC_PT_CMD_STOP = 0x45,                 /*!< stop */
     ESP_AVRC_PT_CMD_PAUSE = 0x46,                /*!< pause */
     ESP_AVRC_PT_CMD_FORWARD = 0x4B,              /*!< forward */
-    ESP_AVRC_PT_CMD_BACKWARD = 0x4C              /*!< backward */
+    ESP_AVRC_PT_CMD_BACKWARD = 0x4C,             /*!< backward */
+    ESP_AVRC_PT_CMD_REWIND = 0x48,               /*!< rewind */
+    ESP_AVRC_PT_CMD_FAST_FORWARD = 0x49          /*!< fast forward */
 } esp_avrc_pt_cmd_t;
 
 /// AVRC passthrough command state
@@ -53,9 +55,73 @@ typedef enum {
 typedef enum {
     ESP_AVRC_CT_CONNECTION_STATE_EVT = 0,        /*!< connection state changed event */
     ESP_AVRC_CT_PASSTHROUGH_RSP_EVT = 1,         /*!< passthrough response event */
-    ESP_AVRC_CT_MAX_EVT
+    ESP_AVRC_CT_METADATA_RSP_EVT = 2,            /*!< metadata response event */
+    ESP_AVRC_CT_PLAY_STATUS_RSP_EVT = 3,         /*!< play status response event */
+    ESP_AVRC_CT_CHANGE_NOTIFY_EVT = 4,           /*!< notification event */
+    ESP_AVRC_CT_REMOTE_FEATURES_EVT = 5,         /*!< feature of remote device indication event */
 } esp_avrc_ct_cb_event_t;
 
+/// AVRC metadata attribute mask
+typedef enum {
+    ESP_AVRC_MD_ATTR_TITLE = 0x1,                 /*!< title of the playing track */
+    ESP_AVRC_MD_ATTR_ARTIST = 0x2,                /*!< track artist */
+    ESP_AVRC_MD_ATTR_ALBUM = 0x4,                 /*!< album name */
+    ESP_AVRC_MD_ATTR_TRACK_NUM = 0x8,             /*!< track position on the album */
+    ESP_AVRC_MD_ATTR_NUM_TRACKS = 0x10,           /*!< number of tracks on the album */
+    ESP_AVRC_MD_ATTR_GENRE = 0x20,                /*!< track genre */
+    ESP_AVRC_MD_ATTR_PLAYING_TIME = 0x40          /*!< total album playing time in miliseconds */
+} esp_avrc_md_attr_mask_t;
+
+/// AVRC event notification ids
+typedef enum {
+    ESP_AVRC_RN_PLAY_STATUS_CHANGE = 0x01,        /*!< track status change, eg. from playing to paused */
+    ESP_AVRC_RN_TRACK_CHANGE = 0x02,              /*!< new track is loaded */
+    ESP_AVRC_RN_TRACK_REACHED_END = 0x03,         /*!< current track reached end */
+    ESP_AVRC_RN_TRACK_REACHED_START = 0x04,       /*!< current track reached start position */
+    ESP_AVRC_RN_PLAY_POS_CHANGED = 0x05,          /*!< track playing position changed */
+    ESP_AVRC_RN_BATTERY_STATUS_CHANGE = 0x06,     /*!< battery status changed */
+    ESP_AVRC_RN_SYSTEM_STATUS_CHANGE = 0x07,      /*!< system status changed */
+    ESP_AVRC_RN_APP_SETTING_CHANGE = 0x08,        /*!< application settings changed */
+    ESP_AVRC_RN_MAX_EVT
+} esp_avrc_rn_event_ids_t;
+
+/// AVRC player setting ids
+typedef enum {
+    ESP_AVRC_PS_EQUALIZER = 0x01,                 /*!< equalizer, on or off */
+    ESP_AVRC_PS_REPEAT_MODE = 0x02,               /*!< repeat mode */
+    ESP_AVRC_PS_SHUFFLE_MODE = 0x03,              /*!< shuffle mode */
+    ESP_AVRC_PS_SCAN_MODE = 0x04,                 /*!< scan mode on or off */
+    ESP_AVRC_PS_MAX_ATTR
+} esp_avrc_ps_attr_ids_t;
+
+/// AVRC equalizer modes
+typedef enum {
+    ESP_AVRC_PS_EQUALIZER_OFF = 0x1,              /*!< equalizer OFF */
+    ESP_AVRC_PS_EQUALIZER_ON = 0x2                /*!< equalizer ON */
+} esp_avrc_ps_eq_value_ids_t;
+
+/// AVRC repeat modes
+typedef enum {
+    ESP_AVRC_PS_REPEAT_OFF = 0x1,                 /*!< repeat mode off */
+    ESP_AVRC_PS_REPEAT_SINGLE = 0x2,              /*!< single track repeat */
+    ESP_AVRC_PS_REPEAT_GROUP = 0x3                /*!< group repeat */
+} esp_avrc_ps_rpt_value_ids_t;
+
+
+/// AVRC shuffle modes
+typedef enum {
+    ESP_AVRC_PS_SHUFFLE_OFF = 0x1,                /*<! shuffle off */
+    ESP_AVRC_PS_SHUFFLE_ALL = 0x2,                /*<! all trackes shuffle */
+    ESP_AVRC_PS_SHUFFLE_GROUP = 0x3               /*<! group shuffle */
+} esp_avrc_ps_shf_value_ids_t;
+
+/// AVRC scan modes
+typedef enum {
+    ESP_AVRC_PS_SCAN_OFF = 0x1,                   /*!< scan off */
+    ESP_AVRC_PS_SCAN_ALL = 0x2,                   /*!< all tracks scan */
+    ESP_AVRC_PS_SCAN_GROUP = 0x3                  /*!< group scan */
+} esp_avrc_ps_scn_value_ids_t;
+
 /// AVRC controller callback parameters
 typedef union {
     /**
@@ -63,10 +129,9 @@ typedef union {
      */
     struct avrc_ct_conn_stat_param {
         bool connected;                          /*!< whether AVRC connection is set up */
-	uint32_t feat_mask;                      /*!< AVRC feature mask of remote device */
         esp_bd_addr_t remote_bda;                /*!< remote bluetooth device address */
     } conn_stat;                                 /*!< AVRC connection status */
-    
+
     /**
      * @brief ESP_AVRC_CT_PASSTHROUGH_RSP_EVT
      */
@@ -75,6 +140,32 @@ typedef union {
         uint8_t key_code;                        /*!< passthrough command code */
         uint8_t key_state;                       /*!< 0 for PRESSED, 1 for RELEASED */
     } psth_rsp;                                  /*!< passthrough command response */
+
+    /**
+     * @brief ESP_AVRC_CT_METADATA_RSP_EVT
+     */
+    struct avrc_ct_meta_rsp_param {
+        uint8_t attr_id;                         /*!< id of metadata attribute */
+        uint8_t *attr_text;                      /*!< attribute itself */
+        int attr_length;                         /*!< attribute character length */
+    } meta_rsp;                                  /*!< metadata attributes response */
+
+    /**
+     * @brief ESP_AVRC_CT_CHANGE_NOTIFY_EVT
+     */
+    struct avrc_ct_change_notify_param {
+        uint8_t event_id;                        /*!< id of AVRC event notification */
+        uint32_t event_parameter;                /*!< event notification parameter */
+    } change_ntf;                                /*!< notifications */
+
+    /**
+     * @brief ESP_AVRC_CT_REMOTE_FEATURES_EVT
+     */
+    struct avrc_ct_rmt_feats_param {
+        uint32_t feat_mask;                      /*!< AVRC feature mask of remote device */
+        esp_bd_addr_t remote_bda;                /*!< remote bluetooth device address */
+    } rmt_feats;                                 /*!< AVRC features discovered from remote SDP server */
+    
 } esp_avrc_ct_cb_param_t;
 
 
@@ -88,9 +179,9 @@ typedef void (* esp_avrc_ct_cb_t)(esp_avrc_ct_cb_event_t event, esp_avrc_ct_cb_p
 
 /**
  * @brief           Register application callbacks to AVRCP module; for now only AVRCP Controller
- *                  role is supported. This function should be called after esp_bluedroid_enable() 
+ *                  role is supported. This function should be called after esp_bluedroid_enable()
  *                  completes successfully
- *                  
+ *
  * @param[in]       callback: AVRCP controller callback function
  *
  * @return
@@ -107,7 +198,7 @@ esp_err_t esp_avrc_ct_register_callback(esp_avrc_ct_cb_t callback);
  * @brief           Initialize the bluetooth AVRCP controller module, This function should be called
  *                  after esp_bluedroid_enable() completes successfully
  *
- * @return          
+ * @return
  *                  - ESP_OK: success
  *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
  *                  - ESP_FAIL: others
@@ -121,13 +212,57 @@ esp_err_t esp_avrc_ct_init(void);
  * @brief           De-initialize AVRCP controller module. This function should be called after
  *                  after esp_bluedroid_enable() completes successfully
  *
- * @return          
+ * @return
  *                  - ESP_OK: success
  *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
  *                  - ESP_FAIL: others
  */
 esp_err_t esp_avrc_ct_deinit(void);
 
+/**
+ *
+ * @brief           Send player application settings command to AVRCP target. This function should be called
+ *                  after ESP_AVRC_CT_CONNECTION_STATE_EVT is received and AVRCP connection is established.
+ *
+ * @param[in]       tl : transaction label, 0 to 15, consecutive commands should use different values.
+ * @param[in]       attr_id : player application setting attribute IDs from one of esp_avrc_ps_attr_ids_t
+ * @param[in]       value_id : attribute value defined for the specific player application setting attribute
+ * @return
+ *                  - ESP_OK: success
+ *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
+ *                  - ESP_FAIL: others
+ */
+esp_err_t esp_avrc_ct_send_set_player_value_cmd(uint8_t tl, uint8_t attr_id, uint8_t value_id);
+
+/**
+ * @brief           Send register notification command to AVRCP target, This function should be called after
+ *                  ESP_AVRC_CT_CONNECTION_STATE_EVT is received and AVRCP connection is established
+ *
+ * @param[in]       tl : transaction label, 0 to 15, consecutive commands should use different values.
+ * @param[in]       event_id : id of events, e.g. ESP_AVRC_RN_PLAY_STATUS_CHANGE, ESP_AVRC_RN_TRACK_CHANGE, etc.
+ * @param[in]       event_parameter : special parameters, eg. playback interval for ESP_AVRC_RN_PLAY_POS_CHANGED
+ * @return
+ *                  - ESP_OK: success
+ *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
+ *                  - ESP_FAIL: others
+ */
+esp_err_t esp_avrc_ct_send_register_notification_cmd(uint8_t tl, uint8_t event_id, uint32_t event_parameter);
+
+
+/**
+ * @brief           Send metadata command to AVRCP target, This function should be called after
+ *                  ESP_AVRC_CT_CONNECTION_STATE_EVT is received and AVRCP connection is established
+ *
+ * @param[in]       tl : transaction label, 0 to 15, consecutive commands should use different values.
+ * @param[in]       attr_mask : mask of attributes, e.g. ESP_AVRC_MD_ATTR_ID_TITLE | ESP_AVRC_MD_ATTR_ID_ARTIST.
+ *
+ * @return
+ *                  - ESP_OK: success
+ *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
+ *                  - ESP_FAIL: others
+ */
+esp_err_t esp_avrc_ct_send_metadata_cmd(uint8_t tl, uint8_t attr_mask);
+
 
 /**
  * @brief           Send passthrough command to AVRCP target, This function should be called after
@@ -138,7 +273,7 @@ esp_err_t esp_avrc_ct_deinit(void);
  * @param[in]       key_state : passthrough command key state, ESP_AVRC_PT_CMD_STATE_PRESSED or
  *                  ESP_AVRC_PT_CMD_STATE_RELEASED
  *
- * @return          
+ * @return
  *                  - ESP_OK: success
  *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
  *                  - ESP_FAIL: others

components/bt/bluedroid/api/include/esp_bt_defs.h

@@ -51,6 +51,7 @@ typedef enum {
     ESP_BT_STATUS_PEER_LE_DATA_LEN_UNSUPPORTED, /* relate to BTM_PEER_LE_DATA_LEN_UNSUPPORTED in btm_api.h */
     ESP_BT_STATUS_CONTROL_LE_DATA_LEN_UNSUPPORTED,/* relate to BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED in btm_api.h */
     ESP_BT_STATUS_ERR_ILLEGAL_PARAMETER_FMT,    /* relate to HCI_ERR_ILLEGAL_PARAMETER_FMT in hcidefs.h */
+    ESP_BT_STATUS_MEMORY_FULL,                  /* relate to BT_STATUS_MEMORY_FULL in bt_def.h */
 } esp_bt_status_t;
 
 

components/bt/bluedroid/api/include/esp_gap_ble_api.h

@@ -97,9 +97,11 @@ typedef enum {
     ESP_GAP_BLE_CLEAR_BOND_DEV_COMPLETE_EVT,                /*!< When clear the bond device clear complete, the event comes */
     ESP_GAP_BLE_GET_BOND_DEV_COMPLETE_EVT,                  /*!< When get the bond device list complete, the event comes */
     ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT,                     /*!< When read the rssi complete, the event comes */
-    ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT,                 /*!< When add or remove whitelist complete, the event comes */
+    ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT,              /*!< When add or remove whitelist complete, the event comes */
     ESP_GAP_BLE_EVT_MAX,
 } esp_gap_ble_cb_event_t;
+/// This is the old name, just for backwards compatibility
+#define ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT
 
 /// Advertising data maximum length
 #define ESP_BLE_ADV_DATA_LEN_MAX               31
@@ -239,7 +241,7 @@ typedef struct {
     uint8_t                 flag;                   /*!< Advertising flag of discovery mode, see BLE_ADV_DATA_FLAG detail */
 } esp_ble_adv_data_t;
 
-/// Ble scan type 
+/// Ble scan type
 typedef enum {
     BLE_SCAN_TYPE_PASSIVE   =   0x0,            /*!< Passive scan */
     BLE_SCAN_TYPE_ACTIVE    =   0x1,            /*!< Active scan */
@@ -249,7 +251,7 @@ typedef enum {
 typedef enum {
     BLE_SCAN_FILTER_ALLOW_ALL           = 0x0,  /*!< Accept all :
                                                   1. advertisement packets except directed advertising packets not addressed to this device (default). */
-    BLE_SCAN_FILTER_ALLOW_ONLY_WLST     = 0x1,  /*!< Accept only : 
+    BLE_SCAN_FILTER_ALLOW_ONLY_WLST     = 0x1,  /*!< Accept only :
                                                   1. advertisement packets from devices where the advertiser’s address is in the White list.
                                                   2. Directed advertising packets which are not addressed for this device shall be ignored. */
     BLE_SCAN_FILTER_ALLOW_UND_RPA_DIR   = 0x2,  /*!< Accept all :
@@ -312,7 +314,7 @@ typedef struct
 } esp_ble_penc_keys_t;                 /*!< The key type*/
 
 /**
-* @brief  BLE CSRK keys 
+* @brief  BLE CSRK keys
 */
 typedef struct
 {
@@ -322,7 +324,7 @@ typedef struct
 } esp_ble_pcsrk_keys_t;               /*!< The pcsrk key type */
 
 /**
-* @brief  BLE pid keys 
+* @brief  BLE pid keys
 */
 typedef struct
 {
@@ -354,7 +356,7 @@ typedef struct
 } esp_ble_lcsrk_keys;                       /*!< The csrk key type */
 
 /**
-* @brief  Structure associated with ESP_KEY_NOTIF_EVT 
+* @brief  Structure associated with ESP_KEY_NOTIF_EVT
 */
 typedef struct
 {
@@ -476,7 +478,7 @@ typedef enum {
 typedef enum{
     ESP_BLE_WHITELIST_REMOVE     = 0X00,    /*!< remove mac from whitelist */
     ESP_BLE_WHITELIST_ADD        = 0X01,    /*!< add address to whitelist */
-}esp_ble_wl_opration;
+}esp_ble_wl_opration_t;
 /**
  * @brief Gap callback parameters union
  */
@@ -486,7 +488,7 @@ typedef union {
      */
     struct ble_adv_data_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate the set advertising data operation success status */
-    } adv_data_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT */ 
+    } adv_data_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT */
     /**
      * @brief ESP_GAP_BLE_SCAN_RSP_DATA_SET_COMPLETE_EVT
      */
@@ -520,7 +522,7 @@ typedef union {
      */
     struct ble_adv_data_raw_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate the set raw advertising data operation success status */
-    } adv_data_raw_cmpl;                            /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT */ 
+    } adv_data_raw_cmpl;                            /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT */
     /**
      * @brief ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT
      */
@@ -616,12 +618,12 @@ typedef union {
         esp_bd_addr_t remote_addr;                  /*!< The remote device address */
     } read_rssi_cmpl;                               /*!< Event parameter of ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT */
     /**
-     * @brief ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT
+     * @brief ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT
      */
-    struct ble_add_whitelist_cmpl_evt_param {
+    struct ble_update_whitelist_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate the add or remove whitelist operation success status */
-        esp_ble_wl_opration wl_opration;            /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
-    } add_whitelist_cmpl;                           /*!< Event parameter of ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT */
+        esp_ble_wl_opration_t wl_opration;          /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
+    } update_whitelist_cmpl;                        /*!< Event parameter of ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT */
 } esp_ble_gap_cb_param_t;
 
 /**
@@ -983,7 +985,7 @@ int esp_ble_get_bond_device_num(void);
 *                           Suggest that dev_num value equal to esp_ble_get_bond_device_num().
 *
 * @param[out]      dev_list: an array(buffer) of `esp_ble_bond_dev_t` type. Use for storing the bonded devices address.
-*                            The dev_list should be allocated by who call this API. 
+*                            The dev_list should be allocated by who call this API.
 * @return          - ESP_OK : success
 *                  - other  : failed
 *

components/bt/bluedroid/api/include/esp_gattc_api.h

@@ -64,6 +64,7 @@ typedef enum {
     ESP_GATTC_CONNECT_EVT             = 40,       /*!< When the ble physical connection is set up, the event comes */
     ESP_GATTC_DISCONNECT_EVT          = 41,       /*!< When the ble physical connection disconnected, the event comes */
     ESP_GATTC_READ_MUTIPLE_EVT        = 42,       /*!< When the ble characteristic or descriptor mutiple complete, the event comes */
+    ESP_GATTC_QUEUE_FULL_EVT          = 43,       /*!< When the gattc command queue full, the event comes */
 } esp_gattc_cb_event_t;
 
 
@@ -145,6 +146,7 @@ typedef union {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t conn_id;               /*!< Connection id */
         uint16_t handle;                /*!< The Characteristic or descriptor handle */
+        uint16_t offset;                /*!< The prepare write offset, this value is valid only when prepare write */
     } write;                            /*!< Gatt client callback param of ESP_GATTC_WRITE_DESCR_EVT */
 
     /**
@@ -214,6 +216,15 @@ typedef union {
         esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
     } disconnect;                       /*!< Gatt client callback param of ESP_GATTC_DISCONNECT_EVT */
 
+    /**
+     * @brief ESP_GATTC_QUEUE_FULL_EVT
+     */
+    struct gattc_queue_full_evt_param {
+        esp_gatt_status_t status;      /*!< Operation status */
+        uint16_t conn_id;              /*!< Connection id */
+        bool     is_full;              /*!< The gattc command queue is full or not */
+    } queue_full;                      /*!< Gatt client callback param of ESP_GATTC_QUEUE_FULL_EVT */
+
 } esp_ble_gattc_cb_param_t;             /*!< GATT client callback parameter union type */
 
 /**
@@ -272,6 +283,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if);
  *
  * @param[in]       gattc_if: Gatt client access interface.
  * @param[in]       remote_bda: remote device bluetooth device address.
+ * @param[in]       remote_addr_type: remote device bluetooth device the address type.
  * @param[in]       is_direct: direct connection or background auto connection
  *
  * @return
@@ -279,7 +291,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if);
  *                  - other: failed
  *
  */
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, bool is_direct);
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct);
 
 
 /**

components/bt/bluedroid/api/include/esp_gatts_api.h

@@ -162,7 +162,7 @@ typedef union {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Descriptor attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t char_uuid;        /*!< Characteristic uuid */
+        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor uuid */
     } add_char_descr;                   /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_DESCR_EVT */
 
     /**

components/bt/bluedroid/bta/av/bta_av_aact.c

@@ -514,6 +514,9 @@ static void bta_av_proc_stream_evt(UINT8 handle, BD_ADDR bd_addr, UINT8 event, t
             p_msg->disc_rsn = p_data->hdr.err_param;
             break;
             */
+            case AVDT_DISCONNECT_IND_EVT:
+                p_msg->hdr.offset = p_data->hdr.err_param;
+                break;
             default:
                 break;
             }

components/bt/bluedroid/bta/av/bta_av_act.c

@@ -529,6 +529,7 @@ void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
 
     bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
     rc_open.peer_features = p_cb->rcb[i].peer_features;
+    rc_open.sdp_disc_done = TRUE;
     rc_open.status = BTA_AV_SUCCESS;
     APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
                      rc_open.peer_features);
@@ -536,6 +537,7 @@ void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
         /* we have not done SDP on peer RC capabilities.
          * peer must have initiated the RC connection */
         rc_open.peer_features = BTA_AV_FEAT_RCCT;
+        rc_open.sdp_disc_done = FALSE;
         bta_av_rc_disc(disc);
     }
     (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
@@ -1266,6 +1268,11 @@ void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
         hdr.layer_specific = xx + 1;
         bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
     }
+
+    bta_sys_free_timer(&p_cb->sig_tmr);
+    memset(&p_cb->sig_tmr, 0, sizeof(TIMER_LIST_ENT));
+    bta_sys_free_timer(&p_cb->acp_sig_tmr);
+    memset(&p_cb->acp_sig_tmr, 0, sizeof(TIMER_LIST_ENT));
 }
 
 /*******************************************************************************
@@ -1610,6 +1617,7 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
                 p_scb->use_rc = FALSE;
                 bdcpy(rc_open.peer_addr, p_scb->peer_addr);
                 rc_open.peer_features = 0;
+                rc_open.sdp_disc_done = FALSE;
                 rc_open.status = BTA_AV_FAIL_SDP;
                 (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
             }
@@ -1839,6 +1847,8 @@ void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
 
         /* make sure that the timer is not active */
         bta_sys_stop_timer(&p_scb->timer);
+        list_free(p_scb->a2d_list);
+        p_scb->a2d_list = NULL;
         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
     }
 

components/bt/bluedroid/bta/av/bta_av_main.c

@@ -1237,9 +1237,10 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
         bta_av_sm_execute(&bta_av_cb, p_msg->event, (tBTA_AV_DATA *) p_msg);
     } else {
         APPL_TRACE_VERBOSE("handle=0x%x\n", p_msg->layer_specific);
+        tBTA_AV_SCB *p_scb = bta_av_hndl_to_scb(p_msg->layer_specific);
+        p_scb->disc_rsn = p_msg->offset;
         /* stream state machine events */
-        bta_av_ssm_execute( bta_av_hndl_to_scb(p_msg->layer_specific),
-                            p_msg->event, (tBTA_AV_DATA *) p_msg);
+        bta_av_ssm_execute(p_scb, p_msg->event, (tBTA_AV_DATA *) p_msg);
     }
     return TRUE;
 }

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -282,6 +282,47 @@ void bta_dm_enable(tBTA_DM_MSG *p_data)
     }
 }
 
+/*******************************************************************************
+ *
+ * Function         bta_dm_init_cb
+ *
+ * Description      Initializes the bta_dm_cb control block
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_init_cb(void)
+{
+    memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+}
+
+/*******************************************************************************
+ *
+ * Function         bta_dm_deinit_cb
+ *
+ * Description      De-initializes the bta_dm_cb control block
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_deinit_cb(void)
+{
+    bta_sys_free_timer(&bta_dm_cb.disable_timer);
+#if ( BTA_EIR_CANNED_UUID_LIST != TRUE )
+    bta_sys_free_timer(&bta_dm_cb.app_ready_timer);
+#endif
+#if BTM_SSR_INCLUDED == TRUE
+    for (size_t i = 0; i < BTA_DM_NUM_PM_TIMER; i++) {
+        for (size_t j = 0; j < BTA_DM_PM_MODE_TIMER_MAX; j++) {
+            bta_sys_free_timer(&bta_dm_cb.pm_timer[i].timer[j]);
+        }
+    }
+#endif
+    memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_sys_hw_cback
@@ -318,7 +359,15 @@ static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
         }
 
         /* reinitialize the control block */
-        memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+        bta_dm_deinit_cb();
+
+        bta_sys_free_timer(&bta_dm_search_cb.search_timer);
+#if ((defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
+#if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE)
+        bta_sys_free_timer(&bta_dm_search_cb.gatt_close_timer);
+#endif
+#endif
+        memset(&bta_dm_search_cb, 0x00, sizeof(bta_dm_search_cb));
 
         /* unregister from SYS */
         bta_sys_hw_unregister( BTA_SYS_HW_BLUETOOTH );
@@ -332,11 +381,18 @@ static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
         /* save security callback */
         temp_cback = bta_dm_cb.p_sec_cback;
         /* make sure the control block is properly initialized */
-        memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+        bta_dm_init_cb();
+
         /* and retrieve the callback */
         bta_dm_cb.p_sec_cback = temp_cback;
         bta_dm_cb.is_bta_dm_active = TRUE;
 
+        bta_sys_free_timer(&bta_dm_search_cb.search_timer);
+#if ((defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
+#if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE)
+        bta_sys_free_timer(&bta_dm_search_cb.gatt_close_timer);
+#endif
+#endif
         /* hw is ready, go on with BTA DM initialization */
         memset(&bta_dm_search_cb, 0x00, sizeof(bta_dm_search_cb));
 #if (BTM_SSR_INCLUDED == TRUE)
@@ -2595,7 +2651,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
         return BTM_NOT_AUTHORIZED;
     }
 }
- 
+
 
 
 
@@ -3284,7 +3340,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         }
 
         bdcpy(conn.link_down.bd_addr, p_bda);
-        conn.link_down.status = (UINT8) btm_get_acl_disc_reason_code();
+        conn.link_down.reason = (UINT8) btm_get_acl_disc_reason_code();
         if ( bta_dm_cb.p_sec_cback ) {
             bta_dm_cb.p_sec_cback(BTA_DM_LINK_DOWN_EVT, &conn);
             if ( issue_unpair_cb ) {
@@ -4101,6 +4157,8 @@ void bta_dm_set_encryption (tBTA_DM_MSG *p_data)
                 == BTM_CMD_STARTED) {
             bta_dm_cb.device_list.peer_device[i].p_encrypt_cback = p_data->set_encryption.p_callback;
         }
+    }else{
+        APPL_TRACE_ERROR("%s, not find peer_bdaddr or peer_bdaddr connection state error", __func__);
     }
 }
 #endif  ///SMP_INCLUDED == TRUE
@@ -4130,6 +4188,8 @@ static void bta_dm_observe_results_cb (tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir)
     result.inq_res.flag             = p_inq->flag;
     result.inq_res.adv_data_len     = p_inq->adv_data_len;
     result.inq_res.scan_rsp_len     = p_inq->scan_rsp_len;
+    memcpy(result.inq_res.dev_class, p_inq->dev_class, sizeof(DEV_CLASS));
+    result.inq_res.ble_evt_type     = p_inq->ble_evt_type;
 
