Merge branch 'update/version_3_2_5' into 'release/v3.2'

Update version to 3.2.5

See merge request espressif/esp-idf!11051

.gitlab-ci.yml

@@ -19,7 +19,7 @@ variables:
   GET_SOURCES_ATTEMPTS: "10"
   ARTIFACT_DOWNLOAD_ATTEMPTS: "10"
 
-  # We use get_sources.sh script to fetch the submodules and/or re-fetch the repo
+  # We use get-full-sources.sh script to fetch the submodules and/or re-fetch the repo
   # if it was corrupted (if submodule update fails this can happen)
   GIT_STRATEGY: fetch
   GIT_SUBMODULE_STRATEGY: none
@@ -33,8 +33,13 @@ variables:
   APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
   CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
 
-# Docker images
+  # Docker images
   BOT_DOCKER_IMAGE_TAG: ":latest"
+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "${GITLAB_SSH_SERVER}/qa/ci-test-runner-configs.git"
+  CI_AUTO_TEST_SCRIPT_REPO_URL: "${GITLAB_SSH_SERVER}/qa/auto_test_script.git"
+  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"
+
 
 # When 'fetch' strategy is used, Gitlab removes untracked files before checking out
 # new revision. However if the new revision doesn't include some of the submodules
@@ -106,6 +111,14 @@ before_script:
     - chmod 600 ~/.ssh/id_rsa
     - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
 
+# for parallel jobs, CI_JOB_NAME will be "job_name index/total" (for example, "IT_001 1/2")
+# we need to convert to pattern "job_name_index.yml"
+.define_config_file_name: &define_config_file_name |
+    JOB_NAME_PREFIX=$(echo ${CI_JOB_NAME} | awk '{print $1}')
+    JOB_FULL_NAME="${JOB_NAME_PREFIX}_${CI_NODE_INDEX}"
+    CONFIG_FILE="${CONFIG_FILE_PATH}/${JOB_FULL_NAME}.yml"
+
+
 build_template_app:
   stage: build
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
@@ -122,11 +135,11 @@ build_template_app:
     # Set the variable for 'esp-idf-template' testing
     - ESP_IDF_TEMPLATE_GIT=${ESP_IDF_TEMPLATE_GIT:-"https://github.com/espressif/esp-idf-template.git"}
     - git clone ${ESP_IDF_TEMPLATE_GIT}
-    - cd esp-idf-template
     # Try to use the same branch name for esp-idf-template that we're
     # using on esp-idf. If it doesn't exist then just stick to the default
     # branch
-    - python $CHECKOUT_REF_SCRIPT esp-idf-template
+    - python $CHECKOUT_REF_SCRIPT esp-idf-template esp-idf-template
+    - cd esp-idf-template
     - make defconfig
     # Test debug build (default)
     - make all V=1
@@ -165,8 +178,8 @@ build_template_app:
       - $BOT_LABEL_REGULAR_TEST
   script:
     - git clone $SSC_REPOSITORY
+    - python $CHECKOUT_REF_SCRIPT SSC SSC
     - cd SSC
-    - python $CHECKOUT_REF_SCRIPT SSC
     - MAKEFLAGS= ./ci_build_ssc.sh "${CI_JOB_NAME}" "${IDF_PATH}/.gitlab-ci.yml"
 
 # don't forget to add to dependency to test_template when adding new build_ssc jobs
@@ -188,7 +201,7 @@ build_ssc_02:
     paths:
       - tools/unit-test-app/output
       - components/idf_test/unit_test/TestCaseAll.yml
-    expire_in: 2 days
+    expire_in: 4 days
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
@@ -245,7 +258,7 @@ build_esp_idf_tests_cmake:
       - build_examples/*/*/*/build/download.config
       - build_examples/*/*/*/build/bootloader/*.bin
       - $LOG_PATH
-    expire_in: 2 days
+    expire_in: 4 days
   variables:
     LOG_PATH: "$CI_PROJECT_DIR/log_examples_make"
   only:
@@ -277,7 +290,7 @@ build_esp_idf_tests_cmake:
       - build_examples_cmake/*/*/*/build/download.config
       - build_examples_cmake/*/*/*/build/bootloader/*.bin
       - $LOG_PATH
-    expire_in: 2 days
+    expire_in: 4 days
   variables:
     LOG_PATH: "$CI_PROJECT_DIR/log_examples_cmake"
   only:
@@ -365,7 +378,7 @@ build_docs:
       - docs/zh_CN/sphinx-warning-log.txt
       - docs/zh_CN/sphinx-warning-log-sanitized.txt
       - docs/zh_CN/_build/html
-    expire_in: 1 day
+    expire_in: 4 days
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
@@ -384,9 +397,17 @@ build_docs:
     - make html
     - ../check_doc_warnings.sh
 
-verify_cmake_style:
-  stage: build
+.check_job_template: &check_job_template
+  stage: check
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  tags:
+    - host_test
+  dependencies: []
+  before_script: *do_nothing_before_no_filter
+
+verify_cmake_style:
+  <<: *check_job_template
+  stage: build
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
@@ -597,9 +618,12 @@ push_to_github:
   tags:
     - deploy
   only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
   when: on_success
   dependencies: []
   before_script: *do_nothing_before
@@ -619,6 +643,7 @@ deploy_docs:
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - deploy
+    - shiny
   only:
     refs:
       - master
@@ -677,14 +702,6 @@ check_doc_links:
     - cd docs
     - make linkcheck
 
-.check_job_template: &check_job_template
-  stage: check
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - build
-  dependencies: []
-  before_script: *do_nothing_before_no_filter
-
 check_line_endings:
   <<: *check_job_template
   script:
@@ -703,6 +720,18 @@ check_permissions:
   script:
     - tools/ci/check-executable.sh
 
+check_version:
+  <<: *check_job_template
+  # Don't run this for feature/bugfix branches, so that it is possible to modify
+  # esp_idf_version.h in a branch before tagging the next version.
+  only:
+    - master
+    - /^release\/v/
+    - /^v\d+\.\d+(\.\d+)?($|-)/
+  script:
+    - export IDF_PATH=$PWD
+    - tools/ci/check_idf_version.sh
+
 check_examples_cmake_make:
   <<: *check_job_template
   except:
@@ -771,6 +800,11 @@ assign_test:
   variables:
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
+    INTEGRATION_CONFIG_OUTPUT_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    PYTHON_VER: 3.7.7
   artifacts:
     paths:
       - components/idf_test/*/CIConfigs
@@ -790,11 +824,11 @@ assign_test:
     # assign unit test cases
     - python $TEST_FW_PATH/CIAssignUnitTest.py $IDF_PATH/components/idf_test/unit_test/TestCaseAll.yml $IDF_PATH/.gitlab-ci.yml $IDF_PATH/components/idf_test/unit_test/CIConfigs
     # clone test script to assign tests
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
     # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t $TEST_CASE_FILE_PATH -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin -o $INTEGRATION_CONFIG_OUTPUT_PATH
 
 .example_test_template: &example_test_template
   stage: target_test
@@ -844,9 +878,8 @@ assign_test:
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
-    - cd ci-test-runner-configs
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     - cd $TEST_FW_PATH
     # run test
     - python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE
@@ -901,23 +934,27 @@ assign_test:
   variables:
     LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
     LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test/integration_test"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/components/idf_test/ModuleDefinition.yml"
-    CONFIG_FILE: "$CI_PROJECT_DIR/components/idf_test/integration_test/CIConfigs/$CI_JOB_NAME.yml"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/components/idf_test/integration_test/KnownIssues"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
+    PYTHON_VER: 3.7.7
   before_script: *add_gitlab_key_before
   script:
+    - *define_config_file_name
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
-    - cd ci-test-runner-configs
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
     # run test
-    - python CIRunner.py -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH -m $MODULE_UPDATE_FILE
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
 
 nvs_compatible_test:
   <<: *test_template
@@ -931,18 +968,21 @@ nvs_compatible_test:
     - ESP32_IDF
     - NVS_Compatible
   script:
+    - *define_config_file_name
+    # first test if config file exists, if not exist, exit 0
+    - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
-    - cd ci-test-runner-configs
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - cd auto_test_script
-    - git checkout ${CI_COMMIT_REF_NAME} || echo "Using default branch..."
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
     # prepare nvs bins
-    - ./Tools/prepare_nvs_bin.sh
+    - cd auto_test_script
+    - ./tools/prepare_nvs_bin.sh
     # run test
-    - python CIRunner.py -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH -m $MODULE_UPDATE_FILE
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
 
 example_test_001_01:
   <<: *example_test_template
@@ -969,11 +1009,17 @@ example_test_002_01:
     - ESP32
     - Example_SDIO
 
-example_test_004_01:
+example_test_004A_01:
   <<: *example_test_template
   tags:
     - ESP32
-    - Example_CAN
+    - Example_CAN1
+
+example_test_004B_01:
+  <<: *example_test_template
+  tags:
+    - ESP32
+    - Example_CAN2
 
 example_test_005_01:
   <<: *example_test_template
@@ -1231,6 +1277,68 @@ UT_001_40:
     - ESP32_IDF
     - UT_T1_1
 
+UT_001_41:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
+UT_001_42:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
+UT_001_43:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+
+UT_001_44:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+
+UT_001_45:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+
+UT_001_46:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+    - psram
+
+UT_001_47:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+
+UT_001_48:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+
+UT_001_49:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+
+UT_001_50:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+    - psram
+
 UT_002_01:
   <<: *unit_test_template
   tags:
@@ -1335,7 +1443,7 @@ UT_004_10:
   tags:
     - ESP32_IDF
     - UT_T1_1
-    - psram    
+    - psram
 
 UT_004_11:
   <<: *unit_test_template
@@ -1357,7 +1465,14 @@ UT_004_13:
     - ESP32_IDF
     - UT_T1_1
     - psram
-    
+
+UT_004_14:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - psram
+
 UT_005_01:
   <<: *unit_test_template
   tags:
@@ -1588,242 +1703,124 @@ UT_601_01:
     - ESP32_IDF
     - UT_T1_1
 
-IT_001_01:
+IT_001:
   <<: *test_template
+  parallel: 3
   tags:
     - ESP32_IDF
     - SSC_T1_4
 
-IT_001_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_4
-
-IT_001_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_4
-
-IT_002_01:
+IT_002:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_2
 
-IT_003_01:
+IT_003:
   <<: *test_template
+  parallel: 14
   tags:
     - ESP32_IDF
     - SSC_T2_5
 
-IT_003_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_04:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_05:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_06:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_07:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_08:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_09:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_10:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_11:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_12:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_13:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_004_01:
+IT_004:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_APC
 
-IT_005_01:
+IT_005:
   <<: *test_template
+  parallel: 2
   tags:
     - ESP32_IDF
     - SSC_T1_5
 
-IT_005_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_5
-
-IT_006_01:
+IT_006:
   <<: *test_template
+  parallel: 12
   tags:
     - ESP32_IDF
     - SSC_T1_6
 
-IT_006_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_04:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_05:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_06:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_07:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_007_01:
+IT_007:
   <<: *test_template
+  parallel: 3
   tags:
     - ESP32_IDF
     - SSC_T1_7
 
-IT_007_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_7
-
-IT_007_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_7
-
-IT_008_01:
+IT_008:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_8
 
-IT_009_01:
+IT_009:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_3
 
-IT_010_01:
+IT_011:
   <<: *test_template
   tags:
     - ESP32_IDF
-    - SSC_T5_1
+    - SSC_T1_MESH1
 
-IT_011_01:
+IT_012:
+  <<: *test_template
+  parallel: 2
+  tags:
+    - ESP32_IDF
+    - SSC_T2_MESH1
+
+IT_013:
   <<: *test_template
   tags:
     - ESP32_IDF
-    - SSC_T50_1
+    - SSC_T3_MESH1
 
-IT_012_01:
+IT_014:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T6_MESH1
+
+IT_015:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T12_MESH1
+
+IT_016:
+  <<: *test_template
+  allow_failure: true
+  tags:
+    - ESP32_IDF
+    - SSC_T50_MESH1
+
+IT_017:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_MESH2
+
+IT_018:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_9
 
-IT_012_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_9
-
-IT_013_01:
+IT_019:
   <<: *test_template
+  parallel: 2
   tags:
     - ESP32_IDF
     - SSC_T2_2
 
-IT_013_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_2
-
-IT_014_01:
+IT_020:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T2_3
-
-IT_015_01:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_4

.readthedocs.yml

@@ -0,0 +1,21 @@
+# .readthedocs.yml
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# Required
+version: 2
+
+# Optionally build your docs in additional formats such as PDF and ePub
+formats:
+  - pdf
+
+# Optionally set the version of Python and requirements required to build your docs
+python:
+  version: 2.7
+  install:
+    - requirements: docs/requirements.txt
+
+# We need to list all the submodules included in documentation build by Doxygen
+submodules: 
+  include:
+    - components/mqtt/esp-mqtt

Kconfig

@@ -8,6 +8,10 @@ config IDF_CMAKE
     bool
     option env="IDF_CMAKE"
 
+config IDF_FIRMWARE_CHIP_ID
+    hex
+    default 0x0000
+
 menu "SDK tool configuration"
 config TOOLPREFIX
     string "Compiler toolchain path/prefix"
@@ -132,17 +136,17 @@ choice STACK_CHECK_MODE
 
         - In NORMAL mode (GCC flag: -fstack-protector) only functions that call alloca,
           and functions with buffers larger than 8 bytes are protected.
-        
+
         - STRONG mode (GCC flag: -fstack-protector-strong) is like NORMAL, but includes
           additional functions to be protected -- those that have local array definitions,
           or have references to local frame addresses.
-        
+
         - In OVERALL mode (GCC flag: -fstack-protector-all) all functions are protected.
 
         Modes have the following impact on code performance and coverage:
 
         - performance: NORMAL > STRONG > OVERALL
-        
+
         - coverage: NORMAL < STRONG < OVERALL
 
 

components/app_update/esp_ota_ops.c

@@ -38,9 +38,9 @@
 #include "esp_log.h"
 
 
-#define OTA_MAX(a,b) ((a) >= (b) ? (a) : (b)) 
-#define OTA_MIN(a,b) ((a) <= (b) ? (a) : (b)) 
-#define SUB_TYPE_ID(i) (i & 0x0F) 
+#define OTA_MAX(a,b) ((a) >= (b) ? (a) : (b))
+#define OTA_MIN(a,b) ((a) <= (b) ? (a) : (b))
+#define SUB_TYPE_ID(i) (i & 0x0F)
 
 typedef struct ota_ops_entry_ {
     uint32_t handle;
@@ -146,7 +146,7 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
             // must erase the partition before writing to it
             assert(it->erased_size > 0 && "must erase the partition before writing to it");
             if (it->wrote_size == 0 && it->partial_bytes == 0 && size > 0 && data_bytes[0] != ESP_IMAGE_HEADER_MAGIC) {
-                ESP_LOGE(TAG, "OTA image has invalid magic byte (expected 0xE9, saw 0x%02x", data_bytes[0]);
+                ESP_LOGE(TAG, "OTA image has invalid magic byte (expected 0xE9, saw 0x%02x)", data_bytes[0]);
                 return ESP_ERR_OTA_VALIDATE_FAILED;
             }
 
@@ -302,10 +302,10 @@ static esp_err_t esp_rewrite_ota_data(esp_partition_subtype_t subtype)
         //named data in first sector as s_ota_select[0], second sector data as s_ota_select[1]
         //e.g.
         //if s_ota_select[0].ota_seq == s_ota_select[1].ota_seq == 0xFFFFFFFF,means ota info partition is in init status
-        //so it will boot factory application(if there is),if there's no factory application,it will boot ota[0] application 
+        //so it will boot factory application(if there is),if there's no factory application,it will boot ota[0] application
         //if s_ota_select[0].ota_seq != 0 and s_ota_select[1].ota_seq != 0,it will choose a max seq ,and get value of max_seq%max_ota_app_number
         //and boot a subtype (mask 0x0F) value is (max_seq - 1)%max_ota_app_number,so if want switch to run ota[x],can use next formulas.
-        //for example, if s_ota_select[0].ota_seq = 4, s_ota_select[1].ota_seq = 5, and there are 8 ota application, 
+        //for example, if s_ota_select[0].ota_seq = 4, s_ota_select[1].ota_seq = 5, and there are 8 ota application,
         //current running is (5-1)%8 = 4,running ota[4],so if we want to switch to run ota[7],
         //we should add s_ota_select[0].ota_seq (is 4) to 4 ,(8-1)%8=7,then it will boot ota[7]
         //if      A=(B - C)%D

components/app_update/test/test_switch_ota.c

@@ -431,7 +431,7 @@ static void test_flow4(void)
 // 2 Stage: run factory -> check it -> copy factory to OTA0          -> reboot  --//--
 // 3 Stage: run OTA0    -> check it -> set_pin_factory_reset         -> reboot  --//--
 // 4 Stage: run factory -> check it -> erase OTA_DATA for next tests -> PASS
-TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0, sets pin_factory_reset, factory", "[app_update][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow4, test_flow4, test_flow4);
+TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0, sets pin_factory_reset, factory", "[app_update][timeout=90][ignore][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow4, test_flow4, test_flow4);
 #endif
 
 #ifdef CONFIG_BOOTLOADER_APP_TEST
@@ -474,5 +474,5 @@ static void test_flow5(void)
 // 2 Stage: run factory    -> check it -> copy factory to Test and set pin_test_app -> reboot  --//--
 // 3 Stage: run test       -> check it -> reset pin_test_app                        -> reboot  --//--
 // 4 Stage: run factory    -> check it -> erase OTA_DATA for next tests             -> PASS
-TEST_CASE_MULTIPLE_STAGES("Switching between factory, test, factory", "[app_update][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow5, test_flow5, test_flow5);
+TEST_CASE_MULTIPLE_STAGES("Switching between factory, test, factory", "[app_update][timeout=90][ignore][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow5, test_flow5, test_flow5);
 #endif

components/bootloader/Kconfig.projbuild

@@ -163,6 +163,7 @@ endmenu  # Bootloader
 
 
 menu "Security features"
+    visible if !IDF_CMAKE
 
 # These three are the actual options to check in code,
 # selected by the displayed options
@@ -426,4 +427,22 @@ config SECURE_BOOT_TEST_MODE
 
 
 endmenu  # Potentially Insecure
+
+    config FLASH_ENCRYPTION_DISABLE_PLAINTEXT
+        bool "Disable serial reflashing of plaintext firmware"
+        depends on FLASH_ENCRYPTION_ENABLED
+        default y if SECURE_BOOT_ENABLED
+        default n if !SECURE_BOOT_ENABLED
+        help
+            If this option is enabled, flash encryption is permanently enabled after first boot by write-protecting
+            the FLASH_CRYPT_CNT efuse. This is the recommended configuration for a secure production system.
+
+            If this option is disabled, FLASH_CRYPT_CNT is left writeable and up to 4 plaintext re-flashes are allowed.
+            An attacker with physical access will be able to read out encrypted flash contents until all plaintext
+            re-flashes have been used up.
+
+            If this option is disabled and hardware Secure Boot is enabled, Secure Boot must be configured in
+            Reflashable mode so that a new Secure Boot digest can be flashed at the same time as plaintext firmware.
+            This combination is not secure and should not be used for a production system.
+
 endmenu  # Security features

components/bootloader/project_include.cmake

@@ -15,9 +15,10 @@ set(bootloader_binary_files
 
 externalproject_add(bootloader
     # TODO: support overriding the bootloader in COMPONENT_PATHS
-    SOURCE_DIR "${IDF_PATH}/components/bootloader/subproject"
+    SOURCE_DIR "${CMAKE_CURRENT_LIST_DIR}/subproject"
     BINARY_DIR "${bootloader_build_dir}"
     CMAKE_ARGS  -DSDKCONFIG=${SDKCONFIG} -DIDF_PATH=${IDF_PATH}
+                -DEXTRA_COMPONENT_DIRS=${CMAKE_CURRENT_LIST_DIR}
     INSTALL_COMMAND ""
     BUILD_ALWAYS 1  # no easy way around this...
     BUILD_BYPRODUCTS ${bootloader_binary_files}

components/bootloader/subproject/main/bootloader_start.c

@@ -18,6 +18,7 @@
 #include "esp_log.h"
 #include "rom/gpio.h"
 #include "rom/spi_flash.h"
+#include "rom/rtc.h"
 #include "bootloader_config.h"
 #include "bootloader_init.h"
 #include "bootloader_utility.h"
@@ -74,7 +75,8 @@ static int selected_boot_partition(const bootloader_state_t *bs)
     int boot_index = bootloader_utility_get_selected_boot_partition(bs);
     if (boot_index == INVALID_INDEX) {
         return boot_index; // Unrecoverable failure (not due to corrupt ota data or bad partition contents)
-    } else {
+    }
+    if (rtc_get_reset_reason(0) != DEEPSLEEP_RESET) {
         // Factory firmware.
 #ifdef CONFIG_BOOTLOADER_FACTORY_RESET
         if (bootloader_common_check_long_hold_gpio(CONFIG_BOOTLOADER_NUM_PIN_FACTORY_RESET, CONFIG_BOOTLOADER_HOLD_TIME_GPIO) == 1) {

components/bootloader_support/CMakeLists.txt

@@ -1,6 +1,7 @@
 set(COMPONENT_SRCS "src/bootloader_clock.c"
                    "src/bootloader_common.c"
                    "src/bootloader_flash.c"
+                   "src/bootloader_flash_config.c"
                    "src/bootloader_random.c"
                    "src/bootloader_sha.c"
                    "src/bootloader_utility.c"

components/bootloader_support/include/bootloader_common.h

@@ -14,6 +14,7 @@
 
 #pragma once
 #include "esp_flash_data_types.h"
+#include "esp_image_format.h"
 
