Merge branch 'bugfix/mdns_any_type_share_v3.1' into 'release/v3.1'

mdns: Fix a portion of the queries are issued with the wildcard query type (backport v3.1)

See merge request idf/esp-idf!3008

.gitlab-ci.yml

@@ -1,9 +1,9 @@
 stages:
   - build
   - assign_test
+  - host_test
   - unit_test
-  - test
-  - test_report
+  - integration_test
   - deploy
 
 variables:
@@ -151,6 +151,8 @@ build_ssc_01:
 build_ssc_02:
   <<: *build_ssc_template
 
+# If you want to add new build ssc jobs, please add it into dependencies of `assign_test` and `.test_template`
+
 build_esp_idf_tests:
   <<: *build_template
   artifacts:
@@ -158,7 +160,7 @@ build_esp_idf_tests:
       - tools/unit-test-app/output
       - components/idf_test/unit_test/TestCaseAll.yml
       - components/idf_test/unit_test/CIConfigs/*.yml
-    expire_in: 6 mos
+    expire_in: 1 mos
   script:
     - cd tools/unit-test-app
     - MAKEFLAGS= make help # make sure kconfig tools are built in single process
@@ -218,6 +220,7 @@ build_examples_06:
 build_examples_07:
   <<: *build_examples_template
 
+# If you want to add new build example jobs, please add it into dependencies of `.example_test_template`
 
 build_docs:
   stage: build
@@ -250,22 +253,21 @@ build_docs:
     - make html
     - ../check_doc_warnings.sh
 
-test_nvs_on_host:
-  stage: test
+.host_test_template: &host_test_template
+  stage: host_test
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - host_test
   dependencies: []
+    
+test_nvs_on_host:
+  <<: *host_test_template
   script:
     - cd components/nvs_flash/test_nvs_host
     - make test
 
 test_nvs_coverage:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
+  <<: *host_test_template
   artifacts:
     paths:
       - components/nvs_flash/test_nvs_host/coverage_report
@@ -279,63 +281,46 @@ test_nvs_coverage:
     - make coverage_report
 
 test_partition_table_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  <<: *host_test_template
   tags:
     - build
-  dependencies: []
   script:
     - cd components/partition_table/test_gen_esp32part_host
     - ./gen_esp32part_tests.py
 
 test_wl_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
+  <<: *host_test_template
   artifacts:
     paths:
       - components/wear_levelling/test_wl_host/coverage_report.zip
-  dependencies: []
   script:
     - cd components/wear_levelling/test_wl_host
     - make test
 
 test_fatfs_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  <<: *host_test_template
   tags:
     - wl_host_test
-  dependencies: []
   script:
     - cd components/fatfs/test_fatfs_host/
     - make test
 
 test_spiffs_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  <<: *host_test_template
   tags:
     - wl_host_test
-  dependencies: []
   script:
     - cd components/spiffs/test_spiffs_host/
     - make test
 
 test_multi_heap_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
+  <<: *host_test_template
   script:
     - cd components/heap/test_multi_heap_host
     - ./test_all_configs.sh
 
 test_build_system:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
+  <<: *host_test_template
   script:
     - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
     - rm -rf test_build_system
@@ -343,73 +328,14 @@ test_build_system:
     - cd test_build_system
     - ${IDF_PATH}/tools/ci/test_build_system.sh
 
-test_report:
-  stage: test_report
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - report
-  only:
-    - master
-    - triggers
-    - schedules
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-  variables:
-    LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test"
-    REPORT_PATH: "$CI_PROJECT_DIR/CI_Test_Report"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/tools/unit-test-app/tools/ModuleDefinition.yml"
-  #dependencies:
-  #We need all UT* and IT* artifacts except for only a few other
-  artifacts:
-    when: always
-    paths:
-      - $REPORT_PATH
-      - $LOG_PATH
-    expire_in: 12 mos
-  script:
-    # calc log path
-    - VER_NUM=`git rev-list HEAD | wc -l | awk '{print $1}'`
-    - SHA_ID=`echo $CI_COMMIT_SHA | cut -c 1-7`
-    - REVISION="${VER_NUM}_${SHA_ID}"
-    # replace / to _ in branch name
-    - ESCAPED_BRANCH_NAME=`echo $CI_COMMIT_REF_NAME | sed 's/\//___/g'`
-    # result path and artifacts path
-    - RESULT_PATH="$CI_PROJECT_NAME/$ESCAPED_BRANCH_NAME/$REVISION"
-    - ARTIFACTS_PATH="$GITLAB_HTTP_SERVER/idf/esp-idf/builds/$CI_JOB_ID/artifacts/browse/$CI_COMMIT_SHA"
-    # clone test bench
-    - git clone $GITLAB_SSH_SERVER/yinling/auto_test_script.git
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
-    # generate report
-    - TEST_RESULT=Pass
-    - python CITestReport.py -l $LOG_PATH -t $TEST_CASE_FILE_PATH -p $REPORT_PATH -r $RESULT_PATH -a $ARTIFACTS_PATH -m $MODULE_UPDATE_FILE || TEST_RESULT=Fail
-    # commit to CI-test-result project
-    - git clone $GITLAB_SSH_SERVER/qa/CI-test-result.git
-    - rm -rf "CI-test-result/RawData/$RESULT_PATH"
-    - cp -R $CI_PROJECT_NAME CI-test-result/RawData
-    - cd CI-test-result
-    # config git user
-    - git config --global user.email "ci-test-result@espressif.com"
-    - git config --global user.name "ci-test-result"
-    # commit test result
-    - git add .
-    - git commit . -m "update test result for $CI_PROJECT_NAME/$CI_COMMIT_REF_NAME/$CI_COMMIT_SHA, pipeline ID $CI_PIPELINE_ID" || exit 0
-    - git push origin master
-    - test "${TEST_RESULT}" = "Pass" || exit 1
-
 test_esp_err_to_name_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
+  <<: *host_test_template
   script:
     - cd tools/
     - ./gen_esp_err_to_name.py
     - git diff --exit-code -- ../components/esp32/esp_err_to_name.c || (echo 'Differences found. Please run gen_esp_err_to_name.py and commit the changes.'; exit 1)
 
-push_master_to_github:
+push_to_github:
   stage: deploy
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
@@ -420,8 +346,6 @@ push_master_to_github:
     - /^v\d+\.\d+(\.\d+)?($|-)/
   when: on_success
   dependencies: []
-  variables:
-    GITHUB_PUSH_REFS: refs/remotes/origin/release refs/remotes/origin/master
   before_script: *do_nothing_before
   script:
     - mkdir -p ~/.ssh
@@ -432,15 +356,12 @@ push_master_to_github:
     - echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
     - git remote remove github &>/dev/null || true
     - git remote add github git@github.com:espressif/esp-idf.git
-    # What the next line of script does: goes through the list of refs for all branches we push to github,
-    # generates a snippet of shell which is evaluated. The snippet checks CI_COMMIT_SHA against the SHA
-    # (aka objectname) at tip of each branch, and if any SHAs match then it checks out the local branch
-    # and then pushes that ref to a corresponding github branch
-    - eval $(git for-each-ref --shell bash --format 'if [ $CI_COMMIT_SHA == %(objectname) ]; then git checkout -B %(refname:strip=3); git push --follow-tags github %(refname:strip=3); fi;' $GITHUB_PUSH_REFS)
-
+    # Need separate push commands for tag builds and for branch builds
+    - "[ -n \"${CI_COMMIT_TAG}\" ] && git push github ${CI_COMMIT_TAG}"
+    - "[ -z \"${CI_COMMIT_TAG}\" ] && git push github ${CI_COMMIT_SHA}:refs/heads/${CI_COMMIT_REF_NAME}"
 
 deploy_docs:
-  stage: assign_test
+  stage: host_test
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - deploy
@@ -475,7 +396,7 @@ deploy_docs:
     - echo "[document preview][zh_CN] $CI_DOCKER_REGISTRY/docs/esp-idf/zh_CN/${GIT_VER}/index.html"
 
 check_doc_links:
-  stage: test
+  stage: host_test
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - check_doc_links
@@ -577,7 +498,7 @@ assign_test:
     - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
 
 .example_test_template: &example_test_template
-  stage: test
+  stage: integration_test
   when: on_success
   only:
     - master
@@ -585,14 +506,21 @@ assign_test:
     - /^v\d+\.\d+(\.\d+)?($|-)/
     - triggers
     - schedules
-  # gitlab ci do not support match job with RegEx or wildcard now in dependencies.
-  # we have a lot build example jobs and the binaries them exceed the limitation of artifacts.
-  # we can't artifact them in one job. For example test jobs, download all artifacts from previous stages.
+  dependencies:
+    - assign_test
+    - build_examples_00
+    - build_examples_01
+    - build_examples_02
+    - build_examples_03
+    - build_examples_04
+    - build_examples_05
+    - build_examples_06
+    - build_examples_07
   artifacts:
     when: always
     paths:
       - $LOG_PATH
-    expire_in: 6 mos
+    expire_in: 1 mos
   variables:
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
@@ -624,7 +552,7 @@ assign_test:
     ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"
 
 .test_template: &test_template
-  stage: test
+  stage: integration_test
   when: on_success
   only:
     - master
@@ -632,7 +560,6 @@ assign_test:
     - /^v\d+\.\d+(\.\d+)?($|-)/
     - triggers
     - schedules
-  allow_failure: true
   dependencies:
     - assign_test
     - build_ssc_00
@@ -642,7 +569,7 @@ assign_test:
     when: always
     paths:
       - $LOG_PATH
-    expire_in: 6 mos
+    expire_in: 1 mos
   variables:
     LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
     LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
@@ -671,7 +598,7 @@ nvs_compatible_test:
     paths:
       - $LOG_PATH
       - nvs_wifi.bin
-    expire_in: 6 mos
+    expire_in: 1 mos
   tags:
     - ESP32_IDF
     - NVS_Compatible
@@ -1082,6 +1009,12 @@ UT_010_04:
     - UT_T1_RMT
     - psram
 
+UT_601_01:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
 IT_001_01:
   <<: *test_template
   tags:
@@ -1250,6 +1183,12 @@ IT_010_01:
     - ESP32_IDF
     - SSC_T5_1
 
+IT_011_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T50_1
+
 IT_501_01:
   <<: *test_template
   tags:

README.md

@@ -4,22 +4,27 @@
 
 ESP-IDF is the official development framework for the [ESP32](https://espressif.com/en/products/hardware/esp32/overview) chip.
 
-# Developing With the ESP-IDF
+# Developing With ESP-IDF
 
 ## Setting Up ESP-IDF
 
 See setup guides for detailed instructions to set up the ESP-IDF:
 
-* [Windows Setup Guide](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/windows-setup.html)
-* [Mac OS Setup Guide](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/macos-setup.html)
-* [Linux Setup Guide](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/linux-setup.html)
+* [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
+* [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
 
 ## Finding a Project
 
-As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in the setup guide, ESP-IDF comes with some example projects in the [examples](examples) directory.
+As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in Getting Started, ESP-IDF comes with some example projects in the [examples](examples) directory.
 
 Once you've found the project you want to work with, change to its directory and you can configure and build it.
 
+To start your own project based on an example, copy the example project directory outside of the ESP-IDF directory.
+
+# Quick Reference
+
+See the Getting Started guide links above for a detailed setup guide. This is a quick reference for common commands when working with ESP-IDF projects:
+
 ## Configuring the Project
 
 `make menuconfig`
@@ -36,15 +41,17 @@ Once done configuring, press Escape multiple times to exit and say "Yes" to save
 
 ## Compiling the Project
 
-`make all`
+`make -j4 all`
 
 ... will compile app, bootloader and generate a partition table based on the config.
 
+NOTE: The `-j4` option causes `make` to run 4 parallel jobs. This is much faster than the default single job. The recommended number to pass to this option is `-j(number of CPUs + 1)`.
+
 ## Flashing the Project
 
 When `make all` finishes, it will print a command line to use esptool.py to flash the chip. However you can also do this from make by running:
 
-`make flash`
+`make -j4 flash`
 
 This will flash the entire project (app, bootloader and partition table) to a new chip. The settings for serial port flashing can be configured with `make menuconfig`.
 
@@ -56,24 +63,24 @@ The `make monitor` target uses the [idf_monitor tool](https://docs.espressif.com
 
 Exit the monitor by typing Ctrl-].
 
-To flash and monitor output in one pass, you can run:
+To build, flash and monitor output in one pass, you can run:
 
-`make flash monitor`
+`make -j4 flash monitor`
 
-## Compiling & Flashing Just the App
+## Compiling & Flashing Only the App
 
 After the initial flash, you may just want to build and flash just your app, not the bootloader and partition table:
 
 * `make app` - build just the app.
 * `make app-flash` - flash just the app.
 
-`make app-flash` will automatically rebuild the app if it needs it.
+`make app-flash` will automatically rebuild the app if any source files have changed.
 
 (In normal development there's no downside to reflashing the bootloader and partition table each time, if they haven't changed.)
 
 ## Parallel Builds
 
-ESP-IDF supports compiling multiple files in parallel, so all of the above commands can be run as `make -jN` where `N` is the number of parallel make processes to run (generally N should be equal to or one more than the number of CPU cores in your system.)
+ESP-IDF supports compiling multiple files in parallel, so all of the above commands can be run as `make -jN` where `N` is the number of parallel make processes to run (generally N should be equal to the number of CPU cores in your system, plus one.)
 
 Multiple make functions can be combined into one. For example: to build the app & bootloader using 5 jobs in parallel, then flash everything, and then display serial output from the ESP32 run:
 

components/app_trace/sys_view/esp32/SEGGER_RTT_esp32.c

@@ -20,7 +20,6 @@
 #include "rom/ets_sys.h"
 #include "esp_app_trace.h"
 
-#define LOG_LOCAL_LEVEL ESP_LOG_ERROR
 #include "esp_log.h"
 const static char *TAG = "segger_rtt";
 
@@ -125,7 +124,7 @@ unsigned SEGGER_RTT_WriteSkipNoLock(unsigned BufferIndex, const void* pBuffer, u
   uint8_t event_id = *pbuf;
 
   if (NumBytes > SYSVIEW_EVENTS_BUF_SZ) {
-      ESP_LOGE(TAG, "Too large event %d bytes!", NumBytes);
+      ESP_LOGE(TAG, "Too large event %u bytes!", NumBytes);
       return 0;
   }
   if (xPortGetCoreID()) { // dual core specific code

components/app_update/esp_ota_ops.c

@@ -240,14 +240,6 @@ esp_err_t esp_ota_end(esp_ota_handle_t handle)
         goto cleanup;
     }
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
-    ret = esp_secure_boot_verify_signature(it->part->address, data.image_len);
-    if (ret != ESP_OK) {
-        ret = ESP_ERR_OTA_VALIDATE_FAILED;
-        goto cleanup;
-    }
-#endif
-
  cleanup:
     LIST_REMOVE(it, entries);
     free(it);

components/bootloader/Kconfig.projbuild

@@ -275,6 +275,13 @@ config SECURE_BOOT_ALLOW_JTAG
 
           Only set this option in testing environments.
 
+config SECURE_BOOT_ALLOW_SHORT_APP_PARTITION
+       bool "Allow app partition length not 64KB aligned"
+       depends on SECURE_BOOT_INSECURE
+       help
+           If not set (default), app partition size must be a multiple of 64KB. App images are padded to 64KB length, and the bootloader checks any trailing bytes after the signature (before the next 64KB boundary) have not been written. This is because flash cache maps entire 64KB pages into the address space. This prevents an attacker from appending unverified data after the app image in the flash, causing it to be mapped into the address space.
+
+           Setting this option allows the app partition length to be unaligned, and disables padding of the app image to this length. It is generally not recommended to set this option, unless you have a legacy partitioning scheme which doesn't support 64KB aligned partition lengths.
 
 config FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_ENCRYPT
     bool "Leave UART bootloader encryption enabled"

components/bootloader/Makefile.projbuild

@@ -107,7 +107,7 @@ bootloader: $(BOOTLOADER_DIGEST_BIN)
 
 $(BOOTLOADER_DIGEST_BIN): $(BOOTLOADER_BIN) $(SECURE_BOOTLOADER_KEY)
 	@echo "DIGEST $(notdir $@)"
-	$(Q) $(ESPSECUREPY) digest_secure_bootloader -k $(SECURE_BOOTLOADER_KEY) -o $@ $<
+	$(ESPSECUREPY) digest_secure_bootloader -k $(SECURE_BOOTLOADER_KEY) -o $@ $<
 
 else # CONFIG_SECURE_BOOT_ENABLED && !CONFIG_SECURE_BOOTLOADER_REFLASHABLE && !CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH
 bootloader:

components/bootloader/subproject/main/esp32.bootloader.ld

@@ -36,19 +36,25 @@ SECTIONS
      *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
     *liblog.a:(.literal .text .literal.* .text.*)
     *libgcc.a:(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_utility.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:esp_image_format.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_random.o(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_flash.o(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:flash_partitions.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_utility.o(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:efuse.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:esp_image_format.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_encrypt.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_partitions.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot.o(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures.o(.literal .text .literal.* .text.*)
+    *libmicro-ecc.a:*.o(.literal .text .literal.* .text.*)
+    *libspi_flash.a:*.o(.literal .text .literal.* .text.*)
     *(.fini.literal)
     *(.fini)
     *(.gnu.version)
     _text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_loader_seg
-  
+
   .iram.text :
   {
     . = ALIGN (16);

components/bootloader_support/include/esp_flash_partitions.h

@@ -27,7 +27,7 @@
 #define ESP_PARTITION_TABLE_MAX_LEN 0xC00 /* Maximum length of partition table data */
 #define ESP_PARTITION_TABLE_MAX_ENTRIES (ESP_PARTITION_TABLE_MAX_LEN / sizeof(esp_partition_info_t)) /* Maximum length of partition table data, including terminating entry */
 
-/* @brief Verify the partition table (does not include verifying secure boot cryptographic signature)
+/* @brief Verify the partition table
  *
  * @param partition_table Pointer to at least ESP_PARTITION_TABLE_MAX_ENTRIES of potential partition table data. (ESP_PARTITION_TABLE_MAX_LEN bytes.)
  * @param log_errors Log errors if the partition table is invalid.
@@ -35,6 +35,13 @@
  *
  * @return ESP_OK on success, ESP_ERR_INVALID_STATE if partition table is not valid.
  */
-esp_err_t esp_partition_table_basic_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions);
+esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions);
+
+
+/* This function is included for compatibility with the ESP-IDF v3.x API */
+inline static __attribute__((deprecated)) esp_err_t esp_partition_table_basic_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions)
+{
+    return esp_partition_table_verify(partition_table, log_errors, num_partitions);
+}
 
 #endif

components/bootloader_support/src/bootloader_common.c

@@ -26,6 +26,7 @@
 #include "esp_flash_partitions.h"
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
+#include "soc/gpio_periph.h"
 
 static const char* TAG = "boot_comm";
 
@@ -42,6 +43,9 @@ bool bootloader_common_ota_select_valid(const esp_ota_select_entry_t *s)
 esp_comm_gpio_hold_t bootloader_common_check_long_hold_gpio(uint32_t num_pin, uint32_t delay_sec)
 {
     gpio_pad_select_gpio(num_pin);
+    if (GPIO_PIN_MUX_REG[num_pin]) {
+        PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[num_pin]);
+    }
     gpio_pad_pullup(num_pin);
     uint32_t tm_start = esp_log_early_timestamp();
     if (GPIO_INPUT_GET(num_pin) == 1) {
@@ -96,18 +100,6 @@ bool bootloader_common_erase_part_type_data(const char *list_erase, bool ota_dat
     int num_partitions;
     bool ret = true;
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
-    if (esp_secure_boot_enabled()) {
-        ESP_LOGI(TAG, "Verifying partition table signature...");
-        err = esp_secure_boot_verify_signature(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
-        if (err != ESP_OK) {
-            ESP_LOGE(TAG, "Failed to verify partition table signature.");
-            return false;
-        }
-        ESP_LOGD(TAG, "Partition table signature verified");
-    }
-#endif
-
     partitions = bootloader_mmap(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
     if (!partitions) {
             ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
@@ -115,7 +107,7 @@ bool bootloader_common_erase_part_type_data(const char *list_erase, bool ota_dat
     }
     ESP_LOGD(TAG, "mapped partition table 0x%x at 0x%x", ESP_PARTITION_TABLE_OFFSET, (intptr_t)partitions);
 
-    err = esp_partition_table_basic_verify(partitions, true, &num_partitions);
+    err = esp_partition_table_verify(partitions, true, &num_partitions);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Failed to verify partition table");
         ret = false;

components/bootloader_support/src/bootloader_sha.c

@@ -28,7 +28,10 @@ bootloader_sha256_handle_t bootloader_sha256_start()
         return NULL;
     }
     mbedtls_sha256_init(ctx);
-    assert(mbedtls_sha256_starts_ret(ctx, false) == 0);
+    int ret = mbedtls_sha256_starts_ret(ctx, false);
+    if (ret != 0) {
+        return NULL;
+    }
     return ctx;
 }
 
@@ -36,7 +39,8 @@ void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data,
 {
     assert(handle != NULL);
     mbedtls_sha256_context *ctx = (mbedtls_sha256_context *)handle;
-    assert(mbedtls_sha256_update_ret(ctx, data, data_len) == 0);
+    int ret = mbedtls_sha256_update_ret(ctx, data, data_len);
+    assert(ret == 0);
 }
 
 void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest)
@@ -44,7 +48,8 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
     assert(handle != NULL);
     mbedtls_sha256_context *ctx = (mbedtls_sha256_context *)handle;
     if (digest != NULL) {
-        assert(mbedtls_sha256_finish_ret(ctx, digest) == 0);
+        int ret = mbedtls_sha256_finish_ret(ctx, digest);
+        assert(ret == 0);
     }
     mbedtls_sha256_free(ctx);
     free(handle);

components/bootloader_support/src/bootloader_utility.c

@@ -72,18 +72,6 @@ bool bootloader_utility_load_partition_table(bootloader_state_t* bs)
     esp_err_t err;
     int num_partitions;
 
-#ifdef CONFIG_SECURE_BOOT_ENABLED
-    if(esp_secure_boot_enabled()) {
-        ESP_LOGI(TAG, "Verifying partition table signature...");
-        err = esp_secure_boot_verify_signature(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
-        if (err != ESP_OK) {
-            ESP_LOGE(TAG, "Failed to verify partition table signature.");
-            return false;
-        }
-        ESP_LOGD(TAG, "Partition table signature verified");
-    }
-#endif
-
     partitions = bootloader_mmap(ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
     if (!partitions) {
         ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", ESP_PARTITION_TABLE_OFFSET, ESP_PARTITION_TABLE_MAX_LEN);
@@ -91,7 +79,7 @@ bool bootloader_utility_load_partition_table(bootloader_state_t* bs)
     }
     ESP_LOGD(TAG, "mapped partition table 0x%x at 0x%x", ESP_PARTITION_TABLE_OFFSET, (intptr_t)partitions);
 
-    err = esp_partition_table_basic_verify(partitions, true, &num_partitions);
+    err = esp_partition_table_verify(partitions, true, &num_partitions);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Failed to verify partition table");
         return false;
@@ -222,8 +210,8 @@ int bootloader_utility_get_selected_boot_partition(const bootloader_state_t *bs)
         bootloader_munmap(ota_select_map);
 
         ESP_LOGD(TAG, "OTA sequence values A 0x%08x B 0x%08x", sa.ota_seq, sb.ota_seq);
-        if(sa.ota_seq == UINT32_MAX && sb.ota_seq == UINT32_MAX) {
-            ESP_LOGD(TAG, "OTA sequence numbers both empty (all-0xFF)");
+        if ((sa.ota_seq == UINT32_MAX && sb.ota_seq == UINT32_MAX) || (bs->app_count == 0)) {
+            ESP_LOGD(TAG, "OTA sequence numbers both empty (all-0xFF) or partition table does not have bootable ota_apps (app_count=%d)", bs->app_count);
             if (bs->factory.offset != 0) {
                 ESP_LOGI(TAG, "Defaulting to factory image");
                 return FACTORY_INDEX;

components/bootloader_support/src/flash_encrypt.c

@@ -254,7 +254,7 @@ static esp_err_t encrypt_and_load_partition_table(esp_partition_info_t *partitio
         ESP_LOGE(TAG, "Failed to read partition table data");
         return err;
     }
-    if (esp_partition_table_basic_verify(partition_table, false, num_partitions) == ESP_OK) {
+    if (esp_partition_table_verify(partition_table, false, num_partitions) == ESP_OK) {
         ESP_LOGD(TAG, "partition table is plaintext. Encrypting...");
         esp_err_t err = esp_flash_encrypt_region(ESP_PARTITION_TABLE_OFFSET,
                                                  FLASH_SECTOR_SIZE);

components/bootloader_support/src/flash_partitions.c

@@ -20,7 +20,7 @@
 
 static const char *TAG = "flash_parts";
 
-esp_err_t esp_partition_table_basic_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions)
+esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table, bool log_errors, int *num_partitions)
 {
     int md5_found = 0;
     int num_parts;

components/bootloader_support/src/flash_qio_mode.c

@@ -35,6 +35,7 @@
 #define CMD_WRDI       0x04
 #define CMD_RDSR       0x05
 #define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
 
 static const char *TAG = "qio_mode";
 
@@ -65,6 +66,11 @@ static void write_status_8b_wrsr2(unsigned new_status);
 /* Write 16 bit status using WRSR */
 static void write_status_16b_wrsr(unsigned new_status);
 
+/* Read 8 bit status of XM25QU64A  */
+static unsigned read_status_8b_xmc25qu64a();
+/* Write 8 bit status of XM25QU64A */
+static void write_status_8b_xmc25qu64a(unsigned new_status);
+
 #define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD has this GPIO wired to WP pin of flash */
 
 #ifndef CONFIG_BOOTLOADER_SPI_WP_PIN // Set in menuconfig if SPI flasher config is set to a quad mode
@@ -84,11 +90,12 @@ static void write_status_16b_wrsr(unsigned new_status);
    Searching of this table stops when the first match is found.
  */
 const static qio_info_t chip_data[] = {
-/*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,          QIE Bit */
-    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,  6 },
-    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,  6 }, /* IDs 0x40xx, 0x70xx */
-    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr, 9 },
-    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr, 9 },
+/*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,               QIE Bit */
+    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 },
+    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
+    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
+    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
+    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },
 
     /* Final entry is default entry, if no other IDs have matched.
 
