Merge branch 'bugfix/backtrace_from_interrupts_backport_v3.1' into 'release/v3.1'

Make backtrace work across interrupts (backport v3.1) See merge request idf/esp-idf!4182
Merge branch 'fix/nvs_host_test' into 'release/v3.1'
2019-02-13 16:53:39 +08:00 · 2019-02-04 14:28:26 +08:00 · 2019-02-01 21:29:15 +08:00 · 2019-01-31 18:47:07 +05:30 · 2019-01-31 12:22:10 +00:00 · 2019-01-31 14:31:26 +08:00
590 changed files with 17864 additions and 5931 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,9 +2,9 @@ stages:
  - build
  - assign_test
  - host_test
-  - unit_test
-  - integration_test
+  - target_test
  - deploy
+  - post_check

 variables:
 # System environment
@@ -49,6 +49,7 @@ variables:
  python $APPLY_BOT_FILTER_SCRIPT || exit 0

 before_script:
+  - source tools/ci/setup_python.sh
  - *git_clean_stale_submodules
  # apply bot filter in before script
  - *apply_bot_filter
@@ -70,6 +71,7 @@ before_script:

 .do_nothing_before:
  before_script: &do_nothing_before
+    - source tools/ci/setup_python.sh
    - *git_clean_stale_submodules
    # apply bot filter in before script
    - *apply_bot_filter
@@ -78,6 +80,7 @@ before_script:

 .add_gitlab_key_before:
  before_script: &add_gitlab_key_before
+    - source tools/ci/setup_python.sh
    - *git_clean_stale_submodules
    # apply bot filter in before script
    - *apply_bot_filter
@@ -99,13 +102,21 @@ build_template_app:
  variables:
    BATCH_BUILD: "1"
    IDF_CI_BUILD: "1"
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_REGULAR_TEST
  script:
-    - git clone https://github.com/espressif/esp-idf-template.git
+    # Set the variable for 'esp-idf-template' testing
+    - ESP_IDF_TEMPLATE_GIT=${ESP_IDF_TEMPLATE_GIT:-"https://github.com/espressif/esp-idf-template.git"}
+    - git clone ${ESP_IDF_TEMPLATE_GIT}
    - cd esp-idf-template
    # Try to use the same branch name for esp-idf-template that we're
    # using on esp-idf. If it doesn't exist then just stick to the default
    # branch
    - python $CHECKOUT_REF_SCRIPT esp-idf-template
+    - make defconfig
    # Test debug build (default)
    - make all V=1
    # Now test release build
@@ -135,6 +146,12 @@ build_template_app:
    expire_in: 1 mos
  variables:
    SSC_CONFIG_FOLDER: "$CI_PROJECT_DIR/SSC/configs/ESP32_IDF"
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_INTEGRATION_TEST
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - git clone $SSC_REPOSITORY
    - cd SSC
@@ -161,6 +178,12 @@ build_esp_idf_tests:
      - components/idf_test/unit_test/TestCaseAll.yml
      - components/idf_test/unit_test/CIConfigs/*.yml
    expire_in: 1 mos
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_UNIT_TEST
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - cd tools/unit-test-app
    - MAKEFLAGS= make help # make sure kconfig tools are built in single process
@@ -170,7 +193,7 @@ build_esp_idf_tests:
    - make ut-build-all-configs
    - python tools/UnitTestParser.py

-.build_examples_template: &build_examples_template
+.build_examples_make_template: &build_examples_make_template
  <<: *build_template
  retry: 1
  artifacts:
@@ -185,7 +208,13 @@ build_esp_idf_tests:
    expire_in: 1 week
  variables:
    IDF_CI_BUILD: "1"
-    LOG_PATH: "$CI_PROJECT_DIR/log_examples"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples_make"
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_EXAMPLE_TEST
+      - $BOT_LABEL_REGULAR_TEST
  script:
    # it's not possible to build 100% out-of-tree and have the "artifacts"
    # mechanism work, but this is the next best thing
@@ -195,36 +224,81 @@ build_esp_idf_tests:
    # build some of examples
    - mkdir -p ${LOG_PATH}
    - ${IDF_PATH}/tools/ci/build_examples.sh "${CI_JOB_NAME}"
-    # and again, with cmake!
-    - rm -rf ../build_examples_cmake
-    - mkdir ../build_examples_cmake
-    - cd ../build_examples_cmake
-    - mkdir -p ${LOG_PATH}_cmake
-    - LOG_PATH=${LOG_PATH}_cmake ${IDF_PATH}/tools/ci/build_examples_cmake.sh "${CI_JOB_NAME}"

-build_examples_00:
-  <<: *build_examples_template
+# same as above, but for CMake
+.build_examples_cmake_template: &build_examples_cmake_template
+  <<: *build_template
+  retry: 1
+  artifacts:
+    when: always
+    paths:
+      - build_examples_cmake/*/*/*/build/*.bin
+      - build_examples_cmake/*/*/*/build/*.elf
+      - build_examples_cmake/*/*/*/build/*.map
+      - build_examples_cmake/*/*/*/build/download.config
+      - build_examples_cmake/*/*/*/build/bootloader/*.bin
+      - $LOG_PATH
+    expire_in: 1 week
+  variables:
+    IDF_CI_BUILD: "1"
+    LOG_PATH: "$CI_PROJECT_DIR/log_examples_cmake"
+  script:
+    # it's not possible to build 100% out-of-tree and have the "artifacts"
+    # mechanism work, but this is the next best thing
+    - rm -rf build_examples_cmake
+    - mkdir build_examples_cmake
+    - cd build_examples_cmake
+    # build some of examples
+    - mkdir -p ${LOG_PATH}
+    - ${IDF_PATH}/tools/ci/build_examples_cmake.sh "${CI_JOB_NAME}"

-build_examples_01:
-  <<: *build_examples_template
+build_examples_make_00:
+  <<: *build_examples_make_template

-build_examples_02:
-  <<: *build_examples_template
+build_examples_make_01:
+  <<: *build_examples_make_template

-build_examples_03:
-  <<: *build_examples_template
+build_examples_make_02:
+  <<: *build_examples_make_template

-build_examples_04:
-  <<: *build_examples_template
+build_examples_make_03:
+  <<: *build_examples_make_template

-build_examples_05:
-  <<: *build_examples_template
+build_examples_make_04:
+  <<: *build_examples_make_template

-build_examples_06:
-  <<: *build_examples_template
+build_examples_make_05:
+  <<: *build_examples_make_template

-build_examples_07:
-  <<: *build_examples_template
+build_examples_make_06:
+  <<: *build_examples_make_template
+
+build_examples_make_07:
+  <<: *build_examples_make_template
+
+build_examples_cmake_00:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_01:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_02:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_03:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_04:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_05:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_06:
+  <<: *build_examples_cmake_template
+
+build_examples_cmake_07:
+  <<: *build_examples_cmake_template

 # If you want to add new build example jobs, please add it into dependencies of `.example_test_template`

@@ -247,6 +321,12 @@ build_docs:
      - docs/zh_CN/sphinx-warning-log-sanitized.txt
      - docs/zh_CN/_build/html
    expire_in: 1 mos
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_BUILD_DOCS
+      - $BOT_LABEL_REGULAR_TEST
  script:
    - cd docs
    - ./check_lang_folder_sync.sh
@@ -262,6 +342,11 @@ build_docs:
 verify_cmake_style:
  stage: build
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD
+      - $BOT_LABEL_REGULAR_TEST
  script:
    tools/cmake/run_cmake_lint.sh

@@ -271,6 +356,11 @@ verify_cmake_style:
  tags:
    - host_test
  dependencies: []
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_HOST_TEST
+      - $BOT_LABEL_REGULAR_TEST

 test_nvs_on_host:
  <<: *host_test_template
@@ -284,10 +374,10 @@ test_nvs_coverage:
    paths:
      - components/nvs_flash/test_nvs_host/coverage_report
  only:
-    - triggers
-  # This job takes a few hours to finish, so only run it on demand
-  variables:
-    BOT_NEEDS_TRIGGER_BY_NAME: 1
+    refs:
+      - triggers
+    variables:
+      - $BOT_LABEL_NVS_COVERAGE
  script:
    - cd components/nvs_flash/test_nvs_host
    - make coverage_report
@@ -383,20 +473,22 @@ push_to_github:
    - echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
    - git remote remove github &>/dev/null || true
    - git remote add github git@github.com:espressif/esp-idf.git
-    # Need separate push commands for tag builds and for branch builds
-    - "[ -n \"${CI_COMMIT_TAG}\" ] && git push github ${CI_COMMIT_TAG}"
-    - "[ -z \"${CI_COMMIT_TAG}\" ] && git push github ${CI_COMMIT_SHA}:refs/heads/${CI_COMMIT_REF_NAME}"
+    - tools/ci/push_to_github.sh

 deploy_docs:
-  stage: host_test
+  stage: deploy
  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
  tags:
    - deploy
  only:
-   - master
-   - /^release\/v/
-   - /^v\d+\.\d+(\.\d+)?($|-)/
-   - triggers
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD_DOCS
  dependencies:
    - build_docs
  before_script: *do_nothing_before
@@ -428,8 +520,12 @@ check_doc_links:
  tags:
    - check_doc_links
  only:
-    # can only be triggered
-    - triggers
+    refs:
+      # can only be triggered
+      - triggers
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_BUILD_DOCS
  artifacts:
    paths:
      - docs/_build/linkcheck
@@ -504,6 +600,21 @@ check_submodule_sync:
    # check if all submodules are correctly synced to public repostory
    - git submodule update --init --recursive

+check_pipeline_triggered_by_label:
+  stage: post_check
+  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  dependencies: []
+  before_script: *do_nothing_before
+  tags:
+    - build
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL
+  script:
+    # If the pipeline is triggered with label, the pipeline will only succeeded if "regular_test" label is added.
+    # We want to make sure some jobs are always executed to detect regression.
+    - test "$BOT_LABEL_REGULAR_TEST" = "true" || exit -1
+
 assign_test:
  tags:
    - assign_test
@@ -525,6 +636,12 @@ assign_test:
      - components/idf_test/*/TC.sqlite
      - $EXAMPLE_CONFIG_OUTPUT_PATH
    expire_in: 1 mos
+  only:
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_UNIT_TEST
+      - $BOT_LABEL_INTEGRATION_TEST
+      - $BOT_LABEL_EXAMPLE_TEST
  before_script: *add_gitlab_key_before
  script:
    # assign example tests
@@ -539,29 +656,43 @@ assign_test:
    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin

 .example_test_template: &example_test_template
-  stage: integration_test
+  stage: target_test
  when: on_success
  only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-    - triggers
-    - schedules
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+      - schedules
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_EXAMPLE_TEST
  dependencies:
    - assign_test
-    - build_examples_00
-    - build_examples_01
-    - build_examples_02
-    - build_examples_03
-    - build_examples_04
-    - build_examples_05
-    - build_examples_06
-    - build_examples_07
+    - build_examples_make_00
+    - build_examples_make_01
+    - build_examples_make_02
+    - build_examples_make_03
+    - build_examples_make_04
+    - build_examples_make_05
+    - build_examples_make_06
+    - build_examples_make_07
+    - build_examples_cmake_00
+    - build_examples_cmake_01
+    - build_examples_cmake_02
+    - build_examples_cmake_03
+    - build_examples_cmake_04
+    - build_examples_cmake_05
+    - build_examples_cmake_06
+    - build_examples_cmake_07
  artifacts:
    when: always
    paths:
      - $LOG_PATH
-    expire_in: 1 mos
+    expire_in: 1 week
+    reports:
+        junit: $LOG_PATH/*/XUNIT_RESULT.xml
  variables:
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
@@ -581,10 +712,20 @@ assign_test:

 .unit_test_template: &unit_test_template
  <<: *example_test_template
-  stage: unit_test
+  stage: target_test
  dependencies:
    - assign_test
    - build_esp_idf_tests
+  only:
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+      - schedules
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_UNIT_TEST
  variables:
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    TEST_CASE_PATH: "$CI_PROJECT_DIR/tools/unit-test-app"
@@ -593,14 +734,18 @@ assign_test:
    ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"

 .test_template: &test_template
-  stage: integration_test
+  stage: target_test
  when: on_success
  only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
-    - triggers
-    - schedules
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+      - triggers
+      - schedules
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+      - $BOT_LABEL_INTEGRATION_TEST
  dependencies:
    - assign_test
    - build_ssc_00
@@ -665,6 +810,16 @@ example_test_001_01:

 example_test_002_01:
  <<: *example_test_template
+  tags:
+    - ESP32
+    - Example_ShieldBox_Basic
+
+example_test_006_01:
+  <<: *example_test_template
+  image: $CI_DOCKER_REGISTRY/ubuntu-test-env$BOT_DOCKER_IMAGE_TAG
+  only:
+    variables:
+      - $BOT_LABEL_IPERF_STRESS_TEST
  tags:
    - ESP32
    - Example_ShieldBox
@@ -818,7 +973,7 @@ UT_001_25:
  tags:
    - ESP32_IDF
    - UT_T1_1
-    
+
 UT_001_26:
  <<: *unit_test_template
  tags:
@@ -855,6 +1010,18 @@ UT_001_31:
    - ESP32_IDF
    - UT_T1_1

+UT_001_32:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
+UT_001_32:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
 UT_002_01:
  <<: *unit_test_template
  tags:
@@ -960,7 +1127,14 @@ UT_004_10:
    - ESP32_IDF
    - UT_T1_1
    - psram
-    
+
+UT_004_11:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - psram
+
 UT_005_01:
  <<: *unit_test_template
  tags:
@@ -1050,65 +1224,73 @@ UT_010_04:
    - UT_T1_RMT
    - psram

+UT_017_01:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+
+UT_017_02:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+
+UT_017_03:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+
+UT_017_04:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+    - psram
+
+UT_017_05:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+    - 8Mpsram
+
 UT_601_01:
  <<: *unit_test_template
  tags:
    - ESP32_IDF
    - UT_T1_1

+UT_601_02:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
+UT_601_03:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
 IT_001_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
+    - SSC_T1_4

 IT_001_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
+    - SSC_T1_4

 IT_001_03:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_04:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_05:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_06:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_07:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_08:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
-
-IT_001_09:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_1
+    - SSC_T1_4

 IT_002_01:
  <<: *test_template
@@ -1120,85 +1302,79 @@ IT_003_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_03:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_04:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_05:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_06:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_07:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_08:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_09:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_10:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_11:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_12:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_003_13:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
-
-IT_003_14:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_1
+    - SSC_T2_5

 IT_004_01:
  <<: *test_template
@@ -1210,7 +1386,79 @@ IT_005_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_WEP
+    - SSC_T1_5
+
+IT_005_02:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_5
+
+IT_006_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_02:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_03:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_04:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_05:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_06:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_006_07:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_6
+
+IT_007_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_7
+
+IT_007_02:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_7
+
+IT_007_03:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_7
+
+IT_008_01:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_8

 IT_009_01:
  <<: *test_template
@@ -1230,58 +1478,38 @@ IT_011_01:
    - ESP32_IDF
    - SSC_T50_1

-IT_501_01:
+IT_012_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-    - stress_test
+    - SSC_T1_9

-IT_501_02:
+IT_012_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-    - stress_test
+    - SSC_T1_9

-IT_501_03:
+IT_013_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T1_1
-    - stress_test
+    - SSC_T2_2

-IT_502_01:
+IT_013_02:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
-    - stress_test
+    - SSC_T2_2

-IT_502_02:
+IT_014_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_1
-    - stress_test
+    - SSC_T2_3

-IT_503_01:
+IT_015_01:
  <<: *test_template
  tags:
    - ESP32_IDF
-    - SSC_T5_1
-    - stress_test
-
-IT_503_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T5_1
-    - stress_test
-
-IT_503_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T5_1
-    - stress_test
+    - SSC_T2_4
--- a/components/app_trace/CMakeLists.txt
+++ b/components/app_trace/CMakeLists.txt
@@ -1,4 +1,7 @@
-set(COMPONENT_SRCDIRS "." "gcov")
+set(COMPONENT_SRCS "app_trace.c"
+                   "app_trace_util.c"
+                   "host_file_io.c"
+                   "gcov/gcov_rtio.c")
 set(COMPONENT_ADD_INCLUDEDIRS "include")

 if(CONFIG_SYSVIEW_ENABLE)
@@ -7,11 +10,10 @@ if(CONFIG_SYSVIEW_ENABLE)
        sys_view/SEGGER
        sys_view/Sample/OS)

-    list(APPEND COMPONENT_SRCDIRS
-        "sys_view/SEGGER"
-        "sys_view/Sample/OS"
-        "sys_view/Sample/Config"
-        "sys_view/esp32")
+    list(APPEND COMPONENT_SRCS "sys_view/SEGGER/SEGGER_SYSVIEW.c"
+                   "sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c"
+                   "sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.c"
+                   "sys_view/esp32/SEGGER_RTT_esp32.c")
 endif()

 set(COMPONENT_REQUIRES)
@@ -22,3 +24,5 @@ register_component()
 # disable --coverage for this component, as it is used as transport
 # for gcov
 component_compile_options("-fno-profile-arcs" "-fno-test-coverage")
+
+target_link_libraries(app_trace gcov)
--- a/components/app_update/CMakeLists.txt
+++ b/components/app_update/CMakeLists.txt
@@ -1,4 +1,4 @@
-set(COMPONENT_SRCDIRS ".")
+set(COMPONENT_SRCS "esp_ota_ops.c")
 set(COMPONENT_ADD_INCLUDEDIRS "include")

 set(COMPONENT_REQUIRES spi_flash)
--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@@ -145,8 +145,7 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
        if (it->handle == handle) {
            // must erase the partition before writing to it
            assert(it->erased_size > 0 && "must erase the partition before writing to it");
-
-            if(it->wrote_size == 0 && size > 0 && data_bytes[0] != 0xE9) {
+            if (it->wrote_size == 0 && it->partial_bytes == 0 && size > 0 && data_bytes[0] != ESP_IMAGE_HEADER_MAGIC) {
                ESP_LOGE(TAG, "OTA image has invalid magic byte (expected 0xE9, saw 0x%02x", data_bytes[0]);
                return ESP_ERR_OTA_VALIDATE_FAILED;
            }
@@ -292,7 +291,7 @@ static esp_err_t esp_rewrite_ota_data(esp_partition_subtype_t subtype)
    uint16_t ota_app_count = 0;
    uint32_t i = 0;
    uint32_t seq;
-    static spi_flash_mmap_memory_t ota_data_map;
+    spi_flash_mmap_handle_t ota_data_map;
    const void *result = NULL;

    find_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
@@ -377,7 +376,7 @@ esp_err_t esp_ota_set_boot_partition(const esp_partition_t *partition)
        return ESP_ERR_OTA_VALIDATE_FAILED;
    }

-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef CONFIG_SECURE_SIGNED_ON_UPDATE
    esp_err_t ret = esp_secure_boot_verify_signature(partition->address, data.image_len);
    if (ret != ESP_OK) {
        return ESP_ERR_OTA_VALIDATE_FAILED;
@@ -438,7 +437,7 @@ const esp_partition_t *esp_ota_get_boot_partition(void)
 {
    esp_err_t ret;
    const esp_partition_t *find_partition = NULL;
-    static spi_flash_mmap_memory_t ota_data_map;
+    spi_flash_mmap_handle_t ota_data_map;
    const void *result = NULL;
    uint16_t ota_app_count = 0;
    find_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
@@ -494,9 +493,18 @@ const esp_partition_t *esp_ota_get_boot_partition(void)

 const esp_partition_t* esp_ota_get_running_partition(void)
 {
+    static const esp_partition_t *curr_partition = NULL;
+
+    /*
+     * Currently running partition is unlikely to change across reset cycle,
+     * so it can be cached here, and avoid lookup on every flash write operation.
+     */
+    if (curr_partition != NULL) {
+        return curr_partition;
+    }
+
    /* Find the flash address of this exact function. By definition that is part
       of the currently running firmware. Then find the enclosing partition. */
-
    size_t phys_offs = spi_flash_cache2phys(esp_ota_get_running_partition);

    assert (phys_offs != SPI_FLASH_CACHE2PHYS_FAIL); /* indicates cache2phys lookup is buggy */
@@ -510,6 +518,7 @@ const esp_partition_t* esp_ota_get_running_partition(void)
        const esp_partition_t *p = esp_partition_get(it);
        if (p->address <= phys_offs && p->address + p->size > phys_offs) {
            esp_partition_iterator_release(it);
+            curr_partition = p;
            return p;
        }
        it = esp_partition_next(it);
--- a/components/aws_iot/CMakeLists.txt
+++ b/components/aws_iot/CMakeLists.txt
@@ -1,6 +1,21 @@
 if(CONFIG_AWS_IOT_SDK)
    set(COMPONENT_ADD_INCLUDEDIRS "include aws-iot-device-sdk-embedded-C/include")
-    set(COMPONENT_SRCDIRS "aws-iot-device-sdk-embedded-C/src port")
+    set(aws_sdk_src aws-iot-device-sdk-embedded-C/src)
+    set(COMPONENT_SRCS "${aws_sdk_src}/aws_iot_json_utils.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_common_internal.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_connect.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_publish.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_subscribe.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_unsubscribe.c"
+                   "${aws_sdk_src}/aws_iot_mqtt_client_yield.c"
+                   "${aws_sdk_src}/aws_iot_shadow.c"
+                   "${aws_sdk_src}/aws_iot_shadow_actions.c"
+                   "${aws_sdk_src}/aws_iot_shadow_json.c"
+                   "${aws_sdk_src}/aws_iot_shadow_records.c"
+                   "port/network_mbedtls_wrapper.c"
+                   "port/threads_freertos.c"
+                   "port/timer.c")
 else()
    message(STATUS "Building empty aws_iot component due to configuration")
 endif()
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -132,9 +132,59 @@ endmenu  # Bootloader

 menu "Security features"

+# These three are the actual options to check in code,
+# selected by the displayed options
+config SECURE_SIGNED_ON_BOOT
+    bool
+    default y
+    depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
+
+config SECURE_SIGNED_ON_UPDATE
+    bool
+    default y
+    depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
+
+config SECURE_SIGNED_APPS
+   bool
+   default y
+   depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE
+
+
+config SECURE_SIGNED_APPS_NO_SECURE_BOOT
+    bool "Require signed app images"
+    default n
+    depends on !SECURE_BOOT_ENABLED
+    help
+        Require apps to be signed to verify their integrity.
+
+        This option uses the same app signature scheme as hardware secure boot, but unlike hardware secure boot it does not prevent the bootloader from being physically updated. This means that the device can be secured against remote network access, but not physical access. Compared to using hardware Secure Boot this option is much simpler to implement.
+
+config SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
+    bool "Bootloader verifies app signatures"
+    default n
+    depends on SECURE_SIGNED_APPS_NO_SECURE_BOOT
+    help
+        If this option is set, the bootloader will be compiled with code to verify that an app is signed before booting it.
+
+        If hardware secure boot is enabled, this option is always enabled and cannot be disabled.
+        If hardware secure boot is not enabled, this option doesn't add significant security by itself so most users will want to leave it disabled.
+
+config SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
+    bool "Verify app signature on update"
+    default y
+    depends on SECURE_SIGNED_APPS_NO_SECURE_BOOT
+    help
+         If this option is set, any OTA updated apps will have the signature verified before being considered valid.
+
+         When enabled, the signature is automatically checked whenever the esp_ota_ops.h APIs are used for OTA updates,
+         or esp_image_format.h APIs are used to verify apps.
+
+         If hardware secure boot is enabled, this option is always enabled and cannot be disabled.
+         If hardware secure boot is not enabled, this option still adds significant security against network-based attackers by preventing spoofing of OTA updates.
+
 config SECURE_BOOT_ENABLED
-    bool "Enable secure boot in bootloader (READ DOCS FIRST)"
-    default N
+    bool "Enable hardware secure boot in bootloader (READ DOCS FIRST)"
+    default n
    help
        Build a bootloader which enables secure boot on first boot.

@@ -169,12 +219,12 @@ endchoice

 config SECURE_BOOT_BUILD_SIGNED_BINARIES
     bool "Sign binaries during build"
-     depends on SECURE_BOOT_ENABLED
+     depends on SECURE_SIGNED_APPS
     default y
     help
-        Once secure boot is enabled, bootloader will only boot if partition table and app image are signed.
+        Once secure boot or signed app requirement is enabled, app images are required to be signed.

-        If enabled, these binary files are signed as part of the build process. The file named in "Secure boot private signing key" will be used to sign the image.
+        If enabled (default), these binary files are signed as part of the build process. The file named in "Secure boot private signing key" will be used to sign the image.

        If disabled, unsigned app/partition data will be built. They must be signed manually using espsecure.py (for example, on a remote signing server.)

@@ -183,7 +233,7 @@ config SECURE_BOOT_SIGNING_KEY
     depends on SECURE_BOOT_BUILD_SIGNED_BINARIES
     default secure_boot_signing_key.pem
     help
-        Path to the key file used to sign partition tables and app images for secure boot. Once secure boot is enabled, bootloader will only boot if partition table and app image are signed.
+        Path to the key file used to sign app images.

        Key file is an ECDSA private key (NIST256p curve) in PEM format.

@@ -196,11 +246,11 @@ config SECURE_BOOT_SIGNING_KEY

 config SECURE_BOOT_VERIFICATION_KEY
    string "Secure boot public signature verification key"
-    depends on SECURE_BOOT_ENABLED && !SECURE_BOOT_BUILD_SIGNED_BINARIES
+    depends on SECURE_SIGNED_APPS && !SECURE_BOOT_BUILD_SIGNED_BINARIES
    default signature_verification_key.bin
    help
-       Path to a public key file used to verify signed images. This key is compiled into the bootloader,
-       and may also be used to verify signatures on OTA images after download.
+       Path to a public key file used to verify signed images. This key is compiled into the bootloader and/or app,
+       to verify app images.

       Key file is in raw binary format, and can be extracted from a
       PEM formatted private key using the espsecure.py
@@ -208,6 +258,27 @@ config SECURE_BOOT_VERIFICATION_KEY

       Refer to https://docs.espressif.com/projects/esp-idf/en/latest/security/secure-boot.html before enabling.

+choice SECURE_BOOTLOADER_KEY_ENCODING
+    bool "Hardware Key Encoding"
+    depends on SECURE_BOOTLOADER_REFLASHABLE
+    default SECURE_BOOTLOADER_NO_ENCODING
+    help
+
+    In reflashable secure bootloader mode, a hardware key is derived from the signing key (with SHA-256) and can be written to efuse
+    with espefuse.py.
+
+    Normally this is a 256-bit key, but if 3/4 Coding Scheme is used on the device then the efuse key is truncated to 192 bits.
+
+    This configuration item doesn't change any firmware code, it only changes the size of key binary which is generated at build time.
+
+config SECURE_BOOTLOADER_KEY_ENCODING_256BIT
+       bool "No encoding (256 bit key)"
+
+config SECURE_BOOTLOADER_KEY_ENCODING_192BIT
+       bool "3/4 encoding (192 bit key)"
+
+endchoice
+
 config SECURE_BOOT_INSECURE
    bool "Allow potentially insecure options"
    depends on SECURE_BOOT_ENABLED
--- a/components/bootloader/Makefile.projbuild
+++ b/components/bootloader/Makefile.projbuild
@@ -78,12 +78,18 @@ else ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 # Reflashable secure bootloader
 # generates a digest binary (bootloader + digest)

+ifdef CONFIG_SECURE_BOOTLOADER_KEY_ENCODING_192BIT
+KEY_DIGEST_LEN=192
+else
+KEY_DIGEST_LEN=256
+endif
+
 BOOTLOADER_DIGEST_BIN := $(BOOTLOADER_BUILD_DIR)/bootloader-reflash-digest.bin
-SECURE_BOOTLOADER_KEY := $(BOOTLOADER_BUILD_DIR)/secure-bootloader-key.bin
+SECURE_BOOTLOADER_KEY := $(BOOTLOADER_BUILD_DIR)/secure-bootloader-key-$(KEY_DIGEST_LEN).bin

 ifdef CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES
 $(SECURE_BOOTLOADER_KEY): $(SECURE_BOOT_SIGNING_KEY)
-	$(ESPSECUREPY) digest_private_key -k $< $@
+	$(ESPSECUREPY) digest_private_key --keylen $(KEY_DIGEST_LEN) -k $< $@
 else
 $(SECURE_BOOTLOADER_KEY):
 	@echo "No pre-generated key for a reflashable secure bootloader is available, due to signing configuration."
--- a/components/bootloader/subproject/CMakeLists.txt
+++ b/components/bootloader/subproject/CMakeLists.txt
@@ -10,14 +10,12 @@ if(NOT IDF_PATH)
        "in by the parent build process.")
 endif()

-set(COMPONENTS bootloader esptool_py esp32 partition_table soc bootloader_support log spi_flash micro-ecc soc)
+set(COMPONENTS bootloader esptool_py esp32 partition_table soc bootloader_support log spi_flash micro-ecc soc main)
 set(BOOTLOADER_BUILD 1)
 add_definitions(-DBOOTLOADER_BUILD=1)

 set(COMPONENT_REQUIRES_COMMON log esp32 soc)

-set(MAIN_SRCS main/bootloader_start.c)
-
 include("${IDF_PATH}/tools/cmake/project.cmake")
 project(bootloader)

--- a/components/bootloader/subproject/main/CMakeLists.txt
+++ b/components/bootloader/subproject/main/CMakeLists.txt
@@ -0,0 +1,4 @@
+set(COMPONENT_SRCS "bootloader_start.c")
+set(COMPONENT_ADD_INCLUDEDIRS "")
+set(COMPONENT_REQUIRES "bootloader bootloader_support")
+register_component()
--- a/components/bootloader/subproject/main/esp32.bootloader.ld
+++ b/components/bootloader/subproject/main/esp32.bootloader.ld
@@ -30,12 +30,12 @@ SECTIONS
  .iram_loader.text :
  {
    . = ALIGN (16);
-    _stext = .;
-    _text_start = ABSOLUTE(.);
+    _loader_text_start = ABSOLUTE(.);
    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
    *liblog.a:(.literal .text .literal.* .text.*)
    *libgcc.a:(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common.o(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
@@ -48,11 +48,11 @@ SECTIONS
    *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
    *(.fini.literal)
    *(.fini)
    *(.gnu.version)
-    _text_end = ABSOLUTE(.);
-    _etext = .;
+    _loader_text_end = ABSOLUTE(.);
  } > iram_loader_seg

  .iram.text :
--- a/components/bootloader/subproject/main/esp32.bootloader.rom.ld
+++ b/components/bootloader/subproject/main/esp32.bootloader.rom.ld
@@ -1 +1,4 @@
 PROVIDE ( ets_update_cpu_frequency = 0x40008550 ); /* Updates g_ticks_per_us on the current CPU only; not on the other core */
+PROVIDE ( MD5Final = 0x4005db1c );
+PROVIDE ( MD5Init = 0x4005da7c );
+PROVIDE ( MD5Update = 0x4005da9c );
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@@ -1,9 +1,22 @@
-set(COMPONENT_SRCDIRS "src")
+set(COMPONENT_SRCS "src/bootloader_clock.c"
+                   "src/bootloader_common.c"
+                   "src/bootloader_flash.c"
+                   "src/bootloader_random.c"
+                   "src/bootloader_sha.c"
+                   "src/bootloader_utility.c"
+                   "src/efuse.c"
+                   "src/esp_image_format.c"
+                   "src/flash_encrypt.c"
+                   "src/flash_partitions.c"
+                   "src/flash_qio_mode.c"
+                   "src/secure_boot.c"
+                   "src/secure_boot_signatures.c")

 if(${BOOTLOADER_BUILD})
    set(COMPONENT_ADD_INCLUDEDIRS "include include_priv")
    set(COMPONENT_REQUIRES)
    set(COMPONENT_PRIV_REQUIRES spi_flash micro-ecc)
+    list(APPEND COMPONENT_SRCS "src/bootloader_init.c")
 else()
    set(COMPONENT_ADD_INCLUDEDIRS "include")
    set(COMPONENT_PRIV_INCLUDEDIRS "include_priv")
--- a/components/bootloader_support/component.mk
+++ b/components/bootloader_support/component.mk
@@ -9,10 +9,14 @@ endif

 COMPONENT_SRCDIRS := src

+ifndef IS_BOOTLOADER_BUILD
+COMPONENT_OBJEXCLUDE := src/bootloader_init.o
+endif
+
 #
 # Secure boot signing key support
 #
-ifdef CONFIG_SECURE_BOOT_ENABLED
+ifdef CONFIG_SECURE_SIGNED_APPS

 # this path is created relative to the component build directory
 SECURE_BOOT_VERIFICATION_KEY := $(abspath signature_verification_key.bin)
--- a/components/bootloader_support/include/bootloader_util.h
+++ b/components/bootloader_support/include/bootloader_util.h
@@ -0,0 +1,34 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <stddef.h>
+
+/**
+ * @brief Check if half-open intervals overlap
+ *
+ * @param start1  interval 1 start
+ * @param end1    interval 1 end
+ * @param start2  interval 2 start
+ * @param end2    interval 2 end
+ * @return true iff [start1; end1) overlaps [start2; end2)
+ */
+static inline bool bootloader_util_regions_overlap(
+        const intptr_t start1, const intptr_t end1,
+        const intptr_t start2, const intptr_t end2)
+{
+    return (end1 > start2 && end2 > start1) ||
+           !(end1 <= start2 || end2 <= start1);
+}
--- a/components/bootloader_support/include/esp_efuse.h
+++ b/components/bootloader_support/include/esp_efuse.h
@@ -15,6 +15,7 @@
 #define _ESP_EFUSE_H

 #include "soc/efuse_reg.h"
+#include "esp_err.h"

 #ifdef __cplusplus
 extern "C" {
@@ -58,6 +59,38 @@ void esp_efuse_reset(void);
 */
 void esp_efuse_disable_basic_rom_console(void);

+/* @brief Encode one or more sets of 6 byte sequences into
+ * 8 bytes suitable for 3/4 Coding Scheme.
+ *
+ * This function is only useful if the CODING_SCHEME efuse
+ * is set to value 1 for 3/4 Coding Scheme.
+ *
+ * @param[in] in_bytes Pointer to a sequence of bytes to encode for 3/4 Coding Scheme. Must have length in_bytes_len. After being written to hardware, these bytes will read back as little-endian words.
+ * @param[out] out_words Pointer to array of words suitable for writing to efuse write registers. Array must contain 2 words (8 bytes) for every 6 bytes in in_bytes_len. Can be a pointer to efuse write registers.
+ * @param in_bytes_len. Length of array pointed to by in_bytes, in bytes. Must be a multiple of 6.
+ *
+ * @return ESP_ERR_INVALID_ARG if either pointer is null or in_bytes_len is not a multiple of 6. ESP_OK otherwise.
+ */
+esp_err_t esp_efuse_apply_34_encoding(const uint8_t *in_bytes, uint32_t *out_words, size_t in_bytes_len);
+
+/* @brief Write random data to efuse key block write registers
+ *
+ * @note Caller is responsible for ensuring efuse
+ * block is empty and not write protected, before calling.
+ *
+ * @note Behaviour depends on coding scheme: a 256-bit key is
+ * generated and written for Coding Scheme "None", a 192-bit key
+ * is generated, extended to 256-bits by the Coding Scheme,
+ * and then writtten for 3/4 Coding Scheme.
+ *
+ * @note This function does not burn the new values, caller should
+ * call esp_efuse_burn_new_values() when ready to do this.
+ *
+ * @param blk_wdata0_reg Address of the first data write register
+ * in the block
+ */
+void esp_efuse_write_random_key(uint32_t blk_wdata0_reg);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@@ -81,6 +81,8 @@ typedef struct {