 /// Type of hold a GPIO in low state
 typedef enum {
@@ -22,6 +23,11 @@ typedef enum {
     GPIO_NOT_HOLD   = 0     /*!< If the GPIO input is not low */
 } esp_comm_gpio_hold_t;
 
+typedef enum {
+    ESP_IMAGE_BOOTLOADER,
+    ESP_IMAGE_APPLICATION
+} esp_image_type;
+
 /**
  * @brief Calculate crc for the OTA data partition.
  *
@@ -91,3 +97,27 @@ bool bootloader_common_label_search(const char *list, char *label);
  *          - ESP_FAIL: An allocation error occurred.
  */
 esp_err_t bootloader_common_get_sha256_of_partition(uint32_t address, uint32_t size, int type, uint8_t *out_sha_256);
+
+/**
+ * @brief Get chip revision
+ *
+ * @return Chip revision number
+ */
+uint8_t bootloader_common_get_chip_revision(void);
+
+/**
+ * @brief Check if the image (bootloader and application) has valid chip ID and revision
+ *
+ * @param[in] img_hdr: image header
+ * @param[in] type: image type, bootloader or application
+ * @return
+ *      - ESP_OK: image and chip are matched well
+ *      - ESP_FAIL: image doesn't match to the chip
+ */
+esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type);
+
+
+/**
+ * @brief Configure VDDSDIO, call this API to rise VDDSDIO to 1.9V when VDDSDIO regulator is enabled as 1.8V mode.
+ */
+void bootloader_common_vddsdio_configure();

components/bootloader_support/include/bootloader_flash_config.h

@@ -0,0 +1,71 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include "esp_image_format.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Update the flash id in g_rom_flashchip(global esp_rom_spiflash_chip_t structure).
+ *
+ * @return None
+ */
+void bootloader_flash_update_id();
+
+/**
+ * @brief Set the flash CS setup and hold time.
+ *
+ * @note CS setup time is recomemded to be 1.5T, and CS hold time is recommended to be 2.5T.
+ *       cs_setup = 1, cs_setup_time = 0; cs_hold = 1, cs_hold_time = 1.
+ *
+ * @return None
+ */
+void bootloader_flash_cs_timing_config();
+
+/**
+ * @brief Configure SPI flash clock.
+ *
+ * @note This function only set clock frequency for SPI0.
+ *
+ * @param pfhdr Pointer to App image header, from where to fetch flash settings.
+ *
+ * @return None
+ */
+void bootloader_flash_clock_config(const esp_image_header_t* pfhdr);
+
+/**
+ * @brief Configure SPI flash gpio, include the IO matrix and drive strength configuration.
+ *
+ * @param pfhdr Pointer to App image header, from where to fetch flash settings.
+ *
+ * @return None
+ */
+void bootloader_flash_gpio_config(const esp_image_header_t* pfhdr);
+
+/**
+ * @brief Configure SPI flash read dummy based on different mode and frequency.
+ *
+ * @param pfhdr Pointer to App image header, from where to fetch flash settings.
+ *
+ * @return None
+ */
+void bootloader_flash_dummy_config(const esp_image_header_t* pfhdr);
+
+#ifdef __cplusplus
+}
+#endif

components/bootloader_support/include/esp_efuse.h

@@ -91,6 +91,13 @@ esp_err_t esp_efuse_apply_34_encoding(const uint8_t *in_bytes, uint32_t *out_wor
  */
 void esp_efuse_write_random_key(uint32_t blk_wdata0_reg);
 
+/**
+ * @brief   Returns chip version from efuse
+ *
+ * @return chip version
+ */
+uint8_t esp_efuse_get_chip_ver(void);
+
 #ifdef __cplusplus
 }
 #endif

components/bootloader_support/include/esp_image_format.h

@@ -55,6 +55,19 @@ typedef enum {
 
 #define ESP_IMAGE_HEADER_MAGIC 0xE9
 
+/**
+ * @brief ESP chip ID
+ *
+ */
+typedef enum {
+    ESP_CHIP_ID_ESP32 = 0x0000,  /*!< chip ID: ESP32 */
+    ESP_CHIP_ID_INVALID = 0xFFFF /*!< Invalid chip ID (we defined it to make sure the esp_chip_id_t is 2 bytes size) */
+} __attribute__((packed)) esp_chip_id_t;
+
+/** @cond */
+_Static_assert(sizeof(esp_chip_id_t) == 2, "esp_chip_id_t should be 16 bit");
+
+
 /* Main header of binary image */
 typedef struct {
     uint8_t magic;
@@ -71,8 +84,12 @@ typedef struct {
     uint8_t wp_pin;
     /* Drive settings for the SPI flash pins (read by ROM bootloader) */
     uint8_t spi_pin_drv[3];
-    /* Reserved bytes in ESP32 additional header space, currently unused */
-    uint8_t reserved[11];
+    /*!< Chip identification number */
+    esp_chip_id_t chip_id;
+    /*!< Minimum chip revision supported by image */
+    uint8_t min_chip_rev;
+    /*!< Reserved bytes in additional header space, currently unused */
+    uint8_t reserved[8];
     /* If 1, a SHA256 digest "simple hash" (of the entire image) is appended after the checksum. Included in image length. This digest
      * is separate to secure boot and only used for detecting corruption. For secure boot signed images, the signature
      * is appended after this (and the simple hash is included in the signed data). */

components/bootloader_support/include_bootloader/bootloader_flash.h

@@ -30,6 +30,13 @@
    bootloader_support components only.
 */
 
+/**
+ * @brief Get number of free pages
+ *
+ * @return Number of free pages
+ */
+uint32_t bootloader_mmap_get_free_pages();
+
 /**
  * @brief Map a region of flash to data memory
  *

components/bootloader_support/src/bootloader_common.c

@@ -27,6 +27,11 @@
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
 #include "soc/gpio_periph.h"
+#include "soc/efuse_reg.h"
+#include "soc/rtc.h"
+#include "soc/spi_reg.h"
+#include "soc/efuse_reg.h"
+#include "soc/apb_ctrl_reg.h"
 #include "esp_image_format.h"
 #include "bootloader_sha.h"
 
@@ -192,3 +197,64 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
 
     return ESP_OK;
 }
+
+void bootloader_common_vddsdio_configure()
+{
+#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
+    rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
+    if (cfg.enable == 1 && cfg.tieh == RTC_VDDSDIO_TIEH_1_8V) {    // VDDSDIO regulator is enabled @ 1.8V
+        cfg.drefh = 3;
+        cfg.drefm = 3;
+        cfg.drefl = 3;
+        cfg.force = 1;
+        rtc_vddsdio_set_config(cfg);
+        ets_delay_us(10); // wait for regulator to become stable
+    }
+#endif // CONFIG_BOOTLOADER_VDDSDIO_BOOST
+}
+
+uint8_t bootloader_common_get_chip_revision(void)
+{
+    uint8_t eco_bit0, eco_bit1, eco_bit2;
+    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
+    eco_bit1 = (REG_READ(EFUSE_BLK0_RDATA5_REG) & 0x100000) >> 20;
+    eco_bit2 = (REG_READ(APB_CTRL_DATE_REG) & 0x80000000) >> 31;
+    uint32_t combine_value = (eco_bit2 << 2) | (eco_bit1 << 1) | eco_bit0;
+    uint8_t chip_ver = 0;
+    switch (combine_value) {
+    case 0:
+        chip_ver = 0;
+        break;
+    case 1:
+        chip_ver = 1;
+        break;
+    case 3:
+        chip_ver = 2;
+        break;
+    case 7:
+        chip_ver = 3;
+        break;
+    default:
+        chip_ver = 0;
+        break;
+    }
+    return chip_ver;
+}
+
+esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
+{
+    esp_err_t err = ESP_OK;
+    esp_chip_id_t chip_id = CONFIG_IDF_FIRMWARE_CHIP_ID;
+    if (chip_id != img_hdr->chip_id) {
+        ESP_LOGE(TAG, "mismatch chip ID, expected %d, found %d", chip_id, img_hdr->chip_id);
+        err = ESP_FAIL;
+    }
+    uint8_t revision = bootloader_common_get_chip_revision();
+    if (revision < img_hdr->min_chip_rev) {
+        ESP_LOGE(TAG, "can't run on lower chip revision, expected %d, found %d", revision, img_hdr->min_chip_rev);
+        err = ESP_FAIL;
+    } else if (revision != img_hdr->min_chip_rev) {
+        ESP_LOGI(TAG, "chip revision: %d, min. %s chip revision: %d", revision, type == ESP_IMAGE_BOOTLOADER ? "bootloader" : "application", img_hdr->min_chip_rev);
+    }
+    return err;
+}

components/bootloader_support/src/bootloader_flash.c

@@ -25,6 +25,11 @@ static const char *TAG = "bootloader_mmap";
 
 static spi_flash_mmap_handle_t map;
 
+uint32_t bootloader_mmap_get_free_pages()
+{
+    return spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
+}
+
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
     if (map) {
@@ -91,12 +96,22 @@ static const char *TAG = "bootloader_flash";
 */
 #define MMU_BLOCK0_VADDR  0x3f400000
 #define MMU_BLOCK50_VADDR 0x3f720000
+#define MMU_FREE_PAGES    ((MMU_BLOCK50_VADDR - MMU_BLOCK0_VADDR) / FLASH_BLOCK_SIZE)
 
 static bool mapped;
 
 // Current bootloader mapping (ab)used for bootloader_read()
 static uint32_t current_read_mapping = UINT32_MAX;
 
+uint32_t bootloader_mmap_get_free_pages()
+{
+    /**
+     * Allow mapping up to 50 of the 51 available MMU blocks (last one used for reads)
+     * Since, bootloader_mmap function below assumes it to be 0x320000 (50 pages), we can safely do this.
+     */
+    return MMU_FREE_PAGES;
+}
+
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
     if (mapped) {

components/bootloader_support/src/bootloader_flash_config.c

@@ -0,0 +1,166 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include <stdbool.h>
+#include <assert.h>
+#include "string.h"
+#include "sdkconfig.h"
+#include "esp_err.h"
+#include "esp_log.h"
+#include "rom/gpio.h"
+#include "rom/spi_flash.h"
+#include "rom/efuse.h"
+#include "soc/gpio_periph.h"
+#include "soc/efuse_reg.h"
+#include "soc/spi_reg.h"
+#include "soc/spi_pins.h"
+#include "flash_qio_mode.h"
+#include "bootloader_flash_config.h"
+
+void bootloader_flash_update_id()
+{
+    g_rom_flashchip.device_id = bootloader_read_flash_id();
+}
+
+void IRAM_ATTR bootloader_flash_cs_timing_config()
+{
+    SET_PERI_REG_MASK(SPI_USER_REG(0), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(0), SPI_HOLD_TIME_V, 1, SPI_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(0), SPI_SETUP_TIME_V, 0, SPI_SETUP_TIME_S);
+    SET_PERI_REG_MASK(SPI_USER_REG(1), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(1), SPI_HOLD_TIME_V, 1, SPI_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(1), SPI_SETUP_TIME_V, 0, SPI_SETUP_TIME_S);
+}
+
+void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
+{
+    uint32_t spi_clk_div = 0;
+    switch (pfhdr->spi_speed) {
+        case ESP_IMAGE_SPI_SPEED_80M:
+            spi_clk_div = 1;
+            break;
+        case ESP_IMAGE_SPI_SPEED_40M:
+            spi_clk_div = 2;
+            break;
+        case ESP_IMAGE_SPI_SPEED_26M:
+            spi_clk_div = 3;
+            break;
+        case ESP_IMAGE_SPI_SPEED_20M:
+            spi_clk_div = 4;
+            break;
+        default:
+            break;
+    }
+    esp_rom_spiflash_config_clk(spi_clk_div, 0);
+    esp_rom_spiflash_config_clk(spi_clk_div, 1);
+}
+
+void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
+{
+    uint32_t drv = 2;
+    if (pfhdr->spi_speed == ESP_IMAGE_SPI_SPEED_80M) {
+        drv = 3;
+    }
+
+    uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
+    uint32_t pkg_ver = chip_ver & 0x7;
+
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
+        // For ESP32D2WD the SPI pins are already configured
+        // flash clock signal should come from IO MUX.
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
+        // For ESP32PICOD2 the SPI pins are already configured
+        // flash clock signal should come from IO MUX.
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
+        // For ESP32PICOD4 the SPI pins are already configured
+        // flash clock signal should come from IO MUX.
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+    } else {
+        const uint32_t spiconfig = ets_efuse_get_spiconfig();
+        if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_CS, SPICS0_OUT_IDX, 0, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_MISO, SPIQ_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_MISO, SPIQ_IN_IDX, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_MOSI, SPID_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_MOSI, SPID_IN_IDX, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_WP, SPIWP_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_WP, SPIWP_IN_IDX, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_HD, SPIHD_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_HD, SPIHD_IN_IDX, 0);
+            //select pin function gpio
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA0_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA1_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA2_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA3_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CMD_U, PIN_FUNC_GPIO);
+            // flash clock signal should come from IO MUX.
+            // set drive ability for clock
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+
+            uint32_t flash_id = g_rom_flashchip.device_id;
+            if (flash_id == FLASH_ID_GD25LQ32C) {
+                // Set drive ability for 1.8v flash in 80Mhz.
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA0_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA1_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA2_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA3_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CMD_U,   FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U,   FUN_DRV, 3, FUN_DRV_S);
+            }
+        }
+    }
+}
+
+void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
+{
+    int spi_cache_dummy = 0;
+    uint32_t modebit = READ_PERI_REG(SPI_CTRL_REG(0));
+    if (modebit & SPI_FASTRD_MODE) {
+        if (modebit & SPI_FREAD_QIO) {    //SPI mode is QIO
+            spi_cache_dummy = SPI0_R_QIO_DUMMY_CYCLELEN;
+        } else if (modebit & SPI_FREAD_DIO) {    //SPI mode is DIO
+            spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;
+            SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_ADDR_BITLEN_V, SPI0_R_DIO_ADDR_BITSLEN, SPI_USR_ADDR_BITLEN_S);
+        } else if(modebit & (SPI_FREAD_QUAD | SPI_FREAD_DUAL))  {    //SPI mode is QOUT or DIO
+            spi_cache_dummy = SPI0_R_FAST_DUMMY_CYCLELEN;
+        }
+    }
+
+    extern uint8_t g_rom_spiflash_dummy_len_plus[];
+    switch (pfhdr->spi_speed) {
+        case ESP_IMAGE_SPI_SPEED_80M:
+            g_rom_spiflash_dummy_len_plus[0] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_80M;
+            g_rom_spiflash_dummy_len_plus[1] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_80M;
+            break;
+        case ESP_IMAGE_SPI_SPEED_40M:
+            g_rom_spiflash_dummy_len_plus[0] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_40M;
+            g_rom_spiflash_dummy_len_plus[1] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_40M;
+            break;
+        case ESP_IMAGE_SPI_SPEED_26M:
+        case ESP_IMAGE_SPI_SPEED_20M:
+            g_rom_spiflash_dummy_len_plus[0] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_20M;
+            g_rom_spiflash_dummy_len_plus[1] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_20M;
+            break;
+        default:
+            break;
+    }
+
+    SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + g_rom_spiflash_dummy_len_plus[0],
+            SPI_USR_DUMMY_CYCLELEN_S);
+}

components/bootloader_support/src/bootloader_init.c

@@ -17,6 +17,7 @@
 #include <sys/param.h>
 
 #include "esp_attr.h"
+#include "esp_efuse.h"
 #include "esp_log.h"
 
 #include "rom/cache.h"
@@ -33,12 +34,10 @@
 #include "soc/cpu.h"
 #include "soc/rtc.h"
 #include "soc/dport_reg.h"
-#include "soc/io_mux_reg.h"
 #include "soc/efuse_reg.h"
 #include "soc/rtc_cntl_reg.h"
 #include "soc/timer_group_reg.h"
-#include "soc/gpio_reg.h"
-#include "soc/gpio_sig_map.h"
+#include "soc/gpio_periph.h"
 #include "soc/rtc_wdt.h"
 
 #include "sdkconfig.h"
@@ -50,6 +49,8 @@
 #include "bootloader_random.h"
 #include "bootloader_config.h"
 #include "bootloader_clock.h"
+#include "bootloader_common.h"
+#include "bootloader_flash_config.h"
 
 #include "flash_qio_mode.h"
 
@@ -63,8 +64,7 @@ static const char* TAG = "boot";
 static esp_err_t bootloader_main();
 static void print_flash_info(const esp_image_header_t* pfhdr);
 static void update_flash_config(const esp_image_header_t* pfhdr);
-static void vddsdio_configure();
-static void flash_gpio_configure(const esp_image_header_t* pfhdr);
+static void bootloader_init_flash_configure(const esp_image_header_t* pfhdr);
 static void uart_console_configure(void);
 static void wdt_reset_check(void);
 
@@ -119,7 +119,7 @@ esp_err_t bootloader_init()
 
 static esp_err_t bootloader_main()
 {
-    vddsdio_configure();
+    bootloader_common_vddsdio_configure();
     /* Read and keep flash ID, for further use. */
     g_rom_flashchip.device_id = bootloader_read_flash_id();
     esp_image_header_t fhdr;
@@ -127,7 +127,13 @@ static esp_err_t bootloader_main()
         ESP_LOGE(TAG, "failed to load bootloader header!");
         return ESP_FAIL;
     }
-    flash_gpio_configure(&fhdr);
+    /* Check chip ID and minimum chip revision that supported by this image */
+    uint8_t revision = bootloader_common_get_chip_revision();
+    ESP_LOGI(TAG, "Chip Revision: %d", revision);
+    if (bootloader_common_check_chip_validity(&fhdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
+        return ESP_FAIL;
+    }
+    bootloader_init_flash_configure(&fhdr);
 #if (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240)
     //Check if ESP32 is rated for a CPU frequency of 160MHz only
     if (REG_GET_BIT(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_CPU_FREQ_RATED) &&
@@ -287,128 +293,15 @@ static void print_flash_info(const esp_image_header_t* phdr)
 #endif
 }
 