@@ -96,7 +103,7 @@ const static qio_info_t chip_data[] = {
        GigaDevice (mfg ID 0xC8, flash IDs including 4016),
        FM25Q32 (QOUT mode only, mfg ID 0xA1, flash IDs including 4016)
     */
-    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2, 1 },
+    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2,      1 },
 };
 
 #define NUM_CHIPS (sizeof(chip_data) / sizeof(qio_info_t))
@@ -246,6 +253,24 @@ static void write_status_16b_wrsr(unsigned new_status)
     execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }
 
+static unsigned read_status_8b_xmc25qu64a()
+{
+    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    uint32_t read_status = execute_flash_command(CMD_RDSR, 0, 0, 8);
+    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+    return read_status;
+}
+
+static void write_status_8b_xmc25qu64a(unsigned new_status)
+{
+    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+}
+
 static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
 {
     uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;

components/bootloader_support/src/secure_boot_signatures.c

@@ -84,10 +84,13 @@ esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block
         return ESP_FAIL;
     }
 
+    ESP_LOGD(TAG, "Verifying secure boot signature");
+
     is_valid = uECC_verify(signature_verification_key_start,
                                 image_digest,
                                 DIGEST_LEN,
                                 sig_block->signature,
                                 uECC_secp256r1());
+    ESP_LOGD(TAG, "Verification result %d", is_valid);
     return is_valid ? ESP_OK : ESP_ERR_IMAGE_INVALID;
 }

components/bt/Kconfig

@@ -1004,6 +1004,15 @@ config BT_BLE_DYNAMIC_ENV_MEMORY
     help
         This select can make the allocation of memory will become more flexible
 
+config BLE_HOST_QUEUE_CONGESTION_CHECK
+    bool "BLE queue congestion check"
+    depends on BLUEDROID_ENABLED
+    default n
+    help
+        When scanning and scan duplicate is not enabled, if there are a lot of adv packets around or application layer 
+        handling adv packets is slow, it will cause the controller memory to run out. if enabled, adv packets will be 
+        lost when host queue is congested.
+
 config BLE_SCAN_DUPLICATE
     bool "BLE Scan Duplicate Options "
     depends on BLUEDROID_ENABLED
@@ -1014,8 +1023,8 @@ config BLE_SCAN_DUPLICATE
 config DUPLICATE_SCAN_CACHE_SIZE
     int "Maximum number of devices in scan duplicate filter"
     depends on BLE_SCAN_DUPLICATE
-    range 10 200
-    default 20
+    range 10 1000
+    default 50
     help
         Maximum number of devices which can be recorded in scan duplicate filter.
         When the maximum amount of device in the filter is reached, the cache will be refreshed.
@@ -1030,8 +1039,8 @@ config BLE_MESH_SCAN_DUPLICATE_EN
 config MESH_DUPLICATE_SCAN_CACHE_SIZE
     int "Maximum number of Mesh adv packets in scan duplicate filter"
     depends on BLE_MESH_SCAN_DUPLICATE_EN
-    range 10 200
-    default 50
+    range 10 1000
+    default 100
     help
         Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
         When the maximum amount of device in the filter is reached, the cache will be refreshed.

components/bt/bluedroid/api/esp_gattc_api.c

@@ -164,6 +164,7 @@ esp_gatt_status_t esp_ble_gattc_get_all_char(esp_gatt_if_t gattc_if,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     if ((start_handle == 0) && (end_handle == 0)) {
+        *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
@@ -206,6 +207,7 @@ esp_gatt_status_t esp_ble_gattc_get_char_by_uuid(esp_gatt_if_t gattc_if,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
@@ -247,6 +249,7 @@ esp_gatt_status_t esp_ble_gattc_get_descr_by_char_handle(esp_gatt_if_t gattc_if,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     if (char_handle == 0) {
+        *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
     
@@ -269,6 +272,7 @@ esp_gatt_status_t esp_ble_gattc_get_include_service(esp_gatt_if_t gattc_if,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
@@ -291,6 +295,7 @@ esp_gatt_status_t esp_ble_gattc_get_attr_count(esp_gatt_if_t gattc_if,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     if ((start_handle == 0 && end_handle == 0) && (type != ESP_GATT_DB_DESCRIPTOR)) {
+        *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 
@@ -308,6 +313,7 @@ esp_gatt_status_t esp_ble_gattc_get_db(esp_gatt_if_t gattc_if, uint16_t conn_id,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
     if (start_handle == 0 && end_handle == 0) {
+        *count = 0;
         return ESP_GATT_INVALID_HANDLE;
     }
 

components/bt/bluedroid/api/esp_gatts_api.c

@@ -261,7 +261,7 @@ esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id,
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
     
     if (L2CA_CheckIsCongest(L2CAP_ATT_CID, conn_id)) {
-        LOG_ERROR("%s, the l2cap chanel is congest.", __func__);
+        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
         return ESP_FAIL;
     }
     

components/bt/bluedroid/api/include/api/esp_gatts_api.h

@@ -350,7 +350,8 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
                                             uint8_t max_nb_attr,
                                             uint8_t srvc_inst_id);
 /**
- * @brief           This function is called to add an included service. After included
+ * @brief           This function is called to add an included service. This function have to be called between 
+ *                  'esp_ble_gatts_create_service' and 'esp_ble_gatts_add_char'.  After included
  *                  service is included, a callback event BTA_GATTS_ADD_INCL_SRVC_EVT
  *                  is reported the included service ID.
  *

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -602,16 +602,16 @@ void bta_dm_ble_read_adv_tx_power(tBTA_DM_MSG *p_data)
     if (p_data->read_tx_power.read_tx_power_cb != NULL) {
         BTM_BleReadAdvTxPower(p_data->read_tx_power.read_tx_power_cb);
     } else {
-        APPL_TRACE_ERROR("%s(), the callback function cann't be NULL.", __func__);
+        APPL_TRACE_ERROR("%s(), the callback function can't be NULL.", __func__);
     }
 }
 
 void bta_dm_ble_read_rssi(tBTA_DM_MSG *p_data)
 {
     if (p_data->rssi.read_rssi_cb != NULL) {
-        BTM_ReadRSSI(p_data->rssi.remote_addr, p_data->rssi.read_rssi_cb);
+        BTM_ReadRSSI(p_data->rssi.remote_addr, p_data->rssi.transport, p_data->rssi.read_rssi_cb);
     } else {
-        APPL_TRACE_ERROR("%s(), the callback function cann't be NULL.", __func__);
+        APPL_TRACE_ERROR("%s(), the callback function can't be NULL.", __func__);
     }
 }
 
@@ -698,7 +698,7 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
 ** Description      Removes device, Disconnects ACL link if required.
 ****
 *******************************************************************************/
-void bta_dm_process_remove_device(BD_ADDR bd_addr)
+static void bta_dm_process_remove_device(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 {
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
     /* need to remove all pending background connection before unpair */
@@ -711,12 +711,16 @@ void bta_dm_process_remove_device(BD_ADDR bd_addr)
     /* remove all cached GATT information */
     BTA_GATTC_Refresh(bd_addr, false);
 #endif
-
     if (bta_dm_cb.p_sec_cback) {
         tBTA_DM_SEC sec_event;
         bdcpy(sec_event.link_down.bd_addr, bd_addr);
         sec_event.link_down.status = HCI_SUCCESS;
-        bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &sec_event);
+        if (transport == BT_TRANSPORT_LE){
+            bta_dm_cb.p_sec_cback(BTA_DM_BLE_DEV_UNPAIRED_EVT, &sec_event);
+        } else {
+            bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &sec_event);
+        }
+
     }
 }
 
@@ -734,15 +738,11 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
         return;
     }
 
-    BD_ADDR other_address;
-    bdcpy(other_address, p_dev->bd_addr);
-
     /* If ACL exists for the device in the remove_bond message*/
     BOOLEAN continue_delete_dev = FALSE;
-    UINT8 other_transport = BT_TRANSPORT_INVALID;
+    UINT8 transport = p_dev->transport;
 
-    if (BTM_IsAclConnectionUp(p_dev->bd_addr, BT_TRANSPORT_LE) ||
-            BTM_IsAclConnectionUp(p_dev->bd_addr, BT_TRANSPORT_BR_EDR)) {
+    if (BTM_IsAclConnectionUp(p_dev->bd_addr, transport)) {
         APPL_TRACE_DEBUG("%s: ACL Up count  %d", __func__, bta_dm_cb.device_list.count);
         continue_delete_dev = FALSE;
 
@@ -753,13 +753,6 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
                 btm_remove_acl( p_dev->bd_addr, bta_dm_cb.device_list.peer_device[i].transport);
                 APPL_TRACE_DEBUG("%s:transport = %d", __func__,
                                  bta_dm_cb.device_list.peer_device[i].transport);
-
-                /* save the other transport to check if device is connected on other_transport */
-                if (bta_dm_cb.device_list.peer_device[i].transport == BT_TRANSPORT_LE) {
-                    other_transport = BT_TRANSPORT_BR_EDR;
-                } else {
-                    other_transport = BT_TRANSPORT_LE;
-                }
                 break;
             }
         }
@@ -767,35 +760,9 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
         continue_delete_dev = TRUE;
     }
 
-    // If it is DUMO device and device is paired as different address, unpair that device
-    // if different address
-    BOOLEAN continue_delete_other_dev = FALSE;
-    if ((other_transport && (BTM_ReadConnectedTransportAddress(other_address, other_transport))) ||
-            (!other_transport && (BTM_ReadConnectedTransportAddress(other_address, BT_TRANSPORT_BR_EDR) ||
-                                  BTM_ReadConnectedTransportAddress(other_address, BT_TRANSPORT_LE)))) {
-        continue_delete_other_dev = FALSE;
-        /* Take the link down first, and mark the device for removal when disconnected */
-        for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
-            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, other_address)) {
-                bta_dm_cb.device_list.peer_device[i].conn_state = BTA_DM_UNPAIRING;
-                btm_remove_acl(other_address, bta_dm_cb.device_list.peer_device[i].transport);
-                break;
-            }
-        }
-    } else {
-        APPL_TRACE_DEBUG("%s: continue to delete the other dev ", __func__);
-        continue_delete_other_dev = TRUE;
-    }
-
     /* Delete the device mentioned in the msg */
     if (continue_delete_dev) {
-        bta_dm_process_remove_device(p_dev->bd_addr);
-    }
-
-    /* Delete the other paired device too */
-    BD_ADDR dummy_bda = {0};
-    if (continue_delete_other_dev && (bdcmp(other_address, dummy_bda) != 0)) {
-        bta_dm_process_remove_device(other_address);
+        bta_dm_process_remove_device(p_dev->bd_addr, transport);
     }
 }
 
@@ -3351,7 +3318,11 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         if ( bta_dm_cb.p_sec_cback ) {
             bta_dm_cb.p_sec_cback(BTA_DM_LINK_DOWN_EVT, &conn);
             if ( issue_unpair_cb ) {
-                bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &conn);
+                if (p_data->acl_change.transport == BT_TRANSPORT_LE) {
+                    bta_dm_cb.p_sec_cback(BTA_DM_BLE_DEV_UNPAIRED_EVT, &conn);
+                } else {
+                    bta_dm_cb.p_sec_cback(BTA_DM_DEV_UNPAIRED_EVT, &conn);
+                }
             }
         }
     }
@@ -4665,7 +4636,7 @@ void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data)
 void bta_dm_ble_stop_advertising(tBTA_DM_MSG *p_data)
 {
     if (p_data->hdr.event != BTA_DM_API_BLE_STOP_ADV_EVT) {
-        APPL_TRACE_ERROR("Invalid BTA event,cann't stop the BLE adverting\n");
+        APPL_TRACE_ERROR("Invalid BTA event,can't stop the BLE adverting\n");
     }
 
     btm_ble_stop_adv();

components/bt/bluedroid/bta/dm/bta_dm_api.c

@@ -206,12 +206,13 @@ void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb)
     }
 }
 
-void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_CMPL_CB *cmpl_cb)
+void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb)
 {
     tBTA_DM_API_READ_RSSI *p_msg;
     if ((p_msg = (tBTA_DM_API_READ_RSSI *)osi_malloc(sizeof(tBTA_DM_API_READ_RSSI))) != NULL) {
         p_msg->hdr.event = BTA_DM_API_BLE_READ_RSSI_EVT;
         memcpy(p_msg->remote_addr, remote_addr, sizeof(BD_ADDR));
+        p_msg->transport = transport;
         p_msg->read_rssi_cb = cmpl_cb;
         bta_sys_sendmsg(p_msg);
     }
@@ -569,7 +570,7 @@ void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
 ** Returns          void
 **
 *******************************************************************************/
-tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr)
+tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 {
     tBTA_DM_API_REMOVE_DEVICE *p_msg;
 
@@ -578,6 +579,7 @@ tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr)
 
         p_msg->hdr.event = BTA_DM_API_REMOVE_DEVICE_EVT;
         bdcpy(p_msg->bd_addr, bd_addr);
+        p_msg->transport = transport;
         bta_sys_sendmsg(p_msg);
     } else {
         return BTA_FAILURE;

components/bt/bluedroid/bta/dm/include/bta_dm_int.h

@@ -196,6 +196,7 @@ typedef struct {
 typedef struct {
     BT_HDR        hdr;
     BD_ADDR       remote_addr;
+    tBTA_TRANSPORT  transport;
     tBTA_CMPL_CB  *read_rssi_cb;
 }tBTA_DM_API_READ_RSSI;
 
@@ -391,6 +392,7 @@ typedef struct {
 typedef struct {
     BT_HDR              hdr;
     BD_ADDR             bd_addr;
+    UINT8               transport;
 } tBTA_DM_API_REMOVE_DEVICE;
 
 /* data type for BTA_DM_API_EXECUTE_CBACK_EVT */

components/bt/bluedroid/bta/gatt/bta_gattc_act.c

@@ -672,6 +672,8 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             if (bta_gattc_cache_load(p_clcb)) {
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
                 bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
+                //register service change
+                bta_gattc_register_service_change_notify(p_clcb->bta_conn_id, p_clcb->bda);
             } else 
 #endif
             { /* cache is building */
@@ -1296,6 +1298,7 @@ void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
     cb_data.write.conn_id = p_clcb->bta_conn_id;
     if (p_conn && p_conn->svc_change_descr_handle == cb_data.write.handle) {
         if(cb_data.write.status != BTA_GATT_OK) {
+            p_conn->write_remote_svc_change_ccc_done = FALSE;
             APPL_TRACE_ERROR("service change write ccc failed");
         }
         return;
@@ -1875,6 +1878,10 @@ BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,
 
             /* if connection available, refresh cache by doing discovery now */
             if (p_clcb != NULL) {
+                tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find(p_clcb->bda);
+                if(p_conn) {
+                    p_conn->write_remote_svc_change_ccc_done = FALSE;
+                }
                 bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
             }
         }
@@ -2280,6 +2287,10 @@ tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_
     tBT_UUID gatt_service_uuid = {LEN_UUID_16, {UUID_SERVCLASS_GATT_SERVER}};
     tBT_UUID gatt_service_change_uuid = {LEN_UUID_16, {GATT_UUID_GATT_SRV_CHGD}};
     tBT_UUID gatt_ccc_uuid = {LEN_UUID_16, {GATT_UUID_CHAR_CLIENT_CONFIG}};
+    tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find_alloc(remote_bda);
+    if(p_conn && p_conn->write_remote_svc_change_ccc_done) {
+        return SERVICE_CHANGE_CCC_WRITTEN_SUCCESS;
+    }
 
     p_srcb = bta_gattc_find_srcb(remote_bda);
     if ((p_srcb != NULL) && (p_srcb->p_srvc_cache != NULL)) {
@@ -2344,9 +2355,9 @@ tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_
     }
 
     if (gatt_ccc_found == TRUE){
-        tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find_alloc(remote_bda);
         if (p_conn) {
             p_conn->svc_change_descr_handle = p_desc->handle;
+            p_conn->write_remote_svc_change_ccc_done = TRUE;
         }
         result = SERVICE_CHANGE_CCC_WRITTEN_SUCCESS;
         uint16_t indicate_value = GATT_CLT_CONFIG_INDICATION;

components/bt/bluedroid/bta/gatt/bta_gattc_cache.c

@@ -376,14 +376,8 @@ static tBTA_GATT_STATUS bta_gattc_add_attr_to_cache(tBTA_GATTC_SERV *p_srvc_cb,
         isvc->included_service = bta_gattc_find_matching_service(
                                     p_srvc_cb->p_srvc_cache, incl_srvc_s_handle);
         if (!isvc->included_service) {
-            // if it is a secondary service, wait to update later
-            if(property == 0){
-                p_srvc_cb->update_sec_sev = true;   
-            } else {
-                APPL_TRACE_ERROR("%s: Illegal action to add non-existing included service!", __func__);
-                osi_free(isvc);
-                return GATT_WRONG_STATE;
-            }
+            // if can't find included service, wait to update later
+            p_srvc_cb->update_incl_srvc = true;
         }
 
         list_append(service->included_svc, isvc);
@@ -606,10 +600,10 @@ static void bta_gattc_explore_srvc(UINT16 conn_id, tBTA_GATTC_SERV *p_srvc_cb)
             return;
         }
     }
-    //update include service when have secondary service
-    if(p_srvc_cb->update_sec_sev) {
+    // if update_incl_srvc is true, update include service
+    if(p_srvc_cb->update_incl_srvc) {
         bta_gattc_update_include_service(p_srvc_cb->p_srvc_cache);
-        p_srvc_cb->update_sec_sev = false;
+        p_srvc_cb->update_incl_srvc = false;
     }
     /* no service found at all, the end of server discovery*/
     APPL_TRACE_DEBUG("%s no more services found", __func__);
@@ -1658,7 +1652,8 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
     if (p_clcb == NULL) {
-        return NULL;
+        *count = 0;
+        return;
     }
     
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;

components/bt/bluedroid/bta/gatt/include/bta_gattc_int.h

@@ -300,7 +300,7 @@ typedef struct {
     UINT16              attr_index;     /* cahce NV saving/loading attribute index */
 
     UINT16              mtu;
-    bool                update_sec_sev;
+    bool                update_incl_srvc;
 } tBTA_GATTC_SERV;
 
 #ifndef BTA_GATTC_NOTIF_REG_MAX
@@ -365,7 +365,8 @@ typedef struct {
 typedef struct {
     BOOLEAN             in_use;
     BD_ADDR             remote_bda;
-    UINT16              svc_change_descr_handle; 
+    UINT16              svc_change_descr_handle;
+    BOOLEAN             write_remote_svc_change_ccc_done;
 } tBTA_GATTC_CONN;
 
 enum {

components/bt/bluedroid/bta/hf_client/bta_hf_client_sco.c

@@ -46,7 +46,7 @@ static const tBTM_ESCO_PARAMS bta_hf_client_esco_params[] = {
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
-        .retrans_effort = BTM_ESCO_RETRANS_POWER,
+        .retrans_effort = BTM_ESCO_RETRANS_OFF,
     },
     /* ESCO CVSD */
     {

components/bt/bluedroid/bta/include/bta/bta_api.h

@@ -631,10 +631,11 @@ typedef UINT8 tBTA_SIG_STRENGTH_MASK;
 #define BTA_DM_SP_RMT_OOB_EXT_EVT       23      /* Simple Pairing Remote OOB Extended Data request. */
 #define BTA_DM_BLE_AUTH_CMPL_EVT        24      /* BLE Auth complete */
 // btla-specific --
-#define BTA_DM_DEV_UNPAIRED_EVT         25
+#define BTA_DM_DEV_UNPAIRED_EVT         25      /* BT unpair event */
 #define BTA_DM_HW_ERROR_EVT             26      /* BT Chip H/W error */
 #define BTA_DM_LE_FEATURES_READ         27      /* Cotroller specific LE features are read */
 #define BTA_DM_ENER_INFO_READ           28      /* Energy info read */
+#define BTA_DM_BLE_DEV_UNPAIRED_EVT     29      /* BLE unpair event */
 typedef UINT8 tBTA_DM_SEC_EVT;
 
 /* Structure associated with BTA_DM_ENABLE_EVT */
@@ -1428,7 +1429,7 @@ extern void BTA_DmUpdateWhiteList(BOOLEAN add_remove,  BD_ADDR remote_addr, tBTA
 
 extern void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb);
 
-extern void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_CMPL_CB *cmpl_cb);
+extern void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb);
 
 /*******************************************************************************
 **
@@ -1632,7 +1633,7 @@ extern void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class,
 **                  BTA_FAIL if operation failed.
 **
 *******************************************************************************/
-extern tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr);
+extern tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport);
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/jv/bta_jv_act.c

@@ -22,7 +22,6 @@
  *
  ******************************************************************************/
 
