Merge branch 'bugfix/fix_some_wifi_bugs_1121_v3.0' into 'release/v3.0'

esp32: fix some wifi bugs (backport v3.0)

See merge request idf/esp-idf!3760

.editorconfig

@@ -0,0 +1,34 @@
+# EditorConfig helps developers define and maintain consistent
+# coding styles between different editors and IDEs
+# http://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[{*.md,*.rst}]
+trim_trailing_whitespace = false
+
+[{Makefile,*.mk,*.bat}]
+indent_style = tab
+indent_size = 2
+
+[*/freertos/**]
+indent_style = tab
+indent_size = 4
+
+[{*/freertos/**.S,**/FreeRTOSConfig.h}]
+indent_style = space
+indent_size = 4
+
+[*.pem]
+insert_final_newline = false
+
+[*.py]
+max_line_length = 119

.gitlab-ci.yml

@@ -1,9 +1,9 @@
 stages:
   - build
   - assign_test
+  - host_test
   - unit_test
-  - test
-  - test_report
+  - integration_test
   - deploy
 
 variables:
@@ -34,6 +34,7 @@ variables:
   python $APPLY_BOT_FILTER_SCRIPT || exit 0
 
 before_script:
+  - source tools/ci/setup_python.sh
   # apply bot filter in before script
   - *apply_bot_filter
   # add gitlab ssh key
@@ -54,6 +55,7 @@ before_script:
 
 .do_nothing_before:
   before_script: &do_nothing_before
+    - source tools/ci/setup_python.sh
     # apply bot filter in before script
     - *apply_bot_filter
     - echo "Not setting up GitLab key, not fetching submodules"
@@ -61,6 +63,7 @@ before_script:
 
 .add_gitlab_key_before:
   before_script: &add_gitlab_key_before
+    - source tools/ci/setup_python.sh
     # apply bot filter in before script
     - *apply_bot_filter
     - echo "Not fetching submodules"
@@ -82,12 +85,15 @@ build_template_app:
     BATCH_BUILD: "1"
     IDF_CI_BUILD: "1"
   script:
-    - git clone https://github.com/espressif/esp-idf-template.git
+    # Set the variable for 'esp-idf-template' testing
+    - ESP_IDF_TEMPLATE_GIT=${ESP_IDF_TEMPLATE_GIT:-"https://github.com/espressif/esp-idf-template.git"}
+    - git clone ${ESP_IDF_TEMPLATE_GIT}
     - cd esp-idf-template
     # Try to use the same branch name for esp-idf-template that we're
     # using on esp-idf. If it doesn't exist then just stick to the default
     # branch
     - python $CHECKOUT_REF_SCRIPT esp-idf-template
+    - make defconfig
     # Test debug build (default)
     - make all V=1
     # Now test release build
@@ -109,17 +115,31 @@ build_template_app:
     BATCH_BUILD: "1"
     V: "0"
 
-build_ssc:
+.build_ssc_template: &build_ssc_template
   <<: *build_template
   artifacts:
     paths:
       - SSC/ssc_bin
-    expire_in: 6 mos
+    expire_in: 1 mos
+  variables:
+    SSC_CONFIG_FOLDER: "$CI_PROJECT_DIR/SSC/configs/ESP32_IDF"
   script:
     - git clone $SSC_REPOSITORY
     - cd SSC
     - python $CHECKOUT_REF_SCRIPT SSC
-    - MAKEFLAGS= ./gen_misc_ng.sh
+    - MAKEFLAGS= ./ci_build_ssc.sh "${CI_JOB_NAME}" "${IDF_PATH}/.gitlab-ci.yml"
+
+# don't forget to add to dependency to test_template when adding new build_ssc jobs
+build_ssc_00:
+  <<: *build_ssc_template
+
+build_ssc_01:
+  <<: *build_ssc_template
+
+build_ssc_02:
+  <<: *build_ssc_template
+
+# If you want to add new build ssc jobs, please add it into dependencies of `assign_test` and `.test_template`
 
 build_esp_idf_tests:
   <<: *build_template
@@ -128,7 +148,7 @@ build_esp_idf_tests:
       - tools/unit-test-app/output
       - components/idf_test/unit_test/TestCaseAll.yml
       - components/idf_test/unit_test/CIConfigs/*.yml
-    expire_in: 6 mos
+    expire_in: 1 mos
   script:
     - cd tools/unit-test-app
     - make help # make sure kconfig tools are built in single process
@@ -141,15 +161,18 @@ build_esp_idf_tests:
 .build_examples_template: &build_examples_template
   <<: *build_template
   artifacts:
+    when: always
     paths:
       - build_examples/*/*/*/build/*.bin
       - build_examples/*/*/*/build/*.elf
       - build_examples/*/*/*/build/*.map
       - build_examples/*/*/*/build/download.config
       - build_examples/*/*/*/build/bootloader/*.bin
+      - $LOG_PATH
     expire_in: 1 week
   variables:
     IDF_CI_BUILD: "1"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples"
   script:
     # it's not possible to build 100% out-of-tree and have the "artifacts"
     # mechanism work, but this is the next best thing
@@ -157,6 +180,7 @@ build_esp_idf_tests:
     - mkdir build_examples
     - cd build_examples
     # build some of examples
+    - mkdir -p ${LOG_PATH}
     - ${IDF_PATH}/tools/ci/build_examples.sh "${CI_JOB_NAME}"
 
 build_examples_00:
@@ -183,6 +207,7 @@ build_examples_06:
 build_examples_07:
   <<: *build_examples_template
 
+# If you want to add new build example jobs, please add it into dependencies of `.example_test_template`
 
 build_docs:
   stage: build
@@ -206,54 +231,44 @@ build_docs:
     - make html
     - ./check_doc_warnings.sh
 
-test_nvs_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
+.host_test_template: &host_test_template
+  stage: host_test
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
-    - nvs_host_test
+    - host_test
   dependencies: []
+    
+test_nvs_on_host:
+  <<: *host_test_template
   script:
     - cd components/nvs_flash/test_nvs_host
     - make test
 
 test_partition_table_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
+  <<: *host_test_template
   tags:
     - build
-  dependencies: []
   script:
     - cd components/partition_table/test_gen_esp32part_host
     - ./gen_esp32part_tests.py
 
 test_wl_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
-  tags:
-    - wl_host_test
+  <<: *host_test_template
   artifacts:
     paths:
       - components/wear_levelling/test_wl_host/coverage_report.zip
-  dependencies: []
   script:
     - cd components/wear_levelling/test_wl_host
     - make test
 
 test_multi_heap_on_host:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
-  tags:
-    - wl_host_test
+  <<: *host_test_template
   script:
     - cd components/heap/test_multi_heap_host
-    - make test
+    - ./test_all_configs.sh
 
 test_build_system:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
-  tags:
-    - build_test
-  dependencies: []
+  <<: *host_test_template
   script:
     - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
     - rm -rf test_build_system
@@ -261,61 +276,7 @@ test_build_system:
     - cd test_build_system
     - ${IDF_PATH}/tools/ci/test_build_system.sh
 
-test_report:
-  stage: test_report
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
-  tags:
-    - report
-  only:
-    - master
-    - triggers
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-  variables:
-    LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test"
-    REPORT_PATH: "$CI_PROJECT_DIR/CI_Test_Report"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/tools/unit-test-app/tools/ModuleDefinition.yml"
-  #dependencies:
-  #We need all UT* and IT* artifacts except for only a few other
-  artifacts:
-    when: always
-    paths:
-      - $REPORT_PATH
-      - $LOG_PATH
-    expire_in: 12 mos
-  script:
-    # calc log path
-    - VER_NUM=`git rev-list HEAD | wc -l | awk '{print $1}'`
-    - SHA_ID=`echo $CI_COMMIT_SHA | cut -c 1-7`
-    - REVISION="${VER_NUM}_${SHA_ID}"
-    # replace / to _ in branch name
-    - ESCAPED_BRANCH_NAME=`echo $CI_COMMIT_REF_NAME | sed 's/\//___/g'`
-    # result path and artifacts path
-    - RESULT_PATH="$CI_PROJECT_NAME/$ESCAPED_BRANCH_NAME/$REVISION"
-    - ARTIFACTS_PATH="$GITLAB_HTTP_SERVER/idf/esp-idf/builds/$CI_JOB_ID/artifacts/browse/$CI_COMMIT_SHA"
-    # clone test bench
-    - git clone $GITLAB_SSH_SERVER/yinling/auto_test_script.git
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
-    # generate report
-    - TEST_RESULT=Pass
-    - python CITestReport.py -l $LOG_PATH -t $TEST_CASE_FILE_PATH -p $REPORT_PATH -r $RESULT_PATH -a $ARTIFACTS_PATH -m $MODULE_UPDATE_FILE || TEST_RESULT=Fail
-    # commit to CI-test-result project
-    - git clone $GITLAB_SSH_SERVER/qa/CI-test-result.git
-    - rm -rf "CI-test-result/RawData/$RESULT_PATH"
-    - cp -R $CI_PROJECT_NAME CI-test-result/RawData
-    - cd CI-test-result
-    # config git user
-    - git config --global user.email "ci-test-result@espressif.com"
-    - git config --global user.name "ci-test-result"
-    # commit test result
-    - git add .
-    - git commit . -m "update test result for $CI_PROJECT_NAME/$CI_COMMIT_REF_NAME/$CI_COMMIT_SHA, pipeline ID $CI_PIPELINE_ID" || exit 0
-    - git push origin master
-    - test "${TEST_RESULT}" = "Pass" || exit 1
-
-push_master_to_github:
+push_to_github:
   stage: deploy
   image: $CI_DOCKER_REGISTRY/esp32-ci-env
   tags:
@@ -326,8 +287,6 @@ push_master_to_github:
     - /^v\d+\.\d+(\.\d+)?($|-)/
   when: on_success
   dependencies: []
-  variables:
-    GITHUB_PUSH_REFS: refs/remotes/origin/release refs/remotes/origin/master
   before_script: *do_nothing_before
   script:
     - mkdir -p ~/.ssh
@@ -338,16 +297,11 @@ push_master_to_github:
     - echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
     - git remote remove github &>/dev/null || true
     - git remote add github git@github.com:espressif/esp-idf.git
-    # What the next line of script does: goes through the list of refs for all branches we push to github,
-    # generates a snippet of shell which is evaluated. The snippet checks CI_COMMIT_SHA against the SHA
-    # (aka objectname) at tip of each branch, and if any SHAs match then it checks out the local branch
-    # and then pushes that ref to a corresponding github branch
-    - eval $(git for-each-ref --shell bash --format 'if [ $CI_COMMIT_SHA == %(objectname) ]; then git checkout -B %(refname:strip=3); git push --follow-tags github %(refname:strip=3); fi;' $GITHUB_PUSH_REFS)
-
+    - tools/ci/push_to_github.sh
 
 deploy_docs:
-  stage: deploy
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
+  stage: host_test
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - deploy
   only:
@@ -373,8 +327,8 @@ deploy_docs:
     - ssh $DOCS_SERVER -x "cd $DOCS_PATH && tar xzvf $GIT_VER.tar.gz && rm -f latest && ln -s $GIT_VER latest"
 
 check_doc_links:
-  stage: test
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env
+  stage: host_test
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - check_doc_links
   only:
@@ -438,7 +392,7 @@ assign_test:
     EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
   artifacts:
     paths:
-      - test_bins
+      - $OUTPUT_BIN_PATH
       - components/idf_test/*/CIConfigs
       - components/idf_test/*/TC.sqlite
       - $EXAMPLE_CONFIG_OUTPUT_PATH
@@ -459,24 +413,31 @@ assign_test:
     # assign unit test cases
     - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/unit_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/test_bins
     # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/test_bins
+    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
 
 .example_test_template: &example_test_template
-  stage: test
+  stage: integration_test
   when: on_success
   only:
     - master
     - /^release\/v/
     - /^v\d+\.\d+(\.\d+)?($|-)/
     - triggers
-  # gitlab ci do not support match job with RegEx or wildcard now in dependencies.
-  # we have a lot build example jobs and the binaries them exceed the limitation of artifacts.
-  # we can't artifact them in one job. For example test jobs, download all artifacts from previous stages.
+  dependencies:
+    - assign_test
+    - build_examples_00
+    - build_examples_01
+    - build_examples_02
+    - build_examples_03
+    - build_examples_04
+    - build_examples_05
+    - build_examples_06
+    - build_examples_07
   artifacts:
     when: always
     paths:
       - $LOG_PATH
-    expire_in: 6 mos
+    expire_in: 1 mos
   variables:
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
@@ -490,21 +451,23 @@ assign_test:
     - python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE
 
 .test_template: &test_template
-  stage: test
+  stage: integration_test
   when: on_success
   only:
     - master
     - /^release\/v/
     - /^v\d+\.\d+(\.\d+)?($|-)/
     - triggers
-  allow_failure: true
   dependencies:
     - assign_test
+    - build_ssc_00
+    - build_ssc_01
+    - build_ssc_02
   artifacts:
     when: always
     paths:
       - $LOG_PATH
-    expire_in: 6 mos
+    expire_in: 1 mos
   variables:
     LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
     LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
@@ -545,7 +508,7 @@ nvs_compatible_test:
     paths:
       - $LOG_PATH
       - nvs_wifi.bin
-    expire_in: 6 mos
+    expire_in: 1 mos
   tags:
     - ESP32_IDF
     - NVS_Compatible
@@ -751,6 +714,13 @@ UT_003_08:
     - UT_T1_1
     - UT_single_core
 
+UT_003_09:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - UT_single_core
+
 UT_004_01:
   <<: *unit_test_template
   tags:

.gitmodules

@@ -33,3 +33,7 @@
 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
 	url = https://github.com/pellepl/spiffs.git
+
+[submodule "components/json/cJSON"]
+	path = components/json/cJSON
+	url = https://github.com/DaveGamble/cJSON.git

README.md

@@ -4,22 +4,27 @@
 
 ESP-IDF is the official development framework for the [ESP32](https://espressif.com/en/products/hardware/esp32/overview) chip.
 
-# Developing With the ESP-IDF
+# Developing With ESP-IDF
 
 ## Setting Up ESP-IDF
 
 See setup guides for detailed instructions to set up the ESP-IDF:
 
-* [Windows Setup Guide](https://esp-idf.readthedocs.io/en/latest/get-started/windows-setup.html)
-* [Mac OS Setup Guide](https://esp-idf.readthedocs.io/en/latest/get-started/macos-setup.html)
-* [Linux Setup Guide](https://esp-idf.readthedocs.io/en/latest/get-started/linux-setup.html)
+* [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
+* [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
 
 ## Finding a Project
 
-As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in the setup guide, ESP-IDF comes with some example projects in the [examples](examples) directory.
+As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in Getting Started, ESP-IDF comes with some example projects in the [examples](examples) directory.
 
 Once you've found the project you want to work with, change to its directory and you can configure and build it.
 
+To start your own project based on an example, copy the example project directory outside of the ESP-IDF directory.
+
+# Quick Reference
+
+See the Getting Started guide links above for a detailed setup guide. This is a quick reference for common commands when working with ESP-IDF projects:
+
 ## Configuring the Project
 
 `make menuconfig`
@@ -36,15 +41,17 @@ Once done configuring, press Escape multiple times to exit and say "Yes" to save
 
 ## Compiling the Project
 
-`make all`
+`make -j4 all`
 
 ... will compile app, bootloader and generate a partition table based on the config.
 
+NOTE: The `-j4` option causes `make` to run 4 parallel jobs. This is much faster than the default single job. The recommended number to pass to this option is `-j(number of CPUs + 1)`.
+
 ## Flashing the Project
 
 When `make all` finishes, it will print a command line to use esptool.py to flash the chip. However you can also do this from make by running:
 
-`make flash`
+`make -j4 flash`
 
 This will flash the entire project (app, bootloader and partition table) to a new chip. The settings for serial port flashing can be configured with `make menuconfig`.
 
@@ -56,24 +63,24 @@ The `make monitor` target uses the [idf_monitor tool](https://esp-idf.readthedoc
 
 Exit the monitor by typing Ctrl-].
 
-To flash and monitor output in one pass, you can run:
+To build, flash and monitor output in one pass, you can run:
 
-`make flash monitor`
+`make -j4 flash monitor`
 
-## Compiling & Flashing Just the App
+## Compiling & Flashing Only the App
 
 After the initial flash, you may just want to build and flash just your app, not the bootloader and partition table:
 
 * `make app` - build just the app.
 * `make app-flash` - flash just the app.
 
-`make app-flash` will automatically rebuild the app if it needs it.
+`make app-flash` will automatically rebuild the app if any source files have changed.
 
 (In normal development there's no downside to reflashing the bootloader and partition table each time, if they haven't changed.)
 
 ## Parallel Builds
 
-ESP-IDF supports compiling multiple files in parallel, so all of the above commands can be run as `make -jN` where `N` is the number of parallel make processes to run (generally N should be equal to or one more than the number of CPU cores in your system.)
+ESP-IDF supports compiling multiple files in parallel, so all of the above commands can be run as `make -jN` where `N` is the number of parallel make processes to run (generally N should be equal to the number of CPU cores in your system, plus one.)
 
 Multiple make functions can be combined into one. For example: to build the app & bootloader using 5 jobs in parallel, then flash everything, and then display serial output from the ESP32 run:
 

components/app_trace/Kconfig

@@ -64,33 +64,37 @@ config SYSVIEW_ENABLE
         Enables supporrt for SEGGER SystemView tracing functionality.
 
 choice SYSVIEW_TS_SOURCE
-    prompt "ESP32 timer to use as SystemView timestamp source"
+    prompt "Timer to use as timestamp source"
     depends on SYSVIEW_ENABLE
-    default SYSVIEW_TS_SOURCE_TIMER_00
+    default SYSVIEW_TS_SOURCE_CCOUNT if FREERTOS_UNICORE && !PM_ENABLE
+    default SYSVIEW_TS_SOURCE_TIMER_00 if !FREERTOS_UNICORE && !PM_ENABLE
+    default SYSVIEW_TS_SOURCE_ESP_TIMER if PM_ENABLE
     help
         SystemView needs to use a hardware timer as the source of timestamps
-        when tracing 
-        This option selects HW timer for it.
+        when tracing. This option selects the timer for it.
+
+config SYSVIEW_TS_SOURCE_CCOUNT
+	bool "CPU cycle counter (CCOUNT)"
+	depends on FREERTOS_UNICORE && !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_00
     bool "Timer 0, Group 0"
-    help
-        Select this to use timer 0 of group 0
+    depends on !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_01
     bool "Timer 1, Group 0"
-    help
-        Select this to use timer 1 of group 0
+    depends on !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_10
     bool "Timer 0, Group 1"
-    help
-        Select this to use timer 0 of group 1
+    depends on !PM_ENABLE
 
 config SYSVIEW_TS_SOURCE_TIMER_11
     bool "Timer 1, Group 1"
-    help
-        Select this to use timer 1 of group 1
+    depends on !PM_ENABLE
+
+config SYSVIEW_TS_SOURCE_ESP_TIMER
+	bool "esp_timer high resolution timer"
 
 endchoice
 

components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c

@@ -64,9 +64,6 @@ Revision: $Rev: 3734 $
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
 #include "rom/ets_sys.h"
-#if CONFIG_FREERTOS_UNICORE == 0
-#include "driver/timer.h"
-#endif
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
 #include "esp_intr_alloc.h"
@@ -86,10 +83,49 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // The target device name
 #define SYSVIEW_DEVICE_NAME     "ESP32"
 
+// Determine which timer to use as timestamp source
+#if CONFIG_SYSVIEW_TS_SOURCE_CCOUNT
+#define TS_USE_CCOUNT 1
+#elif CONFIG_SYSVIEW_TS_SOURCE_ESP_TIMER
+#define TS_USE_ESP_TIMER 1
+#else
+#define TS_USE_TIMERGROUP 1
+#endif
+
+#if TS_USE_TIMERGROUP
+#include "driver/timer.h"
+
 // Timer group timer divisor
 #define SYSVIEW_TIMER_DIV       2
+
 // Frequency of the timestamp.
 #define SYSVIEW_TIMESTAMP_FREQ  (esp_clk_apb_freq() / SYSVIEW_TIMER_DIV)
+
+// Timer ID and group ID
+#if defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_00) || defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_01)
+#define TS_TIMER_ID 0
+#else
+#define TS_TIMER_ID 1
+#endif // TIMER_00 || TIMER_01
+
+#if defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_00) || defined(CONFIG_SYSVIEW_TS_SOURCE_TIMER_10)
+#define TS_TIMER_GROUP 0
+#else
+#define TS_TIMER_GROUP 1
+#endif // TIMER_00 || TIMER_10
+
+#endif // TS_USE_TIMERGROUP
+
+#if TS_USE_ESP_TIMER
+// esp_timer provides 1us resolution
+#define SYSVIEW_TIMESTAMP_FREQ  (1000000)
+#endif // TS_USE_ESP_TIMER
+
+#if TS_USE_CCOUNT
+// CCOUNT is incremented at CPU frequency
+#define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
+#endif // TS_USE_CCOUNT
+
 // System Frequency.
 #define SYSVIEW_CPU_FREQ        (esp_clk_cpu_freq())
 
@@ -103,11 +139,8 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
     #define SYSTICK_INTR_ID (ETS_INTERNAL_TIMER1_INTR_SOURCE+ETS_INTERNAL_INTR_SOURCE_OFF)
 #endif
 
-static timer_idx_t s_ts_timer_idx;
-static timer_group_t s_ts_timer_group;
-
 // SystemView is single core specific: it implies that SEGGER_SYSVIEW_LOCK()
-// disables IRQs (disables rescheduling globaly). So we can not use finite timeouts for locks and return error
+// disables IRQs (disables rescheduling globally). So we can not use finite timeouts for locks and return error
 // in case of expiration, because error will not be handled and SEGGER's code will go further implying that
 // everything is fine, so for multi-core env we have to wait on underlying lock forever
 #define SEGGER_LOCK_WAIT_TMO  ESP_APPTRACE_TMO_INFINITE
@@ -213,35 +246,24 @@ static void _cbSendSystemDesc(void) {
 */
 static void SEGGER_SYSVIEW_TS_Init()
 {
-    timer_config_t config;
-
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_00
-    s_ts_timer_group = TIMER_GROUP_0;
-    s_ts_timer_idx = TIMER_0;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_01
-    s_ts_timer_group = TIMER_GROUP_0;
-    s_ts_timer_idx = TIMER_1;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_10
-    s_ts_timer_group = TIMER_GROUP_1;
-    s_ts_timer_idx = TIMER_0;
-#endif
-#if CONFIG_SYSVIEW_TS_SOURCE_TIMER_11
-    s_ts_timer_group = TIMER_GROUP_1;
-    s_ts_timer_idx = TIMER_1;
-#endif
-    config.alarm_en = 0;
-    config.auto_reload = 0;
-    config.counter_dir = TIMER_COUNT_UP;
-    config.divider = SYSVIEW_TIMER_DIV;
-    config.counter_en = 0;
-    /*Configure timer*/
-    timer_init(s_ts_timer_group, s_ts_timer_idx, &config);
-    /*Load counter value */
-    timer_set_counter_value(s_ts_timer_group, s_ts_timer_idx, 0x00000000ULL);
-    /*Enable timer interrupt*/
-    timer_start(s_ts_timer_group, s_ts_timer_idx);
+    /* We only need to initialize something if we use Timer Group.
+     * esp_timer and ccount can be used as is.
+     */
+#if TS_USE_TIMERGROUP
+    timer_config_t config = {
+        .alarm_en = 0,
+        .auto_reload = 0,
+        .counter_dir = TIMER_COUNT_UP,
+        .divider = SYSVIEW_TIMER_DIV,
+        .counter_en = 0
+    };
+    /* Configure timer */
+    timer_init(TS_TIMER_GROUP, TS_TIMER_ID, &config);
+    /* Load counter value */
+    timer_set_counter_value(TS_TIMER_GROUP, TS_TIMER_ID, 0x00000000ULL);
+    /* Start counting */
+    timer_start(TS_TIMER_GROUP, TS_TIMER_ID);
+#endif // TS_USE_TIMERGROUP
 }
 
 void SEGGER_SYSVIEW_Conf(void) {
@@ -296,12 +318,14 @@ void SEGGER_SYSVIEW_Conf(void) {
 
 U32 SEGGER_SYSVIEW_X_GetTimestamp()
 {
-#if CONFIG_FREERTOS_UNICORE == 0
+#if TS_USE_TIMERGROUP
     uint64_t ts = 0;
-    timer_get_counter_value(s_ts_timer_group, s_ts_timer_idx, &ts);
-    return (U32)ts; // return lower part of counter value
-#else
+    timer_get_counter_value(TS_TIMER_GROUP, TS_TIMER_ID, &ts);
+    return (U32) ts; // return lower part of counter value
+#elif TS_USE_CCOUNT
     return portGET_RUN_TIME_COUNTER_VALUE();
+#elif TS_USE_ESP_TIMER
+    return (U32) esp_timer_get_time(); // return lower part of counter value
 #endif
 }
 

components/bootloader/Kconfig.projbuild

@@ -43,9 +43,9 @@ config BOOTLOADER_SPI_WP_PIN
 
         The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
 
-config BOOTLOADER_VDDSDIO_BOOST
-    bool "Increase VDDSDIO 1.8V LDO voltage to 1.9V"
-    default y
+choice BOOTLOADER_VDDSDIO_BOOST
+    bool "VDDSDIO LDO voltage"
+    default BOOTLOADER_VDDSDIO_BOOST_1_9V
     help
         If this option is enabled, and VDDSDIO LDO is set to 1.8V (using EFUSE
         or MTDI bootstrapping pin), bootloader will change LDO settings to
@@ -55,6 +55,13 @@ config BOOTLOADER_VDDSDIO_BOOST
         This option has no effect if VDDSDIO is set to 3.3V, or if the internal
         VDDSDIO regulator is disabled via efuse.
 
+config BOOTLOADER_VDDSDIO_BOOST_1_8V
+    bool "1.8V"
+    depends on !ESPTOOLPY_FLASHFREQ_80M
+config BOOTLOADER_VDDSDIO_BOOST_1_9V
+    bool "1.9V"
+endchoice
+
 endmenu  # Bootloader
 
 

components/bootloader/Makefile.projbuild

@@ -121,4 +121,6 @@ endif
 
 bootloader-clean: $(SDKCONFIG_MAKEFILE)
 	$(BOOTLOADER_MAKE) app-clean
+ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 	rm -f $(SECURE_BOOTLOADER_KEY) $(BOOTLOADER_DIGEST_BIN)
+endif

components/bootloader/subproject/main/bootloader_start.c

@@ -48,6 +48,7 @@
 #include "bootloader_flash.h"
 #include "bootloader_random.h"
 #include "bootloader_config.h"
+#include "bootloader_clock.h"
 
 #include "flash_qio_mode.h"
 
@@ -75,7 +76,6 @@ static void set_cache_and_start_app(uint32_t drom_addr,
 static void update_flash_config(const esp_image_header_t* pfhdr);
 static void vddsdio_configure();
 static void flash_gpio_configure();
-static void clock_configure(void);
 static void uart_console_configure(void);
 static void wdt_reset_check(void);
 
@@ -447,7 +447,7 @@ void bootloader_main()
 {
     vddsdio_configure();
     flash_gpio_configure();
-    clock_configure();
+    bootloader_clock_configure();
     uart_console_configure();
     wdt_reset_check();
     ESP_LOGI(TAG, "ESP-IDF %s 2nd stage bootloader", IDF_VER);
@@ -743,7 +743,7 @@ static void print_flash_info(const esp_image_header_t* phdr)
 
 static void vddsdio_configure()
 {
-#if CONFIG_BOOTLOADER_VDDSDIO_BOOST
+#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
     rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
     if (cfg.enable == 1 && cfg.tieh == 0) {    // VDDSDIO regulator is enabled @ 1.8V
         cfg.drefh = 3;
@@ -796,24 +796,20 @@ static void IRAM_ATTR flash_gpio_configure()
 
     if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
         // For ESP32D2WD the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32D2WD");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
     } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
         // For ESP32PICOD2 the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32PICOD2");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
     } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
         // For ESP32PICOD4 the SPI pins are already configured
-        ESP_LOGI(TAG, "Detected ESP32PICOD4");
-        //flash clock signal should come from IO MUX.
+        // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
     } else {
-        ESP_LOGI(TAG, "Detected ESP32");
         const uint32_t spiconfig = ets_efuse_get_spiconfig();
         if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
             gpio_matrix_out(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
@@ -839,46 +835,6 @@ static void IRAM_ATTR flash_gpio_configure()
     }
 }
 
-static void clock_configure(void)
-{
-    // ROM bootloader may have put a lot of text into UART0 FIFO.
-    // Wait for it to be printed.
-    // This is not needed on power on reset, when ROM bootloader is running at
-    // 40 MHz. But in case of TG WDT reset, CPU may still be running at >80 MHZ,
-    // and will be done with the bootloader much earlier than UART FIFO is empty.
-    uart_tx_wait_idle(0);
-
-    /* Set CPU to 80MHz. Keep other clocks unmodified. */
-    rtc_cpu_freq_t cpu_freq = RTC_CPU_FREQ_80M;
-
-    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
-     * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
-     * document). For rev. 0, switch to 240 instead if it was chosen in
-     * menuconfig.
-     */
-    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
-    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
-            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
-        cpu_freq = RTC_CPU_FREQ_240M;
-    }
-
-    rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
-    clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
-    clk_cfg.cpu_freq = cpu_freq;
-    clk_cfg.slow_freq = rtc_clk_slow_freq_get();
-    clk_cfg.fast_freq = rtc_clk_fast_freq_get();
-    rtc_clk_init(clk_cfg);
-    /* As a slight optimization, if 32k XTAL was enabled in sdkconfig, we enable
-     * it here. Usually it needs some time to start up, so we amortize at least
-     * part of the start up time by enabling 32k XTAL early.
-     * App startup code will wait until the oscillator has started up.
-     */
-#ifdef CONFIG_ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
-    if (!rtc_clk_32k_enabled()) {
-        rtc_clk_32k_bootstrap();
-    }
-#endif
-}
 
 static void uart_console_configure(void)
 {

components/bootloader/subproject/main/esp32.bootloader.ld

@@ -27,6 +27,7 @@ SECTIONS
   .iram1.text :
   {
     . = ALIGN (16);
+    _loader_text_start = ABSOLUTE(.);
     *(.entry.text)
     *(.init.literal)
     *(.init)
@@ -126,6 +127,7 @@ SECTIONS
     *(.fini)
     *(.gnu.version)
     _text_end = ABSOLUTE(.);
+    _loader_text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_seg
 

components/bootloader/subproject/main/flash_qio_mode.c

@@ -35,6 +35,7 @@
 #define CMD_WRDI       0x04
 #define CMD_RDSR       0x05
 #define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
 
 static const char *TAG = "qio_mode";
 
@@ -65,6 +66,11 @@ static void write_status_8b_wrsr2(unsigned new_status);
 /* Write 16 bit status using WRSR */
 static void write_status_16b_wrsr(unsigned new_status);
 
+/* Read 8 bit status of XM25QU64A  */
+static unsigned read_status_8b_xmc25qu64a();
+/* Write 8 bit status of XM25QU64A */
+static void write_status_8b_xmc25qu64a(unsigned new_status);
+
 #define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD has this GPIO wired to WP pin of flash */
 
 #ifndef CONFIG_BOOTLOADER_SPI_WP_PIN // Set in menuconfig if SPI flasher config is set to a quad mode
@@ -84,11 +90,12 @@ static void write_status_16b_wrsr(unsigned new_status);
    Searching of this table stops when the first match is found.
  */
 const static qio_info_t chip_data[] = {
-/*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,          QIE Bit */
-    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,  6 },
-    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,  6 }, /* IDs 0x40xx, 0x70xx */
-    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr, 9 },
-    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr, 9 },
+/*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,               QIE Bit */
+    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 },
+    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
+    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
+    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
+    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },
 
     /* Final entry is default entry, if no other IDs have matched.
 