     /* application will parse EIR to find out remote device name */
     result.inq_res.p_eir = p_eir;
@@ -4286,7 +4346,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         } else {
             sec_event.auth_cmpl.success = TRUE;
             if (!p_data->complt.smp_over_br) {
-                
+
             }
         }
 
@@ -4571,14 +4631,18 @@ void bta_dm_ble_disconnect (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data)
 {
-    BOOLEAN set_flag = false;
+    tBTM_STATUS status = BTM_SET_STATIC_RAND_ADDR_FAIL;
     if (p_data->set_addr.addr_type != BLE_ADDR_RANDOM) {
         APPL_TRACE_ERROR("Invalid random adress type = %d\n", p_data->set_addr.addr_type);
+        if(p_data->set_addr.p_set_rand_addr_cback) {
+            (*p_data->set_addr.p_set_rand_addr_cback)(status);
+        }
         return;
     }
     //send the setting random address to BTM layer
-    if ((set_flag = BTM_BleSetRandAddress(p_data->set_addr.address) != TRUE)){
-        APPL_TRACE_ERROR("%s,set random address fail.", __func__);
+    status = BTM_BleSetRandAddress(p_data->set_addr.address);
+    if(p_data->set_addr.p_set_rand_addr_cback) {
+        (*p_data->set_addr.p_set_rand_addr_cback)(status);
     }
 
 }
@@ -4729,20 +4793,17 @@ void bta_dm_ble_set_adv_params (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_adv_params_all  (tBTA_DM_MSG *p_data)
 {
-    tBTA_STATUS status = BTA_FAILURE;
-
     if (BTM_BleSetAdvParamsStartAdv(p_data->ble_set_adv_params_all.adv_int_min,
                                 p_data->ble_set_adv_params_all.adv_int_max,
                                 p_data->ble_set_adv_params_all.adv_type,
                                 p_data->ble_set_adv_params_all.addr_type_own,
                                 p_data->ble_set_adv_params_all.p_dir_bda,
                                 p_data->ble_set_adv_params_all.channel_map,
-                                p_data->ble_set_adv_params_all.adv_filter_policy) == BTM_SUCCESS) {
-        status = BTA_SUCCESS;
-    }
-
-    if (p_data->ble_set_adv_params_all.p_start_adv_cback) {
-        (*p_data->ble_set_adv_params_all.p_start_adv_cback)(status);
+                                p_data->ble_set_adv_params_all.adv_filter_policy,
+                                p_data->ble_set_adv_params_all.p_start_adv_cback) == BTM_SUCCESS) {
+        APPL_TRACE_DEBUG("%s(), success to start ble adv.", __func__);
+    } else {
+        APPL_TRACE_ERROR("%s(), fail to start ble adv.", __func__);
     }
 }
 
@@ -4851,25 +4912,26 @@ void bta_dm_ble_set_scan_rsp_raw (tBTA_DM_MSG *p_data)
 void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data)
 {
     tACL_CONN *p_acl_cb = btm_bda_to_acl(p_data->ble_set_data_length.remote_bda, BT_TRANSPORT_LE);
-     if (p_acl_cb == NULL) {
-         APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__);
-         return;
-     } else {
-         p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback;
-     }
-     UINT8 status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda,
-                                         p_data->ble_set_data_length.tx_data_length);
-     if (status != BTM_SUCCESS) {
-        APPL_TRACE_ERROR("%s failed\n", __FUNCTION__);
-        if (p_data->ble_set_data_length.p_set_pkt_data_cback) {
-            if (p_acl_cb->data_length_params.tx_len == 0){
-                uint16_t length = controller_get_interface()->get_acl_data_size_ble();
-                p_acl_cb->data_length_params.rx_len = length;
-                p_acl_cb->data_length_params.tx_len = length;
-            }
-            (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params);
-        }
+    if (p_acl_cb == NULL) {
+        APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__);
+        return;
+    } else {
+        p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback;
     }
+    UINT8 status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda,
+                                        p_data->ble_set_data_length.tx_data_length);
+    if (status != BTM_SUCCESS) {
+        APPL_TRACE_ERROR("%s failed\n", __FUNCTION__);
+    }
+    if (p_data->ble_set_data_length.p_set_pkt_data_cback) {
+        if (p_acl_cb->data_length_params.tx_len == 0){
+            uint16_t length = controller_get_interface()->get_acl_data_size_ble();
+            p_acl_cb->data_length_params.rx_len = length;
+            p_acl_cb->data_length_params.tx_len = length;
+        }
+        (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params);
+    }
+
 }
 
 /*******************************************************************************
@@ -4886,15 +4948,13 @@ void bta_dm_ble_broadcast (tBTA_DM_MSG *p_data)
     tBTM_STATUS status = 0;
     BOOLEAN start = p_data->ble_observe.start;
 
-    status = BTM_BleBroadcast(start);
+    status = BTM_BleBroadcast(start, p_data->ble_observe.p_stop_adv_cback);
 
     if (p_data->ble_observe.p_stop_adv_cback){
         if (status != BTM_SUCCESS){
             APPL_TRACE_WARNING("%s, %s, status=0x%x\n", __func__,\
                     (start == TRUE) ? "start adv failed" : "stop adv failed", status);
         }
-        status = (status == BTM_SUCCESS ? BTA_SUCCESS : BTA_FAILURE);
-        p_data->ble_observe.p_stop_adv_cback(status);
     }
 
 }
@@ -5347,7 +5407,7 @@ static void bta_ble_energy_info_cmpl(tBTM_BLE_TX_TIME_MS tx_time,
     if (BTA_SUCCESS == st) {
         ctrl_state = bta_dm_pm_obtain_controller_state();
     }
-#endif  
+#endif
     if (bta_dm_cb.p_energy_info_cback) {
         bta_dm_cb.p_energy_info_cback(tx_time, rx_time, idle_time, energy_used, ctrl_state, st);
     }
@@ -5581,7 +5641,8 @@ void btm_dm_start_gatt_discovery (BD_ADDR bd_addr)
         bta_sys_stop_timer(&bta_dm_search_cb.gatt_close_timer);
         btm_dm_start_disc_gatt_services(bta_dm_search_cb.conn_id);
     } else {
-        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, TRUE, BTA_GATT_TRANSPORT_LE);
+        //TODO need to add addr_type in future
+        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE);
     }
 }
 #endif /* #if (GATTC_INCLUDED == TRUE) */

components/bt/bluedroid/bta/dm/bta_dm_api.c

@@ -2284,12 +2284,12 @@ extern void BTA_DmBleStopAdvertising(void)
 ** Description      This function set the random address for the APP
 **
 ** Parameters       rand_addr: the random address whith should be setting
-**
+**                  p_set_rand_addr_cback: complete callback
 ** Returns          void
 **
 **
 *******************************************************************************/
-extern void BTA_DmSetRandAddress(BD_ADDR rand_addr)
+extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback)
 {
     tBTA_DM_APT_SET_DEV_ADDR *p_msg;
     APPL_TRACE_API("set the random address ");
@@ -2298,6 +2298,7 @@ extern void BTA_DmSetRandAddress(BD_ADDR rand_addr)
         memcpy(p_msg->address, rand_addr, BD_ADDR_LEN);
         p_msg->hdr.event = BTA_DM_API_SET_RAND_ADDR_EVT;
         p_msg->addr_type = BLE_ADDR_RANDOM;
+        p_msg->p_set_rand_addr_cback = p_set_rand_addr_cback;
         //start sent the msg to the bta system control moudle
         bta_sys_sendmsg(p_msg);
     }

components/bt/bluedroid/bta/dm/bta_dm_int.h

@@ -532,6 +532,7 @@ typedef struct {
     BT_HDR      hdr;
     tBLE_ADDR_TYPE addr_type;
     BD_ADDR address;
+    tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback;
 } tBTA_DM_APT_SET_DEV_ADDR;
 
 /* set adv parameter for BLE advertising */

components/bt/bluedroid/bta/gatt/bta_gattc_act.c

@@ -34,6 +34,7 @@
 #include "l2c_int.h"
 #include "gatt_int.h"
 #include "allocator.h"
+#include "mutex.h"
 
 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
 #include "bta_hh_int.h"
@@ -59,6 +60,7 @@ static void  bta_gattc_cmpl_cback(UINT16 conn_id, tGATTC_OPTYPE op, tGATT_STATUS
 static void bta_gattc_cmpl_sendmsg(UINT16 conn_id, tGATTC_OPTYPE op,
                                    tBTA_GATT_STATUS status,
                                    tGATT_CL_COMPLETE *p_data);
+static void bta_gattc_pop_command_to_send(tBTA_GATTC_CLCB *p_clcb);
 
 static void bta_gattc_deregister_cmpl(tBTA_GATTC_RCB *p_clreg);
 static void bta_gattc_enc_cmpl_cback(tGATT_IF gattc_if, BD_ADDR bda);
@@ -124,8 +126,10 @@ static void bta_gattc_enable(tBTA_GATTC_CB *p_cb)
         /* initialize control block */
         memset(&bta_gattc_cb, 0, sizeof(tBTA_GATTC_CB));
         p_cb->state = BTA_GATTC_STATE_ENABLED;
+        // Create a write ccc mutex when the gatt client enable
+        osi_mutex_new(&bta_gattc_cb.write_ccc_mutex);
     } else {
-        APPL_TRACE_DEBUG("GATTC is arelady enabled");
+        APPL_TRACE_DEBUG("GATTC is already enabled");
     }
 }
 
@@ -150,6 +154,8 @@ void bta_gattc_disable(tBTA_GATTC_CB *p_cb)
         APPL_TRACE_ERROR("not enabled or disable in pogress");
         return;
     }
+    // Free the write ccc mutex when the gatt client disable
+    osi_mutex_free(&bta_gattc_cb.write_ccc_mutex);
 
     for (i = 0; i < BTA_GATTC_CL_MAX; i ++) {
         if (p_cb->cl_rcb[i].in_use) {
@@ -487,9 +493,14 @@ void bta_gattc_open_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
     tBTA_GATTC_DATA gattc_data;
+    BOOLEAN found_app = FALSE;
 
+    tGATT_TCB *p_tcb = gatt_find_tcb_by_addr(p_data->api_conn.remote_bda, BT_TRANSPORT_LE);
+    if(p_tcb && p_clcb && p_data) {
+        found_app = gatt_find_specific_app_in_hold_link(p_tcb, p_clcb->p_rcb->client_if);
+    }
     /* open/hold a connection */
-    if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
+    if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda, p_data->api_conn.remote_addr_type,
                       TRUE, p_data->api_conn.transport)) {
         APPL_TRACE_ERROR("Connection open failure");
 
@@ -501,7 +512,7 @@ void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
                                       &p_clcb->bta_conn_id,
                                       p_data->api_conn.transport)) {
             gattc_data.int_conn.hdr.layer_specific = p_clcb->bta_conn_id;
-
+            gattc_data.int_conn.already_connect = found_app;
             bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, &gattc_data);
         }
         /* else wait for the callback event */
@@ -525,7 +536,7 @@ void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *p_clreg
 
     if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, TRUE, FALSE)) {
         /* always call open to hold a connection */
-        if (!GATT_Connect(p_data->client_if, p_data->remote_bda, FALSE, p_data->transport)) {
+        if (!GATT_Connect(p_data->client_if, p_data->remote_bda, p_data->remote_addr_type, FALSE, p_data->transport)) {
             uint8_t *bda = (uint8_t *)p_data->remote_bda;
             status = BTA_GATT_ERROR;
             APPL_TRACE_ERROR("%s unable to connect to remote bd_addr:%02x:%02x:%02x:%02x:%02x:%02x",
@@ -666,14 +677,14 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             if (bta_gattc_cache_load(p_clcb)) {
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
                 bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
-        } else { /* cache is building */
+            } else { /* cache is building */
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
                 /* cache load failure, start discovery */
                 bta_gattc_start_discover(p_clcb, NULL);
+            }
+        } else { /* cache is building */
+            p_clcb->state = BTA_GATTC_DISCOVER_ST;
         }
-    } else { /* cache is building */
-        p_clcb->state = BTA_GATTC_DISCOVER_ST;
-    }
     } else {
         /* a pending service handle change indication */
         if (p_clcb->p_srcb->srvc_hdl_chg) {
@@ -688,9 +699,14 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
         if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
             bta_sys_conn_open(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
         }
-
+        tBTA_GATT_STATUS status = BTA_GATT_OK;
+        if (p_data && p_data->int_conn.already_connect) {
+            //clear already_connect
+            p_data->int_conn.already_connect = FALSE;
+            status = BTA_GATT_ALREADY_OPEN;
+        }
         bta_gattc_send_open_cback(p_clcb->p_rcb,
-                                  BTA_GATT_OK,
+                                  status,
                                   p_clcb->bda,
                                   p_clcb->bta_conn_id,
                                   p_clcb->transport,
@@ -916,6 +932,7 @@ void bta_gattc_cfg_mtu(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             /* Dequeue the data, if it was enqueued */
             if (p_clcb->p_q_cmd == p_data) {
                 p_clcb->p_q_cmd = NULL;
+                bta_gattc_pop_command_to_send(p_clcb);
             }
 
             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_CONFIG, status, NULL);
@@ -1012,7 +1029,6 @@ void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
     }
     if (p_clcb->p_srcb && p_clcb->p_srcb->p_srvc_list) {
         /* release pending attribute list buffer */
-        APPL_TRACE_DEBUG("+++++++++++++++++++++++++++++++++++++++++++++++++++++++= %p", p_clcb->p_srcb->p_srvc_list);
         osi_free(p_clcb->p_srcb->p_srvc_list);
         p_clcb->p_srcb->p_srvc_list = NULL;
         //osi_free_and_reset((void **)&p_clcb->p_srcb->p_srvc_list);
@@ -1034,11 +1050,9 @@ void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
          * referenced by p_clcb->p_q_cmd
          */
         if (p_q_cmd != p_clcb->p_q_cmd) {
-            APPL_TRACE_DEBUG("====================================================================");
             osi_free(p_q_cmd);
             p_q_cmd = NULL;
         }
-            //osi_free_and_reset((void **)&p_q_cmd);
     }
 }
 /*******************************************************************************
@@ -1067,6 +1081,7 @@ void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             /* Dequeue the data, if it was enqueued */
             if (p_clcb->p_q_cmd == p_data) {
                 p_clcb->p_q_cmd = NULL;
+                bta_gattc_pop_command_to_send(p_clcb);
             }
 
             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
@@ -1102,6 +1117,7 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             /* Dequeue the data, if it was enqueued */
             if (p_clcb->p_q_cmd == p_data) {
                 p_clcb->p_q_cmd = NULL;
+                bta_gattc_pop_command_to_send(p_clcb);
             }
 
             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
@@ -1142,6 +1158,7 @@ void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
         /* Dequeue the data, if it was enqueued */
         if (p_clcb->p_q_cmd == p_data) {
             p_clcb->p_q_cmd = NULL;
+            bta_gattc_pop_command_to_send(p_clcb);
         }
 
         bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_WRITE, status, NULL);
@@ -1166,6 +1183,7 @@ void bta_gattc_execute(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             /* Dequeue the data, if it was enqueued */
             if (p_clcb->p_q_cmd == p_data) {
                 p_clcb->p_q_cmd = NULL;
+                bta_gattc_pop_command_to_send(p_clcb);
             }
 
             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_EXE_WRITE, status, NULL);
@@ -1232,9 +1250,9 @@ void bta_gattc_read_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
         event = p_clcb->p_q_cmd->api_read_multi.cmpl_evt;
     }
     cb_data.read.conn_id = p_clcb->bta_conn_id;
-    osi_free(p_clcb->p_q_cmd);
-    p_clcb->p_q_cmd = NULL;
-    //osi_free_and_reset((void **)&p_clcb->p_q_cmd);
+    //free the command data store in the queue.
+    bta_gattc_free_command_data(p_clcb);
+    bta_gattc_pop_command_to_send(p_clcb);
     /* read complete, callback */
     ( *p_clcb->p_rcb->p_cback)(event, (tBTA_GATTC *)&cb_data);
 
@@ -1265,9 +1283,9 @@ void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
 		} else {
         event = p_clcb->p_q_cmd->api_write.cmpl_evt;
 	}
-    osi_free(p_clcb->p_q_cmd);
-    p_clcb->p_q_cmd = NULL;
-    //osi_free_and_reset((void **)&p_clcb->p_q_cmd);
+    //free the command data store in the queue.
+    bta_gattc_free_command_data(p_clcb);
+    bta_gattc_pop_command_to_send(p_clcb);
     cb_data.write.conn_id = p_clcb->bta_conn_id;
     /* write complete, callback */
     ( *p_clcb->p_rcb->p_cback)(event, (tBTA_GATTC *)&cb_data);
@@ -1285,9 +1303,9 @@ void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
 void bta_gattc_exec_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
 {
     tBTA_GATTC          cb_data;
-    osi_free(p_clcb->p_q_cmd);
-    p_clcb->p_q_cmd = NULL;
-    //osi_free_and_reset((void **)&p_clcb->p_q_cmd);
+    //free the command data store in the queue.
+    bta_gattc_free_command_data(p_clcb);
+    bta_gattc_pop_command_to_send(p_clcb);
     p_clcb->status      = BTA_GATT_OK;
 
     /* execute complete, callback */
@@ -1310,10 +1328,9 @@ void bta_gattc_exec_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
 void bta_gattc_cfg_mtu_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
 {
     tBTA_GATTC          cb_data;
-    osi_free(p_clcb->p_q_cmd);
-    p_clcb->p_q_cmd = NULL;
-    //osi_free_and_reset((void **)&p_clcb->p_q_cmd);
-
+    //free the command data store in the queue.
+    bta_gattc_free_command_data(p_clcb);
+    bta_gattc_pop_command_to_send(p_clcb);
 
     if (p_data->p_cmpl  &&  p_data->status == BTA_GATT_OK) {
         p_clcb->p_srcb->mtu  = p_data->p_cmpl->mtu;
@@ -1456,6 +1473,78 @@ void bta_gattc_q_cmd(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
     bta_gattc_enqueue(p_clcb, p_data);
 }
+/*******************************************************************************
+**
+** Function         bta_gattc_pop_command_to_send
+**
+** Description      dequeue a command into control block.
+**                  Check if there has command pending in the command queue or not,
+**                  if there has command pending in the command queue, sent it to the state machine to decision
+**                  should be sent it to the remote device or not.
+**
+** Returns          None.
+**
+*******************************************************************************/
+static void bta_gattc_pop_command_to_send(tBTA_GATTC_CLCB *p_clcb)
+{
+    if (!list_is_empty(p_clcb->p_cmd_list)) {
+        list_node_t *node = list_begin(p_clcb->p_cmd_list);
+        tBTA_GATTC_DATA *p_data = (tBTA_GATTC_DATA *)list_node(node);
+        if (p_data != NULL) {
+            /* execute pending operation of link block still present */
+            if (l2cu_find_lcb_by_bd_addr(p_clcb->p_srcb->server_bda, BT_TRANSPORT_LE) != NULL) {
+                // The data to be sent to the gattc state machine for processing
+                if(bta_gattc_sm_execute(p_clcb, p_data->hdr.event, p_data)) {
+                    list_remove(p_clcb->p_cmd_list, (void *)p_data);
+                }
+
+                if (p_clcb->is_full) {
+                    tBTA_GATTC cb_data = {0};
+                    p_clcb->is_full = FALSE;
+                    cb_data.status = GATT_SUCCESS;
+                    cb_data.queue_full.conn_id = p_clcb->bta_conn_id;
+                    cb_data.queue_full.is_full = FALSE;
+                    if (p_clcb->p_rcb->p_cback != NULL) {
+                        ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_QUEUE_FULL_EVT, (tBTA_GATTC *)&cb_data);
+                    }
+                }
+            }
+        }
+    }
+}
+/*******************************************************************************
+**
+** Function         bta_gattc_free_command_data
+**
+** Description      free the command data into control block.
+**
+** Returns          None.
+**
+*******************************************************************************/
+void bta_gattc_free_command_data(tBTA_GATTC_CLCB *p_clcb)
+{
+    assert(p_clcb->p_cmd_list);
+    //Check the list is empty or not.
+    if (!list_is_empty(p_clcb->p_cmd_list)) {
+        /* Traversal the command queue, check the p_q_cmd is point to the queue data or not, if the p_q_cmd point to the
+           command queue,should remove it from the list */
+        for (list_node_t *node = list_begin(p_clcb->p_cmd_list); node != list_end(p_clcb->p_cmd_list);
+             node = list_next(node)) {
+            tBTA_GATTC_DATA *p_data = (tBTA_GATTC_DATA *)list_node(node);
+            if (p_data == p_clcb->p_q_cmd) {
+                list_remove(p_clcb->p_cmd_list, (void *)p_data);
+                p_clcb->p_q_cmd = NULL;
+                return;
+            }
+        }
+
+        osi_free(p_clcb->p_q_cmd);
+        p_clcb->p_q_cmd = NULL;
+    } else {
+        osi_free(p_clcb->p_q_cmd);
+        p_clcb->p_q_cmd = NULL;
+    }
+}
 
 /*******************************************************************************
 **
@@ -1563,9 +1652,16 @@ static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
     else if ((transport == BT_TRANSPORT_LE) && (connected == FALSE) && (p_conn != NULL)){
             p_conn->service_change_ccc_written = FALSE;
             if (p_conn->ccc_timer_used == TRUE){
-                osi_free((void *)p_conn->service_change_ccc_timer.param);
+                assert(bta_gattc_cb.write_ccc_mutex != NULL);
+                osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+
+                if (p_conn->service_change_ccc_timer.param != 0) {
+                    osi_free((void *)p_conn->service_change_ccc_timer.param);
+                    p_conn->service_change_ccc_timer.param = (TIMER_PARAM_TYPE)0;
+                }
                 bta_sys_stop_timer(&(p_conn->service_change_ccc_timer));
                 p_conn->ccc_timer_used = FALSE;
+                osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
             }
     }
 
@@ -1741,7 +1837,10 @@ BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,
         }
         /* notify applicationf or service change */
         if (p_clrcb->p_cback != NULL) {
-            (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)p_srcb->server_bda);
+            tBTA_GATTC_SERVICE_CHANGE srvc_chg= {0};
+            memcpy(srvc_chg.remote_bda, p_srcb->server_bda, sizeof(BD_ADDR));
+            srvc_chg.conn_id = conn_id;
+            (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)&srvc_chg);
         }
 
     }
@@ -2084,8 +2183,8 @@ void bta_gattc_broadcast(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
     UNUSED(p_cb);
 
     cb_data.reg_oper.client_if = p_msg->api_listen.client_if;
-    cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start);
-
+    cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start, NULL);
+    //TODO need modify callback if used
     if (p_clreg && p_clreg->p_cback) {
         (*p_clreg->p_cback)(BTA_GATTC_LISTEN_EVT, &cb_data);
     }
@@ -2266,9 +2365,14 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
     BOOLEAN start_ccc_timer = FALSE;
     UINT32 new_timeout;
 
+    assert(bta_gattc_cb.write_ccc_mutex != NULL);
+    osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+
     tBTA_GATTC_WAIT_CCC_TIMER *p_timer_param = (tBTA_GATTC_WAIT_CCC_TIMER*) p_tle->param;
+    p_tle->param = (TIMER_PARAM_TYPE)0;
     if (p_timer_param == NULL){
         APPL_TRACE_ERROR("p_timer_param is NULL in %s\n", __func__);
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
         return;
     }
 
@@ -2276,6 +2380,7 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
     if (p_conn == NULL){
         APPL_TRACE_ERROR("p_conn is NULL in %s\n", __func__);
         osi_free(p_timer_param);
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
         return;
     }
 
@@ -2307,6 +2412,7 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
     }
 
     osi_free(p_timer_param);
+    osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
 }
 
 #endif

components/bt/bluedroid/bta/gatt/bta_gattc_api.c

@@ -135,13 +135,14 @@ void BTA_GATTC_AppDeregister(tBTA_GATTC_IF client_if)
 **
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
+**                  remote_addr_type: remote device BD address type.
 **                  is_direct: direct connection or background auto connection
 **                  transport: Transport to be used for GATT connection (BREDR/LE)
 **
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
+void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
                     BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport)
 {
     tBTA_GATTC_API_OPEN  *p_buf;
@@ -152,6 +153,7 @@ void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
         p_buf->client_if = client_if;
         p_buf->is_direct = is_direct;
         p_buf->transport = transport;
+        p_buf->remote_addr_type = remote_addr_type;
         memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN);
 
 
@@ -829,7 +831,7 @@ tBTA_GATT_STATUS BTA_GATTC_RegisterForNotifications (tBTA_GATTC_IF client_if,
             if ( p_clreg->notif_reg[i].in_use &&
                     !memcmp(p_clreg->notif_reg[i].remote_bda, bda, BD_ADDR_LEN) &&
                   p_clreg->notif_reg[i].handle == handle) {
-                APPL_TRACE_WARNING("notification already registered");
+                APPL_TRACE_DEBUG("notification already registered");
                 status = BTA_GATT_OK;
                 break;
             }

components/bt/bluedroid/bta/gatt/bta_gattc_cache.c

@@ -43,7 +43,6 @@
 #define LOG_TAG "bt_bta_gattc"
 // #include "osi/include/log.h"
 
-static void bta_gattc_cache_write(BD_ADDR server_bda, UINT16 num_attr, tBTA_GATTC_NV_ATTR *attr);
 static void bta_gattc_char_dscpt_disc_cmpl(UINT16 conn_id, tBTA_GATTC_SERV *p_srvc_cb);
 extern void bta_to_btif_uuid(bt_uuid_t *p_dest, tBT_UUID *p_src);
 static size_t bta_gattc_get_db_size_with_type(list_t *services,
@@ -1967,7 +1966,7 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
         }
     }
 
-    bta_gattc_cache_write(p_srvc_cb->server_bda, db_size, nv_attr);
+    /* TODO: Gattc cache write/read need to be added in IDF 3.1*/
     osi_free(nv_attr);
 }
 