-static void vddsdio_configure()
-{
-#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
-    rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
-    if (cfg.enable == 1 && cfg.tieh == RTC_VDDSDIO_TIEH_1_8V) {    // VDDSDIO regulator is enabled @ 1.8V
-        cfg.drefh = 3;
-        cfg.drefm = 3;
-        cfg.drefl = 3;
-        cfg.force = 1;
-        rtc_vddsdio_set_config(cfg);
-        ets_delay_us(10); // wait for regulator to become stable
-    }
-#endif // CONFIG_BOOTLOADER_VDDSDIO_BOOST
-}
-
-#define FLASH_CLK_IO      6
-#define FLASH_CS_IO       11
-#define FLASH_SPIQ_IO     7
-#define FLASH_SPID_IO     8
-#define FLASH_SPIWP_IO    10
-#define FLASH_SPIHD_IO    9
-#define FLASH_IO_MATRIX_DUMMY_40M   1
-#define FLASH_IO_MATRIX_DUMMY_80M   2
-#define FLASH_IO_DRIVE_GD_WITH_1V8PSRAM    3
-
 /*
  * Bootloader reads SPI configuration from bin header, so that
  * the burning configuration can be different with compiling configuration.
  */
-static void IRAM_ATTR flash_gpio_configure(const esp_image_header_t* pfhdr)
+static void IRAM_ATTR bootloader_init_flash_configure(const esp_image_header_t* pfhdr)
 {
-    int spi_cache_dummy = 0;
-    int drv = 2;
-    switch (pfhdr->spi_mode) {
-        case ESP_IMAGE_SPI_MODE_QIO:
-            spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;
-            break;
-        case ESP_IMAGE_SPI_MODE_DIO:
-            spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;   //qio 3
-            break;
-        case ESP_IMAGE_SPI_MODE_QOUT:
-        case ESP_IMAGE_SPI_MODE_DOUT:
-        default:
-            spi_cache_dummy = SPI0_R_FAST_DUMMY_CYCLELEN;
-            break;
-    }
-
-    /* dummy_len_plus values defined in ROM for SPI flash configuration */
-    extern uint8_t g_rom_spiflash_dummy_len_plus[];
-    switch (pfhdr->spi_speed) {
-        case ESP_IMAGE_SPI_SPEED_80M:
-            g_rom_spiflash_dummy_len_plus[0] = FLASH_IO_MATRIX_DUMMY_80M;
-            g_rom_spiflash_dummy_len_plus[1] = FLASH_IO_MATRIX_DUMMY_80M;
-            SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + FLASH_IO_MATRIX_DUMMY_80M,
-                    SPI_USR_DUMMY_CYCLELEN_S);  //DUMMY
-            drv = 3;
-            break;
-        case ESP_IMAGE_SPI_SPEED_40M:
-            g_rom_spiflash_dummy_len_plus[0] = FLASH_IO_MATRIX_DUMMY_40M;
-            g_rom_spiflash_dummy_len_plus[1] = FLASH_IO_MATRIX_DUMMY_40M;
-            SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + FLASH_IO_MATRIX_DUMMY_40M,
-                    SPI_USR_DUMMY_CYCLELEN_S);  //DUMMY
-            break;
-        default:
-            break;
-    }
-
-    uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-    uint32_t pkg_ver = chip_ver & 0x7;
-
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else {
-        const uint32_t spiconfig = ets_efuse_get_spiconfig();
-        if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
-            gpio_matrix_out(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
-            gpio_matrix_out(FLASH_SPIQ_IO, SPIQ_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPIQ_IO, SPIQ_IN_IDX, 0);
-            gpio_matrix_out(FLASH_SPID_IO, SPID_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPID_IO, SPID_IN_IDX, 0);
-            gpio_matrix_out(FLASH_SPIWP_IO, SPIWP_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPIWP_IO, SPIWP_IN_IDX, 0);
-            gpio_matrix_out(FLASH_SPIHD_IO, SPIHD_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPIHD_IO, SPIHD_IN_IDX, 0);
-            //select pin function gpio
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA0_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA1_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA2_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA3_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CMD_U, PIN_FUNC_GPIO);
-            // flash clock signal should come from IO MUX.
-            // set drive ability for clock
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-
-            #if CONFIG_SPIRAM_TYPE_ESPPSRAM32
-            uint32_t flash_id = g_rom_flashchip.device_id;
-            if (flash_id == FLASH_ID_GD25LQ32C) {
-                // Set drive ability for 1.8v flash in 80Mhz.
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA0_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA1_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA2_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA3_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CMD_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, 3, FUN_DRV_S);
-            }
-            #endif
-        }
-    }
+    bootloader_flash_gpio_config(pfhdr);
+    bootloader_flash_dummy_config(pfhdr);
+    bootloader_flash_cs_timing_config();
 }
 
 static void uart_console_configure(void)
@@ -442,10 +335,18 @@ static void uart_console_configure(void)
         // (arrays should be optimized away by the compiler)
         const uint32_t tx_idx_list[3] = { U0TXD_OUT_IDX, U1TXD_OUT_IDX, U2TXD_OUT_IDX };
         const uint32_t rx_idx_list[3] = { U0RXD_IN_IDX, U1RXD_IN_IDX, U2RXD_IN_IDX };
+        const uint32_t uart_reset[3] = { DPORT_UART_RST, DPORT_UART1_RST, DPORT_UART2_RST };
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
+
+        PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
+        gpio_pad_pullup(uart_rx_gpio);
+
         gpio_matrix_out(uart_tx_gpio, tx_idx, 0, 0);
         gpio_matrix_in(uart_rx_gpio, rx_idx, 0);
+
+        DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
+        DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
     }
 #endif // CONFIG_CONSOLE_UART_CUSTOM
 

components/bootloader_support/src/bootloader_random.c

@@ -114,17 +114,18 @@ void bootloader_random_enable(void)
 
 void bootloader_random_disable(void)
 {
-    /* Disable i2s clock */
-    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-
-
     /* Reset some i2s configuration (possibly redundant as we reset entire
        I2S peripheral further down). */
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
-    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+
+    /* Disable i2s clock */
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
 
     /* Restore SYSCON mode registers */
     CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);

components/bootloader_support/src/efuse.c

@@ -15,6 +15,7 @@
 #include "esp_log.h"
 #include <string.h>
 #include "bootloader_random.h"
+#include "soc/apb_ctrl_reg.h"
 
 #define EFUSE_CONF_WRITE 0x5A5A /* efuse_pgm_op_ena, force no rd/wr disable */
 #define EFUSE_CONF_READ 0x5AA5 /* efuse_read_op_ena, release force */
@@ -112,3 +113,32 @@ void esp_efuse_write_random_key(uint32_t blk_wdata0_reg)
     bzero(buf, sizeof(buf));
     bzero(raw, sizeof(raw));
 }
+
+// Returns chip version from efuse
+uint8_t esp_efuse_get_chip_ver(void)
+{
+    uint8_t eco_bit0, eco_bit1, eco_bit2;
+    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
+    eco_bit1 = (REG_READ(EFUSE_BLK0_RDATA5_REG) & 0x100000) >> 20;
+    eco_bit2 = (REG_READ(APB_CTRL_DATE_REG) & 0x80000000) >> 31;
+    uint32_t combine_value = (eco_bit2 << 2) | (eco_bit1 << 1) | eco_bit0;
+    uint8_t chip_ver = 0;
+    switch (combine_value) {
+    case 0:
+        chip_ver = 0;
+        break;
+    case 1:
+        chip_ver = 1;
+        break;
+    case 3:
+        chip_ver = 2;
+        break;
+    case 7:
+        chip_ver = 3;
+        break;
+    default:
+        chip_ver = 0;
+        break;
+    }
+    return chip_ver;
+}

components/bootloader_support/src/esp_image_format.c

@@ -24,6 +24,7 @@
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
 #include "bootloader_util.h"
+#include "bootloader_common.h"
 
 /* Checking signatures as part of verifying images is necessary:
    - Always if secure boot is enabled
@@ -280,6 +281,9 @@ static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t
         }
         err = ESP_ERR_IMAGE_INVALID;
     }
+    if (bootloader_common_check_chip_validity(image, ESP_IMAGE_APPLICATION) != ESP_OK) {
+        err = ESP_ERR_IMAGE_INVALID;
+    }
     if (!silent) {
         if (image->spi_mode > ESP_IMAGE_SPI_MODE_SLOW_READ) {
             ESP_LOGW(TAG, "image at 0x%x has invalid SPI mode %d", src_addr, image->spi_mode);
@@ -368,24 +372,22 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
     }
 #endif // BOOTLOADER_BUILD
 
-#ifndef BOOTLOADER_BUILD
-    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
-    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
-    uint32_t offset_page = 0;
-    while (data_len >= free_page_count * SPI_FLASH_MMU_PAGE_SIZE) {
-        offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0)?1:0;
-        err = process_segment_data(load_addr, data_addr, (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE, do_load, sha_handle, checksum);
+    uint32_t free_page_count = bootloader_mmap_get_free_pages();
+    ESP_LOGD(TAG, "free data page_count 0x%08x", free_page_count);
+
+    int32_t data_len_remain = data_len;
+    while (data_len_remain > 0) {
+        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
+        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
+        data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
+        err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
         if (err != ESP_OK) {
             return err;
         }
-        data_addr += (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
-        data_len -= (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
-    }
-#endif
-    err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
-    if (err != ESP_OK) {
-        return err;
+        data_addr += data_len;
+        data_len_remain -= data_len;
     }
+
     return ESP_OK;
 
 err:

components/bootloader_support/src/flash_encrypt.c

@@ -163,7 +163,7 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
 
     /* If the last flash_crypt_cnt bit is burned or write-disabled, the
        device can't re-encrypt itself. */
-    if (flash_crypt_wr_dis || flash_crypt_cnt == 0xFF) {
+    if (flash_crypt_wr_dis) {
         ESP_LOGE(TAG, "Cannot re-encrypt data (FLASH_CRYPT_CNT 0x%02x write disabled %d", flash_crypt_cnt, flash_crypt_wr_dis);
         return ESP_FAIL;
     }
@@ -200,11 +200,19 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
     ESP_LOGD(TAG, "All flash regions checked for encryption pass");
 
     /* Set least significant 0-bit in flash_crypt_cnt */
-    int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & 0xFF);
-    /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == 0xFF */
+    int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & EFUSE_RD_FLASH_CRYPT_CNT);
+    /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == EFUSE_RD_FLASH_CRYPT_CNT (0x7F) */
     uint32_t new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
     ESP_LOGD(TAG, "FLASH_CRYPT_CNT 0x%x -> 0x%x", flash_crypt_cnt, new_flash_crypt_cnt);
     REG_SET_FIELD(EFUSE_BLK0_WDATA0_REG, EFUSE_FLASH_CRYPT_CNT, new_flash_crypt_cnt);
+
+#ifdef CONFIG_FLASH_ENCRYPTION_DISABLE_PLAINTEXT
+    ESP_LOGI(TAG, "Write protecting FLASH_CRYPT_CNT efuse...");
+    REG_SET_BIT(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_FLASH_CRYPT_CNT);
+#else
+    ESP_LOGW(TAG, "Not disabling FLASH_CRYPT_CNT - plaintext flashing is still possible");
+#endif
+
     esp_efuse_burn_new_values();
 
     ESP_LOGI(TAG, "Flash encryption completed");

components/bootloader_support/src/secure_boot_signatures.c

@@ -21,12 +21,7 @@
 
 #include "uECC.h"
 
-#ifdef BOOTLOADER_BUILD
-#include "rom/sha.h"
-typedef SHA_CTX sha_context;
-#else
-#include "hwcrypto/sha.h"
-#endif
+#include <sys/param.h>
 
 static const char* TAG = "secure_boot";
 
@@ -37,6 +32,9 @@ extern const uint8_t signature_verification_key_end[] asm("_binary_signature_ver
 
 #define DIGEST_LEN 32
 
+/* Mmap source address mask */
+#define MMAP_ALIGNED_MASK 0x0000FFFF
+
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
     uint8_t digest[DIGEST_LEN];
@@ -45,26 +43,44 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 
     ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
 
-    data = bootloader_mmap(src_addr, length + sizeof(esp_secure_boot_sig_block_t));
-    if(data == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr, length+sizeof(esp_secure_boot_sig_block_t));
-        return ESP_FAIL;
+    bootloader_sha256_handle_t handle = bootloader_sha256_start();
+
+    uint32_t free_page_count = bootloader_mmap_get_free_pages();
+    ESP_LOGD(TAG, "free data page_count 0x%08x", free_page_count);
+
+    int32_t data_len_remain = length;
+    uint32_t data_addr = src_addr;
+    while (data_len_remain > 0) {
+        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
+        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
+        uint32_t data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
+        data = (const uint8_t *) bootloader_mmap(data_addr, data_len);
+        if(!data) {
+            ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", data_addr, data_len);
+            bootloader_sha256_finish(handle, NULL);
+            return ESP_FAIL;
+        }
+        bootloader_sha256_data(handle, data, data_len);
+        bootloader_munmap(data);
+
+        data_addr += data_len;
+        data_len_remain -= data_len;
     }
 
-    // Calculate digest of main image
-#ifdef BOOTLOADER_BUILD
-    bootloader_sha256_handle_t handle = bootloader_sha256_start();
-    bootloader_sha256_data(handle, data, length);
+    /* Done! Get the digest */
     bootloader_sha256_finish(handle, digest);
-#else
-    /* Use thread-safe esp-idf SHA function */
-    esp_sha(SHA2_256, data, length, digest);
-#endif
 
-    // Map the signature block and verify the signature
-    sigblock = (const esp_secure_boot_sig_block_t *)(data + length);
+    // Map the signature block
+    sigblock = (const esp_secure_boot_sig_block_t *) bootloader_mmap(src_addr + length, sizeof(esp_secure_boot_sig_block_t));
+    if(!sigblock) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr + length, sizeof(esp_secure_boot_sig_block_t));
+        return ESP_FAIL;
+    }
+    // Verify the signature
     esp_err_t err = esp_secure_boot_verify_signature_block(sigblock, digest);
-    bootloader_munmap(data);
+    // Unmap
+    bootloader_munmap(sigblock);
+
     return err;
 }
 

components/bt/CMakeLists.txt

@@ -11,6 +11,7 @@ if(CONFIG_BT_ENABLED)
             bluedroid/bta/av/include
             bluedroid/bta/dm/include
             bluedroid/bta/gatt/include
+            bluedroid/bta/hf_client/include
             bluedroid/bta/hh/include
             bluedroid/bta/jv/include
             bluedroid/bta/sdp/include
@@ -93,6 +94,14 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/bta/jv/bta_jv_api.c"
                    "bluedroid/bta/jv/bta_jv_cfg.c"
                    "bluedroid/bta/jv/bta_jv_main.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_act.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_api.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_at.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_cmd.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_main.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_rfc.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_sco.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_sdp.c"
                    "bluedroid/bta/sdp/bta_sdp.c"
                    "bluedroid/bta/sdp/bta_sdp_act.c"
                    "bluedroid/bta/sdp/bta_sdp_api.c"
@@ -122,6 +131,8 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c"
                    "bluedroid/btc/profile/std/a2dp/btc_av.c"
                    "bluedroid/btc/profile/std/avrc/btc_avrc.c"
+                   "bluedroid/btc/profile/std/hf_client/btc_hf_client.c"
+                   "bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c"
                    "bluedroid/btc/profile/std/gap/btc_gap_ble.c"
                    "bluedroid/btc/profile/std/gap/btc_gap_bt.c"
                    "bluedroid/btc/profile/std/gatt/btc_gatt_common.c"

components/bt/Kconfig

@@ -53,6 +53,57 @@ config BTDM_CONTROLLER_BR_EDR_MAX_SYNC_CONN
         BR/EDR Synchronize maximum connections of bluetooth controller.
         Each connection uses 2KB static DRAM whenever the BT controller is enabled.
 
+choice BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH
+    prompt "BR/EDR Sync(SCO/eSCO) default data path"
+    depends on BTDM_CONTROLLER_MODE_BR_EDR_ONLY || BTDM_CONTROLLER_MODE_BTDM
+    default BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_PCM
+    help
+        SCO data path, i.e. HCI or PCM.
+        SCO data can be sent/received through HCI synchronous packets, or the data
+        can be routed to on-chip PCM module on ESP32. PCM input/output signals can
+        be "matrixed" to GPIOs. The default data path can also be set using API
+        "esp_bredr_sco_datapath_set"
+
+    config BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_HCI
+        bool "HCI"
+    config BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_PCM
+        bool "PCM"
+endchoice
+
+config BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_EFF
+    int
+    default 0 if BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_HCI
+    default 1 if BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_PCM
+    default 0
+
+config BTDM_CONTROLLER_AUTO_LATENCY
+    bool "Auto latency"
+    depends on BTDM_CONTROLLER_MODE_BTDM
+    default n
+    help
+        BLE auto latency, used to enhance classic BT performance
+        while classic BT and BLE are enabled at the same time.
+
+config BTDM_CONTROLLER_AUTO_LATENCY_EFF
+    bool
+    default BTDM_CONTROLLER_AUTO_LATENCY if BTDM_CONTROLLER_MODE_BTDM
+    default n
+
+config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT
+    bool "Legacy Authentication Vendor Specific Event Enable"
+    depends on BTDM_CONTROLLER_MODE_BR_EDR_ONLY || BTDM_CONTROLLER_MODE_BTDM
+    default y
+    help
+        To protect from BIAS attack during Legacy authentication,
+        Legacy authentication Vendor specific event should be enabled
+
+
+config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT_EFF
+    bool
+    default BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT if BTDM_CONTROLLER_MODE_BR_EDR_ONLY || BTDM_CONTROLLER_MODE_BTDM
+    default 0
+
+
 config BTDM_CONTROLLER_BLE_MAX_CONN_EFF
     int
     default BTDM_CONTROLLER_BLE_MAX_CONN if BTDM_CONTROLLER_MODE_BLE_ONLY || BTDM_CONTROLLER_MODE_BTDM
@@ -170,7 +221,6 @@ config BTDM_LPCLK_SEL_EXT_32K_XTAL
     bool "External 32kHz crystal"
     depends on ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
 endchoice
-
 endmenu
 
 config BLE_SCAN_DUPLICATE
@@ -185,16 +235,16 @@ choice SCAN_DUPLICATE_TYPE
     default SCAN_DUPLICATE_BY_DEVICE_ADDR
     depends on BLE_SCAN_DUPLICATE
     help
-        Scan duplicate have three ways. one is "Scan Duplicate By Device Address", This way is to use advertiser address 
-        filtering. The adv packet of the same address is only allowed to be reported once. Another way is "Scan Duplicate 
-        By Device Address And Advertising Data". This way is to use advertising data and device address filtering. All 
-        different adv packets with the same address are allowed to be reported. The last way is "Scan Duplicate By Advertising 
+        Scan duplicate have three ways. one is "Scan Duplicate By Device Address", This way is to use advertiser address
+        filtering. The adv packet of the same address is only allowed to be reported once. Another way is "Scan Duplicate
+        By Device Address And Advertising Data". This way is to use advertising data and device address filtering. All
+        different adv packets with the same address are allowed to be reported. The last way is "Scan Duplicate By Advertising
         Data". This way is to use advertising data filtering. All same advertising data only allow to be reported once even though
         they are from different devices.
 
 config SCAN_DUPLICATE_BY_DEVICE_ADDR
     bool "Scan Duplicate By Device Address"
-    help 
+    help
         This way is to use advertiser address filtering. The adv packet of the same address is only allowed to be reported once
 
 config SCAN_DUPLICATE_BY_ADV_DATA
@@ -206,7 +256,7 @@ config SCAN_DUPLICATE_BY_ADV_DATA
 config SCAN_DUPLICATE_BY_ADV_DATA_AND_DEVICE_ADDR
     bool "Scan Duplicate By Device Address And Advertising Data"
     help
-    This way is to use advertising data and device address filtering. All different adv packets with the same address are 
+    This way is to use advertising data and device address filtering. All different adv packets with the same address are
     allowed to be reported.
 endchoice
 
@@ -277,6 +327,20 @@ config BLE_ADV_REPORT_DISCARD_THRSHOLD
         If you set `BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
         may cause adv packets lost more.
 