-#include <arpa/inet.h>
 #include <pthread.h>
 #include <stdlib.h>
 

components/bt/bluedroid/btc/core/btc_dm.c

@@ -182,6 +182,10 @@ static void btc_dm_remove_ble_bonding_keys(void)
 
 static void btc_dm_save_ble_bonding_keys(void)
 {
+    if(!(pairing_cb.ble.is_penc_key_rcvd || pairing_cb.ble.is_pid_key_rcvd || pairing_cb.ble.is_pcsrk_key_rcvd || 
+         pairing_cb.ble.is_lenc_key_rcvd || pairing_cb.ble.is_lcsrk_key_rcvd || pairing_cb.ble.is_lidk_key_rcvd)) {
+        return ;
+    }
     bt_bdaddr_t bd_addr;
 
     bdcpy(bd_addr.address, pairing_cb.bd_addr);
@@ -495,10 +499,23 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
     case BTA_DM_DEV_UNPAIRED_EVT: {
 #if (SMP_INCLUDED == TRUE)
         bt_bdaddr_t bd_addr;
-        rsp_app = true;
         BTC_TRACE_DEBUG("BTA_DM_DEV_UNPAIRED_EVT");
         memcpy(bd_addr.address, p_data->link_down.bd_addr, sizeof(BD_ADDR));
         btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
+        if (p_data->link_down.status == HCI_SUCCESS) {
+            //remove the bonded key in the config and nvs flash.
+            btc_storage_remove_bonded_device(&bd_addr);
+        }
+#endif /* #if (SMP_INCLUDED == TRUE) */
+        break;
+    }
+    case BTA_DM_BLE_DEV_UNPAIRED_EVT: {
+#if (SMP_INCLUDED == TRUE)
+        bt_bdaddr_t bd_addr;
+        rsp_app = true;
+        BTC_TRACE_DEBUG("BTA_DM_BLE_DEV_UNPAIRED_EVT");
+        memcpy(bd_addr.address, p_data->link_down.bd_addr, sizeof(BD_ADDR));
+        btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
         param.remove_bond_dev_cmpl.status = ESP_BT_STATUS_FAIL;
 
         if (p_data->link_down.status == HCI_SUCCESS) {

components/bt/bluedroid/btc/core/btc_task.c

@@ -170,6 +170,9 @@ int btc_init(void)
         return BT_STATUS_NOMEM;
     }
     btc_gap_callback_init();
+#if SCAN_QUEUE_CONGEST_CHECK
+    btc_adv_list_init();
+#endif
     /* TODO: initial the profile_tab */
     return BT_STATUS_SUCCESS;
 }
@@ -178,7 +181,18 @@ void btc_deinit(void)
 {
     vTaskDelete(xBtcTaskHandle);
     vQueueDelete(xBtcQueue);
-
+#if SCAN_QUEUE_CONGEST_CHECK
+    btc_adv_list_deinit();
+#endif
     xBtcTaskHandle = NULL;
     xBtcQueue = 0;
 }
+
+bool btc_check_queue_is_congest(void)
+{
+    UBaseType_t wait_size = uxQueueMessagesWaiting(xBtcQueue);
+    if(wait_size >= QUEUE_CONGEST_SIZE) {
+        return true;
+    }
+    return false;
+}

components/bt/bluedroid/btc/include/btc/btc_task.h

@@ -28,6 +28,11 @@ typedef struct btc_msg {
     void   *arg;    //param for btc function or function param
 } btc_msg_t;
 
+typedef struct btc_adv_packet {
+    uint8_t addr[6];
+    uint8_t addr_type;
+} btc_adv_packet_t;
+
 typedef enum {
     BTC_SIG_API_CALL = 0,   // APP TO STACK
     BTC_SIG_API_CB,         // STACK TO APP
@@ -72,5 +77,6 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 
 int btc_init(void);
 void btc_deinit(void);
+bool btc_check_queue_is_congest(void);
 
 #endif /* __BTC_TASK_H__ */

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c

@@ -763,7 +763,7 @@ static void btc_a2dp_sink_thread_init(UNUSED_ATTR void *context)
 
     btc_a2dp_sink_state = BTC_A2DP_SINK_STATE_ON;
 
-    btc_aa_snk_cb.RxSbcQ = fixed_queue_new(SIZE_MAX);
+    btc_aa_snk_cb.RxSbcQ = fixed_queue_new(QUEUE_SIZE_MAX);
 
     btc_a2dp_control_init();
 }

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c

@@ -1616,7 +1616,7 @@ static void btc_a2dp_source_thread_init(UNUSED_ATTR void *context)
 
     btc_a2dp_source_state = BTC_A2DP_SOURCE_STATE_ON;
 
-    btc_aa_src_cb.TxAaQ = fixed_queue_new(SIZE_MAX);
+    btc_aa_src_cb.TxAaQ = fixed_queue_new(QUEUE_SIZE_MAX);
 
     btc_a2dp_control_init();
 }

components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -28,9 +28,23 @@
 #include "btc/btc_ble_storage.h"
 #include "btc/btc_dm.h"
 #include "btc/btc_util.h"
+#include "osi/mutex.h"
 
 static tBTA_BLE_ADV_DATA gl_bta_adv_data;
 static tBTA_BLE_ADV_DATA gl_bta_scan_rsp_data;
+#if SCAN_QUEUE_CONGEST_CHECK
+static list_t *adv_filter_list;
+static osi_mutex_t adv_list_lock;
+bool btc_check_adv_list(uint8_t * addr, uint8_t addr_type);
+uint32_t btc_get_adv_list_length(void);
+void btc_adv_list_refresh(void);
+void btc_adv_list_lock(void);
+void btc_adv_list_unlock(void);
+static uint16_t btc_adv_list_count = 0;
+
+#define  BTC_ADV_LIST_MAX_LENGTH    50
+#define  BTC_ADV_LIST_MAX_COUNT     200
+#endif
 
 static inline void btc_gap_ble_cb_to_app(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param)
 {
@@ -510,6 +524,19 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
     param.scan_rst.search_evt = event;
     switch (event) {
     case BTA_DM_INQ_RES_EVT: {
+#if SCAN_QUEUE_CONGEST_CHECK
+        if(btc_check_queue_is_congest()) {
+            BTC_TRACE_DEBUG("BtcQueue is congested");
+            if(btc_get_adv_list_length() > BTC_ADV_LIST_MAX_LENGTH || btc_adv_list_count > BTC_ADV_LIST_MAX_COUNT) {
+                btc_adv_list_refresh();
+                btc_adv_list_count = 0;
+            }
+            if(btc_check_adv_list(p_data->inq_res.bd_addr, p_data->inq_res.ble_addr_type)) {
+                return;
+            }
+        }
+        btc_adv_list_count ++;
+#endif
         bdcpy(param.scan_rst.bda, p_data->inq_res.bd_addr);
         param.scan_rst.dev_type = p_data->inq_res.device_type;
         param.scan_rst.rssi = p_data->inq_res.rssi;
@@ -585,6 +612,9 @@ static void btc_stop_scan_callback(tBTA_STATUS status)
     if (ret != BT_STATUS_SUCCESS) {
         BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
     }
+#if SCAN_QUEUE_CONGEST_CHECK
+    btc_adv_list_refresh();
+#endif
 }
 
 void btc_update_conn_param_callback (UINT8 status, BD_ADDR bd_addr, tBTM_LE_UPDATE_CONN_PRAMS *update_conn_params)
@@ -725,6 +755,9 @@ static void btc_ble_start_scanning(uint32_t duration,
                                    tBTA_START_STOP_SCAN_CMPL_CBACK *start_scan_cb)
 {
     if ((results_cb != NULL) && (start_scan_cb != NULL)) {
+#if SCAN_QUEUE_CONGEST_CHECK
+        btc_adv_list_refresh();
+#endif
         //Start scan the device
         BTA_DmBleScan(true, duration, results_cb, start_scan_cb);
     } else {
@@ -1018,7 +1051,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
         BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, btc_add_whitelist_complete_callback);
         break;
     case BTC_GAP_BLE_ACT_READ_RSSI:
-        BTA_DmBleReadRSSI(arg->read_rssi.remote_addr, btc_read_ble_rssi_cmpl_callback);
+        BTA_DmBleReadRSSI(arg->read_rssi.remote_addr, BTA_TRANSPORT_LE, btc_read_ble_rssi_cmpl_callback);
         break;
     case BTC_GAP_BLE_ACT_SET_CONN_PARAMS:
         BTA_DmSetBlePrefConnParams(arg->set_conn_params.bd_addr, arg->set_conn_params.min_conn_int,
@@ -1108,7 +1141,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
     case BTC_GAP_BLE_REMOVE_BOND_DEV_EVT: {
         BD_ADDR bd_addr;
         memcpy(bd_addr, arg->remove_bond_device.bd_addr, sizeof(BD_ADDR));
-        BTA_DmRemoveDevice(bd_addr);
+        BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_LE);
         break;
     }
 #endif  ///SMP_INCLUDED == TRUE
@@ -1134,3 +1167,99 @@ void btc_gap_ble_deinit(void)
     btc_cleanup_adv_data(&gl_bta_adv_data);
     btc_cleanup_adv_data(&gl_bta_scan_rsp_data);
 }
+
+#if SCAN_QUEUE_CONGEST_CHECK
+void btc_adv_list_free(void *data)
+{
+    osi_free(data);
+}
+
+void btc_adv_list_init(void)
+{
+    osi_mutex_new(&adv_list_lock);
+    adv_filter_list = list_new(btc_adv_list_free);
+}
+
+void btc_adv_list_deinit(void)
+{
+    osi_mutex_free(&adv_list_lock);
+    if(adv_filter_list) {
+        list_free(adv_filter_list);
+        adv_filter_list = NULL;
+    }
+}
+void btc_adv_list_add_packet(void * data)
+{
+    if(!data) {
+        BTC_TRACE_ERROR("%s data is NULL", __func__);
+        return;
+    }
+    btc_adv_list_lock();
+    list_prepend(adv_filter_list, data);
+    btc_adv_list_unlock();
+}
+
+uint32_t btc_get_adv_list_length(void)
+{
+    if(!adv_filter_list) {
+        BTC_TRACE_ERROR("%s adv_filter_list is NULL", __func__);
+        return 0;
+    }
+    btc_adv_list_lock();
+    size_t length = list_length(adv_filter_list);
+    btc_adv_list_unlock();
+
+    return length;
+}
+
+void btc_adv_list_refresh(void)
+{
+    if(!adv_filter_list) {
+        BTC_TRACE_ERROR("%s adv_filter_list is NULL", __func__);
+        return ;
+    }
+    btc_adv_list_lock();
+    list_clear(adv_filter_list);
+    btc_adv_list_unlock();
+}
+
+bool btc_check_adv_list(uint8_t * addr, uint8_t addr_type)
+{
+    bool found = false;
+    if(!adv_filter_list || !addr) {
+        BTC_TRACE_ERROR("%s adv_filter_list is NULL", __func__);
+        return found;
+    }
+
+    btc_adv_list_lock();
+    for (const list_node_t *node = list_begin(adv_filter_list); node != list_end(adv_filter_list); node = list_next(node)) {
+        btc_adv_packet_t *packet = (btc_adv_packet_t *)list_node(node);
+        if(!bdcmp(addr, packet->addr) && packet->addr_type == addr_type) {
+            found = true;
+            break;
+        }
+     }
+     btc_adv_list_unlock();
+     if(!found) {
+         btc_adv_packet_t *adv_packet = osi_malloc(sizeof(btc_adv_packet_t));
+         if(adv_packet) {
+             adv_packet->addr_type = addr_type;
+             bdcpy(adv_packet->addr, addr);
+             btc_adv_list_add_packet(adv_packet);
+         } else {
+             BTC_TRACE_ERROR("%s adv_packet malloc failed", __func__);
+         }
+     }
+    return found;
+}
+
+void btc_adv_list_lock(void)
+{
+    osi_mutex_lock(&adv_list_lock, OSI_MUTEX_MAX_TIMEOUT);
+}
+
+void btc_adv_list_unlock(void)
+{
+    osi_mutex_unlock(&adv_list_lock);
+}
+#endif

components/bt/bluedroid/btc/profile/std/gap/btc_gap_bt.c

@@ -151,7 +151,7 @@ static void search_devices_copy_cb(btc_msg_t *msg, void *p_dest, void *p_src)
         switch (p_dest_data->event) {
         case BTA_DM_INQ_RES_EVT: {
             if (p_src_data->p_data->inq_res.p_eir) {
-                p_dest_data->p_data->inq_res.p_eir = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                p_dest_data->p_data->inq_res.p_eir = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                 memcpy(p_dest_data->p_data->inq_res.p_eir, p_src_data->p_data->inq_res.p_eir, HCI_EXT_INQ_RESPONSE_LEN);
             }
         }
@@ -159,7 +159,7 @@ static void search_devices_copy_cb(btc_msg_t *msg, void *p_dest, void *p_src)
 
         case BTA_DM_DISC_RES_EVT: {
             if (p_src_data->p_data->disc_res.raw_data_size && p_src_data->p_data->disc_res.p_raw_data) {
-                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                 memcpy(p_dest_data->p_data->disc_res.p_raw_data,
                        p_src_data->p_data->disc_res.p_raw_data,
                        p_src_data->p_data->disc_res.raw_data_size);
@@ -194,7 +194,7 @@ static void search_service_record_copy_cb(btc_msg_t *msg, void *p_dest, void *p_
         switch (p_dest_data->event) {
         case BTA_DM_DISC_RES_EVT: {
             if (p_src_data->p_data->disc_res.p_raw_data && p_src_data->p_data->disc_res.raw_data_size > 0) {
-                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                p_dest_data->p_data->disc_res.p_raw_data = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                 memcpy(p_dest_data->p_data->disc_res.p_raw_data,
                        p_src_data->p_data->disc_res.p_raw_data,
                        p_src_data->p_data->disc_res.raw_data_size);
@@ -566,7 +566,7 @@ static void search_services_copy_cb(btc_msg_t *msg, void *p_dest, void *p_src)
         case BTA_DM_DISC_RES_EVT: {
             if (p_src_data->p_data->disc_res.result == BTA_SUCCESS) {
                 if (p_src_data->p_data->disc_res.num_uuids > 0) {
-                    p_dest_data->p_data->disc_res.p_uuid_list = (UINT8 *)(p_dest_data->p_data + sizeof(tBTA_DM_SEARCH));
+                    p_dest_data->p_data->disc_res.p_uuid_list = (UINT8 *)(p_dest_data->p_data) + sizeof(tBTA_DM_SEARCH);
                     memcpy(p_dest_data->p_data->disc_res.p_uuid_list, p_src_data->p_data->disc_res.p_uuid_list,
                            p_src_data->p_data->disc_res.num_uuids * MAX_UUID_SIZE);
                     osi_free(p_src_data->p_data->disc_res.p_uuid_list);
@@ -632,15 +632,14 @@ static void btc_gap_bt_read_rssi_delta_cmpl_callback(void *p_data)
 
 static void btc_gap_bt_read_rssi_delta(btc_gap_bt_args_t *arg)
 {
-    BTA_DmBleReadRSSI(arg->read_rssi_delta.bda.address, btc_gap_bt_read_rssi_delta_cmpl_callback);
+    BTA_DmBleReadRSSI(arg->read_rssi_delta.bda.address, BTA_TRANSPORT_BR_EDR, btc_gap_bt_read_rssi_delta_cmpl_callback);
 }
 
 esp_err_t btc_gap_bt_remove_bond_device(btc_gap_bt_args_t *arg)
 {
     BD_ADDR bd_addr;
     memcpy(bd_addr, arg->rm_bond_device.bda.address, sizeof(BD_ADDR));
-    if(BTA_DmRemoveDevice(bd_addr) == BTA_SUCCESS){
-        btc_storage_remove_bonded_device(&(arg->rm_bond_device.bda));
+    if(BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS){
         return ESP_BT_STATUS_SUCCESS;
     }
     return ESP_BT_STATUS_FAIL;

components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -331,6 +331,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
         if (bta_uuid) {
             osi_free(bta_uuid);
         }
+        *count = 0;
         return status;
     } else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)svc_num, ESP_GATT_DB_PRIMARY_SERVICE, offset, (void *)result, db);
@@ -362,6 +363,7 @@ esp_gatt_status_t btc_ble_gattc_get_all_char(uint16_t conn_id,
         if (db) {
             osi_free(db);
         }
+        *count = 0;
         return status;
     } else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, offset, (void *)result, db);
@@ -389,6 +391,7 @@ esp_gatt_status_t btc_ble_gattc_get_all_descr(uint16_t conn_id,
         if (db) {
             osi_free(db);
         }
+        *count = 0;
         return status;
     } else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, offset, (void *)result, db);
@@ -420,6 +423,7 @@ esp_gatt_status_t btc_ble_gattc_get_char_by_uuid(uint16_t conn_id,
         if (db) {
             osi_free(db);
         }
+        *count = 0;
         return status;
     } else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, 0, (void *)result, db);
@@ -456,6 +460,7 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_uuid(uint16_t conn_id,
         if (db) {
             osi_free(db);
         }
+        *count = 0;
         return status;
     } else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
@@ -487,6 +492,7 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_char_handle(uint16_t conn_id,
         if (db) {
             osi_free(db);
         }
+        *count = 0;
         return status;
     } else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
@@ -524,6 +530,7 @@ esp_gatt_status_t btc_ble_gattc_get_include_service(uint16_t conn_id,
         if (db) {
             osi_free(db);
         }
+        *count = 0;
         return status;
     }else {
         btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)incl_num, ESP_GATT_DB_INCLUDED_SERVICE, 0, (void *)result, db);
@@ -566,6 +573,7 @@ esp_gatt_status_t btc_ble_gattc_get_db(uint16_t conn_id, uint16_t start_handle,
         if (get_db) {
             osi_free(get_db);
         }
+        *count = 0;
         return ESP_GATT_NOT_FOUND;
     }
 
@@ -579,7 +587,7 @@ esp_gatt_status_t btc_ble_gattc_get_db(uint16_t conn_id, uint16_t start_handle,
         btc128_to_bta_uuid(&bta_uuid, get_db[i].uuid.uu);
         bta_to_btc_uuid(&db[i].uuid, &bta_uuid);
     }
-    *count = num;
+    *count = db_size;
     //don't forget to free the db buffer after used.
     if (get_db) {
         osi_free(get_db);

components/bt/bluedroid/btc/profile/std/include/btc_gap_ble.h

@@ -166,5 +166,7 @@ void btc_gap_ble_cb_deep_free(btc_msg_t *msg);
 void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 void btc_gap_callback_init(void);
 void btc_gap_ble_deinit(void);
+void btc_adv_list_init(void);
+void btc_adv_list_deinit(void);
 
 #endif /* __BTC_GAP_BLE_H__ */

components/bt/bluedroid/common/include/common/bt_defs.h

@@ -26,9 +26,6 @@
 
 #define UNUSED(x)                   (void)(x)
 
-#ifndef SIZE_MAX
-#define SIZE_MAX                    254
-#endif
 /*Timer Related Defination*/
 
 //by Snake.T

components/bt/bluedroid/common/include/common/bt_target.h

@@ -307,6 +307,16 @@
 #define BTA_AV_CO_CP_SCMS_T  FALSE//FALSE
 #endif
 
+#ifndef QUEUE_CONGEST_SIZE
+#define  QUEUE_CONGEST_SIZE    40
+#endif
+
+#ifndef CONFIG_BLE_HOST_QUEUE_CONGESTION_CHECK
+#define SCAN_QUEUE_CONGEST_CHECK  FALSE
+#else
+#define SCAN_QUEUE_CONGEST_CHECK  CONFIG_BLE_HOST_QUEUE_CONGESTION_CHECK
+#endif
+
 /* This feature is used to eanble interleaved scan*/
 #ifndef BTA_HOST_INTERLEAVE_SEARCH
 #define BTA_HOST_INTERLEAVE_SEARCH FALSE//FALSE
@@ -581,7 +591,7 @@
 #define BTM_DEFAULT_DISC_INTERVAL   0x0800
 #endif
 
-/* 
+/*
 * {SERVICE_CLASS, MAJOR_CLASS, MINOR_CLASS}
 *
 * SERVICE_CLASS:0x5A (Bit17 -Networking,Bit19 - Capturing,Bit20 -Object Transfer,Bit22 -Telephony)
@@ -754,6 +764,14 @@
 #define BTM_BLE_CONFORMANCE_TESTING           FALSE
 #endif
 
+/******************************************************************************
+**
+** CONTROLLER TO HOST FLOW CONTROL
+**
+******************************************************************************/
+
+#define C2H_FLOW_CONTROL_INCLUDED TRUE
+
 /******************************************************************************
 **
 ** L2CAP

components/bt/bluedroid/device/controller.c

@@ -95,6 +95,12 @@ static void start_up(void)
         response, &acl_data_size_classic, &acl_buffer_count_classic,
         &sco_data_size, &sco_buffer_count);
 
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+    // Enable controller to host flow control
+    response = AWAIT_COMMAND(packet_factory->make_set_c2h_flow_control(HCI_HOST_FLOW_CTRL_ACL_ON));
+    packet_parser->parse_generic_command_complete(response);
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
     // Tell the controller about our buffer sizes and buffer counts next
     // TODO(zachoverflow): factor this out. eww l2cap contamination. And why just a hardcoded 10?
     response = AWAIT_COMMAND(
@@ -252,6 +258,9 @@ static void start_up(void)
 #if (BTM_SCO_HCI_INCLUDED == TRUE)
     response = AWAIT_COMMAND(packet_factory->make_write_sync_flow_control_enable(1));
     packet_parser->parse_generic_command_complete(response);
+
+    response = AWAIT_COMMAND(packet_factory->make_write_default_erroneous_data_report(1));
+    packet_parser->parse_generic_command_complete(response);
 #endif
     readable = true;
     // return future_new_immediate(FUTURE_SUCCESS);

components/bt/bluedroid/hci/hci_hal_h4.c

@@ -27,10 +27,16 @@
 #include "osi/thread.h"
 #include "esp_bt.h"
 
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+#include "l2c_int.h"
+#include "stack/hcimsgs.h"
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
 #define HCI_HAL_SERIAL_BUFFER_SIZE 1026
 #define HCI_BLE_EVENT 0x3e
 #define PACKET_TYPE_TO_INBOUND_INDEX(type) ((type) - 2)
 #define PACKET_TYPE_TO_INDEX(type) ((type) - 1)
+extern bool BTU_check_queue_is_congest(void);
 
 
 static const uint8_t preamble_sizes[] = {
@@ -92,6 +98,7 @@ static void hci_hal_env_init(
 static void hci_hal_env_deinit(void)
 {
     fixed_queue_free(hci_hal_env.rx_q, hci_hal_env.allocator->free);
+    hci_hal_env.rx_q = NULL;
 }
 
 static bool hal_open(const hci_hal_callbacks_t *upper_callbacks)
@@ -99,7 +106,7 @@ static bool hal_open(const hci_hal_callbacks_t *upper_callbacks)
     assert(upper_callbacks != NULL);
     callbacks = upper_callbacks;
 