@@ -2036,52 +2035,6 @@ done:
     return success;
 }
 
-/*******************************************************************************
-**
-** Function         bta_gattc_cache_write
-**
-** Description      This callout function is executed by GATT when a server cache
-**                  is available to save.
-**
-** Parameter        server_bda: server bd address of this cache belongs to
-**                  num_attr: number of attribute to be save.
-**                  attr: pointer to the list of attributes to save.
-** Returns
-**
-*******************************************************************************/
-static void bta_gattc_cache_write(BD_ADDR server_bda, UINT16 num_attr,
-                           tBTA_GATTC_NV_ATTR *attr)
-{
-    char fname[255] = {0};
-    bta_gattc_generate_cache_file_name(fname, server_bda);
-    FILE *fd = fopen(fname, "wb");
-    if (!fd) {
-        APPL_TRACE_ERROR("%s: can't open GATT cache file for writing: %s", __func__, fname);
-        return;
-    }
-
-    UINT16 cache_ver = GATT_CACHE_VERSION;
-    if (fwrite(&cache_ver, sizeof(UINT16), 1, fd) != 1) {
-        APPL_TRACE_DEBUG("%s: can't write GATT cache version: %s", __func__, fname);
-        fclose(fd);
-        return;
-    }
-
-    if (fwrite(&num_attr, sizeof(UINT16), 1, fd) != 1) {
-        APPL_TRACE_DEBUG("%s: can't write GATT cache attribute count: %s", __func__, fname);
-        fclose(fd);
-        return;
-    }
-
-    if (fwrite(attr, sizeof(tBTA_GATTC_NV_ATTR), num_attr, fd) != num_attr) {
-        APPL_TRACE_DEBUG("%s: can't write GATT cache attributes: %s", __func__, fname);
-        fclose(fd);
-        return;
-    }
-
-    fclose(fd);
-}
-
 /*******************************************************************************
 **
 ** Function         bta_gattc_cache_reset

components/bt/bluedroid/bta/gatt/bta_gattc_main.c

@@ -182,7 +182,7 @@ static const UINT8 bta_gattc_st_connected[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_API_READ_MULTI_EVT     */   {BTA_GATTC_READ_MULTI,         BTA_GATTC_CONN_ST},
     /* BTA_GATTC_API_REFRESH_EVT        */   {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
 
-    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
+    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_CONN,               BTA_GATTC_CONN_ST},
     /* BTA_GATTC_INT_DISCOVER_EVT       */   {BTA_GATTC_START_DISCOVER,     BTA_GATTC_DISCOVER_ST},
     /* BTA_GATTC_DISCOVER_CMPL_EVT       */  {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
     /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_OP_CMPL,            BTA_GATTC_CONN_ST},

components/bt/bluedroid/bta/gatt/bta_gattc_utils.c

@@ -48,6 +48,8 @@ static const UINT8  base_uuid[LEN_UUID_128] = {0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x0
 
 static const BD_ADDR dummy_bda = {0, 0, 0, 0, 0, 0};
 
+#define GATTC_COMMAND_QUEUE_SIZE_MAX    30
+
 /*******************************************************************************
 **
 ** Function         bta_gatt_convert_uuid16_to_uuid128
@@ -230,7 +232,9 @@ tBTA_GATTC_CLCB *bta_gattc_clcb_alloc(tBTA_GATTC_IF client_if, BD_ADDR remote_bd
             bdcpy(p_clcb->bda, remote_bda);
 
             p_clcb->p_rcb = bta_gattc_cl_get_regcb(client_if);
-
+            if (p_clcb->p_cmd_list == NULL) {
+                p_clcb->p_cmd_list = list_new(osi_free_func);
+            }
             if ((p_clcb->p_srcb = bta_gattc_find_srcb(remote_bda)) == NULL) {
                 p_clcb->p_srcb      = bta_gattc_srcb_alloc(remote_bda);
             }
@@ -305,6 +309,10 @@ void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB *p_clcb)
         }
         osi_free(p_clcb->p_q_cmd);
         p_clcb->p_q_cmd = NULL;
+        // don't forget to clear the command queue before dealloc the clcb.
+        list_clear(p_clcb->p_cmd_list);
+        osi_free((void *)p_clcb->p_cmd_list);
+        p_clcb->p_cmd_list = NULL;
         //osi_free_and_reset((void **)&p_clcb->p_q_cmd);
         memset(p_clcb, 0, sizeof(tBTA_GATTC_CLCB));
     } else {
@@ -421,6 +429,24 @@ tBTA_GATTC_SERV *bta_gattc_srcb_alloc(BD_ADDR bda)
     }
     return p_tcb;
 }
+
+static BOOLEAN bta_gattc_has_prepare_command_in_queue(tBTA_GATTC_CLCB *p_clcb)
+{
+    assert(p_clcb != NULL);
+
+    for(list_node_t *sn = list_begin(p_clcb->p_cmd_list);
+        sn != list_end(p_clcb->p_cmd_list); sn = list_next(sn)) {
+
+        tBTA_GATTC_DATA *cmd_data = (tBTA_GATTC_DATA *)list_node(sn);
+        if (cmd_data != NULL && ((cmd_data->hdr.event == BTA_GATTC_API_WRITE_EVT &&
+            cmd_data->api_write.write_type == BTA_GATTC_WRITE_PREPARE) ||
+            cmd_data->hdr.event == BTA_GATTC_API_EXEC_EVT)) {
+            return TRUE;
+        }
+    }
+
+    return FALSE;
+}
 /*******************************************************************************
 **
 ** Function         bta_gattc_enqueue
@@ -432,15 +458,70 @@ tBTA_GATTC_SERV *bta_gattc_srcb_alloc(BD_ADDR bda)
 *******************************************************************************/
 BOOLEAN bta_gattc_enqueue(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
+    tBTA_GATTC cb_data = {0};
 
-    if (p_clcb->p_q_cmd == NULL)
-    {
+    if (p_clcb->p_q_cmd == NULL) {
         p_clcb->p_q_cmd = p_data;
         return TRUE;
+    } else if ((p_data->hdr.event == BTA_GATTC_API_WRITE_EVT &&
+               p_data->api_write.write_type == BTA_GATTC_WRITE_PREPARE) &&
+               ((p_clcb->p_q_cmd->hdr.event == BTA_GATTC_API_WRITE_EVT &&
+               p_clcb->p_q_cmd->api_write.write_type == BTA_GATTC_WRITE_PREPARE) ||
+               bta_gattc_has_prepare_command_in_queue(p_clcb))) {
+        APPL_TRACE_DEBUG("%s(), prepare offset = %d", __func__, p_data->api_write.offset);
+        cb_data.write.status = BTA_GATT_CONGESTED;
+        cb_data.write.handle = p_data->api_write.handle;
+        cb_data.write.conn_id = p_clcb->bta_conn_id;
+        cb_data.write.offset = p_data->api_write.offset;
+        /* write complete, callback */
+        if (p_clcb->p_rcb->p_cback != NULL) {
+            ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_PREP_WRITE_EVT, (tBTA_GATTC *)&cb_data);
+        }
+        return FALSE;
+    }
+    else if (p_clcb->p_cmd_list) {
+        UINT16 len = 0;
+        tBTA_GATTC_DATA *cmd_data = NULL;
+
+        if (list_length(p_clcb->p_cmd_list) >= GATTC_COMMAND_QUEUE_SIZE_MAX) {
+
+            APPL_TRACE_ERROR("%s(), the gattc command queue is full.", __func__);
+            cb_data.status = GATT_BUSY;
+            cb_data.queue_full.conn_id = p_clcb->bta_conn_id;
+            cb_data.queue_full.is_full = TRUE;
+            p_clcb->is_full = TRUE;
+            if (p_clcb->p_rcb->p_cback != NULL) {
+                ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_QUEUE_FULL_EVT, (tBTA_GATTC *)&cb_data);
+            }
+            return FALSE;
+        }
+
+        if (p_data->hdr.event == BTA_GATTC_API_WRITE_EVT) {
+            len = p_data->api_write.len;
+            if ((cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA) + len)) != NULL) {
+                memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA) + len);
+			    memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
+                cmd_data->api_write.p_value = (UINT8 *)(cmd_data + 1);
+			    memcpy(cmd_data->api_write.p_value, p_data->api_write.p_value, len);
+            } else {
+                APPL_TRACE_ERROR("%s(), line = %d, alloc fail, no memery.", __func__, __LINE__);
+                return FALSE;
+            }
+        } else {
+            if ((cmd_data = (tBTA_GATTC_DATA *)osi_malloc(sizeof(tBTA_GATTC_DATA))) != NULL) {
+                memset(cmd_data, 0, sizeof(tBTA_GATTC_DATA));
+                memcpy(cmd_data, p_data, sizeof(tBTA_GATTC_DATA));
+            } else {
+                APPL_TRACE_ERROR("%s(), line = %d, alloc fail, no memery.", __func__, __LINE__);
+                return FALSE;
+            }
+        }
+
+        //store the command to the command list.
+        list_append(p_clcb->p_cmd_list, (void *)cmd_data);
+        return FALSE;
     }
 
-    APPL_TRACE_ERROR ("%s: already has a pending command!!", __func__);
-    /* skip the callback now. ----- need to send callback ? */
     return FALSE;
 }
 
@@ -628,6 +709,7 @@ void bta_gattc_send_open_cback( tBTA_GATTC_RCB *p_clreg, tBTA_GATT_STATUS status
                                 BD_ADDR remote_bda, UINT16 conn_id,
                                 tBTA_TRANSPORT transport, UINT16 mtu)
 {
+
     tBTA_GATTC      cb_data;
 
     if (p_clreg->p_cback) {
@@ -781,6 +863,10 @@ BOOLEAN bta_gattc_conn_dealloc(BD_ADDR remote_bda)
     if (p_conn != NULL) {
         p_conn->in_use = FALSE;
         memset(p_conn->remote_bda, 0, BD_ADDR_LEN);
+        osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+        bta_sys_free_timer(&p_conn->service_change_ccc_timer);
+        p_conn->ccc_timer_used = FALSE;
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
         return TRUE;
     }
     return FALSE;

components/bt/bluedroid/bta/gatt/bta_gatts_act.c

@@ -420,7 +420,7 @@ void bta_gatts_add_char(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_msg)
                                       p_msg->api_add_char.perm,
                                       p_msg->api_add_char.property, p_attr_val, p_control);
     cb_data.add_result.server_if = p_rcb->gatt_if;
-    cb_data.add_result.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+    cb_data.add_result.service_id = p_msg->api_add_char.hdr.layer_specific;
     cb_data.add_result.attr_id = attr_id;
 // btla-specific ++
     memcpy(&cb_data.add_result.char_uuid, &p_msg->api_add_char.char_uuid, sizeof(tBT_UUID));
@@ -470,7 +470,7 @@ void bta_gatts_add_char_descr(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_
                                       p_control);
 
     cb_data.add_result.server_if = p_rcb->gatt_if;
-    cb_data.add_result.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+    cb_data.add_result.service_id = p_msg->api_add_char_descr.hdr.layer_specific;
     cb_data.add_result.attr_id = attr_id;
 // btla-specific ++
     memcpy(&cb_data.add_result.char_uuid, &p_msg->api_add_char_descr.descr_uuid, sizeof(tBT_UUID));
@@ -729,7 +729,7 @@ void bta_gatts_open (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
 
     if ((p_rcb = bta_gatts_find_app_rcb_by_app_if(p_msg->api_open.server_if)) != NULL) {
         /* should always get the connection ID */
-        if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda,
+        if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda, BLE_ADDR_UNKNOWN_TYPE,
                          p_msg->api_open.is_direct, p_msg->api_open.transport)) {
             status = BTA_GATT_OK;
 

components/bt/bluedroid/bta/hh/bta_hh_le.c

@@ -334,7 +334,7 @@ void bta_hh_le_open_conn(tBTA_HH_DEV_CB *p_cb, BD_ADDR remote_bda)
     bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
     p_cb->in_use = TRUE;
 
-    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, TRUE, BTA_GATT_TRANSPORT_LE);
+    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE);
 }
 
 /*******************************************************************************
@@ -2600,7 +2600,7 @@ static void bta_hh_le_add_dev_bg_conn(tBTA_HH_DEV_CB *p_cb, BOOLEAN check_bond)
     if (/*p_cb->dscp_info.flag & BTA_HH_LE_NORMAL_CONN &&*/
         !p_cb->in_bg_conn && to_add) {
         /* add device into BG connection to accept remote initiated connection */
-        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, FALSE, BTA_GATT_TRANSPORT_LE);
+        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, BLE_ADDR_UNKNOWN_TYPE, FALSE, BTA_GATT_TRANSPORT_LE);
         p_cb->in_bg_conn = TRUE;
 
         BTA_DmBleSetBgConnType(BTA_DM_BLE_CONN_AUTO, NULL);

components/bt/bluedroid/bta/include/bta_api.h

@@ -400,12 +400,17 @@ typedef struct {
 
 typedef void (tBTA_SET_ADV_DATA_CMPL_CBACK) (tBTA_STATUS status);
 
-typedef void (tBTA_START_ADV_CMPL_CBACK) (tBTA_STATUS status);
+typedef tBTM_START_ADV_CMPL_CBACK tBTA_START_ADV_CMPL_CBACK;
+
+typedef tBTM_START_STOP_ADV_CMPL_CBACK tBTA_START_STOP_ADV_CMPL_CBACK;
+
 
 typedef tBTM_ADD_WHITELIST_CBACK tBTA_ADD_WHITELIST_CBACK;
 
 typedef tBTM_SET_PKT_DATA_LENGTH_CBACK tBTA_SET_PKT_DATA_LENGTH_CBACK;
 
+typedef tBTM_SET_RAND_ADDR_CBACK tBTA_SET_RAND_ADDR_CBACK;
+
 typedef tBTM_SET_LOCAL_PRIVACY_CBACK tBTA_SET_LOCAL_PRIVACY_CBACK;
 
 typedef tBTM_CMPL_CB tBTA_CMPL_CB;
@@ -782,6 +787,7 @@ typedef struct {
 typedef struct {
     BD_ADDR         bd_addr;            /* BD address peer device. */
     UINT8           status;             /* connection open/closed */
+    UINT8           reason;             /* link down reason */
     BOOLEAN         is_removed;         /* TRUE if device is removed when link is down */
 #if BLE_INCLUDED == TRUE
     tBTA_TRANSPORT  link_type;
@@ -2056,7 +2062,7 @@ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration,
 
 extern void BTA_DmBleStopAdvertising(void);
 
-extern void BTA_DmSetRandAddress(BD_ADDR rand_addr);
+extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback);
 
 #endif
 

components/bt/bluedroid/bta/include/bta_av_api.h

@@ -375,6 +375,7 @@ typedef struct {
 /* data associated with BTA_AV_RC_OPEN_EVT */
 typedef struct {
     UINT8           rc_handle;
+    BOOLEAN         sdp_disc_done;
     tBTA_AV_FEAT    peer_features;
     BD_ADDR         peer_addr;
     tBTA_AV_STATUS  status;

components/bt/bluedroid/bta/include/bta_gatt_api.h

@@ -182,11 +182,14 @@ typedef UINT8 tBTA_GATT_STATUS;
 #define BTA_GATTC_CONNECT_EVT           35 /* GATTC CONNECT  event */
 #define BTA_GATTC_DISCONNECT_EVT        36 /* GATTC DISCONNECT  event */
 #define BTA_GATTC_READ_MUTIPLE_EVT      37 /* GATTC Read mutiple event */
+#define BTA_GATTC_QUEUE_FULL_EVT        38 /* GATTC queue full event */
 
 typedef UINT8 tBTA_GATTC_EVT;
 
 typedef tGATT_IF tBTA_GATTC_IF;
 
+typedef UINT8 tBTA_ADDR_TYPE;
+
 typedef struct {
     UINT16              unit;       /* as UUIUD defined by SIG */
     UINT16              descr;      /* as UUID as defined by SIG */
@@ -298,6 +301,7 @@ typedef struct {
     UINT16              conn_id;
     tBTA_GATT_STATUS    status;
     UINT16              handle;
+    UINT16              offset;
 }tBTA_GATTC_WRITE;
 
 typedef struct {
@@ -354,6 +358,12 @@ typedef struct {
     BOOLEAN congested; /* congestion indicator */
 } tBTA_GATTC_CONGEST;
 
+typedef struct {
+    tBTA_GATT_STATUS status;
+    UINT16 conn_id;
+    BOOLEAN is_full;
+} tBTA_GATTC_QUEUE_FULL;
+
 typedef struct {
     tBTA_GATT_STATUS        status;
     tBTA_GATTC_IF           client_if;
@@ -379,26 +389,30 @@ typedef struct {
     BD_ADDR             remote_bda;
 } tBTA_GATTC_DISCONNECT;
 
-
+typedef struct {
+    UINT16              conn_id;
+    BD_ADDR             remote_bda;
+} tBTA_GATTC_SERVICE_CHANGE;
 
 typedef union {
     tBTA_GATT_STATUS        status;
 
-    tBTA_GATTC_SEARCH_CMPL  search_cmpl;          /* discovery complete */
-    tBTA_GATTC_SRVC_RES     srvc_res;          /* discovery result */
-    tBTA_GATTC_REG          reg_oper;              /* registration data */
+    tBTA_GATTC_SEARCH_CMPL  search_cmpl;    /* discovery complete */
+    tBTA_GATTC_SRVC_RES     srvc_res;       /* discovery result */
+    tBTA_GATTC_REG          reg_oper;       /* registration data */
     tBTA_GATTC_OPEN         open;
     tBTA_GATTC_CONNECT      connect;
     tBTA_GATTC_CLOSE        close;
     tBTA_GATTC_DISCONNECT   disconnect;
-    tBTA_GATTC_READ         read;             /* read attribute/descriptor data */
-    tBTA_GATTC_WRITE        write;            /* write complete data */
-    tBTA_GATTC_EXEC_CMPL    exec_cmpl;       /*  execute complete */
-    tBTA_GATTC_NOTIFY       notify;           /* notification/indication event data */
+    tBTA_GATTC_READ         read;           /* read attribute/descriptor data */
+    tBTA_GATTC_WRITE        write;          /* write complete data */
+    tBTA_GATTC_EXEC_CMPL    exec_cmpl;      /*  execute complete */
+    tBTA_GATTC_NOTIFY       notify;         /* notification/indication event data */
     tBTA_GATTC_ENC_CMPL_CB  enc_cmpl;
-    BD_ADDR                 remote_bda;     /* service change event */
     tBTA_GATTC_CFG_MTU      cfg_mtu;        /* configure MTU operation */
     tBTA_GATTC_CONGEST      congest;
+    tBTA_GATTC_QUEUE_FULL   queue_full;
+    tBTA_GATTC_SERVICE_CHANGE srvc_chg;     /* service change event */
 } tBTA_GATTC;
 
 /* GATTC enable callback function */
@@ -728,13 +742,14 @@ extern void BTA_GATTC_AppDeregister (tBTA_GATTC_IF client_if);
 **
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
+**                  remote_addr_type: remote device BD address type.
 **                  is_direct: direct connection or background auto connection
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
-                           BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport);
+extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
+                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport);
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/include/bta_gattc_int.h

@@ -30,6 +30,7 @@
 #include "bta_gattc_ci.h"
 #include "bta_gattc_co.h"
 #include "fixed_queue.h"
+#include "mutex.h"
 
 /*****************************************************************************
 **  Constants and data types
@@ -115,6 +116,7 @@ typedef tBTA_GATTC_INT_START_IF tBTA_GATTC_INT_DEREG;
 typedef struct {
     BT_HDR                  hdr;
     BD_ADDR                 remote_bda;
+    tBTA_ADDR_TYPE          remote_addr_type;
     tBTA_GATTC_IF           client_if;
     BOOLEAN                 is_direct;
     tBTA_TRANSPORT          transport;
@@ -191,6 +193,7 @@ typedef struct {
     UINT8                   role;
     tBT_TRANSPORT           transport;
     tGATT_DISCONN_REASON    reason;
+    BOOLEAN                 already_connect;
 } tBTA_GATTC_INT_CONN;
 
 typedef struct {
@@ -310,7 +313,8 @@ typedef struct {
     tBTA_GATTC_RCB      *p_rcb;         /* pointer to the registration CB */
     tBTA_GATTC_SERV     *p_srcb;    /* server cache CB */
     tBTA_GATTC_DATA     *p_q_cmd;   /* command in queue waiting for execution */
-
+    list_t              *p_cmd_list; /* The list to store the command to be sent */
+    BOOLEAN             is_full;     /* The gattc command queue is full or not */
 #define BTA_GATTC_NO_SCHEDULE       0
 #define BTA_GATTC_DISC_WAITING      0x01
 #define BTA_GATTC_REQ_WAITING       0x10
@@ -356,8 +360,8 @@ enum {
 };
 
 typedef struct {
-    UINT8             state;
-
+    UINT8               state;
+    osi_mutex_t         write_ccc_mutex;
     tBTA_GATTC_CONN     conn_track[BTA_GATTC_CONN_MAX];
     tBTA_GATTC_BG_TCK   bg_track[BTA_GATTC_KNOWN_SR_MAX];
     tBTA_GATTC_RCB      cl_rcb[BTA_GATTC_CL_MAX];
@@ -425,6 +429,7 @@ extern void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_q_cmd(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
+extern void bta_gattc_free_command_data(tBTA_GATTC_CLCB *p_clcb);
 extern void bta_gattc_search(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_confirm(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);

components/bt/bluedroid/bta/include/bta_sys.h

@@ -224,6 +224,7 @@ extern UINT16 bta_sys_get_sys_features(void);
 extern void bta_sys_sendmsg(void *p_msg);
 extern void bta_sys_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, INT32 timeout_ms);
 extern void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle);
+extern void bta_sys_free_timer(TIMER_LIST_ENT *p_tle);
 extern void bta_sys_disable(tBTA_SYS_HW_MODULE module);
 extern UINT32 bta_sys_get_remaining_ticks(TIMER_LIST_ENT *p_target_tle);
 

components/bt/bluedroid/bta/sys/bta_sys_main.c

@@ -652,6 +652,28 @@ void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle)
     osi_alarm_cancel(alarm);
 }
 
+/*******************************************************************************
+**
+** Function         bta_sys_free_timer
+**
+** Description      Stop and free a BTA timer.
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_sys_free_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    osi_alarm_t *alarm = hash_map_get(bta_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s expected alarm was not in bta alarm hash map.", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(bta_alarm_hash_map, p_tle);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_sys_disable

components/bt/bluedroid/btc/core/btc_ble_storage.c

@@ -23,8 +23,13 @@
 
 #if (SMP_INCLUDED == TRUE)
 
+//the maximum nubmer of bonded devices
+#define BONED_DEVICES_MAX_COUNT (BTM_SEC_MAX_DEVICE_RECORDS)
+
 static void _btc_storage_save(void)
 {
+    uint16_t addr_section_count = 0;
+    const btc_config_section_iter_t *need_remove_iter = NULL;
     const btc_config_section_iter_t *iter = btc_config_section_begin();
 
     while (iter != btc_config_section_end()) {
@@ -48,10 +53,25 @@ static void _btc_storage_save(void)
             btc_config_remove_section(section);
             continue;
         }
-
+        if(addr_section_count == BONED_DEVICES_MAX_COUNT) {
+            need_remove_iter = iter;
+        }
+        addr_section_count ++;
         iter = btc_config_section_next(iter);
     }
-
+    /*exceeded the maximum nubmer of bonded devices, delete them */
+    if (need_remove_iter) {
+        while(need_remove_iter != btc_config_section_end()) {
+            const char *need_remove_section = btc_config_section_name(need_remove_iter);
+            if (!string_is_bdaddr(need_remove_section)) {
+                need_remove_iter = btc_config_section_next(need_remove_iter);
+                continue;
+            }
+            need_remove_iter = btc_config_section_next(need_remove_iter);
+            BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
+            btc_config_remove_section(need_remove_section);
+        }
+    }
     btc_config_flush();
 }
 
@@ -764,7 +784,10 @@ bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev
         //resolve the peer device irk
         if (_btc_storage_get_ble_bonding_key(&bd_addr, BTM_LE_KEY_PID, buffer, sizeof(tBTM_LE_PID_KEYS)) == BT_STATUS_SUCCESS) {
             bond_dev->bond_key.key_mask |= ESP_BLE_ID_KEY_MASK;
-            memcpy(&bond_dev->bond_key.pid_key, buffer, sizeof(tBTM_LE_PID_KEYS));
+            tBTM_LE_PID_KEYS *pid_key = (tBTM_LE_PID_KEYS *) buffer;
+            memcpy(&bond_dev->bond_key.pid_key.irk, pid_key->irk, BT_OCTET16_LEN);
+            bond_dev->bond_key.pid_key.addr_type = pid_key->addr_type;
+            memcpy(&bond_dev->bond_key.pid_key.static_addr, pid_key->static_addr, sizeof(BD_ADDR));
         }
         //serch for the next bond device
         bond_dev++;

components/bt/bluedroid/btc/core/btc_dm.c

@@ -247,12 +247,6 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
          if (btc_storage_get_remote_addr_type(&bdaddr, &addr_type) != BT_STATUS_SUCCESS) {
             btc_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type, true);
         }
-        /* check the irk has been save in the flash or not, if the irk has already save, means that the peer device has bonding
-           before. */
-        if(pairing_cb.ble.is_pid_key_rcvd) {
-            btc_storage_compare_address_key_value(&bdaddr, BTM_LE_KEY_PID,
-                                                  (void *)&pairing_cb.ble.pid_key, sizeof(tBTM_LE_PID_KEYS));
-        }
         btc_dm_save_ble_bonding_keys();
     } else {
         /*Map the HCI fail reason  to  bt status  */
@@ -432,8 +426,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
     switch (msg->act) {
     case BTA_DM_ENABLE_EVT: {
         btc_clear_services_mask();
-        btc_storage_load_bonded_devices();
 #if (SMP_INCLUDED == TRUE)
+        btc_storage_load_bonded_devices();
         //load the bonding device to the btm layer
         btc_storage_load_bonded_ble_devices();
 #endif  ///SMP_INCLUDED == TRUE

components/bt/bluedroid/btc/core/btc_main.c

@@ -57,8 +57,8 @@ static void btc_init_bluetooth(void)
     osi_alarm_create_mux();
     osi_alarm_init();
     bte_main_boot_entry(btc_init_callback);
-    btc_config_init();
 #if (SMP_INCLUDED)
+    btc_config_init();
     //load the ble local key whitch has been store in the flash
     btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
@@ -68,7 +68,9 @@ static void btc_init_bluetooth(void)
 static void btc_deinit_bluetooth(void)
 {
     bte_main_shutdown();
+#if (SMP_INCLUDED)
     btc_config_clean_up();
+#endif
     osi_alarm_deinit();
     osi_alarm_delete_mux();
     future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);

components/bt/bluedroid/btc/core/btc_task.c

@@ -141,9 +141,12 @@ int btc_init(void)
 {
     xBtcQueue = xQueueCreate(BTC_TASK_QUEUE_LEN, sizeof(btc_msg_t));
     xTaskCreatePinnedToCore(btc_task, "Btc_task", BTC_TASK_STACK_SIZE, NULL, BTC_TASK_PRIO, &xBtcTaskHandle, BTC_TASK_PINNED_TO_CORE);
+    if (xBtcTaskHandle == NULL || xBtcQueue == 0){
+        return BT_STATUS_NOMEM;
+    }
+
     btc_gap_callback_init();
     /* TODO: initial the profile_tab */
-
     return BT_STATUS_SUCCESS;
 }
 

components/bt/bluedroid/btc/profile/std/a2dp/btc_avk.c

@@ -1002,8 +1002,6 @@ static void btc_a2d_sink_deinit(void)
 {
     LOG_DEBUG("%s\n", __FUNCTION__);
 