+menuconfig BTDM_COEX_BT_OPTIONS
+    bool "Coexistence Bluetooth Side Options"
+    depends on SW_COEXIST_ENABLE
+    default n
+    help
+        Options of Bluetooth Side of WiFi and bluetooth coexistence.
+
+config BTDM_COEX_BLE_ADV_HIGH_PRIORITY
+    bool "Improve BLE ADV priority for WiFi & BLE coexistence"
+    depends on BTDM_COEX_BT_OPTIONS
+    default n
+    help
+        Improve BLE ADV coexistence priority to make it better performance.
+        For example, BLE mesh need to enable this option to improve BLE adv performance.
 
 endmenu
 
@@ -315,6 +379,13 @@ config BTC_TASK_STACK_SIZE
     help
         This select btc task stack size
 
+config BTU_TASK_STACK_SIZE
+    int "Bluetooth Bluedroid Host Stack task stack size"
+    depends on BLUEDROID_ENABLED
+    default 4096
+    help
+        This select btu task stack size
+
 config BLUEDROID_MEM_DEBUG
     bool "Bluedroid memory debug"
     depends on BLUEDROID_ENABLED
@@ -369,15 +440,15 @@ endchoice
 choice HFP_AUDIO_DATA_PATH
     prompt "audio(SCO) data path"
     depends on HFP_ENABLE
+    help
+        SCO data path, i.e. HCI or PCM. This option is set using API
+        "esp_bredr_sco_datapath_set" in Bluetooth host. Default SCO data
+        path can also be set in Bluetooth Controller.
 
 config HFP_AUDIO_DATA_PATH_PCM
     bool "PCM"
-    help
-        This enables the Serial Port Profile
 config HFP_AUDIO_DATA_PATH_HCI
     bool "HCI"
-    help
-        This enables the Serial Port Profile
 endchoice
 
 config GATTS_ENABLE
@@ -434,6 +505,13 @@ config BLE_SMP_ENABLE
    help
        This option can be close when the app not used the ble security connect.
 
+config SMP_SLAVE_CON_PARAMS_UPD_ENABLE
+        bool "Slave enable connection parameters update during pairing"
+        depends on BLE_SMP_ENABLE
+        default n
+        help
+            In order to reduce the pairing time, slave actively initiates connection parameters update during pairing.
+
 config BT_STACK_NO_LOG
     bool "Disable BT debug logs (minimize bin size)"
     depends on BLUEDROID_ENABLED
@@ -1228,6 +1306,16 @@ config BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
         Bluedroid will report adv data or scan response to application layer immediately.
 
 # Memory reserved at start of DRAM for Bluetooth stack
+
+config BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT
+        int "Timeout of BLE connection establishment"
+        depends on BLUEDROID_ENABLED
+        range 1 60
+        default 30
+        help
+            Bluetooth Connection establishment maximum time, if connection time exceeds this value, the connection
+            establishment fails, ESP_GATTC_OPEN_EVT or ESP_GATTS_OPEN_EVT is triggered.
+
 config BT_RESERVE_DRAM
     hex
     default 0xdb5c if BT_ENABLED

components/bt/bluedroid/api/esp_gap_ble_api.c

@@ -457,7 +457,7 @@ esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_ex
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
-    if (!device_info){
+    if (!device_info && type <= ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_LINK_ID) {
         return ESP_ERR_INVALID_SIZE;
     }
     msg.sig = BTC_SIG_API_CALL;
@@ -465,7 +465,9 @@ esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_ex
     msg.act = BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST;
     arg.update_duplicate_exceptional_list.subcode = ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_ADD;
     arg.update_duplicate_exceptional_list.info_type = type;
-    memcpy(arg.update_duplicate_exceptional_list.device_info, device_info, sizeof(esp_bd_addr_t));
+    if (device_info) {
+        memcpy(arg.update_duplicate_exceptional_list.device_info, device_info, sizeof(esp_bd_addr_t));
+    }
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
                 == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
@@ -479,7 +481,7 @@ esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
-    if (!device_info){
+    if (!device_info && type <= ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_LINK_ID) {
         return ESP_ERR_INVALID_SIZE;
     }
     msg.sig = BTC_SIG_API_CALL;
@@ -487,7 +489,9 @@ esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate
     msg.act = BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST;
     arg.update_duplicate_exceptional_list.subcode = ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_REMOVE;
     arg.update_duplicate_exceptional_list.info_type = type;
-    memcpy(arg.update_duplicate_exceptional_list.device_info, device_info, sizeof(esp_bd_addr_t));
+    if (device_info) {
+        memcpy(arg.update_duplicate_exceptional_list.device_info, device_info, sizeof(esp_bd_addr_t));
+    }
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
                 == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);

components/bt/bluedroid/api/esp_gatt_common_api.c

@@ -46,4 +46,13 @@ esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)
     arg.set_mtu.mtu = mtu;
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatt_com_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
-}
+}
+
+#if (BLE_INCLUDED == TRUE)
+extern uint16_t L2CA_GetFreePktBufferNum_LE(void);
+
+uint16_t esp_ble_get_sendable_packets_num ()
+{
+    return L2CA_GetFreePktBufferNum_LE();
+}
+#endif

components/bt/bluedroid/api/esp_spp_api.c

@@ -95,6 +95,10 @@ esp_err_t esp_spp_connect(esp_spp_sec_t sec_mask,
     btc_spp_args_t arg;
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (sec_mask != ESP_SPP_SEC_NONE && sec_mask != ESP_SPP_SEC_AUTHORIZE && sec_mask != ESP_SPP_SEC_AUTHENTICATE) {
+        LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only\n");
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_SPP;
     msg.act = BTC_SPP_ACT_CONNECT;
@@ -133,6 +137,10 @@ esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
         return ESP_ERR_INVALID_ARG;
     }
 
+    if (sec_mask != ESP_SPP_SEC_NONE && sec_mask != ESP_SPP_SEC_AUTHORIZE && sec_mask != ESP_SPP_SEC_AUTHENTICATE) {
+        LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only\n");
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_SPP;
     msg.act = BTC_SPP_ACT_START_SRV;

components/bt/bluedroid/api/include/api/esp_blufi_api.h

@@ -83,6 +83,7 @@ typedef enum {
     ESP_BLUFI_DH_PARAM_ERROR,
     ESP_BLUFI_READ_PARAM_ERROR,
     ESP_BLUFI_MAKE_PUBLIC_ERROR,
+    ESP_BLUFI_DATA_FORMAT_ERROR,
 } esp_blufi_error_state_t;
 
 /**

components/bt/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -263,13 +263,23 @@ typedef enum {
 
 typedef enum {
     ESP_BLE_SM_PASSKEY = 0,
+    /* Authentication requirements of local device */
     ESP_BLE_SM_AUTHEN_REQ_MODE,
+    /* The IO capability of local device */
     ESP_BLE_SM_IOCAP_MODE,
+    /* Initiator Key Distribution/Generation */
     ESP_BLE_SM_SET_INIT_KEY,
+    /* Responder Key Distribution/Generation */
     ESP_BLE_SM_SET_RSP_KEY,
+    /* Maximum Encryption key size to support */
     ESP_BLE_SM_MAX_KEY_SIZE,
+    /* Minimum Encryption key size requirement from Peer */
+    ESP_BLE_SM_MIN_KEY_SIZE,
+    /* Set static Passkey */
     ESP_BLE_SM_SET_STATIC_PASSKEY,
+    /* Reset static Passkey */
     ESP_BLE_SM_CLEAR_STATIC_PASSKEY,
+    /* Accept only specified SMP Authentication requirement */
     ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH,
     ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;
@@ -584,12 +594,18 @@ typedef enum {
 typedef enum {
     ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_ADV_ADDR       = 0,  /*!< BLE advertising address , device info will be added into ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ADDR_LIST */
     ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_LINK_ID,        /*!< BLE mesh link ID, it is for BLE mesh, device info will be added into ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_LINK_ID_LIST */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_BEACON_TYPE,    /*!< BLE mesh beacon AD type, the format is | Len | 0x2B | Beacon Type | Beacon Data | */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_PROV_SRV_ADV,   /*!< BLE mesh provisioning service uuid, the format is | 0x02 | 0x01 | flags | 0x03 | 0x03 | 0x1827 | .... |` */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_PROXY_SRV_ADV,  /*!< BLE mesh adv with proxy service uuid, the format is | 0x02 | 0x01 | flags | 0x03 | 0x03 | 0x1828 | .... |` */
 } esp_ble_duplicate_exceptional_info_type_t;
 
 typedef enum {
-    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ADDR_LIST         = BLE_BIT(0), /*!< duplicate scan exceptional addr list */
-    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_LINK_ID_LIST = BLE_BIT(1), /*!< duplicate scan exceptional mesh link ID list */
-    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ALL_LIST = (BLE_BIT(0) | BLE_BIT(1)), /*!< duplicate scan exceptional all list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ADDR_LIST                  = BLE_BIT(0),             /*!< duplicate scan exceptional addr list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_LINK_ID_LIST          = BLE_BIT(1),             /*!< duplicate scan exceptional mesh link ID list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_BEACON_TYPE_LIST      = BLE_BIT(2),             /*!< duplicate scan exceptional mesh beacon type list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_PROV_SRV_ADV_LIST     = BLE_BIT(3),             /*!< duplicate scan exceptional mesh adv with provisioning service uuid */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_PROXY_SRV_ADV_LIST    = BLE_BIT(4),             /*!< duplicate scan exceptional mesh adv with provisioning service uuid */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ALL_LIST                   = 0xFFFF,                 /*!< duplicate scan exceptional all list */
 } esp_duplicate_scan_exceptional_list_type_t;
 
 typedef uint8_t esp_duplicate_info_t[ESP_BD_ADDR_LEN];
@@ -1046,6 +1062,7 @@ esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr);
  *
  *
  * @param[in]       type: device info type, it is defined in esp_ble_duplicate_exceptional_info_type_t
+ *                  when type is MESH_BEACON_TYPE, MESH_PROV_SRV_ADV or MESH_PROXY_SRV_ADV , device_info is invalid.
  * @param[in]       device_info: the device information.
  * @return
  *                  - ESP_OK : success
@@ -1058,6 +1075,7 @@ esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_ex
  *
  *
  * @param[in]       type: device info type, it is defined in esp_ble_duplicate_exceptional_info_type_t
+ *                  when type is MESH_BEACON_TYPE, MESH_PROV_SRV_ADV or MESH_PROXY_SRV_ADV , device_info is invalid.
  * @param[in]       device_info: the device information.
  * @return
  *                  - ESP_OK : success

components/bt/bluedroid/api/include/api/esp_gatt_common_api.h

@@ -44,6 +44,10 @@ extern "C" {
  */
 extern esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu);
 
+#if (BLE_INCLUDED == TRUE)
+extern uint16_t esp_ble_get_sendable_packets_num (void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/bt/bluedroid/api/include/api/esp_gatt_defs.h

@@ -34,7 +34,7 @@ extern "C" {
  * All "ESP_GATT_UUID_xxx" is attribute types
  */
 #define ESP_GATT_UUID_IMMEDIATE_ALERT_SVC           0x1802          /*  Immediate alert Service*/
-#define ESP_GATT_UUID_LINK_LOSS_SVC                 0x1803          /*  Link Loss Service*/                             
+#define ESP_GATT_UUID_LINK_LOSS_SVC                 0x1803          /*  Link Loss Service*/
 #define ESP_GATT_UUID_TX_POWER_SVC                  0x1804          /*  TX Power Service*/
 #define ESP_GATT_UUID_CURRENT_TIME_SVC              0x1805          /*  Current Time Service Service*/
 #define ESP_GATT_UUID_REF_TIME_UPDATE_SVC           0x1806          /*  Reference Time Update Service*/
@@ -68,8 +68,14 @@ extern "C" {
 #define ESP_GATT_UUID_CHAR_PRESENT_FORMAT           0x2904          /*  Characteristic Presentation Format*/
 #define ESP_GATT_UUID_CHAR_AGG_FORMAT               0x2905          /*  Characteristic Aggregate Format*/
 #define ESP_GATT_UUID_CHAR_VALID_RANGE              0x2906          /*  Characteristic Valid Range */
-#define ESP_GATT_UUID_EXT_RPT_REF_DESCR             0x2907
-#define ESP_GATT_UUID_RPT_REF_DESCR                 0x2908
+#define ESP_GATT_UUID_EXT_RPT_REF_DESCR             0x2907          /*  External Report Reference */
+#define ESP_GATT_UUID_RPT_REF_DESCR                 0x2908          /*  Report Reference */
+#define ESP_GATT_UUID_NUM_DIGITALS_DESCR            0x2909          /*  Number of Digitals */
+#define ESP_GATT_UUID_VALUE_TRIGGER_DESCR           0x290A          /*  Value Trigger Setting */
+#define ESP_GATT_UUID_ENV_SENSING_CONFIG_DESCR      0x290B          /*  Environmental Sensing Configuration */
+#define ESP_GATT_UUID_ENV_SENSING_MEASUREMENT_DESCR 0x290C          /*  Environmental Sensing Measurement */
+#define ESP_GATT_UUID_ENV_SENSING_TRIGGER_DESCR     0x290D          /*  Environmental Sensing Trigger Setting */
+#define ESP_GATT_UUID_TIME_TRIGGER_DESCR            0x290E          /*  Time Trigger Setting */
 
 /* GAP Profile Attributes */
 #define ESP_GATT_UUID_GAP_DEVICE_NAME               0x2A00
@@ -299,7 +305,7 @@ typedef enum {
  * @brief Attribute description (used to create database)
  */
  typedef struct
- {   
+ {
      uint16_t uuid_length;              /*!< UUID length */
      uint8_t  *uuid_p;                  /*!< UUID value */
      uint16_t perm;                     /*!< Attribute permission */
@@ -348,23 +354,23 @@ typedef struct
 /**
   * @brief Gatt  include service entry element
   */
-typedef struct 
+typedef struct
 {
-    uint16_t start_hdl;                                     /*!< Gatt  start handle value of included service */
-    uint16_t end_hdl;                                       /*!< Gatt  end handle value of included service */
-    uint16_t uuid;                                          /*!< Gatt  attribute value UUID of included service */
+    uint16_t start_hdl;                                     /*!< Gatt start handle value of included service */
+    uint16_t end_hdl;                                       /*!< Gatt end handle value of included service */
+    uint16_t uuid;                                          /*!< Gatt attribute value UUID of included service */
 } esp_gatts_incl_svc_desc_t;                                /*!< Gatt include service entry element */
 
 /**
   * @brief Gatt  include 128 bit service entry element
   */
-typedef struct 
+typedef struct
 {
-    uint16_t start_hdl;                                     /*!< Gatt  start handle value of included 128 bit service */
-    uint16_t end_hdl;                                       /*!< Gatt  end handle value of included 128 bit service */
-} esp_gatts_incl128_svc_desc_t;                             /*!< Gatt  include 128 bit service entry element */
+    uint16_t start_hdl;                                     /*!< Gatt start handle value of included 128 bit service */
+    uint16_t end_hdl;                                       /*!< Gatt end handle value of included 128 bit service */
+} esp_gatts_incl128_svc_desc_t;                             /*!< Gatt include 128 bit service entry element */
 
-/// Gatt attribute value 
+/// Gatt attribute value
 typedef struct {
     uint8_t           value[ESP_GATT_MAX_ATTR_LEN];         /*!< Gatt attribute value */
     uint16_t          handle;                               /*!< Gatt attribute handle */
@@ -426,8 +432,8 @@ typedef struct {
 /**
   * @brief service element
   */
-typedef struct { 
-    bool                        is_primary;                 /*!< The service flag, true if the service is primary service, else is secondly service */
+typedef struct {
+    bool                        is_primary;                 /*!< The service flag, true if the service is primary service, else is secondary service */
     uint16_t                    start_handle;               /*!< The start handle of the service */
     uint16_t                    end_handle;                 /*!< The end handle of the service */
     esp_bt_uuid_t               uuid;                       /*!< The uuid of the service */

components/bt/bluedroid/api/include/api/esp_spp_api.h

@@ -30,7 +30,7 @@ typedef enum {
     ESP_SPP_NO_RESOURCE             /*!< No more set pm control block */
 } esp_spp_status_t;
 
-/* Security Setting Mask */
+/* Security Setting Mask, Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.*/
 #define ESP_SPP_SEC_NONE            0x0000    /*!< No security. relate to BTA_SEC_NONE in bta/bta_api.h */
 #define ESP_SPP_SEC_AUTHORIZE       0x0001    /*!< Authorization required (only needed for out going connection ) relate to BTA_SEC_AUTHORIZE in bta/bta_api.h*/
 #define ESP_SPP_SEC_AUTHENTICATE    0x0012    /*!< Authentication required.  relate to BTA_SEC_AUTHENTICATE in bta/bta_api.h*/
@@ -229,7 +229,7 @@ esp_err_t esp_spp_start_discovery(esp_bd_addr_t bd_addr);
  *              When the connection is established or failed,
  *              the callback is called with ESP_SPP_OPEN_EVT.
  *
- * @param[in]   sec_mask:     Security Setting Mask .
+ * @param[in]   sec_mask:     Security Setting Mask. Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.
  * @param[in]   role:         Master or slave.
  * @param[in]   remote_scn:   Remote device bluetooth device SCN.
  * @param[in]   peer_bd_addr: Remote device bluetooth device address.
@@ -260,7 +260,7 @@ esp_err_t esp_spp_disconnect(uint32_t handle);
  *              When the connection is established, the callback is called
  *              with ESP_SPP_SRV_OPEN_EVT.
  *
- * @param[in]   sec_mask:     Security Setting Mask .
+ * @param[in]   sec_mask:     Security Setting Mask. Security Setting Mask. Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.
  * @param[in]   role:         Master or slave.
  * @param[in]   local_scn:    The specific channel you want to get.
  *                            If channel is 0, means get any channel.

components/bt/bluedroid/bta/av/bta_av_aact.c

@@ -1293,9 +1293,10 @@ void bta_av_setconfig_rsp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
             /* if SBC is used by the SNK as INT, discover req is not sent in bta_av_config_ind.
                        * call disc_res now */
             /* this is called in A2DP SRC path only, In case of SINK we don't need it  */
-            if (local_sep == AVDT_TSEP_SRC)
+            if (local_sep == AVDT_TSEP_SRC) {
                 p_scb->p_cos->disc_res(p_scb->hndl, num, num, 0, p_scb->peer_addr,
                                        UUID_SERVCLASS_AUDIO_SOURCE);
+            }
         } else {
             /* we do not know the peer device and it is using non-SBC codec
              * we need to know all the SEPs on SNK */

components/bt/bluedroid/bta/av/bta_av_act.c

@@ -829,10 +829,11 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
             if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR) {
                 p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
 #if (AVRC_METADATA_INCLUDED == TRUE)
-                if (p_cb->features & BTA_AV_FEAT_METADATA)
+                if (p_cb->features & BTA_AV_FEAT_METADATA) {
                     p_data->rc_msg.msg.hdr.ctype =
                         bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
                                                     p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
+                }
 #endif
             } else {
                 p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
@@ -890,7 +891,9 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
                 evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
             } else
 #endif
+            {
                 evt = BTA_AV_VENDOR_CMD_EVT;
+            }
         }
         /* else if configured to support vendor specific and it's a response */
         else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
@@ -902,7 +905,9 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
                 evt = BTA_AV_META_MSG_EVT;
             } else
 #endif
+            {
                 evt = BTA_AV_VENDOR_RSP_EVT;
+            }
 