-    hci_hal_env_init(HCI_HAL_SERIAL_BUFFER_SIZE, SIZE_MAX);
+    hci_hal_env_init(HCI_HAL_SERIAL_BUFFER_SIZE, QUEUE_SIZE_MAX);
 
     xHciH4Queue = xQueueCreate(HCI_H4_QUEUE_LEN, sizeof(BtTaskEvt_t));
     xTaskCreatePinnedToCore(hci_hal_h4_rx_handler, HCI_H4_TASK_NAME, HCI_H4_TASK_STACK_SIZE, NULL, HCI_H4_TASK_PRIO, &xHciH4TaskHandle, HCI_H4_TASK_PINNED_TO_CORE);
@@ -165,6 +172,7 @@ static void hci_hal_h4_rx_handler(void *arg)
         if (pdTRUE == xQueueReceive(xHciH4Queue, &e, (portTickType)portMAX_DELAY)) {
             if (e.sig == SIG_HCI_HAL_RECV_PACKET) {
                 fixed_queue_process(hci_hal_env.rx_q);
+
             }
         }
     }
@@ -178,13 +186,51 @@ task_post_status_t hci_hal_h4_task_post(task_post_t timeout)
     evt.par = 0;
 
     if (xQueueSend(xHciH4Queue, &evt, timeout) != pdTRUE) {
-        HCI_TRACE_ERROR("xHciH4Queue failed\n");
         return TASK_POST_SUCCESS;
     }
 
     return TASK_POST_FAIL;
 }
 
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+static void hci_packet_complete(BT_HDR *packet){
+    uint8_t type, num_handle;
+    uint16_t handle;
+    uint16_t handles[MAX_L2CAP_LINKS + 4];
+    uint16_t num_packets[MAX_L2CAP_LINKS + 4];
+    uint8_t *stream = packet->data + packet->offset;
+    tL2C_LCB  *p_lcb = NULL;
+
+    STREAM_TO_UINT8(type, stream);
+    if (type == DATA_TYPE_ACL/* || type == DATA_TYPE_SCO*/) {
+        STREAM_TO_UINT16(handle, stream);
+        handle = handle & HCI_DATA_HANDLE_MASK;
+        p_lcb = l2cu_find_lcb_by_handle(handle);
+        if (p_lcb) {
+            p_lcb->completed_packets++;
+        }
+        if (esp_vhci_host_check_send_available()){
+            num_handle = l2cu_find_completed_packets(handles, num_packets);
+            if (num_handle > 0){
+                btsnd_hcic_host_num_xmitted_pkts (num_handle, handles, num_packets);
+            }
+        } else {
+            //Send HCI_Host_Number_of_Completed_Packets next time.
+        }
+
+    }
+}
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
+bool host_recv_adv_packet(BT_HDR *packet)
+{
+    assert(packet);
+    if(packet->data[0] == DATA_TYPE_EVENT && packet->data[1] == HCI_BLE_EVENT && packet->data[3] ==  HCI_BLE_ADV_PKT_RPT_EVT) {
+        return true;
+    }
+    return false;
+}
+
 static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
 {
     uint8_t type, hdr_size;
@@ -194,6 +240,11 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
     if (!packet) {
         return;
     }
+
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+    hci_packet_complete(packet);
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
     STREAM_TO_UINT8(type, stream);
     packet->offset++;
     packet->len--;
@@ -233,6 +284,13 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
         hci_hal_env.allocator->free(packet);
         return;
     }
+#if SCAN_QUEUE_CONGEST_CHECK
+    if(BTU_check_queue_is_congest() && host_recv_adv_packet(packet)) {
+        HCI_TRACE_ERROR("BtuQueue is congested");
+        hci_hal_env.allocator->free(packet);
+        return;
+    }
+#endif
 
     packet->event = outbound_event_types[PACKET_TYPE_TO_INDEX(type)];
     callbacks->packet_ready(packet);
@@ -260,6 +318,10 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
     BT_HDR *pkt;
     size_t pkt_size;
 
+    if (hci_hal_env.rx_q == NULL) {
+        return 0;
+    }
+
     pkt_size = BT_HDR_SIZE + len;
     pkt = (BT_HDR *)hci_hal_env.allocator->alloc(pkt_size);
     if (!pkt) {
@@ -271,7 +333,7 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
     pkt->layer_specific = 0;
     memcpy(pkt->data, data, len);
     fixed_queue_enqueue(hci_hal_env.rx_q, pkt);
-    hci_hal_h4_task_post(TASK_POST_BLOCKING);
+    hci_hal_h4_task_post(100 / portTICK_PERIOD_MS);
 
     BTTRC_DUMP_BUFFER("Recv Pkt", pkt->data, len);
 

components/bt/bluedroid/hci/hci_layer.c

@@ -158,7 +158,7 @@ static int hci_layer_init_env(void)
     // as per the Bluetooth spec, Volume 2, Part E, 4.4 (Command Flow Control)
     // This value can change when you get a command complete or command status event.
     hci_host_env.command_credits = 1;
-    hci_host_env.command_queue = fixed_queue_new(SIZE_MAX);
+    hci_host_env.command_queue = fixed_queue_new(QUEUE_SIZE_MAX);
     if (hci_host_env.command_queue) {
         fixed_queue_register_dequeue(hci_host_env.command_queue, event_command_ready);
     } else {
@@ -166,7 +166,7 @@ static int hci_layer_init_env(void)
         return -1;
     }
 
-    hci_host_env.packet_queue = fixed_queue_new(SIZE_MAX);
+    hci_host_env.packet_queue = fixed_queue_new(QUEUE_SIZE_MAX);
     if (hci_host_env.packet_queue) {
         fixed_queue_register_dequeue(hci_host_env.packet_queue, event_packet_ready);
     } else {
@@ -274,6 +274,7 @@ static void transmit_command(
 
     fixed_queue_enqueue(hci_host_env.command_queue, wait_entry);
     hci_host_task_post(TASK_POST_BLOCKING);
+
 }
 
 static future_t *transmit_command_futured(BT_HDR *command)
@@ -317,8 +318,14 @@ static void event_command_ready(fixed_queue_t *queue)
     command_waiting_response_t *cmd_wait_q = &hci_host_env.cmd_waiting_q;
 
     wait_entry = fixed_queue_dequeue(queue);
-    hci_host_env.command_credits--;
 
+    if(wait_entry->opcode == HCI_HOST_NUM_PACKETS_DONE){
+        packet_fragmenter->fragment_and_dispatch(wait_entry->command);
+        buffer_allocator->free(wait_entry->command);
+        osi_free(wait_entry);
+        return;
+    }
+    hci_host_env.command_credits--;
     // Move it to the list of commands awaiting response
     osi_mutex_lock(&cmd_wait_q->commands_pending_response_lock, OSI_MUTEX_MAX_TIMEOUT);
     list_append(cmd_wait_q->commands_pending_response, wait_entry);
@@ -435,7 +442,6 @@ static bool filter_incoming_event(BT_HDR *packet)
     if (event_code == HCI_COMMAND_COMPLETE_EVT) {
         STREAM_TO_UINT8(hci_host_env.command_credits, stream);
         STREAM_TO_UINT16(opcode, stream);
-
         wait_entry = get_waiting_command(opcode);
         if (!wait_entry) {
             HCI_TRACE_WARNING("%s command complete event with no matching command. opcode: 0x%x.", __func__, opcode);

components/bt/bluedroid/hci/hci_packet_factory.c

@@ -45,6 +45,16 @@ static BT_HDR *make_read_buffer_size(void)
     return make_command_no_params(HCI_READ_BUFFER_SIZE);
 }
 
+static BT_HDR *make_set_c2h_flow_control(uint8_t enable)
+{
+    uint8_t *stream;
+    const uint8_t parameter_size = 1;
+    BT_HDR *packet = make_command(HCI_SET_HC_TO_HOST_FLOW_CTRL, parameter_size, &stream);
+
+    UINT8_TO_STREAM(stream, enable);
+    return packet;
+}
+
 static BT_HDR *make_host_buffer_size(uint16_t acl_size, uint8_t sco_size, uint16_t acl_count, uint16_t sco_count)
 {
     uint8_t *stream;
@@ -184,6 +194,16 @@ static BT_HDR *make_write_sync_flow_control_enable(uint8_t enable)
     UINT8_TO_STREAM(stream, enable);
     return packet;
 }
+
+static BT_HDR *make_write_default_erroneous_data_report(uint8_t enable)
+{
+    uint8_t *stream;
+    const uint8_t parameter_size = 1;
+    BT_HDR *packet = make_command(HCI_WRITE_ERRONEOUS_DATA_RPT, parameter_size, &stream);
+
+    UINT8_TO_STREAM(stream, enable);
+    return packet;
+}
 // Internal functions
 
 static BT_HDR *make_command_no_params(uint16_t opcode)
@@ -220,6 +240,7 @@ static BT_HDR *make_packet(size_t data_size)
 static const hci_packet_factory_t interface = {
     make_reset,
     make_read_buffer_size,
+    make_set_c2h_flow_control,
     make_host_buffer_size,
     make_read_local_version_info,
     make_read_bd_addr,
@@ -237,7 +258,8 @@ static const hci_packet_factory_t interface = {
     make_ble_read_suggested_default_data_length,
     make_ble_write_suggested_default_data_length,
     make_ble_set_event_mask,
-    make_write_sync_flow_control_enable
+    make_write_sync_flow_control_enable,
+    make_write_default_erroneous_data_report,
 };
 
 const hci_packet_factory_t *hci_packet_factory_get_interface()

components/bt/bluedroid/hci/include/hci/hci_packet_factory.h

@@ -25,6 +25,7 @@
 typedef struct {
     BT_HDR *(*make_reset)(void);
     BT_HDR *(*make_read_buffer_size)(void);
+    BT_HDR *(*make_set_c2h_flow_control)(uint8_t enable);
     BT_HDR *(*make_host_buffer_size)(uint16_t acl_size, uint8_t sco_size, uint16_t acl_count, uint16_t sco_count);
     BT_HDR *(*make_read_local_version_info)(void);
     BT_HDR *(*make_read_bd_addr)(void);
@@ -43,6 +44,7 @@ typedef struct {
     BT_HDR *(*make_ble_write_suggested_default_data_length)(uint16_t SuggestedMaxTxOctets, uint16_t SuggestedMaxTxTime);
     BT_HDR *(*make_ble_set_event_mask)(const bt_event_mask_t *event_mask);
     BT_HDR *(*make_write_sync_flow_control_enable)(uint8_t enable);
+    BT_HDR *(*make_write_default_erroneous_data_report)(uint8_t enable);
 } hci_packet_factory_t;
 
 const hci_packet_factory_t *hci_packet_factory_get_interface();

components/bt/bluedroid/osi/include/osi/fixed_queue.h

@@ -22,6 +22,10 @@
 #include <stdbool.h>
 #include "osi/list.h"
 
+#ifndef QUEUE_SIZE_MAX
+#define QUEUE_SIZE_MAX                    254
+#endif
+
 struct fixed_queue_t;
 
 typedef struct fixed_queue_t fixed_queue_t;

components/bt/bluedroid/osi/include/osi/thread.h

@@ -69,7 +69,7 @@ typedef enum {
 #define HCI_H4_TASK_STACK_SIZE          (2048 + BT_TASK_EXTRA_STACK_SIZE)
 #define HCI_H4_TASK_PRIO                (configMAX_PRIORITIES - 4)
 #define HCI_H4_TASK_NAME                "hciH4T"
-#define HCI_H4_QUEUE_LEN                60
+#define HCI_H4_QUEUE_LEN                1
 
 #define BTU_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
 #define BTU_TASK_STACK_SIZE             (4096 + BT_TASK_EXTRA_STACK_SIZE)

components/bt/bluedroid/stack/avct/avct_lcb.c

@@ -313,7 +313,7 @@ tAVCT_LCB *avct_lcb_alloc(BD_ADDR bd_addr)
             p_lcb->allocated = (UINT8)(i + 1);
             memcpy(p_lcb->peer_addr, bd_addr, BD_ADDR_LEN);
             AVCT_TRACE_DEBUG("avct_lcb_alloc %d", p_lcb->allocated);
-            p_lcb->tx_q = fixed_queue_new(SIZE_MAX);
+            p_lcb->tx_q = fixed_queue_new(QUEUE_SIZE_MAX);
             break;
         }
     }

components/bt/bluedroid/stack/avdt/avdt_ccb.c

@@ -376,8 +376,8 @@ tAVDT_CCB *avdt_ccb_alloc(BD_ADDR bd_addr)
         if (!p_ccb->allocated) {
             p_ccb->allocated = TRUE;
             memcpy(p_ccb->peer_addr, bd_addr, BD_ADDR_LEN);
-            p_ccb->cmd_q = fixed_queue_new(SIZE_MAX);
-            p_ccb->rsp_q = fixed_queue_new(SIZE_MAX);
+            p_ccb->cmd_q = fixed_queue_new(QUEUE_SIZE_MAX);
+            p_ccb->rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
             p_ccb->timer_entry.param = (UINT32) p_ccb;
             AVDT_TRACE_DEBUG("avdt_ccb_alloc %d\n", i);
             break;

components/bt/bluedroid/stack/avdt/avdt_l2c.c

@@ -412,6 +412,7 @@ void avdt_l2c_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed)
 {
     tAVDT_TC_TBL    *p_tbl;
     UINT16          disc_rsn = AVDT_DISC_RSN_NORMAL;
+    tAVDT_CCB       *p_ccb;
     AVDT_TRACE_DEBUG("avdt_l2c_disconnect_ind_cback lcid: %d, ack_needed: %d\n",
                      lcid, ack_needed);
     /* look up info for this channel */
@@ -420,7 +421,13 @@ void avdt_l2c_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed)
             /* send L2CAP disconnect response */
             L2CA_DisconnectRsp(lcid);
         } else {
-            disc_rsn = AVDT_DISC_RSN_ABNORMAL;
+            if ((p_ccb = avdt_ccb_by_idx(p_tbl->ccb_idx)) != NULL) {
+                UINT16 rsn = L2CA_GetDisconnectReason(p_ccb->peer_addr, BT_TRANSPORT_BR_EDR);
+                if (rsn != 0 && rsn != HCI_ERR_PEER_USER) {
+                    disc_rsn = AVDT_DISC_RSN_ABNORMAL;
+                    AVDT_TRACE_EVENT("avdt link disc rsn 0x%x", rsn);
+                }
+            }
         }
 
         avdt_ad_tc_close_ind(p_tbl, disc_rsn);

components/bt/bluedroid/stack/avdt/avdt_scb.c

@@ -603,7 +603,7 @@ tAVDT_SCB *avdt_scb_alloc(tAVDT_CS *p_cs)
             memcpy(&p_scb->cs, p_cs, sizeof(tAVDT_CS));
 #if AVDT_MULTIPLEXING == TRUE
             /* initialize fragments gueue */
-            p_scb->frag_q = fixed_queue_new(SIZE_MAX);
+            p_scb->frag_q = fixed_queue_new(QUEUE_SIZE_MAX);
 
             if (p_cs->cfg.psc_mask & AVDT_PSC_MUX) {
                 p_scb->cs.cfg.mux_tcid_media = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);

components/bt/bluedroid/stack/btm/btm_acl.c

@@ -1905,14 +1905,10 @@ void btm_qos_setup_complete (UINT8 status, UINT16 handle, FLOW_SPEC *p_flow)
 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
 **
 *******************************************************************************/
-tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
+tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBT_TRANSPORT transport, tBTM_CMPL_CB *p_cb)
 {
     tACL_CONN   *p;
-    tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
-#if BLE_INCLUDED == TRUE
-    tBT_DEVICE_TYPE dev_type;
-    tBLE_ADDR_TYPE  addr_type;
-#endif
+
     BTM_TRACE_API ("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x\n",
                    remote_bda[0], remote_bda[1], remote_bda[2],
                    remote_bda[3], remote_bda[4], remote_bda[5]);
@@ -1924,13 +1920,6 @@ tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
         return (BTM_BUSY);
     }
 
-#if BLE_INCLUDED == TRUE
-    BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
-    if (dev_type == BT_DEVICE_TYPE_BLE) {
-        transport = BT_TRANSPORT_LE;
-    }
-#endif
-
     p = btm_bda_to_acl(remote_bda, transport);
     if (p != (tACL_CONN *)NULL) {
         btu_start_timer (&btm_cb.devcb.rssi_timer, BTU_TTYPE_BTM_ACL,

components/bt/bluedroid/stack/btm/btm_ble.c

@@ -1225,7 +1225,7 @@ void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY
 
             /* Set that link key is known since this shares field with BTM_SEC_FLAG_LKEY_KNOWN flag in stack/btm_api.h*/
             p_rec->sec_flags |=  BTM_SEC_LE_LINK_KEY_KNOWN;
-            if ( p_keys->pcsrk_key.sec_level == SMP_SEC_AUTHENTICATED) {
+            if ( p_keys->lenc_key.sec_level == SMP_SEC_AUTHENTICATED) {
                 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
             } else {
                 p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
@@ -1948,14 +1948,6 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
             handle = HCID_GET_HANDLE (handle);
 
             btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
-            if(role == HCI_ROLE_SLAVE) {
-                //clear p_cb->state, controller will stop adv when ble connected.
-                tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
-                if(p_cb) {
-                    p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-                    p_cb->state = BTM_BLE_STOP_ADV; 
-                }
-            }
             l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
                               conn_latency, conn_timeout);
 

components/bt/bluedroid/stack/btm/btm_ble_gap.c

@@ -3492,15 +3492,30 @@ tBTM_STATUS btm_ble_stop_adv(void)
     tBTM_STATUS rt = BTM_SUCCESS;
 
     if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
-        if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) {
-            p_cb->fast_adv_on = FALSE;
-            p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-            p_cb->state = BTM_BLE_ADV_PENDING;
-            btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;
+        UINT8 temp_adv_mode = p_cb->adv_mode;
+        BOOLEAN temp_fast_adv_on = p_cb->fast_adv_on;
+        tBTM_BLE_GAP_STATE temp_state = p_cb->state;
+        tBTM_BLE_WL_STATE temp_wl_state = btm_cb.ble_ctr_cb.wl_state;
+        tBTM_BLE_STATE_MASK temp_mask = btm_ble_get_topology_mask ();
+
+        p_cb->fast_adv_on = FALSE;
+        p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
+        p_cb->state = BTM_BLE_ADV_PENDING;
+        btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;
+
+        /* clear all adv states */
+        btm_ble_clear_topology_mask (BTM_BLE_STATE_ALL_ADV_MASK);
+
+        if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) {
 
-            /* clear all adv states */
-            btm_ble_clear_topology_mask (BTM_BLE_STATE_ALL_ADV_MASK);
         } else {
+            // reset state
+            p_cb->fast_adv_on = temp_fast_adv_on;
+            p_cb->adv_mode = temp_adv_mode;
+            p_cb->state = temp_state;
+            btm_cb.ble_ctr_cb.wl_state = temp_wl_state;
+            btm_ble_set_topology_mask (temp_mask);
+
             rt = BTM_NO_RESOURCES;
         }
     }
@@ -3745,6 +3760,20 @@ BOOLEAN btm_ble_clear_topology_mask (tBTM_BLE_STATE_MASK request_state_mask)
     return TRUE;
 }
 
+/*******************************************************************************
+**
+** Function         btm_ble_get_topology_mask
+**
+** Description      Get BLE topology bit mask
+**
+** Returns          state mask.   
+**
+*******************************************************************************/
+tBTM_BLE_STATE_MASK btm_ble_get_topology_mask (void)
+{
+    return btm_cb.ble_ctr_cb.cur_states;
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_update_link_topology_mask
@@ -3838,7 +3867,7 @@ void btm_ble_init (void)
     btm_cb.cmn_ble_vsc_cb.values_read = FALSE;
     p_cb->cur_states       = 0;
 
-    p_cb->conn_pending_q = fixed_queue_new(SIZE_MAX);
+    p_cb->conn_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);
 
     p_cb->inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
     p_cb->inq_var.scan_type = BTM_BLE_SCAN_MODE_NONE;

components/bt/bluedroid/stack/btm/btm_main.c

@@ -56,8 +56,8 @@ void btm_init (void)
 #endif /* #if BTM_DYNAMIC_MEMORY */
     /* All fields are cleared; nonzero fields are reinitialized in appropriate function */
     memset(&btm_cb, 0, sizeof(tBTM_CB));
-    btm_cb.page_queue = fixed_queue_new(SIZE_MAX);
-    btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+    btm_cb.page_queue = fixed_queue_new(QUEUE_SIZE_MAX);
+    btm_cb.sec_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);
 
 #if defined(BTM_INITIAL_TRACE_LEVEL)
     btm_cb.trace_level = BTM_INITIAL_TRACE_LEVEL;

components/bt/bluedroid/stack/btm/btm_sco.c

@@ -113,7 +113,7 @@ void btm_sco_init (void)
 #endif
 #if (BTM_SCO_HCI_INCLUDED == TRUE)
     for (int i = 0; i < BTM_MAX_SCO_LINKS; i++) {
-        btm_cb.sco_cb.sco_db[i].xmit_data_q = fixed_queue_new(SIZE_MAX);
+        btm_cb.sco_cb.sco_db[i].xmit_data_q = fixed_queue_new(QUEUE_SIZE_MAX);
     }
 #endif
     /* Initialize nonzero defaults */
@@ -319,9 +319,8 @@ void btm_sco_process_num_completed_pkts (UINT8 *p)
     STREAM_TO_UINT8 (num_handles, p);
     for (xx = 0; xx < num_handles; xx++) {
         STREAM_TO_UINT16 (handle, p);
-        handle &= 0x7ff; // walk around for bad handle bit mask from controller
         STREAM_TO_UINT16 (num_sent, p);
-        if ((sco_inx = btm_find_scb_by_handle(handle & 0x7ff)) == BTM_MAX_SCO_LINKS) {
+        if ((sco_inx = btm_find_scb_by_handle(handle)) == BTM_MAX_SCO_LINKS) {
             continue;
         }
         BTM_TRACE_DEBUG("%s, %d, %u", __FUNCTION__, handle, p_cb->xmit_window_size); //debug

components/bt/bluedroid/stack/btm/btm_sec.c

@@ -1361,7 +1361,7 @@ tBTM_STATUS BTM_SetEncryption (BD_ADDR bd_addr, tBT_TRANSPORT transport, tBTM_SE
 
         return (BTM_SUCCESS);
     }
-
+    p_dev_rec->enc_init_by_we = TRUE;
     /* enqueue security request if security is active */
     if (p_dev_rec->p_callback || (p_dev_rec->sec_state != BTM_SEC_STATE_IDLE)) {
         BTM_TRACE_WARNING ("Security Manager: BTM_SetEncryption busy, enqueue request\n");
@@ -2762,7 +2762,7 @@ void btm_sec_check_pending_reqs (void)
         /* Now, re-submit anything in the mux queue */
         bq = btm_cb.sec_pending_q;
         if (!btm_cb.sec_pending_q) {
-            btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+            btm_cb.sec_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);
         }
 
         while ((p_e = (tBTM_SEC_QUEUE_ENTRY *)fixed_queue_try_dequeue(bq)) != NULL) {
@@ -4018,7 +4018,6 @@ void btm_sec_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
 #if BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE
     tACL_CONN       *p_acl = NULL;
     UINT8           acl_idx = btm_handle_to_acl_index(handle);
-    tGATT_TCB       *p_tcb = NULL;
 #endif
     BTM_TRACE_EVENT ("Security Manager: encrypt_change status:%d State:%d, encr_enable = %d\n",
                      status, (p_dev_rec) ? p_dev_rec->sec_state : 0, encr_enable);
@@ -4046,14 +4045,6 @@ void btm_sec_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
                 p_dev_rec->sec_flags |= BTM_SEC_16_DIGIT_PIN_AUTHED;
             }
         } else {
-#if BLE_INCLUDED == TRUE
-            /* Before the application layer has received the connection event, the device has received an 
-            encrypted request from the peer device. The device should wait until the application layer 
-            receives the connection event before updating 'sec_flags'. */
-            if ((p_tcb = gatt_find_tcb_by_addr(p_dev_rec->ble.pseudo_addr, BT_TRANSPORT_LE)) == NULL) {
-               //do nothing
-            } else
-#endif
             p_dev_rec->sec_flags |= (BTM_SEC_LE_AUTHENTICATED | BTM_SEC_LE_ENCRYPTED);
         }
     }
@@ -4543,7 +4534,7 @@ void btm_sec_disconnected (UINT16 handle, UINT8 reason)
     if (!p_dev_rec) {
         return;
     }
-
+    p_dev_rec->enc_init_by_we = FALSE;
     transport  = (handle == p_dev_rec->hci_handle) ? BT_TRANSPORT_BR_EDR : BT_TRANSPORT_LE;
 
     p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */

components/bt/bluedroid/stack/btm/include/btm_ble_int.h

@@ -481,6 +481,7 @@ void btm_ble_adv_filter_cleanup(void);
 BOOLEAN btm_ble_topology_check(tBTM_BLE_STATE_MASK request);
 BOOLEAN btm_ble_clear_topology_mask(tBTM_BLE_STATE_MASK request_state);
 BOOLEAN btm_ble_set_topology_mask(tBTM_BLE_STATE_MASK request_state);
+tBTM_BLE_STATE_MASK btm_ble_get_topology_mask(void);
 