-    btc_a2dp_stop_media_task();
-
     btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
 #if (BTA_AV_SINK_INCLUDED == TRUE)
     btc_dm_disable_service(BTA_A2DP_SINK_SERVICE_ID);
@@ -1012,6 +1010,8 @@ static void btc_a2d_sink_deinit(void)
     /* Also shut down the AV state machine */
     btc_sm_shutdown(btc_av_cb.sm_handle);
     btc_av_cb.sm_handle = NULL;
+
+    btc_a2dp_stop_media_task();
 }
 
 /*******************************************************************************
@@ -1120,7 +1120,7 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
          * auto-suspend av streaming on AG events(SCO or Call). The suspend shall
          * be initiated by the app/audioflinger layers */
         BTA_AvEnable(BTA_SEC_AUTHENTICATE, (BTA_AV_FEAT_NO_SCO_SSPD)
-                     // | BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR
+                     | BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR
                      | BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
                      bte_av_callback);
         BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos);

components/bt/bluedroid/btc/profile/std/a2dp/btc_media_task.c

@@ -52,6 +52,8 @@
 #include "bt_utils.h"
 #include "esp_a2dp_api.h"
 #include "mutex.h"
+#include "future.h"
+#include <assert.h>
 
 // #if (BTA_AV_SINK_INCLUDED == TRUE)
 #include "oi_codec_sbc.h"
@@ -162,6 +164,7 @@ static void btc_media_thread_cleanup(UNUSED_ATTR void *context);
 
 static tBTC_MEDIA_CB btc_media_cb;
 static int media_task_running = MEDIA_TASK_STATE_OFF;
+static future_t *media_task_future = NULL;
 static fixed_queue_t *btc_media_cmd_msg_queue = NULL;
 static xTaskHandle  xBtcMediaTaskHandle = NULL;
 static QueueHandle_t xBtcMediaDataQueue = NULL;
@@ -272,13 +275,13 @@ bool btc_a2dp_start_media_task(void)
 
     APPL_TRACE_EVENT("## A2DP START MEDIA THREAD ##");
 
-    xBtcMediaQueueSet = xQueueCreateSet(BTC_MEDIA_TASK_QUEUE_SET_LEN);
+    xBtcMediaQueueSet = xQueueCreateSet(BTC_A2DP_SINK_TASK_QUEUE_SET_LEN);
     configASSERT(xBtcMediaQueueSet);
-    xBtcMediaDataQueue = xQueueCreate(BTC_MEDIA_DATA_QUEUE_LEN, sizeof(void *));
+    xBtcMediaDataQueue = xQueueCreate(BTC_A2DP_SINK_DATA_QUEUE_LEN, sizeof(void *));
     configASSERT(xBtcMediaDataQueue);
     xQueueAddToSet(xBtcMediaDataQueue, xBtcMediaQueueSet);
 
-    xBtcMediaCtrlQueue = xQueueCreate(BTC_MEDIA_CTRL_QUEUE_LEN, sizeof(void *));
+    xBtcMediaCtrlQueue = xQueueCreate(BTC_A2DP_SINK_CTRL_QUEUE_LEN, sizeof(void *));
     configASSERT(xBtcMediaCtrlQueue);
     xQueueAddToSet(xBtcMediaCtrlQueue, xBtcMediaQueueSet);
 
@@ -286,7 +289,7 @@ bool btc_a2dp_start_media_task(void)
         goto error_exit;
     }
 
-    xTaskCreatePinnedToCore(btc_media_task_handler, "BtcMediaT\n", 2048, NULL, configMAX_PRIORITIES - 3, &xBtcMediaTaskHandle, 0);
+    xTaskCreatePinnedToCore(btc_media_task_handler, BTC_A2DP_SINK_TASK_NAME, BTC_A2DP_SINK_TASK_STACK_SIZE, NULL, BTC_A2DP_SINK_TASK_PRIO, &xBtcMediaTaskHandle, BTC_A2DP_SINK_TASK_PINNED_TO_CORE);
     if (xBtcMediaTaskHandle == NULL) {
         goto error_exit;
     }
@@ -319,6 +322,11 @@ error_exit:;
         xBtcMediaCtrlQueue = NULL;
     }
 
+    if (xBtcMediaQueueSet) {
+        vQueueDelete(xBtcMediaQueueSet);
+        xBtcMediaQueueSet = NULL;
+    }
+
     fixed_queue_free(btc_media_cmd_msg_queue, NULL);
     btc_media_cmd_msg_queue = NULL;
     return false;
@@ -329,8 +337,13 @@ void btc_a2dp_stop_media_task(void)
     APPL_TRACE_EVENT("## A2DP STOP MEDIA THREAD ##\n");
 
     // Exit thread
+    media_task_running = MEDIA_TASK_STATE_SHUTTING_DOWN;
+    media_task_future = future_new();
+    assert(media_task_future);
     btc_media_ctrl_post(SIG_MEDIA_TASK_CLEAN_UP);
-    // TODO: wait until CLEAN up is done, then do task delete
+    future_await(media_task_future);
+    media_task_future = NULL;
+
     vTaskDelete(xBtcMediaTaskHandle);
     xBtcMediaTaskHandle = NULL;
 
@@ -340,6 +353,9 @@ void btc_a2dp_stop_media_task(void)
     vQueueDelete(xBtcMediaCtrlQueue);
     xBtcMediaCtrlQueue = NULL;
 
+    vQueueDelete(xBtcMediaQueueSet);
+    xBtcMediaQueueSet = NULL;
+
     fixed_queue_free(btc_media_cmd_msg_queue, NULL);
     btc_media_cmd_msg_queue = NULL;
 }
@@ -527,6 +543,10 @@ static void btc_media_task_avk_data_ready(UNUSED_ATTR void *context)
         }
 
         while ((p_msg = (tBT_SBC_HDR *)fixed_queue_try_peek_first(btc_media_cb.RxSbcQ)) != NULL ) {
+            if (media_task_running != MEDIA_TASK_STATE_ON){
+                return;
+            }
+
             btc_media_task_handle_inc_media(p_msg);
             p_msg = (tBT_SBC_HDR *)fixed_queue_try_dequeue(btc_media_cb.RxSbcQ);
             if ( p_msg == NULL ) {
@@ -552,14 +572,13 @@ static void btc_media_thread_init(UNUSED_ATTR void *context)
 
 static void btc_media_thread_cleanup(UNUSED_ATTR void *context)
 {
-    /* make sure no channels are restarted while shutting down */
-    media_task_running = MEDIA_TASK_STATE_SHUTTING_DOWN;
-
     btc_media_cb.data_channel_open = FALSE;
     /* Clear media task flag */
     media_task_running = MEDIA_TASK_STATE_OFF;
 
     fixed_queue_free(btc_media_cb.RxSbcQ, osi_free_func);
+
+    future_ready(media_task_future, NULL);
 }
 
 /*******************************************************************************
@@ -894,6 +913,10 @@ UINT8 btc_media_sink_enque_buf(BT_HDR *p_pkt)
 {
     tBT_SBC_HDR *p_msg;
 
+    if (media_task_running != MEDIA_TASK_STATE_ON){
+        return 0;
+    }
+
     if (btc_media_cb.rx_flush == TRUE) { /* Flush enabled, do not enque*/
         return fixed_queue_length(btc_media_cb.RxSbcQ);
     }

components/bt/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -31,6 +31,7 @@
 #include "btc_manage.h"
 #include "esp_avrc_api.h"
 #include "mutex.h"
+#include "allocator.h"
 
 #if BTC_AV_INCLUDED
 
@@ -96,6 +97,7 @@ rc_device_t device;
 static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open);
 static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close);
 static void handle_rc_passthrough_rsp ( tBTA_AV_REMOTE_RSP *p_remote_rsp);
+static void handle_rc_metadata_rsp ( tBTA_AV_META_MSG *p_remote_rsp);
 
 /*****************************************************************************
 **  Static variables
@@ -118,30 +120,11 @@ static inline void btc_avrc_ct_cb_to_app(esp_avrc_ct_cb_event_t event, esp_avrc_
 
 static void handle_rc_features(void)
 {
-    btrc_remote_features_t rc_features = BTRC_FEAT_NONE;
-    bt_bdaddr_t rc_addr;
-    bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-
-    // TODO(eisenbach): If devices need to be blacklisted for absolute
-    // volume, it should be added to device/include/interop_database.h
-    // For now, everything goes... If blacklisting is necessary, exclude
-    // the following bit here:
-    //    btc_rc_vb.rc_features &= ~BTA_AV_FEAT_ADV_CTRL;
-
-    if (btc_rc_vb.rc_features & BTA_AV_FEAT_BROWSE) {
-        rc_features |= BTRC_FEAT_BROWSE;
-    }
-
-    if ( (btc_rc_vb.rc_features & BTA_AV_FEAT_ADV_CTRL) &&
-            (btc_rc_vb.rc_features & BTA_AV_FEAT_RCTG)) {
-        rc_features |= BTRC_FEAT_ABSOLUTE_VOLUME;
-    }
-
-    if (btc_rc_vb.rc_features & BTA_AV_FEAT_METADATA) {
-        rc_features |= BTRC_FEAT_METADATA;
-    }
-
-    LOG_DEBUG("%s: rc_features=0x%x", __FUNCTION__, rc_features);
+    esp_avrc_ct_cb_param_t param;
+    memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+    param.rmt_feats.feat_mask = btc_rc_vb.rc_features;
+    memcpy(param.rmt_feats.remote_bda, btc_rc_vb.rc_addr, sizeof(esp_bd_addr_t));
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_REMOTE_FEATURES_EVT, &param);
 }
 
 
@@ -156,9 +139,7 @@ static void handle_rc_features(void)
 static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
 {
     LOG_DEBUG("%s: rc_handle: %d", __FUNCTION__, p_rc_open->rc_handle);
-#if (AVRC_CTLR_INCLUDED == TRUE)
     bt_bdaddr_t rc_addr;
-#endif
 
     if (p_rc_open->status == BTA_AV_SUCCESS) {
         //check if already some RC is connected
@@ -180,22 +161,18 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
         btc_rc_vb.rc_connected = TRUE;
         btc_rc_vb.rc_handle = p_rc_open->rc_handle;
 
+        bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
+
+        esp_avrc_ct_cb_param_t param;
+        memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+        param.conn_stat.connected = true;
+        memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
+        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+
         /* on locally initiated connection we will get remote features as part of connect */
-        if (btc_rc_vb.rc_features != 0) {
+        if (p_rc_open->sdp_disc_done == TRUE) {
             handle_rc_features();
         }
-#if (AVRC_CTLR_INCLUDED == TRUE)
-        bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-        /* report connection state if device is AVRCP target */
-        if (btc_rc_vb.rc_features & BTA_AV_FEAT_RCTG) {
-            esp_avrc_ct_cb_param_t param;
-            memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-            param.conn_stat.connected = true;
-            param.conn_stat.feat_mask = btc_rc_vb.rc_features;
-            memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
-            btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
-        }
-#endif
     } else {
         LOG_ERROR("%s Connect failed with error code: %d",
                   __FUNCTION__, p_rc_open->status);
@@ -213,10 +190,8 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
  ***************************************************************************/
 static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
 {
-#if (AVRC_CTLR_INCLUDED == TRUE)
     bt_bdaddr_t rc_addr;
-    tBTA_AV_FEAT features;
-#endif
+
     LOG_DEBUG("%s: rc_handle: %d", __FUNCTION__, p_rc_close->rc_handle);
     if ((p_rc_close->rc_handle != btc_rc_vb.rc_handle)
             && (bdcmp(btc_rc_vb.rc_addr, p_rc_close->peer_addr))) {
@@ -226,27 +201,102 @@ static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
 
     btc_rc_vb.rc_handle = 0;
     btc_rc_vb.rc_connected = FALSE;
-    memset(btc_rc_vb.rc_addr, 0, sizeof(BD_ADDR));
+    memcpy(btc_rc_vb.rc_addr, p_rc_close->peer_addr, sizeof(BD_ADDR));
     memset(btc_rc_vb.rc_notif, 0, sizeof(btc_rc_vb.rc_notif));
-#if (AVRC_CTLR_INCLUDED == TRUE)
-    features = btc_rc_vb.rc_features;
-#endif
+
     btc_rc_vb.rc_features = 0;
     btc_rc_vb.rc_vol_label = MAX_LABEL;
     btc_rc_vb.rc_volume = MAX_VOLUME;
-#if (AVRC_CTLR_INCLUDED == TRUE)
+
     bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-#endif
+
     memset(btc_rc_vb.rc_addr, 0, sizeof(BD_ADDR));
-#if (AVRC_CTLR_INCLUDED == TRUE)
-    /* report connection state if device is AVRCP target */
-    if (features & BTA_AV_FEAT_RCTG) {
-        esp_avrc_ct_cb_param_t param;
-        memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-        param.conn_stat.connected = false;
-        memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
-        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+
+    /* report connection state */
+    esp_avrc_ct_cb_param_t param;
+    memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+    param.conn_stat.connected = false;
+    memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+}
+
+static void handle_rc_attributes_rsp ( tAVRC_MSG_VENDOR *vendor_msg)
+{
+    uint8_t attr_count = vendor_msg->p_vendor_data[4];
+    int attr_index = 5;
+    int attr_length = 0;
+    uint32_t attr_id = 0;
+
+    //Check if there are any attributes
+    if (attr_count < 1) {
+        return;
     }
+
+    esp_avrc_ct_cb_param_t param[attr_count];
+    memset(&param[0], 0, sizeof(esp_avrc_ct_cb_param_t) * attr_count);
+
+    for (int i = 0; i < attr_count; i++) {
+        attr_length = (int) vendor_msg->p_vendor_data[7 + attr_index] | vendor_msg->p_vendor_data[6 + attr_index] << 8;
+
+        //Received attribute text is not null terminated, so it's useful to know it's length
+        param[i].meta_rsp.attr_length = attr_length;
+        param[i].meta_rsp.attr_text = &vendor_msg->p_vendor_data[8 + attr_index];
+
+        attr_id = vendor_msg->p_vendor_data[3 + attr_index] |
+                  vendor_msg->p_vendor_data[2 + attr_index] << 8 | vendor_msg->p_vendor_data[1 + attr_index] << 16 |
+                  vendor_msg->p_vendor_data[attr_index] << 24;
+
+        //Convert to mask id
+        param[i].meta_rsp.attr_id = (1 << (attr_id - 1));
+
+        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_METADATA_RSP_EVT, &param[i]);
+
+        attr_index += (int) vendor_msg->p_vendor_data[7 + attr_index] + 8;
+    }
+}
+
+static void handle_rc_notification_rsp ( tAVRC_MSG_VENDOR *vendor_msg)
+{
+    esp_avrc_ct_cb_param_t param;
+
+    param.change_ntf.event_id = vendor_msg->p_vendor_data[4];
+
+    param.change_ntf.event_parameter = vendor_msg->p_vendor_data[5] << 24 | vendor_msg->p_vendor_data[6] << 16 |
+                                       vendor_msg->p_vendor_data[7] << 8 | vendor_msg->p_vendor_data[8];
+
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CHANGE_NOTIFY_EVT, &param);
+}
+
+/***************************************************************************
+ *  Function       handle_rc_metadata_rsp
+ *
+ *  - Argument:    tBTA_AV_META_MSG metadata command response
+ *
+ *  - Description: Vendor metadata response handler
+ *
+ ***************************************************************************/
+static void handle_rc_metadata_rsp ( tBTA_AV_META_MSG *p_remote_rsp)
+{
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    tAVRC_MSG *avrc_msg = p_remote_rsp->p_msg;
+    tAVRC_MSG_VENDOR *vendor_msg = &avrc_msg->vendor;
+
+    //Check what type of metadata was received
+    switch (vendor_msg->hdr.ctype) {
+    case AVRC_RSP_CHANGED:
+        if (vendor_msg->p_vendor_data[0] == AVRC_PDU_REGISTER_NOTIFICATION) {
+            handle_rc_notification_rsp(vendor_msg);
+        }
+        break;
+
+    case AVRC_RSP_IMPL_STBL:
+        if (vendor_msg->p_vendor_data[0] == AVRC_PDU_GET_ELEMENT_ATTR) {
+            handle_rc_attributes_rsp(vendor_msg);
+        }
+        break;
+    }
+#else
+    LOG_ERROR("%s AVRCP metadata is not enabled", __FUNCTION__);
 #endif
 }
 
@@ -326,8 +376,12 @@ void btc_rc_handler(tBTA_AV_EVT event, tBTA_AV *p_data)
     }
     break;
 
+    case BTA_AV_META_MSG_EVT: {
+        handle_rc_metadata_rsp(&(p_data->meta_msg));
+    }
+    break;
+
     // below events are not handled for now
-    case BTA_AV_META_MSG_EVT:
     case BTA_AV_REMOTE_CMD_EVT:
     default:
         LOG_DEBUG("Unhandled RC event : 0x%x", event);
@@ -390,13 +444,124 @@ static void btc_avrc_ct_deinit(void)
     LOG_INFO("## %s ## completed", __FUNCTION__);
 }
 
+static bt_status_t btc_avrc_ct_send_set_player_value_cmd(uint8_t tl, uint8_t attr_id, uint8_t value_id)
+{
+    tAVRC_STS status = BT_STATUS_UNSUPPORTED;
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    CHECK_ESP_RC_CONNECTED;
+
+    tAVRC_COMMAND avrc_cmd = {0};
+    BT_HDR *p_msg = NULL;
+    tAVRC_APP_SETTING values = {0};
+
+    values.attr_id = attr_id;
+    values.attr_val = value_id;
+
+    avrc_cmd.set_app_val.opcode = AVRC_OP_VENDOR;
+    avrc_cmd.set_app_val.status = AVRC_STS_NO_ERROR;
+    avrc_cmd.set_app_val.num_val = 1;
+    avrc_cmd.set_app_val.p_vals = &values;
+    avrc_cmd.set_app_val.pdu = AVRC_PDU_SET_PLAYER_APP_VALUE;
+
+    status = AVRC_BldCommand(&avrc_cmd, &p_msg);
+    if (status == AVRC_STS_NO_ERROR) {
+        if (btc_rc_vb.rc_features & BTA_AV_FEAT_METADATA) {
+            BTA_AvMetaCmd(btc_rc_vb.rc_handle, tl, BTA_AV_CMD_CTRL, p_msg);
+            status = BT_STATUS_SUCCESS;
+        } else {
+            status = BT_STATUS_FAIL;
+            LOG_DEBUG("%s: feature not supported", __FUNCTION__);
+        }
+    }
+
+#else
+    LOG_DEBUG("%s: feature not enabled", __FUNCTION__);
+#endif
+
+    return status;
+}
+
+static bt_status_t btc_avrc_ct_send_register_notification_cmd(uint8_t tl, uint8_t event_id, uint32_t event_parameter)
+{
+    tAVRC_STS status = BT_STATUS_UNSUPPORTED;
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    CHECK_ESP_RC_CONNECTED;
+
+    tAVRC_COMMAND avrc_cmd = {0};
+    BT_HDR *p_msg = NULL;
+
+    avrc_cmd.reg_notif.opcode = AVRC_OP_VENDOR;
+    avrc_cmd.reg_notif.status = AVRC_STS_NO_ERROR;
+    avrc_cmd.reg_notif.event_id = event_id;
+    avrc_cmd.reg_notif.param = event_parameter;
+    avrc_cmd.reg_notif.pdu = AVRC_PDU_REGISTER_NOTIFICATION;
+
+    status = AVRC_BldCommand(&avrc_cmd, &p_msg);
+    if (status == AVRC_STS_NO_ERROR) {
+        if (btc_rc_vb.rc_features & BTA_AV_FEAT_METADATA) {
+            BTA_AvMetaCmd(btc_rc_vb.rc_handle, tl, AVRC_CMD_NOTIF, p_msg);
+            status = BT_STATUS_SUCCESS;
+        } else {
+            status = BT_STATUS_FAIL;
+            LOG_DEBUG("%s: feature not supported", __FUNCTION__);
+        }
+    }
+
+#else
+    LOG_DEBUG("%s: feature not enabled", __FUNCTION__);
+#endif
+
+    return status;
+}
+
+static bt_status_t btc_avrc_ct_send_metadata_cmd (uint8_t tl, uint8_t attr_mask)
+{
+    tAVRC_STS status = BT_STATUS_UNSUPPORTED;
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    CHECK_ESP_RC_CONNECTED;
+    uint32_t index = 0;
+
+    tAVRC_COMMAND avrc_cmd = {0};
+    BT_HDR *p_msg = NULL;
+
+    avrc_cmd.get_elem_attrs.opcode = AVRC_OP_VENDOR;
+    avrc_cmd.get_elem_attrs.status = AVRC_STS_NO_ERROR;
+    avrc_cmd.get_elem_attrs.pdu = AVRC_PDU_GET_ELEMENT_ATTR;
+
+    for (int count = 0; count < AVRC_MAX_ELEM_ATTR_SIZE; count++) {
+        if ((attr_mask & (1 << count)) > 0) {
+            avrc_cmd.get_elem_attrs.attrs[index] = count + 1;
+            index++;
+        }
+    }
+
+    avrc_cmd.get_elem_attrs.num_attr = index;
+
+    status = AVRC_BldCommand(&avrc_cmd, &p_msg);
+    if (status == AVRC_STS_NO_ERROR) {
+        if (btc_rc_vb.rc_features & BTA_AV_FEAT_METADATA) {
+            BTA_AvMetaCmd(btc_rc_vb.rc_handle, tl, AVRC_CMD_STATUS, p_msg);
+            status = BT_STATUS_SUCCESS;
+        } else {
+            status = BT_STATUS_FAIL;
+            LOG_DEBUG("%s: feature not supported", __FUNCTION__);
+        }
+    }
+
+#else
+    LOG_DEBUG("%s: feature not enabled", __FUNCTION__);
+#endif
+
+    return status;
+}
+
 static bt_status_t btc_avrc_ct_send_passthrough_cmd(uint8_t tl, uint8_t key_code, uint8_t key_state)
 {
     tAVRC_STS status = BT_STATUS_UNSUPPORTED;
-    if (tl >= 16 ||
-            key_state > ESP_AVRC_PT_CMD_STATE_RELEASED) {
-        return ESP_ERR_INVALID_ARG;
-    }
+
 #if (AVRC_CTLR_INCLUDED == TRUE)
     CHECK_ESP_RC_CONNECTED;
     LOG_DEBUG("%s: key-code: %d, key-state: %d", __FUNCTION__,
@@ -436,6 +601,18 @@ void btc_avrc_call_handler(btc_msg_t *msg)
         // todo: callback to application
         break;
     }
+    case BTC_AVRC_STATUS_API_SND_META_EVT: {
+        btc_avrc_ct_send_metadata_cmd(arg->md_cmd.tl, arg->md_cmd.attr_mask);
+        break;
+    }
+    case BTC_AVRC_NOTIFY_API_SND_REG_NOTIFY_EVT: {
+        btc_avrc_ct_send_register_notification_cmd(arg->rn_cmd.tl, arg->rn_cmd.event_id, arg->rn_cmd.event_parameter);
+        break;
+    }
+    case BTC_AVRC_CTRL_API_SET_PLAYER_SETTING_EVT: {
+        btc_avrc_ct_send_set_player_value_cmd(arg->ps_cmd.tl, arg->ps_cmd.attr_id, arg->ps_cmd.value_id);
+        break;
+    }
     default:
         LOG_WARN("%s : unhandled event: %d\n", __FUNCTION__, msg->act);
     }

components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -115,6 +115,9 @@ static esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
         case HCI_SUCCESS:
             esp_status = ESP_BT_STATUS_SUCCESS;
             break;
+        case HCI_ERR_ESP_VENDOR_FAIL:
+            esp_status = ESP_BT_STATUS_FAIL;
+            break;
         case HCI_ERR_HOST_TIMEOUT:
             esp_status = ESP_BT_STATUS_TIMEOUT;
             break;
@@ -130,6 +133,9 @@ static esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
         case HCI_ERR_ILLEGAL_PARAMETER_FMT:
             esp_status = ESP_BT_STATUS_ERR_ILLEGAL_PARAMETER_FMT;
             break;
+        case HCI_ERR_MEMORY_FULL:
+            esp_status = ESP_BT_STATUS_MEMORY_FULL;
+            break;
         default:
             esp_status = ESP_BT_STATUS_FAIL;
             break;
@@ -166,6 +172,12 @@ static esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
         case BTM_SET_PRIVACY_FAIL:
             esp_status = ESP_BT_STATUS_FAIL;
             break;
+        case BTM_INVALID_STATIC_RAND_ADDR:
+            esp_status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+            break;
+        case BTM_SET_STATIC_RAND_ADDR_FAIL:
+            esp_status = ESP_BT_STATUS_FAIL;
+            break;
         default:
             esp_status = ESP_BT_STATUS_FAIL;
             break;
@@ -438,7 +450,7 @@ static void btc_ble_set_scan_rsp_data_raw(uint8_t *raw_scan_rsp, uint32_t raw_sc
     BTA_DmBleSetScanRspRaw(raw_scan_rsp, raw_scan_rsp_len, p_scan_rsp_data_cback);
 }
 
-static void btc_start_adv_callback(tBTA_STATUS status)
+static void btc_start_adv_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
@@ -447,7 +459,7 @@ static void btc_start_adv_callback(tBTA_STATUS status)
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_ADV_START_COMPLETE_EVT;
-    param.adv_start_cmpl.status = status;
+    param.adv_start_cmpl.status = btc_hci_to_esp_status(status);
 
     ret = btc_transfer_context(&msg, &param,
                                sizeof(esp_ble_gap_cb_param_t), NULL);
@@ -457,7 +469,7 @@ static void btc_start_adv_callback(tBTA_STATUS status)
     }
 }
 
-static void btc_stop_adv_callback(tBTA_STATUS status)
+static void btc_stop_adv_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
@@ -466,7 +478,7 @@ static void btc_stop_adv_callback(tBTA_STATUS status)
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT;
-    param.adv_stop_cmpl.status = status;
+    param.adv_stop_cmpl.status = btc_hci_to_esp_status(status);
 
     ret = btc_transfer_context(&msg, &param,
                                sizeof(esp_ble_gap_cb_param_t), NULL);
@@ -479,24 +491,36 @@ static void btc_stop_adv_callback(tBTA_STATUS status)
 static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBTA_START_ADV_CMPL_CBACK start_adv_cback)
 {
     tBLE_BD_ADDR peer_addr;
-
+    esp_bt_status_t status = ESP_BT_STATUS_SUCCESS;
     if (!BLE_ISVALID_PARAM(ble_adv_params->adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
             !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+        status = ESP_BT_STATUS_PARM_INVALID;
         LOG_ERROR("Invalid advertisting interval parameters.\n");
-        return ;
     }
 
-    if ((ble_adv_params->adv_type < ADV_TYPE_IND) &&
+    if ((ble_adv_params->adv_type < ADV_TYPE_IND) ||
             (ble_adv_params->adv_type > ADV_TYPE_DIRECT_IND_LOW) ) {
+        status = ESP_BT_STATUS_PARM_INVALID;
         LOG_ERROR("Invalid advertisting type parameters.\n");
-        return;
     }
 