@@ -96,7 +103,7 @@ const static qio_info_t chip_data[] = {
        GigaDevice (mfg ID 0xC8, flash IDs including 4016),
        FM25Q32 (QOUT mode only, mfg ID 0xA1, flash IDs including 4016)
     */
-    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2, 1 },
+    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2,      1 },
 };
 
 #define NUM_CHIPS (sizeof(chip_data) / sizeof(qio_info_t))
@@ -252,6 +259,24 @@ static void write_status_16b_wrsr(unsigned new_status)
     execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }
 
+static unsigned read_status_8b_xmc25qu64a()
+{
+    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    uint32_t read_status = execute_flash_command(CMD_RDSR, 0, 0, 8);
+    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+    return read_status;
+}
+
+static void write_status_8b_xmc25qu64a(unsigned new_status)
+{
+    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+}
+
 static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
 {
     SPIFLASH.user2.usr_command_value = command;

components/bootloader_support/include/bootloader_clock.h

@@ -0,0 +1,21 @@
+// Copyright 2017 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+/** @brief Configure clocks for early boot
+ *
+ * Called by bootloader, or by the app if the bootloader version is old (pre v2.1).
+ */
+void bootloader_clock_configure(void);

components/bootloader_support/include/bootloader_util.h

@@ -0,0 +1,34 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <stddef.h>
+
+/**
+ * @brief Check if half-open intervals overlap
+ *
+ * @param start1  interval 1 start
+ * @param end1    interval 1 end
+ * @param start2  interval 2 start
+ * @param end2    interval 2 end
+ * @return true iff [start1; end1) overlaps [start2; end2)
+ */
+static inline bool bootloader_util_regions_overlap(
+        const intptr_t start1, const intptr_t end1,
+        const intptr_t start2, const intptr_t end2)
+{
+    return (end1 > start2 && end2 > start1) ||
+           !(end1 <= start2 || end2 <= start1);
+}

components/bootloader_support/include/esp_image_format.h

@@ -81,6 +81,8 @@ typedef struct {
 
 _Static_assert(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");
 
+#define ESP_IMAGE_HASH_LEN 32 /* Length of the appended SHA-256 digest */
+
 /* Header of binary image segment */
 typedef struct {
     uint32_t load_addr;
@@ -142,6 +144,16 @@ esp_err_t esp_image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *
  */
 esp_err_t esp_image_verify_bootloader(uint32_t *length);
 
+/**
+ * @brief Verify the bootloader image.
+ *
+ * @param[out] Metadata for the image. Only valid if result is ESP_OK.
+ *
+ * @return As per esp_image_load_metadata().
+ */
+esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data);
+
+
 typedef struct {
     uint32_t drom_addr;
     uint32_t drom_load_addr;

components/bootloader_support/src/bootloader_clock.c

@@ -0,0 +1,61 @@
+// Copyright 2017 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "rom/uart.h"
+#include "rom/rtc.h"
+#include "soc/soc.h"
+#include "soc/rtc.h"
+#include "soc/dport_reg.h"
+#include "soc/efuse_reg.h"
+#include "soc/rtc_cntl_reg.h"
+
+void bootloader_clock_configure()
+{
+    // ROM bootloader may have put a lot of text into UART0 FIFO.
+    // Wait for it to be printed.
+    // This is not needed on power on reset, when ROM bootloader is running at
+    // 40 MHz. But in case of TG WDT reset, CPU may still be running at >80 MHZ,
+    // and will be done with the bootloader much earlier than UART FIFO is empty.
+    uart_tx_wait_idle(0);
+
+    /* Set CPU to 80MHz. Keep other clocks unmodified. */
+    rtc_cpu_freq_t cpu_freq = RTC_CPU_FREQ_80M;
+
+    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
+     * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
+     * document). For rev. 0, switch to 240 instead if it was chosen in
+     * menuconfig.
+     */
+    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
+    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
+            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
+        cpu_freq = RTC_CPU_FREQ_240M;
+    }
+
+    rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
+    clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
+    clk_cfg.cpu_freq = cpu_freq;
+    clk_cfg.slow_freq = rtc_clk_slow_freq_get();
+    clk_cfg.fast_freq = rtc_clk_fast_freq_get();
+    rtc_clk_init(clk_cfg);
+    /* As a slight optimization, if 32k XTAL was enabled in sdkconfig, we enable
+     * it here. Usually it needs some time to start up, so we amortize at least
+     * part of the start up time by enabling 32k XTAL early.
+     * App startup code will wait until the oscillator has started up.
+     */
+#ifdef CONFIG_ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
+    if (!rtc_clk_32k_enabled()) {
+        rtc_clk_32k_bootstrap();
+    }
+#endif
+}

components/bootloader_support/src/bootloader_flash.c

@@ -23,7 +23,7 @@
  */
 static const char *TAG = "bootloader_mmap";
 
-static spi_flash_mmap_memory_t map;
+static spi_flash_mmap_handle_t map;
 
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
@@ -36,7 +36,8 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
     size += (src_addr - src_page);
     esp_err_t err = spi_flash_mmap(src_page, size, SPI_FLASH_MMAP_DATA, &result, &map);
     if (err != ESP_OK) {
-        result = NULL;
+        ESP_LOGE(TAG, "spi_flash_mmap failed: 0x%x", err);
+        return NULL;
     }
     return (void *)((intptr_t)result + (src_addr - src_page));
 }

components/bootloader_support/src/bootloader_random.c

@@ -25,8 +25,6 @@
 #include "esp_system.h"
 #endif
 
-const char *TAG = "boot_rng";
-
 void bootloader_fill_random(void *buffer, size_t length)
 {
     uint8_t *buffer_bytes = (uint8_t *)buffer;

components/bootloader_support/src/esp_image_format.c

@@ -19,13 +19,15 @@
 #include <esp_image_format.h>
 #include <esp_secure_boot.h>
 #include <esp_log.h>
+#include <esp_spi_flash.h>
 #include <bootloader_flash.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
+#include "bootloader_util.h"
 
 static const char *TAG = "esp_image";
 
-#define HASH_LEN 32 /* SHA-256 digest length */
+#define HASH_LEN ESP_IMAGE_HASH_LEN
 
 #define SIXTEEN_MB 0x1000000
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF
@@ -33,11 +35,18 @@ static const char *TAG = "esp_image";
 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
 #define STACK_LOAD_HEADROOM 32768
 
+/* Mmap source address mask */
+#define MMAP_ALIGNED_MASK 0x0000FFFF
+
 #ifdef BOOTLOADER_BUILD
 /* 64 bits of random data to obfuscate loaded RAM with, until verification is complete
    (Means loaded code isn't executable until after the secure boot check.)
 */
 static uint32_t ram_obfs_value[2];
+
+/* Range of IRAM used by the loader, defined in ld script */
+extern int _loader_text_start;
+extern int _loader_text_end;
 #endif
 
 /* Return true if load_addr is an address the bootloader should load into */
@@ -48,6 +57,9 @@ static bool should_map(uint32_t load_addr);
 /* Load or verify a segment */
 static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
 
+/* split segment and verify if data_len is too long */
+static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+
 /* Verify the main image header */
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);
 
@@ -279,19 +291,71 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
                  (do_load)?"load":(is_mapping)?"map":"");
     }
 
+
+#ifdef BOOTLOADER_BUILD
+    /* Before loading segment, check it doesn't clobber bootloader RAM. */
     if (do_load) {
-        /* Before loading segment, check it doesn't clobber bootloader RAM... */
-        uint32_t end_addr = load_addr + data_len;
-        if (end_addr < 0x40000000) {
+        const intptr_t load_end = load_addr + data_len;
+        if (load_end <= (intptr_t) SOC_DIRAM_DRAM_HIGH) {
+            /* Writing to DRAM */
             intptr_t sp = (intptr_t)get_sp();
-            if (end_addr > sp - STACK_LOAD_HEADROOM) {
-                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x liimit 0x%08x)",
-                         index, end_addr, sp, sp - STACK_LOAD_HEADROOM);
+            if (load_end > sp - STACK_LOAD_HEADROOM) {
+                /* Bootloader .data/.rodata/.bss is above the stack, so this
+                 * also checks that we aren't overwriting these segments.
+                 *
+                 * TODO: This assumes specific arrangement of sections we have
+                 * in the ESP32. Rewrite this in a generic way to support other
+                 * layouts.
+                 */
+                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x limit 0x%08x)",
+                         index, load_end, sp, sp - STACK_LOAD_HEADROOM);
+                return ESP_ERR_IMAGE_INVALID;
+            }
+        } else {
+            /* Writing to IRAM */
+            const intptr_t loader_iram_start = (intptr_t) &_loader_text_start;
+            const intptr_t loader_iram_end = (intptr_t) &_loader_text_end;
+
+            if (bootloader_util_regions_overlap(loader_iram_start, loader_iram_end,
+                    load_addr, load_end)) {
+                ESP_LOGE(TAG, "Segment %d (0x%08x-0x%08x) overlaps bootloader IRAM (0x%08x-0x%08x)",
+                         index, load_addr, load_end, loader_iram_start, loader_iram_end);
                 return ESP_ERR_IMAGE_INVALID;
             }
         }
     }
+#endif // BOOTLOADER_BUILD
 
+#ifndef BOOTLOADER_BUILD
+    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
+    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
+    uint32_t offset_page = 0;
+    while (data_len >= free_page_count * SPI_FLASH_MMU_PAGE_SIZE) {
+        offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0)?1:0;
+        err = process_segment_data(load_addr, data_addr, (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE, do_load, sha_handle, checksum);
+        if (err != ESP_OK) {
+            return err;
+        }
+        data_addr += (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
+        data_len -= (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
+    }
+#endif
+    err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
+    if (err != ESP_OK) {
+        return err;
+    }
+    return ESP_OK;
+
+err:
+    if (err == ESP_OK) {
+        err = ESP_ERR_IMAGE_INVALID;
+    }
+
+    return err;
+}
+
+static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+{
     const uint32_t *data = (const uint32_t *)bootloader_mmap(data_addr, data_len);
     if(!data) {
         ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed",
@@ -332,12 +396,6 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
     bootloader_munmap(data);
 
     return ESP_OK;
-
- err:
-    if (err == ESP_OK) {
-        err = ESP_ERR_IMAGE_INVALID;
-    }
-    return err;
 }
 
 static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
@@ -411,19 +469,28 @@ static bool should_load(uint32_t load_addr)
 esp_err_t esp_image_verify_bootloader(uint32_t *length)
 {
     esp_image_metadata_t data;
-    const esp_partition_pos_t bootloader_part = {
-        .offset = ESP_BOOTLOADER_OFFSET,
-        .size = ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET,
-    };
-    esp_err_t err = esp_image_load(ESP_IMAGE_VERIFY,
-                                   &bootloader_part,
-                                   &data);
+    esp_err_t err = esp_image_verify_bootloader_data(&data);
     if (length != NULL) {
         *length = (err == ESP_OK) ? data.image_len : 0;
     }
     return err;
 }
 
+esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
+{
+    if (data == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    const esp_partition_pos_t bootloader_part = {
+        .offset = ESP_BOOTLOADER_OFFSET,
+        .size = ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET,
+    };
+    return esp_image_load(ESP_IMAGE_VERIFY,
+                          &bootloader_part,
+                          data);
+}
+
+
 static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data)
 {
     uint32_t unpadded_length = data->image_len;

components/bootloader_support/src/flash_encrypt.c

@@ -62,6 +62,11 @@ esp_err_t esp_flash_encrypt_check_and_update(void)
 
 static esp_err_t initialise_flash_encryption(void)
 {
+    if (REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_CODING_SCHEME_M) {
+        ESP_LOGE(TAG, "Flash Encryption is currently not supported on hardware with 3/4 Coding Scheme (CODING_SCHEME efuse set)");
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     /* Before first flash encryption pass, need to initialise key & crypto config */
 
     /* Generate key */

components/bootloader_support/src/secure_boot.c

@@ -50,7 +50,7 @@ static bool secure_boot_generate(uint32_t image_len){
     const uint32_t *image;
 
     /* hardware secure boot engine only takes full blocks, so round up the
-       image length. The additional data should all be 0xFF.
+       image length. The additional data should all be 0xFF (or the appended SHA, if it falls in the same block).
     */
     if (image_len % sizeof(digest.iv) != 0) {
         image_len = (image_len / sizeof(digest.iv) + 1) * sizeof(digest.iv);
@@ -104,14 +104,20 @@ static inline void burn_efuses()
 
 esp_err_t esp_secure_boot_permanently_enable(void) {
     esp_err_t err;
-    uint32_t image_len = 0;
     if (esp_secure_boot_enabled())
     {
         ESP_LOGI(TAG, "bootloader secure boot is already enabled, continuing..");
         return ESP_OK;
     }
 
-    err = esp_image_verify_bootloader(&image_len);
+    if (REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_CODING_SCHEME_M) {
+        ESP_LOGE(TAG, "Secure Boot is currently not supported on hardware with 3/4 Coding Scheme (CODING_SCHEME efuse set)");
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
+    /* Verify the bootloader */
+    esp_image_metadata_t bootloader_data = { 0 };
+    err = esp_image_verify_bootloader_data(&bootloader_data);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "bootloader image appears invalid! error %d", err);
         return err;
@@ -150,6 +156,11 @@ esp_err_t esp_secure_boot_permanently_enable(void) {
     }
 
     ESP_LOGI(TAG, "Generating secure boot digest...");
+    uint32_t image_len = bootloader_data.image_len;
+    if(bootloader_data.image.hash_appended) {
+        /* Secure boot digest doesn't cover the hash */
+        image_len -= ESP_IMAGE_HASH_LEN;
+    }
     if (false == secure_boot_generate(image_len)){
         ESP_LOGE(TAG, "secure boot generation failed");
         return ESP_FAIL;

components/bootloader_support/test/test_verify_image.c

@@ -13,6 +13,7 @@
 #include "freertos/xtensa_api.h"
 #include "unity.h"
 
+#include "bootloader_util.h"
 #include "esp_partition.h"
 #include "esp_ota_ops.h"
 #include "esp_image_format.h"
@@ -47,3 +48,21 @@ TEST_CASE("Verify unit test app image", "[bootloader_support]")
     TEST_ASSERT_TRUE(data.image_len <= running->size);
 }
 
+TEST_CASE("Test regions_overlap", "[bootloader_support]")
+{
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 1, 2) );
+
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 0, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 1, 3) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 0, 3) );
+
+    TEST_ASSERT( bootloader_util_regions_overlap(0, 2, 1, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 3, 1, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(0, 3, 1, 2) );
+
+    TEST_ASSERT( !bootloader_util_regions_overlap(2, 3, 1, 2) );
+    TEST_ASSERT( !bootloader_util_regions_overlap(1, 2, 2, 3) );
+
+    TEST_ASSERT( !bootloader_util_regions_overlap(3, 4, 1, 2) );
+    TEST_ASSERT( !bootloader_util_regions_overlap(1, 2, 3, 4) );
+}

components/bt/Kconfig

@@ -113,6 +113,13 @@ config CLASSIC_BT_ENABLED
     help
         For now this option needs "SMP_ENABLE" to be set to yes
 
+config A2DP_SINK_TASK_STACK_SIZE
+    int "A2DP sink (audio stream decoding) task stack size"
+    depends on CLASSIC_BT_ENABLED
+    default 2048
+    help
+        This affects the stack size of A2DP sink task which invokes the data callback function.
+
 config GATTS_ENABLE
     bool "Include GATT server module(GATTS)"
     depends on BLUEDROID_ENABLED
@@ -149,6 +156,38 @@ config BT_ACL_CONNECTIONS
     help 
         Maximum BT/BLE connection count
 
+config BLE_SCAN_DUPLICATE
+    bool "BLE Scan Duplicate Options "
+    depends on BLUEDROID_ENABLED
+    default y
+    help
+        This select enables parameters setting of BLE scan duplicate.
+
+config DUPLICATE_SCAN_CACHE_SIZE
+    int "Maximum number of devices in scan duplicate filter"
+    depends on BLE_SCAN_DUPLICATE
+    range 10 1000
+    default 500
+    help
+        Maximum number of devices which can be recorded in scan duplicate filter.
+        When the maximum amount of device in the filter is reached, the cache will be refreshed.
+
+config BLE_MESH_SCAN_DUPLICATE_EN
+    bool "Special duplicate scan mechanism for BLE Mesh scan"
+    depends on BLE_SCAN_DUPLICATE
+    default n
+    help
+        This enables the BLE scan duplicate for special BLE Mesh scan.
+
+config MESH_DUPLICATE_SCAN_CACHE_SIZE
+    int "Maximum number of Mesh adv packets in scan duplicate filter"
+    depends on BLE_MESH_SCAN_DUPLICATE_EN
+    range 10 200
+    default 50
+    help
+        Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
+        When the maximum amount of device in the filter is reached, the cache will be refreshed.
+
 config SMP_ENABLE
    bool
    depends on BLUEDROID_ENABLED

components/bt/bluedroid/api/esp_bt_main.c

@@ -16,7 +16,7 @@
 #include "esp_bt_main.h"
 #include "btc_task.h"
 #include "btc_main.h"
-#include "bt.h"
+#include "esp_bt.h"
 #include "future.h"
 #include "allocator.h"
 

components/bt/bluedroid/api/esp_gap_ble_api.c

@@ -240,7 +240,8 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
     if (ESP_BLE_IS_VALID_PARAM(min_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(max_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF)) {
+        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+        ((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) {
 
         msg.sig = BTC_SIG_API_CALL;
         msg.pid = BTC_PID_GAP_BLE;

components/bt/bluedroid/api/esp_gattc_api.c

@@ -67,7 +67,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, bool is_direct)
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
     btc_msg_t msg;
     btc_ble_gattc_args_t arg;
@@ -79,6 +79,7 @@ esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, b
     msg.act = BTC_GATTC_ACT_OPEN;
     arg.open.gattc_if = gattc_if;
     memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    arg.open.remote_addr_type = remote_addr_type;
     arg.open.is_direct = is_direct;
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);

components/bt/bluedroid/api/include/esp_a2dp_api.h

@@ -138,9 +138,10 @@ esp_err_t esp_a2d_register_callback(esp_a2d_cb_t callback);
 
 /**
  * @brief           Register A2DP sink data output function; For now the output is PCM data stream decoded
- *                  from SBC format. This function should be called only after esp_bluedroid_enable() 
- *                  completes successfully
- *                  
+ *                  from SBC format. This function should be called only after esp_bluedroid_enable()
+ *                  completes successfully, used only by A2DP sink. The callback is invoked in the context
+ *                  of A2DP sink task whose stack size is configurable through menuconfig
+ *
  * @param[in]       callback: A2DP data callback function
  *
  * @return

components/bt/bluedroid/api/include/esp_avrc_api.h

@@ -58,10 +58,10 @@ typedef enum {
     ESP_AVRC_CT_METADATA_RSP_EVT = 2,            /*!< metadata response event */
     ESP_AVRC_CT_PLAY_STATUS_RSP_EVT = 3,         /*!< play status response event */
     ESP_AVRC_CT_CHANGE_NOTIFY_EVT = 4,           /*!< notification event */
-    ESP_AVRC_CT_MAX_EVT
+    ESP_AVRC_CT_REMOTE_FEATURES_EVT = 5,         /*!< feature of remote device indication event */
 } esp_avrc_ct_cb_event_t;
 
-//AVRC metadata attribute mask
+/// AVRC metadata attribute mask
 typedef enum {
     ESP_AVRC_MD_ATTR_TITLE = 0x1,                 /*!< title of the playing track */
     ESP_AVRC_MD_ATTR_ARTIST = 0x2,                /*!< track artist */
@@ -72,7 +72,7 @@ typedef enum {
     ESP_AVRC_MD_ATTR_PLAYING_TIME = 0x40          /*!< total album playing time in miliseconds */
 } esp_avrc_md_attr_mask_t;
 
-//AVRC event notification ids
+/// AVRC event notification ids
 typedef enum {
     ESP_AVRC_RN_PLAY_STATUS_CHANGE = 0x01,        /*!< track status change, eg. from playing to paused */
     ESP_AVRC_RN_TRACK_CHANGE = 0x02,              /*!< new track is loaded */
@@ -85,7 +85,7 @@ typedef enum {
     ESP_AVRC_RN_MAX_EVT
 } esp_avrc_rn_event_ids_t;
 
-//AVRC player setting ids
+/// AVRC player setting ids
 typedef enum {
     ESP_AVRC_PS_EQUALIZER = 0x01,                 /*!< equalizer, on or off */
     ESP_AVRC_PS_REPEAT_MODE = 0x02,               /*!< repeat mode */
@@ -94,32 +94,32 @@ typedef enum {
     ESP_AVRC_PS_MAX_ATTR
 } esp_avrc_ps_attr_ids_t;
 
-//AVRC equalizer modes
+/// AVRC equalizer modes
 typedef enum {
-    ESP_AVRC_PS_EQUALIZER_OFF = 0x1,
-    ESP_AVRC_PS_EQUALIZER_ON = 0x2
+    ESP_AVRC_PS_EQUALIZER_OFF = 0x1,              /*!< equalizer OFF */
+    ESP_AVRC_PS_EQUALIZER_ON = 0x2                /*!< equalizer ON */
 } esp_avrc_ps_eq_value_ids_t;
 
-//AVRC repeat modes
+/// AVRC repeat modes
 typedef enum {
-    ESP_AVRC_PS_REPEAT_OFF = 0x1,
-    ESP_AVRC_PS_REPEAT_SINGLE = 0x2,
-    ESP_AVRC_PS_REPEAT_GROUP = 0x3
+    ESP_AVRC_PS_REPEAT_OFF = 0x1,                 /*!< repeat mode off */
+    ESP_AVRC_PS_REPEAT_SINGLE = 0x2,              /*!< single track repeat */
+    ESP_AVRC_PS_REPEAT_GROUP = 0x3                /*!< group repeat */
 } esp_avrc_ps_rpt_value_ids_t;
 
 
-//AVRC shuffle modes
+/// AVRC shuffle modes
 typedef enum {
-    ESP_AVRC_PS_SHUFFLE_OFF = 0x1,
-    ESP_AVRC_PS_SHUFFLE_ALL = 0x2,
-    ESP_AVRC_PS_SHUFFLE_GROUP = 0x3
+    ESP_AVRC_PS_SHUFFLE_OFF = 0x1,                /*<! shuffle off */
+    ESP_AVRC_PS_SHUFFLE_ALL = 0x2,                /*<! all trackes shuffle */
+    ESP_AVRC_PS_SHUFFLE_GROUP = 0x3               /*<! group shuffle */
 } esp_avrc_ps_shf_value_ids_t;
 
-//AVRC scan modes
+/// AVRC scan modes
 typedef enum {
-    ESP_AVRC_PS_SCAN_OFF = 0x1,
-    ESP_AVRC_PS_SCAN_ALL = 0x2,
-    ESP_AVRC_PS_SCAN_GROUP = 0x3
+    ESP_AVRC_PS_SCAN_OFF = 0x1,                   /*!< scan off */
+    ESP_AVRC_PS_SCAN_ALL = 0x2,                   /*!< all tracks scan */
+    ESP_AVRC_PS_SCAN_GROUP = 0x3                  /*!< group scan */
 } esp_avrc_ps_scn_value_ids_t;
 
 /// AVRC controller callback parameters
@@ -129,7 +129,6 @@ typedef union {
      */
     struct avrc_ct_conn_stat_param {
         bool connected;                          /*!< whether AVRC connection is set up */
-        uint32_t feat_mask;                      /*!< AVRC feature mask of remote device */
         esp_bd_addr_t remote_bda;                /*!< remote bluetooth device address */
     } conn_stat;                                 /*!< AVRC connection status */
 
@@ -159,6 +158,14 @@ typedef union {
         uint32_t event_parameter;                /*!< event notification parameter */
     } change_ntf;                                /*!< notifications */
 
+    /**
+     * @brief ESP_AVRC_CT_REMOTE_FEATURES_EVT
+     */
+    struct avrc_ct_rmt_feats_param {
+        uint32_t feat_mask;                      /*!< AVRC feature mask of remote device */
+        esp_bd_addr_t remote_bda;                /*!< remote bluetooth device address */
+    } rmt_feats;                                 /*!< AVRC features discovered from remote SDP server */
+    
 } esp_avrc_ct_cb_param_t;
 
 
@@ -212,7 +219,19 @@ esp_err_t esp_avrc_ct_init(void);
  */
 esp_err_t esp_avrc_ct_deinit(void);
 
-/* add description */
+/**
+ *
+ * @brief           Send player application settings command to AVRCP target. This function should be called
+ *                  after ESP_AVRC_CT_CONNECTION_STATE_EVT is received and AVRCP connection is established.
+ *
+ * @param[in]       tl : transaction label, 0 to 15, consecutive commands should use different values.
+ * @param[in]       attr_id : player application setting attribute IDs from one of esp_avrc_ps_attr_ids_t
+ * @param[in]       value_id : attribute value defined for the specific player application setting attribute
+ * @return
+ *                  - ESP_OK: success
+ *                  - ESP_INVALID_STATE: if bluetooth stack is not yet enabled
+ *                  - ESP_FAIL: others
+ */
 esp_err_t esp_avrc_ct_send_set_player_value_cmd(uint8_t tl, uint8_t attr_id, uint8_t value_id);
 
 /**

components/bt/bluedroid/api/include/esp_bt_defs.h

@@ -51,6 +51,7 @@ typedef enum {
     ESP_BT_STATUS_PEER_LE_DATA_LEN_UNSUPPORTED, /* relate to BTM_PEER_LE_DATA_LEN_UNSUPPORTED in btm_api.h */
     ESP_BT_STATUS_CONTROL_LE_DATA_LEN_UNSUPPORTED,/* relate to BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED in btm_api.h */
     ESP_BT_STATUS_ERR_ILLEGAL_PARAMETER_FMT,    /* relate to HCI_ERR_ILLEGAL_PARAMETER_FMT in hcidefs.h */
+    ESP_BT_STATUS_MEMORY_FULL,                  /* relate to BT_STATUS_MEMORY_FULL in bt_def.h */
 } esp_bt_status_t;
 
 

components/bt/bluedroid/api/include/esp_gap_ble_api.h

@@ -97,9 +97,11 @@ typedef enum {
     ESP_GAP_BLE_CLEAR_BOND_DEV_COMPLETE_EVT,                /*!< When clear the bond device clear complete, the event comes */
     ESP_GAP_BLE_GET_BOND_DEV_COMPLETE_EVT,                  /*!< When get the bond device list complete, the event comes */
     ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT,                     /*!< When read the rssi complete, the event comes */
-    ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT,                 /*!< When add or remove whitelist complete, the event comes */
+    ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT,              /*!< When add or remove whitelist complete, the event comes */
     ESP_GAP_BLE_EVT_MAX,
 } esp_gap_ble_cb_event_t;
+/// This is the old name, just for backwards compatibility
+#define ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT
 
 /// Advertising data maximum length
 #define ESP_BLE_ADV_DATA_LEN_MAX               31
@@ -217,7 +219,7 @@ typedef struct {
     esp_ble_adv_type_t      adv_type;           /*!< Advertising type */
     esp_ble_addr_type_t     own_addr_type;      /*!< Owner bluetooth device address type */
     esp_bd_addr_t           peer_addr;          /*!< Peer device bluetooth device address */
-    esp_ble_addr_type_t     peer_addr_type;     /*!< Peer device bluetooth device address type */
+    esp_ble_addr_type_t     peer_addr_type;     /*!< Peer device bluetooth device address type, only support public address type and random address type */
     esp_ble_adv_channel_t   channel_map;        /*!< Advertising channel map */
     esp_ble_adv_filter_t    adv_filter_policy;  /*!< Advertising filter policy */
 } esp_ble_adv_params_t;
@@ -239,7 +241,7 @@ typedef struct {
     uint8_t                 flag;                   /*!< Advertising flag of discovery mode, see BLE_ADV_DATA_FLAG detail */
 } esp_ble_adv_data_t;
 
-/// Ble scan type 
+/// Ble scan type
 typedef enum {
     BLE_SCAN_TYPE_PASSIVE   =   0x0,            /*!< Passive scan */
     BLE_SCAN_TYPE_ACTIVE    =   0x1,            /*!< Active scan */
@@ -249,7 +251,7 @@ typedef enum {
 typedef enum {
     BLE_SCAN_FILTER_ALLOW_ALL           = 0x0,  /*!< Accept all :
                                                   1. advertisement packets except directed advertising packets not addressed to this device (default). */
-    BLE_SCAN_FILTER_ALLOW_ONLY_WLST     = 0x1,  /*!< Accept only : 
+    BLE_SCAN_FILTER_ALLOW_ONLY_WLST     = 0x1,  /*!< Accept only :
                                                   1. advertisement packets from devices where the advertiser’s address is in the White list.
                                                   2. Directed advertising packets which are not addressed for this device shall be ignored. */
     BLE_SCAN_FILTER_ALLOW_UND_RPA_DIR   = 0x2,  /*!< Accept all :
@@ -262,6 +264,13 @@ typedef enum {
                                                   3. directed advertising packets addressed to this device.*/
 } esp_ble_scan_filter_t;
 