 #if BTM_BLE_CONFORMANCE_TESTING == TRUE
 void btm_ble_set_no_disc_if_pair_fail (BOOLEAN disble_disc);

components/bt/bluedroid/stack/btm/include/btm_int.h

@@ -618,7 +618,7 @@ typedef struct {
 // btla-specific --
 #define BTM_SEC_NO_LAST_SERVICE_ID      0
     UINT8           last_author_service_id;         /* ID of last serviced authorized: Reset after each l2cap connection */
-
+    BOOLEAN         enc_init_by_we;
 } tBTM_SEC_DEV_REC;
 
 #define BTM_SEC_IS_SM4(sm) ((BOOLEAN)(BTM_SM4_TRUE == ((sm)&BTM_SM4_TRUE)))

components/bt/bluedroid/stack/btu/btu_init.c

@@ -236,3 +236,13 @@ UINT16 BTU_BleAclPktSize(void)
     return 0;
 #endif
 }
+#if SCAN_QUEUE_CONGEST_CHECK
+bool BTU_check_queue_is_congest(void)
+{
+    UBaseType_t wait_size = uxQueueMessagesWaiting(xBtuQueue);
+    if(wait_size >= QUEUE_CONGEST_SIZE ) {
+        return true;
+    }
+    return false;
+}
+#endif

components/bt/bluedroid/stack/gap/gap_conn.c

@@ -1120,8 +1120,8 @@ static tGAP_CCB *gap_allocate_ccb (void)
     for (xx = 0, p_ccb = gap_cb.conn.ccb_pool; xx < GAP_MAX_CONNECTIONS; xx++, p_ccb++) {
         if (p_ccb->con_state == GAP_CCB_STATE_IDLE) {
             memset (p_ccb, 0, sizeof (tGAP_CCB));
-            p_ccb->tx_queue = fixed_queue_new(SIZE_MAX);
-            p_ccb->rx_queue = fixed_queue_new(SIZE_MAX);
+            p_ccb->tx_queue = fixed_queue_new(QUEUE_SIZE_MAX);
+            p_ccb->rx_queue = fixed_queue_new(QUEUE_SIZE_MAX);
 
             p_ccb->gap_handle   = xx;
             p_ccb->rem_mtu_size = L2CAP_MTU_SIZE;

components/bt/bluedroid/stack/gatt/att_protocol.c

@@ -354,7 +354,7 @@ tGATT_STATUS attp_send_msg_to_l2cap(tGATT_TCB *p_tcb, BT_HDR *p_toL2CAP)
     }
 
     if (l2cap_ret == L2CAP_DW_FAILED) {
-        GATT_TRACE_ERROR("ATT   failed to pass msg:0x%0x to L2CAP",
+        GATT_TRACE_DEBUG("ATT   failed to pass msg:0x%0x to L2CAP",
                          *((UINT8 *)(p_toL2CAP + 1) + p_toL2CAP->offset));
         return GATT_INTERNAL_ERROR;
     } else if (l2cap_ret == L2CAP_DW_CONGESTED) {

components/bt/bluedroid/stack/gatt/gatt_db.c

@@ -64,7 +64,7 @@ BOOLEAN gatts_init_service_db (tGATT_SVC_DB *p_db, tBT_UUID *p_service,  BOOLEAN
                                UINT16 s_hdl, UINT16 num_handle)
 {
     if (p_db->svc_buffer == NULL) { //in case already alloc
-        p_db->svc_buffer = fixed_queue_new(SIZE_MAX);
+        p_db->svc_buffer = fixed_queue_new(QUEUE_SIZE_MAX);
     }
 
     if (!allocate_svc_db_buf(p_db)) {

components/bt/bluedroid/stack/gatt/gatt_main.c

@@ -108,9 +108,9 @@ void gatt_init (void)
     gatt_cb.trace_level = BT_TRACE_LEVEL_NONE;    /* No traces */
 #endif
     gatt_cb.def_mtu_size = GATT_DEF_BLE_MTU_SIZE;
-    gatt_cb.sign_op_queue = fixed_queue_new(SIZE_MAX);
-    gatt_cb.srv_chg_clt_q = fixed_queue_new(SIZE_MAX);
-    gatt_cb.pending_new_srv_start_q = fixed_queue_new(SIZE_MAX);
+    gatt_cb.sign_op_queue = fixed_queue_new(QUEUE_SIZE_MAX);
+    gatt_cb.srv_chg_clt_q = fixed_queue_new(QUEUE_SIZE_MAX);
+    gatt_cb.pending_new_srv_start_q = fixed_queue_new(QUEUE_SIZE_MAX);
     /* First, register fixed L2CAP channel for ATT over BLE */
     fixed_reg.fixed_chnl_opts.mode         = L2CAP_FCR_BASIC_MODE;
     fixed_reg.fixed_chnl_opts.max_transmit = 0xFF;
@@ -179,7 +179,7 @@ void gatt_free(void)
 
         btu_free_timer(&gatt_cb.tcb[i].ind_ack_timer_ent);
         memset(&gatt_cb.tcb[i].ind_ack_timer_ent, 0, sizeof(TIMER_LIST_ENT));
-    
+
 #if (GATTS_INCLUDED == TRUE)
         fixed_queue_free(gatt_cb.tcb[i].sr_cmd.multi_rsp_q, NULL);
         gatt_cb.tcb[i].sr_cmd.multi_rsp_q = NULL;
@@ -979,7 +979,12 @@ void gatt_data_process (tGATT_TCB *p_tcb, BT_HDR *p_buf)
                 }
             }
         } else {
-            GATT_TRACE_ERROR ("ATT - Rcvd L2CAP data, unknown cmd: 0x%x\n", op_code);
+            if (op_code & GATT_COMMAND_FLAG) {
+                GATT_TRACE_ERROR ("ATT - Rcvd L2CAP data, unknown cmd: 0x%x\n", op_code);
+            } else {
+                GATT_TRACE_ERROR ("ATT - Rcvd L2CAP data, unknown req: 0x%x\n", op_code);
+                gatt_send_error_rsp (p_tcb, GATT_REQ_NOT_SUPPORTED, op_code, 0, FALSE);
+            }
         }
     } else {
         GATT_TRACE_ERROR ("invalid data length, ignore\n");

components/bt/bluedroid/stack/gatt/gatt_sr.c

@@ -167,7 +167,7 @@ static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
     GATT_TRACE_DEBUG ("process_read_multi_rsp status=%d mtu=%d", status, mtu);
 
 	if (p_cmd->multi_rsp_q == NULL) {
-        p_cmd->multi_rsp_q = fixed_queue_new(SIZE_MAX);
+        p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
 	}
 
     /* Enqueue the response */
@@ -1290,7 +1290,7 @@ void gatt_attr_process_prepare_write (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 hand
             queue_data->offset = offset;
             memcpy(queue_data->value, p, len);
             if (prepare_record->queue == NULL) {
-                prepare_record->queue = fixed_queue_new(SIZE_MAX);
+                prepare_record->queue = fixed_queue_new(QUEUE_SIZE_MAX);
             }
             fixed_queue_enqueue(prepare_record->queue, queue_data);
         }

components/bt/bluedroid/stack/gatt/gatt_utils.c

@@ -337,7 +337,7 @@ tGATT_HDL_LIST_ELEM *gatt_alloc_hdl_buffer(void)
         if (!p_cb->hdl_list[i].in_use) {
             memset(p_elem, 0, sizeof(tGATT_HDL_LIST_ELEM));
             p_elem->in_use = TRUE;
-            p_elem->svc_db.svc_buffer = fixed_queue_new(SIZE_MAX);
+            p_elem->svc_db.svc_buffer = fixed_queue_new(QUEUE_SIZE_MAX);
             return p_elem;
         }
     }
@@ -1007,8 +1007,8 @@ tGATT_TCB *gatt_allocate_tcb_by_bdaddr(BD_ADDR bda, tBT_TRANSPORT transport)
 
         if (allocated) {
             memset(p_tcb, 0, sizeof(tGATT_TCB));
-            p_tcb->pending_enc_clcb = fixed_queue_new(SIZE_MAX);
-            p_tcb->pending_ind_q = fixed_queue_new(SIZE_MAX);
+            p_tcb->pending_enc_clcb = fixed_queue_new(QUEUE_SIZE_MAX);
+            p_tcb->pending_ind_q = fixed_queue_new(QUEUE_SIZE_MAX);
             p_tcb->in_use = TRUE;
             p_tcb->tcb_idx = i;
             p_tcb->transport = transport;

components/bt/bluedroid/stack/include/stack/btm_api.h

@@ -2811,8 +2811,8 @@ tBTM_STATUS BTM_SwitchRole (BD_ADDR remote_bd_addr,
 **
 ** Function         BTM_ReadRSSI
 **
-** Description      This function is called to read the link policy settings.
-**                  The address of link policy results are returned in the callback.
+** Description      This function is called to read the RSSI for a particular transport.
+**                  The RSSI of results are returned in the callback.
 **                  (tBTM_RSSI_RESULTS)
 **
 ** Returns          BTM_CMD_STARTED if command issued to controller.
@@ -2822,7 +2822,7 @@ tBTM_STATUS BTM_SwitchRole (BD_ADDR remote_bd_addr,
 **
 *******************************************************************************/
 //extern
-tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb);
+tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBT_TRANSPORT transport, tBTM_CMPL_CB *p_cb);
 
 
 /*******************************************************************************

components/bt/bluedroid/stack/include/stack/gatt_api.h

@@ -64,7 +64,7 @@
 #define  GATT_NOT_ENCRYPTED                  0x8e
 #define  GATT_CONGESTED                      0x8f
 
-#define  GATT_DUP_REG                        0x90 
+#define  GATT_DUP_REG                        0x90
 #define  GATT_ALREADY_OPEN                   0x91
 #define  GATT_CANCEL                         0x92
 
@@ -111,6 +111,7 @@ typedef UINT8 tGATT_STATUS;
 #define  GATT_SIGN_CMD_WRITE                 0xD2 /* changed in V4.0 1101-0010 (signed write)  see write cmd above*/
 #define  GATT_OP_CODE_MAX                    GATT_HANDLE_VALUE_CONF + 1 /* 0x1E = 30 + 1 = 31*/
 
+#define  GATT_COMMAND_FLAG                   0x40 /* Command Flag: set to one means commond */
 
 #define  GATT_HANDLE_IS_VALID(x) ((x) != 0)
 
@@ -766,7 +767,7 @@ extern UINT16 GATTS_AddIncludeService (UINT16 service_handle,
 **
 *******************************************************************************/
 extern UINT16 GATTS_AddCharacteristic (UINT16 service_handle, tBT_UUID *p_char_uuid,
-                                tGATT_PERM perm, tGATT_CHAR_PROP property, 
+                                tGATT_PERM perm, tGATT_CHAR_PROP property,
                                 tGATT_ATTR_VAL *attr_val, tGATTS_ATTR_CONTROL *control);
 
 /*******************************************************************************

components/bt/bluedroid/stack/include/stack/hcidefs.h

@@ -793,7 +793,7 @@
 #define HCI_ERR_MAX_ERR                                 0x43
 
 //ESP vendor error code
-#define HCI_ERR_ESP_VENDOR_FAIL                         0xE0               
+#define HCI_ERR_ESP_VENDOR_FAIL                         0xE0
 
 #define HCI_HINT_TO_RECREATE_AMP_PHYS_LINK              0xFF
 

components/bt/bluedroid/stack/l2cap/include/l2c_int.h

@@ -376,6 +376,7 @@ typedef struct t_l2c_linkcb {
 
     TIMER_LIST_ENT      timer_entry;                /* Timer list entry for timeout evt */
     UINT16              handle;                     /* The handle used with LM          */
+    UINT16              completed_packets;          /* The number of conpleted packets  */
 
     tL2C_CCB_Q          ccb_queue;                  /* Queue of CCBs on this LCB        */
 
@@ -667,6 +668,10 @@ extern void l2cu_send_peer_ble_credit_based_disconn_req(tL2C_CCB *p_ccb);
 
 #endif
 
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+extern UINT8 l2cu_find_completed_packets(UINT16 *handles, UINT16 *num_packets);
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
 extern BOOLEAN l2cu_initialize_fixed_ccb (tL2C_LCB *p_lcb, UINT16 fixed_cid, tL2CAP_FCR_OPTS *p_fcr);
 extern void    l2cu_no_dynamic_ccbs (tL2C_LCB *p_lcb);
 extern void    l2cu_process_fixed_chnl_resp (tL2C_LCB *p_lcb);

components/bt/bluedroid/stack/l2cap/l2c_api.c

@@ -1816,7 +1816,7 @@ UINT16 L2CA_SendFixedChnlData (UINT16 fixed_cid, BD_ADDR rem_bda, BT_HDR *p_buf)
 
     // If already congested, do not accept any more packets
     if (p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->cong_sent) {
-        L2CAP_TRACE_ERROR ("L2CAP - CID: 0x%04x cannot send, already congested\
+        L2CAP_TRACE_DEBUG ("L2CAP - CID: 0x%04x cannot send, already congested\
             xmit_hold_q.count: %u buff_quota: %u", fixed_cid,
             fixed_queue_length(p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->xmit_hold_q),
             p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->buff_quota);
@@ -1887,7 +1887,7 @@ BOOLEAN L2CA_RemoveFixedChnl (UINT16 fixed_cid, BD_ADDR rem_bda)
     p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, transport);
 
     if ( ((p_lcb) == NULL) || (!p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]) ) {
-        L2CAP_TRACE_WARNING ("L2CA_RemoveFixedChnl()  CID: 0x%04x  BDA: %08x%04x not connected", fixed_cid,
+        L2CAP_TRACE_DEBUG ("L2CA_RemoveFixedChnl()  CID: 0x%04x  BDA: %08x%04x not connected", fixed_cid,
                              (rem_bda[0] << 24) + (rem_bda[1] << 16) + (rem_bda[2] << 8) + rem_bda[3], (rem_bda[4] << 8) + rem_bda[5]);
         return (FALSE);
     }

components/bt/bluedroid/stack/l2cap/l2c_ble.c

@@ -261,6 +261,15 @@ void l2cble_notify_le_connection (BD_ADDR bda)
     tACL_CONN *p_acl = btm_bda_to_acl(bda, BT_TRANSPORT_LE) ;
 
     if (p_lcb != NULL && p_acl != NULL && p_lcb->link_state != LST_CONNECTED) {
+
+        if(p_acl->link_role == HCI_ROLE_SLAVE) {
+            //clear p_cb->state, controller will stop adv when ble connected.
+            tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
+            if(p_cb) {
+                p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
+                p_cb->state = BTM_BLE_STOP_ADV;
+            }
+        }
         /* update link status */
         btm_establish_continue(p_acl);
         /* update l2cap link status and send callback */

components/bt/bluedroid/stack/l2cap/l2c_fcr.c

@@ -750,7 +750,7 @@ void l2c_fcr_proc_pdu (tL2C_CCB *p_ccb, BT_HDR *p_buf)
     if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) &&
          (!fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q))) {
         fixed_queue_t *temp_q = p_ccb->fcrb.srej_rcv_hold_q;
-        p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(SIZE_MAX);
+        p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(QUEUE_SIZE_MAX);
 
         while ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(temp_q)) != NULL) {
             if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN)) {

components/bt/bluedroid/stack/l2cap/l2c_main.c

@@ -966,7 +966,7 @@ UINT8 l2c_data_write (UINT16 cid, BT_HDR *p_data, UINT16 flags)
 
     /* If already congested, do not accept any more packets */
     if (p_ccb->cong_sent) {
-        L2CAP_TRACE_ERROR ("L2CAP - CID: 0x%04x cannot send, already congested  xmit_hold_q.count: %u  buff_quota: %u",
+        L2CAP_TRACE_DEBUG ("L2CAP - CID: 0x%04x cannot send, already congested  xmit_hold_q.count: %u  buff_quota: %u",
                            p_ccb->local_cid,
                            fixed_queue_length(p_ccb->xmit_hold_q),
                            p_ccb->buff_quota);

components/bt/bluedroid/stack/l2cap/l2c_utils.c

@@ -57,7 +57,7 @@ tL2C_LCB *l2cu_allocate_lcb (BD_ADDR p_bd_addr, BOOLEAN is_bonding, tBT_TRANSPOR
             btu_free_timer(&p_lcb->timer_entry);
             btu_free_timer(&p_lcb->info_timer_entry);
             btu_free_timer(&p_lcb->upda_con_timer);
-            
+
             memset (p_lcb, 0, sizeof (tL2C_LCB));
             memcpy (p_lcb->remote_bd_addr, p_bd_addr, BD_ADDR_LEN);
 
@@ -74,7 +74,7 @@ tL2C_LCB *l2cu_allocate_lcb (BD_ADDR p_bd_addr, BOOLEAN is_bonding, tBT_TRANSPOR
 #if (BLE_INCLUDED == TRUE)
             p_lcb->transport       = transport;
             p_lcb->tx_data_len     = controller_get_interface()->get_ble_default_data_packet_length();
-            p_lcb->le_sec_pending_q = fixed_queue_new(SIZE_MAX);
+            p_lcb->le_sec_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);
 
             if (transport == BT_TRANSPORT_LE) {
                 l2cb.num_ble_links_active++;
@@ -86,6 +86,9 @@ tL2C_LCB *l2cu_allocate_lcb (BD_ADDR p_bd_addr, BOOLEAN is_bonding, tBT_TRANSPOR
                 l2c_link_adjust_allocation();
             }
             p_lcb->link_xmit_data_q = list_new(NULL);
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+            p_lcb->completed_packets = 0;
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
             return (p_lcb);
         }
     }
@@ -137,7 +140,7 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb)
     memset(&p_lcb->info_timer_entry, 0, sizeof(TIMER_LIST_ENT));
     btu_free_timer(&p_lcb->upda_con_timer);
     memset(&p_lcb->upda_con_timer, 0, sizeof(TIMER_LIST_ENT));
-        
+
     /* Release any unfinished L2CAP packet on this link */
     if (p_lcb->p_hcit_rcv_acl) {
         osi_free(p_lcb->p_hcit_rcv_acl);
@@ -250,6 +253,11 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb)
         fixed_queue_free(p_lcb->le_sec_pending_q, NULL);
         p_lcb->le_sec_pending_q = NULL;
     }
+
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+    p_lcb->completed_packets = 0;
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
+
 }
 
 
@@ -1488,7 +1496,7 @@ tL2C_CCB *l2cu_allocate_ccb (tL2C_LCB *p_lcb, UINT16 cid)
     btu_free_quick_timer(&p_ccb->fcrb.ack_timer);
     memset(&p_ccb->fcrb.ack_timer, 0, sizeof(TIMER_LIST_ENT));
     p_ccb->fcrb.ack_timer.param  = (TIMER_PARAM_TYPE)p_ccb;
-    
+
     btu_free_quick_timer(&p_ccb->fcrb.mon_retrans_timer);
     memset(&p_ccb->fcrb.mon_retrans_timer, 0, sizeof(TIMER_LIST_ENT));
     p_ccb->fcrb.mon_retrans_timer.param  = (TIMER_PARAM_TYPE)p_ccb;
@@ -1511,11 +1519,11 @@ tL2C_CCB *l2cu_allocate_ccb (tL2C_LCB *p_lcb, UINT16 cid)
     p_ccb->max_rx_mtu                = L2CAP_MTU_SIZE;
     p_ccb->tx_mps                    = L2CAP_FCR_TX_BUF_SIZE - 32;
 
-    p_ccb->xmit_hold_q  = fixed_queue_new(SIZE_MAX);
+    p_ccb->xmit_hold_q  = fixed_queue_new(QUEUE_SIZE_MAX);
 #if (CLASSIC_BT_INCLUDED == TRUE)
-    p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(SIZE_MAX);
-    p_ccb->fcrb.retrans_q = fixed_queue_new(SIZE_MAX);
-    p_ccb->fcrb.waiting_for_ack_q = fixed_queue_new(SIZE_MAX);
+    p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(QUEUE_SIZE_MAX);
+    p_ccb->fcrb.retrans_q = fixed_queue_new(QUEUE_SIZE_MAX);
+    p_ccb->fcrb.waiting_for_ack_q = fixed_queue_new(QUEUE_SIZE_MAX);
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
 
     p_ccb->cong_sent    = FALSE;
@@ -3140,6 +3148,35 @@ void l2cu_send_peer_ble_credit_based_disconn_req(tL2C_CCB *p_ccb)
 
 #endif /* BLE_INCLUDED == TRUE */
 
+#if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         l2cu_find_completed_packets
+**
+** Description      Find the completed packets,
+**                  Then set it to zero
+**
+** Returns          The num of handles
+**
+*******************************************************************************/
+UINT8 l2cu_find_completed_packets(UINT16 *handles, UINT16 *num_packets)
+{
+    int         xx;
+    UINT8       num = 0;
+    tL2C_LCB    *p_lcb = &l2cb.lcb_pool[0];
+
+    for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_lcb++) {
+        if ((p_lcb->in_use) && (p_lcb->completed_packets > 0)) {
+            *(handles++) = p_lcb->handle;
+            *(num_packets++) = p_lcb->completed_packets;
+            num++;
+            p_lcb->completed_packets = 0;
+        }
+    }
+
+    return num;
+}
+#endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
 
 /*******************************************************************************
 ** Functions used by both Full and Light Stack

components/bt/bluedroid/stack/rfcomm/port_utils.c

@@ -128,8 +128,8 @@ void port_set_defaults (tPORT *p_port)
     memset (&p_port->rx, 0, sizeof (p_port->rx));
     memset (&p_port->tx, 0, sizeof (p_port->tx));
 
-    p_port->tx.queue = fixed_queue_new(SIZE_MAX);
-    p_port->rx.queue = fixed_queue_new(SIZE_MAX);
+    p_port->tx.queue = fixed_queue_new(QUEUE_SIZE_MAX);
+    p_port->rx.queue = fixed_queue_new(QUEUE_SIZE_MAX);
 }
 
 /*******************************************************************************

components/bt/bluedroid/stack/rfcomm/rfc_utils.c

@@ -175,7 +175,7 @@ tRFC_MCB *rfc_alloc_multiplexer_channel (BD_ADDR bd_addr, BOOLEAN is_initiator)
             RFCOMM_TRACE_DEBUG("rfc_alloc_multiplexer_channel:is_initiator:%d, create new p_mcb:%p, index:%d",
                                is_initiator, &rfc_cb.port.rfc_mcb[j], j);
 
-            p_mcb->cmd_q = fixed_queue_new(SIZE_MAX);
+            p_mcb->cmd_q = fixed_queue_new(QUEUE_SIZE_MAX);
 
             p_mcb->is_initiator = is_initiator;
 

components/bt/bluedroid/stack/smp/include/p_256_ecc_pp.h

@@ -58,6 +58,8 @@ extern elliptic_curve_t curve_p256;
 
 void ECC_PointMult_Bin_NAF(Point *q, Point *p, DWORD *n, uint32_t keyLength);
 