-    if ((ble_adv_params->adv_filter_policy < ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY) &&
+    if ((ble_adv_params->adv_filter_policy < ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY) ||
             (ble_adv_params->adv_filter_policy > ADV_FILTER_ALLOW_SCAN_WLST_CON_WLST) ) {
+        status = ESP_BT_STATUS_PARM_INVALID;
         LOG_ERROR("Invalid advertisting type parameters.\n");
+    }
+
+    if((ble_adv_params->channel_map | ADV_CHNL_ALL) != ADV_CHNL_ALL || ble_adv_params->channel_map == 0) {
+        status = ESP_BT_STATUS_PARM_INVALID;
+        LOG_ERROR("Invalid advertisting channel map parameters.\n");
+    }
+    if(status != ESP_BT_STATUS_SUCCESS) {
+        if(start_adv_cback) {
+            start_adv_cback(status);
+        }
         return;
     }
+    
     LOG_DEBUG("API_Ble_AppStartAdvertising\n");
 
     memcpy(peer_addr.bda, ble_adv_params->peer_addr, ESP_BD_ADDR_LEN);
@@ -546,8 +570,8 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA
                                      scan_params->own_addr_type,
                                      scan_param_setup_cback);
     } else {
-		btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE);
-	}
+        btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE);
+    }
 }
 
 static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
@@ -566,7 +590,7 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
         param.scan_rst.dev_type = p_data->inq_res.device_type;
         param.scan_rst.rssi = p_data->inq_res.rssi;
         param.scan_rst.ble_addr_type = p_data->inq_res.ble_addr_type;
-		param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
+        param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
         param.scan_rst.flag = p_data->inq_res.flag;
         param.scan_rst.num_resps = 1;
         param.scan_rst.adv_data_len = p_data->inq_res.adv_data_len;
@@ -601,7 +625,7 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
     btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), NULL);
 }
 
-static void btc_start_scan_callback(tBTA_STATUS status)
+static void btc_start_scan_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
@@ -688,9 +712,9 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
-    msg.act = ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT;
-    param.add_whitelist_cmpl.status = btc_hci_to_esp_status(status);
-    param.add_whitelist_cmpl.wl_opration = wl_opration;
+    msg.act = ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT;
+    param.update_whitelist_cmpl.status = btc_hci_to_esp_status(status);
+    param.update_whitelist_cmpl.wl_opration = wl_opration;
     ret = btc_transfer_context(&msg, &param,
                                sizeof(esp_ble_gap_cb_param_t), NULL);
 
@@ -699,6 +723,24 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
     }
 }
 
+static void btc_set_rand_addr_callback(UINT8 status) 
+{
+    esp_ble_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+    param.set_rand_addr_cmpl.status = btc_btm_status_to_esp_status(status); //todo status 
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT;
+    ret = btc_transfer_context(&msg, &param,
+                               sizeof(esp_ble_gap_cb_param_t), NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        LOG_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+
+}
+
 static void btc_set_local_privacy_callback(UINT8 status)
 {
     esp_ble_gap_cb_param_t param;
@@ -806,13 +848,8 @@ static void btc_ble_set_pkt_data_len(BD_ADDR remote_device, uint16_t tx_data_len
     BTA_DmBleSetDataLength(remote_device, tx_data_length, p_set_pkt_data_cback);
 }
 
-static void btc_ble_set_rand_addr (BD_ADDR rand_addr)
+static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback)
 {
-    esp_ble_gap_cb_param_t param;
-    bt_status_t ret;
-    btc_msg_t msg;
-    param.set_rand_addr_cmpl.status = ESP_BT_STATUS_SUCCESS;
-
     if (rand_addr != NULL) {
         /*
         A static address is a 48-bit randomly generated address and shall meet the following requirements:
@@ -827,25 +864,15 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr)
         if((rand_addr[0] & BT_STATIC_RAND_ADDR_MASK) == BT_STATIC_RAND_ADDR_MASK
             && memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0
             && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0){
-            BTA_DmSetRandAddress(rand_addr);
+            BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
         } else {
-            param.set_rand_addr_cmpl.status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+            btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
             LOG_ERROR("Invalid random address, the high bit should be 0b11, all bits of the random part shall not be to 1 or 0");
         }
     } else {
-        param.set_rand_addr_cmpl.status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+        btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
         LOG_ERROR("Invalid random addressm, the address value is NULL");
     }
-
-    msg.sig = BTC_SIG_API_CB;
-    msg.pid = BTC_PID_GAP_BLE;
-    msg.act = ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT;
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_ble_gap_cb_param_t), NULL);
-
-    if (ret != BT_STATUS_SUCCESS) {
-        LOG_ERROR("%s btc_transfer_context failed\n", __func__);
-    }
 }
 
 static void btc_ble_config_local_privacy(bool privacy_enable, tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback)
@@ -1042,12 +1069,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
     case BTC_GAP_BLE_ACT_SET_RAND_ADDRESS: {
         BD_ADDR bd_addr;
         memcpy(bd_addr, arg->set_rand_addr.rand_addr, sizeof(BD_ADDR));
-        btc_ble_set_rand_addr(bd_addr);
+        btc_ble_set_rand_addr(bd_addr, btc_set_rand_addr_callback);
         break;
     }
     case BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY:
         btc_ble_config_local_privacy(arg->cfg_local_privacy.privacy_enable, btc_set_local_privacy_callback);
-        break;    
+        break;
     case BTC_GAP_BLE_ACT_UPDATE_WHITE_LIST:
         BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, btc_add_whitelist_complete_callback);
         break;
@@ -1113,12 +1140,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                 STREAM_TO_UINT8(key_size, arg->set_security_param.value);
                 bta_dm_co_ble_set_max_key_size(key_size);
                 break;
-            }        
+            }
             default:
                 break;
         }
         break;
-    }        
+    }
     case BTC_GAP_BLE_SECURITY_RSP_EVT: {
         BD_ADDR bd_addr;
         tBTA_DM_BLE_SEC_GRANT res = arg->sec_rsp.accept ? BTA_DM_SEC_GRANTED : BTA_DM_SEC_PAIR_NOT_SPT;

components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -196,7 +196,7 @@ static void btc_gattc_app_unregister(btc_ble_gattc_args_t *arg)
 static void btc_gattc_open(btc_ble_gattc_args_t *arg)
 {
     tBTA_GATT_TRANSPORT transport = BTA_GATT_TRANSPORT_LE;
-    BTA_GATTC_Open(arg->open.gattc_if, arg->open.remote_bda, arg->open.is_direct, transport);
+    BTA_GATTC_Open(arg->open.gattc_if, arg->open.remote_bda, arg->open.remote_addr_type, arg->open.is_direct, transport);
 }
 
 static void btc_gattc_close(btc_ble_gattc_args_t *arg)
@@ -253,7 +253,7 @@ static void btc_gattc_fill_gatt_db_conversion(uint16_t count, uint16_t num, esp_
         }
         case ESP_GATT_DB_DESCRIPTOR: {
             esp_gattc_descr_elem_t *descr_result = (esp_gattc_descr_elem_t *)result;
-            for (int i = 0; i < (num - offset); i++) {
+            for (int i = 0; i < db_size; i++) {
                 descr_result->handle = db[offset + i].attribute_handle;
                 btc128_to_bta_uuid(&bta_uuid, db[offset + i].uuid.uu);
                 bta_to_btc_uuid(&descr_result->uuid, &bta_uuid);
@@ -770,6 +770,7 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
         param.write.conn_id = BTC_GATT_GET_CONN_ID(write->conn_id);
         param.write.status = write->status;
         param.write.handle = write->handle;
+        param.write.offset = write->offset;
         btc_gattc_cb_to_app(ret_evt, gattc_if, &param);
         break;
     }
@@ -913,8 +914,19 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
         break;
     }
     case BTA_GATTC_SRVC_CHG_EVT: {
-        memcpy(param.srvc_chg.remote_bda, arg->remote_bda, sizeof(esp_bd_addr_t));
-        btc_gattc_cb_to_app(ESP_GATTC_SRVC_CHG_EVT, ESP_GATT_IF_NONE, &param);
+        tBTA_GATTC_SERVICE_CHANGE *srvc_change = &arg->srvc_chg;
+        gattc_if = BTC_GATT_GET_GATT_IF(srvc_change->conn_id);
+        memcpy(param.srvc_chg.remote_bda, srvc_change->remote_bda, sizeof(esp_bd_addr_t));
+        btc_gattc_cb_to_app(ESP_GATTC_SRVC_CHG_EVT, gattc_if, &param);
+        break;
+    }
+    case BTA_GATTC_QUEUE_FULL_EVT: {
+        tBTA_GATTC_QUEUE_FULL *queue_full = &arg->queue_full;
+        gattc_if = BTC_GATT_GET_GATT_IF(queue_full->conn_id);
+        param.queue_full.conn_id = BTC_GATT_GET_CONN_ID(queue_full->conn_id);
+        param.queue_full.status = arg->status;
+        param.queue_full.is_full = queue_full->is_full;
+        btc_gattc_cb_to_app(ESP_GATTC_QUEUE_FULL_EVT, gattc_if, &param);
         break;
     }
     default:

components/bt/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -832,7 +832,7 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
         param.add_char_descr.status = p_data->add_result.status;
         param.add_char_descr.attr_handle = p_data->add_result.attr_id;
         param.add_char_descr.service_handle = p_data->add_result.service_id;
-        bta_to_btc_uuid(&param.add_char_descr.char_uuid, &p_data->add_result.char_uuid);
+        bta_to_btc_uuid(&param.add_char_descr.descr_uuid, &p_data->add_result.char_uuid);
 
         btc_gatts_cb_to_app(ESP_GATTS_ADD_CHAR_DESCR_EVT, gatts_if, &param);
         break;

components/bt/bluedroid/btc/profile/std/include/btc_avrc.h

@@ -28,18 +28,14 @@
 #define BTC_AVRC_TGT_INCLUDED      FALSE
 #endif
 
-/* Macros */
-typedef enum {
-    BTRC_FEAT_NONE = 0x00,    /* AVRCP 1.0 */
-    BTRC_FEAT_METADATA = 0x01,    /* AVRCP 1.3 */
-    BTRC_FEAT_ABSOLUTE_VOLUME = 0x02,    /* Supports TG role and volume sync */
-    BTRC_FEAT_BROWSE = 0x04,    /* AVRCP 1.4 and up, with Browsing support */
-} btrc_remote_features_t;
-
 typedef enum {
     BTC_AVRC_CTRL_API_INIT_EVT = 0,
     BTC_AVRC_CTRL_API_DEINIT_EVT,
-    BTC_AVRC_CTRL_API_SND_PTCMD_EVT
+    BTC_AVRC_CTRL_API_SND_PTCMD_EVT,
+    BTC_AVRC_STATUS_API_SND_META_EVT,
+    BTC_AVRC_STATUS_API_SND_PLAY_STATUS_EVT,
+    BTC_AVRC_NOTIFY_API_SND_REG_NOTIFY_EVT,
+    BTC_AVRC_CTRL_API_SET_PLAYER_SETTING_EVT
 } btc_avrc_act_t;
 
 typedef struct {
@@ -48,14 +44,29 @@ typedef struct {
     uint8_t key_state;
 } pt_cmd_t;
 
+typedef struct {
+    uint8_t tl;
+    uint8_t attr_mask;
+} md_cmd_t;
+
+typedef struct {
+    uint8_t tl;
+    uint8_t event_id;
+    uint32_t event_parameter;
+} rn_cmd_t;
+
+typedef struct {
+    uint8_t tl;
+    uint8_t attr_id;
+    uint8_t value_id;
+} ps_cmd_t;
+
 /* btc_avrc_args_t */
 typedef union {
-    // BTC_AVRC_CTRL_API_SND_PT_CMD_EVT
-    struct {
-        uint8_t tl;
-        uint8_t key_code;
-        uint8_t key_state;
-    } pt_cmd;
+    pt_cmd_t pt_cmd;
+    md_cmd_t md_cmd;
+    rn_cmd_t rn_cmd;
+    ps_cmd_t ps_cmd;
 } btc_avrc_args_t;
 
 /** BT-RC Controller callback structure. */

components/bt/bluedroid/btc/profile/std/include/btc_gattc.h

@@ -54,6 +54,7 @@ typedef union {
     struct open_arg {
         esp_gatt_if_t gattc_if;
         esp_bd_addr_t remote_bda;
+        esp_ble_addr_type_t remote_addr_type;
         bool is_direct;
     } open;
     //BTC_GATTC_ACT_CLOSE,

components/bt/bluedroid/btcore/bdaddr.c

@@ -102,10 +102,13 @@ bool string_to_bdaddr(const char *string, bt_bdaddr_t *addr)
 
     bt_bdaddr_t new_addr;
     uint8_t *ptr = new_addr.address;
-    bool ret = sscanf(string, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
-                      &ptr[0], &ptr[1], &ptr[2], &ptr[3], &ptr[4], &ptr[5]) == 6;
-
+    uint32_t ptr_32[6];
+    bool ret  = sscanf(string, "%02x:%02x:%02x:%02x:%02x:%02x",
+                      &ptr_32[0], &ptr_32[1], &ptr_32[2], &ptr_32[3], &ptr_32[4], &ptr_32[5]) == 6;
     if (ret) {
+        for (uint8_t i = 0; i < 6; i++){
+            ptr[i] = (uint8_t) ptr_32[i];
+        }
         memcpy(addr, &new_addr, sizeof(bt_bdaddr_t));
     }
 

components/bt/bluedroid/btif/bta_dm_co.c

@@ -492,7 +492,7 @@ void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key)
 {
 #if (SMP_INCLUDED == TRUE)
    rsp_key &= 0x0f;  // 4~7bit reservd, only used the 0~3bit
-   bte_appl_cfg.ble_init_key &= rsp_key;
+   bte_appl_cfg.ble_resp_key &= rsp_key;
 #endif  ///SMP_INCLUDED == TRUE
 }
 

components/bt/bluedroid/device/controller.c

@@ -66,6 +66,7 @@ static uint8_t ble_resolving_list_max_size;
 static uint8_t ble_supported_states[BLE_SUPPORTED_STATES_SIZE];
 static bt_device_features_t features_ble;
 static uint16_t ble_suggested_default_data_length;
+static uint16_t ble_suggested_default_data_txtime;
 
 static bool readable;
 static bool ble_supported;
@@ -228,7 +229,8 @@ static void start_up(void)
             response = AWAIT_COMMAND(packet_factory->make_ble_read_suggested_default_data_length());
             packet_parser->parse_ble_read_suggested_default_data_length_response(
                 response,
-                &ble_suggested_default_data_length);
+                &ble_suggested_default_data_length,
+                &ble_suggested_default_data_txtime);
         }
 
         // Set the ble event mask next
@@ -404,6 +406,13 @@ static uint16_t get_ble_suggested_default_data_length(void)
     return ble_suggested_default_data_length;
 }
 
+static uint16_t get_ble_suggested_default_data_txtime(void)
+{
+    assert(readable);
+    assert(ble_supported);
+    return ble_suggested_default_data_txtime;
+}
+
 static uint16_t get_acl_buffer_count_classic(void)
 {
     assert(readable);
@@ -472,6 +481,7 @@ static const controller_t interface = {
     get_acl_packet_size_classic,
     get_acl_packet_size_ble,
     get_ble_suggested_default_data_length,
+    get_ble_suggested_default_data_txtime,
 
     get_acl_buffer_count_classic,
     get_acl_buffer_count_ble,

components/bt/bluedroid/device/include/controller.h

@@ -69,6 +69,7 @@ typedef struct controller_t {
     uint16_t (*get_acl_packet_size_ble)(void);
 
     uint16_t (*get_ble_default_data_packet_length)(void);
+    uint16_t (*get_ble_default_data_packet_txtime)(void);
 
     // Get the number of acl packets the controller can buffer.
     uint16_t (*get_acl_buffer_count_classic)(void);

components/bt/bluedroid/hci/hci_hal_h4.c

@@ -25,7 +25,7 @@
 #include "hci_internals.h"
 #include "hci_layer.h"
 #include "thread.h"
-#include "bt.h"
+#include "esp_bt.h"
 
 #define HCI_HAL_SERIAL_BUFFER_SIZE 1026
 #define HCI_BLE_EVENT 0x3e

components/bt/bluedroid/hci/hci_layer.c

@@ -16,7 +16,7 @@
  *
  ******************************************************************************/
 #include <string.h>
-#include "bt.h"
+#include "esp_bt.h"
 #include "bt_defs.h"
 #include "bt_trace.h"
 #include "hcidefs.h"
@@ -40,7 +40,6 @@ typedef struct {
     command_complete_cb complete_callback;
     command_status_cb status_callback;
     void *context;
-    uint32_t sent_time;
     BT_HDR *command;
 } waiting_command_t;
 
@@ -90,9 +89,7 @@ static void hci_layer_deinit_env(void);
 static void hci_host_thread_handler(void *arg);
 static void event_command_ready(fixed_queue_t *queue);
 static void event_packet_ready(fixed_queue_t *queue);
-static void restart_comamnd_waiting_response_timer(
-    command_waiting_response_t *cmd_wait_q,
-    bool tigger_by_sending_command);
+static void restart_command_waiting_response_timer(command_waiting_response_t *cmd_wait_q);
 static void command_timed_out(void *context);
 static void hal_says_packet_ready(BT_HDR *packet);
 static bool filter_incoming_event(BT_HDR *packet);
@@ -330,8 +327,7 @@ static void event_command_ready(fixed_queue_t *queue)
     // Send it off
     packet_fragmenter->fragment_and_dispatch(wait_entry->command);
 
-    wait_entry->sent_time = osi_alarm_now();
-    restart_comamnd_waiting_response_timer(cmd_wait_q, true);
+    restart_command_waiting_response_timer(cmd_wait_q);
 }
 
 static void event_packet_ready(fixed_queue_t *queue)
@@ -377,41 +373,18 @@ static void fragmenter_transmit_finished(BT_HDR *packet, bool all_fragments_sent
     }
 }
 
-static void restart_comamnd_waiting_response_timer(
-    command_waiting_response_t *cmd_wait_q,
-    bool tigger_by_sending_command)
+static void restart_command_waiting_response_timer(command_waiting_response_t *cmd_wait_q)
 {
-    uint32_t timeout;
-    waiting_command_t *wait_entry;
-    if (!cmd_wait_q) {
-        return;
-    }
-
+    osi_mutex_lock(&cmd_wait_q->commands_pending_response_lock, OSI_MUTEX_MAX_TIMEOUT);
     if (cmd_wait_q->timer_is_set) {
-        if (tigger_by_sending_command) {
-            return;
-        }
-
-        //Cancel Previous command timeout timer setted when sending command
         osi_alarm_cancel(cmd_wait_q->command_response_timer);
         cmd_wait_q->timer_is_set = false;
     }
-
-    osi_mutex_lock(&cmd_wait_q->commands_pending_response_lock, OSI_MUTEX_MAX_TIMEOUT);
-    wait_entry = (list_is_empty(cmd_wait_q->commands_pending_response) ?
-                  NULL : list_front(cmd_wait_q->commands_pending_response));
-    osi_mutex_unlock(&cmd_wait_q->commands_pending_response_lock);
-
-    if (wait_entry == NULL) {
-        return;
+    if (!list_is_empty(cmd_wait_q->commands_pending_response)) {
+        osi_alarm_set(cmd_wait_q->command_response_timer, COMMAND_PENDING_TIMEOUT);
+        cmd_wait_q->timer_is_set = true;
     }
-
-    timeout = osi_alarm_time_diff(osi_alarm_now(), wait_entry->sent_time);
-    timeout = osi_alarm_time_diff(COMMAND_PENDING_TIMEOUT, timeout);
-    timeout = (timeout <= COMMAND_PENDING_TIMEOUT) ? timeout : COMMAND_PENDING_TIMEOUT;
-
-    cmd_wait_q->timer_is_set = true;
-    osi_alarm_set(cmd_wait_q->command_response_timer, timeout);
+    osi_mutex_unlock(&cmd_wait_q->commands_pending_response_lock);
 }
 
 static void command_timed_out(void *context)
@@ -493,7 +466,7 @@ static bool filter_incoming_event(BT_HDR *packet)
 
     return false;
 intercepted:
-    restart_comamnd_waiting_response_timer(&hci_host_env.cmd_waiting_q, false);
+    restart_command_waiting_response_timer(&hci_host_env.cmd_waiting_q);
 
     /*Tell HCI Host Task to continue TX Pending commands*/
     if (hci_host_env.command_credits &&

components/bt/bluedroid/hci/hci_packet_parser.c

@@ -183,12 +183,13 @@ static void parse_ble_read_resolving_list_size_response(
 
 static void parse_ble_read_suggested_default_data_length_response(
     BT_HDR *response,
-    uint16_t *ble_default_packet_length_ptr)
+    uint16_t *ble_default_packet_length_ptr,
+    uint16_t *ble_default_packet_txtime_ptr)
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
-    STREAM_TO_UINT8(*ble_default_packet_length_ptr, stream);
-
+    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
+    STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
     buffer_allocator->free(response);
 }
 

components/bt/bluedroid/hci/include/hci_packet_parser.h

@@ -90,7 +90,8 @@ typedef struct {
 
     void (*parse_ble_read_suggested_default_data_length_response)(
         BT_HDR *response,
-        uint16_t *ble_default_packet_length_ptr
+        uint16_t *ble_default_packet_length_ptr,
+        uint16_t *ble_default_packet_txtime_ptr
     );
 } hci_packet_parser_t;
 

components/bt/bluedroid/include/bt_defs.h

@@ -90,6 +90,7 @@ typedef enum {
     BT_STATUS_UNACCEPT_CONN_INTERVAL,
     BT_STATUS_PARAM_OUT_OF_RANGE,
     BT_STATUS_TIMEOUT,
+    BT_STATUS_MEMORY_FULL,
 } bt_status_t;
 
 #ifndef CPU_LITTLE_ENDIAN

components/bt/bluedroid/include/bt_target.h

@@ -647,7 +647,8 @@
 
 /* 4.1/4.2 secure connections feature */
 #ifndef SC_MODE_INCLUDED
-#define SC_MODE_INCLUDED                TRUE
+// Disable AES-CCM (BT 4.1) for BT Classic to workaround controller AES issue. E0 encryption (BT 4.0) will be used.
+#define SC_MODE_INCLUDED                FALSE
 #endif
 
 /* Used for conformance testing ONLY */

components/bt/bluedroid/osi/alarm.c

@@ -23,22 +23,18 @@
 #include "alarm.h"
 #include "allocator.h"
 #include "list.h"
-#include "thread.h"
-#include "freertos/FreeRTOSConfig.h"
-#include "freertos/xtensa_api.h"
-#include "rom/ets_sys.h"
+#include "esp_timer.h"
 #include "btc_task.h"
 #include "btc_alarm.h"
 #include "mutex.h"
-#include "time.h"
 
-#define RTC_TIMER_TICKS_TO_MS(ticks)            (((ticks/625)<<1) + (ticks-(ticks/625)*625)/312)
-
-
-#define BT_ALARM_START_WAIT_TICKS   100
-#define BT_ALARM_STOP_WAIT_TICKS    100
-#define BT_ALARM_FREE_WAIT_TICKS    100
-#define BT_ALARM_CHG_PERIOD_WAIT_TICKS  100
+typedef struct alarm_t {
+    /* timer id point to here */
+    esp_timer_handle_t alarm_hdl;
+    osi_alarm_callback_t cb;
+    void *cb_data;
+    int64_t deadline_us;
+} osi_alarm_t;
 
 enum {
     ALARM_STATE_IDLE,
@@ -50,7 +46,7 @@ static int alarm_state;
 
 static struct alarm_t alarm_cbs[ALARM_CBS_NUM];
 
-static int alarm_free(osi_alarm_t *alarm);
+static osi_alarm_err_t alarm_free(osi_alarm_t *alarm);
 
 int osi_alarm_create_mux(void)
 {
@@ -71,11 +67,11 @@ int osi_alarm_delete_mux(void)
     osi_mutex_free(&alarm_mutex);
     return 0;
 }
-    
+
 void osi_alarm_init(void)
 {
     assert(alarm_mutex != NULL);
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_IDLE) {
         LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
@@ -83,7 +79,7 @@ void osi_alarm_init(void)
     }
     memset(alarm_cbs, 0x00, sizeof(alarm_cbs));
     alarm_state = ALARM_STATE_OPEN;
-    
+
 end:
     osi_mutex_unlock(&alarm_mutex);
 }
@@ -91,13 +87,13 @@ end:
 void osi_alarm_deinit(void)
 {
     assert(alarm_mutex != NULL);
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
         goto end;
     }
-    
+
     for (int i = 0; i < ALARM_CBS_NUM; i++) {
         if (alarm_cbs[i].alarm_hdl != NULL) {
             alarm_free(&alarm_cbs[i]);
@@ -123,17 +119,13 @@ static struct alarm_t *alarm_cbs_lookfor_available(void)
     return NULL;
 }
 
-static void alarm_cb_handler(TimerHandle_t xTimer)
+static void alarm_cb_handler(struct alarm_t *alarm)
 {
-    struct alarm_t *alarm;
-    if (!xTimer) {
-        LOG_ERROR("TimerName: NULL\n");
+    LOG_DEBUG("TimerID %p\n", alarm);
+    if (alarm_state != ALARM_STATE_OPEN) {
+        LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
         return;
     }
-    
-    alarm = pvTimerGetTimerID(xTimer);
-    LOG_DEBUG("TimerID %p, Name %s\n", alarm, pcTimerGetTimerName(xTimer));
-    
     btc_msg_t msg;
     btc_alarm_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
@@ -143,19 +135,19 @@ static void alarm_cb_handler(TimerHandle_t xTimer)
     btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL);
 }
 
-osi_alarm_t *osi_alarm_new(char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire)
+osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire)
 {
     assert(alarm_mutex != NULL);
 
     struct alarm_t *timer_id = NULL;
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
         timer_id = NULL;
         goto end;
     }
-    
+
     timer_id = alarm_cbs_lookfor_available();
 
     if (!timer_id) {
@@ -164,161 +156,134 @@ osi_alarm_t *osi_alarm_new(char *alarm_name, osi_alarm_callback_t callback, void
         goto end;
     }
 
-    if (timer_expire == 0) {
-        timer_expire = 1000;
-    }
+    esp_timer_create_args_t tca;
+    tca.callback = (esp_timer_cb_t)alarm_cb_handler;
+    tca.arg = timer_id;
+    tca.dispatch_method = ESP_TIMER_TASK;
+    tca.name = alarm_name;
 
-    TimerHandle_t t = xTimerCreate(alarm_name, timer_expire / portTICK_PERIOD_MS, pdFALSE, timer_id, alarm_cb_handler);
-    if (!t) {
-        LOG_ERROR("%s failed to create timer\n", __func__);
+    timer_id->cb = callback;
+    timer_id->cb_data = data;
+    timer_id->deadline_us = 0;
+
+    esp_err_t stat = esp_timer_create(&tca, &timer_id->alarm_hdl);
+    if (stat != ESP_OK) {
+        LOG_ERROR("%s failed to create timer, err 0x%x\n", __func__, stat);
         timer_id = NULL;
         goto end;
     }
 