         }
         /* else if not configured to support vendor specific and it's a command */

components/bt/bluedroid/bta/av/bta_av_api.c

@@ -114,7 +114,7 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
         p_buf->hdr.layer_specific   = chnl;
         p_buf->hdr.event = BTA_AV_API_REGISTER_EVT;
         if (p_service_name) {
-            BCM_STRNCPY_S(p_buf->p_service_name, sizeof(p_buf->p_service_name), p_service_name, BTA_SERVICE_NAME_LEN);
+            BCM_STRNCPY_S(p_buf->p_service_name, p_service_name, BTA_SERVICE_NAME_LEN);
             p_buf->p_service_name[BTA_SERVICE_NAME_LEN - 1] = 0;
         } else {
             p_buf->p_service_name[0] = 0;

components/bt/bluedroid/bta/av/bta_av_cfg.c

@@ -40,8 +40,9 @@ const UINT32  bta_av_meta_caps_co_ids[] = {
     AVRC_CO_BROADCOM
 };
 
-/* AVRCP cupported categories */
-#define BTA_AV_RC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
+/* AVRCP supported categories */
+#define BTA_AV_RC_SNK_SUPF_CT       (AVRC_SUPF_CT_CAT1)
+#define BTA_AV_RC_SRC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
 
 /* Added to modify
 **  1. flush timeout
@@ -62,9 +63,11 @@ const UINT16  bta_av_audio_flush_to[] = {
 /* Note: Android doesnt support AVRC_SUPF_TG_GROUP_NAVI  */
 /* Note: if AVRC_SUPF_TG_GROUP_NAVI is set, bta_av_cfg.avrc_group should be TRUE */
 #if AVRC_METADATA_INCLUDED == TRUE
-#define BTA_AV_RC_SUPF_TG       (AVRC_SUPF_TG_CAT1) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
+#define BTA_AV_RC_SNK_SUPF_TG       (AVRC_SUPF_TG_CAT2) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
+#define BTA_AV_RC_SRC_SUPF_TG       (AVRC_SUPF_TG_CAT1) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
 #else
-#define BTA_AV_RC_SUPF_TG       (AVRC_SUPF_TG_CAT1)
+#define BTA_AV_RC_SNK_SUPF_TG       (AVRC_SUPF_TG_CAT2)
+#define BTA_AV_RC_SRC_SUPF_TG       (AVRC_SUPF_TG_CAT1)
 #endif
 
 /*
@@ -95,8 +98,10 @@ const tBTA_AV_CFG bta_av_cfg = {
     48,                     /* AVRCP MTU at L2CAP for control channel */
 #endif
     BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */
-    BTA_AV_RC_SUPF_CT,      /* AVRCP controller categories */
-    BTA_AV_RC_SUPF_TG,      /* AVRCP target categories */
+    BTA_AV_RC_SNK_SUPF_CT,  /* AVRCP controller categories as SNK */
+    BTA_AV_RC_SNK_SUPF_TG,  /* AVRCP target categories as SNK */
+    BTA_AV_RC_SRC_SUPF_CT,  /* AVRCP controller categories as SRC */
+    BTA_AV_RC_SRC_SUPF_TG,  /* AVRCP target categories as SRC */
     672,                    /* AVDTP signaling channel MTU at L2CAP */
     BTA_AV_MAX_A2DP_MTU,    /* AVDTP audio transport channel MTU at L2CAP */
     bta_av_audio_flush_to,  /* AVDTP audio transport channel flush timeout */

components/bt/bluedroid/bta/av/bta_av_main.c

@@ -483,8 +483,7 @@ static void bta_av_api_sink_enable(tBTA_AV_DATA *p_data)
     activate_sink = p_data->hdr.layer_specific;
     APPL_TRACE_DEBUG("bta_av_api_sink_enable %d \n", activate_sink)
     char p_service_name[BTA_SERVICE_NAME_LEN + 1];
-    BCM_STRNCPY_S(p_service_name, sizeof(p_service_name),
-                  BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    BCM_STRNCPY_S(p_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
 
     if (activate_sink) {
         AVDT_SINK_Activate();
@@ -526,7 +525,7 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
     tBTA_UTL_COD    cod;
     UINT8           index = 0;
     char p_avk_service_name[BTA_SERVICE_NAME_LEN + 1];
-    BCM_STRNCPY_S(p_avk_service_name, sizeof(p_avk_service_name), BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    BCM_STRNCPY_S(p_avk_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
 
     memset(&cs, 0, sizeof(tAVDT_CS));
 
@@ -571,9 +570,13 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
                 bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
                                 (UINT8)(bta_av_cb.sec_mask & (~BTA_SEC_AUTHORIZE)), BTA_ID_AV);
 #endif
-
-                bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
-                                p_bta_av_cfg->avrc_tg_cat, BTA_ID_AV);
+                if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
+                                p_bta_av_cfg->avrc_src_tg_cat, BTA_ID_AV);
+                } else {
+                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
+                                p_bta_av_cfg->avrc_snk_tg_cat, BTA_ID_AV);
+                }
 #endif
             }
 
@@ -707,8 +710,13 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
                     }
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
                     /* create an SDP record as AVRC CT. */
-                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL, NULL,
-                                    p_bta_av_cfg->avrc_ct_cat, BTA_ID_AV);
+                    if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                        bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, "AV Remote Control Controller\n", NULL,
+                                    p_bta_av_cfg->avrc_src_ct_cat, BTA_ID_AV);
+                    } else {
+                        bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, "AV Remote Control Controller\n", NULL,
+                                    p_bta_av_cfg->avrc_snk_ct_cat, BTA_ID_AV);
+                    }
 #endif
                 }
             }
@@ -1268,7 +1276,7 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
 ** Returns          char *
 **
 *******************************************************************************/
-static char *bta_av_st_code(UINT8 state)
+UNUSED_ATTR static char *bta_av_st_code(UINT8 state)
 {
     switch (state) {
     case BTA_AV_INIT_ST: return "INIT";

components/bt/bluedroid/bta/av/bta_av_ssm.c

@@ -28,6 +28,7 @@
 #include <string.h>
 #include "bta/bta_av_co.h"
 #include "bta_av_int.h"
+#include "osi/osi.h"
 
 /*****************************************************************************
 ** Constants and types
@@ -564,7 +565,7 @@ void bta_av_set_scb_sst_incoming (tBTA_AV_SCB *p_scb)
 ** Returns          char *
 **
 *******************************************************************************/
-static char *bta_av_sst_code(UINT8 state)
+UNUSED_ATTR static char *bta_av_sst_code(UINT8 state)
 {
     switch (state) {
     case BTA_AV_INIT_SST: return "INIT";

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -61,7 +61,7 @@ static void bta_dm_sdp_callback (UINT16 sdp_status);
 #if (SMP_INCLUDED == TRUE)
 static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, UINT8 *service_name, UINT8 service_id, BOOLEAN is_originator);
 static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, BOOLEAN min_16_digit);
-static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type);
+static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type, BOOLEAN sc_support);
 static UINT8 bta_dm_authentication_complete_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, int result);
 #endif  ///SMP_INCLUDED == TRUE
 static void bta_dm_local_name_cback(BD_ADDR bd_addr);
@@ -323,6 +323,9 @@ void bta_dm_deinit_cb(void)
     }
 #endif
     memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreGive(deinit_semaphore);
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 /*******************************************************************************
@@ -636,13 +639,15 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
 
     /* set modes for Discoverability and connectability if not ignore */
     if (p_data->set_visibility.disc_mode != (BTA_DM_IGNORE | BTA_DM_LE_IGNORE)) {
-        if ((p_data->set_visibility.disc_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE)
+        if ((p_data->set_visibility.disc_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE) {
             p_data->set_visibility.disc_mode =
                 ((p_data->set_visibility.disc_mode & ~BTA_DM_LE_IGNORE) | le_disc_mode);
+        }
 
-        if ((p_data->set_visibility.disc_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE)
+        if ((p_data->set_visibility.disc_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE) {
             p_data->set_visibility.disc_mode =
                 ((p_data->set_visibility.disc_mode & ~BTA_DM_IGNORE) | disc_mode);
+        }
 
         BTM_SetDiscoverability(p_data->set_visibility.disc_mode,
                                bta_dm_cb.inquiry_scan_window,
@@ -650,13 +655,15 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
     }
 
     if (p_data->set_visibility.conn_mode != (BTA_DM_IGNORE | BTA_DM_LE_IGNORE)) {
-        if ((p_data->set_visibility.conn_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE)
+        if ((p_data->set_visibility.conn_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE) {
             p_data->set_visibility.conn_mode =
                 ((p_data->set_visibility.conn_mode & ~BTA_DM_LE_IGNORE) | le_conn_mode);
+        }
 
-        if ((p_data->set_visibility.conn_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE)
+        if ((p_data->set_visibility.conn_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE) {
             p_data->set_visibility.conn_mode =
                 ((p_data->set_visibility.conn_mode & ~BTA_DM_IGNORE) | conn_mode);
+        }
 
         BTM_SetConnectability(p_data->set_visibility.conn_mode,
                               bta_dm_cb.page_scan_window,
@@ -816,7 +823,7 @@ void bta_dm_add_device (tBTA_DM_MSG *p_data)
 
     if (!BTM_SecAddDevice (p_dev->bd_addr, p_dc, p_dev->bd_name, p_dev->features,
                            trusted_services_mask, p_lc, p_dev->key_type, p_dev->io_cap,
-                           p_dev->pin_length)) {
+                           p_dev->pin_length, p_dev->sc_support)) {
         APPL_TRACE_ERROR ("BTA_DM: Error adding device %08x%04x",
                           (p_dev->bd_addr[0] << 24) + (p_dev->bd_addr[1] << 16) + (p_dev->bd_addr[2] << 8) + p_dev->bd_addr[3],
                           (p_dev->bd_addr[4] << 8) + p_dev->bd_addr[5]);
@@ -1665,7 +1672,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
                         if (SDP_FindServiceUUIDInRec(p_sdp_rec, &service_uuid)) {
                             /* send result back to app now, one by one */
                             bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN));
+                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
                             result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
                             result.disc_ble_res.service.len = service_uuid.len;
                             result.disc_ble_res.service.uu.uuid16 = service_uuid.uu.uuid16;
@@ -1806,8 +1813,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
 
                 }
                 bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                              bta_dm_get_remname(), (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
                 /* make sure the string is null terminated */
                 p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -1833,8 +1839,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
             p_msg->disc_result.result.disc_res.result = BTA_FAILURE;
             p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is null terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -1886,10 +1891,12 @@ void bta_dm_disc_result (tBTA_DM_MSG *p_data)
 
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
     /* if any BR/EDR service discovery has been done, report the event */
-    if ((bta_dm_search_cb.services & ((BTA_ALL_SERVICE_MASK | BTA_USER_SERVICE_MASK ) & ~BTA_BLE_SERVICE_MASK)))
-#endif
+    if ((bta_dm_search_cb.services & ((BTA_ALL_SERVICE_MASK | BTA_USER_SERVICE_MASK ) & ~BTA_BLE_SERVICE_MASK))) {
         bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);
-
+    }
+#else
+    bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);
+#endif
     tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *) osi_malloc(sizeof(tBTA_DM_MSG));
 
     /* send a message to change state */
@@ -2155,9 +2162,10 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
                         }
 
                         /* last one? clear the BLE service bit if all discovery has been done */
-                        if (bta_dm_search_cb.uuid_to_search == 0)
+                        if (bta_dm_search_cb.uuid_to_search == 0) {
                             bta_dm_search_cb.services_to_search &=
                                 (tBTA_SERVICE_MASK)(~(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index)));
+                        }
 
                     } else
 #endif
@@ -2215,8 +2223,7 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
             p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
             p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2401,8 +2408,7 @@ static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
         p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
         p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
         bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,  sizeof(BD_NAME),
-                      (char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, (char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
 
         /* make sure the string is terminated */
         p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2546,7 +2552,7 @@ static void bta_dm_service_search_remname_cback (BD_ADDR bd_addr, DEV_CLASS dc,
             rem_name.length = (BD_NAME_LEN - 1);
             rem_name.remote_bd_name[(BD_NAME_LEN - 1)] = 0;
         }
-        BCM_STRNCPY_S((char *)rem_name.remote_bd_name,  sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)rem_name.remote_bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
         rem_name.status = BTM_SUCCESS;
 
         bta_dm_remname_cback(&rem_name);
@@ -2589,7 +2595,7 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 
     /* remote name discovery is done but it could be failed */
     bta_dm_search_cb.name_discover_done = TRUE;
-    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name, sizeof(BD_NAME), (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
+    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name,(char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
     bta_dm_search_cb.peer_name[BD_NAME_LEN] = 0;
 
     BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
@@ -2602,7 +2608,7 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 
     if ((p_msg = (tBTA_DM_REM_NAME *) osi_malloc(sizeof(tBTA_DM_REM_NAME))) != NULL) {
         bdcpy (p_msg->result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, sizeof(BD_NAME), (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
+        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
 
         /* make sure the string is null terminated */
         p_msg->result.disc_res.bd_name[BD_NAME_LEN] = 0;
@@ -2634,7 +2640,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
     bdcpy(sec_event.authorize.bd_addr, bd_addr);
     memcpy(sec_event.authorize.dev_class, dev_class, DEV_CLASS_LEN);
 
-    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
 
     /* make sure the string is null terminated */
     sec_event.authorize.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2746,7 +2752,7 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
 
     bdcpy(sec_event.pin_req.bd_addr, bd_addr);
     BTA_COPY_DEVICE_CLASS(sec_event.pin_req.dev_class, dev_class);
-    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
     sec_event.pin_req.bd_name[BD_NAME_LEN - 1] = 0;
     sec_event.pin_req.min_16_digit = min_16_digit;
 
@@ -2764,7 +2770,8 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
 **
 *******************************************************************************/
 static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
-                                        BD_NAME bd_name, LINK_KEY key, UINT8 key_type)
+                                        BD_NAME bd_name, LINK_KEY key, UINT8 key_type,
+                                        BOOLEAN sc_support)
 {
     tBTA_DM_SEC sec_event;
     tBTA_DM_AUTH_CMPL *p_auth_cmpl;
@@ -2786,6 +2793,7 @@ static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
         p_auth_cmpl->key_present = TRUE;
         p_auth_cmpl->key_type = key_type;
         p_auth_cmpl->success = TRUE;
+        p_auth_cmpl->sc_support = sc_support;
 
         memcpy(p_auth_cmpl->key, key, LINK_KEY_LEN);
         sec_event.auth_cmpl.fail_reason = HCI_SUCCESS;
@@ -2916,8 +2924,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
                    copy these values into key_notif from cfm_req */
                 bdcpy(sec_event.key_notif.bd_addr, p_data->cfm_req.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->cfm_req.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2938,8 +2945,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
             } else {
                 bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2960,8 +2966,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
             } else {
                 bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2990,7 +2995,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
 
         bdcpy(sec_event.rmt_oob.bd_addr, p_data->rmt_oob.bd_addr);
         BTA_COPY_DEVICE_CLASS(sec_event.rmt_oob.dev_class, p_data->rmt_oob.dev_class);
-        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, sizeof(BD_NAME), (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
         sec_event.rmt_oob.bd_name[BD_NAME_LEN - 1] = 0;
 
         bta_dm_cb.p_sec_cback(BTA_DM_SP_RMT_OOB_EVT, &sec_event);
@@ -3066,6 +3071,7 @@ static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
 
         switch (p_msg->event) {
         case BTM_BL_CONN_EVT:
+            p_msg->sc_downgrade = p_data->conn.sc_downgrade;
             p_msg->is_new = TRUE;
             bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
 #if BLE_INCLUDED == TRUE
@@ -3292,6 +3298,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         APPL_TRACE_DEBUG("%s info: 0x%x", __func__, bta_dm_cb.device_list.peer_device[i].info);
 
         if (bta_dm_cb.p_sec_cback) {
+            conn.link_up.sc_downgrade = p_data->acl_change.sc_downgrade;
             bta_dm_cb.p_sec_cback(BTA_DM_LINK_UP_EVT, (tBTA_DM_SEC *)&conn);
         }
     } else {
@@ -3640,11 +3647,11 @@ static char *bta_dm_get_remname(void)
     char *p_temp;
 
     /* If the name isn't already stored, try retrieving from BTM */
-    if (*p_name == '\0')
+    if (*p_name == '\0') {
         if ((p_temp = BTM_SecReadDevName(bta_dm_search_cb.peer_bdaddr)) != NULL) {
             p_name = p_temp;
         }
-
+    }
     return p_name;
 }
 #endif  ///SDP_INCLUDED == TRUE || SMP_INCLUDED == TRUE
@@ -4326,8 +4333,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bdcpy(sec_event.ble_req.bd_addr, bda);
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.ble_req.bd_name[0] = 0;
         }
@@ -4339,8 +4345,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bdcpy(sec_event.key_notif.bd_addr, bda);
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.key_notif.bd_name[0] = 0;
         }
@@ -4361,7 +4366,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 
     case BTM_LE_NC_REQ_EVT:
         bdcpy(sec_event.key_notif.bd_addr, bda);
-        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN));
+        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
         sec_event.ble_req.bd_name[BD_NAME_LEN] = 0;
         sec_event.key_notif.passkey = p_data->key_notif;
         bta_dm_cb.p_sec_cback(BTA_DM_BLE_NC_REQ_EVT, &sec_event);
@@ -4381,8 +4386,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 #endif
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.auth_cmpl.bd_name[0] = 0;
         }
@@ -5181,9 +5185,10 @@ void bta_dm_ble_setup_storage (tBTA_DM_MSG *p_data)
                                              p_data->ble_set_storage.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_CFG_STRG_EVT, p_data->ble_set_storage.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5211,9 +5216,10 @@ void bta_dm_ble_enable_batch_scan (tBTA_DM_MSG *p_data)
                                             p_data->ble_enable_scan.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_ENABLE_EVT, p_data->ble_enable_scan.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5237,9 +5243,10 @@ void bta_dm_ble_disable_batch_scan (tBTA_DM_MSG *p_data)
         btm_status = BTM_BleDisableBatchScan(p_data->ble_disable_scan.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_DISABLE_EVT, p_data->ble_enable_scan.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5263,9 +5270,10 @@ void bta_dm_ble_read_scan_reports(tBTA_DM_MSG *p_data)
                                             p_data->ble_read_reports.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_READ_REPTS_EVT, p_data->ble_enable_scan.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5395,10 +5403,11 @@ void bta_dm_cfg_filter_cond (tBTA_DM_MSG *p_data)
         }
     }
 
-    if (p_data->ble_cfg_filter_cond.p_filt_cfg_cback)
+    if (p_data->ble_cfg_filter_cond.p_filt_cfg_cback) {
         p_data->ble_cfg_filter_cond.p_filt_cfg_cback(BTA_DM_BLE_PF_CONFIG_EVT,
                 p_data->ble_cfg_filter_cond.cond_type, 0, status,
                 p_data->ble_cfg_filter_cond.ref_value);
+    }
     return;
 }
 
@@ -5429,9 +5438,10 @@ void bta_dm_enable_scan_filter(tBTA_DM_MSG *p_data)
         return;
     }
 
-    if (p_data->ble_enable_scan_filt.p_filt_status_cback)
+    if (p_data->ble_enable_scan_filt.p_filt_status_cback) {
         p_data->ble_enable_scan_filt.p_filt_status_cback (BTA_DM_BLE_PF_ENABLE_EVT,
                 p_data->ble_enable_scan_filt.ref_value, status);
+    }
 
 }
 
@@ -5465,9 +5475,10 @@ void bta_dm_scan_filter_param_setup (tBTA_DM_MSG *p_data)
         }
     }
 
-    if (p_data->ble_scan_filt_param_setup.p_filt_param_cback)
+    if (p_data->ble_scan_filt_param_setup.p_filt_param_cback) {
         p_data->ble_scan_filt_param_setup.p_filt_param_cback (BTA_DM_BLE_PF_ENABLE_EVT, 0,
                 p_data->ble_scan_filt_param_setup.ref_value, status);
+    }
 
     return;
 }
@@ -5610,7 +5621,7 @@ static void bta_dm_gatt_disc_result(tBTA_GATT_ID service_id)
 
         /* send result back to app now, one by one */
         bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name,bta_dm_get_remname(), (BD_NAME_LEN - 1));
         result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
         memcpy(&result.disc_ble_res.service, &service_id.uuid, sizeof(tBT_UUID));
 