+bool ECC_CheckPointIsInElliCur_P256(Point *p);
+
 #define ECC_PointMult(q, p, n, keyLength)  ECC_PointMult_Bin_NAF(q, p, n, keyLength)
 
 void p_256_init_curve(UINT32 keyLength);

components/bt/bluedroid/stack/smp/p_256_ecc_pp.c

@@ -240,4 +240,40 @@ void ECC_PointMult_Bin_NAF(Point *q, Point *p, DWORD *n, uint32_t keyLength)
     multiprecision_mersenns_mult_mod(q->y, q->y, q->z, keyLength);
 }
 
+bool ECC_CheckPointIsInElliCur_P256(Point *p)
+{
+    /* y^2 % q */
+    DWORD y_y_q[KEY_LENGTH_DWORDS_P256] = {0x0};
+    /* x^2 % q */
+    DWORD x_x_q[KEY_LENGTH_DWORDS_P256] = {0x0};
+    /* x % q */
+    DWORD x_q[KEY_LENGTH_DWORDS_P256] = {0x0};
+    /* x^2, To prevent overflow, the length of the x square here needs to 
+       be expanded to two times the original one. */
+    DWORD x_x[2*KEY_LENGTH_DWORDS_P256] = {0x0};
+    /* y_y_q =(p->y)^2(mod q) */
+    multiprecision_mersenns_squa_mod(y_y_q, p->y, KEY_LENGTH_DWORDS_P256);
+    /* Calculate the value of p->x square, x_x = (p->x)^2 */
+    multiprecision_mult(x_x, p->x, p->x, KEY_LENGTH_DWORDS_P256);
+    /* The function of the elliptic curve is y^2 = x^3 - 3x + b (mod q) ==>
+       y^2 = (x^2 - 3)*x + b (mod q),
+       so we calculate the x^2 - 3 value here */
+    x_x[0] -= 3;
+    /* Using math relations. (a*b) % q = ((a%q)*(b%q)) % q ==> 
+      (x^2 - 3)*x = (((x^2 - 3) % q) * x % q) % q */
+    multiprecision_fast_mod_P256(x_x_q, x_x);
+    /* x_x = x_x_q * x_q */
+    multiprecision_mult(x_x, x_x_q, p->x, KEY_LENGTH_DWORDS_P256);
+    /* x_q = x_x % q */
+    multiprecision_fast_mod_P256(x_q, x_x);
+    /* Save the result in x_x_q */
+    multiprecision_add_mod(x_x_q, x_q, curve_p256.b, KEY_LENGTH_DWORDS_P256);
+    /* compare the y_y_q and x_x_q, see if they are on a given elliptic curve. */
+    if (multiprecision_compare(y_y_q, x_x_q, KEY_LENGTH_DWORDS_P256)) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
 

components/bt/bluedroid/stack/smp/smp_act.c

@@ -22,6 +22,7 @@
 #include "btm_int.h"
 #include "stack/l2c_api.h"
 #include "smp_int.h"
+#include "p_256_ecc_pp.h"
 //#include "utils/include/bt_utils.h"
 
 #if SMP_INCLUDED == TRUE
@@ -668,6 +669,12 @@ void smp_process_pairing_public_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 
     STREAM_TO_ARRAY(p_cb->peer_publ_key.x, p, BT_OCTET32_LEN);
     STREAM_TO_ARRAY(p_cb->peer_publ_key.y, p, BT_OCTET32_LEN);
+    /* In order to prevent the x and y coordinates of the public key from being modified, 
+       we need to check whether the x and y coordinates are on the given elliptic curve. */
+    if (!ECC_CheckPointIsInElliCur_P256((Point *)&p_cb->peer_publ_key)) {
+        SMP_TRACE_ERROR("%s, Invalid Public key.", __func__);
+        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+    }
     p_cb->flags |= SMP_PAIR_FLAG_HAVE_PEER_PUBL_KEY;
 
     smp_wait_for_both_public_keys(p_cb, NULL);
@@ -1831,7 +1838,7 @@ void smp_set_local_oob_random_commitment(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 void smp_link_encrypted(BD_ADDR bda, UINT8 encr_enable)
 {
     tSMP_CB *p_cb = &smp_cb;
-
+    tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (bda);
     SMP_TRACE_DEBUG("%s encr_enable=%d\n", __func__, encr_enable);
 
     if (memcmp(&smp_cb.pairing_bda[0], bda, BD_ADDR_LEN) == 0) {
@@ -1842,6 +1849,18 @@ void smp_link_encrypted(BD_ADDR bda, UINT8 encr_enable)
             btm_ble_update_sec_key_size(bda, p_cb->loc_enc_size);
         }
 
+        smp_sm_event(&smp_cb, SMP_ENCRYPTED_EVT, &encr_enable);
+    } 
+    else if(p_dev_rec && !p_dev_rec->enc_init_by_we){ 
+
+        /* 
+        if enc_init_by_we is false, it means that client initiates encryption before slave calls esp_ble_set_encryption()
+        we need initiate pairing_bda and p_cb->role then encryption, for example iPhones
+        */
+        memcpy(&smp_cb.pairing_bda[0], bda, BD_ADDR_LEN);
+        p_cb->state = SMP_STATE_ENCRYPTION_PENDING;
+        p_cb->role = HCI_ROLE_SLAVE;
+        p_dev_rec->enc_init_by_we = FALSE;
         smp_sm_event(&smp_cb, SMP_ENCRYPTED_EVT, &encr_enable);
     }
 }

components/bt/bt.c

@@ -61,9 +61,9 @@
 /* not for user call, so don't put to include file */
 extern void btdm_osi_funcs_register(void *osi_funcs);
 extern int btdm_controller_init(uint32_t config_mask, esp_bt_controller_config_t *config_opts);
-extern int btdm_controller_deinit(void);
+extern void btdm_controller_deinit(void);
 extern int btdm_controller_enable(esp_bt_mode_t mode);
-extern int btdm_controller_disable(esp_bt_mode_t mode);
+extern void btdm_controller_disable(void);
 extern uint8_t btdm_controller_get_mode(void);
 extern const char *btdm_controller_get_compile_version(void);
 extern void btdm_rf_bb_init(void);
@@ -254,12 +254,20 @@ bool IRAM_ATTR btdm_queue_generic_deregister(btdm_queue_item_t *queue)
 
 static void IRAM_ATTR interrupt_disable(void)
 {
-    portENTER_CRITICAL(&global_int_mux);
+    if (xPortInIsrContext()) {
+        portENTER_CRITICAL_ISR(&global_int_mux);
+    } else {
+        portENTER_CRITICAL(&global_int_mux);
+    }
 }
 
 static void IRAM_ATTR interrupt_restore(void)
 {
-    portEXIT_CRITICAL(&global_int_mux);
+    if (xPortInIsrContext()) {
+        portEXIT_CRITICAL_ISR(&global_int_mux);
+    } else {
+        portEXIT_CRITICAL(&global_int_mux);
+    }
 }
 
 static void IRAM_ATTR task_yield_from_isr(void)
@@ -575,9 +583,7 @@ static int IRAM_ATTR rand_wrapper(void)
 
 static uint32_t IRAM_ATTR btdm_lpcycles_2_us(uint32_t cycles)
 {
-    // Sanity check. The number of lp cycles should not be too high to avoid overflow. Thrs: 100s (for 32kHz freq)
-    assert(cycles < 3200000);
-
+    // The number of lp cycles should not lead to overflow. Thrs: 100s (for 32kHz freq)
     // clock measurement is conducted
     uint64_t us = (uint64_t)btdm_lpcycle_us * cycles;
     us = (us + (1 << (btdm_lpcycle_us_frac - 1))) >> btdm_lpcycle_us_frac;
@@ -589,9 +595,7 @@ static uint32_t IRAM_ATTR btdm_lpcycles_2_us(uint32_t cycles)
  */
 static uint32_t IRAM_ATTR btdm_us_2_lpcycles(uint32_t us)
 {
-    // Sanity check: the number of sleep duration(us) should not be too high to avoid overflow. Thrs: 100s
-    assert(us < 100000000);
-
+    // The number of sleep duration(us) should not lead to overflow. Thrs: 100s
     // Compute the sleep duration in us to low power clock cycles, with calibration result applied
     // clock measurement is conducted
     uint64_t cycles = ((uint64_t)(us) << btdm_lpcycle_us_frac) / btdm_lpcycle_us;
@@ -614,9 +618,6 @@ static void IRAM_ATTR btdm_sleep_enter_wrapper(void)
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
         esp_modem_sleep_enter(MODEM_BLE_MODULE);
         esp_modem_sleep_enter(MODEM_CLASSIC_BT_MODULE);
-#ifdef CONFIG_PM_ENABLE
-        esp_pm_lock_release(s_pm_lock);
-#endif
     } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
         esp_modem_sleep_enter(MODEM_BLE_MODULE);
         // pause bluetooth baseband
@@ -627,9 +628,6 @@ static void IRAM_ATTR btdm_sleep_enter_wrapper(void)
 static void IRAM_ATTR btdm_sleep_exit_wrapper(void)
 {
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-#ifdef CONFIG_PM_ENABLE
-        esp_pm_lock_acquire(s_pm_lock);
-#endif
         esp_modem_sleep_exit(MODEM_BLE_MODULE);
         esp_modem_sleep_exit(MODEM_CLASSIC_BT_MODULE);
     } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
@@ -882,9 +880,7 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
-    if (btdm_controller_deinit() != 0) {
-        return ESP_ERR_NO_MEM;
-    }
+    btdm_controller_deinit();
 
     periph_module_disable(PERIPH_BT_MODULE);
 
@@ -925,7 +921,14 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 
     esp_phy_load_cal_and_init(PHY_BT_MODULE);
 
-    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
+    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_NONE) {
+        //Just register to sleep module, make the modem sleep modules check BT sleep status when sleep enter.
+        //Thus, it will prevent WIFI from disabling RF when BT is not in sleep but is using RF.
+        esp_modem_sleep_register(MODEM_BLE_MODULE);
+        esp_modem_sleep_register(MODEM_CLASSIC_BT_MODULE);
+        esp_modem_sleep_exit(MODEM_BLE_MODULE);
+        esp_modem_sleep_exit(MODEM_CLASSIC_BT_MODULE);
+    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
         esp_modem_sleep_register(MODEM_BLE_MODULE);
         esp_modem_sleep_register(MODEM_CLASSIC_BT_MODULE);
     } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
@@ -943,13 +946,17 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 
     ret = btdm_controller_enable(mode);
     if (ret) {
-        if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
+        if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_NONE
+                || btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
             esp_modem_sleep_deregister(MODEM_BLE_MODULE);
             esp_modem_sleep_deregister(MODEM_CLASSIC_BT_MODULE);
         } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
             esp_modem_sleep_deregister(MODEM_BLE_MODULE);
         }
         esp_phy_rf_deinit(PHY_BT_MODULE);
+#ifdef CONFIG_PM_ENABLE
+        esp_pm_lock_release(s_pm_lock);
+#endif
         return ESP_ERR_INVALID_STATE;
     }
 
@@ -960,8 +967,6 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 
 esp_err_t esp_bt_controller_disable(void)
 {
-    int ret;
-
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
@@ -977,21 +982,17 @@ esp_err_t esp_bt_controller_disable(void)
         }
     }
 
-    ret = btdm_controller_disable(btdm_controller_get_mode());
-    if (ret < 0) {
-        return ESP_ERR_INVALID_STATE;
-    }
+    btdm_controller_disable();
 
-    if (ret == ESP_BT_MODE_IDLE) {
-        if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-            esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-            esp_modem_sleep_deregister(MODEM_CLASSIC_BT_MODULE);
-        } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-            esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-        }
-        esp_phy_rf_deinit(PHY_BT_MODULE);
-        btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
+    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_NONE
+            || btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
+        esp_modem_sleep_deregister(MODEM_BLE_MODULE);
+        esp_modem_sleep_deregister(MODEM_CLASSIC_BT_MODULE);
+    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
+        esp_modem_sleep_deregister(MODEM_BLE_MODULE);
     }
+    esp_phy_rf_deinit(PHY_BT_MODULE);
+    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
 #ifdef CONFIG_PM_ENABLE
     esp_pm_lock_release(s_pm_lock);

components/bt/test/component.mk

@@ -0,0 +1,5 @@
+#
+#Component Makefile
+#
+
+COMPONENT_ADD_LDFLAGS = -Wl,--whole-archive -l$(COMPONENT_NAME) -Wl,--no-whole-archive

components/bt/test/test_smp.c

@@ -0,0 +1,107 @@
+/*
+ Tests for the BLE SMP implementation
+*/
+
+#include <esp_types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <malloc.h>
+#include <string.h>
+#include <string.h>
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/semphr.h"
+#include "freertos/queue.h"
+#include "freertos/xtensa_api.h"
+#include "unity.h"
+#include "esp_heap_caps.h"
+#include "esp_log.h"
+#include "freertos/ringbuf.h"
+#include "esp_system.h"
+#include "nvs_flash.h"
+
+#include "esp_bt.h"
+#include "esp_bt_main.h"
+#include "esp_bt_device.h"
+#include "esp_gap_ble_api.h"
+
+#define TAG "ble_smp_test"
+
+#define KEY_LENGTH_DWORDS_P256 8
+
+typedef unsigned long  DWORD;
+typedef uint32_t UINT32;
+
+typedef struct {
+DWORD x[KEY_LENGTH_DWORDS_P256];
+    DWORD y[KEY_LENGTH_DWORDS_P256];
+    DWORD z[KEY_LENGTH_DWORDS_P256];
+} Point;
+
+typedef struct {
+    // curve's coefficients
+    DWORD a[KEY_LENGTH_DWORDS_P256];
+    DWORD b[KEY_LENGTH_DWORDS_P256];
+
+    //whether a is -3
+    int a_minus3;
+
+    // prime modulus
+    DWORD p[KEY_LENGTH_DWORDS_P256];
+
+    // Omega, p = 2^m -omega
+    DWORD omega[KEY_LENGTH_DWORDS_P256];
+
+    // base point, a point on E of order r
+    Point G;
+
+} elliptic_curve_t;
+
+extern void ECC_PointMult_Bin_NAF(Point *q, Point *p, DWORD *n, uint32_t keyLength);
+extern bool ECC_CheckPointIsInElliCur_P256(Point *p);
+extern void p_256_init_curve(UINT32 keyLength);
+extern elliptic_curve_t curve_p256;
+
+static void bt_rand(void *buf, size_t len)
+{
+    if (!len) {
+        return;
+    }
+    // Reset the buf value to the fixed value.
+    memset(buf, 0x55, len);
+
+    for (int i = 0; i < (int)(len / sizeof(uint32_t)); i++) {
+        uint32_t rand = esp_random();
+        memcpy(buf + i*sizeof(uint32_t), &rand, sizeof(uint32_t));
+    }
+
+    return;
+}
+
+TEST_CASE("ble_smp_public_key_check", "[ble_smp]")
+{
+    /* We wait init finish 200ms here */
+    vTaskDelay(200 / portTICK_PERIOD_MS);
+    Point public_key;
+    DWORD private_key[KEY_LENGTH_DWORDS_P256] = {[0 ... (KEY_LENGTH_DWORDS_P256 - 1)] = 0x12345678};
+    p_256_init_curve(KEY_LENGTH_DWORDS_P256);
+    ECC_PointMult_Bin_NAF(&public_key, &(curve_p256.G), private_key, KEY_LENGTH_DWORDS_P256);
+    /* Check Is the public key generated by the system on the given elliptic curve */
+    TEST_ASSERT(ECC_CheckPointIsInElliCur_P256(&public_key));
+    /* We simulate the attacker and set the y coordinate of the public key to 0. */
+    for (int i = 0; i < KEY_LENGTH_DWORDS_P256; i++) {
+        public_key.y[i] = 0x0;
+    }
+    /* At this point the public key should not be on the given elliptic curve. */
+    TEST_ASSERT(!ECC_CheckPointIsInElliCur_P256(&public_key));
+    /* Test whether the G point on the protocol is on a given elliptic curve */
+    TEST_ASSERT(ECC_CheckPointIsInElliCur_P256(&(curve_p256.G)));
+    /* test 100 times when the private key is generated by the random number. */
+    for (int j = 0; j < 100; j++) {
+        bt_rand(private_key, sizeof(DWORD)*KEY_LENGTH_DWORDS_P256);
+        ECC_PointMult_Bin_NAF(&public_key, &(curve_p256.G), private_key, KEY_LENGTH_DWORDS_P256);
+        /* Check Is the public key generated by the system on the given elliptic curve */
+        TEST_ASSERT(ECC_CheckPointIsInElliCur_P256(&public_key));
+    }
+}

components/coap/component.mk

@@ -12,3 +12,5 @@ COMPONENT_SUBMODULES += libcoap
 
 libcoap/src/debug.o: CFLAGS += -Wno-write-strings
 libcoap/src/pdu.o: CFLAGS += -Wno-write-strings
+# Temporary suppress "fallthrough" warnings until they are fixed in libcoap repo
+libcoap/src/option.o: CFLAGS += -Wno-implicit-fallthrough

components/coap/port/coap_io_socket.c

@@ -374,8 +374,8 @@ coap_network_read(coap_endpoint_t *ep, coap_packet_t **packet) {
 	      }
 
 	      /* local interface for IPv4 */
-	      (*packet)->src.size = sizeof((*packet)->src.addr);
-	      memcpy(&(*packet)->src.addr.sa, &soc_srcipaddr, (*packet)->src.size);
+	      (*packet)->src.size = sizeof((*packet)->src.addr.sa);
+	      memcpy(&((*packet)->src.addr.sa), &soc_srcipaddr, (*packet)->src.size);
 
 	      if (len > coap_get_max_packetlength(*packet)) {
 	         /* FIXME: we might want to send back a response */

components/console/argtable3/argtable3.c

@@ -3071,6 +3071,7 @@ static int trex_charnode(TRex *exp,TRexBool isclass)
 					exp->_p++;
 					return node;
 				} //else default
+				/* falls through */
 			default:
 				t = *exp->_p; exp->_p++;
 				return trex_newnode(exp,t);

components/cxx/cxx_exception_stubs.cpp

@@ -13,12 +13,23 @@ extern "C" void __cxx_fatal_exception(void)
     abort();
 }
 
+extern "C" bool __cxx_fatal_exception_bool(void)
+{
+    __cxx_fatal_exception();
+    return false;
+}
+
 extern "C" void __cxx_fatal_exception_message(const char *msg)
 {
     printf("%s%s\n", FATAL_EXCEPTION, msg);
     abort();
 }
 
+extern "C" void __cxx_fatal_exception_message_va(const char *msg, ...)
+{
+    __cxx_fatal_exception_message(msg);
+}
+
 extern "C" void __cxx_fatal_exception_int(int i)
 {
     printf("%s (%d)\n", FATAL_EXCEPTION, i);
@@ -43,7 +54,7 @@ void std::__throw_length_error(const char*) __attribute__((alias("__cxx_fatal_ex
 
 void std::__throw_out_of_range(const char*) __attribute__((alias("__cxx_fatal_exception_message")));
 
-void std::__throw_out_of_range_fmt(const char*, ...) __attribute__((alias("__cxx_fatal_exception_message")));
+void std::__throw_out_of_range_fmt(const char*, ...) __attribute__((alias("__cxx_fatal_exception_message_va")));
 
 void std::__throw_runtime_error(const char*) __attribute__((alias("__cxx_fatal_exception_message")));
 
@@ -84,6 +95,6 @@ extern "C" void __cxa_rethrow(void) __attribute__((alias("__cxx_fatal_exception"
 extern "C" void __cxa_throw(void) __attribute__((alias("__cxx_fatal_exception")));
 extern "C" void __cxa_call_terminate(void) __attribute__((alias("__cxx_fatal_exception")));
 
-bool std::uncaught_exception() __attribute__((alias("__cxx_fatal_exception")));
+bool std::uncaught_exception() __attribute__((alias("__cxx_fatal_exception_bool")));
 
 #endif // CONFIG_CXX_EXCEPTIONS

components/driver/gpio.c

@@ -21,6 +21,7 @@
 #include "driver/rtc_io.h"
 #include "soc/soc.h"
 #include "esp_log.h"
+#include "soc/gpio_periph.h"
 
 static const char* GPIO_TAG = "gpio";
 #define GPIO_CHECK(a, str, ret_val) \
@@ -29,49 +30,6 @@ static const char* GPIO_TAG = "gpio";
         return (ret_val); \
     }
 
-const uint32_t GPIO_PIN_MUX_REG[GPIO_PIN_COUNT] = {
-    IO_MUX_GPIO0_REG,
-    IO_MUX_GPIO1_REG,
-    IO_MUX_GPIO2_REG,
-    IO_MUX_GPIO3_REG,
-    IO_MUX_GPIO4_REG,
-    IO_MUX_GPIO5_REG,
-    IO_MUX_GPIO6_REG,
-    IO_MUX_GPIO7_REG,
-    IO_MUX_GPIO8_REG,
-    IO_MUX_GPIO9_REG,
-    IO_MUX_GPIO10_REG,
-    IO_MUX_GPIO11_REG,
-    IO_MUX_GPIO12_REG,
-    IO_MUX_GPIO13_REG,
-    IO_MUX_GPIO14_REG,
-    IO_MUX_GPIO15_REG,
-    IO_MUX_GPIO16_REG,
-    IO_MUX_GPIO17_REG,
-    IO_MUX_GPIO18_REG,
-    IO_MUX_GPIO19_REG,
-    0,
-    IO_MUX_GPIO21_REG,
-    IO_MUX_GPIO22_REG,
-    IO_MUX_GPIO23_REG,
-    0,
-    IO_MUX_GPIO25_REG,
-    IO_MUX_GPIO26_REG,
-    IO_MUX_GPIO27_REG,
-    0,
-    0,
-    0,
-    0,
-    IO_MUX_GPIO32_REG,
-    IO_MUX_GPIO33_REG,
-    IO_MUX_GPIO34_REG,
-    IO_MUX_GPIO35_REG,
-    IO_MUX_GPIO36_REG,
-    IO_MUX_GPIO37_REG,
-    IO_MUX_GPIO38_REG,
-    IO_MUX_GPIO39_REG,
-};
-
 typedef struct {
     gpio_isr_t fn;   /*!< isr function */
     void* args;      /*!< isr function args */
@@ -133,9 +91,19 @@ esp_err_t gpio_set_intr_type(gpio_num_t gpio_num, gpio_int_type_t intr_type)
     return ESP_OK;
 }
 
+static void gpio_intr_status_clr(gpio_num_t gpio_num)
+{
+    if (gpio_num < 32) {
+        GPIO.status_w1tc = BIT(gpio_num);
+    } else {
+        GPIO.status1_w1tc.intr_st = BIT(gpio_num - 32);
+    }
+}
+
 static esp_err_t gpio_intr_enable_on_core (gpio_num_t gpio_num, uint32_t core_id)
 {
     GPIO_CHECK(GPIO_IS_VALID_GPIO(gpio_num), "GPIO number error", ESP_ERR_INVALID_ARG);
+    gpio_intr_status_clr(gpio_num);
     if (core_id == 0) {
         GPIO.pin[gpio_num].int_ena = GPIO_PRO_CPU_INTR_ENA;     //enable pro cpu intr
     } else {
@@ -153,6 +121,7 @@ esp_err_t gpio_intr_disable(gpio_num_t gpio_num)
 {
     GPIO_CHECK(GPIO_IS_VALID_GPIO(gpio_num), "GPIO number error", ESP_ERR_INVALID_ARG);
     GPIO.pin[gpio_num].int_ena = 0;                             //disable GPIO intr
+    gpio_intr_status_clr(gpio_num);
     return ESP_OK;
 }
 