-    timer_id->alarm_hdl = t;
-    timer_id->cb = callback;
-    timer_id->cb_data = data;
-
 end:
     osi_mutex_unlock(&alarm_mutex);
     return timer_id;
 }
 
-static int alarm_free(osi_alarm_t *alarm)
+static osi_alarm_err_t alarm_free(osi_alarm_t *alarm)
 {
     if (!alarm || alarm->alarm_hdl == NULL) {
         LOG_ERROR("%s null\n", __func__);
-        return -1;
+        return OSI_ALARM_ERR_INVALID_ARG;
     }
 
-    if (xTimerDelete(alarm->alarm_hdl, BT_ALARM_FREE_WAIT_TICKS) != pdPASS) {
-        LOG_ERROR("%s alarm delete error\n", __func__);
-        return -2;
+    esp_timer_stop(alarm->alarm_hdl);
+    esp_err_t stat = esp_timer_delete(alarm->alarm_hdl);
+    if (stat != ESP_OK) {
+        LOG_ERROR("%s failed to delete timer, err 0x%x\n", __func__, stat);
+        return OSI_ALARM_ERR_FAIL;
     }
-    
+
     memset(alarm, 0, sizeof(osi_alarm_t));
-    return 0;
+    return OSI_ALARM_ERR_PASS;
 }
 
-int osi_alarm_free(osi_alarm_t *alarm)
+void osi_alarm_free(osi_alarm_t *alarm)
 {
     assert(alarm_mutex != NULL);
-    
-    int ret = 0;
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
-        ret = -3;
         goto end;
     }
     alarm_free(alarm);
 
 end:
     osi_mutex_unlock(&alarm_mutex);
-    return ret;
+    return;
 }
 
-
-int osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
+osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
 {
     assert(alarm_mutex != NULL);
-    
-    int ret = 0;
+
+    osi_alarm_err_t ret = OSI_ALARM_ERR_PASS;
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
-        ret = -3;
-        goto end;
-    }
-    
-    if (!alarm || alarm->alarm_hdl == NULL) {
-        LOG_ERROR("%s null\n", __func__);
-        ret = -1;
-        goto end;
-    }
-    
-    if (xTimerChangePeriod(alarm->alarm_hdl, timeout / portTICK_PERIOD_MS, BT_ALARM_CHG_PERIOD_WAIT_TICKS) != pdPASS) {
-        LOG_ERROR("%s chg period error\n", __func__);
-        ret = -2;
+        ret = OSI_ALARM_ERR_INVALID_STATE;
         goto end;
     }
 
-    if (xTimerStart(alarm->alarm_hdl, BT_ALARM_START_WAIT_TICKS) != pdPASS) {
-        LOG_ERROR("%s start error\n", __func__);
-        ret = -2;
+    if (!alarm || alarm->alarm_hdl == NULL) {
+        LOG_ERROR("%s null\n", __func__);
+        ret = OSI_ALARM_ERR_INVALID_ARG;
         goto end;
     }
 
+    int64_t timeout_us = 1000 * (int64_t)timeout;
+    esp_err_t stat = esp_timer_start_once(alarm->alarm_hdl, (uint64_t)timeout_us);
+    if (stat != ESP_OK) {
+        LOG_ERROR("%s failed to start timer, err 0x%x\n", __func__, stat);
+        ret = OSI_ALARM_ERR_FAIL;
+        goto end;
+    }
+    alarm->deadline_us = timeout_us + esp_timer_get_time();
+
 end:
     osi_mutex_unlock(&alarm_mutex);
     return ret;
 }
 
-
-int osi_alarm_cancel(osi_alarm_t *alarm)
+osi_alarm_err_t osi_alarm_cancel(osi_alarm_t *alarm)
 {
-    int ret = 0;
+    int ret = OSI_ALARM_ERR_PASS;
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
-        ret = -3;
+        ret = OSI_ALARM_ERR_INVALID_STATE;
         goto end;
     }
-    
+
     if (!alarm || alarm->alarm_hdl == NULL) {
         LOG_ERROR("%s null\n", __func__);
-        ret = -1;
+        ret = OSI_ALARM_ERR_INVALID_ARG;
         goto end;
     }
 
-    if (xTimerStop(alarm->alarm_hdl, BT_ALARM_STOP_WAIT_TICKS) != pdPASS) {
-        LOG_ERROR("%s failed to stop timer\n", __func__);
-        ret = -2;
+    esp_err_t stat = esp_timer_stop(alarm->alarm_hdl);
+    if (stat != ESP_OK) {
+        LOG_DEBUG("%s failed to stop timer, err 0x%x\n", __func__, stat);
+        ret = OSI_ALARM_ERR_FAIL;
         goto end;
     }
-
 end:
     osi_mutex_unlock(&alarm_mutex);
     return ret;
 }
 
-static uint32_t alarm_current_tick(void)
-{
-    return xTaskGetTickCount();
-}
-
-// todo: this is not accurate
-// max return value: 0xffffffff / 312 = 13765920 = 0xD20D20
-period_ms_t osi_alarm_now(void)
-{
-    return RTC_TIMER_TICKS_TO_MS((alarm_current_tick()));
-}
-
 period_ms_t osi_alarm_get_remaining_ms(const osi_alarm_t *alarm)
 {
-    /* TODO: use FreeRTOS timer.c implement ??? */
-    return 0xffffffff;
-}
+    assert(alarm_mutex != NULL);
+    int64_t dt_us = 0;
 
-// pre-condition: 0 <= t1, t2 <= 0xD20D20
-// return value: 0<= ret <=0XD20D20
-period_ms_t osi_alarm_time_diff(period_ms_t t1, period_ms_t t2)
-{
-#define MAX_ALARM_TIME_MS     (0xD20D20)
-    int32_t diff = (int32_t)(t1) - (int32_t)(t2);
-    if (diff < 0) {
-        diff += MAX_ALARM_TIME_MS;
-    }
-    return (period_ms_t)diff;
+    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
+    dt_us = alarm->deadline_us - esp_timer_get_time();
+    osi_mutex_unlock(&alarm_mutex);
+
+    return (dt_us > 0) ? (period_ms_t)(dt_us / 1000) : 0;
 }
 
 uint32_t osi_time_get_os_boottime_ms(void)
 {
-    return RTC_TIMER_TICKS_TO_MS((alarm_current_tick()));
+    return (uint32_t)(esp_timer_get_time() / 1000);
 }
-
-void osi_delay_ms(uint32_t ms)
-{
-    vTaskDelay(ms / portTICK_PERIOD_MS);
-}
-

components/bt/bluedroid/osi/config.c

@@ -28,8 +28,9 @@
 #include "list.h"
 #include "bt_trace.h"
 
-#define CONFIG_FILE_MAX_SIZE      (2048)
-#define CONFIG_KEY                "bt_cfg_key"
+#define CONFIG_FILE_MAX_SIZE             (1536)//1.5k
+#define CONFIG_FILE_DEFAULE_LENGTH       (2048)
+#define CONFIG_KEY                       "bt_cfg_key"
 typedef struct {
     char *key;
     char *value;
@@ -134,7 +135,7 @@ bool config_has_key(const config_t *config, const char *section, const char *key
 }
 
 bool config_has_key_in_section(config_t *config, char *key, char *key_value)
-{
+{
     LOG_DEBUG("key = %s, value = %s", key, key_value);
     for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
         const section_t *section = (const section_t *)list_node(node);
@@ -302,6 +303,78 @@ const char *config_section_name(const config_section_node_t *node)
     return section->name;
 }
 
+static int get_config_size(const config_t *config)
+{
+    assert(config != NULL);
+
+    int w_len = 0, total_size = 0;
+
+    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
+        const section_t *section = (const section_t *)list_node(node);
+        w_len = strlen(section->name) + strlen("[]\n");// format "[section->name]\n"
+        total_size += w_len;
+
+        for (const list_node_t *enode = list_begin(section->entries); enode != list_end(section->entries); enode = list_next(enode)) {
+            const entry_t *entry = (const entry_t *)list_node(enode);
+            w_len = strlen(entry->key) + strlen(entry->value) + strlen(" = \n");// format "entry->key = entry->value\n"
+            total_size += w_len;
+        }
+
+        // Only add a separating newline if there are more sections.
+        if (list_next(node) != list_end(config->sections)) {
+                total_size ++;  //'\n'
+        } else {
+            break;
+        }
+    }
+    total_size ++; //'\0'
+    return total_size;
+}
+
+static int get_config_size_from_flash(nvs_handle fp)
+{
+    assert(fp != 0);
+
+    esp_err_t err;
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    if (!keyname){
+        LOG_ERROR("%s, malloc error\n", __func__);
+        return 0;
+    }
+    size_t length = CONFIG_FILE_DEFAULE_LENGTH;
+    size_t total_length = 0;
+    uint16_t i = 0;
+    snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, 0);
+    err = nvs_get_blob(fp, keyname, NULL, &length);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        osi_free(keyname);
+        return 0;
+    }
+    if (err != ESP_OK) {
+        LOG_ERROR("%s, error %d\n", __func__, err);
+        osi_free(keyname);
+        return 0;
+    }
+    total_length += length;
+    while (length == CONFIG_FILE_MAX_SIZE) {
+        length = CONFIG_FILE_DEFAULE_LENGTH;
+        snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, ++i);
+        err = nvs_get_blob(fp, keyname, NULL, &length);
+
+        if (err == ESP_ERR_NVS_NOT_FOUND) {
+            break;
+        }
+        if (err != ESP_OK) {
+            LOG_ERROR("%s, error %d\n", __func__, err);
+            osi_free(keyname);
+            return 0;
+        }
+        total_length += length;
+    }
+    osi_free(keyname);
+    return total_length;
+}
+
 bool config_save(const config_t *config, const char *filename)
 {
     assert(config != NULL);
@@ -312,8 +385,10 @@ bool config_save(const config_t *config, const char *filename)
     int err_code = 0;
     nvs_handle fp;
     char *line = osi_calloc(1024);
-    char *buf = osi_calloc(CONFIG_FILE_MAX_SIZE);
-    if (!line || !buf) {
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    int config_size = get_config_size(config);
+    char *buf = osi_calloc(config_size + 100);
+    if (!line || !buf || !keyname) {
         err_code |= 0x01;
         goto error;
     }
@@ -333,45 +408,53 @@ bool config_save(const config_t *config, const char *filename)
         const section_t *section = (const section_t *)list_node(node);
         w_cnt = snprintf(line, 1024, "[%s]\n", section->name);
         LOG_DEBUG("section name: %s, w_cnt + w_cnt_total = %d\n", section->name, w_cnt + w_cnt_total);
-        if (w_cnt + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-            memcpy(buf + w_cnt_total, line, w_cnt);
-            w_cnt_total += w_cnt;
-        } else {
-            break;
-        }
+        memcpy(buf + w_cnt_total, line, w_cnt);
+        w_cnt_total += w_cnt;
 
         for (const list_node_t *enode = list_begin(section->entries); enode != list_end(section->entries); enode = list_next(enode)) {
             const entry_t *entry = (const entry_t *)list_node(enode);
             LOG_DEBUG("(key, val): (%s, %s)\n", entry->key, entry->value);
             w_cnt = snprintf(line, 1024, "%s = %s\n", entry->key, entry->value);
             LOG_DEBUG("%s, w_cnt + w_cnt_total = %d", __func__, w_cnt + w_cnt_total);
-            if (w_cnt + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-                memcpy(buf + w_cnt_total, line, w_cnt);
-                w_cnt_total += w_cnt;
-            } else {
-                break;
-            }
+            memcpy(buf + w_cnt_total, line, w_cnt);
+            w_cnt_total += w_cnt;
         }
 
         // Only add a separating newline if there are more sections.
         if (list_next(node) != list_end(config->sections)) {
-            if (1 + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-                buf[w_cnt_total] = '\n';
-                w_cnt_total += 1;
-            }
+            buf[w_cnt_total] = '\n';
+            w_cnt_total += 1;
         } else {
             break;
         }
     }
-
     buf[w_cnt_total] = '\0';
-
-    err = nvs_set_blob(fp, CONFIG_KEY, buf, w_cnt_total);
-
-    if (err != ESP_OK) {
-        nvs_close(fp);
-        err_code |= 0x04;
-        goto error;
+    if (w_cnt_total < CONFIG_FILE_MAX_SIZE) {
+        snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, 0);
+        err = nvs_set_blob(fp, keyname, buf, w_cnt_total);
+        if (err != ESP_OK) {
+            nvs_close(fp);
+            err_code |= 0x04;
+            goto error;
+        }
+    }else {
+        uint count = (w_cnt_total / CONFIG_FILE_MAX_SIZE);
+        for (int i = 0; i <= count; i++)
+        {
+            snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, i);
+            if (i == count) {
+                err = nvs_set_blob(fp, keyname, buf + i*CONFIG_FILE_MAX_SIZE, w_cnt_total - i*CONFIG_FILE_MAX_SIZE);
+                LOG_DEBUG("save keyname = %s, i = %d, %d\n", keyname, i, w_cnt_total - i*CONFIG_FILE_MAX_SIZE);
+            }else {
+                err = nvs_set_blob(fp, keyname, buf + i*CONFIG_FILE_MAX_SIZE, CONFIG_FILE_MAX_SIZE);
+                LOG_DEBUG("save keyname = %s, i = %d, %d\n", keyname, i, CONFIG_FILE_MAX_SIZE);
+            }
+            if (err != ESP_OK) {
+                nvs_close(fp);
+                err_code |= 0x04;
+                goto error;
+            }
+        }
     }
 
     err = nvs_commit(fp);
@@ -384,6 +467,7 @@ bool config_save(const config_t *config, const char *filename)
     nvs_close(fp);
     osi_free(line);
     osi_free(buf);
+    osi_free(keyname);
     return true;
 
 error:
@@ -393,6 +477,9 @@ error:
     if (line) {
         osi_free(line);
     }
+    if (keyname) {
+        osi_free(keyname);
+    }
     if (err_code) {
         LOG_ERROR("%s, err_code: 0x%x\n", __func__, err_code);
     }
@@ -423,29 +510,50 @@ static void config_parse(nvs_handle fp, config_t *config)
     assert(fp != 0);
     assert(config != NULL);
 
+    esp_err_t err;
     int line_num = 0;
     int err_code = 0;
+    uint16_t i = 0;
+    size_t length = CONFIG_FILE_DEFAULE_LENGTH;
+    size_t total_length = 0;
     char *line = osi_calloc(1024);
     char *section = osi_calloc(1024);
-    char *buf = osi_calloc(CONFIG_FILE_MAX_SIZE);
-    if (!line || !section || !buf) {
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    int buf_size = get_config_size_from_flash(fp);
+    char *buf = osi_calloc(buf_size + 100);
+    if (!line || !section || !buf || !keyname) {
         err_code |= 0x01;
         goto error;
     }
-
-    esp_err_t err;
-    size_t length = CONFIG_FILE_MAX_SIZE;
-    err = nvs_get_blob(fp, CONFIG_KEY, buf, &length);
+    snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, 0);
+    err = nvs_get_blob(fp, keyname, buf, &length);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        goto error;
+    }
     if (err != ESP_OK) {
         err_code |= 0x02;
         goto error;
     }
+    total_length += length;
+    while (length == CONFIG_FILE_MAX_SIZE) {
+        length = CONFIG_FILE_DEFAULE_LENGTH;
+        snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, ++i);
+        err = nvs_get_blob(fp, keyname, buf + CONFIG_FILE_MAX_SIZE * i, &length);
 
+        if (err == ESP_ERR_NVS_NOT_FOUND) {
+            break;
+        }
+        if (err != ESP_OK) {
+            err_code |= 0x02;
+            goto error;
+        }
+        total_length += length;
+    }
     char *p_line_end;
     char *p_line_bgn = buf;
     strcpy(section, CONFIG_DEFAULT_SECTION);
 
-    while ( (p_line_bgn < buf + length - 1) && (p_line_end = strchr(p_line_bgn, '\n'))) {
+    while ( (p_line_bgn < buf + total_length - 1) && (p_line_end = strchr(p_line_bgn, '\n'))) {
 
         // get one line
         int line_len = p_line_end - p_line_bgn;
@@ -493,6 +601,9 @@ error:
     if (section) {
         osi_free(section);
     }
+    if (keyname) {
+        osi_free(keyname);
+    }
     if (err_code) {
         LOG_ERROR("%s returned with err code: %d\n", __func__, err_code);
     }

components/bt/bluedroid/osi/include/alarm.h

@@ -20,20 +20,21 @@
 #define _ALARM_H_
 
 #include <stdint.h>
-#include <freertos/FreeRTOS.h>
-#include <freertos/timers.h>
+#include "esp_timer.h"
 
-typedef uint32_t period_ms_t;
-typedef void (*osi_alarm_callback_t)(void *data);
+typedef struct alarm_t osi_alarm_t;
+typedef uint64_t period_ms_t;
+typedef esp_timer_cb_t osi_alarm_callback_t;
+
+typedef enum {
+    OSI_ALARM_ERR_PASS = 0,
+    OSI_ALARM_ERR_FAIL = -1,
+    OSI_ALARM_ERR_INVALID_ARG = -2,
+    OSI_ALARM_ERR_INVALID_STATE = -3,
+} osi_alarm_err_t;
 
 #define ALARM_CBS_NUM   30
 #define ALARM_ID_BASE   1000
-typedef struct alarm_t {
-    /* timer id point to here */
-    TimerHandle_t alarm_hdl;
-    osi_alarm_callback_t cb;
-    void *cb_data;
-} osi_alarm_t;
 
 int osi_alarm_create_mux(void);
 int osi_alarm_delete_mux(void);
@@ -42,27 +43,25 @@ void osi_alarm_deinit(void);
 
 // Creates a new alarm object. The returned object must be freed by calling
 // |alarm_free|. Returns NULL on failure.
-osi_alarm_t *osi_alarm_new(char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire);
+osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire);
 
 // Frees an alarm object created by |alarm_new|. |alarm| may be NULL. If the
 // alarm is pending, it will be cancelled. It is not safe to call |alarm_free|
 // from inside the callback of |alarm|.
-int osi_alarm_free(osi_alarm_t *alarm);
+void osi_alarm_free(osi_alarm_t *alarm);
 
 // Sets an alarm to fire |cb| after the given |deadline|. Note that |deadline| is the
 // number of milliseconds relative to the current time. |data| is a context variable
 // for the callback and may be NULL. |cb| will be called back in the context of an
 // unspecified thread (i.e. it will not be called back in the same thread as the caller).
 // |alarm| and |cb| may not be NULL.
-int osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout);
+osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout);
 
 // This function cancels the |alarm| if it was previously set. When this call
 // returns, the caller has a guarantee that the callback is not in progress and
 // will not be called if it hasn't already been called. This function is idempotent.
 // |alarm| may not be NULL.
-int osi_alarm_cancel(osi_alarm_t *alarm);
-
-period_ms_t osi_alarm_now(void);
+osi_alarm_err_t osi_alarm_cancel(osi_alarm_t *alarm);
 
 // Figure out how much time until next expiration.
 // Returns 0 if not armed. |alarm| may not be NULL.
@@ -72,10 +71,6 @@ period_ms_t osi_alarm_get_remaining_ms(const osi_alarm_t *alarm);
 // Alarm-related state cleanup
 //void alarm_cleanup(void);
 
-// Compute time difference (t1-t2) considering tick counter wrap
-// t1 and t2 should be no greater than the time of MAX ticks
-period_ms_t osi_alarm_time_diff(period_ms_t t1, period_ms_t t2);
-
 uint32_t osi_time_get_os_boottime_ms(void);
 
 #endif /*_ALARM_H_*/

components/bt/bluedroid/osi/include/thread.h

@@ -83,13 +83,14 @@ typedef enum {
 #define BTC_TASK_PRIO                   (configMAX_PRIORITIES - 6)
 #define BTC_TASK_QUEUE_LEN              60
 
-#define BTC_MEDIA_TASK_PINNED_TO_CORE   (TASK_PINNED_TO_CORE)
-#define BTC_MEDIA_TASK_STACK_SIZE       (CONFIG_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)
-#define BTC_MEDIA_TASK_NAME             "BtcMediaT"
-#define BTC_MEDIA_TASK_PRIO             (configMAX_PRIORITIES - 3)
-#define BTC_MEDIA_DATA_QUEUE_LEN        (1)
-#define BTC_MEDIA_CTRL_QUEUE_LEN        (5)
-#define BTC_MEDIA_TASK_QUEUE_SET_LEN    (BTC_MEDIA_DATA_QUEUE_LEN + BTC_MEDIA_CTRL_QUEUE_LEN)
+#define BTC_A2DP_SINK_TASK_PINNED_TO_CORE     (TASK_PINNED_TO_CORE)
+#define BTC_A2DP_SINK_TASK_STACK_SIZE         (CONFIG_A2DP_SINK_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE) // by menuconfig
+#define BTC_A2DP_SINK_TASK_NAME               "BtA2dSinkT"
+#define BTC_A2DP_SINK_TASK_PRIO               (configMAX_PRIORITIES - 3)
+#define BTC_A2DP_SINK_DATA_QUEUE_LEN          (1)
+#define BTC_A2DP_SINK_CTRL_QUEUE_LEN          (5)
+#define BTC_A2DP_SINK_TASK_QUEUE_SET_LEN      (BTC_A2DP_SINK_DATA_QUEUE_LEN + BTC_A2DP_SINK_CTRL_QUEUE_LEN)
+
 
 #define TASK_POST_NON_BLOCKING          (0)
 #define TASK_POST_BLOCKING              (portMAX_DELAY)

components/bt/bluedroid/stack/avdt/avdt_ccb.c

@@ -407,7 +407,7 @@ void avdt_ccb_dealloc(tAVDT_CCB *p_ccb, tAVDT_CCB_EVT *p_data)
     UNUSED(p_data);
 
     AVDT_TRACE_DEBUG("avdt_ccb_dealloc %d\n", avdt_ccb_to_idx(p_ccb));
-    btu_stop_timer(&p_ccb->timer_entry);
+    btu_free_timer(&p_ccb->timer_entry);
     fixed_queue_free(p_ccb->cmd_q, NULL);
     fixed_queue_free(p_ccb->rsp_q, NULL);
     memset(p_ccb, 0, sizeof(tAVDT_CCB));

components/bt/bluedroid/stack/avdt/avdt_scb.c

@@ -644,7 +644,7 @@ void avdt_scb_dealloc(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
     UNUSED(p_data);
 
     AVDT_TRACE_DEBUG("avdt_scb_dealloc hdl=%d\n", avdt_scb_to_hdl(p_scb));
-    btu_stop_timer(&p_scb->timer_entry);
+    btu_free_timer(&p_scb->timer_entry);
 
 #if AVDT_MULTIPLEXING == TRUE
     /* free fragments we're holding, if any; it shouldn't happen */

components/bt/bluedroid/stack/avrc/avrc_bld_ct.c

@@ -98,7 +98,7 @@ static tAVRC_STS avrc_bld_set_abs_volume_cmd (tAVRC_SET_VOLUME_CMD *p_cmd, BT_HD
 **                  Otherwise, the error code.
 **
 *******************************************************************************/
-static tAVRC_STS avrc_bld_vol_change_notfn(BT_HDR *p_pkt)
+static tAVRC_STS avrc_bld_register_change_notfn(UINT8 event_id, UINT32 event_parameter, BT_HDR *p_pkt)
 {
     UINT8   *p_data, *p_start;
 
@@ -109,8 +109,8 @@ static tAVRC_STS avrc_bld_vol_change_notfn(BT_HDR *p_pkt)
     p_data = p_start + 2; /* pdu + rsvd */
     /* add fixed length 5 -*/
     UINT16_TO_BE_STREAM(p_data, 5);
-    UINT8_TO_BE_STREAM(p_data, AVRC_EVT_VOLUME_CHANGE);
-    UINT32_TO_BE_STREAM(p_data, 0);
+    UINT8_TO_BE_STREAM(p_data, event_id);
+    UINT32_TO_BE_STREAM(p_data, event_parameter);
     p_pkt->len = (p_data - p_start);
     return AVRC_STS_NO_ERROR;
 }
@@ -132,8 +132,7 @@ static BT_HDR *avrc_bld_init_cmd_buffer(tAVRC_COMMAND *p_cmd)
     AVRC_TRACE_API("avrc_bld_init_cmd_buffer: pdu=%x, opcode=%x", p_cmd->pdu, opcode);
 
     UINT16 offset = 0;
-    switch (opcode)
-    {
+    switch (opcode) {
     case AVRC_OP_PASS_THRU:
         offset  = AVRC_MSG_PASS_THRU_OFFSET;
         break;
@@ -148,7 +147,7 @@ static BT_HDR *avrc_bld_init_cmd_buffer(tAVRC_COMMAND *p_cmd)
     if (p_pkt) {
         UINT8 *p_data, *p_start;
 
-    p_pkt->layer_specific = AVCT_DATA_CTRL;
+        p_pkt->layer_specific = AVCT_DATA_CTRL;
         p_pkt->event    = opcode;
         p_pkt->offset   = offset;
         p_data = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
@@ -175,6 +174,69 @@ static BT_HDR *avrc_bld_init_cmd_buffer(tAVRC_COMMAND *p_cmd)
     return p_pkt;
 }
 
+/*******************************************************************************
+**
+** Function         avrc_bld_set_player_value_cmd
+**
+** Description      This function builds the Set Player Application Value command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_player_value_cmd(tAVRC_SET_APP_VALUE_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8 *p_data, *p_start;
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+    /* add length */
+    UINT16_TO_BE_STREAM(p_data, 3);
+    /* Number of attributes */
+    UINT8_TO_BE_STREAM(p_data, 1);
+    UINT8_TO_BE_STREAM(p_data, p_cmd->p_vals->attr_id);
+    UINT8_TO_BE_STREAM(p_data, p_cmd->p_vals->attr_val);
+
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_element_attr_cmd
+**
+** Description      This function builds the Get Element Attribute command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_element_attr_cmd (tAVRC_GET_ELEM_ATTRS_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    int i;
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API("avrc_bld_get_element_attr_cmd num_attr: %d", p_cmd->num_attr);
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+    /* add length */
+    UINT16_TO_BE_STREAM(p_data, 8 + 1 /* id + attr count */ + p_cmd->num_attr * sizeof(UINT32));
+    /* Identifier 0x0 (PLAYING) */
+    UINT64_TO_BE_STREAM(p_data, (UINT64)(0));
+    /* Attribute count */
+    UINT8_TO_BE_STREAM(p_data, p_cmd->num_attr);
+
+    for (i = 0; i < p_cmd->num_attr; i++) {
+        AVRC_TRACE_API("avrc_bld_get_element_attr_cmd attr_id: %d", p_cmd->attrs[i]);
+        UINT32_TO_BE_STREAM(p_data, p_cmd->attrs[i]);
+    }
+
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
 /*******************************************************************************
 **
 ** Function         AVRC_BldCommand
@@ -223,14 +285,17 @@ tAVRC_STS AVRC_BldCommand( tAVRC_COMMAND *p_cmd, BT_HDR **pp_pkt)
         break;
 #endif
 