+/// Ble scan duplicate type
+typedef enum {
+    BLE_SCAN_DUPLICATE_DISABLE           = 0x0,  /*!< the Link Layer should generate advertising reports to the host for each packet received */
+    BLE_SCAN_DUPLICATE_ENABLE            = 0x1,  /*!< the Link Layer should filter out duplicate advertising reports to the Host */
+    BLE_SCAN_DUPLICATE_MAX               = 0x2,  /*!< 0x02 – 0xFF, Reserved for future use */
+} esp_ble_scan_duplicate_t;
+
 /// Ble scan parameters
 typedef struct {
     esp_ble_scan_type_t     scan_type;              /*!< Scan type */
@@ -277,6 +286,9 @@ typedef struct {
                                                       Range: 0x0004 to 0x4000 Default: 0x0010 (10 ms)
                                                       Time = N * 0.625 msec
                                                       Time Range: 2.5 msec to 10240 msec */
+    esp_ble_scan_duplicate_t  scan_duplicate;       /*!< The Scan_Duplicates parameter controls whether the Link Layer should filter out 
+                                                        duplicate advertising reports (BLE_SCAN_DUPLICATE_ENABLE) to the Host, or if the Link Layer should generate 
+                                                        advertising reports for each packet received */
 } esp_ble_scan_params_t;
 
 /// Connection update parameters
@@ -312,7 +324,7 @@ typedef struct
 } esp_ble_penc_keys_t;                 /*!< The key type*/
 
 /**
-* @brief  BLE CSRK keys 
+* @brief  BLE CSRK keys
 */
 typedef struct
 {
@@ -322,7 +334,7 @@ typedef struct
 } esp_ble_pcsrk_keys_t;               /*!< The pcsrk key type */
 
 /**
-* @brief  BLE pid keys 
+* @brief  BLE pid keys
 */
 typedef struct
 {
@@ -354,7 +366,7 @@ typedef struct
 } esp_ble_lcsrk_keys;                       /*!< The csrk key type */
 
 /**
-* @brief  Structure associated with ESP_KEY_NOTIF_EVT 
+* @brief  Structure associated with ESP_KEY_NOTIF_EVT
 */
 typedef struct
 {
@@ -476,7 +488,7 @@ typedef enum {
 typedef enum{
     ESP_BLE_WHITELIST_REMOVE     = 0X00,    /*!< remove mac from whitelist */
     ESP_BLE_WHITELIST_ADD        = 0X01,    /*!< add address to whitelist */
-}esp_ble_wl_opration;
+}esp_ble_wl_opration_t;
 /**
  * @brief Gap callback parameters union
  */
@@ -486,7 +498,7 @@ typedef union {
      */
     struct ble_adv_data_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate the set advertising data operation success status */
-    } adv_data_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT */ 
+    } adv_data_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT */
     /**
      * @brief ESP_GAP_BLE_SCAN_RSP_DATA_SET_COMPLETE_EVT
      */
@@ -520,7 +532,7 @@ typedef union {
      */
     struct ble_adv_data_raw_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate the set raw advertising data operation success status */
-    } adv_data_raw_cmpl;                            /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT */ 
+    } adv_data_raw_cmpl;                            /*!< Event parameter of ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT */
     /**
      * @brief ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT
      */
@@ -616,12 +628,12 @@ typedef union {
         esp_bd_addr_t remote_addr;                  /*!< The remote device address */
     } read_rssi_cmpl;                               /*!< Event parameter of ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT */
     /**
-     * @brief ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT
+     * @brief ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT
      */
-    struct ble_add_whitelist_cmpl_evt_param {
+    struct ble_update_whitelist_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate the add or remove whitelist operation success status */
-        esp_ble_wl_opration wl_opration;            /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
-    } add_whitelist_cmpl;                           /*!< Event parameter of ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT */
+        esp_ble_wl_opration_t wl_opration;          /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
+    } update_whitelist_cmpl;                        /*!< Event parameter of ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT */
 } esp_ble_gap_cb_param_t;
 
 /**
@@ -983,7 +995,7 @@ int esp_ble_get_bond_device_num(void);
 *                           Suggest that dev_num value equal to esp_ble_get_bond_device_num().
 *
 * @param[out]      dev_list: an array(buffer) of `esp_ble_bond_dev_t` type. Use for storing the bonded devices address.
-*                            The dev_list should be allocated by who call this API. 
+*                            The dev_list should be allocated by who call this API.
 * @return          - ESP_OK : success
 *                  - other  : failed
 *

components/bt/bluedroid/api/include/esp_gattc_api.h

@@ -283,6 +283,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if);
  *
  * @param[in]       gattc_if: Gatt client access interface.
  * @param[in]       remote_bda: remote device bluetooth device address.
+ * @param[in]       remote_addr_type: remote device bluetooth device the address type.
  * @param[in]       is_direct: direct connection or background auto connection
  *
  * @return
@@ -290,7 +291,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if);
  *                  - other: failed
  *
  */
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, bool is_direct);
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct);
 
 
 /**

components/bt/bluedroid/api/include/esp_gatts_api.h

@@ -162,7 +162,7 @@ typedef union {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Descriptor attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t char_uuid;        /*!< Characteristic uuid */
+        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor uuid */
     } add_char_descr;                   /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_DESCR_EVT */
 
     /**

components/bt/bluedroid/bta/av/bta_av_aact.c

@@ -514,6 +514,9 @@ static void bta_av_proc_stream_evt(UINT8 handle, BD_ADDR bd_addr, UINT8 event, t
             p_msg->disc_rsn = p_data->hdr.err_param;
             break;
             */
+            case AVDT_DISCONNECT_IND_EVT:
+                p_msg->hdr.offset = p_data->hdr.err_param;
+                break;
             default:
                 break;
             }

components/bt/bluedroid/bta/av/bta_av_act.c

@@ -529,6 +529,7 @@ void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
 
     bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
     rc_open.peer_features = p_cb->rcb[i].peer_features;
+    rc_open.sdp_disc_done = TRUE;
     rc_open.status = BTA_AV_SUCCESS;
     APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
                      rc_open.peer_features);
@@ -536,6 +537,7 @@ void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
         /* we have not done SDP on peer RC capabilities.
          * peer must have initiated the RC connection */
         rc_open.peer_features = BTA_AV_FEAT_RCCT;
+        rc_open.sdp_disc_done = FALSE;
         bta_av_rc_disc(disc);
     }
     (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
@@ -1266,6 +1268,11 @@ void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
         hdr.layer_specific = xx + 1;
         bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
     }
+
+    bta_sys_free_timer(&p_cb->sig_tmr);
+    memset(&p_cb->sig_tmr, 0, sizeof(TIMER_LIST_ENT));
+    bta_sys_free_timer(&p_cb->acp_sig_tmr);
+    memset(&p_cb->acp_sig_tmr, 0, sizeof(TIMER_LIST_ENT));
 }
 
 /*******************************************************************************
@@ -1610,6 +1617,7 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
                 p_scb->use_rc = FALSE;
                 bdcpy(rc_open.peer_addr, p_scb->peer_addr);
                 rc_open.peer_features = 0;
+                rc_open.sdp_disc_done = FALSE;
                 rc_open.status = BTA_AV_FAIL_SDP;
                 (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
             }
@@ -1839,6 +1847,8 @@ void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
 
         /* make sure that the timer is not active */
         bta_sys_stop_timer(&p_scb->timer);
+        list_free(p_scb->a2d_list);
+        p_scb->a2d_list = NULL;
         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
     }
 

components/bt/bluedroid/bta/av/bta_av_main.c

@@ -1237,9 +1237,10 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
         bta_av_sm_execute(&bta_av_cb, p_msg->event, (tBTA_AV_DATA *) p_msg);
     } else {
         APPL_TRACE_VERBOSE("handle=0x%x\n", p_msg->layer_specific);
+        tBTA_AV_SCB *p_scb = bta_av_hndl_to_scb(p_msg->layer_specific);
+        p_scb->disc_rsn = p_msg->offset;
         /* stream state machine events */
-        bta_av_ssm_execute( bta_av_hndl_to_scb(p_msg->layer_specific),
-                            p_msg->event, (tBTA_AV_DATA *) p_msg);
+        bta_av_ssm_execute(p_scb, p_msg->event, (tBTA_AV_DATA *) p_msg);
     }
     return TRUE;
 }

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -282,6 +282,47 @@ void bta_dm_enable(tBTA_DM_MSG *p_data)
     }
 }
 
+/*******************************************************************************
+ *
+ * Function         bta_dm_init_cb
+ *
+ * Description      Initializes the bta_dm_cb control block
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_init_cb(void)
+{
+    memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+}
+
+/*******************************************************************************
+ *
+ * Function         bta_dm_deinit_cb
+ *
+ * Description      De-initializes the bta_dm_cb control block
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_deinit_cb(void)
+{
+    bta_sys_free_timer(&bta_dm_cb.disable_timer);
+#if ( BTA_EIR_CANNED_UUID_LIST != TRUE )
+    bta_sys_free_timer(&bta_dm_cb.app_ready_timer);
+#endif
+#if BTM_SSR_INCLUDED == TRUE
+    for (size_t i = 0; i < BTA_DM_NUM_PM_TIMER; i++) {
+        for (size_t j = 0; j < BTA_DM_PM_MODE_TIMER_MAX; j++) {
+            bta_sys_free_timer(&bta_dm_cb.pm_timer[i].timer[j]);
+        }
+    }
+#endif
+    memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_sys_hw_cback
@@ -318,7 +359,15 @@ static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
         }
 
         /* reinitialize the control block */
-        memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+        bta_dm_deinit_cb();
+
+        bta_sys_free_timer(&bta_dm_search_cb.search_timer);
+#if ((defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
+#if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE)
+        bta_sys_free_timer(&bta_dm_search_cb.gatt_close_timer);
+#endif
+#endif
+        memset(&bta_dm_search_cb, 0x00, sizeof(bta_dm_search_cb));
 
         /* unregister from SYS */
         bta_sys_hw_unregister( BTA_SYS_HW_BLUETOOTH );
@@ -332,11 +381,18 @@ static void bta_dm_sys_hw_cback( tBTA_SYS_HW_EVT status )
         /* save security callback */
         temp_cback = bta_dm_cb.p_sec_cback;
         /* make sure the control block is properly initialized */
-        memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+        bta_dm_init_cb();
+
         /* and retrieve the callback */
         bta_dm_cb.p_sec_cback = temp_cback;
         bta_dm_cb.is_bta_dm_active = TRUE;
 
+        bta_sys_free_timer(&bta_dm_search_cb.search_timer);
+#if ((defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
+#if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE)
+        bta_sys_free_timer(&bta_dm_search_cb.gatt_close_timer);
+#endif
+#endif
         /* hw is ready, go on with BTA DM initialization */
         memset(&bta_dm_search_cb, 0x00, sizeof(bta_dm_search_cb));
 #if (BTM_SSR_INCLUDED == TRUE)
@@ -2595,7 +2651,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
         return BTM_NOT_AUTHORIZED;
     }
 }
- 
+
 
 
 
@@ -3284,7 +3340,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         }
 
         bdcpy(conn.link_down.bd_addr, p_bda);
-        conn.link_down.status = (UINT8) btm_get_acl_disc_reason_code();
+        conn.link_down.reason = (UINT8) btm_get_acl_disc_reason_code();
         if ( bta_dm_cb.p_sec_cback ) {
             bta_dm_cb.p_sec_cback(BTA_DM_LINK_DOWN_EVT, &conn);
             if ( issue_unpair_cb ) {
@@ -4132,6 +4188,8 @@ static void bta_dm_observe_results_cb (tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir)
     result.inq_res.flag             = p_inq->flag;
     result.inq_res.adv_data_len     = p_inq->adv_data_len;
     result.inq_res.scan_rsp_len     = p_inq->scan_rsp_len;
+    memcpy(result.inq_res.dev_class, p_inq->dev_class, sizeof(DEV_CLASS));
+    result.inq_res.ble_evt_type     = p_inq->ble_evt_type;
 
     /* application will parse EIR to find out remote device name */
     result.inq_res.p_eir = p_eir;
@@ -4288,7 +4346,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         } else {
             sec_event.auth_cmpl.success = TRUE;
             if (!p_data->complt.smp_over_br) {
-                
+
             }
         }
 
@@ -4510,6 +4568,7 @@ void bta_dm_ble_set_scan_fil_params(tBTA_DM_MSG *p_data)
                                 p_data->ble_set_scan_fil_params.scan_window,
                                 p_data->ble_set_scan_fil_params.scan_mode,
                                 p_data->ble_set_scan_fil_params.addr_type_own,
+                                p_data->ble_set_scan_fil_params.scan_duplicate_filter,
                                 p_data->ble_set_scan_fil_params.scan_filter_policy,
                                 p_data->ble_set_scan_fil_params.scan_param_setup_cback);
 }
@@ -4573,14 +4632,18 @@ void bta_dm_ble_disconnect (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data)
 {
-    BOOLEAN set_flag = false;
+    tBTM_STATUS status = BTM_SET_STATIC_RAND_ADDR_FAIL;
     if (p_data->set_addr.addr_type != BLE_ADDR_RANDOM) {
         APPL_TRACE_ERROR("Invalid random adress type = %d\n", p_data->set_addr.addr_type);
+        if(p_data->set_addr.p_set_rand_addr_cback) {
+            (*p_data->set_addr.p_set_rand_addr_cback)(status);
+        }
         return;
     }
     //send the setting random address to BTM layer
-    if ((set_flag = BTM_BleSetRandAddress(p_data->set_addr.address) != TRUE)){
-        APPL_TRACE_ERROR("%s,set random address fail.", __func__);
+    status = BTM_BleSetRandAddress(p_data->set_addr.address);
+    if(p_data->set_addr.p_set_rand_addr_cback) {
+        (*p_data->set_addr.p_set_rand_addr_cback)(status);
     }
 
 }
@@ -4731,20 +4794,17 @@ void bta_dm_ble_set_adv_params (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_adv_params_all  (tBTA_DM_MSG *p_data)
 {
-    tBTA_STATUS status = BTA_FAILURE;
-
     if (BTM_BleSetAdvParamsStartAdv(p_data->ble_set_adv_params_all.adv_int_min,
                                 p_data->ble_set_adv_params_all.adv_int_max,
                                 p_data->ble_set_adv_params_all.adv_type,
                                 p_data->ble_set_adv_params_all.addr_type_own,
                                 p_data->ble_set_adv_params_all.p_dir_bda,
                                 p_data->ble_set_adv_params_all.channel_map,
-                                p_data->ble_set_adv_params_all.adv_filter_policy) == BTM_SUCCESS) {
-        status = BTA_SUCCESS;
-    }
-
-    if (p_data->ble_set_adv_params_all.p_start_adv_cback) {
-        (*p_data->ble_set_adv_params_all.p_start_adv_cback)(status);
+                                p_data->ble_set_adv_params_all.adv_filter_policy,
+                                p_data->ble_set_adv_params_all.p_start_adv_cback) == BTM_SUCCESS) {
+        APPL_TRACE_DEBUG("%s(), success to start ble adv.", __func__);
+    } else {
+        APPL_TRACE_ERROR("%s(), fail to start ble adv.", __func__);
     }
 }
 
@@ -4853,25 +4913,26 @@ void bta_dm_ble_set_scan_rsp_raw (tBTA_DM_MSG *p_data)
 void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data)
 {
     tACL_CONN *p_acl_cb = btm_bda_to_acl(p_data->ble_set_data_length.remote_bda, BT_TRANSPORT_LE);
-     if (p_acl_cb == NULL) {
-         APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__);
-         return;
-     } else {
-         p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback;
-     }
-     UINT8 status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda,
-                                         p_data->ble_set_data_length.tx_data_length);
-     if (status != BTM_SUCCESS) {
-        APPL_TRACE_ERROR("%s failed\n", __FUNCTION__);
-        if (p_data->ble_set_data_length.p_set_pkt_data_cback) {
-            if (p_acl_cb->data_length_params.tx_len == 0){
-                uint16_t length = controller_get_interface()->get_acl_data_size_ble();
-                p_acl_cb->data_length_params.rx_len = length;
-                p_acl_cb->data_length_params.tx_len = length;
-            }
-            (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params);
-        }
+    if (p_acl_cb == NULL) {
+        APPL_TRACE_ERROR("%s error: Invalid connection remote_bda.", __func__);
+        return;
+    } else {
+        p_acl_cb->p_set_pkt_data_cback = p_data->ble_set_data_length.p_set_pkt_data_cback;
     }
+    UINT8 status = BTM_SetBleDataLength(p_data->ble_set_data_length.remote_bda,
+                                        p_data->ble_set_data_length.tx_data_length);
+    if (status != BTM_SUCCESS) {
+        APPL_TRACE_ERROR("%s failed\n", __FUNCTION__);
+    }
+    if (p_data->ble_set_data_length.p_set_pkt_data_cback) {
+        if (p_acl_cb->data_length_params.tx_len == 0){
+            uint16_t length = controller_get_interface()->get_acl_data_size_ble();
+            p_acl_cb->data_length_params.rx_len = length;
+            p_acl_cb->data_length_params.tx_len = length;
+        }
+        (*p_data->ble_set_data_length.p_set_pkt_data_cback)(status, &p_acl_cb->data_length_params);
+    }
+
 }
 
 /*******************************************************************************
@@ -4888,15 +4949,13 @@ void bta_dm_ble_broadcast (tBTA_DM_MSG *p_data)
     tBTM_STATUS status = 0;
     BOOLEAN start = p_data->ble_observe.start;
 
-    status = BTM_BleBroadcast(start);
+    status = BTM_BleBroadcast(start, p_data->ble_observe.p_stop_adv_cback);
 
     if (p_data->ble_observe.p_stop_adv_cback){
         if (status != BTM_SUCCESS){
             APPL_TRACE_WARNING("%s, %s, status=0x%x\n", __func__,\
                     (start == TRUE) ? "start adv failed" : "stop adv failed", status);
         }
-        status = (status == BTM_SUCCESS ? BTA_SUCCESS : BTA_FAILURE);
-        p_data->ble_observe.p_stop_adv_cback(status);
     }
 
 }
@@ -5349,7 +5408,7 @@ static void bta_ble_energy_info_cmpl(tBTM_BLE_TX_TIME_MS tx_time,
     if (BTA_SUCCESS == st) {
         ctrl_state = bta_dm_pm_obtain_controller_state();
     }
-#endif  
+#endif
     if (bta_dm_cb.p_energy_info_cback) {
         bta_dm_cb.p_energy_info_cback(tx_time, rx_time, idle_time, energy_used, ctrl_state, st);
     }
@@ -5583,7 +5642,8 @@ void btm_dm_start_gatt_discovery (BD_ADDR bd_addr)
         bta_sys_stop_timer(&bta_dm_search_cb.gatt_close_timer);
         btm_dm_start_disc_gatt_services(bta_dm_search_cb.conn_id);
     } else {
-        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, TRUE, BTA_GATT_TRANSPORT_LE);
+        //TODO need to add addr_type in future
+        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE);
     }
 }
 #endif /* #if (GATTC_INCLUDED == TRUE) */

components/bt/bluedroid/bta/dm/bta_dm_api.c

@@ -968,6 +968,7 @@ void BTA_DmSetBleScanParams(tGATT_IF client_if, UINT32 scan_interval,
 **                  scan_interval - scan interval
 **                  scan_window - scan window
 **                  scan_mode - scan mode
+**                  scan_duplicate_filter - scan duplicate filter
 **                  scan_param_setup_status_cback - Set scan param status callback
 **
 ** Returns          void
@@ -975,7 +976,7 @@ void BTA_DmSetBleScanParams(tGATT_IF client_if, UINT32 scan_interval,
 *******************************************************************************/
 void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval,
                                   UINT32 scan_window, tBLE_SCAN_MODE scan_mode, UINT8 scan_fil_poilcy,
-                                  UINT8 addr_type_own, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback)
+                                  UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback)
 {
     tBTA_DM_API_BLE_SCAN_FILTER_PARAMS *p_msg;
 
@@ -987,6 +988,7 @@ void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval,
         p_msg->scan_window = scan_window;
         p_msg->scan_mode = scan_mode;
         p_msg->addr_type_own = addr_type_own;
+        p_msg->scan_duplicate_filter = scan_duplicate_filter;
         p_msg->scan_filter_policy = scan_fil_poilcy;
         p_msg->scan_param_setup_cback = scan_param_setup_cback;
 
@@ -2284,12 +2286,12 @@ extern void BTA_DmBleStopAdvertising(void)
 ** Description      This function set the random address for the APP
 **
 ** Parameters       rand_addr: the random address whith should be setting
-**
+**                  p_set_rand_addr_cback: complete callback
 ** Returns          void
 **
 **
 *******************************************************************************/
-extern void BTA_DmSetRandAddress(BD_ADDR rand_addr)
+extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback)
 {
     tBTA_DM_APT_SET_DEV_ADDR *p_msg;
     APPL_TRACE_API("set the random address ");
@@ -2298,6 +2300,7 @@ extern void BTA_DmSetRandAddress(BD_ADDR rand_addr)
         memcpy(p_msg->address, rand_addr, BD_ADDR_LEN);
         p_msg->hdr.event = BTA_DM_API_SET_RAND_ADDR_EVT;
         p_msg->addr_type = BLE_ADDR_RANDOM;
+        p_msg->p_set_rand_addr_cback = p_set_rand_addr_cback;
         //start sent the msg to the bta system control moudle
         bta_sys_sendmsg(p_msg);
     }

components/bt/bluedroid/bta/dm/bta_dm_int.h

@@ -485,6 +485,7 @@ typedef struct {
     UINT32 scan_window;
     tBLE_SCAN_MODE scan_mode;
     UINT8 addr_type_own;
+    UINT8 scan_duplicate_filter;
     UINT8 scan_filter_policy;
     tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback;
 } tBTA_DM_API_BLE_SCAN_FILTER_PARAMS;
@@ -532,6 +533,7 @@ typedef struct {
     BT_HDR      hdr;
     tBLE_ADDR_TYPE addr_type;
     BD_ADDR address;
+    tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback;
 } tBTA_DM_APT_SET_DEV_ADDR;
 
 /* set adv parameter for BLE advertising */

components/bt/bluedroid/bta/gatt/bta_gattc_act.c

@@ -48,8 +48,6 @@
 
 #if GATTC_INCLUDED == TRUE && BLE_INCLUDED == TRUE
 
-static osi_mutex_t write_ccc_mutex;
-
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -129,9 +127,9 @@ static void bta_gattc_enable(tBTA_GATTC_CB *p_cb)
         memset(&bta_gattc_cb, 0, sizeof(tBTA_GATTC_CB));
         p_cb->state = BTA_GATTC_STATE_ENABLED;
         // Create a write ccc mutex when the gatt client enable
-        osi_mutex_new(&write_ccc_mutex);
+        osi_mutex_new(&bta_gattc_cb.write_ccc_mutex);
     } else {
-        APPL_TRACE_DEBUG("GATTC is arelady enabled");
+        APPL_TRACE_DEBUG("GATTC is already enabled");
     }
 }
 
@@ -157,7 +155,7 @@ void bta_gattc_disable(tBTA_GATTC_CB *p_cb)
         return;
     }
     // Free the write ccc mutex when the gatt client disable
-    osi_mutex_free(&write_ccc_mutex);
+    osi_mutex_free(&bta_gattc_cb.write_ccc_mutex);
 
     for (i = 0; i < BTA_GATTC_CL_MAX; i ++) {
         if (p_cb->cl_rcb[i].in_use) {
@@ -495,9 +493,14 @@ void bta_gattc_open_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
     tBTA_GATTC_DATA gattc_data;
+    BOOLEAN found_app = FALSE;
 
+    tGATT_TCB *p_tcb = gatt_find_tcb_by_addr(p_data->api_conn.remote_bda, BT_TRANSPORT_LE);
+    if(p_tcb && p_clcb && p_data) {
+        found_app = gatt_find_specific_app_in_hold_link(p_tcb, p_clcb->p_rcb->client_if);
+    }
     /* open/hold a connection */
-    if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
+    if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda, p_data->api_conn.remote_addr_type,
                       TRUE, p_data->api_conn.transport)) {
         APPL_TRACE_ERROR("Connection open failure");
 
@@ -509,7 +512,7 @@ void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
                                       &p_clcb->bta_conn_id,
                                       p_data->api_conn.transport)) {
             gattc_data.int_conn.hdr.layer_specific = p_clcb->bta_conn_id;
-
+            gattc_data.int_conn.already_connect = found_app;
             bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, &gattc_data);
         }
         /* else wait for the callback event */
@@ -533,7 +536,7 @@ void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *p_clreg
 
     if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, TRUE, FALSE)) {
         /* always call open to hold a connection */
-        if (!GATT_Connect(p_data->client_if, p_data->remote_bda, FALSE, p_data->transport)) {
+        if (!GATT_Connect(p_data->client_if, p_data->remote_bda, p_data->remote_addr_type, FALSE, p_data->transport)) {
             uint8_t *bda = (uint8_t *)p_data->remote_bda;
             status = BTA_GATT_ERROR;
             APPL_TRACE_ERROR("%s unable to connect to remote bd_addr:%02x:%02x:%02x:%02x:%02x:%02x",
@@ -674,14 +677,14 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             if (bta_gattc_cache_load(p_clcb)) {
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
                 bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
-        } else { /* cache is building */
+            } else { /* cache is building */
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
                 /* cache load failure, start discovery */
                 bta_gattc_start_discover(p_clcb, NULL);
+            }
+        } else { /* cache is building */
+            p_clcb->state = BTA_GATTC_DISCOVER_ST;
         }
-    } else { /* cache is building */
-        p_clcb->state = BTA_GATTC_DISCOVER_ST;
-    }
     } else {
         /* a pending service handle change indication */
         if (p_clcb->p_srcb->srvc_hdl_chg) {
@@ -696,9 +699,14 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
         if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
             bta_sys_conn_open(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
         }
-
+        tBTA_GATT_STATUS status = BTA_GATT_OK;
+        if (p_data && p_data->int_conn.already_connect) {
+            //clear already_connect
+            p_data->int_conn.already_connect = FALSE;
+            status = BTA_GATT_ALREADY_OPEN;
+        }
         bta_gattc_send_open_cback(p_clcb->p_rcb,
-                                  BTA_GATT_OK,
+                                  status,
                                   p_clcb->bda,
                                   p_clcb->bta_conn_id,
                                   p_clcb->transport,
@@ -1644,8 +1652,8 @@ static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
     else if ((transport == BT_TRANSPORT_LE) && (connected == FALSE) && (p_conn != NULL)){
             p_conn->service_change_ccc_written = FALSE;
             if (p_conn->ccc_timer_used == TRUE){
-                assert(write_ccc_mutex != NULL);
-                osi_mutex_lock(&write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+                assert(bta_gattc_cb.write_ccc_mutex != NULL);
+                osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
 
                 if (p_conn->service_change_ccc_timer.param != 0) {
                     osi_free((void *)p_conn->service_change_ccc_timer.param);
@@ -1653,7 +1661,7 @@ static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
                 }
                 bta_sys_stop_timer(&(p_conn->service_change_ccc_timer));
                 p_conn->ccc_timer_used = FALSE;
-                osi_mutex_unlock(&write_ccc_mutex);
+                osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
             }
     }
 
@@ -1829,7 +1837,10 @@ BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,
         }
         /* notify applicationf or service change */
         if (p_clrcb->p_cback != NULL) {
-            (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)p_srcb->server_bda);
+            tBTA_GATTC_SERVICE_CHANGE srvc_chg= {0};
+            memcpy(srvc_chg.remote_bda, p_srcb->server_bda, sizeof(BD_ADDR));
+            srvc_chg.conn_id = conn_id;
+            (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)&srvc_chg);
         }
 
     }
@@ -2172,8 +2183,8 @@ void bta_gattc_broadcast(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
     UNUSED(p_cb);
 
     cb_data.reg_oper.client_if = p_msg->api_listen.client_if;
-    cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start);
-
+    cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start, NULL);
+    //TODO need modify callback if used
     if (p_clreg && p_clreg->p_cback) {
         (*p_clreg->p_cback)(BTA_GATTC_LISTEN_EVT, &cb_data);
     }
@@ -2354,13 +2365,14 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
     BOOLEAN start_ccc_timer = FALSE;
     UINT32 new_timeout;
 
-    assert(write_ccc_mutex != NULL);
-    osi_mutex_lock(&write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+    assert(bta_gattc_cb.write_ccc_mutex != NULL);
+    osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
 
     tBTA_GATTC_WAIT_CCC_TIMER *p_timer_param = (tBTA_GATTC_WAIT_CCC_TIMER*) p_tle->param;
     p_tle->param = (TIMER_PARAM_TYPE)0;
     if (p_timer_param == NULL){
         APPL_TRACE_ERROR("p_timer_param is NULL in %s\n", __func__);
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
         return;
     }
 
@@ -2368,6 +2380,7 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
     if (p_conn == NULL){
         APPL_TRACE_ERROR("p_conn is NULL in %s\n", __func__);
         osi_free(p_timer_param);
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
         return;
     }
 
@@ -2399,7 +2412,7 @@ static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
     }
 
     osi_free(p_timer_param);
-    osi_mutex_unlock(&write_ccc_mutex);
+    osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
 }
 
 #endif

components/bt/bluedroid/bta/gatt/bta_gattc_api.c

@@ -135,13 +135,14 @@ void BTA_GATTC_AppDeregister(tBTA_GATTC_IF client_if)
 **
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
+**                  remote_addr_type: remote device BD address type.
 **                  is_direct: direct connection or background auto connection
 **                  transport: Transport to be used for GATT connection (BREDR/LE)
 **
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
+void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
                     BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport)
 {
     tBTA_GATTC_API_OPEN  *p_buf;
@@ -152,6 +153,7 @@ void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
         p_buf->client_if = client_if;
         p_buf->is_direct = is_direct;
         p_buf->transport = transport;
+        p_buf->remote_addr_type = remote_addr_type;
         memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN);
 
 
@@ -829,7 +831,7 @@ tBTA_GATT_STATUS BTA_GATTC_RegisterForNotifications (tBTA_GATTC_IF client_if,
             if ( p_clreg->notif_reg[i].in_use &&
                     !memcmp(p_clreg->notif_reg[i].remote_bda, bda, BD_ADDR_LEN) &&
                   p_clreg->notif_reg[i].handle == handle) {
-                APPL_TRACE_WARNING("notification already registered");
+                APPL_TRACE_DEBUG("notification already registered");
                 status = BTA_GATT_OK;
                 break;
             }

components/bt/bluedroid/bta/gatt/bta_gattc_main.c

@@ -182,7 +182,7 @@ static const UINT8 bta_gattc_st_connected[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_API_READ_MULTI_EVT     */   {BTA_GATTC_READ_MULTI,         BTA_GATTC_CONN_ST},
     /* BTA_GATTC_API_REFRESH_EVT        */   {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
 