 _Static_assert(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");

+#define ESP_IMAGE_HASH_LEN 32 /* Length of the appended SHA-256 digest */
+
 /* Header of binary image segment */
 typedef struct {
    uint32_t load_addr;
@@ -142,6 +144,16 @@ esp_err_t esp_image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *
 */
 esp_err_t esp_image_verify_bootloader(uint32_t *length);

+/**
+ * @brief Verify the bootloader image.
+ *
+ * @param[out] Metadata for the image. Only valid if result is ESP_OK.
+ *
+ * @return As per esp_image_load_metadata().
+ */
+esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data);
+
+
 typedef struct {
    uint32_t drom_addr;
    uint32_t drom_load_addr;
--- a/components/bootloader_support/include/esp_secure_boot.h
+++ b/components/bootloader_support/include/esp_secure_boot.h
@@ -17,6 +17,14 @@
 #include <esp_err.h>
 #include "soc/efuse_reg.h"

+#include "sdkconfig.h"
+
+#ifdef CONFIG_SECURE_BOOT_ENABLED
+#if !defined(CONFIG_SECURE_SIGNED_ON_BOOT) || !defined(CONFIG_SECURE_SIGNED_ON_UPDATE) || !defined(CONFIG_SECURE_SIGNED_APPS)
+#error "internal sdkconfig error, secure boot should always enable all signature options"
+#endif
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
--- a/components/bootloader_support/include_priv/bootloader_flash.h
+++ b/components/bootloader_support/include_priv/bootloader_flash.h
@@ -100,4 +100,21 @@ esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool
 */
 esp_err_t bootloader_flash_erase_sector(size_t sector);

+/* Cache MMU block size */
+#define MMU_BLOCK_SIZE    0x00010000
+
+/* Cache MMU address mask (MMU tables ignore bits which are zero) */
+#define MMU_FLASH_MASK    (~(MMU_BLOCK_SIZE - 1))
+
+/**
+ * @brief Calculate the number of cache pages to map
+ * @param size  size of data to map
+ * @param vaddr  virtual address where data will be mapped
+ * @return number of cache MMU pages required to do the mapping
+ */
+static inline uint32_t bootloader_cache_pages_to_map(uint32_t size, uint32_t vaddr)
+{
+    return (size + (vaddr - (vaddr & MMU_FLASH_MASK)) + MMU_BLOCK_SIZE - 1) / MMU_BLOCK_SIZE;
+}
+
 #endif
--- a/components/bootloader_support/src/bootloader_flash.c
+++ b/components/bootloader_support/src/bootloader_flash.c
@@ -86,8 +86,6 @@ static const char *TAG = "bootloader_flash";
 */
 #define MMU_BLOCK0_VADDR  0x3f400000
 #define MMU_BLOCK50_VADDR 0x3f720000
-#define MMU_FLASH_MASK    0xffff0000
-#define MMU_BLOCK_SIZE    0x00010000

 static bool mapped;

@@ -107,10 +105,11 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
    }

    uint32_t src_addr_aligned = src_addr & MMU_FLASH_MASK;
-    uint32_t count = (size + (src_addr - src_addr_aligned) + 0xffff) / MMU_BLOCK_SIZE;
+    uint32_t count = bootloader_cache_pages_to_map(size, src_addr);
    Cache_Read_Disable(0);
    Cache_Flush(0);
-    ESP_LOGD(TAG, "mmu set paddr=%08x count=%d", src_addr_aligned, count );
+    ESP_LOGD(TAG, "mmu set paddr=%08x count=%d size=%x src_addr=%x src_addr_aligned=%x",
+            src_addr & MMU_FLASH_MASK, count, size, src_addr, src_addr_aligned );
    int e = cache_flash_mmu_set(0, 0, MMU_BLOCK0_VADDR, src_addr_aligned, 64, count);
    if (e != 0) {
        ESP_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);
--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@@ -71,6 +71,7 @@ static void wdt_reset_check(void);
 esp_err_t bootloader_init()
 {
    cpu_configure_region_protection();
+    cpu_init_memctl();

    /* Sanity check that static RAM is after the stack */
 #ifndef NDEBUG
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -131,6 +131,9 @@ bool bootloader_utility_load_partition_table(bootloader_state_t* bs)
            case PART_SUBTYPE_DATA_WIFI:
                partition_usage = "WiFi data";
                break;
+            case PART_SUBTYPE_DATA_NVS_KEYS:
+                partition_usage = "NVS keys";
+                break;
            default:
                partition_usage = "Unknown data";
                break;
@@ -384,7 +387,7 @@ static void unpack_load_app(const esp_image_metadata_t* data)
    // Find DROM & IROM addresses, to configure cache mappings
    for (int i = 0; i < data->image.segment_count; i++) {
        const esp_image_segment_header_t *header = &data->segments[i];
-        if (header->load_addr >= SOC_IROM_LOW && header->load_addr < SOC_IROM_HIGH) {
+        if (header->load_addr >= SOC_DROM_LOW && header->load_addr < SOC_DROM_HIGH) {
            if (drom_addr != 0) {
                ESP_LOGE(TAG, MAP_ERR_MSG, "DROM");
            } else {
@@ -394,7 +397,7 @@ static void unpack_load_app(const esp_image_metadata_t* data)
            drom_load_addr = header->load_addr;
            drom_size = header->data_len;
        }
-        if (header->load_addr >= SOC_DROM_LOW && header->load_addr < SOC_DROM_HIGH) {
+        if (header->load_addr >= SOC_IROM_LOW && header->load_addr < SOC_IROM_HIGH) {
            if (irom_addr != 0) {
                ESP_LOGE(TAG, MAP_ERR_MSG, "IROM");
            } else {
@@ -425,6 +428,7 @@ static void set_cache_and_start_app(
    uint32_t irom_size,
    uint32_t entry_addr)
 {
+    int rc;
    ESP_LOGD(TAG, "configure drom and irom and start");
    Cache_Read_Disable( 0 );
    Cache_Flush( 0 );
@@ -436,20 +440,34 @@ static void set_cache_and_start_app(
        DPORT_PRO_FLASH_MMU_TABLE[i] = DPORT_FLASH_MMU_TABLE_INVALID_VAL;
    }

-    uint32_t drom_page_count = (drom_size + 64*1024 - 1) / (64*1024); // round up to 64k
-    ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d", drom_addr & 0xffff0000, drom_load_addr & 0xffff0000, drom_size, drom_page_count );
-    int rc = cache_flash_mmu_set( 0, 0, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    rc = cache_flash_mmu_set( 1, 0, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    uint32_t irom_page_count = (irom_size + 64*1024 - 1) / (64*1024); // round up to 64k
-    ESP_LOGV(TAG, "i mmu set paddr=%08x vaddr=%08x size=%d n=%d", irom_addr & 0xffff0000, irom_load_addr & 0xffff0000, irom_size, irom_page_count );
-    rc = cache_flash_mmu_set( 0, 0, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    rc = cache_flash_mmu_set( 1, 0, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    DPORT_REG_CLR_BIT( DPORT_PRO_CACHE_CTRL1_REG, (DPORT_PRO_CACHE_MASK_IRAM0) | (DPORT_PRO_CACHE_MASK_IRAM1 & 0) | (DPORT_PRO_CACHE_MASK_IROM0 & 0) | DPORT_PRO_CACHE_MASK_DROM0 | DPORT_PRO_CACHE_MASK_DRAM1 );
-    DPORT_REG_CLR_BIT( DPORT_APP_CACHE_CTRL1_REG, (DPORT_APP_CACHE_MASK_IRAM0) | (DPORT_APP_CACHE_MASK_IRAM1 & 0) | (DPORT_APP_CACHE_MASK_IROM0 & 0) | DPORT_APP_CACHE_MASK_DROM0 | DPORT_APP_CACHE_MASK_DRAM1 );
+    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
+    uint32_t drom_page_count = bootloader_cache_pages_to_map(drom_size, drom_load_addr);
+    ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d",
+            drom_addr & MMU_FLASH_MASK, drom_load_addr_aligned, drom_size, drom_page_count);
+    rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+    rc = cache_flash_mmu_set(1, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+
+    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
+    uint32_t irom_page_count = bootloader_cache_pages_to_map(irom_size, irom_load_addr);
+    ESP_LOGV(TAG, "i mmu set paddr=%08x vaddr=%08x size=%d n=%d",
+            irom_addr & MMU_FLASH_MASK, irom_load_addr_aligned, irom_size, irom_page_count);
+    rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+    rc = cache_flash_mmu_set(1, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+
+    DPORT_REG_CLR_BIT( DPORT_PRO_CACHE_CTRL1_REG,
+            (DPORT_PRO_CACHE_MASK_IRAM0) | (DPORT_PRO_CACHE_MASK_IRAM1 & 0) |
+            (DPORT_PRO_CACHE_MASK_IROM0 & 0) | DPORT_PRO_CACHE_MASK_DROM0 |
+            DPORT_PRO_CACHE_MASK_DRAM1 );
+
+    DPORT_REG_CLR_BIT( DPORT_APP_CACHE_CTRL1_REG,
+            (DPORT_APP_CACHE_MASK_IRAM0) | (DPORT_APP_CACHE_MASK_IRAM1 & 0) |
+            (DPORT_APP_CACHE_MASK_IROM0 & 0) | DPORT_APP_CACHE_MASK_DROM0 |
+            DPORT_APP_CACHE_MASK_DRAM1 );
+
    Cache_Read_Enable( 0 );

    // Application will need to do Cache_Flush(1) and Cache_Read_Enable(1)
--- a/components/bootloader_support/src/efuse.c
+++ b/components/bootloader_support/src/efuse.c
@@ -13,6 +13,8 @@
 // limitations under the License.
 #include "esp_efuse.h"
 #include "esp_log.h"
+#include <string.h>
+#include "bootloader_random.h"

 #define EFUSE_CONF_WRITE 0x5A5A /* efuse_pgm_op_ena, force no rd/wr disable */
 #define EFUSE_CONF_READ 0x5AA5 /* efuse_read_op_ena, release force */
@@ -58,3 +60,55 @@ void esp_efuse_disable_basic_rom_console(void)
        esp_efuse_burn_new_values();
    }
 }
+
+esp_err_t esp_efuse_apply_34_encoding(const uint8_t *in_bytes, uint32_t *out_words, size_t in_bytes_len)
+{
+    if (in_bytes == NULL || out_words == NULL || in_bytes_len % 6 != 0) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    while (in_bytes_len > 0) {
+        uint8_t out[8];
+        uint8_t xor = 0;
+        uint8_t mul = 0;
+        for (int i = 0; i < 6; i++) {
+            xor ^= in_bytes[i];
+            mul += (i + 1) * __builtin_popcount(in_bytes[i]);
+        }
+
+        memcpy(out, in_bytes, 6); // Data bytes
+        out[6] = xor;
+        out[7] = mul;
+
+        memcpy(out_words, out, 8);
+
+        in_bytes_len -= 6;
+        in_bytes += 6;
+        out_words += 2;
+    }
+
+    return ESP_OK;
+}
+
+void esp_efuse_write_random_key(uint32_t blk_wdata0_reg)
+{
+    uint32_t buf[8];
+    uint8_t raw[24];
+    uint32_t coding_scheme = REG_READ(EFUSE_BLK0_RDATA6_REG) & EFUSE_CODING_SCHEME_M;
+
+    if (coding_scheme == EFUSE_CODING_SCHEME_VAL_NONE) {
+        bootloader_fill_random(buf, sizeof(buf));
+    } else { // 3/4 Coding Scheme
+        bootloader_fill_random(raw, sizeof(raw));
+        esp_err_t r = esp_efuse_apply_34_encoding(raw, buf, sizeof(raw));
+        assert(r == ESP_OK);
+    }
+
+    ESP_LOGV(TAG, "Writing random values to address 0x%08x", blk_wdata0_reg);
+    for (int i = 0; i < 8; i++) {
+        ESP_LOGV(TAG, "EFUSE_BLKx_WDATA%d_REG = 0x%08x", i, buf[i]);
+        REG_WRITE(blk_wdata0_reg + 4*i, buf[i]);
+    }
+    bzero(buf, sizeof(buf));
+    bzero(raw, sizeof(raw));
+}
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@@ -23,10 +23,25 @@
 #include <bootloader_flash.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
+#include "bootloader_util.h"
+
+/* Checking signatures as part of verifying images is necessary:
+   - Always if secure boot is enabled
+   - Differently in bootloader and/or app, depending on kconfig
+*/
+#ifdef BOOTLOADER_BUILD
+#ifdef CONFIG_SECURE_SIGNED_ON_BOOT
+#define SECURE_BOOT_CHECK_SIGNATURE
+#endif
+#else /* !BOOTLOADER_BUILD */
+#ifdef CONFIG_SECURE_SIGNED_ON_UPDATE
+#define SECURE_BOOT_CHECK_SIGNATURE
+#endif
+#endif

 static const char *TAG = "esp_image";

-#define HASH_LEN 32 /* SHA-256 digest length */
+#define HASH_LEN ESP_IMAGE_HASH_LEN

 #define SIXTEEN_MB 0x1000000
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF
@@ -42,6 +57,10 @@ static const char *TAG = "esp_image";
   (Means loaded code isn't executable until after the secure boot check.)
 */
 static uint32_t ram_obfs_value[2];
+
+/* Range of IRAM used by the loader, defined in ld script */
+extern int _loader_text_start;
+extern int _loader_text_end;
 #endif

 /* Return true if load_addr is an address the bootloader should load into */
@@ -107,7 +126,7 @@ esp_err_t esp_image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *
    }

    // Calculate SHA-256 of image if secure boot is on, or if image has a hash appended
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
    if (1) {
 #else
    if (data->image.hash_appended) {
@@ -174,7 +193,7 @@ goto err;
       rewritten the header - rely on esptool.py having verified the bootloader at flashing time, instead.
    */
    if (!is_bootloader) {
-#ifdef CONFIG_SECURE_BOOT_ENABLED
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
        // secure boot images have a signature appended
        err = verify_secure_boot_signature(sha_handle, data);
 #else
@@ -182,7 +201,7 @@ goto err;
        if (sha_handle != NULL && !esp_cpu_in_ocd_debug_mode()) {
            err = verify_simple_hash(sha_handle, data);
        }
-#endif // CONFIG_SECURE_BOOT_ENABLED
+#endif // SECURE_BOOT_CHECK_SIGNATURE
    } else { // is_bootloader
        // bootloader may still have a sha256 digest handle open
        if (sha_handle != NULL) {
@@ -287,18 +306,41 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
                 (do_load)?"load":(is_mapping)?"map":"");
    }

+
+#ifdef BOOTLOADER_BUILD
+    /* Before loading segment, check it doesn't clobber bootloader RAM. */
    if (do_load) {
-        /* Before loading segment, check it doesn't clobber bootloader RAM... */
-        uint32_t end_addr = load_addr + data_len;
-        if (end_addr < 0x40000000) {
+        const intptr_t load_end = load_addr + data_len;
+        if (load_end <= (intptr_t) SOC_DIRAM_DRAM_HIGH) {
+            /* Writing to DRAM */
            intptr_t sp = (intptr_t)get_sp();
-            if (end_addr > sp - STACK_LOAD_HEADROOM) {
-                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x liimit 0x%08x)",
-                         index, end_addr, sp, sp - STACK_LOAD_HEADROOM);
+            if (load_end > sp - STACK_LOAD_HEADROOM) {
+                /* Bootloader .data/.rodata/.bss is above the stack, so this
+                 * also checks that we aren't overwriting these segments.
+                 *
+                 * TODO: This assumes specific arrangement of sections we have
+                 * in the ESP32. Rewrite this in a generic way to support other
+                 * layouts.
+                 */
+                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x limit 0x%08x)",
+                         index, load_end, sp, sp - STACK_LOAD_HEADROOM);
+                return ESP_ERR_IMAGE_INVALID;
+            }
+        } else {
+            /* Writing to IRAM */
+            const intptr_t loader_iram_start = (intptr_t) &_loader_text_start;
+            const intptr_t loader_iram_end = (intptr_t) &_loader_text_end;
+
+            if (bootloader_util_regions_overlap(loader_iram_start, loader_iram_end,
+                    load_addr, load_end)) {
+                ESP_LOGE(TAG, "Segment %d (0x%08x-0x%08x) overlaps bootloader IRAM (0x%08x-0x%08x)",
+                         index, load_addr, load_end, loader_iram_start, loader_iram_end);
                return ESP_ERR_IMAGE_INVALID;
            }
        }
    }
+#endif // BOOTLOADER_BUILD
+
 #ifndef BOOTLOADER_BUILD
    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
@@ -442,19 +484,28 @@ static bool should_load(uint32_t load_addr)
 esp_err_t esp_image_verify_bootloader(uint32_t *length)
 {
    esp_image_metadata_t data;
-    const esp_partition_pos_t bootloader_part = {
-        .offset = ESP_BOOTLOADER_OFFSET,
-        .size = ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET,
-    };
-    esp_err_t err = esp_image_load(ESP_IMAGE_VERIFY,
-                                   &bootloader_part,
-                                   &data);
+    esp_err_t err = esp_image_verify_bootloader_data(&data);
    if (length != NULL) {
        *length = (err == ESP_OK) ? data.image_len : 0;
    }
    return err;
 }

+esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
+{
+    if (data == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    const esp_partition_pos_t bootloader_part = {
+        .offset = ESP_BOOTLOADER_OFFSET,
+        .size = ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET,
+    };
+    return esp_image_load(ESP_IMAGE_VERIFY,
+                          &bootloader_part,
+                          data);
+}
+
+
 static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data)
 {
    uint32_t unpadded_length = data->image_len;
@@ -492,6 +543,8 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
 {
    uint8_t image_hash[HASH_LEN] = { 0 };

+    ESP_LOGI(TAG, "Verifying image signature...");
+
    // For secure boot, we calculate the signature hash over the whole file, which includes any "simple" hash
    // appended to the image for corruption detection
    if (data->image.hash_appended) {
--- a/components/bootloader_support/src/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encrypt.c
@@ -15,7 +15,6 @@
 #include <strings.h>

 #include "bootloader_flash.h"
-#include "bootloader_random.h"
 #include "esp_image_format.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"
@@ -62,6 +61,12 @@ esp_err_t esp_flash_encrypt_check_and_update(void)

 static esp_err_t initialise_flash_encryption(void)
 {
+    uint32_t coding_scheme = REG_GET_FIELD(EFUSE_BLK0_RDATA6_REG, EFUSE_CODING_SCHEME);
+    if (coding_scheme != EFUSE_CODING_SCHEME_VAL_NONE && coding_scheme != EFUSE_CODING_SCHEME_VAL_34) {
+        ESP_LOGE(TAG, "Unknown/unsupported CODING_SCHEME value 0x%x", coding_scheme);
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
    /* Before first flash encryption pass, need to initialise key & crypto config */

    /* Generate key */
@@ -79,13 +84,7 @@ static esp_err_t initialise_flash_encryption(void)
        && REG_READ(EFUSE_BLK1_RDATA6_REG) == 0
        && REG_READ(EFUSE_BLK1_RDATA7_REG) == 0) {
        ESP_LOGI(TAG, "Generating new flash encryption key...");
-        uint32_t buf[8];
-        bootloader_fill_random(buf, sizeof(buf));
-        for (int i = 0; i < 8; i++) {
-            ESP_LOGV(TAG, "EFUSE_BLK1_WDATA%d_REG = 0x%08x", i, buf[i]);
-            REG_WRITE(EFUSE_BLK1_WDATA0_REG + 4*i, buf[i]);
-        }
-        bzero(buf, sizeof(buf));
+        esp_efuse_write_random_key(EFUSE_BLK1_WDATA0_REG);
        esp_efuse_burn_new_values();

        ESP_LOGI(TAG, "Read & write protecting new key...");
@@ -285,7 +284,8 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
                           &partition->pos,
                           &data_ignored);
      should_encrypt = (err == ESP_OK);
-    } else if (partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA) {
+    } else if ((partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA)
+                || (partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_NVS_KEYS)) {
        /* check if we have ota data partition and the partition should be encrypted unconditionally */
        should_encrypt = true;
    }
--- a/components/bootloader_support/src/secure_boot.c
+++ b/components/bootloader_support/src/secure_boot.c
@@ -50,7 +50,7 @@ static bool secure_boot_generate(uint32_t image_len){
    const uint32_t *image;

    /* hardware secure boot engine only takes full blocks, so round up the
-       image length. The additional data should all be 0xFF.
+       image length. The additional data should all be 0xFF (or the appended SHA, if it falls in the same block).
    */
    if (image_len % sizeof(digest.iv) != 0) {
        image_len = (image_len / sizeof(digest.iv) + 1) * sizeof(digest.iv);
@@ -104,14 +104,21 @@ static inline void burn_efuses()

 esp_err_t esp_secure_boot_permanently_enable(void) {
    esp_err_t err;
-    uint32_t image_len = 0;
    if (esp_secure_boot_enabled())
    {
        ESP_LOGI(TAG, "bootloader secure boot is already enabled, continuing..");
        return ESP_OK;
    }

-    err = esp_image_verify_bootloader(&image_len);
+    uint32_t coding_scheme = REG_GET_FIELD(EFUSE_BLK0_RDATA6_REG, EFUSE_CODING_SCHEME);
+    if (coding_scheme != EFUSE_CODING_SCHEME_VAL_NONE && coding_scheme != EFUSE_CODING_SCHEME_VAL_34) {
+        ESP_LOGE(TAG, "Unknown/unsupported CODING_SCHEME value 0x%x", coding_scheme);
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
+    /* Verify the bootloader */
+    esp_image_metadata_t bootloader_data = { 0 };
+    err = esp_image_verify_bootloader_data(&bootloader_data);
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "bootloader image appears invalid! error %d", err);
        return err;
@@ -131,13 +138,7 @@ esp_err_t esp_secure_boot_permanently_enable(void) {
        && REG_READ(EFUSE_BLK2_RDATA6_REG) == 0
        && REG_READ(EFUSE_BLK2_RDATA7_REG) == 0) {
        ESP_LOGI(TAG, "Generating new secure boot key...");
-        uint32_t buf[8];
-        bootloader_fill_random(buf, sizeof(buf));
-        for (int i = 0; i < 8; i++) {
-            ESP_LOGV(TAG, "EFUSE_BLK2_WDATA%d_REG = 0x%08x", i, buf[i]);
-            REG_WRITE(EFUSE_BLK2_WDATA0_REG + 4*i, buf[i]);
-        }
-        bzero(buf, sizeof(buf));
+        esp_efuse_write_random_key(EFUSE_BLK2_WDATA0_REG);
        burn_efuses();
        ESP_LOGI(TAG, "Read & write protecting new key...");
        REG_WRITE(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_BLK2 | EFUSE_RD_DIS_BLK2);
@@ -150,6 +151,11 @@ esp_err_t esp_secure_boot_permanently_enable(void) {
    }

    ESP_LOGI(TAG, "Generating secure boot digest...");
+    uint32_t image_len = bootloader_data.image_len;
+    if(bootloader_data.image.hash_appended) {
+        /* Secure boot digest doesn't cover the hash */
+        image_len -= ESP_IMAGE_HASH_LEN;
+    }
    if (false == secure_boot_generate(image_len)){
        ESP_LOGE(TAG, "secure boot generation failed");
        return ESP_FAIL;
--- a/components/bootloader_support/test/test_efuse_coding_scheme.c
+++ b/components/bootloader_support/test/test_efuse_coding_scheme.c
@@ -0,0 +1,94 @@
+#include <stdint.h>
+#include <strings.h>
+#include "esp_efuse.h"
+#include "unity.h"
+
+typedef struct {
+    uint8_t unencoded[24];
+    uint32_t encoded[8];
+} coding_scheme_test_t;
+
+/* Randomly generated byte strings, encoded and written to ESP32
+   using espefuse algorithm, then verified to have no encoding errors
+   and correct readback.
+*/
+static const coding_scheme_test_t coding_scheme_data[] = {
+    {
+        .unencoded = { 0x96, 0xa9, 0xab, 0xb2, 0xda, 0xdd, 0x21, 0xd2, 0x35, 0x22, 0xd3, 0x30, 0x3b, 0xf8, 0xcb, 0x77, 0x8d, 0x8d, 0xf4, 0x96, 0x25, 0xc4, 0xb9, 0x94 },
+        .encoded = { 0xb2aba996, 0x6821ddda, 0x2235d221, 0x430730d3, 0x77cbf83b, 0x627f8d8d, 0xc42596f4, 0x4dae94b9 },
+    },
+    {
+        .unencoded = { 0x0e, 0x6b, 0x1a, 0x1d, 0xa5, 0x9f, 0x24, 0xcf, 0x91, 0x5b, 0xe7, 0xe1, 0x7c, 0x0a, 0x6e, 0xdc, 0x5e, 0x8e, 0xb1, 0xec, 0xd1, 0xf3, 0x75, 0x48 },
+        .encoded = { 0x1d1a6b0e, 0x5e589fa5, 0x5b91cf24, 0x6127e1e7, 0xdc6e0a7c, 0x5d148e5e, 0xf3d1ecb1, 0x57424875 },
+    },
+    {
+        .unencoded = { 0x0a, 0x79, 0x5a, 0x1c, 0xb1, 0x45, 0x71, 0x2c, 0xb3, 0xda, 0x9e, 0xdc, 0x76, 0x27, 0xf5, 0xca, 0xe7, 0x00, 0x39, 0x95, 0x6c, 0x53, 0xc2, 0x07 },
+        .encoded = { 0x1c5a790a, 0x4ac145b1, 0xdab32c71, 0x6476dc9e, 0xcaf52776, 0x4d8900e7, 0x536c9539, 0x495607c2 },
+    },
+    {
+        .unencoded = { 0x76, 0x46, 0x88, 0x2d, 0x4c, 0xe1, 0x50, 0x5d, 0xd6, 0x7c, 0x41, 0x15, 0xc6, 0x1f, 0xd4, 0x60, 0x10, 0x15, 0x2a, 0x72, 0x2d, 0x89, 0x93, 0x13 },
+        .encoded = { 0x2d884676, 0x4838e14c, 0x7cd65d50, 0x4bf31541, 0x60d41fc6, 0x39681510, 0x892d722a, 0x497c1393 },
+    },
+    {
+        .unencoded = { 0x32, 0xbc, 0x40, 0x92, 0x13, 0x37, 0x1a, 0xae, 0xb6, 0x00, 0xed, 0x30, 0xb8, 0x82, 0xee, 0xfc, 0xcf, 0x6d, 0x7f, 0xc5, 0xfa, 0x0e, 0xdd, 0x84 },
+        .encoded = { 0x9240bc32, 0x49783713, 0x00b6ae1a, 0x46df30ed, 0xfcee82b8, 0x6e8a6dcf, 0x0efac57f, 0x571784dd },
+    },
+    {
+        .unencoded = { 0x29, 0xb3, 0x04, 0x95, 0xf2, 0x3c, 0x81, 0xe6, 0x5a, 0xf3, 0x42, 0x82, 0xd1, 0x79, 0xe2, 0x12, 0xbe, 0xc3, 0xd4, 0x10, 0x63, 0x66, 0x9f, 0xe3 },
+        .encoded = { 0x9504b329, 0x51c53cf2, 0xf35ae681, 0x460e8242, 0x12e279d1, 0x5825c3be, 0x666310d4, 0x5ebde39f },
+    },
+    {
+        .unencoded = { 0xda, 0xda, 0x71, 0x4a, 0x62, 0x33, 0xdd, 0x31, 0x87, 0xf3, 0x70, 0x12, 0x33, 0x3b, 0x3b, 0xe9, 0xed, 0xc4, 0x6e, 0x6a, 0xc7, 0xd5, 0x85, 0xfc },
+        .encoded = { 0x4a71dada, 0x4e6a3362, 0xf38731dd, 0x4bfa1270, 0xe93b3b33, 0x61f3c4ed, 0xd5c76a6e, 0x636ffc85 },
+    },
+    {
+        .unencoded = { 0x45, 0x64, 0x51, 0x34, 0x1c, 0x82, 0x81, 0x77, 0xf8, 0x89, 0xb1, 0x15, 0x82, 0x94, 0xdd, 0x64, 0xa2, 0x46, 0x0e, 0xfb, 0x1a, 0x70, 0x4b, 0x9f },
+        .encoded = { 0x34516445, 0x39da821c, 0x89f87781, 0x4f2315b1, 0x64dd9482, 0x474b46a2, 0x701afb0e, 0x5e4b9f4b },
+    },
+    {
+        .unencoded = { 0x89, 0x87, 0x15, 0xb6, 0x66, 0x34, 0x49, 0x18, 0x8b, 0x7b, 0xb2, 0xf6, 0x96, 0x1e, 0x2e, 0xf1, 0x03, 0x9d, 0x4e, 0x16, 0x32, 0xd6, 0x23, 0x22 },
+        .encoded = { 0xb6158789, 0x4eff3466, 0x7b8b1849, 0x63e5f6b2, 0xf12e1e96, 0x54c99d03, 0xd632164e, 0x42bd2223 },
+    },
+    {
+        .unencoded = { 0xa7, 0xa0, 0xb5, 0x21, 0xd2, 0xa3, 0x9f, 0x65, 0xa9, 0xeb, 0x72, 0xa2, 0x2e, 0xa6, 0xfb, 0x9c, 0x48, 0x7e, 0x68, 0x08, 0x7a, 0xb1, 0x4f, 0xbc },
+        .encoded = { 0x21b5a0a7, 0x4ce2a3d2, 0xeba9659f, 0x5868a272, 0x9cfba62e, 0x5fd97e48, 0xb17a0868, 0x5b58bc4f },
+    },
+    {
+        .unencoded = { 0xf7, 0x05, 0xe3, 0x6c, 0xb1, 0x55, 0xcb, 0x2f, 0x8d, 0x3e, 0x0b, 0x2e, 0x3e, 0xb7, 0x02, 0xf5, 0x91, 0xb1, 0xfe, 0x8b, 0x58, 0x50, 0xb2, 0x40 },
+        .encoded = { 0x6ce305f7, 0x569955b1, 0x3e8d2fcb, 0x56722e0b, 0xf502b73e, 0x535eb191, 0x50588bfe, 0x3a8f40b2 },
+    },
+    {
+        .unencoded = { 0x0f, 0x93, 0xb0, 0xd5, 0x60, 0xba, 0x40, 0x2a, 0x62, 0xa6, 0x92, 0x82, 0xb8, 0x91, 0x2c, 0xd7, 0x23, 0xdc, 0x6f, 0x7f, 0x2f, 0xbe, 0x41, 0xf5 },
+        .encoded = { 0xd5b0930f, 0x5123ba60, 0xa6622a40, 0x3bbe8292, 0xd72c91b8, 0x582ddc23, 0xbe2f7f6f, 0x6935f541 },
+    },
+    {
+        .unencoded = { 0x7f, 0x0c, 0x99, 0xde, 0xff, 0x2e, 0xd2, 0x1c, 0x48, 0x98, 0x70, 0x85, 0x15, 0x01, 0x2a, 0xfb, 0xcd, 0xf2, 0xa0, 0xf9, 0x0e, 0xbc, 0x9f, 0x0c },
+        .encoded = { 0xde990c7f, 0x6fe52eff, 0x98481cd2, 0x3deb8570, 0xfb2a0115, 0x61faf2cd, 0xbc0ef9a0, 0x55780c9f },
+    },
+    {
+        .unencoded = { 0x9a, 0x10, 0x92, 0x03, 0x81, 0xfe, 0x41, 0x57, 0x77, 0x02, 0xcb, 0x20, 0x67, 0xa4, 0x97, 0xf3, 0xf8, 0xc7, 0x0d, 0x65, 0xcd, 0xfc, 0x15, 0xef },
+        .encoded = { 0x0392109a, 0x4b64fe81, 0x02775741, 0x418820cb, 0xf397a467, 0x6998c7f8, 0xfccd650d, 0x6ba3ef15 },
+    },
+};
+
+TEST_CASE("Test 3/4 Coding Scheme Algorithm", "[bootloader_support]")
+{
+    const int num_tests = sizeof(coding_scheme_data)/sizeof(coding_scheme_test_t);
+    for (int i = 0; i < num_tests; i++) {
+        uint32_t result[8];
+        const coding_scheme_test_t *t = &coding_scheme_data[i];
+
+        printf("Test case %d...\n", i);
+        esp_err_t r = esp_efuse_apply_34_encoding(t->unencoded, result, sizeof(t->unencoded));
+        TEST_ASSERT_EQUAL_HEX(ESP_OK, r);
+        TEST_ASSERT_EQUAL_HEX32_ARRAY(t->encoded, result, 8);
+
+        // Do the same, 6 bytes at a time
+        for (int offs = 0; offs < sizeof(t->unencoded); offs += 6) {
+            bzero(result, sizeof(result));
+            r = esp_efuse_apply_34_encoding(t->unencoded + offs, result, 6);
+            TEST_ASSERT_EQUAL_HEX(ESP_OK, r);
+            TEST_ASSERT_EQUAL_HEX32_ARRAY(t->encoded + (offs / 6 * 2), result, 2);
+        }
+    }
+}
--- a/components/bootloader_support/test/test_verify_image.c
+++ b/components/bootloader_support/test/test_verify_image.c
@@ -14,6 +14,7 @@
 #include "freertos/xtensa_api.h"
 #include "unity.h"
 #include "bootloader_common.h"
+#include "bootloader_util.h"
 #include "esp_partition.h"
 #include "esp_ota_ops.h"
 #include "esp_image_format.h"
@@ -92,3 +93,23 @@ TEST_CASE("Test label_search", "[bootloader_support]")
    check_label_search(25,  "phy, 1234567890123456, nvs1",  "12345678901234567",    true);

 }
+
+
+TEST_CASE("Test regions_overlap", "[bootloader_support]")
+{
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 1, 2) );
+
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 0, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 1, 3) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 2, 0, 3) );
+
+    TEST_ASSERT( bootloader_util_regions_overlap(0, 2, 1, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(1, 3, 1, 2) );
+    TEST_ASSERT( bootloader_util_regions_overlap(0, 3, 1, 2) );
+
+    TEST_ASSERT( !bootloader_util_regions_overlap(2, 3, 1, 2) );
+    TEST_ASSERT( !bootloader_util_regions_overlap(1, 2, 2, 3) );
+
+    TEST_ASSERT( !bootloader_util_regions_overlap(3, 4, 1, 2) );
+    TEST_ASSERT( !bootloader_util_regions_overlap(1, 2, 3, 4) );
+}
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@@ -1,6 +1,6 @@
 if(CONFIG_BT_ENABLED)