-    case AVRC_PDU_REGISTER_NOTIFICATION:      /* 0x31 */
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
-        if (AVRC_EVT_VOLUME_CHANGE == p_cmd->reg_notif.event_id) {
-            status = avrc_bld_vol_change_notfn(p_pkt);
-        }
-#endif
+    case AVRC_PDU_SET_PLAYER_APP_VALUE:       /* 0x14 */
+        status = avrc_bld_set_player_value_cmd(&p_cmd->set_app_val, p_pkt);
         break;
 
+    case AVRC_PDU_GET_ELEMENT_ATTR:         /* 0x20 */
+        status = avrc_bld_get_element_attr_cmd(&p_cmd->get_elem_attrs, p_pkt);
+        break;
+
+    case AVRC_PDU_REGISTER_NOTIFICATION:      /* 0x31 */
+        status = avrc_bld_register_change_notfn(p_cmd->reg_notif.event_id, p_cmd->reg_notif.param, p_pkt);
+        break;
     }
 
     if (alloc && (status != AVRC_STS_NO_ERROR) ) {

components/bt/bluedroid/stack/btm/btm_acl.c

@@ -906,6 +906,11 @@ void btm_read_remote_version_complete (UINT8 *p)
             }
 #if BLE_INCLUDED == TRUE
             if (p_acl_cb->transport == BT_TRANSPORT_LE) {
+                if (HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl_cb->peer_le_features)) {
+                    uint16_t data_length = controller_get_interface()->get_ble_default_data_packet_length();
+                    uint16_t data_txtime = controller_get_interface()->get_ble_default_data_packet_txtime();
+                    btsnd_hcic_ble_set_data_length(p_acl_cb->hci_handle, data_length, data_txtime);
+                }
                 l2cble_notify_le_connection (p_acl_cb->remote_addr);
             }
 #endif
@@ -2073,7 +2078,7 @@ void BTM_BleGetWhiteListSize(uint16_t *length)
 {
     tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
     if (p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_ERROR("%s Whitelist full.", __func__);
+        BTM_TRACE_DEBUG("%s Whitelist full.", __func__);
     }
     *length = p_cb->white_list_avail_size;
     return;

components/bt/bluedroid/stack/btm/btm_ble.c

@@ -180,11 +180,7 @@ BOOLEAN BTM_SecAddBleKey (BD_ADDR bd_addr, tBTM_LE_KEY_VALUE *p_le_key, tBTM_LE_
 
 #if (BLE_PRIVACY_SPT == TRUE)
     if (key_type == BTM_LE_KEY_PID || key_type == BTM_LE_KEY_LID) {
-        /* It will cause that scanner doesn't send scan request to advertiser
-         * which has sent IRK to us and we have stored the IRK in controller.
-         * It is a design problem of hardware. The temporal solution is not to 
-         * send the key to the controller and then resolve the random address in host. */
-        //btm_ble_resolving_list_load_dev (p_dev_rec);
+        btm_ble_resolving_list_load_dev (p_dev_rec);
     }
 #endif
 
@@ -609,18 +605,23 @@ void BTM_ReadDevInfo (BD_ADDR remote_bda, tBT_DEVICE_TYPE *p_dev_type, tBLE_ADDR
 {
     tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (remote_bda);
     tBTM_INQ_INFO     *p_inq_info = BTM_InqDbRead(remote_bda);
+    tBLE_ADDR_TYPE    temp_addr_type = (*p_addr_type);
 
     *p_addr_type = BLE_ADDR_PUBLIC;
 
-    if (!p_dev_rec) {
+    if (!p_dev_rec) {  
         *p_dev_type = BT_DEVICE_TYPE_BREDR;
         /* Check with the BT manager if details about remote device are known */
         if (p_inq_info != NULL) {
             *p_dev_type = p_inq_info->results.device_type ;
             *p_addr_type = p_inq_info->results.ble_addr_type;
         } else {
-            /* unknown device, assume BR/EDR */
-            BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
+            if(temp_addr_type <= BLE_ADDR_TYPE_MAX) {
+                *p_addr_type = temp_addr_type;
+            } else {
+                /* unknown device, assume BR/EDR */
+                BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
+            }
         }
     } else { /* there is a security device record exisitng */
         /* new inquiry result, overwrite device type in security device record */
@@ -665,6 +666,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT tran
 
     /* if no device can be located, return */
     if (p_dev_rec == NULL) {
+        memset(remote_bda, 0, BD_ADDR_LEN);
         return FALSE;
     }
 
@@ -812,7 +814,7 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length)
     }
 
     if (!HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl->peer_le_features)) {
-        BTM_TRACE_DEBUG("%s failed, peer does not support request", __FUNCTION__);
+        BTM_TRACE_ERROR("%s failed, peer does not support request", __FUNCTION__);
         return BTM_PEER_LE_DATA_LEN_UNSUPPORTED;
     }
 
@@ -1221,6 +1223,14 @@ void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY
             p_rec->ble.keys.key_size = p_keys->lenc_key.key_size;
             p_rec->ble.key_type |= BTM_LE_KEY_LENC;
 
+            /* Set that link key is known since this shares field with BTM_SEC_FLAG_LKEY_KNOWN flag in btm_api.h*/
+            p_rec->sec_flags |=  BTM_SEC_LE_LINK_KEY_KNOWN;
+            if ( p_keys->pcsrk_key.sec_level == SMP_SEC_AUTHENTICATED) {
+                p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
+            } else {
+                p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
+            }
+
             BTM_TRACE_DEBUG("BTM_LE_KEY_LENC key_type=0x%x DIV=0x%x key_size=0x%x sec_level=0x%x",
                             p_rec->ble.key_type,
                             p_rec->ble.keys.div,
@@ -1907,7 +1917,17 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
 
         /* possiblly receive connection complete with resolvable random on
            slave role while the device has been paired */
-        if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) {
+
+        /* It will cause that scanner doesn't send scan request to advertiser
+        * which has sent IRK to us and we have stored the IRK in controller.
+        * It is a design problem of hardware. The temporal solution is not to 
+        * send the key to the controller and then resolve the random address in host.
+        * so we need send the real address information to controller to connect. 
+        * Once the connection is successful, resolve device address whether it is 
+        * slave or master*/
+
+        /* if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) { */
+        if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) {
             // save the enhanced value to used in btm_ble_resolve_random_addr_on_conn_cmpl func.
             temp_enhanced = enhanced;
             btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_conn_cmpl, p_data);
@@ -1922,7 +1942,14 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
             handle = HCID_GET_HANDLE (handle);
 
             btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
-
+            if(role == HCI_ROLE_SLAVE) {
+                //clear p_cb->state, controller will stop adv when ble connected.
+                tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
+                if(p_cb) {
+                    p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
+                    p_cb->state = BTM_BLE_STOP_ADV; 
+                }
+            }
             l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
                               conn_latency, conn_timeout);
 
@@ -2066,11 +2093,7 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
                     p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
                     /* add all bonded device into resolving list if IRK is available*/
-                    /* It will cause that scanner doesn't send scan request to advertiser
-                     * which has sent IRK to us and we have stored the IRK in controller.
-                     * It is a design problem of hardware. The temporal solution is not to 
-                     * send the key to the controller and then resolve the random address in host. */
-                    //btm_ble_resolving_list_load_dev(p_dev_rec);
+                    btm_ble_resolving_list_load_dev(p_dev_rec);
 #endif
                 }
 

components/bt/bluedroid/stack/btm/btm_ble_addr.c

@@ -596,7 +596,12 @@ void btm_ble_refresh_local_resolvable_private_addr(BD_ADDR pseudo_addr,
     BD_ADDR     dummy_bda = {0};
 
     if (p != NULL) {
-        if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
+/*
+ *  Temporary solutions for pair with random address:
+ *  use BLE_ADDR_RANDOM when adverting with random adress or in privacy mode
+ *  We will do futher work here
+ */
+        if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE || btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM) {
             p->conn_addr_type = BLE_ADDR_RANDOM;
             if (memcmp(local_rpa, dummy_bda, BD_ADDR_LEN)) {
                 memcpy(p->conn_addr, local_rpa, BD_ADDR_LEN);

components/bt/bluedroid/stack/btm/btm_ble_bgconn.c

@@ -69,7 +69,7 @@ static void background_connections_lazy_init()
     }
 }
 
-static void background_connection_add(bt_bdaddr_t *address)
+static BOOLEAN background_connection_add(bt_bdaddr_t *address)
 {
     assert(address);
     background_connections_lazy_init();
@@ -78,14 +78,17 @@ static void background_connection_add(bt_bdaddr_t *address)
         connection = osi_calloc(sizeof(background_connection_t));
         connection->address = *address;
         hash_map_set(background_connections, &(connection->address), connection);
+        return TRUE;
     }
+    return FALSE;
 }
 
-static void background_connection_remove(bt_bdaddr_t *address)
+static BOOLEAN background_connection_remove(bt_bdaddr_t *address)
 {
     if (address && background_connections) {
-        hash_map_erase(background_connections, address);
+        return hash_map_erase(background_connections, address);
     }
+    return FALSE;
 }
 
 static void background_connections_clear()
@@ -259,20 +262,36 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBTM_ADD_W
     tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
 
     if (to_add && p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_DEBUG("%s Whitelist full, unable to add device", __func__);
+        BTM_TRACE_ERROR("%s Whitelist full, unable to add device", __func__);
+        if (add_wl_cb){
+            add_wl_cb(HCI_ERR_MEMORY_FULL,to_add);
+        }
         return FALSE;
     }
-    if (add_wl_cb){
-        //save add whitelist complete callback
-        p_cb->add_wl_cb = add_wl_cb;
-    }
 
     if (to_add) {
         /* added the bd_addr to the connection hash map queue */
-        background_connection_add((bt_bdaddr_t *)bd_addr);
+        if(!background_connection_add((bt_bdaddr_t *)bd_addr)) {
+            /* if the bd_addr already exist in whitelist, just callback return TRUE */
+            if (add_wl_cb){
+                add_wl_cb(HCI_SUCCESS,to_add);
+            }
+            return TRUE;
+        }
     } else {
         /* remove the bd_addr to the connection hash map queue */
-        background_connection_remove((bt_bdaddr_t *)bd_addr);
+        if(!background_connection_remove((bt_bdaddr_t *)bd_addr)){
+            /* if the bd_addr don't exist in whitelist, just callback return TRUE */
+            if (add_wl_cb){
+                add_wl_cb(HCI_SUCCESS,to_add);
+            }
+            return TRUE;
+        }
+    }
+
+    if (add_wl_cb){
+        //save add whitelist complete callback
+        p_cb->add_wl_cb = add_wl_cb;
     }
     /* stop the auto connect */
     btm_suspend_wl_activity(p_cb->wl_state);
@@ -552,7 +571,7 @@ void btm_ble_initiate_select_conn(BD_ADDR bda)
     BTM_TRACE_EVENT ("btm_ble_initiate_select_conn");
 
     /* use direct connection procedure to initiate connection */
-    if (!L2CA_ConnectFixedChnl(L2CAP_ATT_CID, bda)) {
+    if (!L2CA_ConnectFixedChnl(L2CAP_ATT_CID, bda, BLE_ADDR_UNKNOWN_TYPE)) {
         BTM_TRACE_ERROR("btm_ble_initiate_select_conn failed");
     }
 }

components/bt/bluedroid/stack/btm/btm_ble_gap.c

@@ -467,20 +467,6 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration,
             /* enable resolving list */
             btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_SCAN);
 #endif
-            // if not set scan params, set defalult scan params
-            if (!p_inq->scan_params_set)
-            {
-                /* allow config of scan type */
-                p_inq->scan_type = BTM_BLE_SCAN_MODE_ACTI;
-                p_inq->scan_interval = BTM_BLE_GAP_DISC_SCAN_INT;
-                p_inq->scan_window = BTM_BLE_GAP_DISC_SCAN_WIN;
-                p_inq->sfp = BTM_BLE_DEFAULT_SFP;
-                p_inq->scan_params_set = TRUE;
-                btsnd_hcic_ble_set_scan_params(p_inq->scan_type, p_inq->scan_interval,
-                                               p_inq->scan_window,
-                                               btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type,
-                                               p_inq->sfp);
-            }
             p_inq->scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE;
             status = btm_ble_start_scan();
         }
@@ -515,7 +501,7 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration,
 ** Returns          status.
 **
 *******************************************************************************/
-tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
+tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK  *p_stop_adv_cback)
 {
     tBTM_STATUS status = BTM_NO_RESOURCES;
     tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
@@ -531,7 +517,13 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
         evt_type = p_cb->scan_rsp ? BTM_BLE_CONNECT_EVT : BTM_BLE_NON_CONNECT_EVT;
     }
 #endif
-
+    // if adv state is BTM_BLE_ADV_PENDING, return immediately
+    if (p_cb->state == BTM_BLE_ADV_PENDING) {
+        if (p_stop_adv_cback) {
+            (*p_stop_adv_cback)(HCI_ERR_ILLEGAL_COMMAND);
+        }
+        return BTM_BUSY;
+    }
     if (start && p_cb->adv_mode == BTM_BLE_ADV_DISABLE) {
         /* update adv params */
         if (!btsnd_hcic_ble_write_adv_params ((UINT16)(p_cb->adv_interval_min ? p_cb->adv_interval_min :
@@ -552,15 +544,22 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
         }
 
         status = btm_ble_start_adv ();
-    } else if (!start) {
+    } else if (!start && p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        //save the stop adv callback to the BTM env.
+        p_cb->p_stop_adv_cb = p_stop_adv_cback;
         status = btm_ble_stop_adv();
 #if BLE_PRIVACY_SPT == TRUE
         btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE);
 #endif
     } else {
-        status = BTM_WRONG_MODE;
-        BTM_TRACE_ERROR("Can not %s Broadcast, device %s in Broadcast mode",
-                        (start ? "Start" : "Stop"), (start ? "already" : "not"));
+        /*
+            1. start adv when adv has already started (not used)
+            2. stop adv shen adv has already stoped
+        */
+        status = BTM_SUCCESS;
+        if (p_stop_adv_cback) {
+            (*p_stop_adv_cback)(status);
+        }
     }
     return status;
 }
@@ -748,6 +747,30 @@ BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK
     if (!controller_get_interface()->supports_ble()) {
         return FALSE;
     }
+
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set privacy when advertising, scaning or using static random address
+ *  We will do futher work here
+ */
+    if (p_cb->privacy_mode == BTM_PRIVACY_NONE
+        && random_cb->own_addr_type == BLE_ADDR_RANDOM) {
+        BTM_TRACE_ERROR("Have set random adress, can't set privacy ");
+        if (random_cb && random_cb->set_local_privacy_cback){
+            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
+            random_cb->set_local_privacy_cback = NULL;
+        }
+        return FALSE;
+    }
+    if (!(p_cb->inq_var.state == BTM_BLE_STOP_SCAN || p_cb->inq_var.state == BTM_BLE_STOP_ADV || p_cb->inq_var.state == BTM_BLE_IDLE)) {
+        BTM_TRACE_ERROR("Advertising or scaning now, can't set privacy ");
+        if (random_cb && random_cb->set_local_privacy_cback){
+            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
+            random_cb->set_local_privacy_cback = NULL;
+        }
+        return FALSE;
+    }
+
 #if (defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE)
     uint8_t addr_resolution = 0;
 #endif  /* defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */
@@ -1166,7 +1189,7 @@ tBTM_STATUS BTM_BleSetAdvParams(UINT16 adv_int_min, UINT16 adv_int_max,
 *******************************************************************************/
 tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type,
                                         tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda,
-                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp)
+                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb)
 {
     tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
     tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
@@ -1177,8 +1200,25 @@ tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max,
         return BTM_ILLEGAL_VALUE;
     }
 
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set advertising with BLE_ADDR_PUBLIC when having set random adress or in privacy mode
+ *  We will do futher work here
+ */
+    if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM && own_bda_type == BLE_ADDR_PUBLIC) {
+        BTM_TRACE_ERROR ("own_addr_type is BLE_ADDR_RANDOM but use BLE_ADDR_PUBLIC\n");
+        if(adv_cb) {
+            (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL);
+        }
+        return BTM_ILLEGAL_VALUE;
+    }
+
     if (!BTM_BLE_ISVALID_PARAM(adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
             !BTM_BLE_ISVALID_PARAM(adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+         BTM_TRACE_ERROR ("adv_int_min or adv_int_max is invalid\n");    
+        if(adv_cb) {
+            (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL);
+        }
         return BTM_ILLEGAL_VALUE;
     }
 
@@ -1196,14 +1236,30 @@ tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max,
     p_addr_cb->own_addr_type = own_bda_type;
     p_cb->evt_type = adv_type;
     p_cb->afp = afp;
+    p_cb->p_adv_cb = adv_cb;
 
     if (p_dir_bda) {
         memcpy(&p_cb->direct_bda, p_dir_bda, sizeof(tBLE_BD_ADDR));
     }
 
     BTM_TRACE_EVENT ("update params for an active adv\n");
-
-    btm_ble_stop_adv();
+    // if adv state is BTM_BLE_ADV_PENDING, return immediately
+    if (p_cb->state == BTM_BLE_ADV_PENDING) {
+        if (p_cb->p_adv_cb) {
+            (*p_cb->p_adv_cb)(HCI_ERR_ILLEGAL_COMMAND);
+        }
+        return BTM_BUSY;
+    }
+    /* host will stop adv first and then  start adv again if adv has already started
+       it will get callback twice.
+    */
+    if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        p_cb->adv_callback_twice = TRUE;
+    }
+    tBTM_STATUS status = btm_ble_stop_adv();
+    if (status != BTM_SUCCESS) {
+        p_cb->adv_callback_twice = FALSE;
+    }
 
     /* update adv params */
     btsnd_hcic_ble_write_adv_params (adv_int_min,
@@ -1326,6 +1382,19 @@ void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32
         return;
     }
 
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set scan with BLE_ADDR_PUBLIC when having set random adress or in privacy mode
+ *  We will do futher work here
+ */
+    if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM && addr_type_own == BLE_ADDR_PUBLIC) {
+        BTM_TRACE_ERROR ("own_addr_type is BLE_ADDR_RANDOM but use BLE_ADDR_PUBLIC\n");
+        if (scan_setup_status_cback != NULL) {
+            scan_setup_status_cback(client_if, BTM_ILLEGAL_VALUE);
+        }
+        return;
+    }
+
     /* If not supporting extended scan support, use the older range for checking */
     if (btm_cb.cmn_ble_vsc_cb.extended_scan_support == 0) {
         max_scan_interval = BTM_BLE_SCAN_INT_MAX;
@@ -1504,16 +1573,35 @@ tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len)
 ** Returns          void
 **
 *******************************************************************************/
-BOOLEAN BTM_BleSetRandAddress(BD_ADDR rand_addr)
+tBTM_STATUS BTM_BleSetRandAddress(BD_ADDR rand_addr)
 {
-    BOOLEAN set_flag = false;
-
 	if (rand_addr == NULL)
-		return set_flag;
+		return BTM_SET_STATIC_RAND_ADDR_FAIL;
 
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set rand address when advertising, scaning or in privacy mode
+ *  We will do futher work here
+ */
+#if BLE_PRIVACY_SPT == TRUE
+    if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
+        BTM_TRACE_ERROR("privacy_mode is not BTM_PRIVACY_NONE ");
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
+
+#endif
+    if (!(btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_STOP_SCAN || btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_STOP_ADV || btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_IDLE)) {
+        BTM_TRACE_ERROR("Advertising or scaning now, can't set randaddress %d", btm_cb.ble_ctr_cb.inq_var.state);
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
+    memcpy(btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr, rand_addr, BD_ADDR_LEN);
+    btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type = BLE_ADDR_RANDOM;
     //send the set random address to the controller
-    set_flag = btsnd_hcic_ble_set_random_addr(rand_addr);
-    return set_flag;
+    if(btsnd_hcic_ble_set_random_addr(rand_addr)) {
+        return BTM_SUCCESS;
+    } else {
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
 }
 
 /*******************************************************************************
@@ -2918,6 +3006,8 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
     UINT8               data_len;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
     BOOLEAN             match = FALSE;
+    BD_ADDR             temp_bda;
+    UINT8               temp_addr_type = 0;
 #endif
 
     /* Only process the results if the inquiry is still active */
@@ -2936,6 +3026,9 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
         //BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n",
         //                              bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]);
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
+        temp_addr_type = addr_type;
+        memcpy(temp_bda, bda, BD_ADDR_LEN);
+        
         /* map address to security record */
         match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE);
 
@@ -2946,8 +3039,16 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
             btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, p_data);
         } else
 #endif
-            btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
-
+        btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
+#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
+        //save current adv addr information if p_dev_rec!= NULL
+        tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
+        if(p_dev_rec) {
+            p_dev_rec->ble.current_addr_type = temp_addr_type;
+            memcpy(p_dev_rec->ble.current_addr, temp_bda, BD_ADDR_LEN);
+            p_dev_rec->ble.current_addr_valid = true;
+        }
+#endif
         STREAM_TO_UINT8(data_len, p);
 
         /* Advance to the next event data_len + rssi byte */
@@ -3061,6 +3162,25 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
     }
 }
 
+static void btm_ble_recover_scan_params(void)
+{
+    tBTM_BLE_INQ_CB *p_inq = &btm_cb.ble_ctr_cb.inq_var;
+
+    if (p_inq->scan_params_set) {
+        /// set back the scan params to the controller after stop the scan
+        btsnd_hcic_ble_set_scan_params(p_inq->scan_type, p_inq->scan_interval,
+                                       p_inq->scan_window,
+                                       btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type,
+                                       p_inq->sfp);
+    } else {
+        /// set the default value if the scan params not set yet
+        btm_update_scanner_filter_policy(SP_ADV_ALL);
+
+        btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_SCAN;
+    }
+
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_start_scan
@@ -3074,7 +3194,8 @@ tBTM_STATUS btm_ble_start_scan(void)
 {
     tBTM_BLE_INQ_CB *p_inq = &btm_cb.ble_ctr_cb.inq_var;
     tBTM_STATUS status = BTM_CMD_STARTED;
-
+    // recoverly the scan parameters to the controller before start scan
+    btm_ble_recover_scan_params();
     /* start scan, disable duplicate filtering */
     if (!btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_ENABLE, p_inq->scan_duplicate_filter)) {
         status = BTM_NO_RESOURCES;
@@ -3192,7 +3313,6 @@ static void btm_ble_stop_discover(void)
 {
     tBTM_BLE_CB *p_ble_cb = & btm_cb.ble_ctr_cb;
     tBTM_CMPL_CB *p_scan_cb = p_ble_cb->p_scan_cmpl_cb;
-
     btu_stop_timer (&p_ble_cb->scan_timer_ent);
 
     p_ble_cb->scan_activity &= ~BTM_LE_DISCOVER_ACTIVE;
@@ -3206,6 +3326,8 @@ static void btm_ble_stop_discover(void)
         btm_cb.ble_ctr_cb.inq_var.state = BTM_BLE_STOP_SCAN;
         /* stop discovery now */
         btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE);
+        // recoverly the scan parameters to the controller after stop scan
+        btm_ble_recover_scan_params();
     }
 
     if (p_scan_cb) {
@@ -3287,13 +3409,13 @@ tBTM_STATUS btm_ble_start_adv(void)
 #endif
     if (p_cb->afp != AP_SCAN_CONN_ALL) {
         //find the device in the btm dev buffer and write it to the controller white list
-        btm_execute_wl_dev_operation();    
+        btm_execute_wl_dev_operation();
         btm_cb.ble_ctr_cb.wl_state |= BTM_BLE_WL_ADV;
     }
 
     if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE)) {
         p_cb->adv_mode = BTM_BLE_ADV_ENABLE;
-        p_cb->state = BTM_BLE_ADVERTISING;
+        p_cb->state = BTM_BLE_ADV_PENDING;
         btm_ble_adv_states_operation(btm_ble_set_topology_mask, p_cb->evt_type);
         rt = BTM_SUCCESS;
         BTM_TRACE_EVENT ("BTM_SUCCESS\n");
@@ -3322,7 +3444,7 @@ tBTM_STATUS btm_ble_stop_adv(void)
         if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) {
             p_cb->fast_adv_on = FALSE;
             p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-            p_cb->state = BTM_BLE_STOP_ADV;
+            p_cb->state = BTM_BLE_ADV_PENDING;
             btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;
 
             /* clear all adv states */
@@ -3462,9 +3584,13 @@ void btm_ble_read_remote_features_complete(UINT8 *p)
                 if (p_acl_cb->link_role == HCI_ROLE_MASTER){
                     btsnd_hcic_rmt_ver_req (p_acl_cb->hci_handle);
                 }
-
                 else{
                     if (p_acl_cb->transport == BT_TRANSPORT_LE) {
+                        if (HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl_cb->peer_le_features)) {
+                            uint16_t data_length = controller_get_interface()->get_ble_default_data_packet_length();
+                            uint16_t data_txtime = controller_get_interface()->get_ble_default_data_packet_txtime();
+                            btsnd_hcic_ble_set_data_length(p_acl_cb->hci_handle, data_length, data_txtime);
+                        }
                         l2cble_notify_le_connection (p_acl_cb->remote_addr);
                     }
                 }
@@ -3488,7 +3614,30 @@ void btm_ble_read_remote_features_complete(UINT8 *p)
 void btm_ble_write_adv_enable_complete(UINT8 *p)
 {
     tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
+    UINT8 status = *p;
 
+    // callback to the APP after receive the adv complete from the controller.
+    if (p_cb->p_adv_cb && p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        if (p_cb->adv_callback_twice) {
+            p_cb->adv_callback_twice = FALSE;
+        }else {
+            p_cb->state = BTM_BLE_ADVERTISING;
+            (*p_cb->p_adv_cb)(status);
+            p_cb->p_adv_cb = NULL;
+        }
+    } else if (p_cb->p_stop_adv_cb && p_cb->adv_mode == BTM_BLE_ADV_DISABLE) {
+        p_cb->state = BTM_BLE_STOP_ADV;
+        (*p_cb->p_stop_adv_cb)(status);
+        p_cb->p_stop_adv_cb = NULL;
+    }else {
+        // p_cb->p_adv_cb is NULL or p_cb->p_stop_adv_cb is NULL
+        if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+            p_cb->state = BTM_BLE_ADVERTISING;
+        }else {
+            p_cb->state = BTM_BLE_STOP_ADV;
+        }
+        p_cb->adv_callback_twice = FALSE;
+    }
     /* if write adv enable/disbale not succeed */
     if (*p != HCI_SUCCESS) {
         /* toggle back the adv mode */
@@ -3630,6 +3779,9 @@ void btm_ble_init (void)
 
     BTM_TRACE_DEBUG("%s", __func__);
 