-    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
+    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_CONN,               BTA_GATTC_CONN_ST},
     /* BTA_GATTC_INT_DISCOVER_EVT       */   {BTA_GATTC_START_DISCOVER,     BTA_GATTC_DISCOVER_ST},
     /* BTA_GATTC_DISCOVER_CMPL_EVT       */  {BTA_GATTC_IGNORE,             BTA_GATTC_CONN_ST},
     /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_OP_CMPL,            BTA_GATTC_CONN_ST},
@@ -211,7 +211,7 @@ static const UINT8 bta_gattc_st_discover[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_API_READ_MULTI_EVT     */   {BTA_GATTC_Q_CMD,              BTA_GATTC_DISCOVER_ST},
     /* BTA_GATTC_API_REFRESH_EVT        */   {BTA_GATTC_IGNORE,             BTA_GATTC_DISCOVER_ST},
 
-    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_IGNORE,             BTA_GATTC_DISCOVER_ST},
+    /* BTA_GATTC_INT_CONN_EVT           */   {BTA_GATTC_CONN,               BTA_GATTC_DISCOVER_ST},
     /* BTA_GATTC_INT_DISCOVER_EVT       */   {BTA_GATTC_RESTART_DISCOVER,   BTA_GATTC_DISCOVER_ST},
     /* BTA_GATTC_DISCOVER_CMPL_EVT      */   {BTA_GATTC_DISC_CMPL,          BTA_GATTC_CONN_ST},
     /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE_OP_CMPL,     BTA_GATTC_DISCOVER_ST},

components/bt/bluedroid/bta/gatt/bta_gattc_utils.c

@@ -709,6 +709,7 @@ void bta_gattc_send_open_cback( tBTA_GATTC_RCB *p_clreg, tBTA_GATT_STATUS status
                                 BD_ADDR remote_bda, UINT16 conn_id,
                                 tBTA_TRANSPORT transport, UINT16 mtu)
 {
+
     tBTA_GATTC      cb_data;
 
     if (p_clreg->p_cback) {
@@ -862,6 +863,10 @@ BOOLEAN bta_gattc_conn_dealloc(BD_ADDR remote_bda)
     if (p_conn != NULL) {
         p_conn->in_use = FALSE;
         memset(p_conn->remote_bda, 0, BD_ADDR_LEN);
+        osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
+        bta_sys_free_timer(&p_conn->service_change_ccc_timer);
+        p_conn->ccc_timer_used = FALSE;
+        osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
         return TRUE;
     }
     return FALSE;

components/bt/bluedroid/bta/gatt/bta_gatts_act.c

@@ -420,7 +420,7 @@ void bta_gatts_add_char(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_msg)
                                       p_msg->api_add_char.perm,
                                       p_msg->api_add_char.property, p_attr_val, p_control);
     cb_data.add_result.server_if = p_rcb->gatt_if;
-    cb_data.add_result.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+    cb_data.add_result.service_id = p_msg->api_add_char.hdr.layer_specific;
     cb_data.add_result.attr_id = attr_id;
 // btla-specific ++
     memcpy(&cb_data.add_result.char_uuid, &p_msg->api_add_char.char_uuid, sizeof(tBT_UUID));
@@ -470,7 +470,7 @@ void bta_gatts_add_char_descr(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_
                                       p_control);
 
     cb_data.add_result.server_if = p_rcb->gatt_if;
-    cb_data.add_result.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+    cb_data.add_result.service_id = p_msg->api_add_char_descr.hdr.layer_specific;
     cb_data.add_result.attr_id = attr_id;
 // btla-specific ++
     memcpy(&cb_data.add_result.char_uuid, &p_msg->api_add_char_descr.descr_uuid, sizeof(tBT_UUID));
@@ -702,6 +702,10 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                 APPL_TRACE_ERROR("%s, malloc failed", __func__);
             }
             (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
+            if (cb_data.req_data.value != NULL) {
+                osi_free(cb_data.req_data.value);
+                cb_data.req_data.value = NULL;
+            }
         }
     } else {
         APPL_TRACE_ERROR("Not an registered servce attribute ID: 0x%04x",
@@ -729,7 +733,7 @@ void bta_gatts_open (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
 
     if ((p_rcb = bta_gatts_find_app_rcb_by_app_if(p_msg->api_open.server_if)) != NULL) {
         /* should always get the connection ID */
-        if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda,
+        if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda, BLE_ADDR_UNKNOWN_TYPE,
                          p_msg->api_open.is_direct, p_msg->api_open.transport)) {
             status = BTA_GATT_OK;
 

components/bt/bluedroid/bta/hh/bta_hh_le.c

@@ -334,7 +334,7 @@ void bta_hh_le_open_conn(tBTA_HH_DEV_CB *p_cb, BD_ADDR remote_bda)
     bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
     p_cb->in_use = TRUE;
 
-    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, TRUE, BTA_GATT_TRANSPORT_LE);
+    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE);
 }
 
 /*******************************************************************************
@@ -2600,7 +2600,7 @@ static void bta_hh_le_add_dev_bg_conn(tBTA_HH_DEV_CB *p_cb, BOOLEAN check_bond)
     if (/*p_cb->dscp_info.flag & BTA_HH_LE_NORMAL_CONN &&*/
         !p_cb->in_bg_conn && to_add) {
         /* add device into BG connection to accept remote initiated connection */
-        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, FALSE, BTA_GATT_TRANSPORT_LE);
+        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, BLE_ADDR_UNKNOWN_TYPE, FALSE, BTA_GATT_TRANSPORT_LE);
         p_cb->in_bg_conn = TRUE;
 
         BTA_DmBleSetBgConnType(BTA_DM_BLE_CONN_AUTO, NULL);

components/bt/bluedroid/bta/include/bta_api.h

@@ -400,12 +400,17 @@ typedef struct {
 
 typedef void (tBTA_SET_ADV_DATA_CMPL_CBACK) (tBTA_STATUS status);
 
-typedef void (tBTA_START_ADV_CMPL_CBACK) (tBTA_STATUS status);
+typedef tBTM_START_ADV_CMPL_CBACK tBTA_START_ADV_CMPL_CBACK;
+
+typedef tBTM_START_STOP_ADV_CMPL_CBACK tBTA_START_STOP_ADV_CMPL_CBACK;
+
 
 typedef tBTM_ADD_WHITELIST_CBACK tBTA_ADD_WHITELIST_CBACK;
 
 typedef tBTM_SET_PKT_DATA_LENGTH_CBACK tBTA_SET_PKT_DATA_LENGTH_CBACK;
 
+typedef tBTM_SET_RAND_ADDR_CBACK tBTA_SET_RAND_ADDR_CBACK;
+
 typedef tBTM_SET_LOCAL_PRIVACY_CBACK tBTA_SET_LOCAL_PRIVACY_CBACK;
 
 typedef tBTM_CMPL_CB tBTA_CMPL_CB;
@@ -782,6 +787,7 @@ typedef struct {
 typedef struct {
     BD_ADDR         bd_addr;            /* BD address peer device. */
     UINT8           status;             /* connection open/closed */
+    UINT8           reason;             /* link down reason */
     BOOLEAN         is_removed;         /* TRUE if device is removed when link is down */
 #if BLE_INCLUDED == TRUE
     tBTA_TRANSPORT  link_type;
@@ -1896,6 +1902,7 @@ extern void BTA_DmSetBleScanParams(tGATT_IF client_if, UINT32 scan_interval,
 **                  scan_interval - scan interval
 **                  scan_window - scan window
 **                  scan_mode - scan mode
+**                  scan_duplicate_filter - scan duplicate filter
 **                  scan_param_setup_status_cback - Set scan param status callback
 **
 ** Returns          void
@@ -1903,7 +1910,7 @@ extern void BTA_DmSetBleScanParams(tGATT_IF client_if, UINT32 scan_interval,
 *******************************************************************************/
 extern void BTA_DmSetBleScanFilterParams(tGATT_IF client_if, UINT32 scan_interval,
         UINT32 scan_window, tBLE_SCAN_MODE scan_mode, UINT8 scan_fil_poilcy,
-        UINT8 addr_type_own, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback);
+        UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBLE_SCAN_PARAM_SETUP_CBACK scan_param_setup_cback);
 
 
 /*******************************************************************************
@@ -2056,7 +2063,7 @@ extern void BTA_DmBleScan(BOOLEAN start, UINT32 duration,
 
 extern void BTA_DmBleStopAdvertising(void);
 
-extern void BTA_DmSetRandAddress(BD_ADDR rand_addr);
+extern void BTA_DmSetRandAddress(BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback);
 
 #endif
 

components/bt/bluedroid/bta/include/bta_av_api.h

@@ -375,6 +375,7 @@ typedef struct {
 /* data associated with BTA_AV_RC_OPEN_EVT */
 typedef struct {
     UINT8           rc_handle;
+    BOOLEAN         sdp_disc_done;
     tBTA_AV_FEAT    peer_features;
     BD_ADDR         peer_addr;
     tBTA_AV_STATUS  status;

components/bt/bluedroid/bta/include/bta_gatt_api.h

@@ -188,6 +188,8 @@ typedef UINT8 tBTA_GATTC_EVT;
 
 typedef tGATT_IF tBTA_GATTC_IF;
 
+typedef UINT8 tBTA_ADDR_TYPE;
+
 typedef struct {
     UINT16              unit;       /* as UUIUD defined by SIG */
     UINT16              descr;      /* as UUID as defined by SIG */
@@ -387,27 +389,30 @@ typedef struct {
     BD_ADDR             remote_bda;
 } tBTA_GATTC_DISCONNECT;
 
-
+typedef struct {
+    UINT16              conn_id;
+    BD_ADDR             remote_bda;
+} tBTA_GATTC_SERVICE_CHANGE;
 
 typedef union {
     tBTA_GATT_STATUS        status;
 
-    tBTA_GATTC_SEARCH_CMPL  search_cmpl;          /* discovery complete */
-    tBTA_GATTC_SRVC_RES     srvc_res;          /* discovery result */
-    tBTA_GATTC_REG          reg_oper;              /* registration data */
+    tBTA_GATTC_SEARCH_CMPL  search_cmpl;    /* discovery complete */
+    tBTA_GATTC_SRVC_RES     srvc_res;       /* discovery result */
+    tBTA_GATTC_REG          reg_oper;       /* registration data */
     tBTA_GATTC_OPEN         open;
     tBTA_GATTC_CONNECT      connect;
     tBTA_GATTC_CLOSE        close;
     tBTA_GATTC_DISCONNECT   disconnect;
-    tBTA_GATTC_READ         read;             /* read attribute/descriptor data */
-    tBTA_GATTC_WRITE        write;            /* write complete data */
-    tBTA_GATTC_EXEC_CMPL    exec_cmpl;       /*  execute complete */
-    tBTA_GATTC_NOTIFY       notify;           /* notification/indication event data */
+    tBTA_GATTC_READ         read;           /* read attribute/descriptor data */
+    tBTA_GATTC_WRITE        write;          /* write complete data */
+    tBTA_GATTC_EXEC_CMPL    exec_cmpl;      /*  execute complete */
+    tBTA_GATTC_NOTIFY       notify;         /* notification/indication event data */
     tBTA_GATTC_ENC_CMPL_CB  enc_cmpl;
-    BD_ADDR                 remote_bda;     /* service change event */
     tBTA_GATTC_CFG_MTU      cfg_mtu;        /* configure MTU operation */
     tBTA_GATTC_CONGEST      congest;
     tBTA_GATTC_QUEUE_FULL   queue_full;
+    tBTA_GATTC_SERVICE_CHANGE srvc_chg;     /* service change event */
 } tBTA_GATTC;
 
 /* GATTC enable callback function */
@@ -737,13 +742,14 @@ extern void BTA_GATTC_AppDeregister (tBTA_GATTC_IF client_if);
 **
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
+**                  remote_addr_type: remote device BD address type.
 **                  is_direct: direct connection or background auto connection
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda,
-                           BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport);
+extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
+                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport);
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/include/bta_gattc_int.h

@@ -30,6 +30,7 @@
 #include "bta_gattc_ci.h"
 #include "bta_gattc_co.h"
 #include "fixed_queue.h"
+#include "mutex.h"
 
 /*****************************************************************************
 **  Constants and data types
@@ -115,6 +116,7 @@ typedef tBTA_GATTC_INT_START_IF tBTA_GATTC_INT_DEREG;
 typedef struct {
     BT_HDR                  hdr;
     BD_ADDR                 remote_bda;
+    tBTA_ADDR_TYPE          remote_addr_type;
     tBTA_GATTC_IF           client_if;
     BOOLEAN                 is_direct;
     tBTA_TRANSPORT          transport;
@@ -191,6 +193,7 @@ typedef struct {
     UINT8                   role;
     tBT_TRANSPORT           transport;
     tGATT_DISCONN_REASON    reason;
+    BOOLEAN                 already_connect;
 } tBTA_GATTC_INT_CONN;
 
 typedef struct {
@@ -357,8 +360,8 @@ enum {
 };
 
 typedef struct {
-    UINT8             state;
-
+    UINT8               state;
+    osi_mutex_t         write_ccc_mutex;
     tBTA_GATTC_CONN     conn_track[BTA_GATTC_CONN_MAX];
     tBTA_GATTC_BG_TCK   bg_track[BTA_GATTC_KNOWN_SR_MAX];
     tBTA_GATTC_RCB      cl_rcb[BTA_GATTC_CL_MAX];

components/bt/bluedroid/bta/include/bta_sys.h

@@ -224,6 +224,7 @@ extern UINT16 bta_sys_get_sys_features(void);
 extern void bta_sys_sendmsg(void *p_msg);
 extern void bta_sys_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, INT32 timeout_ms);
 extern void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle);
+extern void bta_sys_free_timer(TIMER_LIST_ENT *p_tle);
 extern void bta_sys_disable(tBTA_SYS_HW_MODULE module);
 extern UINT32 bta_sys_get_remaining_ticks(TIMER_LIST_ENT *p_target_tle);
 

components/bt/bluedroid/bta/sys/bta_sys_main.c

@@ -652,6 +652,28 @@ void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle)
     osi_alarm_cancel(alarm);
 }
 
+/*******************************************************************************
+**
+** Function         bta_sys_free_timer
+**
+** Description      Stop and free a BTA timer.
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_sys_free_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    osi_alarm_t *alarm = hash_map_get(bta_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s expected alarm was not in bta alarm hash map.", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(bta_alarm_hash_map, p_tle);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_sys_disable

components/bt/bluedroid/btc/core/btc_ble_storage.c

@@ -23,8 +23,13 @@
 
 #if (SMP_INCLUDED == TRUE)
 
+//the maximum nubmer of bonded devices
+#define BONED_DEVICES_MAX_COUNT (BTM_SEC_MAX_DEVICE_RECORDS)
+
 static void _btc_storage_save(void)
 {
+    uint16_t addr_section_count = 0;
+    const btc_config_section_iter_t *need_remove_iter = NULL;
     const btc_config_section_iter_t *iter = btc_config_section_begin();
 
     while (iter != btc_config_section_end()) {
@@ -48,10 +53,25 @@ static void _btc_storage_save(void)
             btc_config_remove_section(section);
             continue;
         }
-
+        if(addr_section_count == BONED_DEVICES_MAX_COUNT) {
+            need_remove_iter = iter;
+        }
+        addr_section_count ++;
         iter = btc_config_section_next(iter);
     }
-
+    /*exceeded the maximum nubmer of bonded devices, delete them */
+    if (need_remove_iter) {
+        while(need_remove_iter != btc_config_section_end()) {
+            const char *need_remove_section = btc_config_section_name(need_remove_iter);
+            if (!string_is_bdaddr(need_remove_section)) {
+                need_remove_iter = btc_config_section_next(need_remove_iter);
+                continue;
+            }
+            need_remove_iter = btc_config_section_next(need_remove_iter);
+            BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
+            btc_config_remove_section(need_remove_section);
+        }
+    }
     btc_config_flush();
 }
 
@@ -764,7 +784,10 @@ bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev
         //resolve the peer device irk
         if (_btc_storage_get_ble_bonding_key(&bd_addr, BTM_LE_KEY_PID, buffer, sizeof(tBTM_LE_PID_KEYS)) == BT_STATUS_SUCCESS) {
             bond_dev->bond_key.key_mask |= ESP_BLE_ID_KEY_MASK;
-            memcpy(&bond_dev->bond_key.pid_key, buffer, sizeof(tBTM_LE_PID_KEYS));
+            tBTM_LE_PID_KEYS *pid_key = (tBTM_LE_PID_KEYS *) buffer;
+            memcpy(&bond_dev->bond_key.pid_key.irk, pid_key->irk, BT_OCTET16_LEN);
+            bond_dev->bond_key.pid_key.addr_type = pid_key->addr_type;
+            memcpy(&bond_dev->bond_key.pid_key.static_addr, pid_key->static_addr, sizeof(BD_ADDR));
         }
         //serch for the next bond device
         bond_dev++;

components/bt/bluedroid/btc/core/btc_dm.c

@@ -175,6 +175,10 @@ static void btc_dm_remove_ble_bonding_keys(void)
 
 static void btc_dm_save_ble_bonding_keys(void)
 {
+    if(!(pairing_cb.ble.is_penc_key_rcvd || pairing_cb.ble.is_pid_key_rcvd || pairing_cb.ble.is_pcsrk_key_rcvd || 
+         pairing_cb.ble.is_lenc_key_rcvd || pairing_cb.ble.is_lcsrk_key_rcvd || pairing_cb.ble.is_lidk_key_rcvd)) {
+        return ;
+    }
     bt_bdaddr_t bd_addr;
 
     bdcpy(bd_addr.address, pairing_cb.bd_addr);
@@ -247,12 +251,6 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
          if (btc_storage_get_remote_addr_type(&bdaddr, &addr_type) != BT_STATUS_SUCCESS) {
             btc_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type, true);
         }
-        /* check the irk has been save in the flash or not, if the irk has already save, means that the peer device has bonding
-           before. */
-        if(pairing_cb.ble.is_pid_key_rcvd) {
-            btc_storage_compare_address_key_value(&bdaddr, BTM_LE_KEY_PID,
-                                                  (void *)&pairing_cb.ble.pid_key, sizeof(tBTM_LE_PID_KEYS));
-        }
         btc_dm_save_ble_bonding_keys();
     } else {
         /*Map the HCI fail reason  to  bt status  */
@@ -432,8 +430,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
     switch (msg->act) {
     case BTA_DM_ENABLE_EVT: {
         btc_clear_services_mask();
-        btc_storage_load_bonded_devices();
 #if (SMP_INCLUDED == TRUE)
+        btc_storage_load_bonded_devices();
         //load the bonding device to the btm layer
         btc_storage_load_bonded_ble_devices();
 #endif  ///SMP_INCLUDED == TRUE

components/bt/bluedroid/btc/core/btc_main.c

@@ -41,7 +41,9 @@ static void btc_enable_bluetooth(void)
 
 static void btc_disable_bluetooth(void)
 {
+#if (SMP_INCLUDED)
     btc_config_shut_down();
+#endif /* #if (SMP_INCLUDED) */
     if (BTA_DisableBluetooth() != BTA_SUCCESS) {
         future_ready(*btc_main_get_future_p(BTC_MAIN_DISABLE_FUTURE), FUTURE_FAIL);
     }
@@ -57,8 +59,8 @@ static void btc_init_bluetooth(void)
     osi_alarm_create_mux();
     osi_alarm_init();
     bte_main_boot_entry(btc_init_callback);
-    btc_config_init();
 #if (SMP_INCLUDED)
+    btc_config_init();
     //load the ble local key whitch has been store in the flash
     btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
@@ -68,7 +70,9 @@ static void btc_init_bluetooth(void)
 static void btc_deinit_bluetooth(void)
 {
     bte_main_shutdown();
+#if (SMP_INCLUDED)
     btc_config_clean_up();
+#endif
     osi_alarm_deinit();
     osi_alarm_delete_mux();
     future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);

components/bt/bluedroid/btc/core/btc_task.c

@@ -141,9 +141,12 @@ int btc_init(void)
 {
     xBtcQueue = xQueueCreate(BTC_TASK_QUEUE_LEN, sizeof(btc_msg_t));
     xTaskCreatePinnedToCore(btc_task, "Btc_task", BTC_TASK_STACK_SIZE, NULL, BTC_TASK_PRIO, &xBtcTaskHandle, BTC_TASK_PINNED_TO_CORE);
+    if (xBtcTaskHandle == NULL || xBtcQueue == 0){
+        return BT_STATUS_NOMEM;
+    }
+
     btc_gap_callback_init();
     /* TODO: initial the profile_tab */
-
     return BT_STATUS_SUCCESS;
 }
 

components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c

@@ -208,7 +208,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         blufi_env.frag_size = p_data->req_data.p_data->mtu - BLUFI_MTU_RESERVED_SIZE;
         break;
     case BTA_GATTS_CONF_EVT:
-        LOG_DEBUG("CONIRM EVT\n");
+        LOG_DEBUG("CONFIRM EVT\n");
         /* Nothing */
         break;
     case BTA_GATTS_CREATE_EVT:

components/bt/bluedroid/btc/profile/std/a2dp/btc_avk.c

@@ -38,6 +38,7 @@
 #include "bt_utils.h"
 #include "btc_common.h"
 #include "btc_manage.h"
+#include "alarm.h"
 
 #if BTC_AV_INCLUDED
 
@@ -80,7 +81,7 @@ typedef struct {
 } btc_av_cb_t;
 
 typedef struct {
-    bt_bdaddr_t *target_bda;
+    bt_bdaddr_t target_bda;
     uint16_t uuid;
 } btc_av_connect_req_t;
 
@@ -88,7 +89,8 @@ typedef struct {
 **  Static variables
 ******************************************************************************/
 static btc_av_cb_t btc_av_cb = {0};
-static TIMER_LIST_ENT tle_av_open_on_rc;
+
+static osi_alarm_t *tle_av_open_on_rc = NULL;
 
 /* both interface and media task needs to be ready to alloc incoming request */
 #define CHECK_BTAV_INIT() do \
@@ -203,19 +205,18 @@ UNUSED_ATTR static const char *dump_av_sm_event_name(btc_av_sm_event_t event)
 ** Returns          void
 **
 *******************************************************************************/
-static void btc_initiate_av_open_tmr_hdlr(TIMER_LIST_ENT *tle)
+static void btc_initiate_av_open_tmr_hdlr(void *arg)
 {
+    UNUSED(arg);
     BD_ADDR peer_addr;
-    UNUSED(tle);
     btc_av_connect_req_t connect_req;
-    UNUSED(tle);
     /* is there at least one RC connection - There should be */
     if (btc_rc_get_connected_peer(peer_addr)) {
         LOG_DEBUG("%s Issuing connect to the remote RC peer", __FUNCTION__);
         /* In case of AVRCP connection request, we will initiate SRC connection */
-        connect_req.target_bda = (bt_bdaddr_t *)&peer_addr;
+        memcpy(connect_req.target_bda.address, peer_addr, sizeof(bt_bdaddr_t));
         connect_req.uuid = UUID_SERVCLASS_AUDIO_SOURCE;
-        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_CONNECT_REQ_EVT, (char *)&connect_req);
+        btc_dispatch_sm_event(BTC_AV_CONNECT_REQ_EVT, &connect_req, sizeof(btc_av_connect_req_t));
     } else {
         LOG_ERROR("%s No connected RC peers", __FUNCTION__);
     }
@@ -289,7 +290,7 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
     case BTA_AV_PENDING_EVT:
     case BTC_AV_CONNECT_REQ_EVT: {
         if (event == BTC_AV_CONNECT_REQ_EVT) {
-            memcpy(&btc_av_cb.peer_bda, ((btc_av_connect_req_t *)p_data)->target_bda,
+            memcpy(&btc_av_cb.peer_bda, &((btc_av_connect_req_t *)p_data)->target_bda,
                    sizeof(bt_bdaddr_t));
             BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
                        TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
@@ -313,10 +314,8 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
          */
 
         LOG_DEBUG("BTA_AV_RC_OPEN_EVT received w/o AV");
-        memset(&tle_av_open_on_rc, 0, sizeof(tle_av_open_on_rc));
-        tle_av_open_on_rc.param = (UINT32)btc_initiate_av_open_tmr_hdlr;
-        btu_start_timer(&tle_av_open_on_rc, BTU_TTYPE_USER_FUNC,
-                        BTC_TIMEOUT_AV_OPEN_ON_RC_SECS);
+        tle_av_open_on_rc = osi_alarm_new("AVconn", btc_initiate_av_open_tmr_hdlr, NULL, BTC_TIMEOUT_AV_OPEN_ON_RC_SECS * 1000);
+        osi_alarm_set(tle_av_open_on_rc, BTC_TIMEOUT_AV_OPEN_ON_RC_SECS * 1000);
         btc_rc_handler(event, p_data);
         break;
 
@@ -329,9 +328,9 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
         break;
 
     case BTA_AV_RC_CLOSE_EVT:
-        if (tle_av_open_on_rc.in_use) {
-            LOG_DEBUG("BTA_AV_RC_CLOSE_EVT: Stopping AV timer.");
-            btu_stop_timer(&tle_av_open_on_rc);
+        if (tle_av_open_on_rc) {
+            osi_alarm_free(tle_av_open_on_rc);
+            tle_av_open_on_rc = NULL;
         }
         btc_rc_handler(event, p_data);
         break;
@@ -616,7 +615,7 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
         break;
 
     case BTC_AV_CONNECT_REQ_EVT:
-        if (memcmp ((bt_bdaddr_t *)p_data, &(btc_av_cb.peer_bda),
+        if (memcmp (&((btc_av_connect_req_t *)p_data)->target_bda, &(btc_av_cb.peer_bda),
                     sizeof(btc_av_cb.peer_bda)) == 0) {
             LOG_DEBUG("%s: Ignore BTC_AVCONNECT_REQ_EVT for same device\n", __func__);
         } else {
@@ -972,7 +971,7 @@ bt_status_t btc_a2d_sink_init(void)
 static bt_status_t connect_int(bt_bdaddr_t *bd_addr, uint16_t uuid)
 {
     btc_av_connect_req_t connect_req;
-    connect_req.target_bda = bd_addr;
+    memcpy(&connect_req.target_bda, bd_addr, sizeof(bt_bdaddr_t));
     connect_req.uuid = uuid;
     LOG_DEBUG("%s\n", __FUNCTION__);
 
@@ -1001,9 +1000,6 @@ bt_status_t btc_a2d_sink_connect(bt_bdaddr_t *remote_bda)
 static void btc_a2d_sink_deinit(void)
 {
     LOG_DEBUG("%s\n", __FUNCTION__);
-
-    btc_a2dp_stop_media_task();
-
     btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
 #if (BTA_AV_SINK_INCLUDED == TRUE)
     btc_dm_disable_service(BTA_A2DP_SINK_SERVICE_ID);
@@ -1012,6 +1008,8 @@ static void btc_a2d_sink_deinit(void)
     /* Also shut down the AV state machine */
     btc_sm_shutdown(btc_av_cb.sm_handle);
     btc_av_cb.sm_handle = NULL;
+
+    btc_a2dp_stop_media_task();
 }
 
 /*******************************************************************************
@@ -1232,6 +1230,9 @@ void btc_a2dp_call_handler(btc_msg_t *msg)
         btc_a2dp_sink_reg_data_cb(arg->data_cb);
         break;
     }
+    case BTC_AV_CONNECT_REQ_EVT:
+        btc_sm_dispatch(btc_av_cb.sm_handle, msg->act, (char *)msg->arg);
+        break;
     default:
         LOG_WARN("%s : unhandled event: %d\n", __FUNCTION__, msg->act);
     }

components/bt/bluedroid/btc/profile/std/a2dp/btc_media_task.c

@@ -52,6 +52,8 @@
 #include "bt_utils.h"
 #include "esp_a2dp_api.h"
 #include "mutex.h"
+#include "future.h"
+#include <assert.h>
 
 // #if (BTA_AV_SINK_INCLUDED == TRUE)
 #include "oi_codec_sbc.h"
@@ -162,6 +164,7 @@ static void btc_media_thread_cleanup(UNUSED_ATTR void *context);
 
 static tBTC_MEDIA_CB btc_media_cb;
 static int media_task_running = MEDIA_TASK_STATE_OFF;
+static future_t *media_task_future = NULL;
 static fixed_queue_t *btc_media_cmd_msg_queue = NULL;
 static xTaskHandle  xBtcMediaTaskHandle = NULL;
 static QueueHandle_t xBtcMediaDataQueue = NULL;
@@ -272,13 +275,13 @@ bool btc_a2dp_start_media_task(void)
 
     APPL_TRACE_EVENT("## A2DP START MEDIA THREAD ##");
 
-    xBtcMediaQueueSet = xQueueCreateSet(BTC_MEDIA_TASK_QUEUE_SET_LEN);
+    xBtcMediaQueueSet = xQueueCreateSet(BTC_A2DP_SINK_TASK_QUEUE_SET_LEN);
     configASSERT(xBtcMediaQueueSet);
-    xBtcMediaDataQueue = xQueueCreate(BTC_MEDIA_DATA_QUEUE_LEN, sizeof(void *));
+    xBtcMediaDataQueue = xQueueCreate(BTC_A2DP_SINK_DATA_QUEUE_LEN, sizeof(void *));
     configASSERT(xBtcMediaDataQueue);
     xQueueAddToSet(xBtcMediaDataQueue, xBtcMediaQueueSet);
 
-    xBtcMediaCtrlQueue = xQueueCreate(BTC_MEDIA_CTRL_QUEUE_LEN, sizeof(void *));
+    xBtcMediaCtrlQueue = xQueueCreate(BTC_A2DP_SINK_CTRL_QUEUE_LEN, sizeof(void *));
     configASSERT(xBtcMediaCtrlQueue);
     xQueueAddToSet(xBtcMediaCtrlQueue, xBtcMediaQueueSet);
 
@@ -286,7 +289,7 @@ bool btc_a2dp_start_media_task(void)
         goto error_exit;
     }
 