@@ -5652,8 +5663,7 @@ static void bta_dm_gatt_disc_complete(UINT16 conn_id, tBTA_GATT_STATUS status)
             p_msg->disc_result.result.disc_res.num_uuids = 0;
             p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -5777,6 +5787,8 @@ void bta_dm_proc_open_evt(tBTA_GATTC_OPEN *p_data)
                      ((p2[0]) << 24) + ((p2[1]) << 16) + ((p2[2]) << 8) + (p2[3]),
                      ((p2[4]) << 8) + p2[5]);
 
+    UNUSED(p1);
+    UNUSED(p2);
     APPL_TRACE_DEBUG("BTA_GATTC_OPEN_EVT conn_id = %d client_if=%d status = %d" ,
                      p_data->conn_id,
                      p_data->client_if,

components/bt/bluedroid/bta/dm/bta_dm_api.c

@@ -174,7 +174,7 @@ void BTA_DmSetDeviceName(const char *p_name)
     if ((p_msg = (tBTA_DM_API_SET_NAME *) osi_malloc(sizeof(tBTA_DM_API_SET_NAME))) != NULL) {
         p_msg->hdr.event = BTA_DM_API_SET_NAME_EVT;
         /* truncate the name if needed */
-        BCM_STRNCPY_S((char *)p_msg->name, sizeof(p_msg->name), p_name, BD_NAME_LEN - 1);
+        BCM_STRNCPY_S((char *)p_msg->name, p_name, BD_NAME_LEN - 1);
         p_msg->name[BD_NAME_LEN - 1] = 0;
 
         bta_sys_sendmsg(p_msg);
@@ -556,6 +556,7 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
     }
 }
 #endif ///BT_SSP_INCLUDED == TRUE
+#endif  ///SMP_INCLUDED == TRUE
 /*******************************************************************************
 **
 ** Function         BTA_DmAddDevice
@@ -569,7 +570,8 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
 *******************************************************************************/
 void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
                      tBTA_SERVICE_MASK trusted_mask, BOOLEAN is_trusted,
-                     UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length)
+                     UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length,
+                     UINT8 sc_support)
 {
 
     tBTA_DM_API_ADD_DEVICE *p_msg;
@@ -582,6 +584,7 @@ void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
         p_msg->tm = trusted_mask;
         p_msg->is_trusted = is_trusted;
         p_msg->io_cap = io_cap;
+        p_msg->sc_support = sc_support;
 
         if (link_key) {
             p_msg->link_key_known = TRUE;
@@ -632,7 +635,6 @@ tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 
     return BTA_SUCCESS;
 }
-#endif  ///SMP_INCLUDED == TRUE
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/dm/bta_dm_cfg.c

@@ -228,9 +228,9 @@ tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC bta_dm_pm_spec[BTA_DM_NUM_PM_SPEC] = {
             {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
             {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app open */
             {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app close */
-            {{BTA_DM_PM_SNIFF3, 7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
-            {{BTA_DM_PM_SNIFF,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
-            {{BTA_DM_PM_SNIFF,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
             {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},   /* busy */
             {{BTA_DM_PM_RETRY,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}}    /* mode change retry */
         }

components/bt/bluedroid/bta/dm/bta_dm_co.c

@@ -45,6 +45,7 @@ tBTE_APPL_CFG bte_appl_cfg = {
     BTM_BLE_INITIATOR_KEY_SIZE,
     BTM_BLE_RESPONDER_KEY_SIZE,
     BTM_BLE_MAX_KEY_SIZE,
+    BTM_BLE_MIN_KEY_SIZE,
     BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_DISABLE
 };
 #endif
@@ -399,7 +400,7 @@ void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key)
 void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size)
 {
 #if (SMP_INCLUDED == TRUE)
-    if(ble_key_size >= BTM_BLE_MIN_KEY_SIZE && ble_key_size <= BTM_BLE_MAX_KEY_SIZE) {
+    if(ble_key_size >= bte_appl_cfg.ble_min_key_size && ble_key_size <= BTM_BLE_MAX_KEY_SIZE) {
         bte_appl_cfg.ble_max_key_size = ble_key_size;
     } else {
         APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
@@ -407,6 +408,17 @@ void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size)
 #endif  ///SMP_INCLUDED == TRUE
 }
 
+void bta_dm_co_ble_set_min_key_size(UINT8 ble_key_size)
+{
+#if (SMP_INCLUDED == TRUE)
+    if(ble_key_size >= BTM_BLE_MIN_KEY_SIZE && ble_key_size <= bte_appl_cfg.ble_max_key_size) {
+        bte_appl_cfg.ble_min_key_size = ble_key_size;
+    } else {
+        APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
+    }
+#endif  ///SMP_INCLUDED == TRUE
+}
+
 void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable)
 {
 #if (SMP_INCLUDED == TRUE)

components/bt/bluedroid/bta/dm/bta_dm_pm.c

@@ -1038,9 +1038,10 @@ static void bta_dm_pm_hid_check(BOOLEAN bScoActive)
             bta_dm_pm_set_sniff_policy( bta_dm_find_peer_device(bta_dm_conn_srvcs.conn_srvc[j].peer_bdaddr), bScoActive);
 
             /* if we had disabled link policy, seems like the hid device stop retrying SNIFF after a few tries. force sniff if needed */
-            if (!bScoActive)
+            if (!bScoActive) {
                 bta_dm_pm_set_mode(bta_dm_conn_srvcs.conn_srvc[j].peer_bdaddr, BTA_DM_PM_NO_ACTION,
                                    BTA_DM_PM_RESTART);
+            }
         }
     }
 

components/bt/bluedroid/bta/dm/include/bta_dm_int.h

@@ -25,7 +25,7 @@
 #define BTA_DM_INT_H
 
 #include "common/bt_target.h"
-
+#include "freertos/semphr.h"
 #if (BLE_INCLUDED == TRUE && (defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE))
 #include "bta/bta_gatt_api.h"
 #endif
@@ -375,6 +375,7 @@ typedef struct {
     UINT8           new_role;
     BD_ADDR         bd_addr;
     UINT8           hci_status;
+    BOOLEAN         sc_downgrade;
 #if BLE_INCLUDED == TRUE
     UINT16          handle;
     tBT_TRANSPORT   transport;
@@ -416,6 +417,7 @@ typedef struct {
     BD_NAME             bd_name;
     UINT8               features[BTA_FEATURE_BYTES_PER_PAGE * (BTA_EXT_FEATURES_PAGE_MAX + 1)];
     UINT8               pin_length;
+    UINT8               sc_support;
 } tBTA_DM_API_ADD_DEVICE;
 
 /* data type for BTA_DM_API_REMOVE_ACL_EVT */
@@ -1191,6 +1193,7 @@ extern tBTA_DM_DI_CB  bta_dm_di_cb;
 #else
 extern tBTA_DM_DI_CB *bta_dm_di_cb_ptr;
 #define bta_dm_di_cb (*bta_dm_di_cb_ptr)
+SemaphoreHandle_t deinit_semaphore;
 #endif
 
 extern BOOLEAN bta_dm_sm_execute(BT_HDR *p_msg);

components/bt/bluedroid/bta/gatt/bta_gattc_act.c

@@ -531,7 +531,9 @@ void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *p_clreg
     if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, TRUE, FALSE)) {
         /* always call open to hold a connection */
         if (!GATT_Connect(p_data->client_if, p_data->remote_bda, p_data->remote_addr_type, FALSE, p_data->transport)) {
+#if (!CONFIG_BT_STACK_NO_LOG)
             uint8_t *bda = (uint8_t *)p_data->remote_bda;
+#endif
             status = BTA_GATT_ERROR;
             APPL_TRACE_ERROR("%s unable to connect to remote bd_addr:%02x:%02x:%02x:%02x:%02x:%02x",
                              __func__, bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
@@ -674,7 +676,7 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
                 bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
                 //register service change
                 bta_gattc_register_service_change_notify(p_clcb->bta_conn_id, p_clcb->bda);
-            } else 
+            } else
 #endif
             { /* cache is building */
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
@@ -743,6 +745,8 @@ void bta_gattc_conncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 void bta_gattc_disconncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 {
     if (p_rcb) {
+        // Clear up the notification registration information by BD_ADDR
+        bta_gattc_clear_notif_registration_by_bda(p_rcb, p_data->int_conn.remote_bda);
         bta_gattc_send_disconnect_cback(p_rcb,
                                      p_data->int_conn.reason,
                                      p_data->int_conn.remote_bda,
@@ -1071,8 +1075,9 @@ void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 *******************************************************************************/
 void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
-    if (!bta_gattc_enqueue(p_clcb, p_data))
+    if (!bta_gattc_enqueue(p_clcb, p_data)) {
         return;
+    }
 
     tGATT_READ_PARAM    read_param;
     memset (&read_param, 0 ,sizeof(tGATT_READ_PARAM));
@@ -1140,8 +1145,9 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 *******************************************************************************/
 void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
-    if (!bta_gattc_enqueue(p_clcb, p_data))
+    if (!bta_gattc_enqueue(p_clcb, p_data)) {
         return;
+    }
 
     tBTA_GATT_STATUS    status = BTA_GATT_OK;
     tGATT_VALUE attr;
@@ -1742,7 +1748,7 @@ void bta_gattc_process_api_cache_assoc(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_m
     tBTA_GATTC gattc_cb = {0};
     gattc_cb.set_assoc.client_if = p_msg->api_assoc.client_if;
     BOOLEAN state = FALSE;
-    tBTA_GATTC_CLCB *p_assoc_clcb = bta_gattc_find_clcb_by_cif(p_msg->api_assoc.client_if, 
+    tBTA_GATTC_CLCB *p_assoc_clcb = bta_gattc_find_clcb_by_cif(p_msg->api_assoc.client_if,
                                                              p_msg->api_assoc.assoc_addr, BTA_TRANSPORT_LE);
     tBTA_GATTC_RCB *p_clrcb = bta_gattc_cl_get_regcb(p_msg->api_assoc.client_if);
     if (p_assoc_clcb != NULL) {
@@ -1783,7 +1789,7 @@ void bta_gattc_process_api_cache_assoc(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_m
     }
 
     return;
- 
+
 }
 void bta_gattc_process_api_cache_get_addr_list(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 {

components/bt/bluedroid/bta/gatt/bta_gattc_api.c

@@ -76,7 +76,7 @@ void BTA_GATTC_Disable(void)
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTC module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_client_cb - pointer to the application callback function.
 **
 ** Returns          None
@@ -333,13 +333,13 @@ const tBTA_GATTC_DESCRIPTOR* BTA_GATTC_GetDescriptor(UINT16 conn_id, UINT16 hand
 }
 
 void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid,
-                                  btgatt_db_element_t **db, int *count)
+                                  btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_service_with_uuid(conn_id, svc_uuid, db, count);
 }
 
 void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                          btgatt_db_element_t **db, int *count)
+                          btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_ALL_CHAR,
@@ -354,7 +354,7 @@ void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle
 }
 
 void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
-                                btgatt_db_element_t **db, int *count)
+                                btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_ALL_DESCRI,
@@ -369,7 +369,7 @@ void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
 }
 
 void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid,
-                             btgatt_db_element_t **db, int *count)
+                             btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_CHAR_BY_UUID,
@@ -385,7 +385,7 @@ void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_han
 
 void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t end_handle,
                               tBT_UUID char_uuid, tBT_UUID descr_uuid,
-                              btgatt_db_element_t **db, int *count)
+                              btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_DESCRI_BY_UUID,
@@ -400,7 +400,7 @@ void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t en
 }
 
 void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid,
-                                    btgatt_db_element_t **db, int *count)
+                                    btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_DESCRI_BY_HANDLE,
@@ -415,7 +415,7 @@ void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID
 }
 
 void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                 tBT_UUID *incl_uuid, btgatt_db_element_t **db, int *count)
+                                 tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_INCLUDE_SVC,
@@ -429,13 +429,13 @@ void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end
                                    count);
 }
 
-void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count)
+void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count)
 {
     bta_gattc_get_db_size_handle(conn_id, start_handle, end_handle, count);
 }
 
 void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                               UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count)
+                               UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count)
 {
     bta_gattc_get_db_size_with_type_handle(conn_id, type, start_handle, end_handle, char_handle, count);
 }
@@ -454,7 +454,7 @@ void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
 **
 *******************************************************************************/
 void  BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                          btgatt_db_element_t **db, int *count)
+                          btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_gatt_db(conn_id, start_handle, end_handle, db, count);
 }

components/bt/bluedroid/bta/gatt/bta_gattc_cache.c

@@ -93,7 +93,7 @@ static char *bta_gattc_attr_type[] = {
 };
 /* utility functions */
 
-bool display_cache_attribute(void *data, void *context) 
+bool display_cache_attribute(void *data, void *context)
 {
     //tBTA_GATTC_CACHE_ATTR *p_attr = data;
     //APPL_TRACE_ERROR("\t Attr handle[%d] uuid[0x%04x] type[%s] prop[0x%1x]",
@@ -102,7 +102,7 @@ bool display_cache_attribute(void *data, void *context)
     return true;
 }
 
-bool display_cache_service(void *data, void *context) 
+bool display_cache_service(void *data, void *context)
 {
     tBTA_GATTC_SERVICE    *p_cur_srvc = data;
     APPL_TRACE_API("Service: handle[%d ~ %d] %s[0x%04x] inst[%d]",
@@ -213,9 +213,9 @@ static void bta_gattc_free(void *ptr)
     osi_free(ptr);
 }
 
-void bta_gattc_insert_sec_service_to_cache(list_t *services, tBTA_GATTC_SERVICE *p_new_srvc) 
+void bta_gattc_insert_sec_service_to_cache(list_t *services, tBTA_GATTC_SERVICE *p_new_srvc)
 {
-    // services/p_new_srvc is NULL 
+    // services/p_new_srvc is NULL
     if (!services || !p_new_srvc) {
         APPL_TRACE_ERROR("%s services/p_new_srvc is NULL", __func__);
         return;
@@ -243,7 +243,7 @@ void bta_gattc_insert_sec_service_to_cache(list_t *services, tBTA_GATTC_SERVICE
                     return;
                 }
             }
-        }  
+        }
     }
 }
 
@@ -314,8 +314,9 @@ static tBTA_GATT_STATUS bta_gattc_add_char_to_cache(tBTA_GATTC_SERV *p_srvc_cb,
     /* TODO(jpawlowski): We should use attribute handle, not value handle to refer to characteristic.
        This is just a temporary workaround.
     */
-    if (service->e_handle < value_handle)
+    if (service->e_handle < value_handle) {
         service->e_handle = value_handle;
+    }
 
     tBTA_GATTC_CHARACTERISTIC *characteristic = osi_malloc(sizeof(tBTA_GATTC_CHARACTERISTIC));
     if (!characteristic) {
@@ -554,10 +555,10 @@ void bta_gattc_update_include_service(const list_t *services) {
             if(include_service && !include_service->included_service) {
                 //update
                 include_service->included_service = bta_gattc_find_matching_service(services, include_service->incl_srvc_s_handle);
-                if(!include_service->included_service) { 
+                if(!include_service->included_service) {
                     //not match, free it
                     list_remove(service->included_svc, include_service);
-                    osi_free(include_service);    
+                    osi_free(include_service);
                 }
             }
         }
@@ -980,12 +981,13 @@ void bta_gattc_disc_res_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT_
                                               p_data->value.incl_service.e_handle,
                                               p_data->value.incl_service.service_type);
 
-            if (!pri_srvc)
+            if (!pri_srvc) {
                 bta_gattc_add_srvc_to_list(p_srvc_cb,
                                            p_data->value.incl_service.s_handle,
                                            p_data->value.incl_service.e_handle,
                                            p_data->value.incl_service.service_type,
                                            FALSE);
+            }
             /* add into database */
             bta_gattc_add_attr_to_cache(p_srvc_cb,
                                         p_data->handle,
@@ -1007,8 +1009,8 @@ void bta_gattc_disc_res_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT_
 
         case GATT_DISC_CHAR_DSCPT:
             bta_gattc_add_attr_to_cache(p_srvc_cb,
-                                        p_data->handle, 
-                                        &p_data->type, 
+                                        p_data->handle,
+                                        &p_data->type,
                                         0,
                                         0 /* incl_srvc_s_handle */,
                                         0 /* incl_srvc_e_handle */,
@@ -1023,8 +1025,9 @@ void bta_gattc_disc_cmpl_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
     if ( p_clcb && (status != GATT_SUCCESS || p_clcb->status != GATT_SUCCESS) ) {
-        if (status == GATT_SUCCESS)
+        if (status == GATT_SUCCESS) {
             p_clcb->status = status;
+        }
         bta_gattc_sm_execute(p_clcb, BTA_GATTC_DISCOVER_CMPL_EVT, NULL);
         return;
     }
@@ -1071,15 +1074,17 @@ void bta_gattc_search_service(tBTA_GATTC_CLCB *p_clcb, tBT_UUID *p_uuid)
 {
     tBTA_GATTC          cb_data;
 
-    if (!p_clcb->p_srcb->p_srvc_cache || list_is_empty(p_clcb->p_srcb->p_srvc_cache))
+    if (!p_clcb->p_srcb->p_srvc_cache || list_is_empty(p_clcb->p_srcb->p_srvc_cache)) {
         return;
+    }
 
     for (list_node_t *sn = list_begin(p_clcb->p_srcb->p_srvc_cache);
          sn != list_end(p_clcb->p_srcb->p_srvc_cache); sn = list_next(sn)) {
         tBTA_GATTC_SERVICE *p_cache = list_node(sn);
 
-        if (!bta_gattc_uuid_compare(p_uuid, &p_cache->uuid, FALSE))
+        if (!bta_gattc_uuid_compare(p_uuid, &p_cache->uuid, FALSE)) {
             continue;
+        }
 
 #if (defined BTA_GATT_DEBUG && BTA_GATT_DEBUG == TRUE)
         APPL_TRACE_DEBUG("found service [0x%04x], inst[%d] handle [%d]",
@@ -1087,8 +1092,9 @@ void bta_gattc_search_service(tBTA_GATTC_CLCB *p_clcb, tBT_UUID *p_uuid)
                           p_cache->handle,
                           p_cache->s_handle);
 #endif
-        if (!p_clcb->p_rcb->p_cback)
+        if (!p_clcb->p_rcb->p_cback) {
             continue;
+        }
 
         memset(&cb_data, 0, sizeof(tBTA_GATTC));
 
@@ -1103,8 +1109,9 @@ void bta_gattc_search_service(tBTA_GATTC_CLCB *p_clcb, tBT_UUID *p_uuid)
 }
 
 list_t* bta_gattc_get_services_srcb(tBTA_GATTC_SERV *p_srcb) {
-    if (!p_srcb || !p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache))
+    if (!p_srcb || !p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) {
         return NULL;
+    }
 
     return p_srcb->p_srvc_cache;
 }
@@ -1112,8 +1119,9 @@ list_t* bta_gattc_get_services_srcb(tBTA_GATTC_SERV *p_srcb) {
 const list_t* bta_gattc_get_services(UINT16 conn_id) {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
-    if (p_clcb == NULL )
+    if (p_clcb == NULL ) {
         return NULL;
+    }
 
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
 
@@ -1121,63 +1129,68 @@ const list_t* bta_gattc_get_services(UINT16 conn_id) {
 }
 
 tBTA_GATTC_SERVICE*  bta_gattc_find_matching_service(const list_t *services, UINT16 handle) {
-    if (!services || list_is_empty(services))
+    if (!services || list_is_empty(services)) {
         return NULL;
+    }
 
     for (list_node_t *sn = list_begin(services);
          sn != list_end(services); sn = list_next(sn)) {
         tBTA_GATTC_SERVICE *service = list_node(sn);
 