-    set(COMPONENT_SRCDIRS .)
+    set(COMPONENT_SRCS "bt.c")
    set(COMPONENT_ADD_INCLUDEDIRS include)

    if(CONFIG_BLUEDROID_ENABLED)
@@ -41,43 +41,234 @@ if(CONFIG_BT_ENABLED)

        list(APPEND COMPONENT_ADD_INCLUDEDIRS bluedroid/api/include/api)

-        list(APPEND COMPONENT_SRCDIRS
-            bluedroid/bta/dm
-            bluedroid/bta/gatt
-            bluedroid/bta/hh
-            bluedroid/bta/sdp
-            bluedroid/bta/av
-            bluedroid/bta/ar
-            bluedroid/bta/sys
-            bluedroid/bta/jv
-            bluedroid/device
-            bluedroid/hci
-            bluedroid/main
-            bluedroid/osi
-            bluedroid/external/sbc/decoder/srce
-            bluedroid/external/sbc/encoder/srce
-            bluedroid/btc/core
-            bluedroid/btc/profile/esp/blufi
-            bluedroid/btc/profile/std/gap
-            bluedroid/btc/profile/std/gatt
-            bluedroid/btc/profile/std/a2dp
-            bluedroid/btc/profile/std/avrc
-            bluedroid/btc/profile/std/spp
-            bluedroid/stack/btm
-            bluedroid/stack/btu
-            bluedroid/stack/gap
-            bluedroid/stack/gatt
-            bluedroid/stack/hcic
-            bluedroid/stack/l2cap
-            bluedroid/stack/sdp
-            bluedroid/stack/smp
-            bluedroid/stack/avct
-            bluedroid/stack/avrc
-            bluedroid/stack/avdt
-            bluedroid/stack/a2dp
-            bluedroid/stack/rfcomm
-            bluedroid/api
-            )
+        list(APPEND COMPONENT_SRCS "bluedroid/api/esp_a2dp_api.c"
+                   "bluedroid/api/esp_avrc_api.c"
+                   "bluedroid/api/esp_blufi_api.c"
+                   "bluedroid/api/esp_bt_device.c"
+                   "bluedroid/api/esp_bt_main.c"
+                   "bluedroid/api/esp_gap_ble_api.c"
+                   "bluedroid/api/esp_gap_bt_api.c"
+                   "bluedroid/api/esp_gatt_common_api.c"
+                   "bluedroid/api/esp_gattc_api.c"
+                   "bluedroid/api/esp_gatts_api.c"
+                   "bluedroid/api/esp_hf_client_api.c"
+                   "bluedroid/api/esp_spp_api.c"
+                   "bluedroid/bta/ar/bta_ar.c"
+                   "bluedroid/bta/av/bta_av_aact.c"
+                   "bluedroid/bta/av/bta_av_act.c"
+                   "bluedroid/bta/av/bta_av_api.c"
+                   "bluedroid/bta/av/bta_av_cfg.c"
+                   "bluedroid/bta/av/bta_av_ci.c"
+                   "bluedroid/bta/av/bta_av_main.c"
+                   "bluedroid/bta/av/bta_av_sbc.c"
+                   "bluedroid/bta/av/bta_av_ssm.c"
+                   "bluedroid/bta/dm/bta_dm_act.c"
+                   "bluedroid/bta/dm/bta_dm_api.c"
+                   "bluedroid/bta/dm/bta_dm_cfg.c"
+                   "bluedroid/bta/dm/bta_dm_ci.c"
+                   "bluedroid/bta/dm/bta_dm_co.c"
+                   "bluedroid/bta/dm/bta_dm_main.c"
+                   "bluedroid/bta/dm/bta_dm_pm.c"
+                   "bluedroid/bta/dm/bta_dm_sco.c"
+                   "bluedroid/bta/gatt/bta_gatt_common.c"
+                   "bluedroid/bta/gatt/bta_gattc_act.c"
+                   "bluedroid/bta/gatt/bta_gattc_api.c"
+                   "bluedroid/bta/gatt/bta_gattc_cache.c"
+                   "bluedroid/bta/gatt/bta_gattc_ci.c"
+                   "bluedroid/bta/gatt/bta_gattc_co.c"
+                   "bluedroid/bta/gatt/bta_gattc_main.c"
+                   "bluedroid/bta/gatt/bta_gattc_utils.c"
+                   "bluedroid/bta/gatt/bta_gatts_act.c"
+                   "bluedroid/bta/gatt/bta_gatts_api.c"
+                   "bluedroid/bta/gatt/bta_gatts_co.c"
+                   "bluedroid/bta/gatt/bta_gatts_main.c"
+                   "bluedroid/bta/gatt/bta_gatts_utils.c"
+                   "bluedroid/bta/hh/bta_hh_act.c"
+                   "bluedroid/bta/hh/bta_hh_api.c"
+                   "bluedroid/bta/hh/bta_hh_cfg.c"
+                   "bluedroid/bta/hh/bta_hh_le.c"
+                   "bluedroid/bta/hh/bta_hh_main.c"
+                   "bluedroid/bta/hh/bta_hh_utils.c"
+                   "bluedroid/bta/jv/bta_jv_act.c"
+                   "bluedroid/bta/jv/bta_jv_api.c"
+                   "bluedroid/bta/jv/bta_jv_cfg.c"
+                   "bluedroid/bta/jv/bta_jv_main.c"
+                   "bluedroid/bta/sdp/bta_sdp.c"
+                   "bluedroid/bta/sdp/bta_sdp_act.c"
+                   "bluedroid/bta/sdp/bta_sdp_api.c"
+                   "bluedroid/bta/sdp/bta_sdp_cfg.c"
+                   "bluedroid/bta/sys/bta_sys_conn.c"
+                   "bluedroid/bta/sys/bta_sys_main.c"
+                   "bluedroid/bta/sys/utl.c"
+                   "bluedroid/btc/core/btc_alarm.c"
+                   "bluedroid/btc/core/btc_ble_storage.c"
+                   "bluedroid/btc/core/btc_config.c"
+                   "bluedroid/btc/core/btc_dev.c"
+                   "bluedroid/btc/core/btc_dm.c"
+                   "bluedroid/btc/core/btc_main.c"
+                   "bluedroid/btc/core/btc_manage.c"
+                   "bluedroid/btc/core/btc_profile_queue.c"
+                   "bluedroid/btc/core/btc_sec.c"
+                   "bluedroid/btc/core/btc_sm.c"
+                   "bluedroid/btc/core/btc_storage.c"
+                   "bluedroid/btc/core/btc_task.c"
+                   "bluedroid/btc/core/btc_util.c"
+                   "bluedroid/btc/profile/esp/blufi/blufi_prf.c"
+                   "bluedroid/btc/profile/esp/blufi/blufi_protocol.c"
+                   "bluedroid/btc/profile/std/a2dp/bta_av_co.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c"
+                   "bluedroid/btc/profile/std/a2dp/btc_av.c"
+                   "bluedroid/btc/profile/std/avrc/btc_avrc.c"
+                   "bluedroid/btc/profile/std/gap/btc_gap_ble.c"
+                   "bluedroid/btc/profile/std/gap/btc_gap_bt.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gatt_common.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gatt_util.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gattc.c"
+                   "bluedroid/btc/profile/std/gatt/btc_gatts.c"
+                   "bluedroid/btc/profile/std/spp/btc_spp.c"
+                   "bluedroid/device/bdaddr.c"
+                   "bluedroid/device/controller.c"
+                   "bluedroid/device/interop.c"
+                   "bluedroid/external/sbc/decoder/srce/alloc.c"
+                   "bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c"
+                   "bluedroid/external/sbc/decoder/srce/bitalloc.c"
+                   "bluedroid/external/sbc/decoder/srce/bitstream-decode.c"
+                   "bluedroid/external/sbc/decoder/srce/decoder-oina.c"
+                   "bluedroid/external/sbc/decoder/srce/decoder-private.c"
+                   "bluedroid/external/sbc/decoder/srce/decoder-sbc.c"
+                   "bluedroid/external/sbc/decoder/srce/dequant.c"
+                   "bluedroid/external/sbc/decoder/srce/framing-sbc.c"
+                   "bluedroid/external/sbc/decoder/srce/framing.c"
+                   "bluedroid/external/sbc/decoder/srce/oi_codec_version.c"
+                   "bluedroid/external/sbc/decoder/srce/synthesis-8-generated.c"
+                   "bluedroid/external/sbc/decoder/srce/synthesis-dct8.c"
+                   "bluedroid/external/sbc/decoder/srce/synthesis-sbc.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_analysis.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_dct.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_dct_coeffs.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_enc_coeffs.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_encoder.c"
+                   "bluedroid/external/sbc/encoder/srce/sbc_packing.c"
+                   "bluedroid/hci/buffer_allocator.c"
+                   "bluedroid/hci/hci_audio.c"
+                   "bluedroid/hci/hci_hal_h4.c"
+                   "bluedroid/hci/hci_layer.c"
+                   "bluedroid/hci/hci_packet_factory.c"
+                   "bluedroid/hci/hci_packet_parser.c"
+                   "bluedroid/hci/packet_fragmenter.c"
+                   "bluedroid/main/bte_init.c"
+                   "bluedroid/main/bte_main.c"
+                   "bluedroid/osi/alarm.c"
+                   "bluedroid/osi/allocator.c"
+                   "bluedroid/osi/buffer.c"
+                   "bluedroid/osi/config.c"
+                   "bluedroid/osi/fixed_queue.c"
+                   "bluedroid/osi/future.c"
+                   "bluedroid/osi/hash_functions.c"
+                   "bluedroid/osi/hash_map.c"
+                   "bluedroid/osi/list.c"
+                   "bluedroid/osi/mutex.c"
+                   "bluedroid/osi/osi.c"
+                   "bluedroid/osi/semaphore.c"
+                   "bluedroid/stack/a2dp/a2d_api.c"
+                   "bluedroid/stack/a2dp/a2d_sbc.c"
+                   "bluedroid/stack/avct/avct_api.c"
+                   "bluedroid/stack/avct/avct_ccb.c"
+                   "bluedroid/stack/avct/avct_l2c.c"
+                   "bluedroid/stack/avct/avct_lcb.c"
+                   "bluedroid/stack/avct/avct_lcb_act.c"
+                   "bluedroid/stack/avdt/avdt_ad.c"
+                   "bluedroid/stack/avdt/avdt_api.c"
+                   "bluedroid/stack/avdt/avdt_ccb.c"
+                   "bluedroid/stack/avdt/avdt_ccb_act.c"
+                   "bluedroid/stack/avdt/avdt_l2c.c"
+                   "bluedroid/stack/avdt/avdt_msg.c"
+                   "bluedroid/stack/avdt/avdt_scb.c"
+                   "bluedroid/stack/avdt/avdt_scb_act.c"
+                   "bluedroid/stack/avrc/avrc_api.c"
+                   "bluedroid/stack/avrc/avrc_bld_ct.c"
+                   "bluedroid/stack/avrc/avrc_bld_tg.c"
+                   "bluedroid/stack/avrc/avrc_opt.c"
+                   "bluedroid/stack/avrc/avrc_pars_ct.c"
+                   "bluedroid/stack/avrc/avrc_pars_tg.c"
+                   "bluedroid/stack/avrc/avrc_sdp.c"
+                   "bluedroid/stack/avrc/avrc_utils.c"
+                   "bluedroid/stack/btm/btm_acl.c"
+                   "bluedroid/stack/btm/btm_ble.c"
+                   "bluedroid/stack/btm/btm_ble_addr.c"
+                   "bluedroid/stack/btm/btm_ble_adv_filter.c"
+                   "bluedroid/stack/btm/btm_ble_batchscan.c"
+                   "bluedroid/stack/btm/btm_ble_bgconn.c"
+                   "bluedroid/stack/btm/btm_ble_cont_energy.c"
+                   "bluedroid/stack/btm/btm_ble_gap.c"
+                   "bluedroid/stack/btm/btm_ble_multi_adv.c"
+                   "bluedroid/stack/btm/btm_ble_privacy.c"
+                   "bluedroid/stack/btm/btm_dev.c"
+                   "bluedroid/stack/btm/btm_devctl.c"
+                   "bluedroid/stack/btm/btm_inq.c"
+                   "bluedroid/stack/btm/btm_main.c"
+                   "bluedroid/stack/btm/btm_pm.c"
+                   "bluedroid/stack/btm/btm_sco.c"
+                   "bluedroid/stack/btm/btm_sec.c"
+                   "bluedroid/stack/btu/btu_hcif.c"
+                   "bluedroid/stack/btu/btu_init.c"
+                   "bluedroid/stack/btu/btu_task.c"
+                   "bluedroid/stack/gap/gap_api.c"
+                   "bluedroid/stack/gap/gap_ble.c"
+                   "bluedroid/stack/gap/gap_conn.c"
+                   "bluedroid/stack/gap/gap_utils.c"
+                   "bluedroid/stack/gatt/att_protocol.c"
+                   "bluedroid/stack/gatt/gatt_api.c"
+                   "bluedroid/stack/gatt/gatt_attr.c"
+                   "bluedroid/stack/gatt/gatt_auth.c"
+                   "bluedroid/stack/gatt/gatt_cl.c"
+                   "bluedroid/stack/gatt/gatt_db.c"
+                   "bluedroid/stack/gatt/gatt_main.c"
+                   "bluedroid/stack/gatt/gatt_sr.c"
+                   "bluedroid/stack/gatt/gatt_utils.c"
+                   "bluedroid/stack/hcic/hciblecmds.c"
+                   "bluedroid/stack/hcic/hcicmds.c"
+                   "bluedroid/stack/l2cap/l2c_api.c"
+                   "bluedroid/stack/l2cap/l2c_ble.c"
+                   "bluedroid/stack/l2cap/l2c_csm.c"
+                   "bluedroid/stack/l2cap/l2c_fcr.c"
+                   "bluedroid/stack/l2cap/l2c_link.c"
+                   "bluedroid/stack/l2cap/l2c_main.c"
+                   "bluedroid/stack/l2cap/l2c_ucd.c"
+                   "bluedroid/stack/l2cap/l2c_utils.c"
+                   "bluedroid/stack/l2cap/l2cap_client.c"
+                   "bluedroid/stack/rfcomm/port_api.c"
+                   "bluedroid/stack/rfcomm/port_rfc.c"
+                   "bluedroid/stack/rfcomm/port_utils.c"
+                   "bluedroid/stack/rfcomm/rfc_l2cap_if.c"
+                   "bluedroid/stack/rfcomm/rfc_mx_fsm.c"
+                   "bluedroid/stack/rfcomm/rfc_port_fsm.c"
+                   "bluedroid/stack/rfcomm/rfc_port_if.c"
+                   "bluedroid/stack/rfcomm/rfc_ts_frames.c"
+                   "bluedroid/stack/rfcomm/rfc_utils.c"
+                   "bluedroid/stack/sdp/sdp_api.c"
+                   "bluedroid/stack/sdp/sdp_db.c"
+                   "bluedroid/stack/sdp/sdp_discovery.c"
+                   "bluedroid/stack/sdp/sdp_main.c"
+                   "bluedroid/stack/sdp/sdp_server.c"
+                   "bluedroid/stack/sdp/sdp_utils.c"
+                   "bluedroid/stack/smp/aes.c"
+                   "bluedroid/stack/smp/p_256_curvepara.c"
+                   "bluedroid/stack/smp/p_256_ecc_pp.c"
+                   "bluedroid/stack/smp/p_256_multprecision.c"
+                   "bluedroid/stack/smp/smp_act.c"
+                   "bluedroid/stack/smp/smp_api.c"
+                   "bluedroid/stack/smp/smp_br_main.c"
+                   "bluedroid/stack/smp/smp_cmac.c"
+                   "bluedroid/stack/smp/smp_keys.c"
+                   "bluedroid/stack/smp/smp_l2c.c"
+                   "bluedroid/stack/smp/smp_main.c"
+                   "bluedroid/stack/smp/smp_utils.c")
    endif()
 endif()

--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@@ -70,10 +70,9 @@ menu "MODEM SLEEP Options"
 config BTDM_CONTROLLER_MODEM_SLEEP
    bool "Bluetooth modem sleep"
    depends on BT_ENABLED
-    default n
+    default y
    help
        Enable/disable bluetooth controller low power mode.
-        Note that currently there is problem in the combination use of bluetooth modem sleep and Dynamic Frequency Scaling(DFS). So do not enable DFS if bluetooth modem sleep is in use.

 choice BTDM_MODEM_SLEEP_MODE
    prompt "Bluetooth Modem sleep mode"
@@ -99,6 +98,9 @@ choice BTDM_LOW_POWER_CLOCK

 config BTDM_LPCLK_SEL_MAIN_XTAL
    bool "Main crystal"
+    help
+        Main crystal can be used as low power clock for bluetooth modem sleep. If this option is selected, bluetooth
+        modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but cannot work when light sleep is enabled.
 config BTDM_LPCLK_SEL_EXT_32K_XTAL
    bool "External 32kHz crystal"
    depends on ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
@@ -1050,6 +1052,15 @@ config SMP_ENABLE
   depends on BLUEDROID_ENABLED
   default CLASSIC_BT_ENABLED || BLE_SMP_ENABLE

+config BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+    bool "Report adv data and scan response individually when BLE active scan"
+    depends on BLUEDROID_ENABLED
+    default n
+    help
+        Originally, when doing BLE active scan, Bluedroid will not report adv to application layer
+        until receive scan response. This option is used to disable the behavior. When enable this option,
+        Bluedroid will report adv data or scan response to application layer immediately.
+
 # Memory reserved at start of DRAM for Bluetooth stack
 config BT_RESERVE_DRAM
    hex
--- a/components/bt/bluedroid/api/esp_gap_ble_api.c
+++ b/components/bt/bluedroid/api/esp_gap_ble_api.c
@@ -441,6 +441,23 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d
 esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
        void *value, uint8_t len)
 {
+    if(param_type >= ESP_BLE_SM_MAX_PARAM) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    if((param_type != ESP_BLE_SM_CLEAR_STATIC_PASSKEY) && ( value == NULL || len < sizeof(uint8_t) || len > sizeof(uint32_t))) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    if((param_type == ESP_BLE_SM_SET_STATIC_PASSKEY)) {
+        uint32_t passkey = 0;
+        for(uint8_t i = 0; i < len; i++)
+        {
+            passkey += (((uint8_t *)value)[i]<<(8*i));
+        }
+        if(passkey > 999999) {
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
+
    btc_msg_t msg;
    btc_ble_gap_args_t arg;

--- a/components/bt/bluedroid/api/esp_gap_bt_api.c
+++ b/components/bt/bluedroid/api/esp_gap_bt_api.c
@@ -240,4 +240,50 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
    return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, esp_bt_pin_code_t pin_code)
+{
+    btc_msg_t msg;
+    btc_gap_bt_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_ACT_SET_PIN_TYPE;
+    arg.set_pin_type.pin_type = pin_type;
+    if (pin_type == ESP_BT_PIN_TYPE_FIXED){
+        arg.set_pin_type.pin_code_len = pin_code_len;
+        memcpy(arg.set_pin_type.pin_code, pin_code, pin_code_len);
+    } else {
+        arg.set_pin_type.pin_code_len = 0;
+        memset(arg.set_pin_type.pin_code, 0, ESP_BT_PIN_CODE_LEN);
+    }
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_code_len, esp_bt_pin_code_t pin_code)
+{
+    btc_msg_t msg;
+    btc_gap_bt_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_ACT_PIN_REPLY;
+    arg.pin_reply.accept = accept;
+    arg.pin_reply.pin_code_len = pin_code_len;
+    memcpy(arg.pin_reply.bda.address, bd_addr, sizeof(esp_bd_addr_t));
+    memcpy(arg.pin_reply.pin_code, pin_code, pin_code_len);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 #endif /* #if BTC_GAP_BT_INCLUDED == TRUE */
--- a/components/bt/bluedroid/api/include/api/esp_gap_ble_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_gap_ble_api.h
@@ -54,12 +54,16 @@ typedef uint8_t esp_ble_key_type_t;
 #define ESP_LE_AUTH_NO_BOND                 0x00                                     /*!< 0*/                     /* relate to BTM_LE_AUTH_NO_BOND in stack/btm_api.h */
 #define ESP_LE_AUTH_BOND                    0x01                                     /*!< 1 << 0 */               /* relate to BTM_LE_AUTH_BOND in stack/btm_api.h */
 #define ESP_LE_AUTH_REQ_MITM                (1 << 2)                                 /*!< 1 << 2 */               /* relate to BTM_LE_AUTH_REQ_MITM in stack/btm_api.h */
+#define ESP_LE_AUTH_REQ_BOND_MITM           (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_MITM)/*!< 0101*/
 #define ESP_LE_AUTH_REQ_SC_ONLY             (1 << 3)                                 /*!< 1 << 3 */               /* relate to BTM_LE_AUTH_REQ_SC_ONLY in stack/btm_api.h */
 #define ESP_LE_AUTH_REQ_SC_BOND             (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_SC_ONLY)            /*!< 1001 */  /* relate to BTM_LE_AUTH_REQ_SC_BOND in stack/btm_api.h */
 #define ESP_LE_AUTH_REQ_SC_MITM             (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY)        /*!< 1100 */  /* relate to BTM_LE_AUTH_REQ_SC_MITM in stack/btm_api.h */
 #define ESP_LE_AUTH_REQ_SC_MITM_BOND        (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY | ESP_LE_AUTH_BOND)   /*!< 1101 */  /* relate to BTM_LE_AUTH_REQ_SC_MITM_BOND in stack/btm_api.h */
 typedef uint8_t   esp_ble_auth_req_t;         /*!< combination of the above bit pattern */

+#define ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_DISABLE 0
+#define ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_ENABLE  1
+
 /* relate to BTM_IO_CAP_xxx in stack/btm_api.h */
 #define ESP_IO_CAP_OUT                      0   /*!< DisplayOnly */         /* relate to BTM_IO_CAP_OUT in stack/btm_api.h */
 #define ESP_IO_CAP_IO                       1   /*!< DisplayYesNo */        /* relate to BTM_IO_CAP_IO in stack/btm_api.h */
@@ -264,6 +268,10 @@ typedef enum {
    ESP_BLE_SM_SET_INIT_KEY,
    ESP_BLE_SM_SET_RSP_KEY,
    ESP_BLE_SM_MAX_KEY_SIZE,
+    ESP_BLE_SM_SET_STATIC_PASSKEY,
+    ESP_BLE_SM_CLEAR_STATIC_PASSKEY,
+    ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH,
+    ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;

 /// Advertising parameters
@@ -279,7 +287,7 @@ typedef struct {
    esp_ble_adv_type_t      adv_type;           /*!< Advertising type */
    esp_ble_addr_type_t     own_addr_type;      /*!< Owner bluetooth device address type */
    esp_bd_addr_t           peer_addr;          /*!< Peer device bluetooth device address */
-    esp_ble_addr_type_t     peer_addr_type;     /*!< Peer device bluetooth device address type */
+    esp_ble_addr_type_t     peer_addr_type;     /*!< Peer device bluetooth device address type, only support public address type and random address type */
    esp_ble_adv_channel_t   channel_map;        /*!< Advertising channel map */
    esp_ble_adv_filter_t    adv_filter_policy;  /*!< Advertising filter policy */
 } esp_ble_adv_params_t;
@@ -346,8 +354,8 @@ typedef struct {
                                                      Range: 0x0004 to 0x4000 Default: 0x0010 (10 ms)
                                                      Time = N * 0.625 msec
                                                      Time Range: 2.5 msec to 10240 msec */
-    esp_ble_scan_duplicate_t  scan_duplicate;       /*!< The Scan_Duplicates parameter controls whether the Link Layer should filter out 
-                                                        duplicate advertising reports (BLE_SCAN_DUPLICATE_ENABLE) to the Host, or if the Link Layer should generate 
+    esp_ble_scan_duplicate_t  scan_duplicate;       /*!< The Scan_Duplicates parameter controls whether the Link Layer should filter out
+                                                        duplicate advertising reports (BLE_SCAN_DUPLICATE_ENABLE) to the Host, or if the Link Layer should generate
                                                        advertising reports for each packet received */
 } esp_ble_scan_params_t;

@@ -508,7 +516,8 @@ typedef struct
    uint8_t               fail_reason;           /*!< The HCI reason/error code for when success=FALSE */
    esp_ble_addr_type_t   addr_type;             /*!< Peer device address type */
    esp_bt_dev_type_t     dev_type;              /*!< Device type */
-} esp_ble_auth_cmpl_t;                           /*!< The ble authentication complite cb type */
+    esp_ble_auth_req_t    auth_mode;             /*!< authentication mode */
+} esp_ble_auth_cmpl_t;                           /*!< The ble authentication complete cb type */

 /**
  * @brief union associated with ble security
@@ -933,8 +942,7 @@ esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t
 * @param[in]       type   - finding ADV data type
 * @param[out]      length - return the length of ADV data not including type
 *
- * @return          - ESP_OK : success
- *                  - other  : failed
+ * @return          pointer of ADV data
 *
 */
 uint8_t *esp_ble_resolve_adv_data(uint8_t *adv_data, uint8_t type, uint8_t *length);
--- a/components/bt/bluedroid/api/include/api/esp_gap_bt_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_gap_bt_api.h
@@ -102,6 +102,14 @@ typedef enum {
    ESP_BT_COD_SRVC_INFORMATION              = 0x400,    /*!< Information, e.g., WEB-server, WAP-server */
 } esp_bt_cod_srvc_t;

+typedef enum{
+    ESP_BT_PIN_TYPE_VARIABLE = 0,                       /*!< Refer to BTM_PIN_TYPE_VARIABLE */
+    ESP_BT_PIN_TYPE_FIXED    = 1,                       /*!< Refer to BTM_PIN_TYPE_FIXED */
+} esp_bt_pin_type_t;
+
+#define ESP_BT_PIN_CODE_LEN        16                   /*!< Max pin code length */
+typedef uint8_t esp_bt_pin_code_t[ESP_BT_PIN_CODE_LEN]; /*!< Pin Code (upto 128 bits) MSB is 0 */
+
 /// Bits of major service class field
 #define ESP_BT_COD_SRVC_BIT_MASK              (0xffe000) /*!< Major service bit mask */
 #define ESP_BT_COD_SRVC_BIT_OFFSET            (13)       /*!< Major service bit offset */
@@ -149,6 +157,7 @@ typedef enum {
    ESP_BT_GAP_RMT_SRVCS_EVT,                       /*!< get remote services event */
    ESP_BT_GAP_RMT_SRVC_REC_EVT,                    /*!< get remote service record event */
    ESP_BT_GAP_AUTH_CMPL_EVT,                       /*!< AUTH complete event */
+    ESP_BT_GAP_PIN_REQ_EVT,                         /*!< Legacy Pairing Pin code request */
    ESP_BT_GAP_READ_RSSI_DELTA_EVT,                 /*!< read rssi event */
    ESP_BT_GAP_EVT_MAX,
 } esp_bt_gap_cb_event_t;
@@ -216,6 +225,15 @@ typedef union {
        esp_bt_status_t stat;                  /*!< authentication complete status */
        uint8_t device_name[ESP_BT_GAP_MAX_BDNAME_LEN + 1]; /*!< device name */
    } auth_cmpl;                               /*!< authentication complete parameter struct */
+
+    /**
+     * @brief ESP_BT_GAP_PIN_REQ_EVT
+     */
+    struct pin_req_param {
+        esp_bd_addr_t bda;                     /*!< remote bluetooth device address*/
+        bool min_16_digit;                     /*!< TRUE if the pin returned must be at least 16 digits */
+    } pin_req;                                 /*!< pin request parameter struct */
+
 } esp_bt_gap_cb_param_t;

 /**
@@ -447,6 +465,38 @@ int esp_bt_gap_get_bond_device_num(void);
 */
 esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list);

+/**
+* @brief            Set pin type and default pin code for legacy pairing.
+*
+* @param[in]        pin_type:       Use variable or fixed pin.
+*                                   If pin_type is ESP_BT_PIN_TYPE_VARIABLE, pin_code and pin_code_len
+*                                   will be ignored, and ESP_BT_GAP_PIN_REQ_EVT will come when control
+*                                   requests for pin code.
+*                                   Else, will use fixed pin code and not callback to users.
+* @param[in]        pin_code_len:   Length of pin_code
+* @param[in]        pin_code:       Pin_code
+*
+* @return           - ESP_OK : success
+*                   - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
+*                   - other  : failed
+*/
+esp_err_t esp_bt_gap_set_pin(esp_bt_pin_type_t pin_type, uint8_t pin_code_len, esp_bt_pin_code_t pin_code);
+
+/**
+* @brief            Reply the pin_code to the peer device for legacy pairing
+*                   when ESP_BT_GAP_PIN_REQ_EVT is coming.
+*
+* @param[in]        bd_addr:        BD address of the peer
+* @param[in]        accept:         Pin_code reply successful or declined.
+* @param[in]        pin_code_len:   Length of pin_code
+* @param[in]        pin_code:       Pin_code
+*
+* @return           - ESP_OK : success
+*                   - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
+*                   - other  : failed
+*/
+esp_err_t esp_bt_gap_pin_reply(esp_bd_addr_t bd_addr, bool accept, uint8_t pin_code_len, esp_bt_pin_code_t pin_code);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/bluedroid/api/include/api/esp_hf_client_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_hf_client_api.h
@@ -251,9 +251,9 @@ typedef union {
 } esp_hf_client_cb_param_t;

 /**
- * @brief           HFP client incoming data callback function, the callback is useful in case of 
+ * @brief           HFP client incoming data callback function, the callback is useful in case of
 *                  Voice Over HCI.
- * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the 
+ * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the
 *                  buffer is allocated inside bluetooth protocol stack and will be released after
 *                  invoke of the callback is finished.
 * @param[in]       len : size(in bytes) in buf
@@ -261,13 +261,13 @@ typedef union {
 typedef void (* esp_hf_client_incoming_data_cb_t)(const uint8_t *buf, uint32_t len);

 /**
- * @brief           HFP client outgoing data callback function, the callback is useful in case of 
- *                  Voice Over HCI. Once audio connection is set up and the application layer has 
- *                  prepared data to send, the lower layer will call this function to read data 
+ * @brief           HFP client outgoing data callback function, the callback is useful in case of
+ *                  Voice Over HCI. Once audio connection is set up and the application layer has
+ *                  prepared data to send, the lower layer will call this function to read data
 *                  and then send. This callback is supposed to be implemented as non-blocking,
 *                  and if data is not enough, return value 0 is supposed.
- *                  
- * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the 
+ *
+ * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the
 *                  buffer is allocated inside bluetooth protocol stack and will be released after
 *                  invoke of the callback is finished.
 * @param[in]       len : size(in bytes) in buf
@@ -326,7 +326,7 @@ esp_err_t esp_hf_client_deinit(void);

 /**
 *
- * @brief           Connect to remote bluetooth HFP audio gateway(AG) device, must after esp_a2d_hf_client_init()
+ * @brief           Connect to remote bluetooth HFP audio gateway(AG) device, must after esp_hf_client_init()
 *
 * @param[in]       remote_bda: remote bluetooth device address
 *
@@ -606,7 +606,7 @@ void esp_hf_client_outgoing_data_ready(void);

 /**
 * @brief           Initialize the down sampling converter. This is a utility function that can
- *                  only be used in the case that Voice Over HCI is enabled. 
+ *                  only be used in the case that Voice Over HCI is enabled.
 *
 * @param[in]       src_sps: original samples per second(source audio data, i.e. 48000, 32000,
 *                  16000, 44100, 22050, 11025)
--- a/components/bt/bluedroid/api/include/api/esp_spp_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_spp_api.h
@@ -190,8 +190,7 @@ esp_err_t esp_spp_register_callback(esp_spp_cb_t callback);
 /**
 * @brief       This function is called to init SPP.
 *
- * @param[in]   mode: Choose the mode of SPP, ESP_SPP_MODE_CB or ESP_SPP_MODE_CB.
- *                    Now only supports ESP_SPP_MODE_CB mode, we will continue to update.
+ * @param[in]   mode: Choose the mode of SPP, ESP_SPP_MODE_CB or ESP_SPP_MODE_VFS.
 *
 * @return
 *              - ESP_OK: success
--- a/components/bt/bluedroid/bta/av/bta_av_aact.c
+++ b/components/bt/bluedroid/bta/av/bta_av_aact.c
@@ -143,6 +143,7 @@ const tBTA_AV_SACT bta_av_a2d_action[] = {
    bta_av_role_res,        /* BTA_AV_ROLE_RES */
    bta_av_delay_co,        /* BTA_AV_DELAY_CO */
    bta_av_open_at_inc,     /* BTA_AV_OPEN_AT_INC */
+    bta_av_open_fail_sdp,   /* BTA_AV_OPEN_FAIL_SDP */
    NULL
 };

@@ -1060,6 +1061,35 @@ void bta_av_free_sdb(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
    utl_freebuf((void **) &p_scb->p_disc_db);
 }

+/*******************************************************************************
+**
+** Function         bta_av_open_fail_sdp
+**
+** Description      report BTA_AV_OPEN_EVT with service discovery failed status
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_av_open_fail_sdp(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
+{
+    tBTA_AV_OPEN open;
+
+    bdcpy(open.bd_addr, p_scb->peer_addr);
+    open.chnl   = p_scb->chnl;
+    open.hndl   = p_scb->hndl;
+    open.status = BTA_AV_FAIL_SDP;
+
+    if (p_scb->seps[p_scb->sep_idx].tsep == AVDT_TSEP_SRC ) {
+        open.sep = AVDT_TSEP_SNK;
+    } else if (p_scb->seps[p_scb->sep_idx].tsep == AVDT_TSEP_SNK ) {
+        open.sep = AVDT_TSEP_SRC;
+    }
+
+    (*bta_av_cb.p_cback)(BTA_AV_OPEN_EVT, (tBTA_AV *) &open);
+
+    UNUSED(p_data);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_av_config_ind
@@ -1544,6 +1574,17 @@ void bta_av_disc_results (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
    /* store number of stream endpoints returned */
    p_scb->num_seps = p_data->str_msg.msg.discover_cfm.num_seps;