-    xTaskCreatePinnedToCore(btc_media_task_handler, "BtcMediaT\n", 2048, NULL, configMAX_PRIORITIES - 3, &xBtcMediaTaskHandle, 0);
+    xTaskCreatePinnedToCore(btc_media_task_handler, BTC_A2DP_SINK_TASK_NAME, BTC_A2DP_SINK_TASK_STACK_SIZE, NULL, BTC_A2DP_SINK_TASK_PRIO, &xBtcMediaTaskHandle, BTC_A2DP_SINK_TASK_PINNED_TO_CORE);
     if (xBtcMediaTaskHandle == NULL) {
         goto error_exit;
     }
@@ -319,6 +322,11 @@ error_exit:;
         xBtcMediaCtrlQueue = NULL;
     }
 
+    if (xBtcMediaQueueSet) {
+        vQueueDelete(xBtcMediaQueueSet);
+        xBtcMediaQueueSet = NULL;
+    }
+
     fixed_queue_free(btc_media_cmd_msg_queue, NULL);
     btc_media_cmd_msg_queue = NULL;
     return false;
@@ -329,8 +337,13 @@ void btc_a2dp_stop_media_task(void)
     APPL_TRACE_EVENT("## A2DP STOP MEDIA THREAD ##\n");
 
     // Exit thread
+    media_task_running = MEDIA_TASK_STATE_SHUTTING_DOWN;
+    media_task_future = future_new();
+    assert(media_task_future);
     btc_media_ctrl_post(SIG_MEDIA_TASK_CLEAN_UP);
-    // TODO: wait until CLEAN up is done, then do task delete
+    future_await(media_task_future);
+    media_task_future = NULL;
+
     vTaskDelete(xBtcMediaTaskHandle);
     xBtcMediaTaskHandle = NULL;
 
@@ -340,6 +353,9 @@ void btc_a2dp_stop_media_task(void)
     vQueueDelete(xBtcMediaCtrlQueue);
     xBtcMediaCtrlQueue = NULL;
 
+    vQueueDelete(xBtcMediaQueueSet);
+    xBtcMediaQueueSet = NULL;
+
     fixed_queue_free(btc_media_cmd_msg_queue, NULL);
     btc_media_cmd_msg_queue = NULL;
 }
@@ -527,6 +543,10 @@ static void btc_media_task_avk_data_ready(UNUSED_ATTR void *context)
         }
 
         while ((p_msg = (tBT_SBC_HDR *)fixed_queue_try_peek_first(btc_media_cb.RxSbcQ)) != NULL ) {
+            if (media_task_running != MEDIA_TASK_STATE_ON){
+                return;
+            }
+
             btc_media_task_handle_inc_media(p_msg);
             p_msg = (tBT_SBC_HDR *)fixed_queue_try_dequeue(btc_media_cb.RxSbcQ);
             if ( p_msg == NULL ) {
@@ -552,14 +572,13 @@ static void btc_media_thread_init(UNUSED_ATTR void *context)
 
 static void btc_media_thread_cleanup(UNUSED_ATTR void *context)
 {
-    /* make sure no channels are restarted while shutting down */
-    media_task_running = MEDIA_TASK_STATE_SHUTTING_DOWN;
-
     btc_media_cb.data_channel_open = FALSE;
     /* Clear media task flag */
     media_task_running = MEDIA_TASK_STATE_OFF;
 
     fixed_queue_free(btc_media_cb.RxSbcQ, osi_free_func);
+
+    future_ready(media_task_future, NULL);
 }
 
 /*******************************************************************************
@@ -622,7 +641,7 @@ static void btc_media_task_handle_inc_media(tBT_SBC_HDR *p_msg)
     OI_STATUS status;
     int num_sbc_frames = p_msg->num_frames_to_be_processed;
     UINT32 sbc_frame_len = p_msg->len - 1;
-    availPcmBytes = 2 * sizeof(pcmData);
+    availPcmBytes = sizeof(pcmData);
 
     if ((btc_media_cb.peer_sep == AVDT_TSEP_SNK) || (btc_media_cb.rx_flush)) {
         APPL_TRACE_DEBUG(" State Changed happened in this tick ");
@@ -652,7 +671,7 @@ static void btc_media_task_handle_inc_media(tBT_SBC_HDR *p_msg)
         p_msg->len = sbc_frame_len + 1;
     }
 
-    btc_a2d_data_cb_to_app((uint8_t *)pcmData, (2 * sizeof(pcmData) - availPcmBytes));
+    btc_a2d_data_cb_to_app((uint8_t *)pcmData, (sizeof(pcmData) - availPcmBytes));
 }
 
 /*******************************************************************************
@@ -894,6 +913,10 @@ UINT8 btc_media_sink_enque_buf(BT_HDR *p_pkt)
 {
     tBT_SBC_HDR *p_msg;
 
+    if (media_task_running != MEDIA_TASK_STATE_ON){
+        return 0;
+    }
+
     if (btc_media_cb.rx_flush == TRUE) { /* Flush enabled, do not enque*/
         return fixed_queue_length(btc_media_cb.RxSbcQ);
     }

components/bt/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -120,30 +120,11 @@ static inline void btc_avrc_ct_cb_to_app(esp_avrc_ct_cb_event_t event, esp_avrc_
 
 static void handle_rc_features(void)
 {
-    btrc_remote_features_t rc_features = BTRC_FEAT_NONE;
-    bt_bdaddr_t rc_addr;
-    bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-
-    // TODO(eisenbach): If devices need to be blacklisted for absolute
-    // volume, it should be added to device/include/interop_database.h
-    // For now, everything goes... If blacklisting is necessary, exclude
-    // the following bit here:
-    //    btc_rc_vb.rc_features &= ~BTA_AV_FEAT_ADV_CTRL;
-
-    if (btc_rc_vb.rc_features & BTA_AV_FEAT_BROWSE) {
-        rc_features |= BTRC_FEAT_BROWSE;
-    }
-
-    if ( (btc_rc_vb.rc_features & BTA_AV_FEAT_ADV_CTRL) &&
-            (btc_rc_vb.rc_features & BTA_AV_FEAT_RCTG)) {
-        rc_features |= BTRC_FEAT_ABSOLUTE_VOLUME;
-    }
-
-    if (btc_rc_vb.rc_features & BTA_AV_FEAT_METADATA) {
-        rc_features |= BTRC_FEAT_METADATA;
-    }
-
-    LOG_DEBUG("%s: rc_features=0x%x", __FUNCTION__, rc_features);
+    esp_avrc_ct_cb_param_t param;
+    memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+    param.rmt_feats.feat_mask = btc_rc_vb.rc_features;
+    memcpy(param.rmt_feats.remote_bda, btc_rc_vb.rc_addr, sizeof(esp_bd_addr_t));
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_REMOTE_FEATURES_EVT, &param);
 }
 
 
@@ -158,9 +139,7 @@ static void handle_rc_features(void)
 static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
 {
     LOG_DEBUG("%s: rc_handle: %d", __FUNCTION__, p_rc_open->rc_handle);
-#if (AVRC_CTLR_INCLUDED == TRUE)
     bt_bdaddr_t rc_addr;
-#endif
 
     if (p_rc_open->status == BTA_AV_SUCCESS) {
         //check if already some RC is connected
@@ -182,22 +161,18 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
         btc_rc_vb.rc_connected = TRUE;
         btc_rc_vb.rc_handle = p_rc_open->rc_handle;
 
+        bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
+
+        esp_avrc_ct_cb_param_t param;
+        memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+        param.conn_stat.connected = true;
+        memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
+        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+
         /* on locally initiated connection we will get remote features as part of connect */
-        if (btc_rc_vb.rc_features != 0) {
+        if (p_rc_open->sdp_disc_done == TRUE) {
             handle_rc_features();
         }
-#if (AVRC_CTLR_INCLUDED == TRUE)
-        bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-        /* report connection state if device is AVRCP target */
-        if (btc_rc_vb.rc_features & BTA_AV_FEAT_RCTG) {
-            esp_avrc_ct_cb_param_t param;
-            memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-            param.conn_stat.connected = true;
-            param.conn_stat.feat_mask = btc_rc_vb.rc_features;
-            memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
-            btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
-        }
-#endif
     } else {
         LOG_ERROR("%s Connect failed with error code: %d",
                   __FUNCTION__, p_rc_open->status);
@@ -215,10 +190,8 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
  ***************************************************************************/
 static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
 {
-#if (AVRC_CTLR_INCLUDED == TRUE)
     bt_bdaddr_t rc_addr;
-    tBTA_AV_FEAT features;
-#endif
+
     LOG_DEBUG("%s: rc_handle: %d", __FUNCTION__, p_rc_close->rc_handle);
     if ((p_rc_close->rc_handle != btc_rc_vb.rc_handle)
             && (bdcmp(btc_rc_vb.rc_addr, p_rc_close->peer_addr))) {
@@ -228,28 +201,23 @@ static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
 
     btc_rc_vb.rc_handle = 0;
     btc_rc_vb.rc_connected = FALSE;
-    memset(btc_rc_vb.rc_addr, 0, sizeof(BD_ADDR));
+    memcpy(btc_rc_vb.rc_addr, p_rc_close->peer_addr, sizeof(BD_ADDR));
     memset(btc_rc_vb.rc_notif, 0, sizeof(btc_rc_vb.rc_notif));
-#if (AVRC_CTLR_INCLUDED == TRUE)
-    features = btc_rc_vb.rc_features;
-#endif
+
     btc_rc_vb.rc_features = 0;
     btc_rc_vb.rc_vol_label = MAX_LABEL;
     btc_rc_vb.rc_volume = MAX_VOLUME;
-#if (AVRC_CTLR_INCLUDED == TRUE)
+
     bdcpy(rc_addr.address, btc_rc_vb.rc_addr);
-#endif
+
     memset(btc_rc_vb.rc_addr, 0, sizeof(BD_ADDR));
-#if (AVRC_CTLR_INCLUDED == TRUE)
-    /* report connection state if device is AVRCP target */
-    if (features & BTA_AV_FEAT_RCTG) {
-        esp_avrc_ct_cb_param_t param;
-        memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-        param.conn_stat.connected = false;
-        memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
-        btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
-    }
-#endif
+
+    /* report connection state */
+    esp_avrc_ct_cb_param_t param;
+    memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
+    param.conn_stat.connected = false;
+    memcpy(param.conn_stat.remote_bda, &rc_addr, sizeof(esp_bd_addr_t));
+    btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
 }
 
 static void handle_rc_attributes_rsp ( tAVRC_MSG_VENDOR *vendor_msg)

components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -115,6 +115,9 @@ static esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
         case HCI_SUCCESS:
             esp_status = ESP_BT_STATUS_SUCCESS;
             break;
+        case HCI_ERR_ESP_VENDOR_FAIL:
+            esp_status = ESP_BT_STATUS_FAIL;
+            break;
         case HCI_ERR_HOST_TIMEOUT:
             esp_status = ESP_BT_STATUS_TIMEOUT;
             break;
@@ -130,6 +133,9 @@ static esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
         case HCI_ERR_ILLEGAL_PARAMETER_FMT:
             esp_status = ESP_BT_STATUS_ERR_ILLEGAL_PARAMETER_FMT;
             break;
+        case HCI_ERR_MEMORY_FULL:
+            esp_status = ESP_BT_STATUS_MEMORY_FULL;
+            break;
         default:
             esp_status = ESP_BT_STATUS_FAIL;
             break;
@@ -166,6 +172,12 @@ static esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
         case BTM_SET_PRIVACY_FAIL:
             esp_status = ESP_BT_STATUS_FAIL;
             break;
+        case BTM_INVALID_STATIC_RAND_ADDR:
+            esp_status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+            break;
+        case BTM_SET_STATIC_RAND_ADDR_FAIL:
+            esp_status = ESP_BT_STATUS_FAIL;
+            break;
         default:
             esp_status = ESP_BT_STATUS_FAIL;
             break;
@@ -438,7 +450,7 @@ static void btc_ble_set_scan_rsp_data_raw(uint8_t *raw_scan_rsp, uint32_t raw_sc
     BTA_DmBleSetScanRspRaw(raw_scan_rsp, raw_scan_rsp_len, p_scan_rsp_data_cback);
 }
 
-static void btc_start_adv_callback(tBTA_STATUS status)
+static void btc_start_adv_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
@@ -447,7 +459,7 @@ static void btc_start_adv_callback(tBTA_STATUS status)
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_ADV_START_COMPLETE_EVT;
-    param.adv_start_cmpl.status = status;
+    param.adv_start_cmpl.status = btc_hci_to_esp_status(status);
 
     ret = btc_transfer_context(&msg, &param,
                                sizeof(esp_ble_gap_cb_param_t), NULL);
@@ -457,7 +469,7 @@ static void btc_start_adv_callback(tBTA_STATUS status)
     }
 }
 
-static void btc_stop_adv_callback(tBTA_STATUS status)
+static void btc_stop_adv_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
@@ -466,7 +478,7 @@ static void btc_stop_adv_callback(tBTA_STATUS status)
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT;
-    param.adv_stop_cmpl.status = status;
+    param.adv_stop_cmpl.status = btc_hci_to_esp_status(status);
 
     ret = btc_transfer_context(&msg, &param,
                                sizeof(esp_ble_gap_cb_param_t), NULL);
@@ -479,26 +491,43 @@ static void btc_stop_adv_callback(tBTA_STATUS status)
 static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBTA_START_ADV_CMPL_CBACK start_adv_cback)
 {
     tBLE_BD_ADDR peer_addr;
-
+    esp_bt_status_t status = ESP_BT_STATUS_SUCCESS;
     if (!BLE_ISVALID_PARAM(ble_adv_params->adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
             !BLE_ISVALID_PARAM(ble_adv_params->adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+        status = ESP_BT_STATUS_PARM_INVALID;
         LOG_ERROR("Invalid advertisting interval parameters.\n");
-        return ;
     }
 
-    if ((ble_adv_params->adv_type < ADV_TYPE_IND) &&
+    if ((ble_adv_params->adv_type < ADV_TYPE_IND) ||
             (ble_adv_params->adv_type > ADV_TYPE_DIRECT_IND_LOW) ) {
+        status = ESP_BT_STATUS_PARM_INVALID;
         LOG_ERROR("Invalid advertisting type parameters.\n");
-        return;
     }
 
-    if ((ble_adv_params->adv_filter_policy < ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY) &&
+    if ((ble_adv_params->adv_filter_policy < ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY) ||
             (ble_adv_params->adv_filter_policy > ADV_FILTER_ALLOW_SCAN_WLST_CON_WLST) ) {
+        status = ESP_BT_STATUS_PARM_INVALID;
         LOG_ERROR("Invalid advertisting type parameters.\n");
+    }
+
+    if((ble_adv_params->channel_map | ADV_CHNL_ALL) != ADV_CHNL_ALL || ble_adv_params->channel_map == 0) {
+        status = ESP_BT_STATUS_PARM_INVALID;
+        LOG_ERROR("Invalid advertisting channel map parameters.\n");
+    }
+
+    if (!BLE_ISVALID_PARAM(ble_adv_params->peer_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RANDOM)) {
+        status = ESP_BT_STATUS_PARM_INVALID;
+        LOG_ERROR("Invalid advertisting peer address type parameters.\n");
+    }
+
+    if(status != ESP_BT_STATUS_SUCCESS) {
+        if(start_adv_cback) {
+            start_adv_cback(status);
+        }
         return;
     }
-    LOG_DEBUG("API_Ble_AppStartAdvertising\n");
 
+    LOG_DEBUG("API_Ble_AppStartAdvertising\n");
     memcpy(peer_addr.bda, ble_adv_params->peer_addr, ESP_BD_ADDR_LEN);
     peer_addr.type = ble_adv_params->peer_addr_type;
     BTA_DmSetBleAdvParamsAll(ble_adv_params->adv_int_min,
@@ -537,6 +566,7 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA
         BLE_ISVALID_PARAM(scan_params->scan_window, BTM_BLE_SCAN_WIN_MIN, BTM_BLE_SCAN_WIN_MAX) &&
         BLE_ISVALID_PARAM(scan_params->own_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RPA_RANDOM) &&
         BLE_ISVALID_PARAM(scan_params->scan_filter_policy, BLE_SCAN_FILTER_ALLOW_ALL, BLE_SCAN_FILTER_ALLOW_WLIST_PRA_DIR) &&
+        BLE_ISVALID_PARAM(scan_params->scan_duplicate, BLE_SCAN_DUPLICATE_DISABLE, BLE_SCAN_DUPLICATE_MAX -1) &&
         (scan_params->scan_type == BTM_BLE_SCAN_MODE_ACTI || scan_params->scan_type == BTM_BLE_SCAN_MODE_PASS)) {
         BTA_DmSetBleScanFilterParams(ESP_DEFAULT_GATT_IF,	/*client_if*/
                                      scan_params->scan_interval,
@@ -544,10 +574,11 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA
                                      scan_params->scan_type,
                                      scan_params->scan_filter_policy,
                                      scan_params->own_addr_type,
+                                     scan_params->scan_duplicate,
                                      scan_param_setup_cback);
     } else {
-		btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE);
-	}
+        btc_scan_params_callback(ESP_DEFAULT_GATT_IF, BTM_ILLEGAL_VALUE);
+    }
 }
 
 static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
@@ -566,7 +597,7 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
         param.scan_rst.dev_type = p_data->inq_res.device_type;
         param.scan_rst.rssi = p_data->inq_res.rssi;
         param.scan_rst.ble_addr_type = p_data->inq_res.ble_addr_type;
-		param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
+        param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
         param.scan_rst.flag = p_data->inq_res.flag;
         param.scan_rst.num_resps = 1;
         param.scan_rst.adv_data_len = p_data->inq_res.adv_data_len;
@@ -601,7 +632,7 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
     btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), NULL);
 }
 
-static void btc_start_scan_callback(tBTA_STATUS status)
+static void btc_start_scan_callback(uint8_t status)
 {
     esp_ble_gap_cb_param_t param;
     bt_status_t ret;
@@ -688,9 +719,9 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_GAP_BLE;
-    msg.act = ESP_GAP_BLE_ADD_WHITELIST_COMPLETE_EVT;
-    param.add_whitelist_cmpl.status = btc_hci_to_esp_status(status);
-    param.add_whitelist_cmpl.wl_opration = wl_opration;
+    msg.act = ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT;
+    param.update_whitelist_cmpl.status = btc_hci_to_esp_status(status);
+    param.update_whitelist_cmpl.wl_opration = wl_opration;
     ret = btc_transfer_context(&msg, &param,
                                sizeof(esp_ble_gap_cb_param_t), NULL);
 
@@ -699,6 +730,24 @@ static void btc_add_whitelist_complete_callback(UINT8 status, tBTM_WL_OPERATION
     }
 }
 
+static void btc_set_rand_addr_callback(UINT8 status)
+{
+    esp_ble_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+    param.set_rand_addr_cmpl.status = btc_btm_status_to_esp_status(status); //todo status
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT;
+    ret = btc_transfer_context(&msg, &param,
+                               sizeof(esp_ble_gap_cb_param_t), NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        LOG_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+
+}
+
 static void btc_set_local_privacy_callback(UINT8 status)
 {
     esp_ble_gap_cb_param_t param;
@@ -806,13 +855,8 @@ static void btc_ble_set_pkt_data_len(BD_ADDR remote_device, uint16_t tx_data_len
     BTA_DmBleSetDataLength(remote_device, tx_data_length, p_set_pkt_data_cback);
 }
 
-static void btc_ble_set_rand_addr (BD_ADDR rand_addr)
+static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *p_set_rand_addr_cback)
 {
-    esp_ble_gap_cb_param_t param;
-    bt_status_t ret;
-    btc_msg_t msg;
-    param.set_rand_addr_cmpl.status = ESP_BT_STATUS_SUCCESS;
-
     if (rand_addr != NULL) {
         /*
         A static address is a 48-bit randomly generated address and shall meet the following requirements:
@@ -827,25 +871,15 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr)
         if((rand_addr[0] & BT_STATIC_RAND_ADDR_MASK) == BT_STATIC_RAND_ADDR_MASK
             && memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0
             && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0){
-            BTA_DmSetRandAddress(rand_addr);
+            BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
         } else {
-            param.set_rand_addr_cmpl.status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+            btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
             LOG_ERROR("Invalid random address, the high bit should be 0b11, all bits of the random part shall not be to 1 or 0");
         }
     } else {
-        param.set_rand_addr_cmpl.status = ESP_BT_STATUS_INVALID_STATIC_RAND_ADDR;
+        btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
         LOG_ERROR("Invalid random addressm, the address value is NULL");
     }
-
-    msg.sig = BTC_SIG_API_CB;
-    msg.pid = BTC_PID_GAP_BLE;
-    msg.act = ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT;
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_ble_gap_cb_param_t), NULL);
-
-    if (ret != BT_STATUS_SUCCESS) {
-        LOG_ERROR("%s btc_transfer_context failed\n", __func__);
-    }
 }
 
 static void btc_ble_config_local_privacy(bool privacy_enable, tBTA_SET_LOCAL_PRIVACY_CBACK *set_local_privacy_cback)
@@ -983,6 +1017,13 @@ void btc_gap_ble_arg_deep_free(btc_msg_t *msg)
         }
         break;
     }
+    case BTC_GAP_BLE_SET_SECURITY_PARAM_EVT: {
+        uint8_t *value = ((btc_ble_gap_args_t *)msg->arg)->set_security_param.value;
+        if (value) {
+            osi_free(value);
+        }
+        break;
+    }
     default:
         LOG_DEBUG("Unhandled deep free %d\n", msg->act);
         break;
@@ -1042,12 +1083,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
     case BTC_GAP_BLE_ACT_SET_RAND_ADDRESS: {
         BD_ADDR bd_addr;
         memcpy(bd_addr, arg->set_rand_addr.rand_addr, sizeof(BD_ADDR));
-        btc_ble_set_rand_addr(bd_addr);
+        btc_ble_set_rand_addr(bd_addr, btc_set_rand_addr_callback);
         break;
     }
     case BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY:
         btc_ble_config_local_privacy(arg->cfg_local_privacy.privacy_enable, btc_set_local_privacy_callback);
-        break;    
+        break;
     case BTC_GAP_BLE_ACT_UPDATE_WHITE_LIST:
         BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, btc_add_whitelist_complete_callback);
         break;
@@ -1081,44 +1122,45 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
         break;
     }
     case BTC_GAP_BLE_SET_SECURITY_PARAM_EVT: {
+        uint8_t *value = arg->set_security_param.value;
         switch(arg->set_security_param.param_type) {
             case ESP_BLE_SM_PASSKEY:
                 break;
             case ESP_BLE_SM_AUTHEN_REQ_MODE: {
                 uint8_t authen_req = 0;
-                STREAM_TO_UINT8(authen_req, arg->set_security_param.value);
+                STREAM_TO_UINT8(authen_req, value);
                 bta_dm_co_ble_set_auth_req(authen_req);
                 break;
             }
             case ESP_BLE_SM_IOCAP_MODE: {
                 uint8_t iocap = 0;
-                STREAM_TO_UINT8(iocap, arg->set_security_param.value);
+                STREAM_TO_UINT8(iocap, value);
                 bta_dm_co_ble_set_io_cap(iocap);
                 break;
             }
             case ESP_BLE_SM_SET_INIT_KEY: {
                 uint8_t init_key = 0;
-                STREAM_TO_UINT8(init_key, arg->set_security_param.value);
+                STREAM_TO_UINT8(init_key, value);
                 bta_dm_co_ble_set_init_key_req(init_key);
                 break;
             }
             case ESP_BLE_SM_SET_RSP_KEY: {
                 uint8_t rsp_key = 0;
-                STREAM_TO_UINT8(rsp_key, arg->set_security_param.value);
+                STREAM_TO_UINT8(rsp_key, value);
                 bta_dm_co_ble_set_rsp_key_req(rsp_key);
                 break;
             }
             case ESP_BLE_SM_MAX_KEY_SIZE: {
                 uint8_t key_size = 0;
-                STREAM_TO_UINT8(key_size, arg->set_security_param.value);
+                STREAM_TO_UINT8(key_size, value);
                 bta_dm_co_ble_set_max_key_size(key_size);
                 break;
-            }        
+            }
             default:
                 break;
         }
         break;
-    }        
+    }
     case BTC_GAP_BLE_SECURITY_RSP_EVT: {
         BD_ADDR bd_addr;
         tBTA_DM_BLE_SEC_GRANT res = arg->sec_rsp.accept ? BTA_DM_SEC_GRANTED : BTA_DM_SEC_PAIR_NOT_SPT;

components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -196,7 +196,7 @@ static void btc_gattc_app_unregister(btc_ble_gattc_args_t *arg)
 static void btc_gattc_open(btc_ble_gattc_args_t *arg)
 {
     tBTA_GATT_TRANSPORT transport = BTA_GATT_TRANSPORT_LE;
-    BTA_GATTC_Open(arg->open.gattc_if, arg->open.remote_bda, arg->open.is_direct, transport);
+    BTA_GATTC_Open(arg->open.gattc_if, arg->open.remote_bda, arg->open.remote_addr_type, arg->open.is_direct, transport);
 }
 
 static void btc_gattc_close(btc_ble_gattc_args_t *arg)
@@ -671,7 +671,7 @@ void btc_gattc_call_handler(btc_msg_t *msg)
     btc_ble_gattc_args_t *arg = (btc_ble_gattc_args_t *)(msg->arg);
     switch (msg->act) {
     case BTC_GATTC_ACT_APP_REGISTER:
-        LOG_ERROR("%s()", __func__);
+        LOG_DEBUG("%s()", __func__);
         btc_gattc_app_register(arg);
         break;
     case BTC_GATTC_ACT_APP_UNREGISTER:
@@ -914,8 +914,10 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
         break;
     }
     case BTA_GATTC_SRVC_CHG_EVT: {
-        memcpy(param.srvc_chg.remote_bda, arg->remote_bda, sizeof(esp_bd_addr_t));
-        btc_gattc_cb_to_app(ESP_GATTC_SRVC_CHG_EVT, ESP_GATT_IF_NONE, &param);
+        tBTA_GATTC_SERVICE_CHANGE *srvc_change = &arg->srvc_chg;
+        gattc_if = BTC_GATT_GET_GATT_IF(srvc_change->conn_id);
+        memcpy(param.srvc_chg.remote_bda, srvc_change->remote_bda, sizeof(esp_bd_addr_t));
+        btc_gattc_cb_to_app(ESP_GATTC_SRVC_CHG_EVT, gattc_if, &param);
         break;
     }
     case BTA_GATTC_QUEUE_FULL_EVT: {

components/bt/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -506,6 +506,8 @@ static void btc_gatts_cb_param_copy_req(btc_msg_t *msg, void *p_dest, void *p_sr
         if (p_dest_data->req_data.p_data != NULL) {
             memcpy(p_dest_data->req_data.p_data, p_src_data->req_data.p_data,
                    sizeof(tBTA_GATTS_REQ_DATA));
+        } else {
+            LOG_ERROR("%s %d no mem\n", __func__, msg->act);
         }
         break;
 
@@ -528,9 +530,6 @@ static void btc_gatts_cb_param_copy_free(btc_msg_t *msg, tBTA_GATTS *p_data)
         }
         break;
     case BTA_GATTS_CONF_EVT:
-        if (p_data && p_data->req_data.value){
-            osi_free(p_data->req_data.value);
-        }
         break;
     default:
         break;
@@ -759,6 +758,9 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
         param.write.conn_id = BTC_GATT_GET_CONN_ID(p_data->req_data.conn_id);
         param.write.trans_id = p_data->req_data.trans_id;
         memcpy(param.write.bda, p_data->req_data.remote_bda, ESP_BD_ADDR_LEN);
+        if (p_data->req_data.p_data == NULL) {
+            break;
+        }
         param.write.handle = p_data->req_data.p_data->write_req.handle;
         param.write.offset = p_data->req_data.p_data->write_req.offset;
         param.write.need_rsp = p_data->req_data.p_data->write_req.need_rsp;
@@ -775,6 +777,9 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
         param.exec_write.conn_id = BTC_GATT_GET_CONN_ID(p_data->req_data.conn_id);
         param.exec_write.trans_id = p_data->req_data.trans_id;
         memcpy(param.exec_write.bda, p_data->req_data.remote_bda, ESP_BD_ADDR_LEN);
+        if (p_data->req_data.p_data == NULL) {
+            break;
+        }
         param.exec_write.exec_write_flag = p_data->req_data.p_data->exec_write;
 
         btc_gatts_cb_to_app(ESP_GATTS_EXEC_WRITE_EVT, gatts_if, &param);
@@ -832,7 +837,7 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
         param.add_char_descr.status = p_data->add_result.status;
         param.add_char_descr.attr_handle = p_data->add_result.attr_id;
         param.add_char_descr.service_handle = p_data->add_result.service_id;
-        bta_to_btc_uuid(&param.add_char_descr.char_uuid, &p_data->add_result.char_uuid);
+        bta_to_btc_uuid(&param.add_char_descr.descr_uuid, &p_data->add_result.char_uuid);
 
         btc_gatts_cb_to_app(ESP_GATTS_ADD_CHAR_DESCR_EVT, gatts_if, &param);
         break;

components/bt/bluedroid/btc/profile/std/include/btc_avrc.h

@@ -28,14 +28,6 @@
 #define BTC_AVRC_TGT_INCLUDED      FALSE
 #endif
 
-/* Macros */
-typedef enum {
-    BTRC_FEAT_NONE = 0x00,    /* AVRCP 1.0 */
-    BTRC_FEAT_METADATA = 0x01,    /* AVRCP 1.3 */
-    BTRC_FEAT_ABSOLUTE_VOLUME = 0x02,    /* Supports TG role and volume sync */
-    BTRC_FEAT_BROWSE = 0x04,    /* AVRCP 1.4 and up, with Browsing support */
-} btrc_remote_features_t;
-
 typedef enum {
     BTC_AVRC_CTRL_API_INIT_EVT = 0,
     BTC_AVRC_CTRL_API_DEINIT_EVT,

components/bt/bluedroid/btc/profile/std/include/btc_gattc.h

@@ -54,6 +54,7 @@ typedef union {
     struct open_arg {
         esp_gatt_if_t gattc_if;
         esp_bd_addr_t remote_bda;
+        esp_ble_addr_type_t remote_addr_type;
         bool is_direct;
     } open;
     //BTC_GATTC_ACT_CLOSE,

components/bt/bluedroid/btcore/bdaddr.c

@@ -102,10 +102,13 @@ bool string_to_bdaddr(const char *string, bt_bdaddr_t *addr)
 
     bt_bdaddr_t new_addr;
     uint8_t *ptr = new_addr.address;
-    bool ret = sscanf(string, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
-                      &ptr[0], &ptr[1], &ptr[2], &ptr[3], &ptr[4], &ptr[5]) == 6;
-
+    uint32_t ptr_32[6];
+    bool ret  = sscanf(string, "%02x:%02x:%02x:%02x:%02x:%02x",
+                      &ptr_32[0], &ptr_32[1], &ptr_32[2], &ptr_32[3], &ptr_32[4], &ptr_32[5]) == 6;
     if (ret) {
+        for (uint8_t i = 0; i < 6; i++){
+            ptr[i] = (uint8_t) ptr_32[i];
+        }
         memcpy(addr, &new_addr, sizeof(bt_bdaddr_t));
     }
 

components/bt/bluedroid/btif/bta_dm_co.c

@@ -492,7 +492,7 @@ void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key)
 {
 #if (SMP_INCLUDED == TRUE)
    rsp_key &= 0x0f;  // 4~7bit reservd, only used the 0~3bit
-   bte_appl_cfg.ble_init_key &= rsp_key;
+   bte_appl_cfg.ble_resp_key &= rsp_key;
 #endif  ///SMP_INCLUDED == TRUE
 }
 

components/bt/bluedroid/device/controller.c

@@ -66,6 +66,7 @@ static uint8_t ble_resolving_list_max_size;
 static uint8_t ble_supported_states[BLE_SUPPORTED_STATES_SIZE];
 static bt_device_features_t features_ble;
 static uint16_t ble_suggested_default_data_length;
+static uint16_t ble_suggested_default_data_txtime;
 
 static bool readable;
 static bool ble_supported;
@@ -228,7 +229,8 @@ static void start_up(void)
             response = AWAIT_COMMAND(packet_factory->make_ble_read_suggested_default_data_length());
             packet_parser->parse_ble_read_suggested_default_data_length_response(
                 response,
-                &ble_suggested_default_data_length);
+                &ble_suggested_default_data_length,
+                &ble_suggested_default_data_txtime);
         }
 