@@ -291,7 +260,11 @@ esp_err_t gpio_config(const gpio_config_t *pGPIOConfig)
     }
     do {
         io_reg = GPIO_PIN_MUX_REG[io_num];
-        if (((gpio_pin_mask >> io_num) & BIT(0)) && io_reg) {
+        if (((gpio_pin_mask >> io_num) & BIT(0))) {
+            if (!io_reg) {
+                ESP_LOGE(GPIO_TAG, "IO%d is not a valid GPIO",io_num);
+                return ESP_ERR_INVALID_ARG;
+            }
             if(RTC_GPIO_IS_VALID_GPIO(io_num)){
                 rtc_gpio_deinit(io_num);
             }
@@ -343,7 +316,7 @@ esp_err_t gpio_reset_pin(gpio_num_t gpio_num)
 {
     assert(gpio_num >= 0 && GPIO_IS_VALID_GPIO(gpio_num));
     gpio_config_t cfg = {
-        .pin_bit_mask = BIT(gpio_num),
+        .pin_bit_mask = BIT64(gpio_num),
         .mode = GPIO_MODE_DISABLE,
         //for powersave reasons, the GPIO should not be floating, select pullup
         .pull_up_en = true,

components/driver/include/driver/gpio.h

@@ -24,6 +24,7 @@
 #include "rom/gpio.h"
 #include "esp_attr.h"
 #include "esp_intr_alloc.h"
+#include "soc/gpio_periph.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -121,10 +122,8 @@ extern "C" {
 #define GPIO_MODE_DEF_OD              (BIT2)
 
 
-#define GPIO_PIN_COUNT              40
 /** @endcond */
 
-extern const uint32_t GPIO_PIN_MUX_REG[GPIO_PIN_COUNT];
 #define GPIO_IS_VALID_GPIO(gpio_num)      ((gpio_num < GPIO_PIN_COUNT && GPIO_PIN_MUX_REG[gpio_num] != 0))   /*!< Check whether it is a valid GPIO number */
 #define GPIO_IS_VALID_OUTPUT_GPIO(gpio_num)      ((GPIO_IS_VALID_GPIO(gpio_num)) && (gpio_num < 34))         /*!< Check whether it can be a valid GPIO number of output mode */
 
@@ -250,13 +249,13 @@ esp_err_t gpio_config(const gpio_config_t *pGPIOConfig);
 
 /**
  * @brief Reset an gpio to default state (select gpio function, enable pullup and disable input and output).
- * 
+ *
  * @param gpio_num GPIO number.
- * 
+ *
  * @note This function also configures the IOMUX for this pin to the GPIO
  *       function, and disconnects any other peripheral output configured via GPIO
  *       Matrix.
- * 
+ *
  * @return Always return ESP_OK.
  */
 esp_err_t gpio_reset_pin(gpio_num_t gpio_num);

components/driver/include/driver/ledc.h

@@ -455,7 +455,7 @@ void ledc_fade_func_uninstall();
 esp_err_t ledc_fade_start(ledc_mode_t speed_mode, ledc_channel_t channel, ledc_fade_mode_t fade_mode);
 
 /**
- * @brief A thread-safe API to set duty for LEDC channel and update the settings immediately
+ * @brief A thread-safe API to set duty for LEDC channel and return when duty updated.
  * @note  If a fade operation is running in progress on that channel, the driver would not allow it to be stopped.
  *        Other duty operations will have to wait until the fade operation has finished.
  *

components/driver/include/driver/pcnt.h

@@ -98,6 +98,8 @@ typedef intr_handle_t pcnt_isr_handle_t;
 
 /**
  * @brief Configure Pulse Counter unit
+ *        @note
+ *        This function will disable three events: PCNT_EVT_L_LIM, PCNT_EVT_H_LIM, PCNT_EVT_ZERO.
  *
  * @param pcnt_config Pointer of Pulse Counter unit configure parameter
  *
@@ -233,16 +235,19 @@ esp_err_t pcnt_get_event_value(pcnt_unit_t unit, pcnt_evt_type_t evt_type, int16
 /**
  * @brief Register PCNT interrupt handler, the handler is an ISR.
  *        The handler will be attached to the same CPU core that this function is running on.
+ *        Please do not use pcnt_isr_service_install if this function was called.
  *
  * @param fn Interrupt handler function.
  * @param arg Parameter for handler function
  * @param intr_alloc_flags Flags used to allocate the interrupt. One or multiple (ORred)
  *        ESP_INTR_FLAG_* values. See esp_intr_alloc.h for more info.
  * @param handle Pointer to return handle. If non-NULL, a handle for the interrupt will
- *        be returned here.
+ *        be returned here. Calling esp_intr_free to unregister this ISR service if needed,
+ *        but only if the handle is not NULL.
  *
  * @return
  *     - ESP_OK Success
+ *     - ESP_ERR_NOT_FOUND Can not find the interrupt that matches the flags.
  *     - ESP_ERR_INVALID_ARG Function pointer error.
  */
 esp_err_t pcnt_isr_register(void (*fn)(void*), void * arg, int intr_alloc_flags, pcnt_isr_handle_t *handle);
@@ -358,7 +363,8 @@ esp_err_t pcnt_isr_handler_add(pcnt_unit_t unit, void(*isr_handler)(void *), voi
 /**
  * @brief Install PCNT ISR service.
  * @note We can manage different interrupt service for each unit.
- *       Please do not use pcnt_isr_register if this function was called.
+ *       This function will use the default ISR handle service, Calling pcnt_isr_service_uninstall to
+ *       uninstall the default service if needed. Please do not use pcnt_isr_register if this function was called. 
  *
  * @param intr_alloc_flags Flags used to allocate the interrupt. One or multiple (ORred)
  *        ESP_INTR_FLAG_* values. See esp_intr_alloc.h for more info.

components/driver/include/driver/rtc_io.h

@@ -19,33 +19,11 @@
 #include "esp_err.h"
 #include "driver/gpio.h"
 #include "soc/rtc_gpio_channel.h"
-
+#include "soc/rtc_periph.h"
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-/**
- * @brief Pin function information for a single GPIO pad's RTC functions.
- *
- * This is an internal function of the driver, and is not usually useful
- * for external use.
- */
-typedef struct {
-    uint32_t reg;       /*!< Register of RTC pad, or 0 if not an RTC GPIO */
-    uint32_t mux;       /*!< Bit mask for selecting digital pad or RTC pad */
-    uint32_t func;      /*!< Shift of pad function (FUN_SEL) field */
-    uint32_t ie;        /*!< Mask of input enable */
-    uint32_t pullup;    /*!< Mask of pullup enable */
-    uint32_t pulldown;  /*!< Mask of pulldown enable */
-    uint32_t slpsel;    /*!< If slpsel bit is set, slpie will be used as pad input enabled signal in sleep mode */
-    uint32_t slpie;     /*!< Mask of input enable in sleep mode */
-    uint32_t hold;      /*!< Mask of hold enable */
-    uint32_t hold_force;/*!< Mask of hold_force bit for RTC IO in RTC_CNTL_HOLD_FORCE_REG */
-    uint32_t drv_v;     /*!< Mask of drive capability */
-    uint32_t drv_s;     /*!< Offset of drive capability */
-    int rtc_num;        /*!< RTC IO number, or -1 if not an RTC GPIO */
-} rtc_gpio_desc_t;
-
 typedef enum {
     RTC_GPIO_MODE_INPUT_ONLY , /*!< Pad input */
     RTC_GPIO_MODE_OUTPUT_ONLY, /*!< Pad output */
@@ -53,15 +31,6 @@ typedef enum {
     RTC_GPIO_MODE_DISABLED,    /*!< Pad (output + input) disable */
 } rtc_gpio_mode_t;
 
-/**
- * @brief Provides access to a constant table of RTC I/O pin
- * function information.
- *
- * This is an internal function of the driver, and is not usually useful
- * for external use.
- */
-extern const rtc_gpio_desc_t rtc_gpio_desc[GPIO_PIN_COUNT];
-
 /**
  * @brief Determine if the specified GPIO is a valid RTC GPIO.
  *

components/driver/include/driver/sdio_slave.h

@@ -47,10 +47,12 @@ typedef enum {
 
 /// Timing of SDIO slave
 typedef enum {
-    SDIO_SLAVE_TIMING_NSEND_PSAMPLE = 0,///< Send at negedge, and sample at posedge. Default value for SD protocol.
-    SDIO_SLAVE_TIMING_NSEND_NSAMPLE,    ///< Send at negedge, and sample at negedge
-    SDIO_SLAVE_TIMING_PSEND_PSAMPLE,    ///< Send at posedge, and sample at posedge
+    SDIO_SLAVE_TIMING_PSEND_PSAMPLE = 0,/**< Send at posedge, and sample at posedge. Default value for HS mode.
+                                         *   Normally there's no problem using this to work in DS mode.
+                                         */
+    SDIO_SLAVE_TIMING_NSEND_PSAMPLE    ,///< Send at negedge, and sample at posedge. Default value for DS mode and below.
     SDIO_SLAVE_TIMING_PSEND_NSAMPLE,    ///< Send at posedge, and sample at negedge
+    SDIO_SLAVE_TIMING_NSEND_NSAMPLE,    ///< Send at negedge, and sample at negedge
 } sdio_slave_timing_t;
 
 /// Configuration of SDIO slave mode
@@ -197,12 +199,12 @@ uint8_t* sdio_slave_recv_get_buf( sdio_slave_buf_handle_t handle, size_t *len_o)
 esp_err_t sdio_slave_send_queue(uint8_t* addr, size_t len, void* arg, TickType_t wait);
 
 /** Return the ownership of a finished transaction.
- * @param arg_o Argument of the finished transaction.
+ * @param out_arg Argument of the finished transaction. Set to NULL if unused.
  * @param wait Time to wait if there's no finished sending transaction.
  *
  * @return ESP_ERR_TIMEOUT if no transaction finished, or ESP_OK if succeed.
  */
-esp_err_t sdio_slave_send_get_finished(void** arg_o, TickType_t wait);
+esp_err_t sdio_slave_send_get_finished(void** out_arg, TickType_t wait);
 
 /** Start a new sending transfer, and wait for it (blocked) to be finished.
  *

components/driver/include/driver/sdmmc_defs.h

@@ -31,11 +31,13 @@
 #define MMC_SEND_EXT_CSD                8       /* R1 */
 #define MMC_SEND_CSD                    9       /* R2 */
 #define MMC_SEND_CID                    10      /* R1 */
+#define MMC_READ_DAT_UNTIL_STOP         11      /* R1 */
 #define MMC_STOP_TRANSMISSION           12      /* R1B */
 #define MMC_SEND_STATUS                 13      /* R1 */
 #define MMC_SET_BLOCKLEN                16      /* R1 */
 #define MMC_READ_BLOCK_SINGLE           17      /* R1 */
 #define MMC_READ_BLOCK_MULTIPLE         18      /* R1 */
+#define MMC_WRITE_DAT_UNTIL_STOP        20      /* R1 */
 #define MMC_SET_BLOCK_COUNT             23      /* R1 */
 #define MMC_WRITE_BLOCK_SINGLE          24      /* R1 */
 #define MMC_WRITE_BLOCK_MULTIPLE        25      /* R1 */

components/driver/include/driver/touch_pad.h

@@ -122,6 +122,7 @@ esp_err_t touch_pad_init();
 
 /**
  * @brief Un-install touch pad driver.
+ * @note  After this function is called, other touch functions are prohibited from being called.
  * @return
  *     - ESP_OK   Success
  *     - ESP_FAIL Touch pad driver not initialized
@@ -550,6 +551,15 @@ esp_err_t touch_pad_filter_stop();
  */
 esp_err_t touch_pad_filter_delete();
 
+/**
+ * @brief Get the touch pad which caused wakeup from sleep
+ * @param pad_num pointer to touch pad which caused wakeup
+ * @return
+ *      - ESP_OK Success
+ *      - ESP_FAIL get status err
+ */
+esp_err_t touch_pad_get_wakeup_status(touch_pad_t *pad_num);
+
 #ifdef __cplusplus
 }
 #endif

components/driver/ledc.c

@@ -449,6 +449,7 @@ esp_err_t ledc_set_freq(ledc_mode_t speed_mode, ledc_timer_t timer_num, uint32_t
         ret = ESP_FAIL;
     }
     LEDC.timer_group[speed_mode].timer[timer_num].conf.clock_divider = clock_divider;
+    ledc_ls_timer_update(speed_mode, timer_num);
     portEXIT_CRITICAL(&ledc_spinlock);
     return ret;
 }
@@ -587,7 +588,7 @@ static esp_err_t _ledc_set_fade_with_step(ledc_mode_t speed_mode, ledc_channel_t
 {
     portENTER_CRITICAL(&ledc_spinlock);
     uint32_t duty_cur = LEDC.channel_group[speed_mode].channel[channel].duty_rd.duty_read >> LEDC_DUTY_DECIMAL_BIT_NUM;
-    // if duty == max_duty and scale and fade_down == 1, counter would overflow.
+    // When duty == max_duty, meanwhile, if scale == 1 and fade_down == 1, counter would overflow.
     if (duty_cur == ledc_get_max_duty(speed_mode, channel)) {
         duty_cur -= 1;
     }
@@ -609,6 +610,7 @@ static esp_err_t _ledc_set_fade_with_step(ledc_mode_t speed_mode, ledc_channel_t
             step_num = step_num > LEDC_STEP_NUM_MAX ? LEDC_STEP_NUM_MAX : step_num;
         }
     }
+
     portEXIT_CRITICAL(&ledc_spinlock);
     if (scale > 0 && step_num > 0) {
         ledc_duty_config(speed_mode, channel, LEDC_VAL_NO_CHANGE, duty_cur << 4, dir, step_num, cycle_num, scale);
@@ -736,18 +738,16 @@ esp_err_t ledc_set_duty_and_update(ledc_mode_t speed_mode, ledc_channel_t channe
     LEDC_ARG_CHECK(speed_mode < LEDC_SPEED_MODE_MAX, "speed_mode");
     LEDC_ARG_CHECK(channel < LEDC_CHANNEL_MAX, "channel");
     LEDC_ARG_CHECK(duty <= ledc_get_max_duty(speed_mode, channel), "target_duty");
+    LEDC_CHECK(ledc_fade_channel_init_check(speed_mode, channel) == ESP_OK , LEDC_FADE_INIT_ERROR_STR, ESP_FAIL);
+    uint32_t cur_duty = ledc_get_duty(speed_mode, channel);
+    if (duty == cur_duty) {
+        return ESP_OK;
+    }
     _ledc_op_lock_acquire(speed_mode, channel);
     _ledc_fade_hw_acquire(speed_mode, channel);
-    ledc_duty_config(speed_mode,
-                     channel,         //uint32_t chan_num,
-                     hpoint,          //uint32_t hpoint_val,
-                     duty << 4,       //uint32_t duty_val,the least 4 bits are decimal part
-                     1,               //uint32_t increase,
-                     1,               //uint32_t duty_num,
-                     1,               //uint32_t duty_cycle,
-                     0                //uint32_t duty_scale
-                     );
-    ledc_update_duty(speed_mode, channel);
+    int scale = cur_duty > duty ? cur_duty - duty : duty - cur_duty;
+    _ledc_set_fade_with_step(speed_mode, channel, duty, scale, 1);
+    _ledc_fade_start(speed_mode, channel, LEDC_FADE_WAIT_DONE);
     _ledc_fade_hw_release(speed_mode, channel);
     _ledc_op_lock_release(speed_mode, channel);
     return ESP_OK;

components/driver/pcnt.c

@@ -24,6 +24,7 @@
 #define PCNT_COUNT_MODE_ERR_STR "PCNT COUNTER MODE ERROR"
 #define PCNT_CTRL_MODE_ERR_STR  "PCNT CTRL MODE ERROR"
 #define PCNT_EVT_TYPE_ERR_STR   "PCNT value type error"
+#define PCNT_LIMT_VAL_ERR_STR   "PCNT limit value error"
 
 #define PCNT_ENTER_CRITICAL(mux)    portENTER_CRITICAL(mux)
 #define PCNT_EXIT_CRITICAL(mux)     portEXIT_CRITICAL(mux)
@@ -221,6 +222,8 @@ esp_err_t pcnt_set_event_value(pcnt_unit_t unit, pcnt_evt_type_t evt_type, int16
 {
     PCNT_CHECK(unit < PCNT_UNIT_MAX, PCNT_UNIT_ERR_STR, ESP_ERR_INVALID_ARG);
     PCNT_CHECK(evt_type < PCNT_EVT_MAX, PCNT_EVT_TYPE_ERR_STR, ESP_ERR_INVALID_ARG);
+    PCNT_CHECK(!(evt_type == PCNT_EVT_L_LIM && value > 0), PCNT_LIMT_VAL_ERR_STR, ESP_ERR_INVALID_ARG);
+    PCNT_CHECK(!(evt_type == PCNT_EVT_H_LIM && value < 0), PCNT_LIMT_VAL_ERR_STR, ESP_ERR_INVALID_ARG);
     if(evt_type == PCNT_EVT_L_LIM) {
         PCNT.conf_unit[unit].conf2.cnt_l_lim = value;
     } else if(evt_type == PCNT_EVT_H_LIM) {

components/driver/rmt.c

@@ -137,7 +137,7 @@ esp_err_t rmt_get_rx_idle_thresh(rmt_channel_t channel, uint16_t *thresh)
 esp_err_t rmt_set_mem_block_num(rmt_channel_t channel, uint8_t rmt_mem_num)
 {
     RMT_CHECK(channel < RMT_CHANNEL_MAX, RMT_CHANNEL_ERROR_STR, ESP_ERR_INVALID_ARG);
-    RMT_CHECK(rmt_mem_num < 16, RMT_MEM_CNT_ERROR_STR, ESP_ERR_INVALID_ARG);
+    RMT_CHECK(rmt_mem_num <= RMT_CHANNEL_MAX - channel, RMT_MEM_CNT_ERROR_STR, ESP_ERR_INVALID_ARG);
     RMT.conf_ch[channel].conf0.mem_size = rmt_mem_num;
     return ESP_OK;
 }
@@ -669,7 +669,7 @@ esp_err_t rmt_driver_uninstall(rmt_channel_t channel)
     }
     //Avoid blocking here(when the interrupt is disabled and do not wait tx done).
     if(p_rmt_obj[channel]->wait_done) {
-        xSemaphoreTake(p_rmt_obj[channel]->tx_sem, portMAX_DELAY);  
+        xSemaphoreTake(p_rmt_obj[channel]->tx_sem, portMAX_DELAY);
     }
     rmt_set_rx_intr_en(channel, 0);
     rmt_set_err_intr_en(channel, 0);
@@ -929,4 +929,4 @@ esp_err_t rmt_write_sample(rmt_channel_t channel, const uint8_t *src, size_t src
         xSemaphoreGive(p_rmt->tx_sem);
     }
     return ESP_OK;
-}
+}

components/driver/rtc_module.c

@@ -1,6 +1,9 @@
+// Copyright 2016-2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-
+//
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
@@ -98,12 +101,12 @@ In ADC2, there're two locks used for different cases:
 adc2_spinlock should be acquired first, then adc2_wifi_lock or rtc_spinlock.
 */
 //prevent ADC2 being used by wifi and other tasks at the same time.
-static _lock_t adc2_wifi_lock = NULL;
+static _lock_t adc2_wifi_lock;
 //prevent ADC2 being used by tasks (regardless of WIFI)
 portMUX_TYPE adc2_spinlock = portMUX_INITIALIZER_UNLOCKED;
 
 //prevent ADC1 being used by I2S dma and other tasks at the same time.
-static _lock_t adc1_i2s_lock = NULL;
+static _lock_t adc1_i2s_lock;
 
 typedef struct {
     TimerHandle_t timer;
@@ -118,50 +121,6 @@ static touch_pad_filter_t *s_touch_pad_filter = NULL;
 static uint16_t s_touch_pad_init_bit = 0x0000;
 static filter_cb_t s_filter_cb = NULL;
 