+    UINT8 num_seps = (p_scb->num_seps < BTA_AV_NUM_SEPS) ? p_scb->num_seps : BTA_AV_NUM_SEPS;
+    memcpy(p_scb->sep_info, p_data->str_msg.msg.discover_cfm.p_sep_info, sizeof(tAVDT_SEP_INFO) * num_seps);
+    for (i = 0; i < p_data->str_msg.msg.discover_cfm.num_seps; i++) {
+        APPL_TRACE_DEBUG("peer sep %d, in use %d, seid %d, media type %d,  tsep %d",
+                           i,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].in_use,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].seid,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].media_type,
+                           p_data->str_msg.msg.discover_cfm.p_sep_info[i].tsep
+                           );
+    }
    for (i = 0; i < p_scb->num_seps; i++) {
        /* steam not in use, is a sink, and is audio */
        if ((p_scb->sep_info[i].in_use == FALSE) &&
@@ -1557,7 +1598,7 @@ void bta_av_disc_results (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
                    (uuid_int == UUID_SERVCLASS_AUDIO_SINK)) {
                num_srcs++;
            }
-
+            APPL_TRACE_DEBUG("num srcs: %d, num_snks: %d\n", num_snks, num_srcs);
        }
    }

--- a/components/bt/bluedroid/bta/av/bta_av_api.c
+++ b/components/bt/bluedroid/bta/av/bta_av_api.c
@@ -105,7 +105,7 @@ void BTA_AvDisable(void)
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos)
+void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep)
 {
    tBTA_AV_API_REG  *p_buf;

@@ -122,6 +122,7 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
        p_buf->app_id = app_id;
        p_buf->p_app_data_cback = p_data_cback;
        p_buf->bta_av_cos = bta_av_cos;
+        p_buf->tsep = tsep;
        bta_sys_sendmsg(p_buf);
    }
 }
--- a/components/bt/bluedroid/bta/av/bta_av_main.c
+++ b/components/bt/bluedroid/bta/av/bta_av_main.c
@@ -578,18 +578,20 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            }

            /* Set the Capturing service class bit */
+            if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                cod.service = BTM_COD_SERVICE_CAPTURING;
+            } else {
 #if (BTA_AV_SINK_INCLUDED == TRUE)
-            cod.service = BTM_COD_SERVICE_CAPTURING | BTM_COD_SERVICE_RENDERING;
-#else
-            cod.service = BTM_COD_SERVICE_CAPTURING;
+                cod.service = BTM_COD_SERVICE_RENDERING;
 #endif
+            }
            utl_set_device_class(&cod, BTA_UTL_SET_COD_SERVICE_CLASS);
        } /* if 1st channel */

        /* get stream configuration and create stream */
        /* memset(&cs.cfg,0,sizeof(tAVDT_CFG)); */
        cs.cfg.num_codec = 1;
-        cs.tsep = AVDT_TSEP_SRC;
+        cs.tsep = p_data->api_reg.tsep;

        /*
         * memset of cs takes care setting call back pointers to null.
@@ -637,11 +639,10 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            memcpy(&p_scb->cfg, &cs.cfg, sizeof(tAVDT_CFG));
            while (index < BTA_AV_MAX_SEPS &&
                    (p_scb->p_cos->init)(&codec_type, cs.cfg.codec_info,
-                                         &cs.cfg.num_protect, cs.cfg.protect_info, index) == TRUE) {
+                                         &cs.cfg.num_protect, cs.cfg.protect_info, p_data->api_reg.tsep) == TRUE) {

 #if (BTA_AV_SINK_INCLUDED == TRUE)
-                if (index == 1) {
-                    cs.tsep = AVDT_TSEP_SNK;
+                if (p_data->api_reg.tsep == AVDT_TSEP_SNK) {
                    cs.p_data_cback = bta_av_stream_data_cback;
                }
                APPL_TRACE_DEBUG(" SEP Type = %d\n", cs.tsep);
@@ -667,18 +668,20 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            }

            if (!bta_av_cb.reg_audio) {
-                /* create the SDP records on the 1st audio channel */
-                bta_av_cb.sdp_a2d_handle = SDP_CreateRecord();
-                A2D_AddRecord(UUID_SERVCLASS_AUDIO_SOURCE, p_service_name, NULL,
-                              A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_handle);
-                bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
-
+                if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                    /* create the SDP records on the 1st audio channel */
+                    bta_av_cb.sdp_a2d_handle = SDP_CreateRecord();
+                    A2D_AddRecord(UUID_SERVCLASS_AUDIO_SOURCE, p_service_name, NULL,
+                                  A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_handle);
+                    bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
+                } else {
 #if (BTA_AV_SINK_INCLUDED == TRUE)
-                bta_av_cb.sdp_a2d_snk_handle = SDP_CreateRecord();
-                A2D_AddRecord(UUID_SERVCLASS_AUDIO_SINK, p_avk_service_name, NULL,
-                              A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_snk_handle);
-                bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SINK);
+                    bta_av_cb.sdp_a2d_snk_handle = SDP_CreateRecord();
+                    A2D_AddRecord(UUID_SERVCLASS_AUDIO_SINK, p_avk_service_name, NULL,
+                                  A2D_SUPF_PLAYER, bta_av_cb.sdp_a2d_snk_handle);
+                    bta_sys_add_uuid(UUID_SERVCLASS_AUDIO_SINK);
 #endif
+                }
                /* start listening when A2DP is registered */
                if (bta_av_cb.features & BTA_AV_FEAT_RCTG) {
                    bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
--- a/components/bt/bluedroid/bta/av/bta_av_ssm.c
+++ b/components/bt/bluedroid/bta/av/bta_av_ssm.c
@@ -94,6 +94,7 @@ enum {
    BTA_AV_ROLE_RES,
    BTA_AV_DELAY_CO,
    BTA_AV_OPEN_AT_INC,
+    BTA_AV_OPEN_FAIL_SDP,
    BTA_AV_NUM_SACTIONS
 };

@@ -199,7 +200,7 @@ static const UINT8 bta_av_sst_opening[][BTA_AV_NUM_COLS] = {
    /* CI_SETCONFIG_OK_EVT */   {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
    /* CI_SETCONFIG_FAIL_EVT */ {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
    /* SDP_DISC_OK_EVT */       {BTA_AV_CONNECT_REQ,    BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
-    /* SDP_DISC_FAIL_EVT */     {BTA_AV_CONNECT_REQ,    BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
+    /* SDP_DISC_FAIL_EVT */     {BTA_AV_FREE_SDB,       BTA_AV_OPEN_FAIL_SDP,  BTA_AV_INIT_SST },
    /* STR_DISC_OK_EVT */       {BTA_AV_DISC_RESULTS,   BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
    /* STR_DISC_FAIL_EVT */     {BTA_AV_OPEN_FAILED,    BTA_AV_SIGNORE,        BTA_AV_CLOSING_SST },
    /* STR_GETCAP_OK_EVT */     {BTA_AV_GETCAP_RESULTS, BTA_AV_SIGNORE,        BTA_AV_OPENING_SST },
--- a/components/bt/bluedroid/bta/av/include/bta_av_int.h
+++ b/components/bt/bluedroid/bta/av/include/bta_av_int.h
@@ -158,44 +158,6 @@ enum {
 /*****************************************************************************
 **  Data types
 *****************************************************************************/
-#if 0
-/* function types for call-out functions */
-typedef BOOLEAN (*tBTA_AV_CO_INIT) (UINT8 *p_codec_type, UINT8 *p_codec_info,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 index);
-typedef void (*tBTA_AV_CO_DISC_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
-                                     UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
-typedef UINT8 (*tBTA_AV_CO_GETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
-                                    UINT8 *p_codec_info, UINT8 *p_sep_info_idx, UINT8 seid,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info);
-typedef void (*tBTA_AV_CO_SETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
-                                   UINT8 *p_codec_info, UINT8 seid, BD_ADDR addr,
-                                   UINT8 num_protect, UINT8 *p_protect_info,
-                                   UINT8 t_local_sep, UINT8 avdt_handle);
-typedef void (*tBTA_AV_CO_OPEN) (tBTA_AV_HNDL hndl,
-                                 tBTA_AV_CODEC codec_type, UINT8 *p_codec_info,
-                                 UINT16 mtu);
-typedef void (*tBTA_AV_CO_CLOSE) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type, UINT16 mtu);
-typedef void (*tBTA_AV_CO_START) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type, UINT8 *p_codec_info, BOOLEAN *p_no_rtp_hdr);
-typedef void (*tBTA_AV_CO_STOP) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type);
-typedef void *(*tBTA_AV_CO_DATAPATH) (tBTA_AV_CODEC codec_type,
-                                      UINT32 *p_len, UINT32 *p_timestamp);
-typedef void (*tBTA_AV_CO_DELAY) (tBTA_AV_HNDL hndl, UINT16 delay);
-
-/* the call-out functions for one stream */
-typedef struct {
-    tBTA_AV_CO_INIT     init;
-    tBTA_AV_CO_DISC_RES disc_res;
-    tBTA_AV_CO_GETCFG   getcfg;
-    tBTA_AV_CO_SETCFG   setcfg;
-    tBTA_AV_CO_OPEN     open;
-    tBTA_AV_CO_CLOSE    close;
-    tBTA_AV_CO_START    start;
-    tBTA_AV_CO_STOP     stop;
-    tBTA_AV_CO_DATAPATH data;
-    tBTA_AV_CO_DELAY    delay;
-} tBTA_AV_CO_FUNCTS;
-#endif
-
 /* data type for BTA_AV_API_ENABLE_EVT */
 typedef struct {
    BT_HDR              hdr;
@@ -209,7 +171,8 @@ typedef struct {
    BT_HDR              hdr;
    char                p_service_name[BTA_SERVICE_NAME_LEN + 1];
    UINT8               app_id;
-    tBTA_AV_DATA_CBACK       *p_app_data_cback;
+    UINT8               tsep; // local SEP type
+    tBTA_AV_DATA_CBACK  *p_app_data_cback;
    tBTA_AV_CO_FUNCTS   *bta_av_cos;
 } tBTA_AV_API_REG;

@@ -698,6 +661,7 @@ extern void bta_av_switch_role (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
 extern void bta_av_role_res (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
 extern void bta_av_delay_co (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
 extern void bta_av_open_at_inc (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
+extern void bta_av_open_fail_sdp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);

 /* ssm action functions - vdp specific */
 extern void bta_av_do_disc_vdp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data);
--- a/components/bt/bluedroid/bta/dm/bta_dm_act.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_act.c
@@ -705,7 +705,7 @@ static void bta_dm_process_remove_device(BD_ADDR bd_addr, tBT_TRANSPORT transpor
    BTA_GATTC_CancelOpen(0, bd_addr, FALSE);
 #endif

-    BTM_SecDeleteDevice(bd_addr);
+    BTM_SecDeleteDevice(bd_addr, transport);

 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
    /* remove all cached GATT information */
@@ -748,7 +748,8 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)

        /* Take the link down first, and mark the device for removal when disconnected */
        for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
-            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_dev->bd_addr)) {
+            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_dev->bd_addr)
+                && bta_dm_cb.device_list.peer_device[i].transport == transport) {
                bta_dm_cb.device_list.peer_device[i].conn_state = BTA_DM_UNPAIRING;
                btm_remove_acl( p_dev->bd_addr, bta_dm_cb.device_list.peer_device[i].transport);
                APPL_TRACE_DEBUG("%s:transport = %d", __func__,
@@ -853,7 +854,7 @@ void bta_dm_close_acl(tBTA_DM_MSG *p_data)
    }
    /* if to remove the device from security database ? do it now */
    else if (p_remove_acl->remove_dev) {
-        if (!BTM_SecDeleteDevice(p_remove_acl->bd_addr)) {
+        if (!BTM_SecDeleteDevice(p_remove_acl->bd_addr, p_remove_acl->transport)) {
            APPL_TRACE_ERROR("delete device from security database failed.");
        }
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
@@ -973,6 +974,21 @@ void bta_dm_bond_cancel (tBTA_DM_MSG *p_data)

 }

+/*******************************************************************************
+**
+** Function         bta_dm_set_pin_type
+**
+** Description      Set the pin type and fixed pin
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_dm_set_pin_type (tBTA_DM_MSG *p_data)
+{
+    BTM_SetPinType (p_data->set_pin_type.pin_type, p_data->set_pin_type.p_pin, p_data->set_pin_type.pin_len);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_pin_reply
@@ -2626,9 +2642,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
    }
 }

-
-
-
+#if (BTM_LOCAL_IO_CAPS != BTM_IO_CAP_NONE)
 /*******************************************************************************
 **
 ** Function         bta_dm_pinname_cback
@@ -2685,6 +2699,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
        bta_dm_cb.p_sec_cback(event, &sec_event);
    }
 }
+#endif //(BTM_LOCAL_IO_CAPS != BTM_IO_CAP_NONE)

 /*******************************************************************************
 **
@@ -2704,18 +2719,6 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
        return BTM_NOT_AUTHORIZED;
    }

-    /* If the device name is not known, save bdaddr and devclass and initiate a name request */
-    if (bd_name[0] == 0) {
-        bta_dm_cb.pin_evt = BTA_DM_PIN_REQ_EVT;
-        bdcpy(bta_dm_cb.pin_bd_addr, bd_addr);
-        BTA_COPY_DEVICE_CLASS(bta_dm_cb.pin_dev_class, dev_class);
-        if ((BTM_ReadRemoteDeviceName(bd_addr, bta_dm_pinname_cback, BT_TRANSPORT_BR_EDR)) == BTM_CMD_STARTED) {
-            return BTM_CMD_STARTED;
-        }
-
-        APPL_TRACE_WARNING(" bta_dm_pin_cback() -> Failed to start Remote Name Request  ");
-    }
-
    bdcpy(sec_event.pin_req.bd_addr, bd_addr);
    BTA_COPY_DEVICE_CLASS(sec_event.pin_req.dev_class, dev_class);
    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
@@ -3256,7 +3259,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
            }

            if ( bta_dm_cb.device_list.peer_device[i].conn_state == BTA_DM_UNPAIRING ) {
-                if (BTM_SecDeleteDevice(bta_dm_cb.device_list.peer_device[i].peer_bdaddr)) {
+                if (BTM_SecDeleteDevice(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, bta_dm_cb.device_list.peer_device[i].transport)) {
                    issue_unpair_cb = TRUE;
                }

@@ -3304,7 +3307,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
            }
        }
        if (conn.link_down.is_removed) {
-            BTM_SecDeleteDevice(p_bda);
+            BTM_SecDeleteDevice(p_bda, p_data->acl_change.transport);
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
            /* need to remove all pending background connection */
            BTA_GATTC_CancelOpen(0, p_bda, FALSE);
@@ -3482,7 +3485,7 @@ static void bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr)
            APPL_TRACE_ERROR(" %s Device does not exist in DB", __FUNCTION__);
        }
    } else {
-        BTM_SecDeleteDevice (remote_bd_addr);
+        BTM_SecDeleteDevice (remote_bd_addr, bta_dm_cb.device_list.peer_device[index].transport);
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
        /* need to remove all pending background connection */
        BTA_GATTC_CancelOpen(0, remote_bd_addr, FALSE);
@@ -4233,9 +4236,8 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D

    memset(&sec_event, 0, sizeof(tBTA_DM_SEC));
    switch (event) {
-    case BTM_LE_IO_REQ_EVT:
-        // #if (BTM_LOCAL_IO_CAPS != BTM_IO_CAP_NONE)
-
+    case BTM_LE_IO_REQ_EVT: {
+        // #if (BT_SSP_INCLUDED == TRUE)
        bta_dm_co_ble_io_req(bda,
                             &p_data->io_req.io_cap,
                             &p_data->io_req.oob_data,
@@ -4250,6 +4252,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
        APPL_TRACE_EVENT("io mitm: %d oob_data:%d\n", p_data->io_req.auth_req, p_data->io_req.oob_data);

        break;
+    }

    case BTM_LE_SEC_REQUEST_EVT:
        bdcpy(sec_event.ble_req.bd_addr, bda);
@@ -4325,7 +4328,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D

            }
        }
-
+        sec_event.auth_cmpl.auth_mode = p_data->complt.auth_mode;
        if (bta_dm_cb.p_sec_cback) {
            //bta_dm_cb.p_sec_cback(BTA_DM_AUTH_CMPL_EVT, &sec_event);
            bta_dm_cb.p_sec_cback(BTA_DM_BLE_AUTH_CMPL_EVT, &sec_event);
@@ -4414,7 +4417,8 @@ void bta_dm_add_ble_device (tBTA_DM_MSG *p_data)
 {
    if (!BTM_SecAddBleDevice (p_data->add_ble_device.bd_addr, NULL,
                              p_data->add_ble_device.dev_type  ,
-                              p_data->add_ble_device.addr_type)) {
+                              p_data->add_ble_device.addr_type,
+                              p_data->add_ble_device.auth_mode)) {
        APPL_TRACE_ERROR ("BTA_DM: Error adding BLE Device for device %08x%04x",
                          (p_data->add_ble_device.bd_addr[0] << 24) + (p_data->add_ble_device.bd_addr[1] << 16) + \
                          (p_data->add_ble_device.bd_addr[2] << 8) + p_data->add_ble_device.bd_addr[3],
@@ -4443,6 +4447,10 @@ void bta_dm_ble_passkey_reply (tBTA_DM_MSG *p_data)

 }

+void bta_dm_ble_set_static_passkey(tBTA_DM_MSG *p_data)
+{
+    BTM_BleSetStaticPasskey(p_data->ble_set_static_passkey.add, p_data->ble_set_static_passkey.static_passkey);
+}
 /*******************************************************************************
 **
 ** Function         bta_dm_ble_confirm_reply
--- a/components/bt/bluedroid/bta/dm/bta_dm_api.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_api.c
@@ -436,6 +436,29 @@ void BTA_DmBondCancel(BD_ADDR bd_addr)

 }

+/*******************************************************************************
+**
+** Function         BTA_DMSetPinType
+**
+** Description      This function set pin type as BTM_PIN_TYPE_FIXED or BTM_PIN_TYPE_VARIABLE
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+void BTA_DMSetPinType (UINT8 pin_type, UINT8 *pin_code, UINT8 pin_code_len)
+{
+    tBTA_DM_API_SET_PIN_TYPE    *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_SET_PIN_TYPE *) osi_malloc(sizeof(tBTA_DM_API_SET_PIN_TYPE))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_SET_PIN_TYPE_EVT;
+        p_msg->pin_type = pin_type;
+        p_msg->pin_len = pin_code_len;
+        memcpy(p_msg->p_pin, pin_code, pin_code_len);
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_DmPinReply
@@ -448,7 +471,6 @@ void BTA_DmBondCancel(BD_ADDR bd_addr)
 **
 *******************************************************************************/
 void BTA_DmPinReply(BD_ADDR bd_addr, BOOLEAN accept, UINT8 pin_len, UINT8 *p_pin)
-
 {
    tBTA_DM_API_PIN_REPLY    *p_msg;

@@ -752,12 +774,13 @@ void BTA_DmAddBleKey (BD_ADDR bd_addr, tBTA_LE_KEY_VALUE *p_le_key, tBTA_LE_KEY_
 **
 ** Parameters:      bd_addr          - BD address of the peer
 **                  dev_type         - Remote device's device type.
+**                  auth_mode        - auth mode
 **                  addr_type        - LE device address type.
 **
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, tBT_DEVICE_TYPE dev_type)
+void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, int auth_mode, tBT_DEVICE_TYPE dev_type)
 {
    tBTA_DM_API_ADD_BLE_DEVICE *p_msg;

@@ -767,6 +790,7 @@ void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, tBT_DEVICE_TY
        p_msg->hdr.event = BTA_DM_API_ADD_BLEDEVICE_EVT;
        bdcpy(p_msg->bd_addr, bd_addr);
        p_msg->addr_type = addr_type;
+        p_msg->auth_mode = auth_mode;
        p_msg->dev_type = dev_type;

        bta_sys_sendmsg(p_msg);
@@ -803,6 +827,21 @@ void BTA_DmBlePasskeyReply(BD_ADDR bd_addr, BOOLEAN accept, UINT32 passkey)
        bta_sys_sendmsg(p_msg);
    }
 }
+
+void BTA_DmBleSetStaticPasskey(bool add, uint32_t passkey)
+{
+    tBTA_DM_API_SET_DEFAULT_PASSKEY    *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_SET_DEFAULT_PASSKEY *) osi_malloc(sizeof(tBTA_DM_API_SET_DEFAULT_PASSKEY))) != NULL) {
+        memset(p_msg, 0, sizeof(tBTA_DM_API_SET_DEFAULT_PASSKEY));
+
+        p_msg->hdr.event = BTA_DM_API_BLE_SET_STATIC_PASSKEY_EVT;
+        p_msg->add = add;
+        p_msg->static_passkey = passkey;
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleConfirmReply
--- a/components/bt/bluedroid/bta/dm/bta_dm_co.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_co.c
@@ -31,6 +31,10 @@
 #endif /* #if (defined(BTIF_INCLUDED) && BTIF_INCLUDED == TRUE) */
 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
 #include "common/bte_appl.h"
+
+#define BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_DISABLE 0
+#define BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_ENABLE  1
+
 tBTE_APPL_CFG bte_appl_cfg = {
 #if SMP_INCLUDED == TRUE
    BTA_LE_AUTH_REQ_SC_MITM_BOND, // Authentication requirements
@@ -40,7 +44,8 @@ tBTE_APPL_CFG bte_appl_cfg = {
    BTM_LOCAL_IO_CAPS_BLE,
    BTM_BLE_INITIATOR_KEY_SIZE,
    BTM_BLE_RESPONDER_KEY_SIZE,
-    BTM_BLE_MAX_KEY_SIZE
+    BTM_BLE_MAX_KEY_SIZE,
+    BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_DISABLE
 };
 #endif

@@ -319,7 +324,7 @@ void bta_dm_co_ble_io_req(BD_ADDR bd_addr,  tBTA_IO_CAP *p_io_cap,
 #endif  ///SMP_INCLUDED == TRUE
 }

-void bta_dm_co_ble_set_io_cap(UINT8   ble_io_cap)
+void bta_dm_co_ble_set_io_cap(UINT8 ble_io_cap)
 {
 #if (SMP_INCLUDED == TRUE)
    if(ble_io_cap < BTM_IO_CAP_MAX ) {
@@ -330,7 +335,7 @@ void bta_dm_co_ble_set_io_cap(UINT8   ble_io_cap)
 #endif  ///SMP_INCLUDED == TRUE
 }

-void bta_dm_co_ble_set_auth_req(UINT8   ble_auth_req)
+void bta_dm_co_ble_set_auth_req(UINT8 ble_auth_req)
 {
 #if (SMP_INCLUDED == TRUE)
    bte_appl_cfg.ble_auth_req = ble_auth_req;
@@ -363,5 +368,32 @@ void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size)
    }
 #endif  ///SMP_INCLUDED == TRUE
 }
+
+void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable)
+{
+#if (SMP_INCLUDED == TRUE)
+    if (enable) {
+        enable = BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_ENABLE;
+    }
+    bte_appl_cfg.ble_accept_auth_enable = enable;
+#endif  ///SMP_INCLUDED == TRUE
+}
+
+UINT8 bta_dm_co_ble_get_accept_auth_enable(void)
+{
+#if (SMP_INCLUDED == TRUE)
+    return bte_appl_cfg.ble_accept_auth_enable;
+#endif  ///SMP_INCLUDED == TRUE
+    return 0;
+}
+
+UINT8 bta_dm_co_ble_get_auth_req(void)
+{
+#if (SMP_INCLUDED == TRUE)
+    return bte_appl_cfg.ble_auth_req;
+#endif  ///SMP_INCLUDED == TRUE
+    return 0;
+}
+
 #endif

--- a/components/bt/bluedroid/bta/dm/bta_dm_main.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_main.c
@@ -53,33 +53,34 @@ typedef void (*tBTA_DM_ACTION)(tBTA_DM_MSG *p_data);
 const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {

    /* device manager local device API events */
-    bta_dm_enable,                          /* 0  BTA_DM_API_ENABLE_EVT */
-    bta_dm_disable,                         /* 1  BTA_DM_API_DISABLE_EVT */
-    bta_dm_set_dev_name,                    /* 2  BTA_DM_API_SET_NAME_EVT */
-    bta_dm_set_visibility,                  /* 3  BTA_DM_API_SET_VISIBILITY_EVT */
-    bta_dm_acl_change,                      /* 8  BTA_DM_ACL_CHANGE_EVT */
-    bta_dm_add_device,                      /* 9  BTA_DM_API_ADD_DEVICE_EVT */
-    bta_dm_close_acl,                       /* 10  BTA_DM_API_REMOVE_ACL_EVT */
+    bta_dm_enable,                          /* BTA_DM_API_ENABLE_EVT */
+    bta_dm_disable,                         /* BTA_DM_API_DISABLE_EVT */
+    bta_dm_set_dev_name,                    /* BTA_DM_API_SET_NAME_EVT */
+    bta_dm_set_visibility,                  /* BTA_DM_API_SET_VISIBILITY_EVT */
+    bta_dm_acl_change,                      /* BTA_DM_ACL_CHANGE_EVT */
+    bta_dm_add_device,                      /* BTA_DM_API_ADD_DEVICE_EVT */
+    bta_dm_close_acl,                       /* BTA_DM_API_REMOVE_ACL_EVT */
 #if (SMP_INCLUDED == TRUE)
    /* security API events */
-    bta_dm_bond,                            /* 11  BTA_DM_API_BOND_EVT */
-    bta_dm_bond_cancel,                     /* 12  BTA_DM_API_BOND_CANCEL_EVT */
-    bta_dm_pin_reply,                       /* 13 BTA_DM_API_PIN_REPLY_EVT */
+    bta_dm_bond,                            /* BTA_DM_API_BOND_EVT */
+    bta_dm_bond_cancel,                     /* BTA_DM_API_BOND_CANCEL_EVT */
+    bta_dm_set_pin_type,                    /* BTA_DM_API_SET_PIN_TYPE_EVT */
+    bta_dm_pin_reply,                       /* BTA_DM_API_PIN_REPLY_EVT */
 #endif  ///SMP_INCLUDED == TRUE
 #if (BTA_DM_PM_INCLUDED == TRUE)
    /* power manger events */
-    bta_dm_pm_btm_status,                   /* 16 BTA_DM_PM_BTM_STATUS_EVT */
-    bta_dm_pm_timer,                        /* 17 BTA_DM_PM_TIMER_EVT*/
+    bta_dm_pm_btm_status,                   /* BTA_DM_PM_BTM_STATUS_EVT */
+    bta_dm_pm_timer,                        /* BTA_DM_PM_TIMER_EVT */
 #endif /* #if (BTA_DM_PM_INCLUDED == TRUE) */
    /* simple pairing events */
 #if (SMP_INCLUDED == TRUE)
-    bta_dm_confirm,                         /* 18 BTA_DM_API_CONFIRM_EVT */
+    bta_dm_confirm,                         /* BTA_DM_API_CONFIRM_EVT */
    bta_dm_set_encryption,                  /* BTA_DM_API_SET_ENCRYPTION_EVT */
 #endif  ///SMP_INCLUDED == TRUE
 #if (BTM_OOB_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
-    bta_dm_loc_oob,                         /* 20 BTA_DM_API_LOC_OOB_EVT */
-    bta_dm_ci_io_req_act,                   /* 21 BTA_DM_CI_IO_REQ_EVT */
-    bta_dm_ci_rmt_oob_act,                  /* 22 BTA_DM_CI_RMT_OOB_EVT */
+    bta_dm_loc_oob,                         /* BTA_DM_API_LOC_OOB_EVT */
+    bta_dm_ci_io_req_act,                   /* BTA_DM_CI_IO_REQ_EVT */
+    bta_dm_ci_rmt_oob_act,                  /* BTA_DM_CI_RMT_OOB_EVT */
 #endif /* BTM_OOB_INCLUDED */


@@ -88,6 +89,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_add_blekey,                      /*  BTA_DM_API_ADD_BLEKEY_EVT           */
    bta_dm_add_ble_device,                  /*  BTA_DM_API_ADD_BLEDEVICE_EVT        */
    bta_dm_ble_passkey_reply,               /*  BTA_DM_API_BLE_PASSKEY_REPLY_EVT    */
+    bta_dm_ble_set_static_passkey,          /* BTA_DM_API_BLE_SET_STATIC_PASSKEY_EVT */
    bta_dm_ble_confirm_reply,               /*  BTA_DM_API_BLE_CONFIRM_REPLY_EVT    */
    bta_dm_security_grant,
 #endif  ///SMP_INCLUDED == TRUE
@@ -96,18 +98,18 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_set_conn_scan_params,        /* BTA_DM_API_BLE_CONN_SCAN_PARAM_EVT */
    bta_dm_ble_set_scan_params,             /* BTA_DM_API_BLE_SCAN_PARAM_EVT */
    bta_dm_ble_set_scan_fil_params,         /* BTA_DM_API_BLE_SCAN_FIL_PARAM_EVT */
-    bta_dm_ble_observe,                     /* BTA_DM_API_BLE_OBSERVE_EVT*/
+    bta_dm_ble_observe,                     /* BTA_DM_API_BLE_OBSERVE_EVT */
    bta_dm_ble_scan,                        /* BTA_DM_API_BLE_SCAN_EVT */
    bta_dm_ble_update_conn_params,          /* BTA_DM_API_UPDATE_CONN_PARAM_EVT */
    /* This handler function added by
       Yulong at 2016/9/9 to support the
       random address setting for the APP */
-    bta_dm_ble_set_rand_address,            /* BTA_DM_API_SET_RAND_ADDR_EVT*/
+    bta_dm_ble_set_rand_address,            /* BTA_DM_API_SET_RAND_ADDR_EVT */
    /* This handler function added by
       Yulong at 2016/10/19 to support
       stop the ble advertising setting
       by the APP */
-    bta_dm_ble_stop_advertising,            /* BTA_DM_API_BLE_STOP_ADV_EVT*/
+    bta_dm_ble_stop_advertising,            /* BTA_DM_API_BLE_STOP_ADV_EVT */
 #if BLE_PRIVACY_SPT == TRUE
    bta_dm_ble_config_local_privacy,        /* BTA_DM_API_LOCAL_PRIVACY_EVT */
 #endif
@@ -119,7 +121,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
       data to HCI */
    bta_dm_ble_set_adv_config_raw,          /* BTA_DM_API_BLE_SET_ADV_CONFIG_RAW_EVT */
    bta_dm_ble_set_scan_rsp,                /* BTA_DM_API_BLE_SET_SCAN_RSP_EVT */
-    /* New function to allow set raw scan 
+    /* New function to allow set raw scan
       response data to HCI */
    bta_dm_ble_set_scan_rsp_raw,            /* BTA_DM_API_BLE_SET_SCAN_RSP_RAW_EVT */
    bta_dm_ble_broadcast,                   /* BTA_DM_API_BLE_BROADCAST_EVT */
@@ -129,10 +131,10 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_scan_filter_param_setup,         /* BTA_DM_API_SCAN_FILTER_SETUP_EVT */
    bta_dm_enable_scan_filter,              /* BTA_DM_API_SCAN_FILTER_ENABLE_EVT */
 #endif
-    bta_dm_ble_multi_adv_enb,               /*  BTA_DM_API_BLE_MULTI_ADV_ENB_EVT*/
-    bta_dm_ble_multi_adv_upd_param,         /*  BTA_DM_API_BLE_MULTI_ADV_PARAM_UPD_EVT */
-    bta_dm_ble_multi_adv_data,              /*  BTA_DM_API_BLE_MULTI_ADV_DATA_EVT */
-    btm_dm_ble_multi_adv_disable,           /*  BTA_DM_API_BLE_MULTI_ADV_DISABLE_EVT */
+    bta_dm_ble_multi_adv_enb,               /* BTA_DM_API_BLE_MULTI_ADV_ENB_EVT */
+    bta_dm_ble_multi_adv_upd_param,         /* BTA_DM_API_BLE_MULTI_ADV_PARAM_UPD_EVT */
+    bta_dm_ble_multi_adv_data,              /* BTA_DM_API_BLE_MULTI_ADV_DATA_EVT */
+    btm_dm_ble_multi_adv_disable,           /* BTA_DM_API_BLE_MULTI_ADV_DISABLE_EVT */
    bta_dm_ble_setup_storage,               /* BTA_DM_API_BLE_SETUP_STORAGE_EVT */
    bta_dm_ble_enable_batch_scan,           /* BTA_DM_API_BLE_ENABLE_BATCH_SCAN_EVT */
    bta_dm_ble_disable_batch_scan,          /* BTA_DM_API_BLE_DISABLE_BATCH_SCAN_EVT */
@@ -142,9 +144,9 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_disconnect,                  /* BTA_DM_API_BLE_DISCONNECT_EVT */
 #endif

-    bta_dm_enable_test_mode,                /*  BTA_DM_API_ENABLE_TEST_MODE_EVT     */
-    bta_dm_disable_test_mode,               /*  BTA_DM_API_DISABLE_TEST_MODE_EVT    */
-    bta_dm_execute_callback,                /*  BTA_DM_API_EXECUTE_CBACK_EVT        */
+    bta_dm_enable_test_mode,                /* BTA_DM_API_ENABLE_TEST_MODE_EVT */
+    bta_dm_disable_test_mode,               /* BTA_DM_API_DISABLE_TEST_MODE_EVT */
+    bta_dm_execute_callback,                /* BTA_DM_API_EXECUTE_CBACK_EVT */

    bta_dm_remove_all_acl,                  /* BTA_DM_API_REMOVE_ALL_ACL_EVT */
    bta_dm_remove_device,                   /* BTA_DM_API_REMOVE_DEVICE_EVT */
--- a/components/bt/bluedroid/bta/dm/include/bta_dm_int.h
+++ b/components/bt/bluedroid/bta/dm/include/bta_dm_int.h
@@ -61,6 +61,7 @@ enum {
    /* security API events */
    BTA_DM_API_BOND_EVT,
    BTA_DM_API_BOND_CANCEL_EVT,
+    BTA_DM_API_SET_PIN_TYPE_EVT,
    BTA_DM_API_PIN_REPLY_EVT,
 #endif  ///SMP_INCLUDED == TRUE
 #if (BTA_DM_PM_INCLUDED == TRUE)
@@ -86,6 +87,7 @@ enum {
    BTA_DM_API_ADD_BLEKEY_EVT,
    BTA_DM_API_ADD_BLEDEVICE_EVT,
    BTA_DM_API_BLE_PASSKEY_REPLY_EVT,
+    BTA_DM_API_BLE_SET_STATIC_PASSKEY_EVT,
    BTA_DM_API_BLE_CONFIRM_REPLY_EVT,
    BTA_DM_API_BLE_SEC_GRANT_EVT,
 #endif  ///SMP_INCLUDED == TRUE
@@ -271,6 +273,14 @@ typedef struct {
    tBTA_TRANSPORT  transport;
 } tBTA_DM_API_BOND_CANCEL;