         // Set the ble event mask next
@@ -404,6 +406,13 @@ static uint16_t get_ble_suggested_default_data_length(void)
     return ble_suggested_default_data_length;
 }
 
+static uint16_t get_ble_suggested_default_data_txtime(void)
+{
+    assert(readable);
+    assert(ble_supported);
+    return ble_suggested_default_data_txtime;
+}
+
 static uint16_t get_acl_buffer_count_classic(void)
 {
     assert(readable);
@@ -472,6 +481,7 @@ static const controller_t interface = {
     get_acl_packet_size_classic,
     get_acl_packet_size_ble,
     get_ble_suggested_default_data_length,
+    get_ble_suggested_default_data_txtime,
 
     get_acl_buffer_count_classic,
     get_acl_buffer_count_ble,

components/bt/bluedroid/device/include/controller.h

@@ -69,6 +69,7 @@ typedef struct controller_t {
     uint16_t (*get_acl_packet_size_ble)(void);
 
     uint16_t (*get_ble_default_data_packet_length)(void);
+    uint16_t (*get_ble_default_data_packet_txtime)(void);
 
     // Get the number of acl packets the controller can buffer.
     uint16_t (*get_acl_buffer_count_classic)(void);

components/bt/bluedroid/hci/hci_hal_h4.c

@@ -25,7 +25,7 @@
 #include "hci_internals.h"
 #include "hci_layer.h"
 #include "thread.h"
-#include "bt.h"
+#include "esp_bt.h"
 
 #define HCI_HAL_SERIAL_BUFFER_SIZE 1026
 #define HCI_BLE_EVENT 0x3e
@@ -92,6 +92,7 @@ static void hci_hal_env_init(
 static void hci_hal_env_deinit(void)
 {
     fixed_queue_free(hci_hal_env.rx_q, hci_hal_env.allocator->free);
+    hci_hal_env.rx_q = NULL;
 }
 
 static bool hal_open(const hci_hal_callbacks_t *upper_callbacks)
@@ -260,6 +261,10 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
     BT_HDR *pkt;
     size_t pkt_size;
 
+    if (hci_hal_env.rx_q == NULL) {
+        return 0;
+    }
+
     pkt_size = BT_HDR_SIZE + len;
     pkt = (BT_HDR *)hci_hal_env.allocator->alloc(pkt_size);
     if (!pkt) {

components/bt/bluedroid/hci/hci_layer.c

@@ -16,7 +16,7 @@
  *
  ******************************************************************************/
 #include <string.h>
-#include "bt.h"
+#include "esp_bt.h"
 #include "bt_defs.h"
 #include "bt_trace.h"
 #include "hcidefs.h"

components/bt/bluedroid/hci/hci_packet_parser.c

@@ -183,12 +183,13 @@ static void parse_ble_read_resolving_list_size_response(
 
 static void parse_ble_read_suggested_default_data_length_response(
     BT_HDR *response,
-    uint16_t *ble_default_packet_length_ptr)
+    uint16_t *ble_default_packet_length_ptr,
+    uint16_t *ble_default_packet_txtime_ptr)
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
-    STREAM_TO_UINT8(*ble_default_packet_length_ptr, stream);
-
+    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
+    STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
     buffer_allocator->free(response);
 }
 

components/bt/bluedroid/hci/include/hci_packet_parser.h

@@ -90,7 +90,8 @@ typedef struct {
 
     void (*parse_ble_read_suggested_default_data_length_response)(
         BT_HDR *response,
-        uint16_t *ble_default_packet_length_ptr
+        uint16_t *ble_default_packet_length_ptr,
+        uint16_t *ble_default_packet_txtime_ptr
     );
 } hci_packet_parser_t;
 

components/bt/bluedroid/include/bt_defs.h

@@ -90,6 +90,7 @@ typedef enum {
     BT_STATUS_UNACCEPT_CONN_INTERVAL,
     BT_STATUS_PARAM_OUT_OF_RANGE,
     BT_STATUS_TIMEOUT,
+    BT_STATUS_MEMORY_FULL,
 } bt_status_t;
 
 #ifndef CPU_LITTLE_ENDIAN

components/bt/bluedroid/include/bt_target.h

@@ -647,7 +647,8 @@
 
 /* 4.1/4.2 secure connections feature */
 #ifndef SC_MODE_INCLUDED
-#define SC_MODE_INCLUDED                TRUE
+// Disable AES-CCM (BT 4.1) for BT Classic to workaround controller AES issue. E0 encryption (BT 4.0) will be used.
+#define SC_MODE_INCLUDED                FALSE
 #endif
 
 /* Used for conformance testing ONLY */

components/bt/bluedroid/osi/alarm.c

@@ -67,11 +67,11 @@ int osi_alarm_delete_mux(void)
     osi_mutex_free(&alarm_mutex);
     return 0;
 }
-    
+
 void osi_alarm_init(void)
 {
     assert(alarm_mutex != NULL);
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_IDLE) {
         LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
@@ -79,7 +79,7 @@ void osi_alarm_init(void)
     }
     memset(alarm_cbs, 0x00, sizeof(alarm_cbs));
     alarm_state = ALARM_STATE_OPEN;
-    
+
 end:
     osi_mutex_unlock(&alarm_mutex);
 }
@@ -87,13 +87,13 @@ end:
 void osi_alarm_deinit(void)
 {
     assert(alarm_mutex != NULL);
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
         goto end;
     }
-    
+
     for (int i = 0; i < ALARM_CBS_NUM; i++) {
         if (alarm_cbs[i].alarm_hdl != NULL) {
             alarm_free(&alarm_cbs[i]);
@@ -122,6 +122,10 @@ static struct alarm_t *alarm_cbs_lookfor_available(void)
 static void alarm_cb_handler(struct alarm_t *alarm)
 {
     LOG_DEBUG("TimerID %p\n", alarm);
+    if (alarm_state != ALARM_STATE_OPEN) {
+        LOG_WARN("%s, invalid state %d\n", __func__, alarm_state);
+        return;
+    }
     btc_msg_t msg;
     btc_alarm_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
@@ -136,14 +140,14 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
     assert(alarm_mutex != NULL);
 
     struct alarm_t *timer_id = NULL;
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
         timer_id = NULL;
         goto end;
     }
-    
+
     timer_id = alarm_cbs_lookfor_available();
 
     if (!timer_id) {
@@ -161,7 +165,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
     timer_id->cb = callback;
     timer_id->cb_data = data;
     timer_id->deadline_us = 0;
-    
+
     esp_err_t stat = esp_timer_create(&tca, &timer_id->alarm_hdl);
     if (stat != ESP_OK) {
         LOG_ERROR("%s failed to create timer, err 0x%x\n", __func__, stat);
@@ -181,12 +185,13 @@ static osi_alarm_err_t alarm_free(osi_alarm_t *alarm)
         return OSI_ALARM_ERR_INVALID_ARG;
     }
 
+    esp_timer_stop(alarm->alarm_hdl);
     esp_err_t stat = esp_timer_delete(alarm->alarm_hdl);
     if (stat != ESP_OK) {
         LOG_ERROR("%s failed to delete timer, err 0x%x\n", __func__, stat);
         return OSI_ALARM_ERR_FAIL;
     }
-    
+
     memset(alarm, 0, sizeof(osi_alarm_t));
     return OSI_ALARM_ERR_PASS;
 }
@@ -194,7 +199,7 @@ static osi_alarm_err_t alarm_free(osi_alarm_t *alarm)
 void osi_alarm_free(osi_alarm_t *alarm)
 {
     assert(alarm_mutex != NULL);
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
         LOG_ERROR("%s, invalid state %d\n", __func__, alarm_state);
@@ -210,7 +215,7 @@ end:
 osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
 {
     assert(alarm_mutex != NULL);
-    
+
     osi_alarm_err_t ret = OSI_ALARM_ERR_PASS;
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     if (alarm_state != ALARM_STATE_OPEN) {
@@ -218,7 +223,7 @@ osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
         ret = OSI_ALARM_ERR_INVALID_STATE;
         goto end;
     }
-    
+
     if (!alarm || alarm->alarm_hdl == NULL) {
         LOG_ERROR("%s null\n", __func__);
         ret = OSI_ALARM_ERR_INVALID_ARG;
@@ -233,7 +238,7 @@ osi_alarm_err_t osi_alarm_set(osi_alarm_t *alarm, period_ms_t timeout)
         goto end;
     }
     alarm->deadline_us = timeout_us + esp_timer_get_time();
-    
+
 end:
     osi_mutex_unlock(&alarm_mutex);
     return ret;
@@ -248,7 +253,7 @@ osi_alarm_err_t osi_alarm_cancel(osi_alarm_t *alarm)
         ret = OSI_ALARM_ERR_INVALID_STATE;
         goto end;
     }
-    
+
     if (!alarm || alarm->alarm_hdl == NULL) {
         LOG_ERROR("%s null\n", __func__);
         ret = OSI_ALARM_ERR_INVALID_ARG;
@@ -270,7 +275,7 @@ period_ms_t osi_alarm_get_remaining_ms(const osi_alarm_t *alarm)
 {
     assert(alarm_mutex != NULL);
     int64_t dt_us = 0;
-    
+
     osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
     dt_us = alarm->deadline_us - esp_timer_get_time();
     osi_mutex_unlock(&alarm_mutex);

components/bt/bluedroid/osi/config.c

@@ -28,8 +28,9 @@
 #include "list.h"
 #include "bt_trace.h"
 
-#define CONFIG_FILE_MAX_SIZE      (2048)
-#define CONFIG_KEY                "bt_cfg_key"
+#define CONFIG_FILE_MAX_SIZE             (1536)//1.5k
+#define CONFIG_FILE_DEFAULE_LENGTH       (2048)
+#define CONFIG_KEY                       "bt_cfg_key"
 typedef struct {
     char *key;
     char *value;
@@ -134,7 +135,7 @@ bool config_has_key(const config_t *config, const char *section, const char *key
 }
 
 bool config_has_key_in_section(config_t *config, char *key, char *key_value)
-{
+{
     LOG_DEBUG("key = %s, value = %s", key, key_value);
     for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
         const section_t *section = (const section_t *)list_node(node);
@@ -302,6 +303,78 @@ const char *config_section_name(const config_section_node_t *node)
     return section->name;
 }
 
+static int get_config_size(const config_t *config)
+{
+    assert(config != NULL);
+
+    int w_len = 0, total_size = 0;
+
+    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
+        const section_t *section = (const section_t *)list_node(node);
+        w_len = strlen(section->name) + strlen("[]\n");// format "[section->name]\n"
+        total_size += w_len;
+
+        for (const list_node_t *enode = list_begin(section->entries); enode != list_end(section->entries); enode = list_next(enode)) {
+            const entry_t *entry = (const entry_t *)list_node(enode);
+            w_len = strlen(entry->key) + strlen(entry->value) + strlen(" = \n");// format "entry->key = entry->value\n"
+            total_size += w_len;
+        }
+
+        // Only add a separating newline if there are more sections.
+        if (list_next(node) != list_end(config->sections)) {
+                total_size ++;  //'\n'
+        } else {
+            break;
+        }
+    }
+    total_size ++; //'\0'
+    return total_size;
+}
+
+static int get_config_size_from_flash(nvs_handle fp)
+{
+    assert(fp != 0);
+
+    esp_err_t err;
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    if (!keyname){
+        LOG_ERROR("%s, malloc error\n", __func__);
+        return 0;
+    }
+    size_t length = CONFIG_FILE_DEFAULE_LENGTH;
+    size_t total_length = 0;
+    uint16_t i = 0;
+    snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, 0);
+    err = nvs_get_blob(fp, keyname, NULL, &length);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        osi_free(keyname);
+        return 0;
+    }
+    if (err != ESP_OK) {
+        LOG_ERROR("%s, error %d\n", __func__, err);
+        osi_free(keyname);
+        return 0;
+    }
+    total_length += length;
+    while (length == CONFIG_FILE_MAX_SIZE) {
+        length = CONFIG_FILE_DEFAULE_LENGTH;
+        snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, ++i);
+        err = nvs_get_blob(fp, keyname, NULL, &length);
+
+        if (err == ESP_ERR_NVS_NOT_FOUND) {
+            break;
+        }
+        if (err != ESP_OK) {
+            LOG_ERROR("%s, error %d\n", __func__, err);
+            osi_free(keyname);
+            return 0;
+        }
+        total_length += length;
+    }
+    osi_free(keyname);
+    return total_length;
+}
+
 bool config_save(const config_t *config, const char *filename)
 {
     assert(config != NULL);
@@ -312,8 +385,10 @@ bool config_save(const config_t *config, const char *filename)
     int err_code = 0;
     nvs_handle fp;
     char *line = osi_calloc(1024);
-    char *buf = osi_calloc(CONFIG_FILE_MAX_SIZE);
-    if (!line || !buf) {
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    int config_size = get_config_size(config);
+    char *buf = osi_calloc(config_size + 100);
+    if (!line || !buf || !keyname) {
         err_code |= 0x01;
         goto error;
     }
@@ -333,45 +408,53 @@ bool config_save(const config_t *config, const char *filename)
         const section_t *section = (const section_t *)list_node(node);
         w_cnt = snprintf(line, 1024, "[%s]\n", section->name);
         LOG_DEBUG("section name: %s, w_cnt + w_cnt_total = %d\n", section->name, w_cnt + w_cnt_total);
-        if (w_cnt + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-            memcpy(buf + w_cnt_total, line, w_cnt);
-            w_cnt_total += w_cnt;
-        } else {
-            break;
-        }
+        memcpy(buf + w_cnt_total, line, w_cnt);
+        w_cnt_total += w_cnt;
 
         for (const list_node_t *enode = list_begin(section->entries); enode != list_end(section->entries); enode = list_next(enode)) {
             const entry_t *entry = (const entry_t *)list_node(enode);
             LOG_DEBUG("(key, val): (%s, %s)\n", entry->key, entry->value);
             w_cnt = snprintf(line, 1024, "%s = %s\n", entry->key, entry->value);
             LOG_DEBUG("%s, w_cnt + w_cnt_total = %d", __func__, w_cnt + w_cnt_total);
-            if (w_cnt + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-                memcpy(buf + w_cnt_total, line, w_cnt);
-                w_cnt_total += w_cnt;
-            } else {
-                break;
-            }
+            memcpy(buf + w_cnt_total, line, w_cnt);
+            w_cnt_total += w_cnt;
         }
 
         // Only add a separating newline if there are more sections.
         if (list_next(node) != list_end(config->sections)) {
-            if (1 + w_cnt_total < CONFIG_FILE_MAX_SIZE) {
-                buf[w_cnt_total] = '\n';
-                w_cnt_total += 1;
-            }
+            buf[w_cnt_total] = '\n';
+            w_cnt_total += 1;
         } else {
             break;
         }
     }
-
     buf[w_cnt_total] = '\0';
-
-    err = nvs_set_blob(fp, CONFIG_KEY, buf, w_cnt_total);
-
-    if (err != ESP_OK) {
-        nvs_close(fp);
-        err_code |= 0x04;
-        goto error;
+    if (w_cnt_total < CONFIG_FILE_MAX_SIZE) {
+        snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, 0);
+        err = nvs_set_blob(fp, keyname, buf, w_cnt_total);
+        if (err != ESP_OK) {
+            nvs_close(fp);
+            err_code |= 0x04;
+            goto error;
+        }
+    }else {
+        uint count = (w_cnt_total / CONFIG_FILE_MAX_SIZE);
+        for (int i = 0; i <= count; i++)
+        {
+            snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, i);
+            if (i == count) {
+                err = nvs_set_blob(fp, keyname, buf + i*CONFIG_FILE_MAX_SIZE, w_cnt_total - i*CONFIG_FILE_MAX_SIZE);
+                LOG_DEBUG("save keyname = %s, i = %d, %d\n", keyname, i, w_cnt_total - i*CONFIG_FILE_MAX_SIZE);
+            }else {
+                err = nvs_set_blob(fp, keyname, buf + i*CONFIG_FILE_MAX_SIZE, CONFIG_FILE_MAX_SIZE);
+                LOG_DEBUG("save keyname = %s, i = %d, %d\n", keyname, i, CONFIG_FILE_MAX_SIZE);
+            }
+            if (err != ESP_OK) {
+                nvs_close(fp);
+                err_code |= 0x04;
+                goto error;
+            }
+        }
     }
 
     err = nvs_commit(fp);
@@ -384,6 +467,7 @@ bool config_save(const config_t *config, const char *filename)
     nvs_close(fp);
     osi_free(line);
     osi_free(buf);
+    osi_free(keyname);
     return true;
 
 error:
@@ -393,6 +477,9 @@ error:
     if (line) {
         osi_free(line);
     }
+    if (keyname) {
+        osi_free(keyname);
+    }
     if (err_code) {
         LOG_ERROR("%s, err_code: 0x%x\n", __func__, err_code);
     }
@@ -423,29 +510,50 @@ static void config_parse(nvs_handle fp, config_t *config)
     assert(fp != 0);
     assert(config != NULL);
 
+    esp_err_t err;
     int line_num = 0;
     int err_code = 0;
+    uint16_t i = 0;
+    size_t length = CONFIG_FILE_DEFAULE_LENGTH;
+    size_t total_length = 0;
     char *line = osi_calloc(1024);
     char *section = osi_calloc(1024);
-    char *buf = osi_calloc(CONFIG_FILE_MAX_SIZE);
-    if (!line || !section || !buf) {
+    char *keyname = osi_calloc(sizeof(CONFIG_KEY) + 1);
+    int buf_size = get_config_size_from_flash(fp);
+    char *buf = osi_calloc(buf_size + 100);
+    if (!line || !section || !buf || !keyname) {
         err_code |= 0x01;
         goto error;
     }
-
-    esp_err_t err;
-    size_t length = CONFIG_FILE_MAX_SIZE;
-    err = nvs_get_blob(fp, CONFIG_KEY, buf, &length);
+    snprintf(keyname, sizeof(CONFIG_KEY)+1, "%s%d", CONFIG_KEY, 0);
+    err = nvs_get_blob(fp, keyname, buf, &length);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        goto error;
+    }
     if (err != ESP_OK) {
         err_code |= 0x02;
         goto error;
     }
+    total_length += length;
+    while (length == CONFIG_FILE_MAX_SIZE) {
+        length = CONFIG_FILE_DEFAULE_LENGTH;
+        snprintf(keyname, sizeof(CONFIG_KEY) + 1, "%s%d", CONFIG_KEY, ++i);
+        err = nvs_get_blob(fp, keyname, buf + CONFIG_FILE_MAX_SIZE * i, &length);
 
+        if (err == ESP_ERR_NVS_NOT_FOUND) {
+            break;
+        }
+        if (err != ESP_OK) {
+            err_code |= 0x02;
+            goto error;
+        }
+        total_length += length;
+    }
     char *p_line_end;
     char *p_line_bgn = buf;
     strcpy(section, CONFIG_DEFAULT_SECTION);
 
-    while ( (p_line_bgn < buf + length - 1) && (p_line_end = strchr(p_line_bgn, '\n'))) {
+    while ( (p_line_bgn < buf + total_length - 1) && (p_line_end = strchr(p_line_bgn, '\n'))) {
 
         // get one line
         int line_len = p_line_end - p_line_bgn;
@@ -493,6 +601,9 @@ error:
     if (section) {
         osi_free(section);
     }
+    if (keyname) {
+        osi_free(keyname);
+    }
     if (err_code) {
         LOG_ERROR("%s returned with err code: %d\n", __func__, err_code);
     }

components/bt/bluedroid/osi/include/thread.h

@@ -83,13 +83,14 @@ typedef enum {
 #define BTC_TASK_PRIO                   (configMAX_PRIORITIES - 6)
 #define BTC_TASK_QUEUE_LEN              60
 
-#define BTC_MEDIA_TASK_PINNED_TO_CORE   (TASK_PINNED_TO_CORE)
-#define BTC_MEDIA_TASK_STACK_SIZE       (CONFIG_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)
-#define BTC_MEDIA_TASK_NAME             "BtcMediaT"
-#define BTC_MEDIA_TASK_PRIO             (configMAX_PRIORITIES - 3)
-#define BTC_MEDIA_DATA_QUEUE_LEN        (1)
-#define BTC_MEDIA_CTRL_QUEUE_LEN        (5)
-#define BTC_MEDIA_TASK_QUEUE_SET_LEN    (BTC_MEDIA_DATA_QUEUE_LEN + BTC_MEDIA_CTRL_QUEUE_LEN)
+#define BTC_A2DP_SINK_TASK_PINNED_TO_CORE     (TASK_PINNED_TO_CORE)
+#define BTC_A2DP_SINK_TASK_STACK_SIZE         (CONFIG_A2DP_SINK_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE) // by menuconfig
+#define BTC_A2DP_SINK_TASK_NAME               "BtA2dSinkT"
+#define BTC_A2DP_SINK_TASK_PRIO               (configMAX_PRIORITIES - 3)
+#define BTC_A2DP_SINK_DATA_QUEUE_LEN          (1)
+#define BTC_A2DP_SINK_CTRL_QUEUE_LEN          (5)
+#define BTC_A2DP_SINK_TASK_QUEUE_SET_LEN      (BTC_A2DP_SINK_DATA_QUEUE_LEN + BTC_A2DP_SINK_CTRL_QUEUE_LEN)
+
 
 #define TASK_POST_NON_BLOCKING          (0)
 #define TASK_POST_BLOCKING              (portMAX_DELAY)

components/bt/bluedroid/stack/avdt/avdt_ccb.c

@@ -407,7 +407,7 @@ void avdt_ccb_dealloc(tAVDT_CCB *p_ccb, tAVDT_CCB_EVT *p_data)
     UNUSED(p_data);
 
     AVDT_TRACE_DEBUG("avdt_ccb_dealloc %d\n", avdt_ccb_to_idx(p_ccb));
-    btu_stop_timer(&p_ccb->timer_entry);
+    btu_free_timer(&p_ccb->timer_entry);
     fixed_queue_free(p_ccb->cmd_q, NULL);
     fixed_queue_free(p_ccb->rsp_q, NULL);
     memset(p_ccb, 0, sizeof(tAVDT_CCB));

components/bt/bluedroid/stack/avdt/avdt_l2c.c

@@ -412,6 +412,7 @@ void avdt_l2c_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed)
 {
     tAVDT_TC_TBL    *p_tbl;
     UINT16          disc_rsn = AVDT_DISC_RSN_NORMAL;
+    tAVDT_CCB       *p_ccb;
     AVDT_TRACE_DEBUG("avdt_l2c_disconnect_ind_cback lcid: %d, ack_needed: %d\n",
                      lcid, ack_needed);
     /* look up info for this channel */
@@ -420,7 +421,13 @@ void avdt_l2c_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed)
             /* send L2CAP disconnect response */
             L2CA_DisconnectRsp(lcid);
         } else {
-            disc_rsn = AVDT_DISC_RSN_ABNORMAL;
+            if ((p_ccb = avdt_ccb_by_idx(p_tbl->ccb_idx)) != NULL) {
+                UINT16 rsn = L2CA_GetDisconnectReason(p_ccb->peer_addr, BT_TRANSPORT_BR_EDR);
+                if (rsn != 0 && rsn != HCI_ERR_PEER_USER) {
+                    disc_rsn = AVDT_DISC_RSN_ABNORMAL;
+                    AVDT_TRACE_EVENT("avdt link disc rsn 0x%x", rsn);
+                }
+            }
         }
 
         avdt_ad_tc_close_ind(p_tbl, disc_rsn);

components/bt/bluedroid/stack/avdt/avdt_scb.c

@@ -644,7 +644,7 @@ void avdt_scb_dealloc(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
     UNUSED(p_data);
 
     AVDT_TRACE_DEBUG("avdt_scb_dealloc hdl=%d\n", avdt_scb_to_hdl(p_scb));
-    btu_stop_timer(&p_scb->timer_entry);
+    btu_free_timer(&p_scb->timer_entry);
 
 #if AVDT_MULTIPLEXING == TRUE
     /* free fragments we're holding, if any; it shouldn't happen */

components/bt/bluedroid/stack/btm/btm_acl.c

@@ -335,7 +335,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
                     btsnd_hcic_ble_read_remote_feat(p->hci_handle);
                 } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
                          && link_role == HCI_ROLE_SLAVE) {
-                    btsnd_hcic_ble_read_remote_feat(p->hci_handle);
+                    btsnd_hcic_rmt_ver_req (p->hci_handle);
                 } else {
                     btm_establish_continue(p);
                 }
@@ -906,7 +906,17 @@ void btm_read_remote_version_complete (UINT8 *p)
             }
 #if BLE_INCLUDED == TRUE
             if (p_acl_cb->transport == BT_TRANSPORT_LE) {
-                l2cble_notify_le_connection (p_acl_cb->remote_addr);
+                if(p_acl_cb->link_role == HCI_ROLE_MASTER) {
+                    if (HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl_cb->peer_le_features)) {
+                        uint16_t data_length = controller_get_interface()->get_ble_default_data_packet_length();
+                        uint16_t data_txtime = controller_get_interface()->get_ble_default_data_packet_txtime();
+                        btsnd_hcic_ble_set_data_length(p_acl_cb->hci_handle, data_length, data_txtime);
+                    }
+                    l2cble_notify_le_connection (p_acl_cb->remote_addr);
+                } else {
+                     //slave role, read remote feature
+                     btsnd_hcic_ble_read_remote_feat(p_acl_cb->hci_handle);
+                }
             }
 #endif
             break;
@@ -2073,7 +2083,7 @@ void BTM_BleGetWhiteListSize(uint16_t *length)
 {
     tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
     if (p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_ERROR("%s Whitelist full.", __func__);
+        BTM_TRACE_DEBUG("%s Whitelist full.", __func__);
     }
     *length = p_cb->white_list_avail_size;
     return;

components/bt/bluedroid/stack/btm/btm_ble.c

@@ -180,11 +180,7 @@ BOOLEAN BTM_SecAddBleKey (BD_ADDR bd_addr, tBTM_LE_KEY_VALUE *p_le_key, tBTM_LE_
 
 #if (BLE_PRIVACY_SPT == TRUE)
     if (key_type == BTM_LE_KEY_PID || key_type == BTM_LE_KEY_LID) {
-        /* It will cause that scanner doesn't send scan request to advertiser
-         * which has sent IRK to us and we have stored the IRK in controller.
-         * It is a design problem of hardware. The temporal solution is not to 
-         * send the key to the controller and then resolve the random address in host. */
-        //btm_ble_resolving_list_load_dev (p_dev_rec);
+        btm_ble_resolving_list_load_dev (p_dev_rec);
     }
 #endif
 
@@ -609,18 +605,23 @@ void BTM_ReadDevInfo (BD_ADDR remote_bda, tBT_DEVICE_TYPE *p_dev_type, tBLE_ADDR
 {
     tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (remote_bda);
     tBTM_INQ_INFO     *p_inq_info = BTM_InqDbRead(remote_bda);
+    tBLE_ADDR_TYPE    temp_addr_type = (*p_addr_type);
 
     *p_addr_type = BLE_ADDR_PUBLIC;
 
-    if (!p_dev_rec) {
+    if (!p_dev_rec) {  
         *p_dev_type = BT_DEVICE_TYPE_BREDR;
         /* Check with the BT manager if details about remote device are known */
         if (p_inq_info != NULL) {
             *p_dev_type = p_inq_info->results.device_type ;
             *p_addr_type = p_inq_info->results.ble_addr_type;
         } else {
-            /* unknown device, assume BR/EDR */
-            BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
+            if(temp_addr_type <= BLE_ADDR_TYPE_MAX) {
+                *p_addr_type = temp_addr_type;
+            } else {
+                /* unknown device, assume BR/EDR */
+                BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
+            }
         }
     } else { /* there is a security device record exisitng */
         /* new inquiry result, overwrite device type in security device record */
@@ -665,6 +666,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT tran
 
     /* if no device can be located, return */
     if (p_dev_rec == NULL) {
+        memset(remote_bda, 0, BD_ADDR_LEN);
         return FALSE;
     }
 
@@ -812,7 +814,7 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length)
     }
 
     if (!HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl->peer_le_features)) {
-        BTM_TRACE_DEBUG("%s failed, peer does not support request", __FUNCTION__);
+        BTM_TRACE_ERROR("%s failed, peer does not support request", __FUNCTION__);
         return BTM_PEER_LE_DATA_LEN_UNSUPPORTED;
     }
 
@@ -1221,6 +1223,14 @@ void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY
             p_rec->ble.keys.key_size = p_keys->lenc_key.key_size;
             p_rec->ble.key_type |= BTM_LE_KEY_LENC;
 