-//Reg,Mux,Fun,IE,Up,Down,Rtc_number
-const rtc_gpio_desc_t rtc_gpio_desc[GPIO_PIN_COUNT] = {
-    {RTC_IO_TOUCH_PAD1_REG, RTC_IO_TOUCH_PAD1_MUX_SEL_M, RTC_IO_TOUCH_PAD1_FUN_SEL_S, RTC_IO_TOUCH_PAD1_FUN_IE_M, RTC_IO_TOUCH_PAD1_RUE_M, RTC_IO_TOUCH_PAD1_RDE_M, RTC_IO_TOUCH_PAD1_SLP_SEL_M, RTC_IO_TOUCH_PAD1_SLP_IE_M, RTC_IO_TOUCH_PAD1_HOLD_M, RTC_CNTL_TOUCH_PAD1_HOLD_FORCE_M, RTC_IO_TOUCH_PAD1_DRV_V, RTC_IO_TOUCH_PAD1_DRV_S, RTCIO_GPIO0_CHANNEL}, //0
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //1
-    {RTC_IO_TOUCH_PAD2_REG, RTC_IO_TOUCH_PAD2_MUX_SEL_M, RTC_IO_TOUCH_PAD2_FUN_SEL_S, RTC_IO_TOUCH_PAD2_FUN_IE_M, RTC_IO_TOUCH_PAD2_RUE_M, RTC_IO_TOUCH_PAD2_RDE_M, RTC_IO_TOUCH_PAD2_SLP_SEL_M, RTC_IO_TOUCH_PAD2_SLP_IE_M, RTC_IO_TOUCH_PAD2_HOLD_M, RTC_CNTL_TOUCH_PAD2_HOLD_FORCE_M, RTC_IO_TOUCH_PAD2_DRV_V, RTC_IO_TOUCH_PAD2_DRV_S, RTCIO_GPIO2_CHANNEL}, //2
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //3
-    {RTC_IO_TOUCH_PAD0_REG, RTC_IO_TOUCH_PAD0_MUX_SEL_M, RTC_IO_TOUCH_PAD0_FUN_SEL_S, RTC_IO_TOUCH_PAD0_FUN_IE_M, RTC_IO_TOUCH_PAD0_RUE_M, RTC_IO_TOUCH_PAD0_RDE_M, RTC_IO_TOUCH_PAD0_SLP_SEL_M, RTC_IO_TOUCH_PAD0_SLP_IE_M, RTC_IO_TOUCH_PAD0_HOLD_M,  RTC_CNTL_TOUCH_PAD0_HOLD_FORCE_M, RTC_IO_TOUCH_PAD0_DRV_V, RTC_IO_TOUCH_PAD0_DRV_S, RTCIO_GPIO4_CHANNEL}, //4
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //5
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //6
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //7
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //8
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //9
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //10
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //11
-    {RTC_IO_TOUCH_PAD5_REG, RTC_IO_TOUCH_PAD5_MUX_SEL_M, RTC_IO_TOUCH_PAD5_FUN_SEL_S, RTC_IO_TOUCH_PAD5_FUN_IE_M, RTC_IO_TOUCH_PAD5_RUE_M, RTC_IO_TOUCH_PAD5_RDE_M, RTC_IO_TOUCH_PAD5_SLP_SEL_M, RTC_IO_TOUCH_PAD5_SLP_IE_M, RTC_IO_TOUCH_PAD5_HOLD_M, RTC_CNTL_TOUCH_PAD5_HOLD_FORCE_M, RTC_IO_TOUCH_PAD5_DRV_V, RTC_IO_TOUCH_PAD5_DRV_S, RTCIO_GPIO12_CHANNEL}, //12
-    {RTC_IO_TOUCH_PAD4_REG, RTC_IO_TOUCH_PAD4_MUX_SEL_M, RTC_IO_TOUCH_PAD4_FUN_SEL_S, RTC_IO_TOUCH_PAD4_FUN_IE_M, RTC_IO_TOUCH_PAD4_RUE_M, RTC_IO_TOUCH_PAD4_RDE_M, RTC_IO_TOUCH_PAD4_SLP_SEL_M, RTC_IO_TOUCH_PAD4_SLP_IE_M, RTC_IO_TOUCH_PAD4_HOLD_M, RTC_CNTL_TOUCH_PAD4_HOLD_FORCE_M, RTC_IO_TOUCH_PAD4_DRV_V, RTC_IO_TOUCH_PAD4_DRV_S, RTCIO_GPIO13_CHANNEL}, //13
-    {RTC_IO_TOUCH_PAD6_REG, RTC_IO_TOUCH_PAD6_MUX_SEL_M, RTC_IO_TOUCH_PAD6_FUN_SEL_S, RTC_IO_TOUCH_PAD6_FUN_IE_M, RTC_IO_TOUCH_PAD6_RUE_M, RTC_IO_TOUCH_PAD6_RDE_M, RTC_IO_TOUCH_PAD6_SLP_SEL_M, RTC_IO_TOUCH_PAD6_SLP_IE_M, RTC_IO_TOUCH_PAD6_HOLD_M, RTC_CNTL_TOUCH_PAD6_HOLD_FORCE_M, RTC_IO_TOUCH_PAD6_DRV_V, RTC_IO_TOUCH_PAD6_DRV_S, RTCIO_GPIO14_CHANNEL}, //14
-    {RTC_IO_TOUCH_PAD3_REG, RTC_IO_TOUCH_PAD3_MUX_SEL_M, RTC_IO_TOUCH_PAD3_FUN_SEL_S, RTC_IO_TOUCH_PAD3_FUN_IE_M, RTC_IO_TOUCH_PAD3_RUE_M, RTC_IO_TOUCH_PAD3_RDE_M, RTC_IO_TOUCH_PAD3_SLP_SEL_M, RTC_IO_TOUCH_PAD3_SLP_IE_M, RTC_IO_TOUCH_PAD3_HOLD_M, RTC_CNTL_TOUCH_PAD3_HOLD_FORCE_M, RTC_IO_TOUCH_PAD3_DRV_V, RTC_IO_TOUCH_PAD3_DRV_S, RTCIO_GPIO15_CHANNEL}, //15
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //16
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //17
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //18
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //19
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //20
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //21
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //22
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //23
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //24
-    {RTC_IO_PAD_DAC1_REG, RTC_IO_PDAC1_MUX_SEL_M, RTC_IO_PDAC1_FUN_SEL_S, RTC_IO_PDAC1_FUN_IE_M, RTC_IO_PDAC1_RUE_M, RTC_IO_PDAC1_RDE_M, RTC_IO_PDAC1_SLP_SEL_M, RTC_IO_PDAC1_SLP_IE_M, RTC_IO_PDAC1_HOLD_M, RTC_CNTL_PDAC1_HOLD_FORCE_M, RTC_IO_PDAC1_DRV_V, RTC_IO_PDAC1_DRV_S, RTCIO_GPIO25_CHANNEL},                           //25
-    {RTC_IO_PAD_DAC2_REG, RTC_IO_PDAC2_MUX_SEL_M, RTC_IO_PDAC2_FUN_SEL_S, RTC_IO_PDAC2_FUN_IE_M, RTC_IO_PDAC2_RUE_M, RTC_IO_PDAC2_RDE_M, RTC_IO_PDAC2_SLP_SEL_M, RTC_IO_PDAC2_SLP_IE_M, RTC_IO_PDAC2_HOLD_M, RTC_CNTL_PDAC2_HOLD_FORCE_M, RTC_IO_PDAC2_DRV_V, RTC_IO_PDAC2_DRV_S, RTCIO_GPIO26_CHANNEL},                           //26
-    {RTC_IO_TOUCH_PAD7_REG, RTC_IO_TOUCH_PAD7_MUX_SEL_M, RTC_IO_TOUCH_PAD7_FUN_SEL_S, RTC_IO_TOUCH_PAD7_FUN_IE_M, RTC_IO_TOUCH_PAD7_RUE_M, RTC_IO_TOUCH_PAD7_RDE_M, RTC_IO_TOUCH_PAD7_SLP_SEL_M, RTC_IO_TOUCH_PAD7_SLP_IE_M, RTC_IO_TOUCH_PAD7_HOLD_M, RTC_CNTL_TOUCH_PAD7_HOLD_FORCE_M, RTC_IO_TOUCH_PAD7_DRV_V, RTC_IO_TOUCH_PAD7_DRV_S, RTCIO_GPIO27_CHANNEL}, //27
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //28
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //29
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //30
-    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1},                                                                                                                                            //31
-    {RTC_IO_XTAL_32K_PAD_REG, RTC_IO_X32P_MUX_SEL_M, RTC_IO_X32P_FUN_SEL_S, RTC_IO_X32P_FUN_IE_M, RTC_IO_X32P_RUE_M, RTC_IO_X32P_RDE_M, RTC_IO_X32P_SLP_SEL_M, RTC_IO_X32P_SLP_IE_M, RTC_IO_X32P_HOLD_M, RTC_CNTL_X32P_HOLD_FORCE_M, RTC_IO_X32P_DRV_V, RTC_IO_X32P_DRV_S, RTCIO_GPIO32_CHANNEL},                            //32
-    {RTC_IO_XTAL_32K_PAD_REG, RTC_IO_X32N_MUX_SEL_M, RTC_IO_X32N_FUN_SEL_S, RTC_IO_X32N_FUN_IE_M, RTC_IO_X32N_RUE_M, RTC_IO_X32N_RDE_M, RTC_IO_X32N_SLP_SEL_M, RTC_IO_X32N_SLP_IE_M, RTC_IO_X32N_HOLD_M, RTC_CNTL_X32N_HOLD_FORCE_M, RTC_IO_X32N_DRV_V, RTC_IO_X32N_DRV_S, RTCIO_GPIO33_CHANNEL},                            //33
-    {RTC_IO_ADC_PAD_REG, RTC_IO_ADC1_MUX_SEL_M, RTC_IO_ADC1_FUN_SEL_S, RTC_IO_ADC1_FUN_IE_M, 0, 0, RTC_IO_ADC1_SLP_SEL_M, RTC_IO_ADC1_SLP_IE_M, RTC_IO_ADC1_HOLD_M, RTC_CNTL_ADC1_HOLD_FORCE_M, 0, 0, RTCIO_GPIO34_CHANNEL},                                                                //34
-    {RTC_IO_ADC_PAD_REG, RTC_IO_ADC2_MUX_SEL_M, RTC_IO_ADC2_FUN_SEL_S, RTC_IO_ADC2_FUN_IE_M, 0, 0, RTC_IO_ADC2_SLP_SEL_M, RTC_IO_ADC2_SLP_IE_M, RTC_IO_ADC1_HOLD_M, RTC_CNTL_ADC2_HOLD_FORCE_M, 0, 0, RTCIO_GPIO35_CHANNEL},                                                                //35
-    {RTC_IO_SENSOR_PADS_REG, RTC_IO_SENSE1_MUX_SEL_M, RTC_IO_SENSE1_FUN_SEL_S, RTC_IO_SENSE1_FUN_IE_M, 0, 0, RTC_IO_SENSE1_SLP_SEL_M, RTC_IO_SENSE1_SLP_IE_M, RTC_IO_SENSE1_HOLD_M, RTC_CNTL_SENSE1_HOLD_FORCE_M, 0, 0, RTCIO_GPIO36_CHANNEL},                                                      //36
-    {RTC_IO_SENSOR_PADS_REG, RTC_IO_SENSE2_MUX_SEL_M, RTC_IO_SENSE2_FUN_SEL_S, RTC_IO_SENSE2_FUN_IE_M, 0, 0, RTC_IO_SENSE2_SLP_SEL_M, RTC_IO_SENSE2_SLP_IE_M, RTC_IO_SENSE1_HOLD_M, RTC_CNTL_SENSE2_HOLD_FORCE_M, 0, 0, RTCIO_GPIO37_CHANNEL},                                                      //37
-    {RTC_IO_SENSOR_PADS_REG, RTC_IO_SENSE3_MUX_SEL_M, RTC_IO_SENSE3_FUN_SEL_S, RTC_IO_SENSE3_FUN_IE_M, 0, 0, RTC_IO_SENSE3_SLP_SEL_M, RTC_IO_SENSE3_SLP_IE_M, RTC_IO_SENSE1_HOLD_M, RTC_CNTL_SENSE3_HOLD_FORCE_M, 0, 0, RTCIO_GPIO38_CHANNEL},                                                       //38
-    {RTC_IO_SENSOR_PADS_REG, RTC_IO_SENSE4_MUX_SEL_M, RTC_IO_SENSE4_FUN_SEL_S, RTC_IO_SENSE4_FUN_IE_M, 0, 0, RTC_IO_SENSE4_SLP_SEL_M, RTC_IO_SENSE4_SLP_IE_M, RTC_IO_SENSE1_HOLD_M, RTC_CNTL_SENSE4_HOLD_FORCE_M, 0, 0, RTCIO_GPIO39_CHANNEL},                                                      //39
-};
-
 typedef enum {
     ADC_CTRL_RTC = 0,
     ADC_CTRL_ULP = 1,
@@ -520,7 +479,7 @@ static void touch_pad_filter_cb(void *arg)
 {
     static uint32_t s_filtered_temp[TOUCH_PAD_MAX] = {0};
 
-    if (s_touch_pad_filter == NULL) {
+    if (s_touch_pad_filter == NULL || rtc_touch_mux == NULL) {
         return;
     }
     uint16_t val = 0;
@@ -869,15 +828,15 @@ esp_err_t touch_pad_init()
 
 esp_err_t touch_pad_deinit()
 {
-    if (rtc_touch_mux == NULL) {
-        return ESP_FAIL;
+    RTC_MODULE_CHECK(rtc_touch_mux != NULL, "Touch pad not initialized", ESP_FAIL);
+    if (s_touch_pad_filter != NULL) {
+        touch_pad_filter_stop();
+        touch_pad_filter_delete();
     }
     s_touch_pad_init_bit = 0x0000;
-    touch_pad_filter_delete();
     touch_pad_set_fsm_mode(TOUCH_FSM_MODE_SW);
     touch_pad_clear_status();
     touch_pad_intr_disable();
-    vSemaphoreDelete(rtc_touch_mux);
     rtc_touch_mux = NULL;
     return ESP_OK;
 }
@@ -1016,7 +975,7 @@ esp_err_t touch_pad_filter_start(uint32_t filter_period_ms)
 esp_err_t touch_pad_filter_stop()
 {
     RTC_MODULE_CHECK(s_touch_pad_filter != NULL, "Touch pad filter not initialized", ESP_ERR_INVALID_STATE);
-
+    RTC_MODULE_CHECK(rtc_touch_mux != NULL, "Touch pad not initialized", ESP_ERR_INVALID_STATE);
     esp_err_t ret = ESP_OK;
     xSemaphoreTake(rtc_touch_mux, portMAX_DELAY);
     if (s_touch_pad_filter != NULL) {
@@ -1032,6 +991,7 @@ esp_err_t touch_pad_filter_stop()
 esp_err_t touch_pad_filter_delete()
 {
     RTC_MODULE_CHECK(s_touch_pad_filter != NULL, "Touch pad filter not initialized", ESP_ERR_INVALID_STATE);
+    RTC_MODULE_CHECK(rtc_touch_mux != NULL, "Touch pad not initialized", ESP_ERR_INVALID_STATE);
     xSemaphoreTake(rtc_touch_mux, portMAX_DELAY);
     if (s_touch_pad_filter != NULL) {
         if (s_touch_pad_filter->timer != NULL) {
@@ -1046,6 +1006,16 @@ esp_err_t touch_pad_filter_delete()
     return ESP_OK;
 }
 
+esp_err_t touch_pad_get_wakeup_status(touch_pad_t *pad_num)
+{
+    uint32_t touch_mask = SENS.sar_touch_ctrl2.touch_meas_en;
+    if(touch_mask == 0) {
+        return ESP_FAIL;
+    }
+    *pad_num = touch_pad_num_wrap((touch_pad_t)(__builtin_ffs(touch_mask) - 1));
+    return ESP_OK;
+}
+
 /*---------------------------------------------------------------
                     ADC Common
 ---------------------------------------------------------------*/

components/driver/sdio_slave.c

@@ -120,12 +120,12 @@ typedef enum {
 } send_state_t;
 
 typedef struct {
-    uint32_t clk;
-    uint32_t cmd;
-    uint32_t d0;
-    uint32_t d1;
-    uint32_t d2;
-    uint32_t d3;
+    uint32_t clk_gpio;
+    uint32_t cmd_gpio;
+    uint32_t d0_gpio;
+    uint32_t d1_gpio;
+    uint32_t d2_gpio;
+    uint32_t d3_gpio;
     int      func;
 } sdio_slave_slot_info_t ;
 
@@ -136,20 +136,20 @@ typedef struct {
 // currently slot 0 is occupied by SPI for flash
 static const sdio_slave_slot_info_t s_slot_info[2]  = {
     {
-        .clk = PERIPHS_IO_MUX_SD_CLK_U,
-        .cmd = PERIPHS_IO_MUX_SD_CMD_U,
-        .d0 = PERIPHS_IO_MUX_SD_DATA0_U,
-        .d1 = PERIPHS_IO_MUX_SD_DATA1_U,
-        .d2 = PERIPHS_IO_MUX_SD_DATA2_U,
-        .d3 = PERIPHS_IO_MUX_SD_DATA3_U,
+        .clk_gpio = 6,
+        .cmd_gpio = 11,
+        .d0_gpio = 7,
+        .d1_gpio = 8,
+        .d2_gpio = 9,
+        .d3_gpio = 10,
         .func = 0,
     }, {
-        .clk = PERIPHS_IO_MUX_MTMS_U,
-        .cmd = PERIPHS_IO_MUX_MTDO_U,
-        .d0 = PERIPHS_IO_MUX_GPIO2_U,
-        .d1 = PERIPHS_IO_MUX_GPIO4_U,
-        .d2 = PERIPHS_IO_MUX_MTDI_U,
-        .d3 = PERIPHS_IO_MUX_MTCK_U,
+        .clk_gpio = 14,
+        .cmd_gpio = 15,
+        .d0_gpio = 2,
+        .d1_gpio = 4,
+        .d2_gpio = 12,
+        .d3_gpio = 13,
         .func = 4,
     },
 };
@@ -193,7 +193,7 @@ typedef struct {
     SemaphoreHandle_t remain_cnt;
 } sdio_ringbuf_t;
 
-#define offset_of(type, field) ( (unsigned int)&(((type *)(0))->field) )  
+#define offset_of(type, field) ( (unsigned int)&(((type *)(0))->field) )
 typedef enum {
     ringbuf_write_ptr = offset_of(sdio_ringbuf_t, write_ptr),
     ringbuf_read_ptr = offset_of(sdio_ringbuf_t, read_ptr),
@@ -225,7 +225,7 @@ typedef struct {
     /*------- receiving ---------------*/
     buf_stailq_t    recv_link_list; // now ready to/already hold data
     buf_tailq_t     recv_reg_list;  // removed from the link list, registered but not used now
-    buf_desc_t*     recv_cur_ret;
+    volatile buf_desc_t*     recv_cur_ret;   // next desc to return, NULL if all loaded descriptors are returned
     portMUX_TYPE    recv_spinlock;
 } sdio_context_t;
 
@@ -304,7 +304,7 @@ no_mem:
 }
 
 //calculate a pointer with offset to a original pointer of the specific ringbuffer
-static inline uint8_t* sdio_ringbuf_offset_ptr( sdio_ringbuf_t *buf, sdio_ringbuf_pointer_t ptr, uint32_t offset ) 
+static inline uint8_t* sdio_ringbuf_offset_ptr( sdio_ringbuf_t *buf, sdio_ringbuf_pointer_t ptr, uint32_t offset )
 {
     uint8_t *buf_ptr = (uint8_t*)*(uint32_t*)(((uint8_t*)buf)+ptr);   //get the specific pointer of the buffer
     uint8_t *offset_ptr=buf_ptr+offset;
@@ -315,7 +315,7 @@ static inline uint8_t* sdio_ringbuf_offset_ptr( sdio_ringbuf_t *buf, sdio_ringbu
 static esp_err_t sdio_ringbuf_send( sdio_ringbuf_t* buf, esp_err_t (*copy_callback)(uint8_t*, void*), void* arg, TickType_t wait )
 {
     portBASE_TYPE ret = xSemaphoreTake(buf->remain_cnt, wait);
-    if ( ret != pdTRUE ) return NULL;
+    if (ret != pdTRUE) return ESP_ERR_TIMEOUT;
 
     portENTER_CRITICAL( &buf->write_spinlock );
     uint8_t* get_ptr = sdio_ringbuf_offset_ptr( buf, ringbuf_write_ptr, buf->item_size );
@@ -499,13 +499,18 @@ no_mem:
     return ESP_ERR_NO_MEM;
 }
 
-static inline void configure_pin(uint32_t io_mux_reg, uint32_t func)
+static void configure_pin(int pin, uint32_t func, bool pullup)
 {
     const int sdmmc_func = func;
     const int drive_strength = 3;
-    PIN_INPUT_ENABLE(io_mux_reg);
-    PIN_FUNC_SELECT(io_mux_reg, sdmmc_func);
-    PIN_SET_DRV(io_mux_reg, drive_strength);
+    assert(pin!=-1);
+    uint32_t reg = GPIO_PIN_MUX_REG[pin];
+    assert(reg!=0);
+
+    PIN_INPUT_ENABLE(reg);
+    PIN_FUNC_SELECT(reg, sdmmc_func);
+    PIN_SET_DRV(reg, drive_strength);
+    gpio_pulldown_dis(pin);
 }
 
 static inline esp_err_t sdio_slave_hw_init(sdio_slave_config_t *config)
@@ -515,12 +520,13 @@ static inline esp_err_t sdio_slave_hw_init(sdio_slave_config_t *config)
 
     //initialize pin
     const sdio_slave_slot_info_t *slot = &s_slot_info[1];
-    configure_pin(slot->clk, slot->func);
-    configure_pin(slot->cmd, slot->func);
-    configure_pin(slot->d0, slot->func);
-    configure_pin(slot->d1, slot->func);
-    configure_pin(slot->d2, slot->func);
-    configure_pin(slot->d3, slot->func);
+    configure_pin(slot->clk_gpio, slot->func, false);   //clk doesn't need a pullup
+    configure_pin(slot->cmd_gpio, slot->func, false);
+    configure_pin(slot->d0_gpio, slot->func, false);
+    configure_pin(slot->d1_gpio, slot->func, false);
+    configure_pin(slot->d2_gpio, slot->func, false);
+    configure_pin(slot->d3_gpio, slot->func, false);
+
     //enable module and config
     periph_module_reset(PERIPH_SDIO_SLAVE_MODULE);
     periph_module_enable(PERIPH_SDIO_SLAVE_MODULE);
@@ -539,28 +545,28 @@ static inline esp_err_t sdio_slave_hw_init(sdio_slave_config_t *config)
 
     switch( config->timing ) {
         case SDIO_SLAVE_TIMING_PSEND_PSAMPLE:
-            HOST.conf.frc_sdio20 = 0xf;
+            HOST.conf.frc_sdio20 = 0x1f;
             HOST.conf.frc_sdio11 = 0;
-            HOST.conf.frc_pos_samp = 0xf;
+            HOST.conf.frc_pos_samp = 0x1f;
             HOST.conf.frc_neg_samp = 0;
             break;
         case SDIO_SLAVE_TIMING_PSEND_NSAMPLE:
-            HOST.conf.frc_sdio20 = 0xf;
+            HOST.conf.frc_sdio20 = 0x1f;
             HOST.conf.frc_sdio11 = 0;
             HOST.conf.frc_pos_samp = 0;
-            HOST.conf.frc_neg_samp = 0xf;
+            HOST.conf.frc_neg_samp = 0x1f;
             break;
         case SDIO_SLAVE_TIMING_NSEND_PSAMPLE:
             HOST.conf.frc_sdio20 = 0;
-            HOST.conf.frc_sdio11 = 0xf;
-            HOST.conf.frc_pos_samp = 0xf;
+            HOST.conf.frc_sdio11 = 0x1f;
+            HOST.conf.frc_pos_samp = 0x1f;
             HOST.conf.frc_neg_samp = 0;
             break;
         case SDIO_SLAVE_TIMING_NSEND_NSAMPLE:
             HOST.conf.frc_sdio20 = 0;
-            HOST.conf.frc_sdio11 = 0xf;
+            HOST.conf.frc_sdio11 = 0x1f;
             HOST.conf.frc_pos_samp = 0;
-            HOST.conf.frc_neg_samp = 0xf;
+            HOST.conf.frc_neg_samp = 0x1f;
             break;
     }
 
@@ -952,9 +958,11 @@ esp_err_t sdio_slave_send_queue(uint8_t* addr, size_t len, void* arg, TickType_t
     return ESP_OK;
 }
 
-esp_err_t sdio_slave_send_get_finished(void** arg, TickType_t wait)
+esp_err_t sdio_slave_send_get_finished(void** out_arg, TickType_t wait)
 {
-    portBASE_TYPE err = xQueueReceive( context.ret_queue, arg, wait );
+    void* arg = NULL;
+    portBASE_TYPE err = xQueueReceive(context.ret_queue, &arg, wait);
+    if (out_arg) *out_arg = arg;
     if ( err != pdTRUE ) return ESP_ERR_TIMEOUT;
     return ESP_OK;
 }
@@ -1160,8 +1168,6 @@ static void sdio_intr_recv(void* arg)
     portBASE_TYPE yield = 0;
     if ( SLC.slc0_int_raw.tx_done ) {
         SLC.slc0_int_clr.tx_done = 1;
-        assert( context.recv_cur_ret != NULL );
-
         while ( context.recv_cur_ret && context.recv_cur_ret->owner == 0 ) {
             // This may cause the ``cur_ret`` pointer to be NULL, indicating the list is empty,
             // in this case the ``tx_done`` should happen no longer until new desc is appended.
@@ -1186,15 +1192,24 @@ esp_err_t sdio_slave_recv_load_buf(sdio_slave_buf_handle_t handle)
     desc->owner = 1;
     desc->not_receiving = 0; //manually remove the prev link (by set not_receiving=0), to indicate this is in the queue
 
-    // 1. If all desc are returned in the ISR, the pointer is moved to NULL. The pointer is set to the newly appended desc here.
-    // 2. If the pointer is move to some not-returned desc (maybe the one appended here), do nothing.
-    // The ``cur_ret`` pointer must be checked and set after new desc appended to the list, or the pointer setting may fail.
+    buf_desc_t *const tail = STAILQ_LAST(queue, buf_desc_s, qe);
+
     STAILQ_INSERT_TAIL( queue, desc, qe );
-    if ( context.recv_cur_ret == NULL ) {
+    if (tail == NULL || (tail->owner == 0)) {
+        //in this case we have to set the ret pointer
+        if (tail != NULL) {
+            /* if the owner of the tail is returned to the software, the ISR is
+             * expect to write this pointer to NULL in a short time, wait until
+             * that and set new value for this pointer
+             */
+            while (context.recv_cur_ret != NULL) {}
+        }
+        assert(context.recv_cur_ret == NULL);
         context.recv_cur_ret = desc;
     }
+    assert(context.recv_cur_ret != NULL);
 
-    if ( desc == STAILQ_FIRST(queue) ) {
+    if (tail == NULL) {
         //no one in the ll, start new ll operation.
         SLC.slc0_tx_link.addr = (uint32_t)desc;
         SLC.slc0_tx_link.start = 1;