+/* data type for BTA_DM_API_SET_PIN_TYPE_EVT */
+typedef struct {
+    BT_HDR      hdr;
+    UINT8       pin_type;
+    UINT8       pin_len;
+    UINT8       p_pin[PIN_CODE_LEN];
+} tBTA_DM_API_SET_PIN_TYPE;
+
 /* data type for BTA_DM_API_PIN_REPLY_EVT */
 typedef struct {
    BT_HDR      hdr;
@@ -424,6 +434,7 @@ typedef struct {
    BT_HDR                  hdr;
    BD_ADDR                 bd_addr;
    tBT_DEVICE_TYPE         dev_type ;
+    UINT32                  auth_mode;
    tBLE_ADDR_TYPE          addr_type;

 } tBTA_DM_API_ADD_BLE_DEVICE;
@@ -435,6 +446,12 @@ typedef struct {
    UINT32                  passkey;
 } tBTA_DM_API_PASSKEY_REPLY;

+typedef struct {
+    BT_HDR                  hdr;
+    BOOLEAN                 add;      
+    UINT32                  static_passkey;
+} tBTA_DM_API_SET_DEFAULT_PASSKEY;
+
 typedef struct {
    BT_HDR                  hdr;
    BD_ADDR                 bd_addr;
@@ -744,6 +761,7 @@ typedef union {

    tBTA_DM_API_BOND_CANCEL bond_cancel;

+    tBTA_DM_API_SET_PIN_TYPE set_pin_type;
    tBTA_DM_API_PIN_REPLY pin_reply;

    tBTA_DM_API_LOC_OOB     loc_oob;
@@ -777,6 +795,7 @@ typedef union {
    tBTA_DM_API_ADD_BLEKEY              add_ble_key;
    tBTA_DM_API_ADD_BLE_DEVICE          add_ble_device;
    tBTA_DM_API_PASSKEY_REPLY           ble_passkey_reply;
+    tBTA_DM_API_SET_DEFAULT_PASSKEY     ble_set_static_passkey;
    tBTA_DM_API_BLE_SEC_GRANT           ble_sec_grant;
    tBTA_DM_API_BLE_SET_BG_CONN_TYPE    ble_set_bd_conn_type;
    tBTA_DM_API_BLE_CONN_PARAMS         ble_set_conn_params;
@@ -1166,6 +1185,7 @@ extern void bta_dm_set_scan_config(tBTA_DM_MSG *p_data);
 extern void bta_dm_vendor_spec_command(tBTA_DM_MSG *p_data);
 extern void bta_dm_bond (tBTA_DM_MSG *p_data);
 extern void bta_dm_bond_cancel (tBTA_DM_MSG *p_data);
+extern void bta_dm_set_pin_type (tBTA_DM_MSG *p_data);
 extern void bta_dm_pin_reply (tBTA_DM_MSG *p_data);
 extern void bta_dm_acl_change(tBTA_DM_MSG *p_data);
 extern void bta_dm_add_device (tBTA_DM_MSG *p_data);
@@ -1178,6 +1198,7 @@ extern void bta_dm_add_ampkey (tBTA_DM_MSG *p_data);
 extern void bta_dm_add_blekey (tBTA_DM_MSG *p_data);
 extern void bta_dm_add_ble_device (tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_passkey_reply (tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_set_static_passkey(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_confirm_reply (tBTA_DM_MSG *p_data);
 extern void bta_dm_security_grant (tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_set_bg_conn_type (tBTA_DM_MSG *p_data);
--- a/components/bt/bluedroid/bta/hf_client/bta_hf_client_sco.c
+++ b/components/bt/bluedroid/bta/hf_client/bta_hf_client_sco.c
@@ -429,7 +429,6 @@ static void bta_hf_client_sco_event(UINT8 event)
    if (event == BTA_HF_CLIENT_SCO_CI_DATA_E) {
        uint16_t pkt_offset = 1 + HCI_SCO_PREAMBLE_SIZE;
        uint16_t len_to_send = 0;
-        uint8_t *p;
        while (true)
        {
            p_buf = osi_malloc(sizeof(BT_HDR) + pkt_offset + BTM_SCO_DATA_SIZE_MAX);
@@ -439,13 +438,13 @@ static void bta_hf_client_sco_event(UINT8 event)
            }

            p_buf->offset = pkt_offset;
+            p_buf->len = BTM_SCO_DATA_SIZE_MAX;
            len_to_send = bta_hf_client_sco_co_out_data(p_buf->data + pkt_offset, BTM_SCO_DATA_SIZE_MAX);
-            if (len_to_send) {
+            if (len_to_send == BTM_SCO_DATA_SIZE_MAX) {
+                // expect to get the exact size of data from upper layer
                if (bta_hf_client_cb.scb.sco_state == BTA_HF_CLIENT_SCO_OPEN_ST) {
-                    p = (UINT8 *)(p_buf->data + pkt_offset -1);
-                    *p = len_to_send; // set SCO packet length;
                    tBTM_STATUS write_stat = BTM_WriteScoData(p_scb->sco_idx, p_buf);
-                    if (write_stat != BTM_SUCCESS && write_stat != BTM_SCO_BAD_LENGTH) {
+                    if (write_stat != BTM_SUCCESS) {
                        break;
                    }
                } else {
--- a/components/bt/bluedroid/bta/include/bta/bta_api.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_api.h
@@ -763,6 +763,7 @@ typedef struct {
    UINT8           fail_reason;        /* The HCI reason/error code for when success=FALSE */
    tBLE_ADDR_TYPE  addr_type;          /* Peer device address type */
    tBT_DEVICE_TYPE dev_type;
+    UINT8           auth_mode;
 } tBTA_DM_AUTH_CMPL;


@@ -1560,6 +1561,18 @@ extern void BTA_DmBondByTransport(BD_ADDR bd_addr, tBTA_TRANSPORT transport);
 *******************************************************************************/
 extern void BTA_DmBondCancel(BD_ADDR bd_addr);

+/*******************************************************************************
+**
+** Function         BTA_DMSetPinType
+**
+** Description      This function sets pin type as BTM_PIN_TYPE_FIXED or BTM_PIN_TYPE_VARIABLE
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_DMSetPinType (UINT8 pin_type, UINT8 *pin_code, UINT8 pin_code_len);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmPinReply
@@ -1790,6 +1803,22 @@ extern void BTA_DmBleSetBgConnType(tBTA_DM_BLE_CONN_TYPE bg_conn_type, tBTA_DM_B
 *******************************************************************************/
 extern void BTA_DmBlePasskeyReply(BD_ADDR bd_addr, BOOLEAN accept, UINT32 passkey);

+/*******************************************************************************
+**
+** Function         BTA_DmBleSetStaticPasskey
+**
+** Description      Set BLE SMP static passkey.
+**
+** Parameters:      add              - add static passkey when add is true
+**                                     clear static passkey when add is false
+**                  passkey          - static passkey value
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_DmBleSetStaticPasskey(bool add, uint32_t passkey);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleConfirmReply
@@ -1814,12 +1843,13 @@ extern void BTA_DmBleConfirmReply(BD_ADDR bd_addr, BOOLEAN accept);
 **
 ** Parameters:      bd_addr          - BD address of the peer
 **                  dev_type         - Remote device's device type.
+**                  auth_mode        - auth mode
 **                  addr_type        - LE device address type.
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type,
+extern void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, int auth_mode,
                               tBT_DEVICE_TYPE dev_type);


--- a/components/bt/bluedroid/bta/include/bta/bta_av_api.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_av_api.h
@@ -98,7 +98,7 @@ typedef UINT8 tBTA_AV_HNDL;
 #endif

 #ifndef BTA_AV_MAX_SEPS
-#define BTA_AV_MAX_SEPS         2
+#define BTA_AV_MAX_SEPS         1
 #endif

 #ifndef BTA_AV_MAX_A2DP_MTU
@@ -259,7 +259,7 @@ typedef UINT8 tBTA_AV_ERR;

 /* function types for call-out functions */
 typedef BOOLEAN (*tBTA_AV_CO_INIT) (UINT8 *p_codec_type, UINT8 *p_codec_info,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 index);
+                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 tsep);
 typedef void (*tBTA_AV_CO_DISC_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
                                     UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
 typedef UINT8 (*tBTA_AV_CO_GETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
@@ -580,7 +580,7 @@ void BTA_AvDisable(void);
 **
 *******************************************************************************/
 void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name,
-                    UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos);
+                    UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep);

 /*******************************************************************************
 **
--- a/components/bt/bluedroid/bta/include/bta/bta_av_co.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_av_co.h
@@ -85,7 +85,7 @@ typedef struct {
 **
 *******************************************************************************/
 extern BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info,
-                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 index);
+                                    UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 tsep);

 /*******************************************************************************
 **
--- a/components/bt/bluedroid/bta/include/bta/bta_dm_co.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_dm_co.h
@@ -190,4 +190,10 @@ extern void bta_dm_co_ble_set_init_key_req(UINT8 init_key);
 extern void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key);

 extern void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size);
+
+extern void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable);
+
+extern UINT8 bta_dm_co_ble_get_accept_auth_enable(void);
+
+extern UINT8 bta_dm_co_ble_get_auth_req(void);
 #endif
--- a/components/bt/bluedroid/bta/jv/bta_jv_act.c
+++ b/components/bt/bluedroid/bta/jv/bta_jv_act.c
@@ -958,6 +958,14 @@ static bool create_base_record(const uint32_t sdp_handle, const char *name, cons
        return FALSE;
    }

+    stage = "profile_descriptor_list";
+    if (!SDP_AddProfileDescriptorList(sdp_handle, UUID_SERVCLASS_SERIAL_PORT, SPP_VERSION)){
+        APPL_TRACE_ERROR("create_base_record: failed to create base service "
+                   "record, stage: %s, scn: %d, name: %s, with_obex: %d",
+                   stage, channel, name, with_obex);
+        return FALSE;
+    }
+
    // Add the name to the SDP record.
    if (name[0] != '\0') {
        stage = "service_name";
--- a/components/bt/bluedroid/bta/jv/include/bta_jv_int.h
+++ b/components/bt/bluedroid/bta/jv/include/bta_jv_int.h
@@ -37,6 +37,8 @@
 **  Constants
 *****************************************************************************/

+#define SPP_VERSION             0x0102
+
 enum {
    /* these events are handled by the state machine */
    BTA_JV_API_ENABLE_EVT = BTA_SYS_EVT_START(BTA_ID_JV),
--- a/components/bt/bluedroid/btc/core/btc_ble_storage.c
+++ b/components/bt/bluedroid/btc/core/btc_ble_storage.c
@@ -29,6 +29,8 @@
 static void _btc_storage_save(void)
 {
    uint16_t addr_section_count = 0;
+    bt_bdaddr_t bd_addr;
+    uint32_t device_type = 0;
    const btc_config_section_iter_t *need_remove_iter = NULL;
    const btc_config_section_iter_t *iter = btc_config_section_begin();

@@ -36,12 +38,9 @@ static void _btc_storage_save(void)
        //store the next iter, if remove section, then will not loss the point

        const char *section = btc_config_section_name(iter);
-        if (!string_is_bdaddr(section)) {
-            iter = btc_config_section_next(iter);
-            continue;
-        }

-        if (!btc_config_exist(section, BTC_BLE_STORAGE_DEV_TYPE_STR) && 
+        if (string_is_bdaddr(section) &&
+                !btc_config_exist(section, BTC_BLE_STORAGE_DEV_TYPE_STR) &&
                !btc_config_exist(section, BTC_BLE_STORAGE_ADDR_TYPE_STR) &&
                !btc_config_exist(section, BTC_BLE_STORAGE_LINK_KEY_STR) &&
                !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_PENC_STR) &&
@@ -53,6 +52,14 @@ static void _btc_storage_save(void)
            btc_config_remove_section(section);
            continue;
        }
+
+        if (!string_is_bdaddr(section) ||
+            !btc_config_get_int(section, BTC_BLE_STORAGE_DEV_TYPE_STR, (int *)&device_type) ||
+            ((device_type & BT_DEVICE_TYPE_BLE) != BT_DEVICE_TYPE_BLE)) {
+            iter = btc_config_section_next(iter);
+            continue;
+        }
+
        if(addr_section_count == BONED_DEVICES_MAX_COUNT) {
            need_remove_iter = iter;
        }
@@ -63,13 +70,20 @@ static void _btc_storage_save(void)
    if (need_remove_iter) {
        while(need_remove_iter != btc_config_section_end()) {
            const char *need_remove_section = btc_config_section_name(need_remove_iter);
-            if (!string_is_bdaddr(need_remove_section)) {
+            if (!string_is_bdaddr(need_remove_section) ||
+                !btc_config_get_int(need_remove_section, BTC_BLE_STORAGE_DEV_TYPE_STR, (int *)&device_type) ||
+                ((device_type & BT_DEVICE_TYPE_BLE) != BT_DEVICE_TYPE_BLE)) {
                need_remove_iter = btc_config_section_next(need_remove_iter);
                continue;
            }
            need_remove_iter = btc_config_section_next(need_remove_iter);
-            BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
-            btc_config_remove_section(need_remove_section);
+            //delete device info
+            string_to_bdaddr(need_remove_section, &bd_addr);
+            BTM_SecDeleteDevice(bd_addr.address, BT_TRANSPORT_LE);
+            //delet config info
+            if(btc_config_remove_section(need_remove_section)) {
+                BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
+            }
        }
    }
    btc_config_flush();
@@ -228,6 +242,9 @@ static bt_status_t _btc_storage_remove_ble_bonding_keys(bt_bdaddr_t *remote_bd_a
    if (btc_config_exist(bdstr, BTC_BLE_STORAGE_LE_KEY_LCSRK_STR)) {
        ret |= btc_config_remove(bdstr, BTC_BLE_STORAGE_LE_KEY_LCSRK_STR);
    }
+    if (btc_config_exist(bdstr, BTC_BLE_STORAGE_LE_KEY_LID_STR)) {
+        ret |= btc_config_remove(bdstr, BTC_BLE_STORAGE_LE_KEY_LID_STR);
+    }
    //here don't remove section, because config_save will check it
    _btc_storage_save();
    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
@@ -536,6 +553,91 @@ bt_status_t btc_storage_remove_ble_dev_type(bt_bdaddr_t *remote_bd_addr, bool fl
    return ret;
 }

+static bt_status_t _btc_storage_set_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, uint8_t auth_mode, bool flush)
+{
+    int ret;
+    bdstr_t bdstr;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr_t));
+    ret = btc_config_set_int(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR, (int)auth_mode);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    if (flush) {
+        _btc_storage_save();
+    }
+
+    return BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_set_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, uint8_t auth_mode, bool flush)
+{
+    bt_status_t ret;
+
+    btc_config_lock();
+    ret = _btc_storage_set_ble_dev_auth_mode(remote_bd_addr, auth_mode, flush);
+    btc_config_unlock();
+
+    return ret;
+}
+
+static bt_status_t _btc_storage_get_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, int* auth_mode)
+{
+    bdstr_t bdstr;
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    int ret = btc_config_get_int(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR, auth_mode);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+bt_status_t btc_storage_get_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, int* auth_mode)
+{
+    bt_status_t ret;
+
+    btc_config_lock();
+    ret = _btc_storage_get_ble_dev_auth_mode(remote_bd_addr, auth_mode);
+    btc_config_unlock();
+
+    return ret;
+}
+
+static bt_status_t _btc_storage_remove_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, bool flush)
+{
+    bool ret = true;
+    bdstr_t bdstr;
+    uint32_t auth_mode = 0;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+
+    ret = btc_config_get_int(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR, (int *)&auth_mode);
+    if (ret == false) {
+        //cannot find the key, just return SUCCESS, indicate already removed
+        return BT_STATUS_SUCCESS;
+    }
+
+    ret = btc_config_remove(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    if (flush) {
+        _btc_storage_save();
+    }
+
+    return  BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_remove_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, bool flush)
+{
+    bt_status_t ret;
+
+    btc_config_lock();
+    ret = _btc_storage_remove_ble_dev_auth_mode(remote_bd_addr, flush);
+    btc_config_unlock();
+
+    return ret;
+}
+
 static bt_status_t _btc_storage_set_remote_addr_type(bt_bdaddr_t *remote_bd_addr, uint8_t addr_type, bool flush)
 {
    int ret;
@@ -640,7 +742,11 @@ static void _btc_read_le_key(const uint8_t key_type, const size_t key_len, bt_bd
            bdcpy(bta_bd_addr, bd_addr.address);

            if (!*device_added) {
-                BTA_DmAddBleDevice(bta_bd_addr, addr_type, BT_DEVICE_TYPE_BLE);
+                int auth_mode = 0;
+                if(_btc_storage_get_ble_dev_auth_mode(&bd_addr, &auth_mode) != BT_STATUS_SUCCESS) {
+                    BTC_TRACE_WARNING("%s Failed to get auth mode from flash, please erase flash and download the firmware again", __func__);
+                }
+                BTA_DmAddBleDevice(bta_bd_addr, addr_type, auth_mode, BT_DEVICE_TYPE_BLE);
                *device_added = true;
            }

@@ -750,7 +856,6 @@ bt_status_t btc_storage_load_bonded_ble_devices(void)
 bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev, int dev_num)
 {
    bt_bdaddr_t bd_addr;
-    uint32_t device_type = 0;
    char buffer[sizeof(tBTM_LE_KEY_VALUE)] = {0};

    btc_config_lock();
@@ -760,12 +865,13 @@ bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev
        if (dev_num-- <= 0) {
            break;
        }
-
+        uint32_t device_type = 0;
        const char *name = btc_config_section_name(iter);

        if (!string_is_bdaddr(name) ||
                !btc_config_get_int(name, BTC_BLE_STORAGE_DEV_TYPE_STR, (int *)&device_type) ||
                !(device_type & BT_DEVICE_TYPE_BLE)) {
+            dev_num ++;
            continue;
        }

--- a/components/bt/bluedroid/btc/core/btc_dm.c
+++ b/components/bt/bluedroid/btc/core/btc_dm.c
@@ -54,7 +54,7 @@ static btc_dm_local_key_cb_t ble_local_key_cb;
 **  Externs
 ******************************************************************************/
 #if BTC_AV_INCLUDED
-extern bt_status_t btc_av_execute_service(BOOLEAN b_enable);
+extern bt_status_t btc_av_source_execute_service(BOOLEAN b_enable);
 extern bt_status_t btc_av_sink_execute_service(BOOLEAN b_enable);
 #endif
 #if BTC_HF_CLIENT_INCLUDED
@@ -176,13 +176,14 @@ static void btc_dm_remove_ble_bonding_keys(void)
    bdcpy(bd_addr.address, pairing_cb.bd_addr);

    btc_storage_remove_remote_addr_type(&bd_addr, false);
+    btc_storage_remove_ble_dev_auth_mode(&bd_addr, false);
    btc_storage_remove_ble_dev_type(&bd_addr, false);
    btc_storage_remove_ble_bonding_keys(&bd_addr);
 }

 static void btc_dm_save_ble_bonding_keys(void)
 {
-    if(!(pairing_cb.ble.is_penc_key_rcvd || pairing_cb.ble.is_pid_key_rcvd || pairing_cb.ble.is_pcsrk_key_rcvd || 
+    if (!(pairing_cb.ble.is_penc_key_rcvd || pairing_cb.ble.is_pid_key_rcvd || pairing_cb.ble.is_pcsrk_key_rcvd ||
         pairing_cb.ble.is_lenc_key_rcvd || pairing_cb.ble.is_lcsrk_key_rcvd || pairing_cb.ble.is_lidk_key_rcvd)) {
        return ;
    }
@@ -197,6 +198,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.penc_key,
                                        BTM_LE_KEY_PENC,
                                        sizeof(tBTM_LE_PENC_KEYS));
+        pairing_cb.ble.is_penc_key_rcvd = false;
    }

    if (pairing_cb.ble.is_pid_key_rcvd) {
@@ -204,6 +206,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.pid_key,
                                        BTM_LE_KEY_PID,
                                        sizeof(tBTM_LE_PID_KEYS));
+        pairing_cb.ble.is_pid_key_rcvd = false;
    }


@@ -212,6 +215,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.pcsrk_key,
                                        BTM_LE_KEY_PCSRK,
                                        sizeof(tBTM_LE_PCSRK_KEYS));
+        pairing_cb.ble.is_pcsrk_key_rcvd = false;
    }


@@ -220,6 +224,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.lenc_key,
                                        BTM_LE_KEY_LENC,
                                        sizeof(tBTM_LE_LENC_KEYS));
+        pairing_cb.ble.is_lenc_key_rcvd = false;
    }

    if (pairing_cb.ble.is_lcsrk_key_rcvd) {
@@ -227,6 +232,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        (char *) &pairing_cb.ble.lcsrk_key,
                                        BTM_LE_KEY_LCSRK,
                                        sizeof(tBTM_LE_LCSRK_KEYS));
+        pairing_cb.ble.is_lcsrk_key_rcvd = false;
    }

    if (pairing_cb.ble.is_lidk_key_rcvd) {
@@ -234,6 +240,7 @@ static void btc_dm_save_ble_bonding_keys(void)
                                        NULL,
                                        BTM_LE_KEY_LID,
                                        0);
+        pairing_cb.ble.is_lidk_key_rcvd = false;
    }
 }

@@ -255,9 +262,14 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
        BTC_TRACE_DEBUG ("%s, -  pairing_cb.bd_addr: %08x%04x", __func__,
                             (pairing_cb.bd_addr[0] << 24) + (pairing_cb.bd_addr[1] << 16) + (pairing_cb.bd_addr[2] << 8) + pairing_cb.bd_addr[3],
                             (pairing_cb.bd_addr[4] << 8) + pairing_cb.bd_addr[5]);
+        // Check if need to save BLE keys
+        if((p_auth_cmpl->auth_mode & SMP_AUTH_GEN_BOND) == 0) {
+            return;
+        }
         if (btc_storage_get_remote_addr_type(&bdaddr, &addr_type) != BT_STATUS_SUCCESS) {
            btc_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type, true);
        }
+        btc_storage_set_ble_dev_auth_mode(&bdaddr, p_auth_cmpl->auth_mode, true);
        btc_dm_save_ble_bonding_keys();
    } else {
        /*Map the HCI fail reason  to  bt status  */
@@ -379,6 +391,27 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
    (void) status;
 }

+static void btc_dm_pin_req_evt(tBTA_DM_PIN_REQ *p_pin_req)
+{
+#if (BTC_GAP_BT_INCLUDED == TRUE)
+    esp_bt_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_PIN_REQ_EVT;
+    param.pin_req.min_16_digit = p_pin_req->min_16_digit;
+    memcpy(param.pin_req.bda, p_pin_req->bd_addr, ESP_BD_ADDR_LEN);
+
+    ret = btc_transfer_context(&msg, &param,
+                               sizeof(esp_bt_gap_cb_param_t), NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+#endif /// BTC_GAP_BT_INCLUDED == TRUE
+}
+
 tBTA_SERVICE_MASK btc_get_enabled_services_mask(void)
 {
    return btc_enabled_services;
@@ -397,7 +430,7 @@ static bt_status_t btc_in_execute_service_request(tBTA_SERVICE_ID service_id,
    switch (service_id) {
 #if BTC_AV_INCLUDED
    case BTA_A2DP_SOURCE_SERVICE_ID:
-        btc_av_execute_service(b_enable);
+        btc_av_source_execute_service(b_enable);
        break;
    case BTA_A2DP_SINK_SERVICE_ID:
        btc_av_sink_execute_service(b_enable);
@@ -488,6 +521,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
        break;
    }
    case BTA_DM_PIN_REQ_EVT:
+        BTC_TRACE_DEBUG("BTA_DM_PIN_REQ_EVT");
+        btc_dm_pin_req_evt(&p_data->pin_req);
        break;
    case BTA_DM_AUTH_CMPL_EVT:
        btc_dm_auth_cmpl_evt(&p_data->auth_cmpl);
@@ -522,6 +557,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
            //remove the bonded key in the config and nvs flash.
            btc_storage_remove_ble_dev_type(&bd_addr, false);
            btc_storage_remove_remote_addr_type(&bd_addr, false);
+            btc_storage_remove_ble_dev_auth_mode(&bd_addr, false);
            param.remove_bond_dev_cmpl.status = btc_storage_remove_ble_bonding_keys(&bd_addr);
        }
        ble_msg.act = ESP_GAP_BLE_REMOVE_BOND_DEV_COMPLETE_EVT;
@@ -555,6 +591,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
        param.ble_security.auth_cmpl.key_present = p_data->auth_cmpl.key_present;
        memcpy(param.ble_security.auth_cmpl.bd_addr, p_data->auth_cmpl.bd_addr, sizeof(BD_ADDR));
        memcpy(param.ble_security.auth_cmpl.key, p_data->auth_cmpl.key, sizeof(LINK_KEY));
+        param.ble_security.auth_cmpl.auth_mode = p_data->auth_cmpl.auth_mode;
        btc_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
        break;
    }
--- a/components/bt/bluedroid/btc/core/btc_main.c
+++ b/components/bt/bluedroid/btc/core/btc_main.c
@@ -64,7 +64,7 @@ static void btc_init_bluetooth(void)
    bte_main_boot_entry(btc_init_callback);
 #if (SMP_INCLUDED)
    btc_config_init();
-    //load the ble local key whitch has been store in the flash
+    //load the ble local key which has been stored in the flash
    btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
 }
--- a/components/bt/bluedroid/btc/include/btc/btc_ble_storage.h
+++ b/components/bt/bluedroid/btc/include/btc/btc_ble_storage.h
@@ -32,6 +32,7 @@
 #define BTC_BLE_STORAGE_LE_KEY_LENC_STR             "LE_KEY_LENC"
 #define BTC_BLE_STORAGE_LE_KEY_LID_STR              "LE_KEY_LID"
 #define BTC_BLE_STORAGE_LE_KEY_LCSRK_STR            "LE_KEY_LCSRK"
+#define BTC_BLE_STORAGE_LE_AUTH_MODE_STR            "AuthMode"

 #define BTC_BLE_STORAGE_LOCAL_ADAPTER_STR           "Adapter"
 #define BTC_BLE_STORAGE_LE_LOCAL_KEY_IR_STR         "LE_LOCAL_KEY_IR"
@@ -66,6 +67,12 @@ bt_status_t btc_storage_remove_ble_local_keys(void);

 bt_status_t btc_storage_get_ble_local_key(uint8_t key_type, char *key_value, int key_len);

+bt_status_t btc_storage_set_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, uint8_t auth_mode, bool flush);
+
+bt_status_t btc_storage_get_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, int* auth_mode);
+
+bt_status_t btc_storage_remove_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, bool flush);
+
 bt_status_t btc_storage_get_remote_addr_type(bt_bdaddr_t *remote_bd_addr, int *addr_type);

 bt_status_t btc_storage_set_remote_addr_type(bt_bdaddr_t *remote_bd_addr, uint8_t addr_type, bool flush);
--- a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
@@ -206,7 +206,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        break;
    case BTA_GATTS_MTU_EVT:
        BLUFI_TRACE_DEBUG("MTU size %d\n", p_data->req_data.p_data->mtu);
-        blufi_env.frag_size = p_data->req_data.p_data->mtu - BLUFI_MTU_RESERVED_SIZE;
+        blufi_env.frag_size = (p_data->req_data.p_data->mtu < BLUFI_MAX_DATA_LEN ? p_data->req_data.p_data->mtu : BLUFI_MAX_DATA_LEN) - BLUFI_MTU_RESERVED_SIZE;
        break;
    case BTA_GATTS_CONF_EVT:
        BLUFI_TRACE_DEBUG("CONFIRM EVT\n");
--- a/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
@@ -72,6 +72,7 @@ typedef struct blufi_frag_hdr blufi_frag_hdr_t;
 #define BLUFI_DATA_SEC_MODE_ENC_MASK    0x02  
 #define BLUFI_CTRL_SEC_MODE_CHECK_MASK  0x10  
 #define BLUFI_CTRL_SEC_MODE_ENC_MASK    0x20
+#define BLUFI_MAX_DATA_LEN              255

 // packet type
 #define BLUFI_TYPE_MASK         0x03
--- a/components/bt/bluedroid/btc/profile/std/a2dp/bta_av_co.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/bta_av_co.c
@@ -267,11 +267,11 @@ static tBTA_AV_CO_PEER *bta_av_co_get_peer(tBTA_AV_HNDL hndl)
 **
 *******************************************************************************/
 BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info, UINT8 *p_num_protect,
-                             UINT8 *p_protect_info, UINT8 index)
+                             UINT8 *p_protect_info, UINT8 tsep)
 {
    FUNC_TRACE();

-    APPL_TRACE_DEBUG("bta_av_co_audio_init: %d", index);
+    APPL_TRACE_DEBUG("bta_av_co_audio_init: %d", tsep);

    /* By default - no content protection info */
    *p_num_protect = 0;
@@ -280,29 +280,24 @@ BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info, UINT8 *p_
    /* reset remote preference through setconfig */
    bta_av_co_cb.codec_cfg_setconfig.id = BTC_AV_CODEC_NONE;

-    switch (index) {
-    case BTC_SV_AV_AA_SBC_INDEX:
+    if (tsep == AVDT_TSEP_SRC) {
 #if defined(BTA_AV_CO_CP_SCMS_T) && (BTA_AV_CO_CP_SCMS_T == TRUE)
-    {
-        UINT8 *p = p_protect_info;
+        do {
+            UINT8 *p = p_protect_info;

-        /* Content protection info - support SCMS-T */
-        *p_num_protect = 1;
-        *p++ = BTA_AV_CP_LOSC;
-        UINT16_TO_STREAM(p, BTA_AV_CP_SCMS_T_ID);
-
-    }
+            /* Content protection info - support SCMS-T */
+            *p_num_protect = 1;
+            *p++ = BTA_AV_CP_LOSC;
+            UINT16_TO_STREAM(p, BTA_AV_CP_SCMS_T_ID);
+        } while (0);
 #endif
        /* Set up for SBC codec  for SRC*/
-    *p_codec_type = BTA_AV_CODEC_SBC;
+        *p_codec_type = BTA_AV_CODEC_SBC;

        /* This should not fail because we are using constants for parameters */
-    A2D_BldSbcInfo(AVDT_MEDIA_AUDIO, (tA2D_SBC_CIE *) &bta_av_co_sbc_caps, p_codec_info);
-
-        /* Codec is valid */
-    return TRUE;
-#if (BTA_AV_SINK_INCLUDED == TRUE)
-    case BTC_SV_AV_AA_SBC_SINK_INDEX:
+        A2D_BldSbcInfo(AVDT_MEDIA_AUDIO, (tA2D_SBC_CIE *) &bta_av_co_sbc_caps, p_codec_info);
+        return TRUE;
+    } else if (tsep == AVDT_TSEP_SNK) {
        *p_codec_type = BTA_AV_CODEC_SBC;

        /* This should not fail because we are using constants for parameters */
@@ -310,9 +305,8 @@ BOOLEAN bta_av_co_audio_init(UINT8 *p_codec_type, UINT8 *p_codec_info, UINT8 *p_

        /* Codec is valid */
        return TRUE;
-#endif
-    default:
-        /* Not valid */
+    } else {
+        APPL_TRACE_WARNING("invalid SEP type %d", tsep);
        return FALSE;
    }
 }
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c
@@ -143,9 +143,21 @@ static inline void btc_a2d_data_cb_to_app(const uint8_t *data, uint32_t len)
    }
 }

-OI_CODEC_SBC_DECODER_CONTEXT context;
-OI_UINT32 contextData[CODEC_DATA_WORDS(2, SBC_CODEC_FAST_FILTER_BUFFERS)];
-OI_INT16 pcmData[15 * SBC_MAX_SAMPLES_PER_FRAME * SBC_MAX_CHANNELS];
+#define BTC_SBC_DEC_CONTEXT_DATA_LEN (CODEC_DATA_WORDS(2, SBC_CODEC_FAST_FILTER_BUFFERS))
+#define BTC_SBC_DEC_PCM_DATA_LEN (15 * SBC_MAX_SAMPLES_PER_FRAME * SBC_MAX_CHANNELS)
+
+#if BTC_SBC_DEC_DYNAMIC_MEMORY == FALSE
+static OI_CODEC_SBC_DECODER_CONTEXT btc_sbc_decoder_context;
+static OI_UINT32 btc_sbc_decoder_context_data[BTC_SBC_DEC_CONTEXT_DATA_LEN];
+static OI_INT16 btc_sbc_pcm_data[BTC_SBC_DEC_PCM_DATA_LEN];
+#else
+static OI_CODEC_SBC_DECODER_CONTEXT *btc_sbc_decoder_context_ptr;
+static OI_UINT32 *btc_sbc_decoder_context_data;
+static OI_INT16 *btc_sbc_pcm_data;
+#define btc_sbc_decoder_context (*btc_sbc_decoder_context_ptr)
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == FALSE */
+
+

 /*****************************************************************************
 **  Misc helper functions
@@ -235,6 +247,16 @@ bool btc_a2dp_sink_startup(void)

    APPL_TRACE_EVENT("## A2DP SINK START MEDIA THREAD ##");

+#if (BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE)
+    btc_sbc_decoder_context_ptr = osi_calloc(sizeof(OI_CODEC_SBC_DECODER_CONTEXT));
+    btc_sbc_decoder_context_data = osi_calloc(BTC_SBC_DEC_CONTEXT_DATA_LEN * sizeof(OI_UINT32));
+    btc_sbc_pcm_data = osi_calloc(BTC_SBC_DEC_PCM_DATA_LEN * sizeof(OI_INT16));
+    if (!btc_sbc_decoder_context_ptr || !btc_sbc_decoder_context_data || !btc_sbc_pcm_data) {
+        APPL_TRACE_ERROR("failed to allocate SBC decoder");
+        goto error_exit;
+    }
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE */
+
    btc_aa_snk_queue_set = xQueueCreateSet(BTC_A2DP_SINK_TASK_QUEUE_SET_LEN);
    configASSERT(btc_aa_snk_queue_set);
    btc_aa_snk_data_queue = xQueueCreate(BTC_A2DP_SINK_DATA_QUEUE_LEN, sizeof(int32_t));
@@ -280,6 +302,21 @@ error_exit:;
        vQueueDelete(btc_aa_snk_queue_set);
        btc_aa_snk_queue_set = NULL;
    }
+#if (BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE)
+    if (btc_sbc_decoder_context_ptr) {
+        osi_free(btc_sbc_decoder_context_ptr);
+        btc_sbc_decoder_context_ptr = NULL;
+    }
+    if (btc_sbc_decoder_context_data) {
+        osi_free(btc_sbc_decoder_context_data);
+        btc_sbc_decoder_context_data = NULL;
+    }
+    if (btc_sbc_pcm_data) {
+        osi_free(btc_sbc_pcm_data);
+        btc_sbc_pcm_data = NULL;
+    }
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE */
+
    return false;
 }

@@ -306,6 +343,17 @@ void btc_a2dp_sink_shutdown(void)

    vQueueDelete(btc_aa_snk_queue_set);
    btc_aa_snk_queue_set = NULL;
+
+#if (BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE)
+    osi_free(btc_sbc_decoder_context_ptr);
+    btc_sbc_decoder_context_ptr = NULL;
+
+    osi_free(btc_sbc_decoder_context_data);
+    btc_sbc_decoder_context_data = NULL;
+
+    osi_free(btc_sbc_pcm_data);
+    btc_sbc_pcm_data = NULL;
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE */
 }