+            /* Set that link key is known since this shares field with BTM_SEC_FLAG_LKEY_KNOWN flag in btm_api.h*/
+            p_rec->sec_flags |=  BTM_SEC_LE_LINK_KEY_KNOWN;
+            if ( p_keys->lenc_key.sec_level == SMP_SEC_AUTHENTICATED) {
+                p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
+            } else {
+                p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
+            }
+
             BTM_TRACE_DEBUG("BTM_LE_KEY_LENC key_type=0x%x DIV=0x%x key_size=0x%x sec_level=0x%x",
                             p_rec->ble.key_type,
                             p_rec->ble.keys.div,
@@ -1907,7 +1917,17 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
 
         /* possiblly receive connection complete with resolvable random on
            slave role while the device has been paired */
-        if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) {
+
+        /* It will cause that scanner doesn't send scan request to advertiser
+        * which has sent IRK to us and we have stored the IRK in controller.
+        * It is a design problem of hardware. The temporal solution is not to 
+        * send the key to the controller and then resolve the random address in host.
+        * so we need send the real address information to controller to connect. 
+        * Once the connection is successful, resolve device address whether it is 
+        * slave or master*/
+
+        /* if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) { */
+        if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) {
             // save the enhanced value to used in btm_ble_resolve_random_addr_on_conn_cmpl func.
             temp_enhanced = enhanced;
             btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_conn_cmpl, p_data);
@@ -1922,7 +1942,6 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
             handle = HCID_GET_HANDLE (handle);
 
             btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
-
             l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
                               conn_latency, conn_timeout);
 
@@ -2066,11 +2085,7 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
                     p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
                     /* add all bonded device into resolving list if IRK is available*/
-                    /* It will cause that scanner doesn't send scan request to advertiser
-                     * which has sent IRK to us and we have stored the IRK in controller.
-                     * It is a design problem of hardware. The temporal solution is not to 
-                     * send the key to the controller and then resolve the random address in host. */
-                    //btm_ble_resolving_list_load_dev(p_dev_rec);
+                    btm_ble_resolving_list_load_dev(p_dev_rec);
 #endif
                 }
 

components/bt/bluedroid/stack/btm/btm_ble_addr.c

@@ -65,6 +65,23 @@ static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p)
             p_cb->set_local_privacy_cback = NULL;
         }
 
+        if (btm_cb.ble_ctr_cb.inq_var.adv_mode == BTM_BLE_ADV_ENABLE){
+            BTM_TRACE_DEBUG("Advertise with new resolvable private address, now.");
+            /**
+             * Restart advertising, using new resolvable private address
+             */
+            btm_ble_stop_adv();
+            btm_ble_start_adv();
+        }
+        if (btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_SCANNING){
+            BTM_TRACE_DEBUG("Scan with new resolvable private address, now.");
+            /**
+             * Restart scaning, using new resolvable private address
+             */
+            btm_ble_stop_scan();
+            btm_ble_start_scan();
+        }
+
         /* start a periodical timer to refresh random addr */
         btu_stop_timer_oneshot(&p_cb->raddr_timer_ent);
 #if (BTM_BLE_CONFORMANCE_TESTING == TRUE)
@@ -596,7 +613,12 @@ void btm_ble_refresh_local_resolvable_private_addr(BD_ADDR pseudo_addr,
     BD_ADDR     dummy_bda = {0};
 
     if (p != NULL) {
-        if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
+/*
+ *  Temporary solutions for pair with random address:
+ *  use BLE_ADDR_RANDOM when adverting with random adress or in privacy mode
+ *  We will do futher work here
+ */
+        if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE || btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM) {
             p->conn_addr_type = BLE_ADDR_RANDOM;
             if (memcmp(local_rpa, dummy_bda, BD_ADDR_LEN)) {
                 memcpy(p->conn_addr, local_rpa, BD_ADDR_LEN);

components/bt/bluedroid/stack/btm/btm_ble_bgconn.c

@@ -69,7 +69,7 @@ static void background_connections_lazy_init()
     }
 }
 
-static void background_connection_add(bt_bdaddr_t *address)
+static BOOLEAN background_connection_add(bt_bdaddr_t *address)
 {
     assert(address);
     background_connections_lazy_init();
@@ -78,14 +78,17 @@ static void background_connection_add(bt_bdaddr_t *address)
         connection = osi_calloc(sizeof(background_connection_t));
         connection->address = *address;
         hash_map_set(background_connections, &(connection->address), connection);
+        return TRUE;
     }
+    return FALSE;
 }
 
-static void background_connection_remove(bt_bdaddr_t *address)
+static BOOLEAN background_connection_remove(bt_bdaddr_t *address)
 {
     if (address && background_connections) {
-        hash_map_erase(background_connections, address);
+        return hash_map_erase(background_connections, address);
     }
+    return FALSE;
 }
 
 static void background_connections_clear()
@@ -259,20 +262,36 @@ BOOLEAN btm_update_dev_to_white_list(BOOLEAN to_add, BD_ADDR bd_addr, tBTM_ADD_W
     tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
 
     if (to_add && p_cb->white_list_avail_size == 0) {
-        BTM_TRACE_DEBUG("%s Whitelist full, unable to add device", __func__);
+        BTM_TRACE_ERROR("%s Whitelist full, unable to add device", __func__);
+        if (add_wl_cb){
+            add_wl_cb(HCI_ERR_MEMORY_FULL,to_add);
+        }
         return FALSE;
     }
-    if (add_wl_cb){
-        //save add whitelist complete callback
-        p_cb->add_wl_cb = add_wl_cb;
-    }
 
     if (to_add) {
         /* added the bd_addr to the connection hash map queue */
-        background_connection_add((bt_bdaddr_t *)bd_addr);
+        if(!background_connection_add((bt_bdaddr_t *)bd_addr)) {
+            /* if the bd_addr already exist in whitelist, just callback return TRUE */
+            if (add_wl_cb){
+                add_wl_cb(HCI_SUCCESS,to_add);
+            }
+            return TRUE;
+        }
     } else {
         /* remove the bd_addr to the connection hash map queue */
-        background_connection_remove((bt_bdaddr_t *)bd_addr);
+        if(!background_connection_remove((bt_bdaddr_t *)bd_addr)){
+            /* if the bd_addr don't exist in whitelist, just callback return TRUE */
+            if (add_wl_cb){
+                add_wl_cb(HCI_SUCCESS,to_add);
+            }
+            return TRUE;
+        }
+    }
+
+    if (add_wl_cb){
+        //save add whitelist complete callback
+        p_cb->add_wl_cb = add_wl_cb;
     }
     /* stop the auto connect */
     btm_suspend_wl_activity(p_cb->wl_state);
@@ -552,7 +571,7 @@ void btm_ble_initiate_select_conn(BD_ADDR bda)
     BTM_TRACE_EVENT ("btm_ble_initiate_select_conn");
 
     /* use direct connection procedure to initiate connection */
-    if (!L2CA_ConnectFixedChnl(L2CAP_ATT_CID, bda)) {
+    if (!L2CA_ConnectFixedChnl(L2CAP_ATT_CID, bda, BLE_ADDR_UNKNOWN_TYPE)) {
         BTM_TRACE_ERROR("btm_ble_initiate_select_conn failed");
     }
 }

components/bt/bluedroid/stack/btm/btm_ble_gap.c

@@ -403,7 +403,6 @@ tBTM_STATUS BTM_BleObserve(BOOLEAN start, UINT32 duration,
                                                   BTM_BLE_DEFAULT_SFP);
             }
 
-            p_inq->scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE;
             status = btm_ble_start_scan();
         }
 
@@ -442,7 +441,6 @@ tBTM_STATUS BTM_BleObserve(BOOLEAN start, UINT32 duration,
 tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration,
                            tBTM_INQ_RESULTS_CB *p_results_cb, tBTM_CMPL_CB *p_cmpl_cb)
 {
-    tBTM_BLE_INQ_CB *p_inq = &btm_cb.ble_ctr_cb.inq_var;
     tBTM_STATUS status = BTM_WRONG_MODE;
 
     if (!controller_get_interface()->supports_ble()) {
@@ -467,7 +465,6 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration,
             /* enable resolving list */
             btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_SCAN);
 #endif
-            p_inq->scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE;
             status = btm_ble_start_scan();
         }
 
@@ -501,7 +498,7 @@ tBTM_STATUS BTM_BleScan(BOOLEAN start, UINT32 duration,
 ** Returns          status.
 **
 *******************************************************************************/
-tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
+tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK  *p_stop_adv_cback)
 {
     tBTM_STATUS status = BTM_NO_RESOURCES;
     tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
@@ -517,7 +514,13 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
         evt_type = p_cb->scan_rsp ? BTM_BLE_CONNECT_EVT : BTM_BLE_NON_CONNECT_EVT;
     }
 #endif
-
+    // if adv state is BTM_BLE_ADV_PENDING, return immediately
+    if (p_cb->state == BTM_BLE_ADV_PENDING) {
+        if (p_stop_adv_cback) {
+            (*p_stop_adv_cback)(HCI_ERR_ILLEGAL_COMMAND);
+        }
+        return BTM_BUSY;
+    }
     if (start && p_cb->adv_mode == BTM_BLE_ADV_DISABLE) {
         /* update adv params */
         if (!btsnd_hcic_ble_write_adv_params ((UINT16)(p_cb->adv_interval_min ? p_cb->adv_interval_min :
@@ -538,15 +541,22 @@ tBTM_STATUS BTM_BleBroadcast(BOOLEAN start)
         }
 
         status = btm_ble_start_adv ();
-    } else if (!start) {
+    } else if (!start && p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        //save the stop adv callback to the BTM env.
+        p_cb->p_stop_adv_cb = p_stop_adv_cback;
         status = btm_ble_stop_adv();
 #if BLE_PRIVACY_SPT == TRUE
         btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE);
 #endif
     } else {
-        status = BTM_WRONG_MODE;
-        BTM_TRACE_ERROR("Can not %s Broadcast, device %s in Broadcast mode",
-                        (start ? "Start" : "Stop"), (start ? "already" : "not"));
+        /*
+            1. start adv when adv has already started (not used)
+            2. stop adv shen adv has already stoped
+        */
+        status = BTM_SUCCESS;
+        if (p_stop_adv_cback) {
+            (*p_stop_adv_cback)(status);
+        }
     }
     return status;
 }
@@ -734,6 +744,30 @@ BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK
     if (!controller_get_interface()->supports_ble()) {
         return FALSE;
     }
+
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set privacy when advertising, scaning or using static random address
+ *  We will do futher work here
+ */
+    if (p_cb->privacy_mode == BTM_PRIVACY_NONE
+        && random_cb->own_addr_type == BLE_ADDR_RANDOM) {
+        BTM_TRACE_ERROR("Have set random adress, can't set privacy ");
+        if (random_cb && random_cb->set_local_privacy_cback){
+            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
+            random_cb->set_local_privacy_cback = NULL;
+        }
+        return FALSE;
+    }
+    if (!(p_cb->inq_var.state == BTM_BLE_STOP_SCAN || p_cb->inq_var.state == BTM_BLE_STOP_ADV || p_cb->inq_var.state == BTM_BLE_IDLE)) {
+        BTM_TRACE_ERROR("Advertising or scaning now, can't set privacy ");
+        if (random_cb && random_cb->set_local_privacy_cback){
+            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
+            random_cb->set_local_privacy_cback = NULL;
+        }
+        return FALSE;
+    }
+
 #if (defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE)
     uint8_t addr_resolution = 0;
 #endif  /* defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */
@@ -1152,7 +1186,7 @@ tBTM_STATUS BTM_BleSetAdvParams(UINT16 adv_int_min, UINT16 adv_int_max,
 *******************************************************************************/
 tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type,
                                         tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda,
-                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp)
+                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb)
 {
     tBTM_LE_RANDOM_CB *p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
     tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
@@ -1163,8 +1197,25 @@ tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max,
         return BTM_ILLEGAL_VALUE;
     }
 
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set advertising with BLE_ADDR_PUBLIC when having set random adress or in privacy mode
+ *  We will do futher work here
+ */
+    if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM && own_bda_type == BLE_ADDR_PUBLIC) {
+        BTM_TRACE_ERROR ("own_addr_type is BLE_ADDR_RANDOM but use BLE_ADDR_PUBLIC\n");
+        if(adv_cb) {
+            (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL);
+        }
+        return BTM_ILLEGAL_VALUE;
+    }
+
     if (!BTM_BLE_ISVALID_PARAM(adv_int_min, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX) ||
             !BTM_BLE_ISVALID_PARAM(adv_int_max, BTM_BLE_ADV_INT_MIN, BTM_BLE_ADV_INT_MAX)) {
+         BTM_TRACE_ERROR ("adv_int_min or adv_int_max is invalid\n");    
+        if(adv_cb) {
+            (* adv_cb)(HCI_ERR_ESP_VENDOR_FAIL);
+        }
         return BTM_ILLEGAL_VALUE;
     }
 
@@ -1182,14 +1233,30 @@ tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max,
     p_addr_cb->own_addr_type = own_bda_type;
     p_cb->evt_type = adv_type;
     p_cb->afp = afp;
+    p_cb->p_adv_cb = adv_cb;
 
     if (p_dir_bda) {
         memcpy(&p_cb->direct_bda, p_dir_bda, sizeof(tBLE_BD_ADDR));
     }
 
     BTM_TRACE_EVENT ("update params for an active adv\n");
-
-    btm_ble_stop_adv();
+    // if adv state is BTM_BLE_ADV_PENDING, return immediately
+    if (p_cb->state == BTM_BLE_ADV_PENDING) {
+        if (p_cb->p_adv_cb) {
+            (*p_cb->p_adv_cb)(HCI_ERR_ILLEGAL_COMMAND);
+        }
+        return BTM_BUSY;
+    }
+    /* host will stop adv first and then  start adv again if adv has already started
+       it will get callback twice.
+    */
+    if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        p_cb->adv_callback_twice = TRUE;
+    }
+    tBTM_STATUS status = btm_ble_stop_adv();
+    if (status != BTM_SUCCESS) {
+        p_cb->adv_callback_twice = FALSE;
+    }
 
     /* update adv params */
     btsnd_hcic_ble_write_adv_params (adv_int_min,
@@ -1300,7 +1367,7 @@ void BTM_BleSetScanParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_
 }
 
 void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_window,
-                                tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, tBTM_BLE_SFP scan_filter_policy,
+                                tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBTM_BLE_SFP scan_filter_policy,
                                 tBLE_SCAN_PARAM_SETUP_CBACK scan_setup_status_cback)
 {
     tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
@@ -1312,6 +1379,19 @@ void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32
         return;
     }
 
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set scan with BLE_ADDR_PUBLIC when having set random adress or in privacy mode
+ *  We will do futher work here
+ */
+    if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM && addr_type_own == BLE_ADDR_PUBLIC) {
+        BTM_TRACE_ERROR ("own_addr_type is BLE_ADDR_RANDOM but use BLE_ADDR_PUBLIC\n");
+        if (scan_setup_status_cback != NULL) {
+            scan_setup_status_cback(client_if, BTM_ILLEGAL_VALUE);
+        }
+        return;
+    }
+
     /* If not supporting extended scan support, use the older range for checking */
     if (btm_cb.cmn_ble_vsc_cb.extended_scan_support == 0) {
         max_scan_interval = BTM_BLE_SCAN_INT_MAX;
@@ -1324,12 +1404,14 @@ void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32
 
     if (BTM_BLE_ISVALID_PARAM(scan_interval, BTM_BLE_SCAN_INT_MIN, max_scan_interval) &&
             BTM_BLE_ISVALID_PARAM(scan_window, BTM_BLE_SCAN_WIN_MIN, max_scan_window) &&
-            (scan_mode == BTM_BLE_SCAN_MODE_ACTI || scan_mode == BTM_BLE_SCAN_MODE_PASS)) {
+            (scan_mode == BTM_BLE_SCAN_MODE_ACTI || scan_mode == BTM_BLE_SCAN_MODE_PASS) &&
+            (scan_duplicate_filter < BTM_BLE_SCAN_DUPLICATE_MAX)) {
         p_cb->scan_type = scan_mode;
         p_cb->scan_interval = scan_interval;
         p_cb->scan_window = scan_window;
         p_cb->sfp = scan_filter_policy;
         p_cb->scan_params_set = TRUE;
+        p_cb->scan_duplicate_filter = scan_duplicate_filter;
 
         btsnd_hcic_ble_set_scan_params(p_cb->scan_type, (UINT16)scan_interval,
                                        (UINT16)scan_window,
@@ -1490,16 +1572,35 @@ tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len)
 ** Returns          void
 **
 *******************************************************************************/
-BOOLEAN BTM_BleSetRandAddress(BD_ADDR rand_addr)
+tBTM_STATUS BTM_BleSetRandAddress(BD_ADDR rand_addr)
 {
-    BOOLEAN set_flag = false;
-
 	if (rand_addr == NULL)
-		return set_flag;
+		return BTM_SET_STATIC_RAND_ADDR_FAIL;
 
+/*
+ *  Temporary solutions for pair with random address:
+ *  can't set rand address when advertising, scaning or in privacy mode
+ *  We will do futher work here
+ */
+#if BLE_PRIVACY_SPT == TRUE
+    if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
+        BTM_TRACE_ERROR("privacy_mode is not BTM_PRIVACY_NONE ");
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
+
+#endif
+    if (!(btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_STOP_SCAN || btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_STOP_ADV || btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_IDLE)) {
+        BTM_TRACE_ERROR("Advertising or scaning now, can't set randaddress %d", btm_cb.ble_ctr_cb.inq_var.state);
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
+    memcpy(btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr, rand_addr, BD_ADDR_LEN);
+    btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type = BLE_ADDR_RANDOM;
     //send the set random address to the controller
-    set_flag = btsnd_hcic_ble_set_random_addr(rand_addr);
-    return set_flag;
+    if(btsnd_hcic_ble_set_random_addr(rand_addr)) {
+        return BTM_SUCCESS;
+    } else {
+        return BTM_SET_STATIC_RAND_ADDR_FAIL;
+    }
 }
 
 /*******************************************************************************
@@ -2180,7 +2281,6 @@ tBTM_STATUS btm_ble_start_inquiry (UINT8 mode, UINT8   duration)
         /* enable IRK list */
         btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_SCAN);
 #endif
-        p_ble_cb->inq_var.scan_duplicate_filter  = BTM_BLE_DUPLICATE_DISABLE;
         status = btm_ble_start_scan();
     } else if ((p_ble_cb->inq_var.scan_interval != BTM_BLE_LOW_LATENCY_SCAN_INT) ||
                (p_ble_cb->inq_var.scan_window != BTM_BLE_LOW_LATENCY_SCAN_WIN)) {
@@ -2471,7 +2571,7 @@ static void btm_ble_parse_adv_data(tBTM_INQ_INFO *p_info, UINT8 *p_data,
 ** Returns          void
 **
 *******************************************************************************/
-void btm_ble_cache_adv_data(tBTM_INQ_RESULTS *p_cur, UINT8 data_len, UINT8 *p, UINT8 evt_type)
+void btm_ble_cache_adv_data(BD_ADDR bda, tBTM_INQ_RESULTS *p_cur, UINT8 data_len, UINT8 *p, UINT8 evt_type)
 {
     tBTM_BLE_INQ_CB     *p_le_inq_cb = &btm_cb.ble_ctr_cb.inq_var;
     UINT8 *p_cache;
@@ -2483,6 +2583,15 @@ void btm_ble_cache_adv_data(tBTM_INQ_RESULTS *p_cur, UINT8 data_len, UINT8 *p, U
         memset(p_le_inq_cb->adv_data_cache, 0, BTM_BLE_CACHE_ADV_DATA_MAX);
         p_cur->adv_data_len = 0;
         p_cur->scan_rsp_len = 0;
+    } 
+
+    //Clear the adv cache if the addresses are not equal
+    if(memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) != 0) {
+        p_le_inq_cb->adv_len = 0;
+        memcpy(p_le_inq_cb->adv_addr, bda, BD_ADDR_LEN);
+        memset(p_le_inq_cb->adv_data_cache, 0, BTM_BLE_CACHE_ADV_DATA_MAX);
+        p_cur->adv_data_len = 0;
+        p_cur->scan_rsp_len = 0;
     }
 
     if (data_len > 0) {
@@ -2712,7 +2821,7 @@ static void btm_ble_appearance_to_cod(UINT16 appearance, UINT8 *dev_class)
 ** Returns          void
 **
 *******************************************************************************/
-BOOLEAN btm_ble_update_inq_result(tINQ_DB_ENT *p_i, UINT8 addr_type, UINT8 evt_type, UINT8 *p)
+BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type, UINT8 evt_type, UINT8 *p)
 {
     BOOLEAN             to_report = TRUE;
     tBTM_INQ_RESULTS     *p_cur = &p_i->inq_info.results;
@@ -2730,7 +2839,7 @@ BOOLEAN btm_ble_update_inq_result(tINQ_DB_ENT *p_i, UINT8 addr_type, UINT8 evt_t
         BTM_TRACE_WARNING("EIR data too long %d. discard", data_len);
         return FALSE;
     }
-    btm_ble_cache_adv_data(p_cur, data_len, p, evt_type);
+    btm_ble_cache_adv_data(bda, p_cur, data_len, p, evt_type);
 
     p1 = (p + data_len);
     STREAM_TO_UINT8 (rssi, p1);
@@ -2904,6 +3013,8 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
     UINT8               data_len;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
     BOOLEAN             match = FALSE;
+    BD_ADDR             temp_bda;
+    UINT8               temp_addr_type = 0;
 #endif
 
     /* Only process the results if the inquiry is still active */
@@ -2922,6 +3033,9 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
         //BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n",
         //                              bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]);
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
+        temp_addr_type = addr_type;
+        memcpy(temp_bda, bda, BD_ADDR_LEN);
+        
         /* map address to security record */
         match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE);
 
@@ -2932,8 +3046,16 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
             btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, p_data);
         } else
 #endif
-            btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
-
+        btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
+#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
+        //save current adv addr information if p_dev_rec!= NULL
+        tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
+        if(p_dev_rec) {
+            p_dev_rec->ble.current_addr_type = temp_addr_type;
+            memcpy(p_dev_rec->ble.current_addr, temp_bda, BD_ADDR_LEN);
+            p_dev_rec->ble.current_addr_valid = true;
+        }
+#endif
         STREAM_TO_UINT8(data_len, p);
 
         /* Advance to the next event data_len + rssi byte */
@@ -2941,6 +3063,71 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
     }
 }
 
+/*******************************************************************************
+**
+** Function         btm_ble_process_last_adv_pkt
+**
+** Description      This function is called to report last adv packet
+**
+** Parameters
+**
+** Returns          void
+**
+*******************************************************************************/
+
+static void btm_ble_process_last_adv_pkt(void)
+{
+    UINT8       result = 0;
+    UINT8       null_bda[6] = {0};
+    tBTM_INQUIRY_VAR_ST  *p_inq = &btm_cb.btm_inq_vars;
+    tBTM_INQ_RESULTS_CB  *p_inq_results_cb = p_inq->p_inq_results_cb;
+    tBTM_INQ_RESULTS_CB  *p_obs_results_cb = btm_cb.ble_ctr_cb.p_obs_results_cb;
+    tBTM_INQ_RESULTS_CB  *p_scan_results_cb = btm_cb.ble_ctr_cb.p_scan_results_cb;
+    tBTM_BLE_INQ_CB      *p_le_inq_cb = &btm_cb.ble_ctr_cb.inq_var;
+    tINQ_DB_ENT          *p_i = btm_inq_db_find (p_le_inq_cb->adv_addr);
+
+    if(memcmp(null_bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) == 0) {
+        return;
+    }
+
+    if(p_i == NULL) {
+        BTM_TRACE_DEBUG("no last adv");
+        return;
+    }
+
+    if ((result = btm_ble_is_discoverable(p_le_inq_cb->adv_addr, p_i->inq_info.results.ble_evt_type, NULL)) == 0) {
+        BTM_TRACE_WARNING("%s device is no longer discoverable so discarding advertising packet pkt",
+                 __func__);
+        return;
+    }
+    /* background connection in selective connection mode */
+    if (btm_cb.ble_ctr_cb.bg_conn_type == BTM_BLE_CONN_SELECTIVE) {
+        //do nothing
+    } else {
+        if (p_inq_results_cb && (result & BTM_BLE_INQ_RESULT)) {
+            (p_inq_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
+        }
+        if (p_obs_results_cb && (result & BTM_BLE_OBS_RESULT)) {
+            (p_obs_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
+        }
+        if (p_scan_results_cb && (result & BTM_BLE_DISCO_RESULT)) {
+            (p_scan_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
+        }
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_process_adv_pkt_cont
@@ -2965,6 +3152,13 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
     BOOLEAN     update = TRUE;
     UINT8       result = 0;
 
+   //if scan duplicate is enabled, the adv packet without scan response is allowed to report to upper layer
+   if(p_le_inq_cb->scan_duplicate_filter == BTM_BLE_SCAN_DUPLICATE_ENABLE) {
+       if(memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) != 0) {
+            btm_ble_process_last_adv_pkt();
+       }
+   }
+
     p_i = btm_inq_db_find (bda);
 
     /* Check if this address has already been processed for this inquiry */
@@ -2993,7 +3187,7 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
         p_inq->inq_cmpl_info.num_resp++;
     }
     /* update the LE device information in inquiry database */
-    if (!btm_ble_update_inq_result(p_i, addr_type, evt_type, p)) {
+    if (!btm_ble_update_inq_result(bda, p_i, addr_type, evt_type, p)) {
         return;
     }
 
@@ -3037,12 +3231,24 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
     } else {
         if (p_inq_results_cb && (result & BTM_BLE_INQ_RESULT)) {
             (p_inq_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
         }
         if (p_obs_results_cb && (result & BTM_BLE_OBS_RESULT)) {
             (p_obs_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
         }
         if (p_scan_results_cb && (result & BTM_BLE_DISCO_RESULT)) {
             (p_scan_results_cb)((tBTM_INQ_RESULTS *) &p_i->inq_info.results, p_le_inq_cb->adv_data_cache);
+            p_le_inq_cb->adv_len = 0;
+            memset(p_le_inq_cb->adv_addr, 0, BD_ADDR_LEN);
+            p_i->inq_info.results.adv_data_len = 0;
+            p_i->inq_info.results.scan_rsp_len = 0;
         }
     }
 }
@@ -3081,6 +3287,9 @@ tBTM_STATUS btm_ble_start_scan(void)
     tBTM_STATUS status = BTM_CMD_STARTED;
     // recoverly the scan parameters to the controller before start scan
     btm_ble_recover_scan_params();
+    if(p_inq->scan_duplicate_filter > BTM_BLE_DUPLICATE_MAX) {
+        p_inq->scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE;
+    }
     /* start scan, disable duplicate filtering */
     if (!btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_ENABLE, p_inq->scan_duplicate_filter)) {
         status = BTM_NO_RESOURCES;
@@ -3294,13 +3503,13 @@ tBTM_STATUS btm_ble_start_adv(void)
 #endif
     if (p_cb->afp != AP_SCAN_CONN_ALL) {
         //find the device in the btm dev buffer and write it to the controller white list
-        btm_execute_wl_dev_operation();    
+        btm_execute_wl_dev_operation();
         btm_cb.ble_ctr_cb.wl_state |= BTM_BLE_WL_ADV;
     }
 
     if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE)) {
         p_cb->adv_mode = BTM_BLE_ADV_ENABLE;
-        p_cb->state = BTM_BLE_ADVERTISING;
+        p_cb->state = BTM_BLE_ADV_PENDING;
         btm_ble_adv_states_operation(btm_ble_set_topology_mask, p_cb->evt_type);
         rt = BTM_SUCCESS;
         BTM_TRACE_EVENT ("BTM_SUCCESS\n");
@@ -3329,7 +3538,7 @@ tBTM_STATUS btm_ble_stop_adv(void)
         if (btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE)) {
             p_cb->fast_adv_on = FALSE;
             p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
-            p_cb->state = BTM_BLE_STOP_ADV;
+            p_cb->state = BTM_BLE_ADV_PENDING;
             btm_cb.ble_ctr_cb.wl_state &= ~BTM_BLE_WL_ADV;
 
             /* clear all adv states */
@@ -3469,9 +3678,13 @@ void btm_ble_read_remote_features_complete(UINT8 *p)
                 if (p_acl_cb->link_role == HCI_ROLE_MASTER){
                     btsnd_hcic_rmt_ver_req (p_acl_cb->hci_handle);
                 }
-
                 else{
                     if (p_acl_cb->transport == BT_TRANSPORT_LE) {
+                        if (HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl_cb->peer_le_features)) {
+                            uint16_t data_length = controller_get_interface()->get_ble_default_data_packet_length();
+                            uint16_t data_txtime = controller_get_interface()->get_ble_default_data_packet_txtime();
+                            btsnd_hcic_ble_set_data_length(p_acl_cb->hci_handle, data_length, data_txtime);
+                        }
                         l2cble_notify_le_connection (p_acl_cb->remote_addr);
                     }
                 }
@@ -3495,7 +3708,30 @@ void btm_ble_read_remote_features_complete(UINT8 *p)
 void btm_ble_write_adv_enable_complete(UINT8 *p)
 {
     tBTM_BLE_INQ_CB *p_cb = &btm_cb.ble_ctr_cb.inq_var;
+    UINT8 status = *p;
 
+    // callback to the APP after receive the adv complete from the controller.
+    if (p_cb->p_adv_cb && p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+        if (p_cb->adv_callback_twice) {
+            p_cb->adv_callback_twice = FALSE;
+        }else {
+            p_cb->state = BTM_BLE_ADVERTISING;
+            (*p_cb->p_adv_cb)(status);
+            p_cb->p_adv_cb = NULL;
+        }
+    } else if (p_cb->p_stop_adv_cb && p_cb->adv_mode == BTM_BLE_ADV_DISABLE) {
+        p_cb->state = BTM_BLE_STOP_ADV;
+        (*p_cb->p_stop_adv_cb)(status);
+        p_cb->p_stop_adv_cb = NULL;
+    }else {
+        // p_cb->p_adv_cb is NULL or p_cb->p_stop_adv_cb is NULL
+        if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
+            p_cb->state = BTM_BLE_ADVERTISING;
+        }else {
+            p_cb->state = BTM_BLE_STOP_ADV;
+        }
+        p_cb->adv_callback_twice = FALSE;
+    }
     /* if write adv enable/disbale not succeed */
     if (*p != HCI_SUCCESS) {
         /* toggle back the adv mode */
@@ -3637,6 +3873,9 @@ void btm_ble_init (void)
 