-        if (handle >= service->s_handle && handle <= service->e_handle)
+        if (handle >= service->s_handle && handle <= service->e_handle) {
             return service;
+        }
     }
 
     return NULL;
 }
 
-const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle) 
+const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle)
 {
     const list_t *services = bta_gattc_get_services_srcb(p_srcb);
 
     return bta_gattc_find_matching_service(services, handle);
 }
 
-const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle(UINT16 conn_id, UINT16 handle) 
+const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle(UINT16 conn_id, UINT16 handle)
 {
     const list_t *services = bta_gattc_get_services(conn_id);
 
     return bta_gattc_find_matching_service(services, handle);
 }
 
-tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle) 
+tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle)
 {
     const tBTA_GATTC_SERVICE* service = bta_gattc_get_service_for_handle_srcb(p_srcb, handle);
 
-    if (!service)
+    if (!service) {
         return NULL;
+    }
 
     for (list_node_t *cn = list_begin(service->characteristics);
          cn != list_end(service->characteristics); cn = list_next(cn)) {
         tBTA_GATTC_CHARACTERISTIC *p_char = list_node(cn);
-        if (handle == p_char->handle)
+        if (handle == p_char->handle) {
             return p_char;
+        }
     }
 
     return NULL;
 }
 
-tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle) 
+tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle)
 {
    tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
-    if (p_clcb == NULL )
+    if (p_clcb == NULL ) {
         return NULL;
+    }
 
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     return bta_gattc_get_characteristic_srcb(p_srcb, handle);
 }
 
-tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle) 
+tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle)
 {
     const tBTA_GATTC_SERVICE* service = bta_gattc_get_service_for_handle_srcb(p_srcb, handle);
 
@@ -1191,20 +1204,22 @@ tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor_srcb(tBTA_GATTC_SERV *p_srcb, U
         for (list_node_t *dn = list_begin(p_char->descriptors);
              dn != list_end(p_char->descriptors); dn = list_next(dn)) {
             tBTA_GATTC_DESCRIPTOR *p_desc = list_node(dn);
-            if (handle == p_desc->handle)
+            if (handle == p_desc->handle) {
                 return p_desc;
+            }
         }
     }
 
     return NULL;
 }
 
-tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle) 
+tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
-    if (p_clcb == NULL )
+    if (p_clcb == NULL ) {
         return NULL;
+    }
 
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     return bta_gattc_get_descriptor_srcb(p_srcb, handle);
@@ -1212,7 +1227,7 @@ tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle)
 
 void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid,
                                      btgatt_db_element_t **svc_db,
-                                     int *count)
+                                     UINT16 *count)
 {
     const list_t* svc = bta_gattc_get_services(conn_id);
     if(!svc) {
@@ -1286,7 +1301,7 @@ void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       tBT_UUID *descr_uuid,
                                                       UINT16 start_handle, UINT16 end_handle,
                                                       btgatt_db_element_t **char_db,
-                                                      int *count)
+                                                      UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1443,7 +1458,7 @@ void bta_gattc_get_db_with_opration(UINT16 conn_id,
                     }
                 }
             }
-            
+
         }
     }
 
@@ -1476,7 +1491,7 @@ static size_t bta_gattc_get_db_size_with_type(list_t *services,
         }
 
         if (type == BTGATT_DB_PRIMARY_SERVICE || type == BTGATT_DB_SECONDARY_SERVICE) {
-            if ((type == BTGATT_DB_PRIMARY_SERVICE && p_cur_srvc->is_primary) || 
+            if ((type == BTGATT_DB_PRIMARY_SERVICE && p_cur_srvc->is_primary) ||
                 (type == BTGATT_DB_SECONDARY_SERVICE && !p_cur_srvc->is_primary)) {
                 // if the current service is the last service in the db, need to ensure the current service start handle is not less than the start_handle.
                 if (!svc_length) {
@@ -1572,10 +1587,11 @@ static size_t bta_gattc_get_db_size_with_type(list_t *services,
 ** Returns          number of elements inside db from start_handle to end_handle
 *******************************************************************************/
 static size_t bta_gattc_get_db_size(list_t *services,
-                                    UINT16 start_handle, UINT16 end_handle) 
+                                    UINT16 start_handle, UINT16 end_handle)
 {
-    if (!services || list_is_empty(services))
+    if (!services || list_is_empty(services)) {
         return 0;
+    }
 
     size_t db_size = 0;
     UINT16 svc_length = list_length(services) - 1;
@@ -1598,9 +1614,10 @@ static size_t bta_gattc_get_db_size(list_t *services,
         } else {
             db_size++;
         }
-        
-        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics))
+
+        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics)) {
             continue;
+        }
 
         for (list_node_t *cn = list_begin(p_cur_srvc->characteristics);
              cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) {
@@ -1649,7 +1666,7 @@ static size_t bta_gattc_get_db_size(list_t *services,
     return db_size;
 }
 
-void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count)
+void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1657,7 +1674,7 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
         *count = 0;
         return;
     }
-    
+
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     if (!p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) {
         *count = 0;
@@ -1668,7 +1685,7 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
 }
 
 void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                            UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count)
+                                            UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1676,7 +1693,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
         *count = 0;
         return;
     }
-    
+
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     if (!p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) {
         *count = 0;
@@ -1694,7 +1711,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
         }
     }
     *count = bta_gattc_get_db_size_with_type(p_srcb->p_srvc_cache, type, NULL, start_handle, end_handle);
-    
+
 }
 
 /*******************************************************************************
@@ -1715,7 +1732,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
 static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
                                        UINT16 start_handle, UINT16 end_handle,
                                        btgatt_db_element_t **db,
-                                       int *count)
+                                       UINT16 *count)
 {
     APPL_TRACE_DEBUG("%s: start_handle 0x%04x, end_handle 0x%04x",
                      __func__, start_handle, end_handle);
@@ -1786,8 +1803,9 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
                                           p_char->properties);
                 curr_db_attr++;
 
-                if (!p_char->descriptors || list_is_empty(p_char->descriptors))
+                if (!p_char->descriptors || list_is_empty(p_char->descriptors)) {
                     continue;
+                }
 
                 for (list_node_t *dn = list_begin(p_char->descriptors);
                      dn != list_end(p_char->descriptors); dn = list_next(dn)) {
@@ -1815,8 +1833,9 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
             }
         }
 
-        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc))
+        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc)) {
             continue;
+        }
 
         for (list_node_t *isn = list_begin(p_cur_srvc->included_svc);
              isn != list_end(p_cur_srvc->included_svc); isn = list_next(isn)) {
@@ -1861,7 +1880,7 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
 ** Returns          None.
 **
 *******************************************************************************/
-void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, int *count)
+void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1983,8 +2002,9 @@ void bta_gattc_fill_nv_attr(tBTA_GATTC_NV_ATTR *p_attr, UINT8 type, UINT16 s_han
 *******************************************************************************/
 void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
 {
-    if (!p_srvc_cb->p_srvc_cache || list_is_empty(p_srvc_cb->p_srvc_cache))
+    if (!p_srvc_cb->p_srvc_cache || list_is_empty(p_srvc_cb->p_srvc_cache)) {
         return;
+    }
 
     int i = 0;
     size_t db_size = bta_gattc_get_db_size(p_srvc_cb->p_srvc_cache, 0x0000, 0xFFFF);
@@ -2017,8 +2037,9 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
          sn != list_end(p_srvc_cb->p_srvc_cache); sn = list_next(sn)) {
         tBTA_GATTC_SERVICE *p_cur_srvc = list_node(sn);
 
-        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics))
+        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics)) {
             continue;
+        }
 
         for (list_node_t *cn = list_begin(p_cur_srvc->characteristics);
              cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) {
@@ -2034,8 +2055,9 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
                                    0 /* incl_srvc_e_handle */,
                                    FALSE);
 
-            if (!p_char->descriptors || list_is_empty(p_char->descriptors))
+            if (!p_char->descriptors || list_is_empty(p_char->descriptors)) {
                 continue;
+            }
 
             for (list_node_t *dn = list_begin(p_char->descriptors);
                  dn != list_end(p_char->descriptors); dn = list_next(dn)) {
@@ -2053,8 +2075,9 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
             }
         }
 
-        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc))
+        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc)) {
             continue;
+        }
 
         for (list_node_t *an = list_begin(p_cur_srvc->included_svc);
              an != list_end(p_cur_srvc->included_svc); an = list_next(an)) {

components/bt/bluedroid/bta/gatt/bta_gattc_co.c

@@ -261,14 +261,18 @@ tBTA_GATT_STATUS bta_gattc_co_cache_open(BD_ADDR server_bda, BOOLEAN to_save, UI
 *******************************************************************************/
 tBTA_GATT_STATUS bta_gattc_co_cache_load(tBTA_GATTC_NV_ATTR *attr, UINT8 index)
 {
+#if (!CONFIG_BT_STACK_NO_LOG)
     UINT16              num_attr = 0;
+#endif
     tBTA_GATT_STATUS    status = BTA_GATT_ERROR;
     size_t length = 0;
     // Read the size of memory space required for blob
     nvs_get_blob(cache_env.cache_addr[index].cache_fp, cache_key, NULL, &length);
     // Read previously saved blob if available
     esp_err_t err_code = nvs_get_blob(cache_env.cache_addr[index].cache_fp, cache_key, attr, &length);
+#if (!CONFIG_BT_STACK_NO_LOG)
     num_attr = length / sizeof(tBTA_GATTC_NV_ATTR);
+#endif
     status = (err_code == ESP_OK && length != 0) ? BTA_GATT_OK : BTA_GATT_ERROR;
     APPL_TRACE_DEBUG("%s() - read=%d, status=%d, err_code = %d",
                      __func__, num_attr, status, err_code);
@@ -323,6 +327,9 @@ void bta_gattc_co_cache_save (BD_ADDR server_bda, UINT16 num_attr,
         status = BTA_GATT_ERROR;
     }
 
+#if CONFIG_BT_STACK_NO_LOG
+    (void) status;
+#endif
     APPL_TRACE_DEBUG("%s() wrote hash_key = %x%x%x%x, num_attr = %d, status = %d.", __func__, hash_key[0], hash_key[1], hash_key[2], hash_key[3], num_attr, status);
 }
 

components/bt/bluedroid/bta/gatt/bta_gattc_utils.c

@@ -416,8 +416,9 @@ tBTA_GATTC_SERV *bta_gattc_srcb_alloc(BD_ADDR bda)
 
     if (p_tcb != NULL)
     {
-        if (p_tcb->p_srvc_cache != NULL)
+        if (p_tcb->p_srvc_cache != NULL) {
             list_free(p_tcb->p_srvc_cache);
+        }
         osi_free(p_tcb->p_srvc_list);
         p_tcb->p_srvc_list = NULL;
         //osi_free_and_reset((void **)&p_tcb->p_srvc_list);
@@ -583,8 +584,9 @@ void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id,
                      * clear boundaries are always around service.
                      */
                     handle = p_clrcb->notif_reg[i].handle;
-                    if (handle >= start_handle && handle <= end_handle)
+                    if (handle >= start_handle && handle <= end_handle) {
                         memset(&p_clrcb->notif_reg[i], 0, sizeof(tBTA_GATTC_NOTIF_REG));
+                    }
                 }
             }
         }
@@ -594,6 +596,30 @@ void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id,
     return;
 }
 
+/*******************************************************************************
+**
+** Function         bta_gattc_clear_notif_registration_by_bda
+**
+** Description      Clear up the notification registration information by BD_ADDR.
+**
+**
+** Returns          None.
+**
+*******************************************************************************/
+void bta_gattc_clear_notif_registration_by_bda(tBTA_GATTC_RCB *p_clrcb, BD_ADDR remote_bda)
+{
+    if(p_clrcb == NULL) {
+        return;
+    }
+    for (uint8_t i = 0 ; i < BTA_GATTC_NOTIF_REG_MAX; i ++) {
+        if (p_clrcb->notif_reg[i].in_use &&
+            !bdcmp(p_clrcb->notif_reg[i].remote_bda, remote_bda))
+        {
+            memset(&p_clrcb->notif_reg[i], 0, sizeof(tBTA_GATTC_NOTIF_REG));
+        }
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         bta_gattc_mark_bg_conn
@@ -637,8 +663,9 @@ BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR_PTR remote_bda
     }
     if (!add) {
         if (remote_bda_ptr) {
-            // bdstr_t bdstr = {0};
+#if (!CONFIG_BT_STACK_NO_LOG)
             char bdstr[18] = {0};
+#endif
             APPL_TRACE_ERROR("%s unable to find the bg connection mask for: %s", __func__,
                              bdaddr_to_string((bt_bdaddr_t *)remote_bda_ptr, bdstr, sizeof(bdstr)));
         }
@@ -936,8 +963,9 @@ void bta_to_btif_uuid(bt_uuid_t *p_dest, tBT_UUID *p_src)
 
     if (p_src->len == LEN_UUID_16 || p_src->len == LEN_UUID_32)
     {
-        for(i=0; i != 16; ++i)
+        for(i=0; i != 16; ++i) {
             p_dest->uu[i] = base_uuid[i];
+        }
     }
 
     switch (p_src->len)

components/bt/bluedroid/bta/gatt/bta_gatts_act.c

@@ -403,7 +403,7 @@ void bta_gatts_add_char(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_msg)
     UINT16          attr_id = 0;
     tBTA_GATTS      cb_data;
 
-    tGATT_ATTR_VAL *p_attr_val = NULL; 
+    tGATT_ATTR_VAL *p_attr_val = NULL;
     tGATTS_ATTR_CONTROL *p_control = NULL;
 
     if(p_msg->api_add_char.attr_val.attr_max_len != 0){
@@ -665,17 +665,18 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                                     &gatt_if, remote_bda, &transport)) {
             p_rcb = bta_gatts_find_app_rcb_by_app_if(gatt_if);
 
-            if (p_msg->api_indicate.need_confirm)
+            if (p_msg->api_indicate.need_confirm) {
 
                 status = GATTS_HandleValueIndication (p_msg->api_indicate.hdr.layer_specific,
                                                       p_msg->api_indicate.attr_id,
                                                       p_msg->api_indicate.len,
                                                       p_msg->api_indicate.value);
-            else
+            } else {
                 status = GATTS_HandleValueNotification (p_msg->api_indicate.hdr.layer_specific,
                                                         p_msg->api_indicate.attr_id,
                                                         p_msg->api_indicate.len,
                                                         p_msg->api_indicate.value);
+            }
 
             /* if over BR_EDR, inform PM for mode change */
             if (transport == BTA_TRANSPORT_BR_EDR) {
@@ -691,16 +692,25 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                 p_rcb && p_cb->rcb[p_srvc_cb->rcb_idx].p_cback) {
             cb_data.req_data.status = status;
             cb_data.req_data.conn_id = p_msg->api_indicate.hdr.layer_specific;
+            cb_data.req_data.value = NULL;
+            cb_data.req_data.data_len = 0;
             cb_data.req_data.handle = p_msg->api_indicate.attr_id;
 
-            cb_data.req_data.value = (uint8_t *)osi_malloc(p_msg->api_indicate.len);
-            if (cb_data.req_data.value != NULL){
-                memset(cb_data.req_data.value, 0, p_msg->api_indicate.len);
-                cb_data.req_data.data_len = p_msg->api_indicate.len;
-                memcpy(cb_data.req_data.value, p_msg->api_indicate.value, p_msg->api_indicate.len);
-            }else{
-                cb_data.req_data.data_len = 0;
-                APPL_TRACE_ERROR("%s, malloc failed", __func__);
+            if (p_msg->api_indicate.value && (p_msg->api_indicate.len > 0)) {
+                cb_data.req_data.value = (uint8_t *) osi_malloc(p_msg->api_indicate.len);
+                if (cb_data.req_data.value != NULL) {
+                    memset(cb_data.req_data.value, 0, p_msg->api_indicate.len);
+                    cb_data.req_data.data_len = p_msg->api_indicate.len;
+                    memcpy(cb_data.req_data.value, p_msg->api_indicate.value, p_msg->api_indicate.len);
+                } else {
+                    APPL_TRACE_ERROR("%s, malloc failed", __func__);
+                }
+            } else {
+                if (p_msg->api_indicate.value) {
+                    APPL_TRACE_ERROR("%s, incorrect length", __func__);
+                } else {
+                    APPL_TRACE_WARNING("%s, NULL value", __func__);
+                }
             }
             (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
             if (cb_data.req_data.value != NULL) {
@@ -851,13 +861,13 @@ void bta_gatts_send_service_change_indication (tBTA_GATTS_DATA *p_msg)
         memcpy(bd_addr, p_msg->api_send_service_change.remote_bda, BD_ADDR_LEN);
         status = GATT_SendServiceChangeIndication(bd_addr);
     } else {
-        status = GATT_SendServiceChangeIndication(NULL);    
+        status = GATT_SendServiceChangeIndication(NULL);
     }
     if (p_rcb && p_rcb->p_cback) {
         service_change.status = status;
         service_change.server_if = p_msg->api_send_service_change.server_if;
         (*p_rcb->p_cback)(BTA_GATTS_SEND_SERVICE_CHANGE_EVT,  (tBTA_GATTS *)&service_change);
-    }   
+    }
 }
 
 /*******************************************************************************
@@ -933,7 +943,7 @@ static void bta_gatts_send_request_cback (UINT16 conn_id,
             cb_data.req_data.p_data     = (tBTA_GATTS_REQ_DATA *)p_data;
 
             if(req_type == BTA_GATTS_CONF_EVT) {
-               cb_data.req_data.handle =  p_data->handle; 
+               cb_data.req_data.handle =  p_data->handle;
             }
             (*p_rcb->p_cback)(req_type,  &cb_data);
         } else {
@@ -1006,22 +1016,14 @@ static void bta_gatts_conn_cback (tGATT_IF gatt_if, BD_ADDR bda, UINT16 conn_id,
 ** Returns          none.
 **
 *******************************************************************************/
+extern void btc_congest_callback(tBTA_GATTS *param);
 static void bta_gatts_cong_cback (UINT16 conn_id, BOOLEAN congested)
 {
-    tBTA_GATTS_RCB *p_rcb;
-    tGATT_IF gatt_if;
-    tBTA_GATT_TRANSPORT transport;
     tBTA_GATTS cb_data;
 
-    if (GATT_GetConnectionInfor(conn_id, &gatt_if, cb_data.req_data.remote_bda, &transport)) {
-        p_rcb = bta_gatts_find_app_rcb_by_app_if(gatt_if);
+    cb_data.congest.conn_id = conn_id;
+    cb_data.congest.congested = congested;
 
-        if (p_rcb && p_rcb->p_cback) {
-            cb_data.congest.conn_id = conn_id;
-            cb_data.congest.congested = congested;
-
-            (*p_rcb->p_cback)(BTA_GATTS_CONGEST_EVT, &cb_data);
-        }
-    }
+    btc_congest_callback(&cb_data);
 }
 #endif /* GATTS_INCLUDED */

components/bt/bluedroid/bta/gatt/include/bta_gattc_int.h

@@ -498,6 +498,7 @@ extern BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR_PTR rem
 extern BOOLEAN bta_gattc_check_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR remote_bda, UINT8 role);
 extern UINT8 bta_gattc_num_reg_app(void);
 extern void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id, UINT16 start_handle, UINT16 end_handle);
+extern void bta_gattc_clear_notif_registration_by_bda(tBTA_GATTC_RCB *p_clrcb, BD_ADDR remote_bda);
 extern tBTA_GATTC_SERV * bta_gattc_find_srvr_cache(BD_ADDR bda);
 
 /* discovery functions */
@@ -511,12 +512,12 @@ extern const tBTA_GATTC_SERVICE* bta_gattc_get_service_for_handle(UINT16 conn_id
 tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle);
 extern tBTA_GATTC_CHARACTERISTIC* bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle);
 extern tBTA_GATTC_DESCRIPTOR* bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle);
-extern void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count);
+extern void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count);
 extern void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                                   UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count);
+                                                   UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count);
 extern void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid,
                                             btgatt_db_element_t **svc_db,
-                                            int *count);
+                                            UINT16 *count);
 
 extern void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       bt_gatt_get_db_op_t op,
@@ -526,9 +527,9 @@ extern void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       tBT_UUID *descr_uuid,
                                                       UINT16 start_handle, UINT16 end_handle,
                                                       btgatt_db_element_t **char_db,
-                                                      int *count);
+                                                      UINT16 *count);
 