 /*****************************************************************************
@@ -467,7 +515,8 @@ static void btc_a2dp_sink_handle_decoder_reset(tBTC_MEDIA_SINK_CFG_UPDATE *p_msg

    btc_aa_snk_cb.rx_flush = FALSE;
    APPL_TRACE_EVENT("Reset to sink role");
-    status = OI_CODEC_SBC_DecoderReset(&context, contextData, sizeof(contextData), 2, 2, FALSE);
+    status = OI_CODEC_SBC_DecoderReset(&btc_sbc_decoder_context, btc_sbc_decoder_context_data,
+                                       BTC_SBC_DEC_CONTEXT_DATA_LEN * sizeof(OI_UINT32), 2, 2, FALSE);
    if (!OI_SUCCESS(status)) {
        APPL_TRACE_ERROR("OI_CODEC_SBC_DecoderReset failed with error code %d\n", status);
    }
@@ -582,11 +631,11 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
    UINT8 *sbc_start_frame = ((UINT8 *)(p_msg + 1) + p_msg->offset + 1);
    int count;
    UINT32 pcmBytes, availPcmBytes;
-    OI_INT16 *pcmDataPointer = pcmData; /*Will be overwritten on next packet receipt*/
+    OI_INT16 *pcmDataPointer = btc_sbc_pcm_data; /*Will be overwritten on next packet receipt*/
    OI_STATUS status;
    int num_sbc_frames = p_msg->num_frames_to_be_processed;
    UINT32 sbc_frame_len = p_msg->len - 1;
-    availPcmBytes = sizeof(pcmData);
+    availPcmBytes = BTC_SBC_DEC_PCM_DATA_LEN * sizeof(OI_INT16);

    /* XXX: Check if the below check is correct, we are checking for peer to be sink when we are sink */
    if (btc_av_get_peer_sep() == AVDT_TSEP_SNK || (btc_aa_snk_cb.rx_flush)) {
@@ -603,7 +652,7 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)

    for (count = 0; count < num_sbc_frames && sbc_frame_len != 0; count ++) {
        pcmBytes = availPcmBytes;
-        status = OI_CODEC_SBC_DecodeFrame(&context, (const OI_BYTE **)&sbc_start_frame,
+        status = OI_CODEC_SBC_DecodeFrame(&btc_sbc_decoder_context, (const OI_BYTE **)&sbc_start_frame,
                                          (OI_UINT32 *)&sbc_frame_len,
                                          (OI_INT16 *)pcmDataPointer,
                                          (OI_UINT32 *)&pcmBytes);
@@ -617,7 +666,7 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
        p_msg->len = sbc_frame_len + 1;
    }

-    btc_a2d_data_cb_to_app((uint8_t *)pcmData, (sizeof(pcmData) - availPcmBytes));
+    btc_a2d_data_cb_to_app((uint8_t *)btc_sbc_pcm_data, (BTC_SBC_DEC_PCM_DATA_LEN * sizeof(OI_INT16) - availPcmBytes));
 }

 /*******************************************************************************
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c
@@ -156,7 +156,6 @@ typedef struct {
    tBTC_AV_FEEDING_MODE feeding_mode;
    tBTC_AV_MEDIA_FEEDINGS_STATE media_feeding_state;
    tBTC_AV_MEDIA_FEEDINGS media_feeding;
-    SBC_ENC_PARAMS encoder;
    osi_alarm_t *media_alarm;
 } tBTC_A2DP_SOURCE_CB;

@@ -187,6 +186,13 @@ static QueueSetHandle_t btc_aa_src_queue_set;
 static esp_a2d_source_data_cb_t btc_aa_src_data_cb = NULL;
 static UINT64 last_frame_us = 0;

+#if BTC_SBC_ENC_DYNAMIC_MEMORY == FALSE
+static SBC_ENC_PARAMS btc_sbc_encoder;
+#else
+static SBC_ENC_PARAMS *btc_sbc_encoder_ptr;
+#define btc_sbc_encoder (*btc_sbc_encoder_ptr)
+#endif /* BTC_SBC_ENC_DYNAMIC_MEMORY == FALSE */
+
 void btc_a2dp_src_reg_data_cb(esp_a2d_source_data_cb_t callback)
 {
    // todo: critical section protection
@@ -310,6 +316,14 @@ bool btc_a2dp_source_startup(void)

    APPL_TRACE_EVENT("## A2DP SOURCE START MEDIA THREAD ##");

+#if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE
+    btc_sbc_encoder_ptr = osi_calloc(sizeof(SBC_ENC_PARAMS));
+    if (!btc_sbc_encoder_ptr) {
+        APPL_TRACE_ERROR("failed to allocate SBC encoder");
+        goto error_exit;
+    }
+#endif /* #if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE */
+
    btc_aa_src_queue_set = xQueueCreateSet(BTC_A2DP_SOURCE_TASK_QUEUE_SET_LEN);
    configASSERT(btc_aa_src_queue_set);
    btc_aa_src_data_queue = xQueueCreate(BTC_A2DP_SOURCE_DATA_QUEUE_LEN, sizeof(void *));
@@ -355,6 +369,12 @@ error_exit:;
        vQueueDelete(btc_aa_src_queue_set);
        btc_aa_src_queue_set = NULL;
    }
+#if (BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE)
+    if (btc_sbc_encoder_ptr) {
+        osi_free(btc_sbc_encoder_ptr);
+        btc_sbc_encoder_ptr = NULL;
+    }
+#endif /* #if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE */
    return false;
 }

@@ -381,6 +401,11 @@ void btc_a2dp_source_shutdown(void)

    vQueueDelete(btc_aa_src_queue_set);
    btc_aa_src_queue_set = NULL;
+
+#if (BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE)
+    osi_free(btc_sbc_encoder_ptr);
+    btc_sbc_encoder_ptr = NULL;
+#endif /* #if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE */
 }

 /*****************************************************************************
@@ -794,13 +819,14 @@ static void btc_a2dp_source_enc_init(BT_HDR *p_msg)
    btc_aa_src_cb.timestamp = 0;

    /* SBC encoder config (enforced even if not used) */
-    btc_aa_src_cb.encoder.s16ChannelMode = pInitAudio->ChannelMode;
-    btc_aa_src_cb.encoder.s16NumOfSubBands = pInitAudio->NumOfSubBands;
-    btc_aa_src_cb.encoder.s16NumOfBlocks = pInitAudio->NumOfBlocks;
-    btc_aa_src_cb.encoder.s16AllocationMethod = pInitAudio->AllocationMethod;
-    btc_aa_src_cb.encoder.s16SamplingFreq = pInitAudio->SamplingFreq;

-    btc_aa_src_cb.encoder.u16BitRate = btc_a2dp_source_get_sbc_rate();
+    btc_sbc_encoder.s16ChannelMode = pInitAudio->ChannelMode;
+    btc_sbc_encoder.s16NumOfSubBands = pInitAudio->NumOfSubBands;
+    btc_sbc_encoder.s16NumOfBlocks = pInitAudio->NumOfBlocks;
+    btc_sbc_encoder.s16AllocationMethod = pInitAudio->AllocationMethod;
+    btc_sbc_encoder.s16SamplingFreq = pInitAudio->SamplingFreq;
+
+    btc_sbc_encoder.u16BitRate = btc_a2dp_source_get_sbc_rate();

    /* Default transcoding is PCM to SBC, modified by feeding configuration */
    btc_aa_src_cb.TxTranscoding = BTC_MEDIA_TRSCD_PCM_2_SBC;
@@ -811,14 +837,14 @@ static void btc_a2dp_source_enc_init(BT_HDR *p_msg)
    APPL_TRACE_EVENT("btc_a2dp_source_enc_init mtu %d, peer mtu %d",
                     btc_aa_src_cb.TxAaMtuSize, pInitAudio->MtuSize);
    APPL_TRACE_EVENT("      ch mode %d, subnd %d, nb blk %d, alloc %d, rate %d, freq %d",
-                     btc_aa_src_cb.encoder.s16ChannelMode, btc_aa_src_cb.encoder.s16NumOfSubBands,
-                     btc_aa_src_cb.encoder.s16NumOfBlocks,
-                     btc_aa_src_cb.encoder.s16AllocationMethod, btc_aa_src_cb.encoder.u16BitRate,
-                     btc_aa_src_cb.encoder.s16SamplingFreq);
+                     btc_sbc_encoder.s16ChannelMode, btc_sbc_encoder.s16NumOfSubBands,
+                     btc_sbc_encoder.s16NumOfBlocks,
+                     btc_sbc_encoder.s16AllocationMethod, btc_sbc_encoder.u16BitRate,
+                     btc_sbc_encoder.s16SamplingFreq);

    /* Reset entirely the SBC encoder */
-    SBC_Encoder_Init(&(btc_aa_src_cb.encoder));
-    APPL_TRACE_DEBUG("btc_a2dp_source_enc_init bit pool %d", btc_aa_src_cb.encoder.s16BitPool);
+    SBC_Encoder_Init(&(btc_sbc_encoder));
+    APPL_TRACE_DEBUG("btc_a2dp_source_enc_init bit pool %d", btc_sbc_encoder.s16BitPool);
 }


@@ -835,7 +861,7 @@ static void btc_a2dp_source_enc_init(BT_HDR *p_msg)
 static void btc_a2dp_source_enc_update(BT_HDR *p_msg)
 {
    tBTC_MEDIA_UPDATE_AUDIO *pUpdateAudio = (tBTC_MEDIA_UPDATE_AUDIO *) p_msg;
-    SBC_ENC_PARAMS *pstrEncParams = &btc_aa_src_cb.encoder;
+    SBC_ENC_PARAMS *pstrEncParams = &btc_sbc_encoder;
    UINT16 s16SamplingFreq;
    SINT16 s16BitPool = 0;
    SINT16 s16BitRate;
@@ -928,19 +954,19 @@ static void btc_a2dp_source_enc_update(BT_HDR *p_msg)
            if (s16BitPool > pUpdateAudio->MaxBitPool) {
                APPL_TRACE_DEBUG("%s computed bitpool too large (%d)",  __FUNCTION__, s16BitPool);
                /* Decrease bitrate */
-                btc_aa_src_cb.encoder.u16BitRate -= BTC_MEDIA_BITRATE_STEP;
+                btc_sbc_encoder.u16BitRate -= BTC_MEDIA_BITRATE_STEP;
                /* Record that we have decreased the bitrate */
                protect |= 1;
            } else if (s16BitPool < pUpdateAudio->MinBitPool) {
                APPL_TRACE_WARNING("%s computed bitpool too small (%d)", __FUNCTION__, s16BitPool);

                /* Increase bitrate */
-                UINT16 previous_u16BitRate = btc_aa_src_cb.encoder.u16BitRate;
-                btc_aa_src_cb.encoder.u16BitRate += BTC_MEDIA_BITRATE_STEP;
+                UINT16 previous_u16BitRate = btc_sbc_encoder.u16BitRate;
+                btc_sbc_encoder.u16BitRate += BTC_MEDIA_BITRATE_STEP;
                /* Record that we have increased the bitrate */
                protect |= 2;
                /* Check over-flow */
-                if (btc_aa_src_cb.encoder.u16BitRate < previous_u16BitRate) {
+                if (btc_sbc_encoder.u16BitRate < previous_u16BitRate) {
                    protect |= 3;
                }
            } else {
@@ -957,10 +983,10 @@ static void btc_a2dp_source_enc_update(BT_HDR *p_msg)
        pstrEncParams->s16BitPool = s16BitPool;

        APPL_TRACE_DEBUG("%s final bit rate %d, final bit pool %d", __FUNCTION__,
-                         btc_aa_src_cb.encoder.u16BitRate, btc_aa_src_cb.encoder.s16BitPool);
+                         btc_sbc_encoder.u16BitRate, btc_sbc_encoder.s16BitPool);

        /* make sure we reinitialize encoder with new settings */
-        SBC_Encoder_Init(&(btc_aa_src_cb.encoder));
+        SBC_Encoder_Init(&(btc_sbc_encoder));
    }
 }

@@ -991,10 +1017,10 @@ static void btc_a2dp_source_pcm2sbc_init(tBTC_MEDIA_INIT_AUDIO_FEEDING *p_feedin
    case 32000:
    case 48000:
        /* For these sampling_freq the AV connection must be 48000 */
-        if (btc_aa_src_cb.encoder.s16SamplingFreq != SBC_sf48000) {
+        if (btc_sbc_encoder.s16SamplingFreq != SBC_sf48000) {
            /* Reconfiguration needed at 48000 */
            APPL_TRACE_DEBUG("SBC Reconfiguration needed at 48000");
-            btc_aa_src_cb.encoder.s16SamplingFreq = SBC_sf48000;
+            btc_sbc_encoder.s16SamplingFreq = SBC_sf48000;
            reconfig_needed = TRUE;
        }
        break;
@@ -1003,10 +1029,10 @@ static void btc_a2dp_source_pcm2sbc_init(tBTC_MEDIA_INIT_AUDIO_FEEDING *p_feedin
    case 22050:
    case 44100:
        /* For these sampling_freq the AV connection must be 44100 */
-        if (btc_aa_src_cb.encoder.s16SamplingFreq != SBC_sf44100) {
+        if (btc_sbc_encoder.s16SamplingFreq != SBC_sf44100) {
            /* Reconfiguration needed at 44100 */
            APPL_TRACE_DEBUG("SBC Reconfiguration needed at 44100");
-            btc_aa_src_cb.encoder.s16SamplingFreq = SBC_sf44100;
+            btc_sbc_encoder.s16SamplingFreq = SBC_sf44100;
            reconfig_needed = TRUE;
        }
        break;
@@ -1016,21 +1042,21 @@ static void btc_a2dp_source_pcm2sbc_init(tBTC_MEDIA_INIT_AUDIO_FEEDING *p_feedin
    }

    /* Some AV Headsets do not support Mono => always ask for Stereo */
-    if (btc_aa_src_cb.encoder.s16ChannelMode == SBC_MONO) {
+    if (btc_sbc_encoder.s16ChannelMode == SBC_MONO) {
        APPL_TRACE_DEBUG("SBC Reconfiguration needed in Stereo");
-        btc_aa_src_cb.encoder.s16ChannelMode = SBC_JOINT_STEREO;
+        btc_sbc_encoder.s16ChannelMode = SBC_JOINT_STEREO;
        reconfig_needed = TRUE;
    }

    if (reconfig_needed != FALSE) {
        APPL_TRACE_DEBUG("%s :: mtu %d", __FUNCTION__, btc_aa_src_cb.TxAaMtuSize);
        APPL_TRACE_DEBUG("ch mode %d, nbsubd %d, nb %d, alloc %d, rate %d, freq %d",
-                         btc_aa_src_cb.encoder.s16ChannelMode,
-                         btc_aa_src_cb.encoder.s16NumOfSubBands, btc_aa_src_cb.encoder.s16NumOfBlocks,
-                         btc_aa_src_cb.encoder.s16AllocationMethod, btc_aa_src_cb.encoder.u16BitRate,
-                         btc_aa_src_cb.encoder.s16SamplingFreq);
+                         btc_sbc_encoder.s16ChannelMode,
+                         btc_sbc_encoder.s16NumOfSubBands, btc_sbc_encoder.s16NumOfBlocks,
+                         btc_sbc_encoder.s16AllocationMethod, btc_sbc_encoder.u16BitRate,
+                         btc_sbc_encoder.s16SamplingFreq);

-        SBC_Encoder_Init(&(btc_aa_src_cb.encoder));
+        SBC_Encoder_Init(&(btc_sbc_encoder));
    } else {
        APPL_TRACE_DEBUG("%s no SBC reconfig needed", __FUNCTION__);
    }
@@ -1105,8 +1131,8 @@ static UINT8 btc_get_num_aa_frame(void)

    switch (btc_aa_src_cb.TxTranscoding) {
    case BTC_MEDIA_TRSCD_PCM_2_SBC: {
-        UINT32 pcm_bytes_per_frame = btc_aa_src_cb.encoder.s16NumOfSubBands *
-                                     btc_aa_src_cb.encoder.s16NumOfBlocks *
+        UINT32 pcm_bytes_per_frame = btc_sbc_encoder.s16NumOfSubBands *
+                                     btc_sbc_encoder.s16NumOfBlocks *
                                     btc_aa_src_cb.media_feeding.cfg.pcm.num_channel *
                                     btc_aa_src_cb.media_feeding.cfg.pcm.bit_per_sample / 8;

@@ -1162,12 +1188,12 @@ static UINT8 btc_get_num_aa_frame(void)

 BOOLEAN btc_media_aa_read_feeding(void)
 {
-    UINT16 blocm_x_subband = btc_aa_src_cb.encoder.s16NumOfSubBands * \
-                             btc_aa_src_cb.encoder.s16NumOfBlocks;
+    UINT16 blocm_x_subband = btc_sbc_encoder.s16NumOfSubBands * \
+                             btc_sbc_encoder.s16NumOfBlocks;
    UINT32 read_size;
    UINT16 sbc_sampling = 48000;
    UINT32 src_samples;
-    UINT16 bytes_needed = blocm_x_subband * btc_aa_src_cb.encoder.s16NumOfChannels * \
+    UINT16 bytes_needed = blocm_x_subband * btc_sbc_encoder.s16NumOfChannels * \
                          btc_aa_src_cb.media_feeding.cfg.pcm.bit_per_sample / 8;
    static UINT16 up_sampled_buffer[SBC_MAX_NUM_FRAME * SBC_MAX_NUM_OF_BLOCKS
                                    * SBC_MAX_NUM_OF_CHANNELS * SBC_MAX_NUM_OF_SUBBANDS * 2];
@@ -1181,7 +1207,7 @@ BOOLEAN btc_media_aa_read_feeding(void)
    UINT32  nb_byte_read = 0;

    /* Get the SBC sampling rate */
-    switch (btc_aa_src_cb.encoder.s16SamplingFreq) {
+    switch (btc_sbc_encoder.s16SamplingFreq) {
    case SBC_sf48000:
        sbc_sampling = 48000;
        break;
@@ -1199,7 +1225,7 @@ BOOLEAN btc_media_aa_read_feeding(void)
    if (sbc_sampling == btc_aa_src_cb.media_feeding.cfg.pcm.sampling_freq) {
        read_size = bytes_needed - btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue;
        nb_byte_read = btc_aa_src_data_read(
-                           ((uint8_t *)btc_aa_src_cb.encoder.as16PcmBuffer) +
+                           ((uint8_t *)btc_sbc_encoder.as16PcmBuffer) +
                           btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue,
                           read_size);
        if (nb_byte_read == read_size) {
@@ -1293,7 +1319,7 @@ BOOLEAN btc_media_aa_read_feeding(void)
    /* only copy the pcm sample when we have up-sampled enough PCM */
    if (btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue >= bytes_needed) {
        /* Copy the output pcm samples in SBC encoding buffer */
-        memcpy((UINT8 *)btc_aa_src_cb.encoder.as16PcmBuffer,
+        memcpy((UINT8 *)btc_sbc_encoder.as16PcmBuffer,
               (UINT8 *)up_sampled_buffer,
               bytes_needed);
        /* update the residue */
@@ -1322,8 +1348,8 @@ BOOLEAN btc_media_aa_read_feeding(void)
 static void btc_media_aa_prep_sbc_2_send(UINT8 nb_frame)
 {
    BT_HDR *p_buf;
-    UINT16 blocm_x_subband = btc_aa_src_cb.encoder.s16NumOfSubBands *
-                             btc_aa_src_cb.encoder.s16NumOfBlocks;
+    UINT16 blocm_x_subband = btc_sbc_encoder.s16NumOfSubBands *
+                             btc_sbc_encoder.s16NumOfBlocks;

    while (nb_frame) {
        if (NULL == (p_buf = osi_malloc(BTC_MEDIA_AA_BUF_SIZE))) {
@@ -1339,27 +1365,27 @@ static void btc_media_aa_prep_sbc_2_send(UINT8 nb_frame)

        do {
            /* Write @ of allocated buffer in encoder.pu8Packet */
-            btc_aa_src_cb.encoder.pu8Packet = (UINT8 *) (p_buf + 1) + p_buf->offset + p_buf->len;
+            btc_sbc_encoder.pu8Packet = (UINT8 *) (p_buf + 1) + p_buf->offset + p_buf->len;
            /* Fill allocated buffer with 0 */
-            memset(btc_aa_src_cb.encoder.as16PcmBuffer, 0, blocm_x_subband
-                   * btc_aa_src_cb.encoder.s16NumOfChannels);
+            memset(btc_sbc_encoder.as16PcmBuffer, 0, blocm_x_subband
+                   * btc_sbc_encoder.s16NumOfChannels);

            /* Read PCM data and upsample them if needed */
            if (btc_media_aa_read_feeding()) {
                /* SBC encode and descramble frame */
-                SBC_Encoder(&(btc_aa_src_cb.encoder));
-                A2D_SbcChkFrInit(btc_aa_src_cb.encoder.pu8Packet);
-                A2D_SbcDescramble(btc_aa_src_cb.encoder.pu8Packet, btc_aa_src_cb.encoder.u16PacketLength);
+                SBC_Encoder(&(btc_sbc_encoder));
+                A2D_SbcChkFrInit(btc_sbc_encoder.pu8Packet);
+                A2D_SbcDescramble(btc_sbc_encoder.pu8Packet, btc_sbc_encoder.u16PacketLength);
                /* Update SBC frame length */
-                p_buf->len += btc_aa_src_cb.encoder.u16PacketLength;
+                p_buf->len += btc_sbc_encoder.u16PacketLength;
                nb_frame--;
                p_buf->layer_specific++;
            } else {
                APPL_TRACE_WARNING("btc_media_aa_prep_sbc_2_send underflow %d, %d",
                                   nb_frame, btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue);
                btc_aa_src_cb.media_feeding_state.pcm.counter += nb_frame *
-                        btc_aa_src_cb.encoder.s16NumOfSubBands *
-                        btc_aa_src_cb.encoder.s16NumOfBlocks *
+                        btc_sbc_encoder.s16NumOfSubBands *
+                        btc_sbc_encoder.s16NumOfBlocks *
                        btc_aa_src_cb.media_feeding.cfg.pcm.num_channel *
                        btc_aa_src_cb.media_feeding.cfg.pcm.bit_per_sample / 8;
                /* no more pcm to read */
@@ -1372,7 +1398,7 @@ static void btc_media_aa_prep_sbc_2_send(UINT8 nb_frame)
                }
            }

-        } while (((p_buf->len + btc_aa_src_cb.encoder.u16PacketLength) < btc_aa_src_cb.TxAaMtuSize)
+        } while (((p_buf->len + btc_sbc_encoder.u16PacketLength) < btc_aa_src_cb.TxAaMtuSize)
                 && (p_buf->layer_specific < 0x0F) && nb_frame);

        if (p_buf->len) {
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c
@@ -315,8 +315,10 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
                       TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
        } else if (event == BTA_AV_PENDING_EVT) {
            bdcpy(btc_av_cb.peer_bda.address, ((tBTA_AV *)p_data)->pend.bd_addr);
+            UINT16 uuid = (btc_av_cb.service_id == BTA_A2DP_SOURCE_SERVICE_ID) ? UUID_SERVCLASS_AUDIO_SOURCE :
+                UUID_SERVCLASS_AUDIO_SINK;
            BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
-                       TRUE, BTA_SEC_AUTHENTICATE, UUID_SERVCLASS_AUDIO_SOURCE);
+                       TRUE, BTA_SEC_AUTHENTICATE, uuid);
        }
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_OPENING);
    } break;
@@ -402,8 +404,8 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
        tBTA_AV *p_bta_data = (tBTA_AV *)p_data;
        esp_a2d_connection_state_t state;
        btc_sm_state_t av_state;
-        BTC_TRACE_DEBUG("status:%d, edr 0x%x\n", p_bta_data->open.status,
-                  p_bta_data->open.edr);
+        BTC_TRACE_DEBUG("status:%d, edr 0x%x, peer sep %d\n", p_bta_data->open.status,
+                        p_bta_data->open.edr, p_bta_data->open.sep);

        if (p_bta_data->open.status == BTA_AV_SUCCESS) {
            state = ESP_A2D_CONNECTION_STATE_CONNECTED;
@@ -428,7 +430,8 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
            btc_rc_check_handle_pending_play(p_bta_data->open.bd_addr,
                                             (p_bta_data->open.status == BTA_AV_SUCCESS));
            */
-        } else if (btc_av_cb.peer_sep == AVDT_TSEP_SRC) {
+        } else if (btc_av_cb.peer_sep == AVDT_TSEP_SRC &&
+                   (p_bta_data->open.status == BTA_AV_SUCCESS)) {
            /* Bring up AVRCP connection too */
            BTA_AvOpenRc(btc_av_cb.bta_handle);
        }
@@ -978,10 +981,10 @@ static bt_status_t btc_av_init(int service_id)
        btc_av_cb.sm_handle =
            btc_sm_init((const btc_sm_handler_t *)btc_av_state_handlers, BTC_AV_STATE_IDLE);

-        btc_dm_enable_service(BTA_A2DP_SOURCE_SERVICE_ID);
-
        if (service_id == BTA_A2DP_SINK_SERVICE_ID) {
            btc_dm_enable_service(BTA_A2DP_SINK_SERVICE_ID);
+        } else {
+            btc_dm_enable_service(BTA_A2DP_SOURCE_SERVICE_ID);
        }

        btc_a2dp_on_init();
@@ -1213,7 +1216,7 @@ static void bte_av_media_callback(tBTA_AV_EVT event, tBTA_AV_MEDIA *p_data)
 ** Returns          BT_STATUS_SUCCESS on success, BT_STATUS_FAIL otherwise
 **
 *******************************************************************************/
-bt_status_t btc_av_execute_service(BOOLEAN b_enable)
+bt_status_t btc_av_execute_service(BOOLEAN b_enable, UINT8 tsep)
 {
    if (b_enable) {
        /* TODO: Removed BTA_SEC_AUTHORIZE since the Java/App does not
@@ -1227,7 +1230,7 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
                     | BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR
                     | BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
                     bte_av_callback);
-        BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos);
+        BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos, tsep);
    } else {
        BTA_AvDeregister(btc_av_cb.bta_handle);
        BTA_AvDisable();
@@ -1235,6 +1238,20 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
    return BT_STATUS_SUCCESS;
 }

+/*******************************************************************************
+**
+** Function         btc_av_source_execute_service
+**
+** Description      Initializes/Shuts down the A2DP source service
+**
+** Returns          BT_STATUS_SUCCESS on success, BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_av_source_execute_service(BOOLEAN b_enable)
+{
+    return btc_av_execute_service(b_enable, AVDT_TSEP_SRC);
+}
+
 /*******************************************************************************
 **
 ** Function         btc_av_sink_execute_service
@@ -1246,6 +1263,10 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable)
 *******************************************************************************/
 bt_status_t btc_av_sink_execute_service(BOOLEAN b_enable)
 {
+    bt_status_t ret = btc_av_execute_service(b_enable, AVDT_TSEP_SNK);
+    if (ret != BT_STATUS_SUCCESS) {
+        return ret;
+    }
 #if (BTA_AV_SINK_INCLUDED == TRUE)
    BTA_AvEnable_Sink(b_enable);
 #endif
--- a/components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c
+++ b/components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c
@@ -29,6 +29,7 @@
 #include "btc/btc_dm.h"
 #include "btc/btc_util.h"
 #include "osi/mutex.h"
+#include "esp_bt.h"

 static tBTA_BLE_ADV_DATA gl_bta_adv_data;
 static tBTA_BLE_ADV_DATA gl_bta_scan_rsp_data;
@@ -142,6 +143,7 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT

    if (p_adv_data->include_txpower) {
        mask |= BTM_BLE_AD_BIT_TX_PWR;
+        bta_adv_data->tx_power = esp_ble_tx_power_get(ESP_BLE_PWR_TYPE_ADV);
    }

    if (p_adv_data->min_interval > 0 && p_adv_data->max_interval > 0 &&
@@ -450,6 +452,10 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBT
        status = ESP_BT_STATUS_PARM_INVALID;
        BTC_TRACE_ERROR("Invalid advertisting channel map parameters.\n");
    }
+    if (!BLE_ISVALID_PARAM(ble_adv_params->peer_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RANDOM)) {
+        status = ESP_BT_STATUS_PARM_INVALID;
+        BTC_TRACE_ERROR("Invalid advertisting peer address type parameters.\n");
+    }
    if(status != ESP_BT_STATUS_SUCCESS) {
        if(start_adv_cback) {
            start_adv_cback(status);
@@ -829,7 +835,7 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *
            BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
        } else {
            btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
-            BTC_TRACE_ERROR("Invalid random address, the high bit should be 0b11, all bits of the random part shall not be to 1 or 0");
+            BTC_TRACE_ERROR("Invalid random address, the high bit should be 0b11, bits of the random part shall not be all 1 or 0");
        }
    } else {
        btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
@@ -1114,6 +1120,25 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                bta_dm_co_ble_set_max_key_size(key_size);
                break;
            }
+            case ESP_BLE_SM_SET_STATIC_PASSKEY: {
+                uint32_t passkey = 0;
+                for(uint8_t i = 0; i < arg->set_security_param.len; i++)
+                {
+                    passkey += (((uint8_t *)value)[i]<<(8*i));
+                }
+                BTA_DmBleSetStaticPasskey(true, passkey);
+                break;
+            }
+            case ESP_BLE_SM_CLEAR_STATIC_PASSKEY: {
+                BTA_DmBleSetStaticPasskey(false, 0);
+                break;
+            }
+            case ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH: {
+                uint8_t enable = 0;
+                STREAM_TO_UINT8(enable, value);
+                bta_dm_co_ble_set_accept_auth_enable(enable);
+                break;
+            }
            default:
                break;
        }
--- a/components/bt/bluedroid/btc/profile/std/gap/btc_gap_bt.c
+++ b/components/bt/bluedroid/btc/profile/std/gap/btc_gap_bt.c
@@ -645,6 +645,14 @@ esp_err_t btc_gap_bt_remove_bond_device(btc_gap_bt_args_t *arg)
    return ESP_BT_STATUS_FAIL;
 }

+static void btc_gap_bt_set_pin_type(btc_gap_bt_args_t *arg){
+    BTA_DMSetPinType (arg->set_pin_type.pin_type, arg->set_pin_type.pin_code, arg->set_pin_type.pin_code_len);
+}
+
+static void btc_gap_bt_pin_reply(btc_gap_bt_args_t *arg){
+    BTA_DmPinReply(arg->pin_reply.bda.address, arg->pin_reply.accept, arg->pin_reply.pin_code_len, arg->pin_reply.pin_code);
+}
+
 void btc_gap_bt_call_handler(btc_msg_t *msg)
 {
    btc_gap_bt_args_t *arg = (btc_gap_bt_args_t *)msg->arg;
@@ -682,6 +690,14 @@ void btc_gap_bt_call_handler(btc_msg_t *msg)
        btc_gap_bt_remove_bond_device(msg->arg);
        break;
    }
+    case BTC_GAP_BT_ACT_SET_PIN_TYPE:{
+        btc_gap_bt_set_pin_type(arg);
+        break;
+    }
+    case BTC_GAP_BT_ACT_PIN_REPLY: {
+        btc_gap_bt_pin_reply(arg);
+        break;
+    }
    default:
        break;
    }
@@ -715,6 +731,7 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg)
        break;
    case BTC_GAP_BT_READ_RSSI_DELTA_EVT:
    case BTC_GAP_BT_AUTH_CMPL_EVT:
+    case BTC_GAP_BT_PIN_REQ_EVT:
        break;
    default:
        BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
@@ -745,6 +762,10 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg)
        btc_gap_bt_cb_to_app(ESP_BT_GAP_AUTH_CMPL_EVT, (esp_bt_gap_cb_param_t *)msg->arg);
        break;
    }
+    case BTC_GAP_BT_PIN_REQ_EVT:{
+        btc_gap_bt_cb_to_app(ESP_BT_GAP_PIN_REQ_EVT, (esp_bt_gap_cb_param_t *)msg->arg);
+        break;
+    }
    default:
        BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
        break;
--- a/components/bt/bluedroid/btc/profile/std/include/btc_gap_bt.h
+++ b/components/bt/bluedroid/btc/profile/std/include/btc_gap_bt.h
@@ -28,6 +28,7 @@ typedef enum {
    BTC_GAP_BT_SEARCH_SERVICE_RECORD_EVT,
    BTC_GAP_BT_READ_RSSI_DELTA_EVT,
    BTC_GAP_BT_AUTH_CMPL_EVT,
+    BTC_GAP_BT_PIN_REQ_EVT,
 }btc_gap_bt_evt_t;

 typedef enum {
@@ -39,6 +40,8 @@ typedef enum {
    BTC_GAP_BT_ACT_SET_COD,
    BTC_GAP_BT_ACT_READ_RSSI_DELTA,
    BTC_GAP_BT_ACT_REMOVE_BOND_DEVICE,
+    BTC_GAP_BT_ACT_SET_PIN_TYPE,
+    BTC_GAP_BT_ACT_PIN_REPLY,
 } btc_gap_bt_act_t;

 /* btc_bt_gap_args_t */
@@ -79,6 +82,22 @@ typedef union {
    struct rm_bond_device_args {
       bt_bdaddr_t bda;
    } rm_bond_device;
+
+    // BTC_GAP_BT_ACT_SET_PIN_TYPE
+    struct set_pin_type_args {
+        esp_bt_pin_type_t pin_type;
+        uint8_t pin_code_len;
+        esp_bt_pin_code_t pin_code;
+    } set_pin_type;
+
+    // BTC_GAP_BT_ACT_PIN_REPLY
+    struct pin_reply_args {
+        bt_bdaddr_t bda;
+        bool accept;
+        uint8_t pin_code_len;
+        esp_bt_pin_code_t pin_code;
+    } pin_reply;
+
 } btc_gap_bt_args_t;

 void btc_gap_bt_call_handler(btc_msg_t *msg);
--- a/components/bt/bluedroid/btc/profile/std/spp/btc_spp.c
+++ b/components/bt/bluedroid/btc/profile/std/spp/btc_spp.c
@@ -52,7 +52,7 @@ typedef struct {
    list_t *list;
    list_t *incoming_list;
    uint8_t service_uuid[16];
-    char service_name[ESP_SPP_SERVER_NAME_MAX];
+    char service_name[ESP_SPP_SERVER_NAME_MAX + 1];
 } spp_slot_t;

 static struct spp_local_param_t {
--- a/components/bt/bluedroid/common/include/common/bt_target.h
+++ b/components/bt/bluedroid/common/include/common/bt_target.h
@@ -127,7 +127,7 @@
 #else
 #define SMP_INCLUDED              FALSE
 #define BLE_PRIVACY_SPT           FALSE
-#endif  /* CONFIG_GATTC_ENABLE */
+#endif  /* CONFIG_SMP_ENABLE */