     BTM_TRACE_DEBUG("%s", __func__);
 
+    btu_free_timer(&p_cb->obs_timer_ent);
+    btu_free_timer(&p_cb->scan_timer_ent);
+    btu_free_timer(&p_cb->inq_var.fast_adv_timer);
     memset(p_cb, 0, sizeof(tBTM_BLE_CB));
     memset(&(btm_cb.cmn_ble_vsc_cb), 0 , sizeof(tBTM_BLE_VSC_CB));
     btm_cb.cmn_ble_vsc_cb.values_read = FALSE;

components/bt/bluedroid/stack/btm/btm_ble_privacy.c

@@ -765,18 +765,22 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                 btm_ble_update_resolving_list(p_dev_rec->bd_addr, TRUE);
                 if (controller_get_interface()->supports_ble_privacy()) {
                     BD_ADDR dummy_bda = {0};
-                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
-                    UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
-
                     if (memcmp(p_dev_rec->ble.static_addr, dummy_bda, BD_ADDR_LEN) == 0) {
                         memcpy(p_dev_rec->ble.static_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
                         p_dev_rec->ble.static_addr_type = p_dev_rec->ble.ble_addr_type;
                     }
-
+                    /* It will cause that scanner doesn't send scan request to advertiser
+                     * which has sent IRK to us and we have stored the IRK in controller.
+                     * It is a design problem of hardware. The temporal solution is not to 
+                     * send the key to the controller and then resolve the random address in host. */
+                    /*
                     BTM_TRACE_DEBUG("%s:adding device to controller resolving list\n", __func__);
-                    // use identical IRK for now
+                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
+                    UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
+                    //use identical IRK for now
                     rt = btsnd_hcic_ble_add_device_resolving_list(p_dev_rec->ble.static_addr_type,
-                            p_dev_rec->ble.static_addr, peer_irk, local_irk);
+                           p_dev_rec->ble.static_addr, peer_irk, local_irk);
+                    */
                 } else {
                     UINT8 param[40] = {0};
                     UINT8 *p = param;
@@ -807,7 +811,7 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                 }
             }
         } else {
-            BTM_TRACE_ERROR("Device already in Resolving list\n");
+            BTM_TRACE_DEBUG("Device already in Resolving list\n");
             rt = TRUE;
         }
     } else {

components/bt/bluedroid/stack/btm/btm_devctl.c

@@ -533,7 +533,7 @@ void btm_read_local_name_complete (UINT8 *p, UINT16 evt_len)
     UINT8           status;
     UNUSED(evt_len);
 
-    btu_stop_timer (&btm_cb.devcb.rln_timer);
+    btu_free_timer (&btm_cb.devcb.rln_timer);
 
     /* If there was a callback address for read local name, call it */
     btm_cb.devcb.p_rln_cmpl_cb = NULL;

components/bt/bluedroid/stack/btm/btm_inq.c

@@ -170,16 +170,6 @@ tBTM_STATUS BTM_SetDiscoverability (UINT16 inq_mode, UINT16 window, UINT16 inter
     BOOLEAN      cod_limited;
 
     BTM_TRACE_API ("BTM_SetDiscoverability\n");
-#if (BLE_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
-    if (controller_get_interface()->supports_ble()) {
-        if (btm_ble_set_discoverability((UINT16)(inq_mode))
-                == BTM_SUCCESS) {
-            btm_cb.btm_inq_vars.discoverable_mode &= (~BTM_BLE_DISCOVERABLE_MASK);
-            btm_cb.btm_inq_vars.discoverable_mode |= (inq_mode & BTM_BLE_DISCOVERABLE_MASK);
-        }
-    }
-    inq_mode &= ~BTM_BLE_DISCOVERABLE_MASK;
-#endif
 
     /*** Check mode parameter ***/
     if (inq_mode > BTM_MAX_DISCOVERABLE) {
@@ -601,17 +591,6 @@ tBTM_STATUS BTM_SetConnectability (UINT16 page_mode, UINT16 window, UINT16 inter
 
     BTM_TRACE_API ("BTM_SetConnectability\n");
 
-#if (BLE_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
-    if (controller_get_interface()->supports_ble()) {
-        if (btm_ble_set_connectability(page_mode) != BTM_SUCCESS) {
-            return BTM_NO_RESOURCES;
-        }
-        p_inq->connectable_mode &= (~BTM_BLE_CONNECTABLE_MASK);
-        p_inq->connectable_mode |= (page_mode & BTM_BLE_CONNECTABLE_MASK);
-    }
-    page_mode &= ~BTM_BLE_CONNECTABLE_MASK;
-#endif
-
     /*** Check mode parameter ***/
     if (page_mode != BTM_NON_CONNECTABLE && page_mode != BTM_CONNECTABLE) {
         return (BTM_ILLEGAL_VALUE);
@@ -1359,6 +1338,12 @@ void btm_inq_db_init (void)
 #if 0  /* cleared in btm_init; put back in if called from anywhere else! */
     memset (&btm_cb.btm_inq_vars, 0, sizeof (tBTM_INQUIRY_VAR_ST));
 #endif
+
+    btu_free_timer(&btm_cb.btm_inq_vars.rmt_name_timer_ent);
+    memset(&btm_cb.btm_inq_vars.rmt_name_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+    btu_free_timer(&btm_cb.btm_inq_vars.inq_timer_ent);
+    memset(&btm_cb.btm_inq_vars.inq_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+
     btm_cb.btm_inq_vars.no_inc_ssp = BTM_NO_SSP_ON_INQUIRY;
 }
 

components/bt/bluedroid/stack/btm/btm_sec.c

@@ -1361,7 +1361,7 @@ tBTM_STATUS BTM_SetEncryption (BD_ADDR bd_addr, tBT_TRANSPORT transport, tBTM_SE
 
         return (BTM_SUCCESS);
     }
-
+    p_dev_rec->enc_init_by_we = TRUE;
     /* enqueue security request if security is active */
     if (p_dev_rec->p_callback || (p_dev_rec->sec_state != BTM_SEC_STATE_IDLE)) {
         BTM_TRACE_WARNING ("Security Manager: BTM_SetEncryption busy, enqueue request\n");
@@ -2763,7 +2763,9 @@ void btm_sec_check_pending_reqs (void)
         /* Now, re-submit anything in the mux queue */
         bq = btm_cb.sec_pending_q;
 
-        btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+        if (!btm_cb.sec_pending_q) {
+            btm_cb.sec_pending_q = fixed_queue_new(SIZE_MAX);
+        }
 
         while ((p_e = (tBTM_SEC_QUEUE_ENTRY *)fixed_queue_try_dequeue(bq)) != NULL) {
             /* Check that the ACL is still up before starting security procedures */
@@ -4535,7 +4537,7 @@ void btm_sec_disconnected (UINT16 handle, UINT8 reason)
     if (!p_dev_rec) {
         return;
     }
-
+    p_dev_rec->enc_init_by_we = FALSE;
     transport  = (handle == p_dev_rec->hci_handle) ? BT_TRANSPORT_BR_EDR : BT_TRANSPORT_LE;
 
     p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */

components/bt/bluedroid/stack/btu/btu_hcif.c

@@ -906,7 +906,30 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
     case HCI_BLE_CLEAR_WHITE_LIST:
         btm_ble_clear_white_list_complete(p, evt_len);
         break;
-
+    case HCI_BLE_WRITE_ADV_PARAMS: {
+        uint8_t status;
+        STREAM_TO_UINT8  (status, p);
+        if(status != HCI_SUCCESS) {
+            HCI_TRACE_ERROR("hci write adv params error 0x%x", status);
+        }
+        break;
+    }
+    case HCI_BLE_RC_PARAM_REQ_REPLY: {
+        uint8_t status;
+        STREAM_TO_UINT8  (status, p);
+        if(status != HCI_SUCCESS) {
+            HCI_TRACE_ERROR("hci connection params reply command error 0x%x", status);
+        }
+        break;
+    }
+    case HCI_BLE_RC_PARAM_REQ_NEG_REPLY: {
+        uint8_t status;
+        STREAM_TO_UINT8  (status, p);
+        if(status != HCI_SUCCESS) {
+            HCI_TRACE_ERROR("hci connection params neg reply command error 0x%x", status);
+        }
+        break;
+    }
     case HCI_BLE_REMOVE_WHITE_LIST:
         btm_ble_remove_from_white_list_complete(p, evt_len);
         break;

components/bt/bluedroid/stack/btu/btu_task.c

@@ -239,23 +239,6 @@ void btu_task_thread_handler(void *arg)
             case SIG_BTU_ONESHOT_ALARM: {
                 TIMER_LIST_ENT *p_tle = (TIMER_LIST_ENT *)e.par;
                 btu_general_alarm_process(p_tle);
-
-                switch (p_tle->event) {
-#if (defined(BLE_INCLUDED) && BLE_INCLUDED == TRUE)
-                    case BTU_TTYPE_BLE_RANDOM_ADDR:
-                        btm_ble_timeout(p_tle);
-                        break;
-#endif
-                    case BTU_TTYPE_USER_FUNC: {
-                        tUSER_TIMEOUT_FUNC  *p_uf = (tUSER_TIMEOUT_FUNC *)p_tle->param;
-                        (*p_uf)(p_tle);
-                        break;
-                    }
-                    default:
-                        // FAIL
-                        LOG_ERROR("Received unexpected oneshot timer event:0x%x\n", p_tle->event);
-                        break;
-                }
                 break;
             }
             case SIG_BTU_L2CAP_ALARM:
@@ -498,6 +481,32 @@ void btu_stop_timer(TIMER_LIST_ENT *p_tle)
     osi_alarm_cancel(alarm);
 }
 
+
+/*******************************************************************************
+**
+** Function         btu_free_timer
+**
+** Description      Stop and free a timer.
+**
+** Returns          void
+**
+*******************************************************************************/
+void btu_free_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    p_tle->in_use = FALSE;
+
+    // Get the alarm for the timer list entry.
+    osi_alarm_t *alarm = hash_map_get(btu_general_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s Unable to find expected alarm in hashmap", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(btu_general_alarm_hash_map, p_tle);
+}
+
 #if defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0)
 /*******************************************************************************
 **
@@ -585,6 +594,23 @@ void btu_stop_quick_timer(TIMER_LIST_ENT *p_tle)
     }
     osi_alarm_cancel(alarm);
 }
+
+void btu_free_quick_timer(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    p_tle->in_use = FALSE;
+
+    // Get the alarm for the timer list entry.
+    osi_alarm_t *alarm = hash_map_get(btu_l2cap_alarm_hash_map, p_tle);
+    if (alarm == NULL) {
+        LOG_DEBUG("%s Unable to find expected alarm in hashmap", __func__);
+        return;
+    }
+    osi_alarm_cancel(alarm);
+    hash_map_erase(btu_l2cap_alarm_hash_map, p_tle);
+}
+
 #endif /* defined(QUICK_TIMER_TICKS_PER_SEC) && (QUICK_TIMER_TICKS_PER_SEC > 0) */
 
 void btu_oneshot_alarm_cb(void *data)

components/bt/bluedroid/stack/gap/gap_ble.c

@@ -694,7 +694,7 @@ BOOLEAN gap_ble_accept_cl_operation(BD_ADDR peer_bda, UINT16 uuid, tGAP_BLE_CMPL
     }
 
     /* hold the link here */
-    if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, TRUE, BT_TRANSPORT_LE)) {
+    if (!GATT_Connect(gap_cb.gatt_if, p_clcb->bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BT_TRANSPORT_LE)) {
         return started;
     }
 

components/bt/bluedroid/stack/gatt/gatt_api.c

@@ -1337,12 +1337,13 @@ void GATT_StartIf (tGATT_IF gatt_if)
 **
 ** Parameters       gatt_if: applicaiton interface
 **                  bd_addr: peer device address.
+**                  bd_addr_type: peer device address type.
 **                  is_direct: is a direct conenection or a background auto connection
 **
 ** Returns          TRUE if connection started; FALSE if connection start failure.
 **
 *******************************************************************************/
-BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, BOOLEAN is_direct, tBT_TRANSPORT transport)
+BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, BOOLEAN is_direct, tBT_TRANSPORT transport)
 {
     tGATT_REG    *p_reg;
     BOOLEAN status = FALSE;
@@ -1356,7 +1357,7 @@ BOOLEAN GATT_Connect (tGATT_IF gatt_if, BD_ADDR bd_addr, BOOLEAN is_direct, tBT_
     }
 
     if (is_direct) {
-        status = gatt_act_connect (p_reg, bd_addr, transport);
+        status = gatt_act_connect (p_reg, bd_addr, bd_addr_type, transport);
     } else {
         if (transport == BT_TRANSPORT_LE) {
             status = gatt_update_auto_connect_dev(gatt_if, TRUE, bd_addr, TRUE);

components/bt/bluedroid/stack/gatt/gatt_attr.c

@@ -494,7 +494,7 @@ void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable, tBT_TRANSP
         p_clcb->connected = TRUE;
     }
     /* hold the link here */
-    GATT_Connect(gatt_cb.gatt_if, remote_bda, TRUE, transport);
+    GATT_Connect(gatt_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, transport);
     p_clcb->ccc_stage = GATT_SVC_CHANGED_CONNECTING;
 
     if (!p_clcb->connected) {

components/bt/bluedroid/stack/gatt/gatt_cl.c

@@ -586,7 +586,7 @@ void gatt_process_prep_write_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op
     tGATT_VALUE  value = {0};
     UINT8        *p = p_data;
 
-    GATT_TRACE_ERROR("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);
+    GATT_TRACE_DEBUG("value resp op_code = %s len = %d", gatt_dbg_op_name(op_code), len);
 
     if (len < GATT_PREP_WRITE_RSP_MIN_LEN) {
         GATT_TRACE_ERROR("illegal prepare write response length, discard");
@@ -988,8 +988,10 @@ void gatt_process_mtu_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT16 len, UINT
             p_tcb->payload_size = mtu;
         }
     }
-
-    l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+    /* host will set packet data length to 251 automatically if remote device support set packet data length,
+       so l2cble_set_fixed_channel_tx_data_length() is not necessary.
+       l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+    */
     gatt_end_operation(p_clcb, status, NULL);
 }
 /*******************************************************************************
@@ -1036,7 +1038,10 @@ BOOLEAN gatt_cl_send_next_cmd_inq(tGATT_TCB *p_tcb)
         if (att_ret == GATT_SUCCESS || att_ret == GATT_CONGESTED) {
             sent = TRUE;
             p_cmd->to_send = FALSE;
-            p_cmd->p_cmd = NULL;
+            if(p_cmd->p_cmd) {
+                osi_free(p_cmd->p_cmd);
+                p_cmd->p_cmd = NULL;
+            }
 
             /* dequeue the request if is write command or sign write */
             if (p_cmd->op_code != GATT_CMD_WRITE && p_cmd->op_code != GATT_SIGN_CMD_WRITE) {

components/bt/bluedroid/stack/gatt/gatt_main.c

@@ -172,6 +172,12 @@ void gatt_free(void)
         fixed_queue_free(gatt_cb.tcb[i].pending_ind_q, NULL);
         gatt_cb.tcb[i].pending_ind_q = NULL;
 
+        btu_free_timer(&gatt_cb.tcb[i].conf_timer_ent);
+        memset(&gatt_cb.tcb[i].conf_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+
+        btu_free_timer(&gatt_cb.tcb[i].ind_ack_timer_ent);
+        memset(&gatt_cb.tcb[i].ind_ack_timer_ent, 0, sizeof(TIMER_LIST_ENT));
+    
         fixed_queue_free(gatt_cb.tcb[i].sr_cmd.multi_rsp_q, NULL);
         gatt_cb.tcb[i].sr_cmd.multi_rsp_q = NULL;
     }
@@ -189,11 +195,11 @@ void gatt_free(void)
 ** Description      This function is called to initiate a connection to a peer device.
 **
 ** Parameter        rem_bda: remote device address to connect to.
-**
+**                  bd_addr_type: emote device address type.
 ** Returns          TRUE if connection is started, otherwise return FALSE.
 **
 *******************************************************************************/
-BOOLEAN gatt_connect (BD_ADDR rem_bda, tGATT_TCB *p_tcb, tBT_TRANSPORT transport)
+BOOLEAN gatt_connect (BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type, tGATT_TCB *p_tcb, tBT_TRANSPORT transport)
 {
     BOOLEAN             gatt_ret = FALSE;
 
@@ -203,7 +209,7 @@ BOOLEAN gatt_connect (BD_ADDR rem_bda, tGATT_TCB *p_tcb, tBT_TRANSPORT transport
 
     if (transport == BT_TRANSPORT_LE) {
         p_tcb->att_lcid = L2CAP_ATT_CID;
-        gatt_ret = L2CA_ConnectFixedChnl (L2CAP_ATT_CID, rem_bda);
+        gatt_ret = L2CA_ConnectFixedChnl (L2CAP_ATT_CID, rem_bda, bd_addr_type);
 #if (CLASSIC_BT_INCLUDED == TRUE)
     } else {
         if ((p_tcb->att_lcid = L2CA_ConnectReq(BT_PSM_ATT, rem_bda)) != 0) {
@@ -348,7 +354,7 @@ void gatt_update_app_use_link_flag (tGATT_IF gatt_if, tGATT_TCB *p_tcb, BOOLEAN
 ** Returns          void.
 **
 *******************************************************************************/
-BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT transport)
+BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, tBT_TRANSPORT transport)
 {
     BOOLEAN     ret = FALSE;
     tGATT_TCB   *p_tcb;
@@ -361,7 +367,7 @@ BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT trans
         /* before link down, another app try to open a GATT connection */
         if (st == GATT_CH_OPEN &&  gatt_num_apps_hold_link(p_tcb) == 0 &&
                 transport == BT_TRANSPORT_LE ) {
-            if (!gatt_connect(bd_addr,  p_tcb, transport)) {
+            if (!gatt_connect(bd_addr, bd_addr_type, p_tcb, transport)) {
                 ret = FALSE;
             }
         } else if (st == GATT_CH_CLOSING) {
@@ -370,7 +376,7 @@ BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT trans
         }
     } else {
         if ((p_tcb = gatt_allocate_tcb_by_bdaddr(bd_addr, transport)) != NULL) {
-            if (!gatt_connect(bd_addr,  p_tcb, transport)) {
+            if (!gatt_connect(bd_addr, bd_addr_type, p_tcb, transport)) {
                 GATT_TRACE_ERROR("gatt_connect failed");
                 fixed_queue_free(p_tcb->pending_enc_clcb, NULL);
                 fixed_queue_free(p_tcb->pending_ind_q, NULL);

components/bt/bluedroid/stack/gatt/gatt_sr.c

@@ -359,6 +359,7 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
     tGATT_IF gatt_if;
     UINT16  conn_id;
     UINT16  queue_num = 0;
+    BOOLEAN is_first = TRUE;
     BOOLEAN is_prepare_write_valid = FALSE;
     BOOLEAN is_need_dequeue_sr_cmd = FALSE;
     tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
@@ -420,6 +421,11 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
         queue_data = fixed_queue_dequeue(prepare_record->queue);
         if (is_prepare_write_valid){
             if((queue_data->p_attr->p_value != NULL) && (queue_data->p_attr->p_value->attr_val.attr_val != NULL)){
+                if(is_first) {
+                    //clear attr_val.attr_len before handle prepare write data
+                    queue_data->p_attr->p_value->attr_val.attr_len = 0;
+                    is_first = FALSE;
+                }
                 memcpy(queue_data->p_attr->p_value->attr_val.attr_val+queue_data->offset, queue_data->value, queue_data->len);
                 //don't forget to increase the attribute value length in the gatts database.
                 queue_data->p_attr->p_value->attr_val.attr_len += queue_data->len;
@@ -949,7 +955,10 @@ static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
             p_tcb->payload_size = mtu;
         }
 
-        l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+        /* host will set packet data length to 251 automatically if remote device support set packet data length,
+            so l2cble_set_fixed_channel_tx_data_length() is not necessary.
+            l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
+        */
 
         if ((p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, (tGATT_SR_MSG *) &p_tcb->payload_size)) != NULL) {
             attp_send_sr_msg (p_tcb, p_buf);

components/bt/bluedroid/stack/gatt/gatt_utils.c

@@ -1683,6 +1683,7 @@ tGATT_CLCB *gatt_clcb_alloc (UINT16 conn_id)
 void gatt_clcb_dealloc (tGATT_CLCB *p_clcb)
 {
     if (p_clcb && p_clcb->in_use) {
+        btu_free_timer(&p_clcb->rsp_timer_ent);
         memset(p_clcb, 0, sizeof(tGATT_CLCB));
     }
 }
@@ -1997,6 +1998,29 @@ BOOLEAN gatt_find_app_hold_link(tGATT_TCB *p_tcb, UINT8 start_idx, UINT8 *p_foun
     return found;
 }
 
+/*******************************************************************************
+**
+** Function         gatt_find_specific_app_in_hold_link
+**
+** Description      find the specific applicaiton that is holding the specified link
+**
+** Returns         Boolean
+**
+*******************************************************************************/
+BOOLEAN gatt_find_specific_app_in_hold_link(tGATT_TCB *p_tcb, tGATT_IF p_gatt_if)
+{
+    UINT8 i;
+    BOOLEAN found = FALSE;
+
+    for (i = 0; i < GATT_MAX_APPS; i ++) {
+        if (p_tcb->app_hold_link[i] && p_tcb->app_hold_link[i] == p_gatt_if) {
+            found = TRUE;
+            break;
+        }
+    }
+    return found;
+}
+
 /*******************************************************************************
 **
 ** Function         gatt_cmd_enq
@@ -2211,8 +2235,8 @@ void gatt_cleanup_upon_disc(BD_ADDR bda, UINT16 reason, tBT_TRANSPORT transport)
             }
         }
 
-        btu_stop_timer (&p_tcb->ind_ack_timer_ent);
-        btu_stop_timer (&p_tcb->conf_timer_ent);
+        btu_free_timer (&p_tcb->ind_ack_timer_ent);
+        btu_free_timer (&p_tcb->conf_timer_ent);
         gatt_free_pending_ind(p_tcb);
         gatt_free_pending_enc_queue(p_tcb);
         gatt_free_pending_prepare_write_queue(p_tcb);
@@ -2234,6 +2258,7 @@ void gatt_cleanup_upon_disc(BD_ADDR bda, UINT16 reason, tBT_TRANSPORT transport)
         GATT_TRACE_DEBUG ("exit gatt_cleanup_upon_disc ");
         BTM_Recovery_Pre_State();
     }
+    gatt_delete_dev_from_srv_chg_clt_list(bda);
 }
 /*******************************************************************************
 **

components/bt/bluedroid/stack/gatt/include/gatt_int.h

@@ -572,8 +572,8 @@ extern void gatt_free(void);
 
 /* from gatt_main.c */
 extern BOOLEAN gatt_disconnect (tGATT_TCB *p_tcb);
-extern BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBT_TRANSPORT transport);
-extern BOOLEAN gatt_connect (BD_ADDR rem_bda,  tGATT_TCB *p_tcb, tBT_TRANSPORT transport);
+extern BOOLEAN gatt_act_connect (tGATT_REG *p_reg, BD_ADDR bd_addr, tBLE_ADDR_TYPE bd_addr_type, tBT_TRANSPORT transport);
+extern BOOLEAN gatt_connect (BD_ADDR rem_bda, tBLE_ADDR_TYPE bd_addr_type, tGATT_TCB *p_tcb, tBT_TRANSPORT transport);
 extern void gatt_data_process (tGATT_TCB *p_tcb, BT_HDR *p_buf);
 extern void gatt_update_app_use_link_flag ( tGATT_IF gatt_if, tGATT_TCB *p_tcb, BOOLEAN is_add, BOOLEAN check_acl_link);
 
@@ -682,6 +682,7 @@ extern void gatt_sr_update_cback_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN
 extern void gatt_sr_update_prep_cnt(tGATT_TCB *p_tcb, tGATT_IF gatt_if, BOOLEAN is_inc, BOOLEAN is_reset_first);
 
 extern BOOLEAN gatt_find_app_hold_link(tGATT_TCB *p_tcb, UINT8 start_idx, UINT8 *p_found_idx, tGATT_IF *p_gatt_if);
+extern BOOLEAN gatt_find_specific_app_in_hold_link(tGATT_TCB *p_tcb, tGATT_IF p_gatt_if);
 extern UINT8 gatt_num_apps_hold_link(tGATT_TCB *p_tcb);
 extern UINT8 gatt_num_clcb_by_bd_addr(BD_ADDR bda);
 extern tGATT_TCB *gatt_find_tcb_by_cid(UINT16 lcid);

components/bt/bluedroid/stack/include/bt_types.h

@@ -499,6 +499,8 @@ typedef struct {
 #define BLE_ADDR_RANDOM         0x01
 #define BLE_ADDR_PUBLIC_ID      0x02
 #define BLE_ADDR_RANDOM_ID      0x03
+#define BLE_ADDR_TYPE_MAX       BLE_ADDR_RANDOM_ID
+#define BLE_ADDR_UNKNOWN_TYPE   0XFF
 typedef UINT8 tBLE_ADDR_TYPE;
 #define BLE_ADDR_TYPE_MASK      (BLE_ADDR_RANDOM | BLE_ADDR_PUBLIC)
 

components/bt/bluedroid/stack/include/btm_api.h

@@ -72,6 +72,8 @@ enum {
     BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED,/* 22 controller setting data length is unsupported*/
     BTM_SET_PRIVACY_SUCCESS,            /* 23 enable/disable local privacy success */
     BTM_SET_PRIVACY_FAIL,               /* 24 enable/disable local privacy failed*/
+    BTM_SET_STATIC_RAND_ADDR_FAIL,      /* 25 Command failed */
+    BTM_INVALID_STATIC_RAND_ADDR,       /* 26 invalid static rand addr */
 };
 
 typedef uint8_t tBTM_STATUS;
@@ -182,6 +184,8 @@ typedef void (tBTM_UPDATE_CONN_PARAM_CBACK) (UINT8 status, BD_ADDR bd_addr, tBTM
 
 typedef void (tBTM_SET_PKT_DATA_LENGTH_CBACK) (UINT8 status, tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS *data_length_params);
 
+typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status);
+
 typedef void (tBTM_ADD_WHITELIST_CBACK) (UINT8 status, tBTM_WL_OPERATION wl_opration);
 
 typedef void (tBTM_SET_LOCAL_PRIVACY_CBACK) (UINT8 status);

components/bt/bluedroid/stack/include/btm_ble_api.h

@@ -573,6 +573,12 @@ typedef struct {
     tBTM_BLE_REF_VALUE             ref_value;
 } tBTM_BLE_BATCH_SCAN_CB;
 
+/// Ble scan duplicate type
+enum {
+    BTM_BLE_SCAN_DUPLICATE_DISABLE           = 0x0,  /*!< the Link Layer should generate advertising reports to the host for each packet received */
+    BTM_BLE_SCAN_DUPLICATE_ENABLE            = 0x1,  /*!< the Link Layer should filter out duplicate advertising reports to the Host */
+    BTM_BLE_SCAN_DUPLICATE_MAX               = 0x2,  /*!< 0x02 – 0xFF, Reserved for future use */
+};
 /* filter selection bit index  */
 #define BTM_BLE_PF_ADDR_FILTER          0
 #define BTM_BLE_PF_SRVC_DATA            1
@@ -852,6 +858,11 @@ typedef void (*tBLE_SCAN_PARAM_SETUP_CBACK)(tGATT_IF client_if, tBTM_STATUS stat
 
 tBTM_BLE_SCAN_SETUP_CBACK bta_ble_scan_setup_cb;
 
+typedef void (tBTM_START_ADV_CMPL_CBACK) (UINT8 status);
+typedef void (tBTM_START_STOP_ADV_CMPL_CBACK) (UINT8 status);
+
+
+
 /*****************************************************************************
 **  EXTERNAL FUNCTION DECLARATIONS
 *****************************************************************************/
@@ -943,7 +954,7 @@ tBTM_STATUS BTM_BleSetAdvParams(UINT16 adv_int_min, UINT16 adv_int_max,
 *******************************************************************************/
 tBTM_STATUS BTM_BleSetAdvParamsStartAdv(UINT16 adv_int_min, UINT16 adv_int_max, UINT8 adv_type,
                                         tBLE_ADDR_TYPE own_bda_type, tBLE_BD_ADDR *p_dir_bda,
-                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp);
+                                        tBTM_BLE_ADV_CHNL_MAP chnl_map, tBTM_BLE_AFP afp, tBTM_START_ADV_CMPL_CBACK *adv_cb);
 
 
 /*******************************************************************************
@@ -977,7 +988,7 @@ tBTM_STATUS BTM_BleWriteAdvData(tBTM_BLE_AD_MASK  data_mask,
 tBTM_STATUS BTM_BleWriteAdvDataRaw(UINT8 *p_raw_adv, UINT32 raw_adv_len);
 
 
-BOOLEAN BTM_BleSetRandAddress(BD_ADDR rand_addr);
+tBTM_STATUS BTM_BleSetRandAddress(BD_ADDR rand_addr);
 
 
 /*******************************************************************************
@@ -1045,6 +1056,7 @@ void BTM_BleSetScanParams(tGATT_IF client_if, UINT32 scan_interval,
 **                  scan_window - Scan window
 **                  scan_type - Scan type
 **                  addr_type_own - owner address type
+**                  scan_duplicate_filter - scan duplicate filter
 **                  scan_filter_policy - scan filter policy
 **                  scan_setup_status_cback - Scan setup status callback
 **
@@ -1052,7 +1064,7 @@ void BTM_BleSetScanParams(tGATT_IF client_if, UINT32 scan_interval,
 **
 *******************************************************************************/
 void BTM_BleSetScanFilterParams(tGATT_IF client_if, UINT32 scan_interval, UINT32 scan_window,
-                                tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, tBTM_BLE_SFP scan_filter_policy,
+                                tBLE_SCAN_MODE scan_mode, UINT8 addr_type_own, UINT8 scan_duplicate_filter, tBTM_BLE_SFP scan_filter_policy,
                                 tBLE_SCAN_PARAM_SETUP_CBACK scan_setup_status_cback);
 
 
@@ -1610,7 +1622,7 @@ BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda,
 **
 *******************************************************************************/
 //extern
-tBTM_STATUS BTM_BleBroadcast(BOOLEAN start);
+tBTM_STATUS BTM_BleBroadcast(BOOLEAN start, tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cback);
 
 /*******************************************************************************
 **