+    btu_free_timer(&p_cb->obs_timer_ent);
+    btu_free_timer(&p_cb->scan_timer_ent);
+    btu_free_timer(&p_cb->inq_var.fast_adv_timer);
     memset(p_cb, 0, sizeof(tBTM_BLE_CB));
     memset(&(btm_cb.cmn_ble_vsc_cb), 0 , sizeof(tBTM_BLE_VSC_CB));
     btm_cb.cmn_ble_vsc_cb.values_read = FALSE;

components/bt/bluedroid/stack/btm/btm_ble_privacy.c

@@ -765,18 +765,22 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                 btm_ble_update_resolving_list(p_dev_rec->bd_addr, TRUE);
                 if (controller_get_interface()->supports_ble_privacy()) {
                     BD_ADDR dummy_bda = {0};
-                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
-                    UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
-
                     if (memcmp(p_dev_rec->ble.static_addr, dummy_bda, BD_ADDR_LEN) == 0) {
                         memcpy(p_dev_rec->ble.static_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
                         p_dev_rec->ble.static_addr_type = p_dev_rec->ble.ble_addr_type;
                     }
-
+                    /* It will cause that scanner doesn't send scan request to advertiser
+                     * which has sent IRK to us and we have stored the IRK in controller.
+                     * It is a design problem of hardware. The temporal solution is not to 
+                     * send the key to the controller and then resolve the random address in host. */
+                    /*
                     BTM_TRACE_DEBUG("%s:adding device to controller resolving list\n", __func__);
-                    // use identical IRK for now
+                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
+                    UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
+                    //use identical IRK for now
                     rt = btsnd_hcic_ble_add_device_resolving_list(p_dev_rec->ble.static_addr_type,
-                            p_dev_rec->ble.static_addr, peer_irk, local_irk);
+                           p_dev_rec->ble.static_addr, peer_irk, local_irk);
+                    */
                 } else {
                     UINT8 param[40] = {0};
                     UINT8 *p = param;
@@ -807,7 +811,7 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                 }
             }
         } else {
-            BTM_TRACE_ERROR("Device already in Resolving list\n");
+            BTM_TRACE_DEBUG("Device already in Resolving list\n");
             rt = TRUE;
         }
     } else {

components/bt/bluedroid/stack/btm/btm_devctl.c

@@ -533,7 +533,7 @@ void btm_read_local_name_complete (UINT8 *p, UINT16 evt_len)
     UINT8           status;
     UNUSED(evt_len);
 
-    btu_stop_timer (&btm_cb.devcb.rln_timer);
+    btu_free_timer (&btm_cb.devcb.rln_timer);
 
     /* If there was a callback address for read local name, call it */
     btm_cb.devcb.p_rln_cmpl_cb = NULL;

components/bt/bluedroid/stack/btm/btm_inq.c

@@ -1359,6 +1359,12 @@ void btm_inq_db_init (void)
 #if 0  /* cleared in btm_init; put back in if called from anywhere else! */
     memset (&btm_cb.btm_inq_vars, 0, sizeof (tBTM_INQUIRY_VAR_ST));
 #endif
+
+    btu_free_timer(&btm_cb.btm_inq_vars.rmt_name_timer_ent);
+    memset(&btm_cb.btm_inq_vars.rmt_name_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+    btu_free_timer(&btm_cb.btm_inq_vars.inq_timer_ent);
+    memset(&btm_cb.btm_inq_vars.inq_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+
     btm_cb.btm_inq_vars.no_inc_ssp = BTM_NO_SSP_ON_INQUIRY;
 }
 

components/bt/bluedroid/stack/btm/btm_sec.c

@@ -2763,7 +2763,9 @@ void btm_sec_check_pending_reqs (void)
         /* Now, re-submit anything in the mux queue */
         bq = btm_cb.sec_pending_q;
 
-        btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+        if (!btm_cb.sec_pending_q) {
+            btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+        }
 
         while ((p_e = (tBTM_SEC_QUEUE_ENTRY *)fixed_queue_try_dequeue(bq)) != NULL) {
             /* Check that the ACL is still up before starting security procedures */

components/bt/bluedroid/stack/btu/btu_task.c

@@ -498,6 +498,32 @@ void btu_stop_timer(TIMER_LIST_ENT *p_tle)
     osi_alarm_cancel(alarm);
 }
 
+
+/*******************************************************************************
+**
+** Function         btu_free_timer
+**
+** Description      Stop and free a timer.
+**
+** Returns          void
+**
+*******************************************************************************/
+void btu_free_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    p_tle->in_use = FALSE;
+
+    // Get the alarm for the timer list entry.
+    osi_alarm_t *alarm = hash_map_get(btu_general_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s Unable to find expected alarm in hashmap", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(btu_general_alarm_hash_map, p_tle);
+}
+
 #if defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0)
 /*******************************************************************************
 **
@@ -585,6 +611,23 @@ void btu_stop_quick_timer(TIMER_LIST_ENT *p_tle)
     }
     osi_alarm_cancel(alarm);
 }
+
+void btu_free_quick_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    p_tle->in_use = FALSE;
+
+    // Get the alarm for the timer list entry.
+    osi_alarm_t *alarm = hash_map_get(btu_l2cap_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s Unable to find expected alarm in hashmap", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(btu_l2cap_alarm_hash_map, p_tle);
+}
+
 #endif /* defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0) */
 
 void btu_oneshot_alarm_cb(void *data)

components/bt/bluedroid/stack/gap/gap_ble.c

@@ -694,7 +694,7 @@ BOOLEAN gap_ble_accept_cl_operation(BD_ADDR peer_bda, UINT16 uuid, tGAP_BLE_CMPL
     }
 
     /* hold the link here */
-    if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, TRUE, BT_TRANSPORT_LE)) {
+    if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BT_TRANSPORT_LE)) {
         return started;
     }
 

components/bt/bluedroid/stack/gatt/gatt_api.c

@@ -1337,12 +1337,13 @@ void GATT_StartIf (tGATT_IF gatt_if)
 **
 ** Parameters       gatt_if: applicaiton interface
 **                  bd_addr: peer device address.
+**                  bd_addr_type: peer device address type.
 **                  is_direct: is a direct conenection or a background auto connection
 **
 ** Returns          TRUE if connection started; FALSE if connection start failure.
 **
 *******************************************************************************/
-BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, BOOLEAN is_direct, tBT_TRANSPORT transport)
+BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, BOOLEAN is_direct, tBT_TRANSPORT transport)
 {
     tGATT_REG    *p_reg;
     BOOLEAN status = FALSE;
@@ -1356,7 +1357,7 @@ BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, BOOLEAN is_direct, tBT_
     }
 
     if (is_direct) {
-        status = gatt_act_connect (p_reg, bd_addr, transport);
+        status = gatt_act_connect (p_reg, bd_addr, bd_addr_type, transport);
     } else {
         if (transport == BT_TRANSPORT_LE) {
             status = gatt_update_auto_connect_dev(gatt_if, TRUE, bd_addr, TRUE);

components/bt/bluedroid/stack/gatt/gatt_attr.c

@@ -494,7 +494,7 @@ void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable, tBT_TRANSP
         p_clcb->connected = TRUE;
     }
     /* hold the link here */
-    GATT_Connect(gatt_cb.gatt_if, remote_bda, TRUE, transport);
+    GATT_Connect(gatt_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, transport);
     p_clcb->ccc_stage = GATT_SVC_CHANGED_CONNECTING;
 
     if (!p_clcb->connected) {

components/bt/bluedroid/stack/gatt/gatt_cl.c

@@ -586,7 +586,7 @@ void gatt_process_prep_write_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op
     tGATT_VALUE  value = {0};
     UINT8        *p = p_data;
 
-    GATT_TRACE_ERROR("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);
+    GATT_TRACE_DEBUG("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);
 
     if (len < GATT_PREP_WRITE_RSP_MIN_LEN) {
         GATT_TRACE_ERROR("illegal prepare write response length, discard");
@@ -988,8 +988,10 @@ void gatt_process_mtu_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT16 len, UINT
             p_tcb->payload_size = mtu;
         }
     }
-
-    l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+    /* host will set packet data length to 251 automatically if remote device support set packet data length,
+       so l2cble_set_fixed_channel_tx_data_length() is not necessary.
+       l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+    */
     gatt_end_operation(p_clcb, status, NULL);
 }
 /*******************************************************************************

components/bt/bluedroid/stack/gatt/gatt_main.c

@@ -172,6 +172,12 @@ void gatt_free(void)
         fixed_queue_free(gatt_cb.tcb[i].pending_ind_q, NULL);
         gatt_cb.tcb[i].pending_ind_q = NULL;
 
+        btu_free_timer(&gatt_cb.tcb[i].conf_timer_ent);
+        memset(&gatt_cb.tcb[i].conf_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+
+        btu_free_timer(&gatt_cb.tcb[i].ind_ack_timer_ent);
+        memset(&gatt_cb.tcb[i].ind_ack_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+    
         fixed_queue_free(gatt_cb.tcb[i].sr_cmd.multi_rsp_q, NULL);
         gatt_cb.tcb[i].sr_cmd.multi_rsp_q = NULL;
     }
@@ -189,11 +195,11 @@ void gatt_free(void)
 ** Description      This function is called to initiate a connection to a peer device.
 **
 ** Parameter        rem_bda: remote device address to connect to.
-**
+**                  bd_addr_type: emote device address type.
 ** Returns          TRUE if connection is started, otherwise return FALSE.
 **
 *******************************************************************************/
-BOOLEAN gatt_connect (BD_ADDR rem_bda, tGATT_TCB *p_tcb, tBT_TRANSPORT transport)
+BOOLEAN gatt_connect (BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type, tGATT_TCB *p_tcb, tBT_TRANSPORT transport)
 {
     BOOLEAN             gatt_ret = FALSE;
 
@@ -203,7 +209,7 @@ BOOLEAN gatt_connect (BD_ADDR rem_bda, tGATT_TCB *p_tcb, tBT_TRANSPORT transport
 
     if (transport == BT_TRANSPORT_LE) {
         p_tcb->att_lcid = L2CAP_ATT_CID;
-        gatt_ret = L2CA_ConnectFixedChnl (L2CAP_ATT_CID, rem_bda);
+        gatt_ret = L2CA_ConnectFixedChnl (L2CAP_ATT_CID, rem_bda, bd_addr_type);
 #if (CLASSIC_BT_INCLUDED == TRUE)
     } else {
         if ((p_tcb->att_lcid = L2CA_ConnectReq(BT_PSM_ATT, rem_bda)) != 0) {
@@ -348,7 +354,7 @@ void gatt_update_app_use_link_flag (tGATT_IF gatt_if, tGATT_TCB *p_tcb, BOOLEAN
 ** Returns          void.
 **
 *******************************************************************************/
-BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT transport)
+BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, tBT_TRANSPORT transport)
 {
     BOOLEAN     ret = FALSE;
     tGATT_TCB   *p_tcb;
@@ -361,7 +367,7 @@ BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT trans
         /* before link down, another app try to open a GATT connection */
         if (st == GATT_CH_OPEN &&  gatt_num_apps_hold_link(p_tcb) == 0 &&
                 transport == BT_TRANSPORT_LE ) {
-            if (!gatt_connect(bd_addr,  p_tcb, transport)) {
+            if (!gatt_connect(bd_addr, bd_addr_type, p_tcb, transport)) {
                 ret = FALSE;
             }
         } else if (st == GATT_CH_CLOSING) {
@@ -370,7 +376,7 @@ BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT trans
         }
     } else {
         if ((p_tcb = gatt_allocate_tcb_by_bdaddr(bd_addr, transport)) != NULL) {
-            if (!gatt_connect(bd_addr,  p_tcb, transport)) {
+            if (!gatt_connect(bd_addr, bd_addr_type, p_tcb, transport)) {
                 GATT_TRACE_ERROR("gatt_connect failed");
                 fixed_queue_free(p_tcb->pending_enc_clcb, NULL);
                 fixed_queue_free(p_tcb->pending_ind_q, NULL);

components/bt/bluedroid/stack/gatt/gatt_sr.c

@@ -359,6 +359,7 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
     tGATT_IF gatt_if;
     UINT16  conn_id;
     UINT16  queue_num = 0;
+    BOOLEAN is_first = TRUE;
     BOOLEAN is_prepare_write_valid = FALSE;
     BOOLEAN is_need_dequeue_sr_cmd = FALSE;
     tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
@@ -420,6 +421,11 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
         queue_data = fixed_queue_dequeue(prepare_record->queue);
         if (is_prepare_write_valid){
             if((queue_data->p_attr->p_value != NULL) && (queue_data->p_attr->p_value->attr_val.attr_val != NULL)){
+                if(is_first) {
+                    //clear attr_val.attr_len before handle prepare write data
+                    queue_data->p_attr->p_value->attr_val.attr_len = 0;
+                    is_first = FALSE;
+                }
                 memcpy(queue_data->p_attr->p_value->attr_val.attr_val+queue_data->offset, queue_data->value, queue_data->len);
                 //don't forget to increase the attribute value length in the gatts database.
                 queue_data->p_attr->p_value->attr_val.attr_len += queue_data->len;
@@ -949,7 +955,10 @@ static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
             p_tcb->payload_size = mtu;
         }
 
-        l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+        /* host will set packet data length to 251 automatically if remote device support set packet data length,
+            so l2cble_set_fixed_channel_tx_data_length() is not necessary.
+            l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+        */
 
         if ((p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, (tGATT_SR_MSG *) &p_tcb->payload_size)) != NULL) {
             attp_send_sr_msg (p_tcb, p_buf);

components/bt/bluedroid/stack/gatt/gatt_utils.c

@@ -861,7 +861,7 @@ tGATTS_SRV_CHG *gatt_is_bda_in_the_srv_chg_clt_list (BD_ADDR bda)
     list_t *list = fixed_queue_get_list(gatt_cb.srv_chg_clt_q);
     for (const list_node_t *node = list_begin(list); node != list_end(list);
          node = list_next(node)) {
-        tGATTS_SRV_CHG *p_buf = (tGATTS_SRV_CHG *)list_node(node);
+        p_buf = (tGATTS_SRV_CHG *)list_node(node);
         if (!memcmp( bda, p_buf->bda, BD_ADDR_LEN)) {
             GATT_TRACE_DEBUG("bda is in the srv chg clt list");
             break;
@@ -1255,7 +1255,7 @@ void gatt_start_ind_ack_timer(tGATT_TCB *p_tcb)
     p_tcb->ind_ack_timer_ent.param  = (TIMER_PARAM_TYPE)p_tcb;
     /* start notification cache timer */
     btu_start_timer (&p_tcb->ind_ack_timer_ent, BTU_TTYPE_ATT_WAIT_FOR_IND_ACK,
-                     GATT_WAIT_FOR_RSP_TOUT);
+                     GATT_WAIT_FOR_IND_ACK_TOUT);
 
 }
 /*******************************************************************************
@@ -1683,6 +1683,7 @@ tGATT_CLCB *gatt_clcb_alloc (UINT16 conn_id)
 void gatt_clcb_dealloc (tGATT_CLCB *p_clcb)
 {
     if (p_clcb && p_clcb->in_use) {
+        btu_free_timer(&p_clcb->rsp_timer_ent);
         memset(p_clcb, 0, sizeof(tGATT_CLCB));
     }
 }
@@ -1997,6 +1998,29 @@ BOOLEAN gatt_find_app_hold_link(tGATT_TCB *p_tcb, UINT8 start_idx, UINT8 *p_foun
     return found;
 }
 
+/*******************************************************************************
+**
+** Function         gatt_find_specific_app_in_hold_link
+**
+** Description      find the specific applicaiton that is holding the specified link
+**
+** Returns         Boolean
+**
+*******************************************************************************/
+BOOLEAN gatt_find_specific_app_in_hold_link(tGATT_TCB *p_tcb, tGATT_IF p_gatt_if)
+{
+    UINT8 i;
+    BOOLEAN found = FALSE;
+
+    for (i = 0; i < GATT_MAX_APPS; i ++) {
+        if (p_tcb->app_hold_link[i] && p_tcb->app_hold_link[i] == p_gatt_if) {
+            found = TRUE;
+            break;
+        }
+    }
+    return found;
+}
+
 /*******************************************************************************
 **
 ** Function         gatt_cmd_enq
@@ -2211,8 +2235,8 @@ void gatt_cleanup_upon_disc(BD_ADDR bda, UINT16 reason, tBT_TRANSPORT transport)
             }
         }
 
-        btu_stop_timer (&p_tcb->ind_ack_timer_ent);
-        btu_stop_timer (&p_tcb->conf_timer_ent);
+        btu_free_timer (&p_tcb->ind_ack_timer_ent);
+        btu_free_timer (&p_tcb->conf_timer_ent);
         gatt_free_pending_ind(p_tcb);
         gatt_free_pending_enc_queue(p_tcb);
         gatt_free_pending_prepare_write_queue(p_tcb);

components/bt/bluedroid/stack/gatt/include/gatt_int.h

@@ -80,6 +80,7 @@ typedef UINT8 tGATT_SEC_ACTION;
 #define GATT_WAIT_FOR_RSP_TOUT       30
 #define GATT_WAIT_FOR_DISC_RSP_TOUT  5
 #define GATT_REQ_RETRY_LIMIT         2
+#define GATT_WAIT_FOR_IND_ACK_TOUT   5
 
 /* characteristic descriptor type */
 #define GATT_DESCR_EXT_DSCPTOR   1    /* Characteristic Extended Properties */
@@ -571,8 +572,8 @@ extern void gatt_free(void);
 
 /* from gatt_main.c */
 extern BOOLEAN gatt_disconnect (tGATT_TCB *p_tcb);
-extern BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT transport);
-extern BOOLEAN gatt_connect (BD_ADDR rem_bda,  tGATT_TCB *p_tcb, tBT_TRANSPORT transport);
+extern BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, tBT_TRANSPORT transport);
+extern BOOLEAN gatt_connect (BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type, tGATT_TCB *p_tcb, tBT_TRANSPORT transport);
 extern void gatt_data_process (tGATT_TCB *p_tcb, BT_HDR *p_buf);
 extern void gatt_update_app_use_link_flag ( tGATT_IF gatt_if, tGATT_TCB *p_tcb, BOOLEAN is_add, BOOLEAN check_acl_link);
 
@@ -681,6 +682,7 @@ extern void gatt_sr_update_cback_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN
 extern void gatt_sr_update_prep_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN is_inc, BOOLEAN is_reset_first);
 
 extern BOOLEAN gatt_find_app_hold_link(tGATT_TCB *p_tcb, UINT8 start_idx, UINT8 *p_found_idx, tGATT_IF *p_gatt_if);
+extern BOOLEAN gatt_find_specific_app_in_hold_link(tGATT_TCB *p_tcb, tGATT_IF p_gatt_if);
 extern UINT8 gatt_num_apps_hold_link(tGATT_TCB *p_tcb);
 extern UINT8 gatt_num_clcb_by_bd_addr(BD_ADDR bda);
 extern tGATT_TCB *gatt_find_tcb_by_cid(UINT16 lcid);

components/bt/bluedroid/stack/include/bt_types.h

@@ -276,6 +276,7 @@ typedef struct {
 /********************************************************************************
 ** Macros to get and put bytes to and from a stream (Big Endian format)
 */
+#define UINT64_TO_BE_STREAM(p, u64) {*(p)++ = (UINT8)((u64) >> 56); *(p)++ = (UINT8)((u64) >> 48); *(p)++ = (UINT8)((u64) >> 40); *(p)++ = (UINT8)((u64) >> 32); *(p)++ = (UINT8)((u64) >> 24);  *(p)++ = (UINT8)((u64) >> 16); *(p)++ = (UINT8)((u64) >> 8); *(p)++ = (UINT8)(u64); }
 #define UINT32_TO_BE_STREAM(p, u32) {*(p)++ = (UINT8)((u32) >> 24);  *(p)++ = (UINT8)((u32) >> 16); *(p)++ = (UINT8)((u32) >> 8); *(p)++ = (UINT8)(u32); }
 #define UINT24_TO_BE_STREAM(p, u24) {*(p)++ = (UINT8)((u24) >> 16); *(p)++ = (UINT8)((u24) >> 8); *(p)++ = (UINT8)(u24);}
 #define UINT16_TO_BE_STREAM(p, u16) {*(p)++ = (UINT8)((u16) >> 8); *(p)++ = (UINT8)(u16);}
@@ -498,6 +499,8 @@ typedef struct {
 #define BLE_ADDR_RANDOM         0x01
 #define BLE_ADDR_PUBLIC_ID      0x02
 #define BLE_ADDR_RANDOM_ID      0x03
+#define BLE_ADDR_TYPE_MAX       BLE_ADDR_RANDOM_ID
+#define BLE_ADDR_UNKNOWN_TYPE   0XFF
 typedef UINT8 tBLE_ADDR_TYPE;
 #define BLE_ADDR_TYPE_MASK      (BLE_ADDR_RANDOM | BLE_ADDR_PUBLIC)
 

components/bt/bluedroid/stack/include/btm_api.h

@@ -72,6 +72,8 @@ enum {
     BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED,/* 22 controller setting data length is unsupported*/
     BTM_SET_PRIVACY_SUCCESS,            /* 23 enable/disable local privacy success */
     BTM_SET_PRIVACY_FAIL,               /* 24 enable/disable local privacy failed*/
+    BTM_SET_STATIC_RAND_ADDR_FAIL,      /* 25 Command failed */
+    BTM_INVALID_STATIC_RAND_ADDR,       /* 26 invalid static rand addr */
 };
 
 typedef uint8_t tBTM_STATUS;
@@ -182,6 +184,8 @@ typedef void (tBTM_UPDATE_CONN_PARAM_CBACK) (UINT8 status, BD_ADDR bd_addr, tBTM
 
 typedef void (tBTM_SET_PKT_DATA_LENGTH_CBACK) (UINT8 status, tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS *data_length_params);
 
+typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status);
+
 typedef void (tBTM_ADD_WHITELIST_CBACK) (UINT8 status, tBTM_WL_OPERATION wl_opration);
 
 typedef void (tBTM_SET_LOCAL_PRIVACY_CBACK) (UINT8 status);

components/bt/bluedroid/stack/include/btm_ble_api.h

@@ -852,6 +852,11 @@ typedef void (*tBLE_SCAN_PARAM_SETUP_CBACK)(tGATT_IF client_if, tBTM_STATUS stat
 
 tBTM_BLE_SCAN_SETUP_CBACK bta_ble_scan_setup_cb;
 
+typedef void (tBTM_START_ADV_CMPL_CBACK) (UINT8 status);
+typedef void (tBTM_START_STOP_ADV_CMPL_CBACK) (UINT8 status);
+
+
+
 /*****************************************************************************
 **  EXTERNAL FUNCTION DECLARATIONS
 *****************************************************************************/
@@ -943,7 +948,7 @@ tBTM_STATUS BTM_BleSetAdvParams(UINT16 adv_int_min, UINT16 adv_int_max,
 *******************************************************************************/
 tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type,
                                         tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda,
-                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp);
+                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb);
 
 
 /*******************************************************************************
@@ -977,7 +982,7 @@ tBTM_STATUS BTM_BleWriteAdvData(tBTM_BLE_AD_MASK  data_mask,
 tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len);
 
 
-BOOLEAN BTM_BleSetRandAddress(BD_ADDR rand_addr);
+tBTM_STATUS BTM_BleSetRandAddress(BD_ADDR rand_addr);
 
 
 /*******************************************************************************
@@ -1610,7 +1615,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda,
 **
 *******************************************************************************/
 //extern
-tBTM_STATUS BTM_BleBroadcast(BOOLEAN start);
+tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback);
 
 /*******************************************************************************
 **

components/bt/bluedroid/stack/include/btm_ble_int.h

@@ -104,6 +104,7 @@ typedef UINT8   tBTM_BLE_SEC_REQ_ACT;
 #define BTM_VSC_CHIP_CAPABILITY_M_VERSION 95
 
 typedef enum {
+    BTM_BLE_IDLE,
     BTM_BLE_SCANNING,
     BTM_BLE_SCAN_PENDING,
     BTM_BLE_STOP_SCAN,
@@ -147,8 +148,10 @@ typedef struct {
     UINT16 adv_interval_max;
     tBTM_BLE_AFP afp; /* advertising filter policy */
     tBTM_BLE_SFP sfp; /* scanning filter policy */
-
+    tBTM_START_ADV_CMPL_CBACK *p_adv_cb;
+    tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cb;
     tBLE_ADDR_TYPE adv_addr_type;
+    BOOLEAN adv_callback_twice;
     UINT8 evt_type;
     UINT8 adv_mode;
     tBLE_BD_ADDR direct_bda;
@@ -319,7 +322,6 @@ typedef struct {
     UINT32 scan_int;
     UINT32 scan_win;
     tBTM_BLE_SEL_CBACK *p_select_cback;
-
     /* white list information */
     UINT8 white_list_avail_size;
     tBTM_ADD_WHITELIST_CBACK *add_wl_cb;

components/bt/bluedroid/stack/include/btm_int.h

@@ -486,6 +486,11 @@ typedef struct {
     tBTM_LE_KEY_TYPE    key_type;       /* bit mask of valid key types in record */
     tBTM_SEC_BLE_KEYS   keys;           /* LE device security info in slave rode */
 #endif
+#if (BLE_PRIVACY_SPT == TRUE)
+    tBLE_ADDR_TYPE      current_addr_type; /* current adv addr type*/  
+    BD_ADDR             current_addr;      /* current adv addr*/
+    bool                current_addr_valid; /* current addr info is valid or not*/
+#endif   
 } tBTM_SEC_BLE;
 
 

components/bt/bluedroid/stack/include/btu.h

@@ -234,6 +234,7 @@ extern const BD_ADDR        BT_BD_ANY;
 */
 void btu_start_timer (TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout);
 void btu_stop_timer (TIMER_LIST_ENT *p_tle);
+void btu_free_timer (TIMER_LIST_ENT *p_tle);
 void btu_start_timer_oneshot(TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout);
 void btu_stop_timer_oneshot(TIMER_LIST_ENT *p_tle);
 
@@ -245,6 +246,7 @@ void btu_uipc_rx_cback(BT_HDR *p_msg);
 #if defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0)
 void btu_start_quick_timer (TIMER_LIST_ENT *p_tle, UINT16 type, UINT32 timeout);
 void btu_stop_quick_timer (TIMER_LIST_ENT *p_tle);
+void btu_free_quick_timer (TIMER_LIST_ENT *p_tle);
 void btu_process_quick_timer_evt (void);
 #endif
 

components/bt/bluedroid/stack/include/gatt_api.h

@@ -1097,13 +1097,14 @@ extern  void GATT_StartIf (tGATT_IF gatt_if);
 **
 ** Parameters       gatt_if: applicaiton interface
 **                  bd_addr: peer device address.
+**                  bd_addr_type: peer device address type.
 **                  is_direct: is a direct conenection or a background auto connection
 **                  transport : Physical transport for GATT connection (BR/EDR or LE)
 **
 ** Returns          TRUE if connection started; FALSE if connection start failure.
 **
 *******************************************************************************/
-extern BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr,
+extern BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type,
                              BOOLEAN is_direct, tBT_TRANSPORT transport);