 #if (CONFIG_BT_ACL_CONNECTIONS)
 #define MAX_ACL_CONNECTIONS  CONFIG_BT_ACL_CONNECTIONS
@@ -317,6 +317,12 @@
 #define SCAN_QUEUE_CONGEST_CHECK  CONFIG_BLE_HOST_QUEUE_CONGESTION_CHECK
 #endif

+#ifndef CONFIG_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+#define BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY    FALSE
+#else
+#define BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY    CONFIG_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+#endif
+
 /* This feature is used to eanble interleaved scan*/
 #ifndef BTA_HOST_INTERLEAVE_SEARCH
 #define BTA_HOST_INTERLEAVE_SEARCH FALSE//FALSE
@@ -991,7 +997,7 @@
 #endif

 #ifndef BTM_BLE_ADV_TX_POWER
-#define BTM_BLE_ADV_TX_POWER {-21, -15, -7, 1, 9}
+#define BTM_BLE_ADV_TX_POWER {-12, -9, -6, -3, 0, 3, 6, 9}
 #endif


--- a/components/bt/bluedroid/common/include/common/bte_appl.h
+++ b/components/bt/bluedroid/common/include/common/bte_appl.h
@@ -31,6 +31,7 @@ typedef struct {
    UINT8   ble_init_key;
    UINT8   ble_resp_key;
    UINT8   ble_max_key_size;
+    UINT8   ble_accept_auth_enable;
 #endif
 } tBTE_APPL_CFG;

--- a/components/bt/bluedroid/device/controller.c
+++ b/components/bt/bluedroid/device/controller.c
@@ -250,10 +250,10 @@ static void start_up(void)
    }
 #endif

-    if (simple_pairing_supported) {
-        response = AWAIT_COMMAND(packet_factory->make_set_event_mask(&CLASSIC_EVENT_MASK));
-        packet_parser->parse_generic_command_complete(response);
-    }
+
+    response = AWAIT_COMMAND(packet_factory->make_set_event_mask(&CLASSIC_EVENT_MASK));
+    packet_parser->parse_generic_command_complete(response);
+

 #if (BTM_SCO_HCI_INCLUDED == TRUE)
    response = AWAIT_COMMAND(packet_factory->make_write_sync_flow_control_enable(1));
--- a/components/bt/bluedroid/hci/hci_hal_h4.c
+++ b/components/bt/bluedroid/hci/hci_hal_h4.c
@@ -26,10 +26,10 @@
 #include "hci/hci_layer.h"
 #include "osi/thread.h"
 #include "esp_bt.h"
+#include "stack/hcimsgs.h"

 #if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
 #include "l2c_int.h"
-#include "stack/hcimsgs.h"
 #endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE

 #define HCI_HAL_SERIAL_BUFFER_SIZE 1026
--- a/components/bt/bluedroid/stack/btm/btm_acl.c
+++ b/components/bt/bluedroid/stack/btm/btm_acl.c
@@ -1522,11 +1522,10 @@ UINT8 BTM_AllocateSCN(void)
 {
    UINT8   x;
    BTM_TRACE_DEBUG ("BTM_AllocateSCN\n");
-    // stack reserves scn 1 for HFP, HSP we still do the correct way
    for (x = 1; x < BTM_MAX_SCN; x++) {
-        if (!btm_cb.btm_scn[x]) {
-            btm_cb.btm_scn[x] = TRUE;
-            return (x + 1);
+        if (!btm_cb.btm_scn[x - 1]) {
+            btm_cb.btm_scn[x - 1] = TRUE;
+            return x;
        }
    }
    return (0);    /* No free ports */
@@ -1545,10 +1544,7 @@ UINT8 BTM_AllocateSCN(void)
 #if (CLASSIC_BT_INCLUDED == TRUE)
 BOOLEAN BTM_TryAllocateSCN(UINT8 scn)
 {
-    /* Make sure we don't exceed max port range.
-     * Stack reserves scn 1 for HFP, HSP we still do the correct way.
-     */
-    if ( (scn >= BTM_MAX_SCN) || (scn == 1) ) {
+    if (scn >= BTM_MAX_SCN) {
        return FALSE;
    }

--- a/components/bt/bluedroid/stack/btm/btm_ble.c
+++ b/components/bt/bluedroid/stack/btm/btm_ble.c
@@ -43,7 +43,7 @@
 //#include "osi/include/log.h"

 #if SMP_INCLUDED == TRUE
-// The temp variable to pass parameter between functions when in the connected event comeback.
+// The temp variable to pass parameter between functions when in the connected event callback.
 static BOOLEAN temp_enhanced = FALSE;
 extern BOOLEAN aes_cipher_msg_auth_code(BT_OCTET16 key, UINT8 *input, UINT16 length,
                                        UINT16 tlen, UINT8 *p_signature);
@@ -66,13 +66,14 @@ extern void gatt_notify_enc_cmpl(BD_ADDR bd_addr);
 **                  bd_name          - Name of the peer device.  NULL if unknown.
 **                  dev_type         - Remote device's device type.
 **                  addr_type        - LE device address type.
+**                  auth_mode        - auth mode             
 **
 ** Returns          TRUE if added OK, else FALSE
 **
 *******************************************************************************/
 #if (SMP_INCLUDED == TRUE)
 BOOLEAN BTM_SecAddBleDevice (BD_ADDR bd_addr, BD_NAME bd_name, tBT_DEVICE_TYPE dev_type,
-                             tBLE_ADDR_TYPE addr_type)
+                             tBLE_ADDR_TYPE addr_type, UINT32 auth_mode)
 {
    tBTM_SEC_DEV_REC  *p_dev_rec;
    UINT8               i = 0;
@@ -125,6 +126,7 @@ BOOLEAN BTM_SecAddBleDevice (BD_ADDR bd_addr, BD_NAME bd_name, tBT_DEVICE_TYPE d
    }
    p_dev_rec->device_type |= dev_type;
    p_dev_rec->ble.ble_addr_type = addr_type;
+    p_dev_rec->ble.auth_mode = auth_mode;

    memcpy (p_dev_rec->ble.pseudo_addr, bd_addr, BD_ADDR_LEN);
    /* sync up with the Inq Data base*/
@@ -423,6 +425,26 @@ void BTM_BlePasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey)
 #endif
 }

+/*******************************************************************************
+**
+** Function         BTM_BleSetStaticPasskey
+**
+** Description      This function is called to set static passkey
+**
+**
+** Parameters:      add          - set static passkey when add is TRUE
+**                                 clear static passkey when add is FALSE
+**                  passkey      - static passkey
+**
+**
+*******************************************************************************/
+void BTM_BleSetStaticPasskey(BOOLEAN add, UINT32 passkey)
+{
+#if SMP_INCLUDED == TRUE
+    SMP_SetStaticPasskey(add, passkey);
+#endif
+}
+
 /*******************************************************************************
 **
 ** Function         BTM_BleConfirmReply
@@ -609,7 +631,7 @@ void BTM_ReadDevInfo (BD_ADDR remote_bda, tBT_DEVICE_TYPE *p_dev_type, tBLE_ADDR

    *p_addr_type = BLE_ADDR_PUBLIC;

-    if (!p_dev_rec) {  
+    if (!p_dev_rec) {
        *p_dev_type = BT_DEVICE_TYPE_BREDR;
        /* Check with the BT manager if details about remote device are known */
        if (p_inq_info != NULL) {
@@ -1451,7 +1473,7 @@ tBTM_STATUS btm_ble_set_encryption (BD_ADDR bd_addr, void *p_ref_data, UINT8 lin
        if(link_role == BTM_ROLE_SLAVE && (p_rec->ble.key_type & BTM_LE_KEY_PENC)) {
            p_rec->ble.skip_update_conn_param = true;
        } else {
-            p_rec->ble.skip_update_conn_param = false;    
+            p_rec->ble.skip_update_conn_param = false;
        }
        if (SMP_Pair(bd_addr) == SMP_STARTED) {
            cmd = BTM_CMD_STARTED;
@@ -1600,7 +1622,7 @@ void btm_ble_link_encrypted(BD_ADDR bd_addr, UINT8 encr_enable)
    /* to notify GATT to send data if any request is pending */
    gatt_notify_enc_cmpl(p_dev_rec->ble.pseudo_addr);
 }
-#endif  ///SMP_INCLUDED == TRUE 
+#endif  ///SMP_INCLUDED == TRUE


 /*******************************************************************************
@@ -1926,10 +1948,10 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)

        /* It will cause that scanner doesn't send scan request to advertiser
        * which has sent IRK to us and we have stored the IRK in controller.
-        * It is a design problem of hardware. The temporal solution is not to 
-        * send the key to the controller and then resolve the random address in host.
-        * so we need send the real address information to controller to connect. 
-        * Once the connection is successful, resolve device address whether it is 
+        * It is a hardware limitation. The preliminary solution is not to
+        * send key to the controller, but to resolve the random address in host.
+        * so we need send the real address information to controller to connect.
+        * Once the connection is successful, resolve device address whether it is
        * slave or master*/

        /* if (!match && role == HCI_ROLE_SLAVE && BTM_BLE_IS_RESOLVE_BDA(bda)) { */
--- a/components/bt/bluedroid/stack/btm/btm_ble_addr.c
+++ b/components/bt/bluedroid/stack/btm/btm_ble_addr.c
@@ -65,6 +65,23 @@ static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p)
            p_cb->set_local_privacy_cback = NULL;
        }

+        if (btm_cb.ble_ctr_cb.inq_var.adv_mode == BTM_BLE_ADV_ENABLE){
+            BTM_TRACE_DEBUG("Advertise with new resolvable private address, now.");
+            /**
+             * Restart advertising, using new resolvable private address
+             */
+            btm_ble_stop_adv();
+            btm_ble_start_adv();
+        }
+        if (btm_cb.ble_ctr_cb.inq_var.state == BTM_BLE_SCANNING){
+            BTM_TRACE_DEBUG("Scan with new resolvable private address, now.");
+            /**
+             * Restart scaning, using new resolvable private address
+             */
+            btm_ble_stop_scan();
+            btm_ble_start_scan();
+        }
+
        /* start a periodical timer to refresh random addr */
        btu_stop_timer_oneshot(&p_cb->raddr_timer_ent);
 #if (BTM_BLE_CONFORMANCE_TESTING == TRUE)
--- a/components/bt/bluedroid/stack/btm/btm_ble_gap.c
+++ b/components/bt/bluedroid/stack/btm/btm_ble_gap.c
@@ -2922,7 +2922,9 @@ BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type
        BTM_TRACE_DEBUG("btm_ble_update_inq_result scan_rsp=false, to_report=false,\
                              scan_type_active=%d", btm_cb.ble_ctr_cb.inq_var.scan_type);
        p_i->scan_rsp = FALSE;
+#if BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY == FALSE
        to_report = FALSE;
+#endif
    } else {
        p_i->scan_rsp = TRUE;
    }
@@ -3218,10 +3220,26 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
    tBTM_BLE_INQ_CB      *p_le_inq_cb = &btm_cb.ble_ctr_cb.inq_var;
    BOOLEAN     update = TRUE;
    UINT8       result = 0;
-
+    /* Event_Type:
+        0x00 Connectable undirected advertising (ADV_IND).
+        0x01 Connectable directed advertising (ADV_DIRECT_IND)
+        0x02 Scannable undirected advertising (ADV_SCAN_IND)
+        0x03 Non connectable undirected advertising (ADV_NONCONN_IND)
+        0x04 Scan Response (SCAN_RSP)
+        0x05-0xFF Reserved for future use 
+    */
   //if scan duplicate is enabled, the adv packet without scan response is allowed to report to upper layer
   if(p_le_inq_cb->scan_duplicate_filter == BTM_BLE_SCAN_DUPLICATE_ENABLE) {
-       if(memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN) != 0) {
+       /*
+        Bluedroid will put the advertising packet and scan response into a packet and send it to the higher layer.
+        If two advertising packets are not with the same address, or can't be combined into a packet, then the first advertising 
+        packet will be discarded. So we added the following judgment:
+        1. For different addresses, send the last advertising packet to higher layer
+        2. For same address and same advertising type (not scan response), send the last advertising packet to higher layer
+        3. For same address and scan response, do nothing
+        */
+       int same_addr = memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN);
+       if (same_addr != 0 || (same_addr == 0 && evt_type != BTM_BLE_SCAN_RSP_EVT)) {
            btm_ble_process_last_adv_pkt();
       }
   }
--- a/components/bt/bluedroid/stack/btm/btm_ble_multi_adv.c
+++ b/components/bt/bluedroid/stack/btm/btm_ble_multi_adv.c
@@ -222,10 +222,10 @@ tBTM_STATUS btm_ble_enable_multi_adv (BOOLEAN enable, UINT8 inst_id, UINT8 cb_ev
 ** Returns          tx power in dBm
 **
 *******************************************************************************/
-int btm_ble_tx_power[BTM_BLE_ADV_TX_POWER_MAX + 1] = BTM_BLE_ADV_TX_POWER;
+static const int btm_ble_tx_power[BTM_BLE_ADV_TX_POWER_MAX + 1] = BTM_BLE_ADV_TX_POWER;
 char btm_ble_map_adv_tx_power(int tx_power_index)
 {
-    if (0 <= tx_power_index && tx_power_index < BTM_BLE_ADV_TX_POWER_MAX) {
+    if (0 <= tx_power_index && tx_power_index <= BTM_BLE_ADV_TX_POWER_MAX) {
        return (char)btm_ble_tx_power[tx_power_index];
    }
    return 0;
--- a/components/bt/bluedroid/stack/btm/btm_ble_privacy.c
+++ b/components/bt/bluedroid/stack/btm/btm_ble_privacy.c
@@ -771,8 +771,8 @@ BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
                    }
                    /* It will cause that scanner doesn't send scan request to advertiser
                     * which has sent IRK to us and we have stored the IRK in controller.
-                     * It is a design problem of hardware. The temporal solution is not to 
-                     * send the key to the controller and then resolve the random address in host. */
+                     * It is a hardware limitation. The preliminary solution is not to
+                     * send key to the controller, but to resolve the random address in host. */
                    /*
                    BTM_TRACE_DEBUG("%s:adding device to controller resolving list\n", __func__);
                    UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
--- a/components/bt/bluedroid/stack/btm/btm_dev.c
+++ b/components/bt/bluedroid/stack/btm/btm_dev.c
@@ -172,22 +172,23 @@ BOOLEAN BTM_SecAddDevice (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name,
 ** Description      Free resources associated with the device.
 **
 ** Parameters:      bd_addr          - BD address of the peer
+**                  transport        - BT_TRANSPORT_BR_EDR or BT_TRANSPORT_LE
 **
 ** Returns          TRUE if removed OK, FALSE if not found or ACL link is active
 **
 *******************************************************************************/
-BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr)
+BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr, tBT_TRANSPORT transport)
 {
+
    tBTM_SEC_DEV_REC *p_dev_rec;

-    if (BTM_IsAclConnectionUp(bd_addr, BT_TRANSPORT_LE) ||
-            BTM_IsAclConnectionUp(bd_addr, BT_TRANSPORT_BR_EDR)) {
+    if (BTM_IsAclConnectionUp(bd_addr, transport)) {
        BTM_TRACE_WARNING("%s FAILED: Cannot Delete when connection is active\n", __func__);
        return FALSE;
    }
-
    if ((p_dev_rec = btm_find_dev(bd_addr)) != NULL) {
-        btm_sec_free_dev(p_dev_rec);
+        btm_sec_free_dev(p_dev_rec, transport);
+
        /* Tell controller to get rid of the link key, if it has one stored */
        BTM_DeleteStoredLinkKey (p_dev_rec->bd_addr, NULL);
    }
@@ -340,17 +341,33 @@ tBTM_SEC_DEV_REC *btm_sec_alloc_dev (BD_ADDR bd_addr)
 ** Description      Mark device record as not used
 **
 *******************************************************************************/
-void btm_sec_free_dev (tBTM_SEC_DEV_REC *p_dev_rec)
+void btm_sec_free_dev (tBTM_SEC_DEV_REC *p_dev_rec, tBT_TRANSPORT transport)
 {
-    p_dev_rec->bond_type = BOND_TYPE_UNKNOWN;
-    p_dev_rec->sec_flags = 0;
+    if (transport == BT_TRANSPORT_BR_EDR) {
+        memset(p_dev_rec->link_key, 0, LINK_KEY_LEN);
+        p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
+                                | BTM_SEC_ENCRYPTED | BTM_SEC_NAME_KNOWN
+                                | BTM_SEC_LINK_KEY_KNOWN | BTM_SEC_LINK_KEY_AUTHED
+                                | BTM_SEC_ROLE_SWITCHED | BTM_SEC_16_DIGIT_PIN_AUTHED);
+    } else if (transport == BT_TRANSPORT_LE) {
+        p_dev_rec->bond_type = BOND_TYPE_UNKNOWN;
+        p_dev_rec->sec_flags &= ~(BTM_SEC_LE_AUTHENTICATED | BTM_SEC_LE_ENCRYPTED
+                                | BTM_SEC_LE_NAME_KNOWN | BTM_SEC_LE_LINK_KEY_KNOWN
+                                | BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_ROLE_SWITCHED);
+#if BLE_INCLUDED == TRUE
+        /* Clear out any saved BLE keys */
+        btm_sec_clear_ble_keys (p_dev_rec);
+#endif
+    } else {
+        p_dev_rec->bond_type = BOND_TYPE_UNKNOWN;
+        memset(p_dev_rec->link_key, 0, LINK_KEY_LEN);
+        p_dev_rec->sec_flags = 0;

 #if BLE_INCLUDED == TRUE
-    /* Clear out any saved BLE keys */
-    btm_sec_clear_ble_keys (p_dev_rec);
+        /* Clear out any saved BLE keys */
+        btm_sec_clear_ble_keys (p_dev_rec);
 #endif
-
-
+    }
 }

 /*******************************************************************************
--- a/components/bt/bluedroid/stack/btm/btm_inq.c
+++ b/components/bt/bluedroid/stack/btm/btm_inq.c
@@ -170,16 +170,6 @@ tBTM_STATUS BTM_SetDiscoverability (UINT16 inq_mode, UINT16 window, UINT16 inter
    BOOLEAN      cod_limited;

    BTM_TRACE_API ("BTM_SetDiscoverability\n");
-#if (BLE_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
-    if (controller_get_interface()->supports_ble()) {
-        if (btm_ble_set_discoverability((UINT16)(inq_mode))
-                == BTM_SUCCESS) {
-            btm_cb.btm_inq_vars.discoverable_mode &= (~BTM_BLE_DISCOVERABLE_MASK);
-            btm_cb.btm_inq_vars.discoverable_mode |= (inq_mode & BTM_BLE_DISCOVERABLE_MASK);
-        }
-    }
-    inq_mode &= ~BTM_BLE_DISCOVERABLE_MASK;
-#endif

    /*** Check mode parameter ***/
    if (inq_mode > BTM_MAX_DISCOVERABLE) {
@@ -601,17 +591,6 @@ tBTM_STATUS BTM_SetConnectability (UINT16 page_mode, UINT16 window, UINT16 inter

    BTM_TRACE_API ("BTM_SetConnectability\n");

-#if (BLE_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
-    if (controller_get_interface()->supports_ble()) {
-        if (btm_ble_set_connectability(page_mode) != BTM_SUCCESS) {
-            return BTM_NO_RESOURCES;
-        }
-        p_inq->connectable_mode &= (~BTM_BLE_CONNECTABLE_MASK);
-        p_inq->connectable_mode |= (page_mode & BTM_BLE_CONNECTABLE_MASK);
-    }
-    page_mode &= ~BTM_BLE_CONNECTABLE_MASK;
-#endif
-
    /*** Check mode parameter ***/
    if (page_mode != BTM_NON_CONNECTABLE && page_mode != BTM_CONNECTABLE) {
        return (BTM_ILLEGAL_VALUE);
--- a/components/bt/bluedroid/stack/btm/btm_sco.c
+++ b/components/bt/bluedroid/stack/btm/btm_sco.c
@@ -431,12 +431,13 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
            /* only sent the first BTM_SCO_DATA_SIZE_MAX bytes data if more than max,
               and set warning status */
            if (p_buf->len > BTM_SCO_DATA_SIZE_MAX) {
+                BTM_TRACE_WARNING ("BTM SCO hdl %x, bad len %u", p_ccb->hci_handle, p_buf->len);
                p_buf->len = BTM_SCO_DATA_SIZE_MAX;
                status = BTM_SCO_BAD_LENGTH;
            }

            UINT8_TO_STREAM (p, (UINT8)p_buf->len);
-            BTM_TRACE_DEBUG ("BTM SCO hdl %x, len %u", p_ccb->hci_handle, p_buf->len);
+
            p_buf->len += HCI_SCO_PREAMBLE_SIZE;

            if (fixed_queue_length(p_ccb->xmit_data_q) < BTM_SCO_XMIT_QUEUE_THRS) {
@@ -453,7 +454,7 @@ tBTM_STATUS BTM_WriteScoData (UINT16 sco_inx, BT_HDR *p_buf)
        status = BTM_UNKNOWN_ADDR;
    }

-    if (status != BTM_SUCCESS && status != BTM_SCO_BAD_LENGTH) {
+    if (status != BTM_SUCCESS) {
        BTM_TRACE_WARNING ("stat %d", status);
        osi_free(p_buf);
    }
--- a/components/bt/bluedroid/stack/btm/btm_sec.c
+++ b/components/bt/bluedroid/stack/btm/btm_sec.c
@@ -2761,9 +2761,9 @@ void btm_sec_check_pending_reqs (void)

        /* Now, re-submit anything in the mux queue */
        bq = btm_cb.sec_pending_q;
-        if (!btm_cb.sec_pending_q) {
-            btm_cb.sec_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);
-        }
+
+        btm_cb.sec_pending_q = fixed_queue_new(QUEUE_SIZE_MAX);
+

        while ((p_e = (tBTM_SEC_QUEUE_ENTRY *)fixed_queue_try_dequeue(bq)) != NULL) {
            /* Check that the ACL is still up before starting security procedures */
@@ -2784,6 +2784,7 @@ void btm_sec_check_pending_reqs (void)

            osi_free (p_e);
        }
+        fixed_queue_free(bq, NULL);
    }
 }
 #endif  ///SMP_INCLUDED == TRUE
@@ -5029,42 +5030,13 @@ void btm_sec_pin_code_request (UINT8 *p_bda)
        memcpy (p_cb->connecting_bda, p_bda, BD_ADDR_LEN);
        memcpy (p_cb->connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);

-        /* Check if the name is known */
-        /* Even if name is not known we might not be able to get one */
-        /* this is the case when we are already getting something from the */
-        /* device, so HCI level is flow controlled */
-        /* Also cannot send remote name request while paging, i.e. connection is not completed */
-        if (p_dev_rec->sec_flags & BTM_SEC_NAME_KNOWN) {
-            BTM_TRACE_EVENT ("btm_sec_pin_code_request going for callback\n");
-
-            btm_cb.pairing_flags |= BTM_PAIR_FLAGS_PIN_REQD;
-            if (p_cb->api.p_pin_callback) {
-                (*p_cb->api.p_pin_callback) (p_bda, p_dev_rec->dev_class, p_dev_rec->sec_bd_name,
-                                             (p_dev_rec->p_cur_service == NULL) ? FALSE
-                                             : (p_dev_rec->p_cur_service->security_flags
-                                                & BTM_SEC_IN_MIN_16_DIGIT_PIN));
-            }
-        } else {
-            BTM_TRACE_EVENT ("btm_sec_pin_code_request going for remote name\n");
-
-            /* We received PIN code request for the device with unknown name */
-            /* it is not user friendly just to ask for the PIN without name */
-            /* try to get name at first */
-            if (!btsnd_hcic_rmt_name_req (p_dev_rec->bd_addr,
-                                          HCI_PAGE_SCAN_REP_MODE_R1,
-                                          HCI_MANDATARY_PAGE_SCAN_MODE, 0)) {
-                p_dev_rec->sec_flags |= BTM_SEC_NAME_KNOWN;
-                p_dev_rec->sec_bd_name[0] = 'f';
-                p_dev_rec->sec_bd_name[1] = '0';
-                BTM_TRACE_ERROR ("can not send rmt_name_req?? fake a name and call callback\n");
-
-                btm_cb.pairing_flags |= BTM_PAIR_FLAGS_PIN_REQD;
-                if (p_cb->api.p_pin_callback)
-                    (*p_cb->api.p_pin_callback) (p_bda, p_dev_rec->dev_class,
-                                                 p_dev_rec->sec_bd_name, (p_dev_rec->p_cur_service == NULL) ? FALSE
-                                                 : (p_dev_rec->p_cur_service->security_flags
-                                                    & BTM_SEC_IN_MIN_16_DIGIT_PIN));
-            }
+        BTM_TRACE_EVENT ("btm_sec_pin_code_request going for callback\n");
+        btm_cb.pairing_flags |= BTM_PAIR_FLAGS_PIN_REQD;
+        if (p_cb->api.p_pin_callback) {
+            (*p_cb->api.p_pin_callback) (p_bda, p_dev_rec->dev_class, p_dev_rec->sec_bd_name,
+                                         (p_dev_rec->p_cur_service == NULL) ? FALSE
+                                         : (p_dev_rec->p_cur_service->security_flags
+                                            & BTM_SEC_IN_MIN_16_DIGIT_PIN));
        }
    }
    return;
--- a/components/bt/bluedroid/stack/btm/include/btm_int.h
+++ b/components/bt/bluedroid/stack/btm/include/btm_int.h
@@ -489,12 +489,13 @@ typedef struct {
    tBTM_LE_KEY_TYPE    key_type;       /* bit mask of valid key types in record */
    tBTM_SEC_BLE_KEYS   keys;           /* LE device security info in slave rode */
    bool skip_update_conn_param;        /* skip update connection paraams or not*/
+    UINT16 auth_mode;                   /* Authentication mode */
 #endif
 #if (BLE_PRIVACY_SPT == TRUE)
-    tBLE_ADDR_TYPE      current_addr_type; /* current adv addr type*/  
+    tBLE_ADDR_TYPE      current_addr_type; /* current adv addr type*/
    BD_ADDR             current_addr;      /* current adv addr*/
    bool                current_addr_valid; /* current addr info is valid or not*/
-#endif   
+#endif
 } tBTM_SEC_BLE;


@@ -1062,7 +1063,7 @@ void btm_report_device_status (tBTM_DEV_STATUS status);
 BOOLEAN btm_dev_support_switch (BD_ADDR bd_addr);

 tBTM_SEC_DEV_REC  *btm_sec_alloc_dev (BD_ADDR bd_addr);
-void               btm_sec_free_dev (tBTM_SEC_DEV_REC *p_dev_rec);
+void              btm_sec_free_dev (tBTM_SEC_DEV_REC *p_dev_rec, tBT_TRANSPORT transport);
 tBTM_SEC_DEV_REC  *btm_find_dev (BD_ADDR bd_addr);
 tBTM_SEC_DEV_REC  *btm_find_or_alloc_dev (BD_ADDR bd_addr);
 tBTM_SEC_DEV_REC  *btm_find_dev_by_handle (UINT16 handle);
--- a/components/bt/bluedroid/stack/include/stack/btm_api.h
+++ b/components/bt/bluedroid/stack/include/stack/btm_api.h
@@ -1642,6 +1642,7 @@ typedef struct {
    UINT8 sec_level;
    BOOLEAN is_pair_cancel;
    BOOLEAN smp_over_br;
+    tSMP_AUTH_REQ auth_mode;
 } tBTM_LE_COMPLT;
 #endif

@@ -3417,8 +3418,7 @@ BOOLEAN BTM_SecAddDevice (BD_ADDR bd_addr, DEV_CLASS dev_class,
 **
 *******************************************************************************/
 //extern
-BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr);
-
+BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr, tBT_TRANSPORT transport);

 /*******************************************************************************
 **
--- a/components/bt/bluedroid/stack/include/stack/btm_ble_api.h
+++ b/components/bt/bluedroid/stack/include/stack/btm_ble_api.h
@@ -375,10 +375,7 @@ typedef UINT8   tBTM_BLE_AD_TYPE;

 /* adv tx power level */
 #define BTM_BLE_ADV_TX_POWER_MIN        0           /* minimum tx power */
-#define BTM_BLE_ADV_TX_POWER_LOW        1           /* low tx power     */
-#define BTM_BLE_ADV_TX_POWER_MID        2           /* middle tx power  */
-#define BTM_BLE_ADV_TX_POWER_UPPER      3           /* upper tx power   */
-#define BTM_BLE_ADV_TX_POWER_MAX        4           /* maximum tx power */
+#define BTM_BLE_ADV_TX_POWER_MAX        7           /* maximum tx power */
 typedef UINT8 tBTM_BLE_ADV_TX_POWER;

 /* adv tx power in dBm */
@@ -906,13 +903,14 @@ void BTM_BleRegiseterConnParamCallback(tBTM_UPDATE_CONN_PARAM_CBACK *update_conn
 **                  bd_name          - Name of the peer device.  NULL if unknown.
 **                  dev_type         - Remote device's device type.
 **                  addr_type        - LE device address type.
+**                  auth_mode        - auth mode
 **
 ** Returns          TRUE if added OK, else FALSE
 **
 *******************************************************************************/
 //extern
 BOOLEAN BTM_SecAddBleDevice (BD_ADDR bd_addr, BD_NAME bd_name,
-                             tBT_DEVICE_TYPE dev_type, tBLE_ADDR_TYPE addr_type);
+                             tBT_DEVICE_TYPE dev_type, tBLE_ADDR_TYPE addr_type, UINT32 auth_mode);

 /*******************************************************************************
 **
@@ -1318,6 +1316,21 @@ void BTM_SecurityGrant(BD_ADDR bd_addr, UINT8 res);
 //extern
 void BTM_BlePasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey);

+/*******************************************************************************
+**
+** Function         BTM_BleSetStaticPasskey
+**
+** Description      This function is called to set static passkey
+**
+**
+** Parameters:      add          - set static passkey when add is TRUE
+**                                 clear static passkey when add is FALSE
+**                  passkey      - static passkey
+**
+**
+*******************************************************************************/
+void BTM_BleSetStaticPasskey(BOOLEAN add, UINT32 passkey);
+
 /*******************************************************************************
 **
 ** Function         BTM_BleConfirmReply
--- a/components/bt/bluedroid/stack/include/stack/dyn_mem.h
+++ b/components/bt/bluedroid/stack/include/stack/dyn_mem.h
@@ -51,6 +51,7 @@
 #define SLIP_DYNAMIC_MEMORY        TRUE
 #define LLCP_DYNAMIC_MEMORY        TRUE
 #define BTC_SBC_DEC_DYNAMIC_MEMORY TRUE
+#define BTC_SBC_ENC_DYNAMIC_MEMORY TRUE

 #else  /* #if CONFIG_BT_BLE_DYNAMIC_ENV_MEMORY */

@@ -79,6 +80,7 @@
 #define SLIP_DYNAMIC_MEMORY        FALSE
 #define LLCP_DYNAMIC_MEMORY        FALSE
 #define BTC_SBC_DEC_DYNAMIC_MEMORY FALSE
+#define BTC_SBC_ENC_DYNAMIC_MEMORY FALSE

 #endif /* #if CONFIG_BT_BLE_DYNAMIC_ENV_MEMORY */
 /****************************************************************************
--- a/components/bt/bluedroid/stack/include/stack/hcimsgs.h
+++ b/components/bt/bluedroid/stack/include/stack/hcimsgs.h
@@ -275,7 +275,10 @@ BOOLEAN btsnd_hcic_hold_mode(UINT16 handle, UINT16 max_hold_period,
 #define HCI_HOLD_MODE_MIN_PER_OFF       4
 /* Hold Mode */

-/* Sniff Mode */
+/**
+ * Sniff Mode
+ * sniff_attempt more than 0xFF is not supported
+ */
 BOOLEAN btsnd_hcic_sniff_mode(UINT16 handle,
                              UINT16 max_sniff_period,
                              UINT16 min_sniff_period,
--- a/components/bt/bluedroid/stack/include/stack/smp_api.h
+++ b/components/bt/bluedroid/stack/include/stack/smp_api.h
@@ -224,6 +224,7 @@ typedef struct {
    tSMP_SEC_LEVEL sec_level;
    BOOLEAN is_pair_cancel;
    BOOLEAN smp_over_br;
+    tSMP_AUTH_REQ auth_mode;
 } tSMP_CMPL;

 typedef struct {
@@ -401,6 +402,21 @@ extern void SMP_SecurityGrant(BD_ADDR bd_addr, UINT8 res);
 *******************************************************************************/
 extern void SMP_PasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey);

+/*******************************************************************************
+**
+** Function         SMP_SetStaticPasskey
+**
+** Description      This function is called to set static passkey
+**
+**
+** Parameters:      add          - set static passkey when add is TRUE
+**                                 clear static passkey when add is FALSE
+**                  passkey      - static passkey
+**
+**
+*******************************************************************************/
+extern void SMP_SetStaticPasskey (BOOLEAN add, UINT32 passkey);
+
 /*******************************************************************************
 **
 ** Function         SMP_ConfirmReply
--- a/components/bt/bluedroid/stack/l2cap/l2c_api.c
+++ b/components/bt/bluedroid/stack/l2cap/l2c_api.c
@@ -1845,7 +1845,7 @@ BOOLEAN L2CA_CheckIsCongest(UINT16 fixed_cid, UINT16 handle)
    tL2C_LCB *p_lcb;
    p_lcb = l2cu_find_lcb_by_handle(handle);

-    if (p_lcb != NULL) {
+    if (p_lcb != NULL && p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL] != NULL) {
        return p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->cong_sent;
    }

--- a/components/bt/bluedroid/stack/l2cap/l2c_ble.c
+++ b/components/bt/bluedroid/stack/l2cap/l2c_ble.c
@@ -813,17 +813,17 @@ BOOLEAN l2cble_init_direct_conn (tL2C_LCB *p_lcb)
            memcpy(peer_addr, p_dev_rec->ble.current_addr, 6);
        } else {
            /* find security device information but not find the real address information
-             * This state may be directly open whithout scanning. In this case, you must 
+             * This state may be directly open without scanning. In this case, you must
             * use the current adv address of the device to open*/
-        } 
+        }
    } else {
        //not find security device information, We think this is a new device, connect directly
    }

    /* It will cause that scanner doesn't send scan request to advertiser
    * which has sent IRK to us and we have stored the IRK in controller.
-    * It is a design problem of hardware. The temporal solution is not to 
-    * send the key to the controller and then resolve the random address in host.
+    * It is a hardware limitation. The preliminary solution is not to
+    * send key to the controller, but to resolve the random address in host.
    * so we need send the real address information to controller. */
    /*
    if (p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) {
--- a/components/bt/bluedroid/stack/rfcomm/rfc_ts_frames.c
+++ b/components/bt/bluedroid/stack/rfcomm/rfc_ts_frames.c
@@ -23,6 +23,7 @@
 ******************************************************************************/

 #include <stddef.h>
+#include <string.h>
 #include "common/bt_target.h"
 #include "stack/rfcdefs.h"
 #include "stack/port_api.h"
@@ -513,6 +514,13 @@ void rfc_send_test (tRFC_MCB *p_mcb, BOOLEAN is_command, BT_HDR *p_buf)
    UINT16   xx;
    UINT8    *p_src, *p_dest;

+    BT_HDR *p_buf_new;
+    if ((p_buf_new = (BT_HDR *)osi_malloc(RFCOMM_CMD_BUF_SIZE)) == NULL) {
+        return;
+    }
+    memcpy(p_buf_new, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);
+    osi_free(p_buf);
+    p_buf = p_buf_new;
    /* Shift buffer to give space for header */
    if (p_buf->offset < (L2CAP_MIN_OFFSET + RFCOMM_MIN_OFFSET + 2)) {
        p_src  = (UINT8 *) (p_buf + 1) + p_buf->offset + p_buf->len - 1;
--- a/components/bt/bluedroid/stack/sdp/sdp_discovery.c
+++ b/components/bt/bluedroid/stack/sdp/sdp_discovery.c
@@ -354,15 +354,17 @@ static void sdp_copy_raw_data (tCONN_CB *p_ccb, BOOLEAN offset)
            type = *p++;
            p = sdpu_get_len_from_type (p, type, &list_len);
        }
-        if (list_len && list_len < cpy_len ) {
+        if (list_len < cpy_len ) {
            cpy_len = list_len;
        }
 #if (SDP_DEBUG_RAW == TRUE)
-        SDP_TRACE_WARNING("list_len :%d cpy_len:%d raw_size:%d raw_used:%d\n",
+        SDP_TRACE_DEBUG("list_len :%d cpy_len:%d raw_size:%d raw_used:%d\n",
                          list_len, cpy_len, p_ccb->p_db->raw_size, p_ccb->p_db->raw_used);
 #endif
-        memcpy (&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
-        p_ccb->p_db->raw_used += cpy_len;
+        if (cpy_len != 0){
+            memcpy (&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
+            p_ccb->p_db->raw_used += cpy_len;
+        }
    }
 }
 #endif
--- a/components/bt/bluedroid/stack/smp/include/smp_int.h
+++ b/components/bt/bluedroid/stack/smp/include/smp_int.h
@@ -132,6 +132,8 @@ typedef UINT8 tSMP_EVENT;
 /* Assumption it's only using the low 8 bits, if bigger than that, need to expand it to 16 bits */
 #define SMP_SEC_KEY_MASK                    0x00ff

+#define SMP_PASSKEY_MASK    0xfff00000
+
 /* SMP pairing state */
 enum {
    SMP_STATE_IDLE,
@@ -299,6 +301,7 @@ typedef struct {
    tSMP_OOB_FLAG   loc_oob_flag;
    tSMP_AUTH_REQ   peer_auth_req;
    tSMP_AUTH_REQ   loc_auth_req;
+    tSMP_AUTH_REQ   auth_mode;
    BOOLEAN         secure_connections_only_mode_required;/* TRUE if locally SM is required to operate */
    /* either in Secure Connections mode or not at all */
    tSMP_ASSO_MODEL selected_association_model;
@@ -331,6 +334,10 @@ typedef struct {
    UINT8           rcvd_cmd_len;
    UINT16          total_tx_unacked;
    BOOLEAN         wait_for_authorization_complete;
+    BOOLEAN         use_static_passkey;
+    UINT32          static_passkey;
+    BOOLEAN         accept_specified_sec_auth;
+    tSMP_AUTH_REQ   origin_loc_auth_req;
 } tSMP_CB;

 /* Server Action functions are of this type */
--- a/components/bt/bluedroid/stack/smp/smp_act.c
+++ b/components/bt/bluedroid/stack/smp/smp_act.c
@@ -52,6 +52,9 @@ const tSMP_ACT smp_distribute_act [] = {
    smp_set_derive_link_key
 };

+extern UINT8 bta_dm_co_ble_get_accept_auth_enable(void);
+extern UINT8 bta_dm_co_ble_get_auth_req(void);
+
 static bool lmp_version_below(BD_ADDR bda, uint8_t version)
 {
    tACL_CONN *acl = btm_bda_to_acl(bda, BT_TRANSPORT_LE);
@@ -498,6 +501,33 @@ void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
    p_cb->status = *(UINT8 *)p_data;
 }

+/*******************************************************************************
+** Function     smp_get_auth_mode
+** Description  Get the SMP pairing auth mode
+*******************************************************************************/
+uint16_t smp_get_auth_mode (tSMP_ASSO_MODEL model)
+{
+    SMP_TRACE_DEBUG("%s model %d", __func__, model);
+    uint16_t auth = 0;
+    if (model == SMP_MODEL_ENCRYPTION_ONLY || model == SMP_MODEL_SEC_CONN_JUSTWORKS) {
+        //No MITM
+        if(model == SMP_MODEL_SEC_CONN_JUSTWORKS) {
+            //SC SMP_SC_SUPPORT_BIT
+            auth |=  SMP_SC_SUPPORT_BIT;
+        }
+    } else if (model <= SMP_MODEL_KEY_NOTIF) {
+        //NO SC, MITM
+        auth |= SMP_AUTH_YN_BIT;
+    } else if (model <= SMP_MODEL_SEC_CONN_OOB) {
+        //SC, MITM
+        auth |= SMP_SC_SUPPORT_BIT;
+        auth |= SMP_AUTH_YN_BIT;
+    } else {
+        auth = 0;
+    }
+    return auth;
+} 
+
 /*******************************************************************************
 ** Function     smp_proc_pair_cmd
 ** Description  Process the SMP pairing request/response from peer device
@@ -528,7 +558,8 @@ void smp_proc_pair_cmd(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
        return;
    }
-
+    p_cb->accept_specified_sec_auth = bta_dm_co_ble_get_accept_auth_enable();
+    p_cb->origin_loc_auth_req = bta_dm_co_ble_get_auth_req();
    if (p_cb->role == HCI_ROLE_SLAVE) {
        if (!(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)) {
            /* peer (master) started pairing sending Pairing Request */
@@ -551,6 +582,23 @@ void smp_proc_pair_cmd(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
                smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
                return;
            }
+            uint16_t auth = smp_get_auth_mode(p_cb->selected_association_model);
+            if(p_cb->peer_auth_req & p_cb->loc_auth_req & SMP_AUTH_GEN_BOND) {
+                auth |= SMP_AUTH_GEN_BOND;
+            }
+            p_cb->auth_mode = auth;
+            if (p_cb->accept_specified_sec_auth) {
+                if ((auth & p_cb->origin_loc_auth_req) != p_cb->origin_loc_auth_req ) {
+                    SMP_TRACE_ERROR("%s pairing failed - slave requires auth is 0x%x but peer auth is 0x%x local auth is 0x%x",
+                                    __func__, p_cb->origin_loc_auth_req, p_cb->peer_auth_req, p_cb->loc_auth_req);
+                    if (BTM_IsAclConnectionUp(p_cb->pairing_bda, BT_TRANSPORT_LE)) {
+                        btm_remove_acl (p_cb->pairing_bda, BT_TRANSPORT_LE);
+                    }
+                    reason = SMP_PAIR_AUTH_FAIL;
+                    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+                    return;
+                }
+            }

            if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB) {
                if (smp_request_oob_data(p_cb)) {
@@ -573,6 +621,24 @@ void smp_proc_pair_cmd(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
            return;
        }

+        uint16_t auth = smp_get_auth_mode(p_cb->selected_association_model);
+        if(p_cb->peer_auth_req & p_cb->loc_auth_req & SMP_AUTH_GEN_BOND) {
+            auth |= SMP_AUTH_GEN_BOND;
+        }
+        p_cb->auth_mode = auth;
+        if (p_cb->accept_specified_sec_auth) {
+            if ((auth & p_cb->origin_loc_auth_req) != p_cb->origin_loc_auth_req ) {
+                SMP_TRACE_ERROR("%s pairing failed - master requires auth is 0x%x but peer auth is 0x%x local auth is 0x%x",
+                                    __func__, p_cb->origin_loc_auth_req, p_cb->peer_auth_req, p_cb->loc_auth_req);
+                if (BTM_IsAclConnectionUp(p_cb->pairing_bda, BT_TRANSPORT_LE)) {
+                    btm_remove_acl (p_cb->pairing_bda, BT_TRANSPORT_LE);
+                }
+                reason = SMP_PAIR_AUTH_FAIL;
+                smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+                return;
+            }
+        }
+
        if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB) {
            if (smp_request_oob_data(p_cb)) {
                return;
@@ -1299,7 +1365,6 @@ void smp_decide_association_model(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 void smp_process_io_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 {
    uint8_t reason = SMP_PAIR_AUTH_FAIL;
-
    SMP_TRACE_DEBUG("%s\n", __func__);
    if (p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD) {
        /* pairing started by local (slave) Security Request */
@@ -1317,6 +1382,23 @@ void smp_process_io_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
            smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
            return;
        }
+        uint16_t auth = smp_get_auth_mode(p_cb->selected_association_model);
+        if(p_cb->peer_auth_req & p_cb->loc_auth_req & SMP_AUTH_GEN_BOND) {
+            auth |= SMP_AUTH_GEN_BOND;
+        }
+        p_cb->auth_mode = auth;
+        if (p_cb->accept_specified_sec_auth) {
+            if ((auth & p_cb->origin_loc_auth_req) != p_cb->origin_loc_auth_req ) {
+                SMP_TRACE_ERROR("pairing failed - slave requires auth is 0x%x but peer auth is 0x%x local auth is 0x%x",
+                                    p_cb->origin_loc_auth_req, p_cb->peer_auth_req, p_cb->loc_auth_req);
+                if (BTM_IsAclConnectionUp(p_cb->pairing_bda, BT_TRANSPORT_LE)) {
+                    btm_remove_acl (p_cb->pairing_bda, BT_TRANSPORT_LE);
+                }
+                reason = SMP_PAIR_AUTH_FAIL;
+                smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+                return;
+            }
+        }

        if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB) {
            if (smp_request_oob_data(p_cb)) {
--- a/components/bt/bluedroid/stack/smp/smp_api.c
+++ b/components/bt/bluedroid/stack/smp/smp_api.c
@@ -328,6 +328,32 @@ void SMP_PasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey)
    return;
 }

+/*******************************************************************************
+**
+** Function         SMP_SetStaticPasskey
+**
+** Description      This function is called to set static passkey
+**
+**
+** Parameters:      add          - set static passkey when add is TRUE
+**                                 clear static passkey when add is FALSE
+**                  passkey      - static passkey
+**
+**
+*******************************************************************************/
+void SMP_SetStaticPasskey (BOOLEAN add, UINT32 passkey)
+{
+    SMP_TRACE_DEBUG("static passkey %6d", passkey);
+    tSMP_CB *p_cb = & smp_cb;
+    if(add) {
+        p_cb->static_passkey = passkey;
+        p_cb->use_static_passkey = true;
+    } else {
+        p_cb->static_passkey = 0;
+        p_cb->use_static_passkey = false;
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         SMP_ConfirmReply
--- a/components/bt/bluedroid/stack/smp/smp_keys.c
+++ b/components/bt/bluedroid/stack/smp/smp_keys.c
@@ -71,8 +71,6 @@ static const tSMP_ACT smp_encrypt_action[] = {
    smp_generate_rand_cont         /* SMP_GEN_SRAND_MRAND_CONT */
 };

-#define SMP_PASSKEY_MASK    0xfff00000
-
 void smp_debug_print_nbyte_little_endian(UINT8 *p, const UINT8 *key_name, UINT8 len)
 {
 #if SMP_DEBUG == TRUE
@@ -186,6 +184,29 @@ BOOLEAN smp_encrypt_data (UINT8 *key, UINT8 key_len,
    return TRUE;
 }

+void smp_use_static_passkey(void)
+{
+    tSMP_CB *p_cb = &smp_cb;
+    UINT8   *tt = p_cb->tk;
+    tSMP_KEY    key;
+    UINT32  passkey = p_cb->static_passkey;
+    /* save the TK */
+    memset(p_cb->tk, 0, BT_OCTET16_LEN);
+    UINT32_TO_STREAM(tt, passkey);
+
+    key.key_type = SMP_KEY_TYPE_TK;
+    key.p_data  = p_cb->tk;
+
+    if (p_cb->p_callback) {
+        (*p_cb->p_callback)(SMP_PASSKEY_NOTIF_EVT, p_cb->pairing_bda, (tSMP_EVT_DATA *)&passkey);
+    }
+
+    if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_PASSKEY_DISP) {
+        smp_sm_event(&smp_cb, SMP_KEY_READY_EVT, &passkey);
+    } else {
+        smp_sm_event(p_cb, SMP_KEY_READY_EVT, (tSMP_INT_DATA *)&key);
+    }
+}
 /*******************************************************************************
 **
 ** Function         smp_generate_passkey
@@ -199,7 +220,12 @@ void smp_generate_passkey(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 {
    UNUSED(p_data);

-    SMP_TRACE_DEBUG ("%s", __func__);
+    if(p_cb->use_static_passkey) {
+        SMP_TRACE_DEBUG ("%s use static passkey %6d", __func__, p_cb->static_passkey);
+        smp_use_static_passkey();
+        return;
+    }
+    SMP_TRACE_DEBUG ("%s generate rand passkey", __func__);
    p_cb->rand_enc_proc_state = SMP_GEN_TK;

    /* generate MRand or SRand */
--- a/components/bt/bluedroid/stack/smp/smp_utils.c
+++ b/components/bt/bluedroid/stack/smp/smp_utils.c
@@ -877,16 +877,21 @@ void smp_xor_128(BT_OCTET16 a, BT_OCTET16 b)
 ** Returns          void
 **
 *******************************************************************************/
-void smp_cb_cleanup(tSMP_CB   *p_cb)
+void smp_cb_cleanup(tSMP_CB *p_cb)
 {
    tSMP_CALLBACK   *p_callback = p_cb->p_callback;
    UINT8           trace_level = p_cb->trace_level;
-
+    UINT32          static_passkey = p_cb->static_passkey;
+    BOOLEAN         use_static_passkey = p_cb->use_static_passkey;
    SMP_TRACE_EVENT("smp_cb_cleanup\n");

    memset(p_cb, 0, sizeof(tSMP_CB));
    p_cb->p_callback = p_callback;
    p_cb->trace_level = trace_level;
+    if(use_static_passkey) {
+        p_cb->use_static_passkey = use_static_passkey;
+        p_cb->static_passkey = static_passkey;
+    }
 }

 /*******************************************************************************
@@ -951,15 +956,23 @@ void smp_proc_pairing_cmpl(tSMP_CB *p_cb)
    tSMP_EVT_DATA   evt_data = {0};
    tSMP_CALLBACK   *p_callback = p_cb->p_callback;
    BD_ADDR         pairing_bda;
-    tBTM_SEC_DEV_REC    *p_rec;
+    tBTM_SEC_DEV_REC    *p_rec = btm_find_dev (p_cb->pairing_bda);

    SMP_TRACE_DEBUG ("smp_proc_pairing_cmpl \n");

    evt_data.cmplt.reason = p_cb->status;
    evt_data.cmplt.smp_over_br = p_cb->smp_over_br;
-
+    evt_data.cmplt.auth_mode = 0;
    if (p_cb->status == SMP_SUCCESS) {
        evt_data.cmplt.sec_level = p_cb->sec_level;
+        if (p_cb->auth_mode) { // the first encryption
+            evt_data.cmplt.auth_mode = p_cb->auth_mode;
+            if (p_rec) {
+                p_rec->ble.auth_mode = p_cb->auth_mode;
+            }
+        } else if (p_rec) {
+            evt_data.cmplt.auth_mode =  p_rec->ble.auth_mode;
+        }
    }

    evt_data.cmplt.is_pair_cancel  = FALSE;
@@ -976,7 +989,6 @@ void smp_proc_pairing_cmpl(tSMP_CB *p_cb)
    memcpy (pairing_bda, p_cb->pairing_bda, BD_ADDR_LEN);

    if (p_cb->role == HCI_ROLE_SLAVE) {
-        p_rec = btm_find_dev (p_cb->pairing_bda);
        if(p_rec && p_rec->ble.skip_update_conn_param) {
            //clear flag
            p_rec->ble.skip_update_conn_param = false;
--- a/components/bt/bt.c
+++ b/components/bt/bt.c
@@ -66,7 +66,7 @@ extern int btdm_controller_enable(esp_bt_mode_t mode);
 extern void btdm_controller_disable(void);
 extern uint8_t btdm_controller_get_mode(void);
 extern const char *btdm_controller_get_compile_version(void);
-extern void btdm_rf_bb_init(void);
+extern void btdm_rf_bb_init_phase2(void); // shall be called after PHY/RF is enabled
 extern void btdm_controller_enable_sleep(bool enable);

 #define BTDM_MODEM_SLEEP_MODE_NONE          (0)
@@ -84,7 +84,10 @@ extern void btdm_wakeup_request(void);
 extern bool btdm_lpclk_select_src(uint32_t sel);
 extern bool btdm_lpclk_set_div(uint32_t div);

-#define BTDM_MIN_SLEEP_DURATION  (20)
+/* Sleep and wakeup interval control */
+#define BTDM_MIN_SLEEP_DURATION          (12) // threshold of interval in slots to allow to fall into modem sleep
+#define BTDM_MODEM_WAKE_UP_DELAY         (4)  // delay in slots of modem wake up procedure, including re-enable PHY/RF
+
 /* VHCI function interface */
 typedef struct vhci_host_callback {
    void (*notify_host_send_available)(void);               /*!< callback used to notify that the host can send packet to controller */
@@ -148,8 +151,8 @@ typedef struct {
    void *buffer;
 } btdm_queue_item_t;
 #define BTDM_MAX_QUEUE_NUM       (5)
-static btdm_queue_item_t btdm_queue_table[BTDM_MAX_QUEUE_NUM];
-SemaphoreHandle_t btdm_queue_table_mux = NULL;
+static DRAM_ATTR btdm_queue_item_t btdm_queue_table[BTDM_MAX_QUEUE_NUM];
+static DRAM_ATTR SemaphoreHandle_t btdm_queue_table_mux = NULL;
 #endif /* #if CONFIG_SPIRAM_USE_MALLOC */

 struct osi_funcs_t {
@@ -187,25 +190,43 @@ struct osi_funcs_t {
    uint32_t (* _btdm_lpcycles_2_us)(uint32_t cycles);
    uint32_t (* _btdm_us_2_lpcycles)(uint32_t us);
    bool (* _btdm_sleep_check_duration)(uint32_t *slot_cnt);
-    void (* _btdm_sleep_enter)(void);
-    void (* _btdm_sleep_exit)(void);  /* called from ISR */
+    void (* _btdm_sleep_enter_phase1)(uint32_t lpcycles);  /* called when interrupt is disabled */
+    void (* _btdm_sleep_enter_phase2)(void);
+    void (* _btdm_sleep_exit_phase1)(void);  /* called from ISR */
+    void (* _btdm_sleep_exit_phase2)(void);  /* called from ISR */
+    void (* _btdm_sleep_exit_phase3)(void);  /* called from task */
 };


 /* Static variable declare */
-static bool btdm_bb_init_flag = false;
-static esp_bt_controller_status_t btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
+// timestamp when PHY/RF was switched on
+static DRAM_ATTR int64_t s_time_phy_rf_just_enabled = 0;
+static DRAM_ATTR esp_bt_controller_status_t btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;

-static portMUX_TYPE global_int_mux = portMUX_INITIALIZER_UNLOCKED;
+static DRAM_ATTR portMUX_TYPE global_int_mux = portMUX_INITIALIZER_UNLOCKED;

 // measured average low power clock period in micro seconds
-static uint32_t btdm_lpcycle_us = 0;
-static uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit for btdm_lpcycle_us
+static DRAM_ATTR uint32_t btdm_lpcycle_us = 0;
+static DRAM_ATTR uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit for btdm_lpcycle_us

 #ifdef CONFIG_PM_ENABLE
-static esp_pm_lock_handle_t s_pm_lock;
+static DRAM_ATTR esp_timer_handle_t s_btdm_slp_tmr;
+static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock;
+static DRAM_ATTR esp_pm_lock_handle_t s_light_sleep_pm_lock; // pm_lock to prevent light sleep due to incompatibility currently
+static DRAM_ATTR QueueHandle_t s_pm_lock_sem = NULL;
 #endif

+static inline void btdm_check_and_init_bb(void)
+{
+    /* init BT-BB if PHY/RF has been switched off since last BT-BB init */
+    int64_t latest_ts = esp_phy_rf_get_on_ts();
+    if (latest_ts != s_time_phy_rf_just_enabled ||
+        s_time_phy_rf_just_enabled == 0) {
+        btdm_rf_bb_init_phase2();
+        s_time_phy_rf_just_enabled = latest_ts;
+    }
+}
+
 #if CONFIG_SPIRAM_USE_MALLOC
 bool IRAM_ATTR btdm_queue_generic_register(const btdm_queue_item_t *queue)
 {
@@ -583,7 +604,7 @@ static int IRAM_ATTR rand_wrapper(void)

 static uint32_t IRAM_ATTR btdm_lpcycles_2_us(uint32_t cycles)
 {
-    // The number of lp cycles should not lead to overflow. Thrs: 100s (for 32kHz freq)
+    // The number of lp cycles should not lead to overflow. Thrs: 100s
    // clock measurement is conducted
    uint64_t us = (uint64_t)btdm_lpcycle_us * cycles;
    us = (us + (1 << (btdm_lpcycle_us_frac - 1))) >> btdm_lpcycle_us_frac;
@@ -608,16 +629,41 @@ static bool IRAM_ATTR btdm_sleep_check_duration(uint32_t *slot_cnt)
    if (*slot_cnt < BTDM_MIN_SLEEP_DURATION) {
        return false;
    }
-    /* wake up 3 slots in advance */
-    *slot_cnt = *slot_cnt -3;
+    /* wake up in advance considering the delay in enabling PHY/RF */
+    *slot_cnt -= BTDM_MODEM_WAKE_UP_DELAY;
    return true;
 }

-static void IRAM_ATTR btdm_sleep_enter_wrapper(void)
+static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
+{
+#ifdef CONFIG_PM_ENABLE
+    // start a timer to wake up and acquire the pm_lock before modem_sleep awakes
+    uint32_t us_to_sleep = btdm_lpcycles_2_us(lpcycles);
+
+#define BTDM_MIN_TIMER_UNCERTAINTY_US      (1800)
+    assert(us_to_sleep > BTDM_MIN_TIMER_UNCERTAINTY_US);
+    // allow a maximum time uncertainty to be about 488ppm(1/2048) at least as clock drift
+    // and set the timer in advance
+    uint32_t uncertainty = (us_to_sleep >> 11);
+    if (uncertainty < BTDM_MIN_TIMER_UNCERTAINTY_US) {
+        uncertainty = BTDM_MIN_TIMER_UNCERTAINTY_US;
+    }
+
+    if (esp_timer_start_once(s_btdm_slp_tmr, us_to_sleep - uncertainty) != ESP_OK) {
+        ESP_LOGW(BTDM_LOG_TAG, "timer start failed");
+    }
+#endif
+}
+
+static void btdm_sleep_enter_phase2_wrapper(void)
 {
    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
        esp_modem_sleep_enter(MODEM_BLE_MODULE);
        esp_modem_sleep_enter(MODEM_CLASSIC_BT_MODULE);
+#ifdef CONFIG_PM_ENABLE
+        esp_pm_lock_release(s_pm_lock);
+        semphr_give_wrapper(s_pm_lock_sem);
+#endif
    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
        esp_modem_sleep_enter(MODEM_BLE_MODULE);
        // pause bluetooth baseband
@@ -625,11 +671,24 @@ static void IRAM_ATTR btdm_sleep_enter_wrapper(void)
    }
 }

-static void IRAM_ATTR btdm_sleep_exit_wrapper(void)
+static void IRAM_ATTR btdm_sleep_exit_phase1_wrapper(void)
+{
+#ifdef CONFIG_PM_ENABLE
+    if (semphr_take_from_isr_wrapper(s_pm_lock_sem, NULL) == pdTRUE) {
+        esp_pm_lock_acquire(s_pm_lock);
+    }
+#endif
+}
+
+static void btdm_sleep_exit_phase3_wrapper(void)
 {
    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
        esp_modem_sleep_exit(MODEM_BLE_MODULE);
        esp_modem_sleep_exit(MODEM_CLASSIC_BT_MODULE);
+        btdm_check_and_init_bb();
+#ifdef CONFIG_PM_ENABLE
+        esp_timer_stop(s_btdm_slp_tmr);
+#endif
    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
        // resume bluetooth baseband
        periph_module_enable(PERIPH_BT_BASEBAND_MODULE);
@@ -637,7 +696,16 @@ static void IRAM_ATTR btdm_sleep_exit_wrapper(void)
    }
 }

-static struct osi_funcs_t osi_funcs = {
+#ifdef CONFIG_PM_ENABLE
+static void IRAM_ATTR btdm_slp_tmr_callback(void *arg)
+{
+    if (semphr_take_wrapper(s_pm_lock_sem, 0) == pdTRUE) {
+        esp_pm_lock_acquire(s_pm_lock);
+    }
+}
+#endif
+
+static DRAM_ATTR struct osi_funcs_t osi_funcs = {
    ._set_isr = xt_set_interrupt_handler,
    ._ints_on = xt_ints_on,
    ._interrupt_disable = interrupt_disable,
@@ -672,8 +740,11 @@ static struct osi_funcs_t osi_funcs = {
    ._btdm_lpcycles_2_us = btdm_lpcycles_2_us,
    ._btdm_us_2_lpcycles = btdm_us_2_lpcycles,
    ._btdm_sleep_check_duration = btdm_sleep_check_duration,
-    ._btdm_sleep_enter = btdm_sleep_enter_wrapper,
-    ._btdm_sleep_exit = btdm_sleep_exit_wrapper,
+    ._btdm_sleep_enter_phase1 = btdm_sleep_enter_phase1_wrapper,
+    ._btdm_sleep_enter_phase2 = btdm_sleep_enter_phase2_wrapper,
+    ._btdm_sleep_exit_phase1 = btdm_sleep_exit_phase1_wrapper,
+    ._btdm_sleep_exit_phase2 = NULL,
+    ._btdm_sleep_exit_phase3 = btdm_sleep_exit_phase3_wrapper,
 };

 bool esp_vhci_host_check_send_available(void)
@@ -684,6 +755,12 @@ bool esp_vhci_host_check_send_available(void)
 void esp_vhci_host_send_packet(uint8_t *data, uint16_t len)
 {
    if (!btdm_power_state_active()) {
+#if CONFIG_PM_ENABLE
+        if (semphr_take_wrapper(s_pm_lock_sem, 0)) {
+            esp_pm_lock_acquire(s_pm_lock);
+        }
+        esp_timer_stop(s_btdm_slp_tmr);
+#endif
        btdm_wakeup_request();
    }
    API_vhci_host_send_packet(data, len);
@@ -785,7 +862,7 @@ esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode)

 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 {
-    BaseType_t ret;
+    esp_err_t err;
    uint32_t btdm_cfg_mask = 0;

    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
@@ -806,27 +883,39 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        return ESP_ERR_INVALID_ARG;
    }

-#ifdef CONFIG_PM_ENABLE
-    esp_err_t err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock);
-    if (err != ESP_OK) {
-        return err;
-    }
-#endif
-
    ESP_LOGI(BTDM_LOG_TAG, "BT controller compile version [%s]\n", btdm_controller_get_compile_version());

 #if CONFIG_SPIRAM_USE_MALLOC
    btdm_queue_table_mux = xSemaphoreCreateMutex();
-    if (btdm_queue_table == NULL) {
-#ifdef CONFIG_PM_ENABLE
-        esp_pm_lock_delete(s_pm_lock);
-        s_pm_lock = NULL;
-#endif
+    if (btdm_queue_table_mux == NULL) {
        return ESP_ERR_NO_MEM;
    }
    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
 #endif

+#ifdef CONFIG_PM_ENABLE
+    if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+        goto error;
+    }
+    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+        goto error;
+    }
+    esp_timer_create_args_t create_args = {
+        .callback = btdm_slp_tmr_callback,
+        .arg = NULL,
+        .name = "btSlp"
+    };
+    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
+        goto error;
+    }
+
+    s_pm_lock_sem = semphr_create_wrapper(1, 0);
+    if (s_pm_lock_sem == NULL) {
+        err = ESP_ERR_NO_MEM;
+        goto error;
+    }
+#endif
+
    btdm_osi_funcs_register(&osi_funcs);

    btdm_controller_mem_init();
@@ -840,10 +929,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    bool set_div_ret = false;
 #if CONFIG_BTDM_LPCLK_SEL_MAIN_XTAL
    select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-    set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get() * 32 - 1);
+    set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get() * 2 - 1);
    assert(select_src_ret && set_div_ret);
    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 32 << btdm_lpcycle_us_frac;
+    btdm_lpcycle_us = 2 << btdm_lpcycle_us_frac;
 #elif CONFIG_BTDM_LPCLK_SEL_EXT_32K_XTAL
    select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
    set_div_ret = btdm_lpclk_set_div(0);
@@ -861,17 +950,34 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)

    btdm_cfg_mask = btdm_config_mask_load();

-    ret = btdm_controller_init(btdm_cfg_mask, cfg);
-    if (ret) {
-#ifdef CONFIG_PM_ENABLE
-        esp_pm_lock_delete(s_pm_lock);
-        s_pm_lock = NULL;
-#endif
-        return ESP_ERR_NO_MEM;
+    if (btdm_controller_init(btdm_cfg_mask, cfg) != 0) {
+        err = ESP_ERR_NO_MEM;
+        goto error;
    }

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
+
    return ESP_OK;
+error:
+#ifdef CONFIG_PM_ENABLE
+    if (s_light_sleep_pm_lock != NULL) {
+        esp_pm_lock_delete(s_light_sleep_pm_lock);
+        s_light_sleep_pm_lock = NULL;
+    }
+    if (s_pm_lock != NULL) {
+        esp_pm_lock_delete(s_pm_lock);
+        s_pm_lock = NULL;
+    }
+    if (s_btdm_slp_tmr != NULL) {
+        esp_timer_delete(s_btdm_slp_tmr);
+        s_btdm_slp_tmr = NULL;
+    }
+    if (s_pm_lock_sem) {
+        semphr_delete_wrapper(s_pm_lock_sem);
+        s_pm_lock_sem = NULL;
+    }
+#endif
+    return err;
 }

 esp_err_t esp_bt_controller_deinit(void)
@@ -884,6 +990,18 @@ esp_err_t esp_bt_controller_deinit(void)

    periph_module_disable(PERIPH_BT_MODULE);

+#ifdef CONFIG_PM_ENABLE
+    esp_pm_lock_delete(s_light_sleep_pm_lock);
+    s_light_sleep_pm_lock = NULL;
+    esp_pm_lock_delete(s_pm_lock);
+    s_pm_lock = NULL;
+    esp_timer_stop(s_btdm_slp_tmr);
+    esp_timer_delete(s_btdm_slp_tmr);
+    s_btdm_slp_tmr = NULL;
+    semphr_delete_wrapper(s_pm_lock_sem);
+    s_pm_lock_sem = NULL;
+#endif
+
 #if CONFIG_SPIRAM_USE_MALLOC
    vSemaphoreDelete(btdm_queue_table_mux);
    btdm_queue_table_mux = NULL;
@@ -894,10 +1012,6 @@ esp_err_t esp_bt_controller_deinit(void)

    btdm_lpcycle_us = 0;
    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-#ifdef CONFIG_PM_ENABLE
-    esp_pm_lock_delete(s_pm_lock);
-    s_pm_lock = NULL;
-#endif

    return ESP_OK;
 }
@@ -916,6 +1030,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
    }

 #ifdef CONFIG_PM_ENABLE
+    esp_pm_lock_acquire(s_light_sleep_pm_lock);
    esp_pm_lock_acquire(s_pm_lock);
 #endif

@@ -939,10 +1054,8 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
        btdm_controller_enable_sleep(true);
    }

-    if (btdm_bb_init_flag == false) {
-        btdm_bb_init_flag = true;
-        btdm_rf_bb_init();  /* only initialise once */
-    }
+    // inititalize bluetooth baseband
+    btdm_check_and_init_bb();

    ret = btdm_controller_enable(mode);
    if (ret) {
@@ -955,6 +1068,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
        }
        esp_phy_rf_deinit(PHY_BT_MODULE);
 #ifdef CONFIG_PM_ENABLE
+        esp_pm_lock_release(s_light_sleep_pm_lock);
        esp_pm_lock_release(s_pm_lock);
 #endif
        return ESP_ERR_INVALID_STATE;
@@ -995,6 +1109,7 @@ esp_err_t esp_bt_controller_disable(void)
    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;

 #ifdef CONFIG_PM_ENABLE
+    esp_pm_lock_release(s_light_sleep_pm_lock);
    esp_pm_lock_release(s_pm_lock);
 #endif

--- a/components/bt/include/esp_bt.h
+++ b/components/bt/include/esp_bt.h
@@ -334,7 +334,6 @@ esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode);
 *
 * For ORIG mode:
 * Bluetooth modem sleep is enabled in controller start up by default if CONFIG_BTDM_CONTROLLER_MODEM_SLEEP is set and "ORIG mode" is selected. In ORIG modem sleep mode, bluetooth controller will switch off some components and pause to work every now and then, if there is no event to process; and wakeup according to the scheduled interval and resume the work. It can also wakeup earlier upon external request using function "esp_bt_controller_wakeup_request".
- * Note that currently there is problem in the combination use of bluetooth modem sleep and Dynamic Frequency Scaling(DFS). So do not enable DFS if bluetooth modem sleep is in use.
 *
 * @return
 *                  - ESP_OK : success
--- a/components/bt/lib
+++ b/components/bt/lib
--- a/components/bt/test/component.mk
+++ b/components/bt/test/component.mk
@@ -1,5 +1,5 @@
-#
-#Component Makefile
-#
-
+ifdef CONFIG_BT_ENABLED
 COMPONENT_ADD_LDFLAGS = -Wl,--whole-archive -l$(COMPONENT_NAME) -Wl,--no-whole-archive
+else
+COMPONENT_CONFIG_ONLY := 1
+endif
--- a/components/bt/test/test_bt_common.c
+++ b/components/bt/test/test_bt_common.c
@@ -0,0 +1,14 @@
+/*
+ Tests for the BT common things implementation
+*/
+
+#include <stdbool.h>
+
+#include "unity.h"
+
+extern bool btdm_controller_compile_version_check(void);
+
+TEST_CASE("bt_controller_git_commit_check", "[bt_common]")
+{
+    TEST_ASSERT(btdm_controller_compile_version_check() == true);
+}
--- a/Show More
+++ b/Show More