-extern void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, int *count);
+extern void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count);
 
 extern tBTA_GATT_STATUS bta_gattc_init_cache(tBTA_GATTC_SERV *p_srvc_cb);
 extern void bta_gattc_rebuild_cache(tBTA_GATTC_SERV *p_srcv, UINT16 num_attr, tBTA_GATTC_NV_ATTR *attr);

components/bt/bluedroid/bta/hf_client/bta_hf_client_api.c

@@ -141,7 +141,7 @@ void BTA_HfClientRegister(tBTA_SEC sec_mask, tBTA_HF_CLIENT_FEAT features,
         p_buf->features = features;
         p_buf->sec_mask = sec_mask;
         if (p_service_name) {
-            BCM_STRNCPY_S(p_buf->name, BTA_SERVICE_NAME_LEN + 1, p_service_name, BTA_SERVICE_NAME_LEN);
+            BCM_STRNCPY_S(p_buf->name, p_service_name, BTA_SERVICE_NAME_LEN);
             p_buf->name[BTA_SERVICE_NAME_LEN] = 0;
         } else {
             p_buf->name[0] = '\0';

components/bt/bluedroid/bta/hf_client/bta_hf_client_at.c

@@ -75,12 +75,12 @@ typedef struct {
 /* CIND: storage room for indicators value range and their statuses */
 static const tBTA_HF_CLIENT_INDICATOR bta_hf_client_indicators[BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT] = {
     /* name                                | min | max | name length - used by parser */
-    {BTA_HF_CLIENT_INDICATOR_BATTERYCHG,     0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_BATTERYCHG)},
-    {BTA_HF_CLIENT_INDICATOR_SIGNAL,         0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_SIGNAL)},
-    {BTA_HF_CLIENT_INDICATOR_SERVICE,        0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_SERVICE)},
     {BTA_HF_CLIENT_INDICATOR_CALL,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_CALL)},
-    {BTA_HF_CLIENT_INDICATOR_ROAM,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_ROAM)},
     {BTA_HF_CLIENT_INDICATOR_CALLSETUP,      0,   3,    sizeof(BTA_HF_CLIENT_INDICATOR_CALLSETUP)},
+    {BTA_HF_CLIENT_INDICATOR_SERVICE,        0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_SERVICE)},
+    {BTA_HF_CLIENT_INDICATOR_SIGNAL,         0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_SIGNAL)},
+    {BTA_HF_CLIENT_INDICATOR_ROAM,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_ROAM)},
+    {BTA_HF_CLIENT_INDICATOR_BATTERYCHG,     0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_BATTERYCHG)},
     {BTA_HF_CLIENT_INDICATOR_CALLHELD,       0,   2,    sizeof(BTA_HF_CLIENT_INDICATOR_CALLHELD)}
 };
 
@@ -94,7 +94,7 @@ UINT32 service_index = 0;
 BOOLEAN service_availability = TRUE;
 /* helper functions for handling AT commands queueing */
 
-static void bta_hf_client_handle_ok();
+static void bta_hf_client_handle_ok(void);
 
 static void bta_hf_client_clear_queued_at(void)
 {
@@ -268,7 +268,7 @@ static void bta_hf_client_start_at_hold_timer(void)
 **   No buffer parsing is being done here.
 *******************************************************************************/
 
-static void bta_hf_client_handle_ok()
+static void bta_hf_client_handle_ok(void)
 {
     APPL_TRACE_DEBUG("%s", __FUNCTION__);
 
@@ -342,7 +342,7 @@ static void bta_hf_client_handle_error(tBTA_HF_CLIENT_AT_RESULT_TYPE type, UINT1
     bta_hf_client_send_queued_at();
 }
 
-static void bta_hf_client_handle_ring()
+static void bta_hf_client_handle_ring(void)
 {
     APPL_TRACE_DEBUG("%s", __FUNCTION__);
     bta_hf_client_evt_val(BTA_HF_CLIENT_RING_INDICATION, 0);
@@ -427,7 +427,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
 
     APPL_TRACE_DEBUG("%s index: %u value: %u", __FUNCTION__, index, value);
 
-    if (index == 0 || index > BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
+    if (index >= BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
         return;
     }
 
@@ -435,7 +435,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
         service_availability = value == 0 ? FALSE : TRUE;
     }
 
-    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index - 1];
+    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index];
 
     if (realind >= 0 && realind < BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT) {
         /* get the real in-array index from lookup table by index it comes at */
@@ -576,15 +576,17 @@ static void bta_hf_client_handle_btrh( UINT16 code)
 
 /* Check if prefix match and skip spaces if any */
 #define AT_CHECK_EVENT(buf, event) \
-    if (strncmp("\r\n"event, buf,sizeof("\r\n"event) - 1) != 0) return buf; \
-    buf += sizeof("\r\n"event) - 1; \
-    while (*buf == ' ') buf++;
+if (strncmp("\r\n"event,buf,sizeof("\r\n"event) - 1) != 0) \
+    return buf; \
+buf += sizeof("\r\n"event) - 1; \
+while (*buf == ' ') buf++;
 
 /* check for <cr><lf> and forward buffer if match */
 #define AT_CHECK_RN(buf) \
     if (strncmp("\r\n", buf, sizeof("\r\n") - 1) != 0) { \
-        APPL_TRACE_DEBUG("%s missing end <cr><lf>", __FUNCTION__); \
-        return NULL;} \
+        APPL_TRACE_ERROR("%s missing end <cr><lf>", __FUNCTION__); \
+        return NULL;\
+    } \
     buf += sizeof("\r\n") - 1;
 
 /* skip rest of AT string up to <cr> */
@@ -1022,20 +1024,20 @@ static char *bta_hf_client_parse_clcc(char *buffer)
 static char *bta_hf_client_parse_cnum(char *buffer)
 {
     char numstr[33];     /* spec forces 32 chars, plus one for \0*/
-    UINT16 type;
-    UINT16 service = 0; /* 0 in case this optional parameter is not being sent */
+    int type;
+    int service = 0; /* 0 in case this optional parameter is not being sent */
     int res;
     int offset;
 
     AT_CHECK_EVENT(buffer, "+CNUM:");
 
-    res = sscanf(buffer, ",\"%32[^\"]\",%hu,,%hu%n", numstr, &type, &service, &offset);
+    res = sscanf(buffer, ",\"%32[^\"]\",%d%n,,%d%n", numstr, &type, &offset, &service, &offset);
     if (res < 0) {
         return NULL;
     }
 
     if (res == 0) {
-        res = sscanf(buffer, ",\"\",%hu,,%hu%n", &type, &service, &offset);
+        res = sscanf(buffer, ",\"\",%d%n,,%d%n", &type, &offset, &service, &offset);
         if (res < 0) {
             return NULL;
         }
@@ -1045,7 +1047,7 @@ static char *bta_hf_client_parse_cnum(char *buffer)
         numstr[0] = '\0';
     }
 
-    if (res < 3) {
+    if (res < 2) {
         return NULL;
     }
 
@@ -1159,6 +1161,7 @@ static char *bta_hf_client_skip_unknown(char *buffer)
     buffer = tmp + 2;
 
     APPL_TRACE_DEBUG("%s %.*s", __FUNCTION__, buffer - start - 2, start);
+    UNUSED(start);
 
     return buffer;
 }
@@ -1256,7 +1259,7 @@ static void bta_hf_client_at_parse_start(void)
         for (i = 0; i < bta_hf_client_psraser_cb_count; i++) {
             tmp = bta_hf_client_parser_cb[i](buf);
             if (tmp == NULL) {
-                APPL_TRACE_ERROR("HFPCient: AT event/reply parsing failed, skipping");
+                APPL_TRACE_ERROR("HFPCient: AT event/reply parsing failed, skipping %d", i);
                 tmp = bta_hf_client_skip_unknown(buf);
                 break;
             }

components/bt/bluedroid/bta/hf_client/bta_hf_client_sco.c

@@ -308,6 +308,7 @@ static void bta_hf_client_sco_disc_cback(UINT16 sco_idx)
 #if (BTM_SCO_HCI_INCLUDED == TRUE )
         tBTM_STATUS status = BTM_ConfigScoPath(BTM_SCO_ROUTE_PCM, NULL, NULL, TRUE);
         APPL_TRACE_DEBUG("%s close config status = %d", __FUNCTION__, status);
+        UNUSED(status);
         /* SCO clean up here */
         bta_hf_client_sco_co_close();
 #endif

components/bt/bluedroid/bta/hh/bta_hh_act.c

@@ -101,8 +101,10 @@ void bta_hh_api_enable(tBTA_HH_DATA *p_data)
         bta_hh_le_enable();
     } else
 #endif
+    {
         /* signal BTA call back event */
         (* bta_hh_cb.p_cback)(BTA_HH_ENABLE_EVT, (tBTA_HH *)&status);
+    }
 }
 /*******************************************************************************
 **
@@ -901,7 +903,9 @@ void bta_hh_get_dscp_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
         bta_hh_le_get_dscp_act(p_cb);
     } else
 #endif
+    {
         (*bta_hh_cb.p_cback)(BTA_HH_GET_DSCP_EVT, (tBTA_HH *)&p_cb->dscp_info);
+    }
 }
 
 /*******************************************************************************
@@ -934,11 +938,10 @@ void bta_hh_maint_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
                 dev_info.status   = BTA_HH_OK;
             } else
 #endif
-
+            {
                 if (HID_HostAddDev(p_dev_info->bda, p_dev_info->attr_mask, &dev_handle)\
                         == HID_SUCCESS) {
                     dev_info.handle   = dev_handle;
-                    dev_info.status   = BTA_HH_OK;
 
 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
                     /* update DI information */
@@ -966,6 +969,7 @@ void bta_hh_maint_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
                     /* update cb_index[] map */
                     bta_hh_cb.cb_index[dev_handle] = p_cb->index;
                 }
+            }
         } else { /* device already been added */
             dev_info.handle = p_cb->hid_handle;
             dev_info.status = BTA_HH_OK;

components/bt/bluedroid/bta/hh/bta_hh_le.c

@@ -2183,9 +2183,10 @@ void bta_hh_le_write_char_descr_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_b
         case GATT_UUID_HID_BT_KB_INPUT:
         case GATT_UUID_HID_BT_MOUSE_INPUT:
         case GATT_UUID_HID_REPORT:
-            if (p_data->status == BTA_GATT_OK)
+            if (p_data->status == BTA_GATT_OK) {
                 p_dev_cb->hid_srvc[hid_inst_id].report[p_dev_cb->clt_cfg_idx].client_cfg_value =
                     BTA_GATT_CLT_CONFIG_NOTIFICATION;
+            }
             p_dev_cb->clt_cfg_idx ++;
             bta_hh_le_write_rpt_clt_cfg(p_dev_cb, hid_inst_id);
 

components/bt/bluedroid/bta/hh/bta_hh_utils.c

@@ -75,11 +75,12 @@ UINT8  bta_hh_find_cb(BD_ADDR bda)
             return xx;
         }
 #if BTA_HH_DEBUG
-        else
+        else {
             APPL_TRACE_DEBUG("in_use ? [%d] kdev[%d].hid_handle = %d state = [%d]",
                              bta_hh_cb.kdev[xx].in_use, xx,
                              bta_hh_cb.kdev[xx].hid_handle,
                              bta_hh_cb.kdev[xx].state);
+        }
 #endif
     }
 
@@ -123,7 +124,9 @@ void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB *p_cb)
             bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = BTA_HH_IDX_INVALID;
         } else
 #endif
+        {
             bta_hh_cb.cb_index[p_cb->hid_handle] = BTA_HH_IDX_INVALID;
+        }
     }
 
     /* reset device control block */
@@ -486,11 +489,12 @@ UINT8 bta_hh_dev_handle_to_cb_idx(UINT8 dev_handle)
 #endif
     } else
 #endif
+    {
         /* regular HID device checking */
         if (dev_handle < BTA_HH_MAX_KNOWN ) {
             index = bta_hh_cb.cb_index[dev_handle];
         }
-
+    }
     return index;
 
 }

components/bt/bluedroid/bta/include/bta/bta_api.h

@@ -769,6 +769,7 @@ typedef struct {
     tBLE_ADDR_TYPE  addr_type;          /* Peer device address type */
     tBT_DEVICE_TYPE dev_type;
     UINT8           auth_mode;
+    BOOLEAN           sc_support;         /* Denotes if peer device supported secure connection while bonding. */
 } tBTA_DM_AUTH_CMPL;
 
 
@@ -784,6 +785,7 @@ typedef struct {
 
 /* Structure associated with BTA_DM_LINK_UP_EVT */
 typedef struct {
+    BOOLEAN         sc_downgrade;       /* Security downgrade state. */
     BD_ADDR         bd_addr;            /* BD address peer device. */
 #if BLE_INCLUDED == TRUE
     tBTA_TRANSPORT  link_type;
@@ -1667,7 +1669,8 @@ extern void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passke
 extern void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class,
                             LINK_KEY link_key, tBTA_SERVICE_MASK trusted_mask,
                             BOOLEAN is_trusted, UINT8 key_type,
-                            tBTA_IO_CAP io_cap, UINT8 pin_length);
+                            tBTA_IO_CAP io_cap, UINT8 pin_length,
+                            UINT8 sc_support);
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/include/bta/bta_av_api.h

@@ -509,8 +509,10 @@ typedef struct {
     UINT32  company_id;         /* AVRCP Company ID */
     UINT16  avrc_mtu;           /* AVRCP MTU at L2CAP for control channel */
     UINT16  avrc_br_mtu;        /* AVRCP MTU at L2CAP for browsing channel */
-    UINT16  avrc_ct_cat;        /* AVRCP controller categories */
-    UINT16  avrc_tg_cat;        /* AVRCP target categories */
+    UINT16  avrc_snk_ct_cat;    /* AVRCP controller categories as SNK */
+    UINT16  avrc_snk_tg_cat;    /* AVRCP target categories SNK */
+    UINT16  avrc_src_ct_cat;    /* AVRCP controller categories as SRC */
+    UINT16  avrc_src_tg_cat;    /* AVRCP target categories as SRC */
     UINT16  sig_mtu;            /* AVDTP signaling channel MTU at L2CAP */
     UINT16  audio_mtu;          /* AVDTP audio transport channel MTU at L2CAP */
     const UINT16 *p_audio_flush_to;/* AVDTP audio transport channel flush timeout */

components/bt/bluedroid/bta/include/bta/bta_dm_co.h

@@ -205,6 +205,8 @@ extern void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key);
 
 extern void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size);
 
+extern void bta_dm_co_ble_set_min_key_size(UINT8 ble_key_size);
+
 extern void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable);
 
 extern UINT8 bta_dm_co_ble_get_accept_auth_enable(void);

components/bt/bluedroid/bta/include/bta/bta_gatt_api.h

@@ -152,7 +152,7 @@ typedef UINT8 tBTA_GATT_STATUS;
 #define BTA_GATTC_CLOSE_EVT             5   /* GATTC  close request status event */
 #define BTA_GATTC_SEARCH_CMPL_EVT       6   /* GATT discovery complete event */
 #define BTA_GATTC_SEARCH_RES_EVT        7   /* GATT discovery result event */
-#define BTA_GATTC_READ_DESCR_EVT        8   /* GATT read characterisitc descriptor event */
+#define BTA_GATTC_READ_DESCR_EVT        8   /* GATT read characteristic descriptor event */
 #define BTA_GATTC_WRITE_DESCR_EVT       9   /* GATT write characteristic descriptor event */
 #define BTA_GATTC_NOTIF_EVT             10  /* GATT attribute notification event */
 #define BTA_GATTC_PREP_WRITE_EVT        11  /* GATT prepare write  event */
@@ -739,7 +739,7 @@ extern void BTA_GATTC_Disable(void);
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTC module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_client_cb - pointer to the application callback function.
 **
 ** Returns          None
@@ -867,32 +867,32 @@ extern const tBTA_GATTC_CHARACTERISTIC* BTA_GATTC_GetCharacteristic(UINT16 conn_
 *******************************************************************************/
 extern const tBTA_GATTC_DESCRIPTOR* BTA_GATTC_GetDescriptor(UINT16 conn_id, UINT16 handle);
 
-extern void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid, 
-                                         btgatt_db_element_t **db, int *count);
+extern void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid,
+                                         btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                 btgatt_db_element_t **db, int *count);
+                                 btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
-                                       btgatt_db_element_t **db, int *count);
+                                       btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid,
-                                    btgatt_db_element_t **db, int *count);
+                                    btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t end_handle,
                                      tBT_UUID char_uuid, tBT_UUID descr_uuid,
-                                     btgatt_db_element_t **db, int *count);
+                                     btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid,
-                                           btgatt_db_element_t **db, int *count);
+                                           btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                        tBT_UUID *incl_uuid, btgatt_db_element_t **db, int *count);
+                                        tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count);
 
-extern void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count);
+extern void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count);
 
 extern void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                      UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count);
+                                      UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count);
 
 /*******************************************************************************
 **
@@ -907,7 +907,7 @@ extern void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_
 **
 *******************************************************************************/
 extern void BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                btgatt_db_element_t **db, int *count);
+                                btgatt_db_element_t **db, UINT16 *count);
 
 /*******************************************************************************
 **
@@ -1202,7 +1202,7 @@ extern void BTA_GATTS_Disable(void);
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTS module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_cback - pointer to the application callback function.
 **
 ** Returns          None
@@ -1325,7 +1325,7 @@ extern void  BTA_GATTS_DeleteService(UINT16 service_id);
 ** Description      This function is called to start a service.
 **
 ** Parameters       service_id: the service ID to be started.
-**                  sup_transport: supported trasnport.
+**                  sup_transport: supported transport.
 **
 ** Returns          None.
 **

components/bt/bluedroid/bta/include/bta/bta_hf_client_api.h

@@ -115,15 +115,16 @@ typedef UINT8 tBTA_HF_CLIENT_EVT;
 
 typedef UINT8 tBTA_HF_CLIENT_STATUS;
 
-/* indicator type */
-#define BTA_HF_CLIENT_IND_BATTCH    0  /* Battery charge indicator */
-#define BTA_HF_CLIENT_IND_SIGNAL    1  /* Signal Strength indicator */
-#define BTA_HF_CLIENT_IND_SERVICE   2  /* Service availability indicator */
-#define BTA_HF_CLIENT_IND_CALL      3  /* Standard call status indicator*/
-#define BTA_HF_CLIENT_IND_ROAM      4  /* Roaming status indicator */
-#define BTA_HF_CLIENT_IND_CALLSETUP 5  /* Call setup status indicator */
-#define BTA_HF_CLIENT_IND_CALLHELD  6  /* Call hold status indicator */
-
+/* indicator constants HFP 1.1 and later */
+#define BTA_HF_CLIENT_IND_CALL             0   /* position of call indicator */
+#define BTA_HF_CLIENT_IND_CALLSETUP        1   /* position of callsetup indicator */
+#define BTA_HF_CLIENT_IND_SERVICE          2   /* position of service indicator */
+/* indicator constants HFP 1.5 and later */
+#define BTA_HF_CLIENT_IND_SIGNAL           3   /* position of signal strength indicator */
+#define BTA_HF_CLIENT_IND_ROAM             4   /* position of roaming indicator */
+#define BTA_HF_CLIENT_IND_BATTCH           5   /* position of battery charge indicator */
+#define BTA_HF_CLIENT_IND_CALLHELD         6   /* position of callheld indicator */
+#define BTA_HF_CLIENT_IND_BEARER           7   /* position of bearer indicator */
 typedef UINT8 tBTA_HF_CLIENT_IND_TYPE;
 
 /* AT commands */

components/bt/bluedroid/bta/jv/bta_jv_act.c

@@ -26,6 +26,7 @@
 #include <stdlib.h>
 
 #include "osi/allocator.h"
+#include "osi/osi.h"
 #include "stack/bt_types.h"
 #include "bta/utl.h"
 #include "bta/bta_sys.h"
@@ -137,7 +138,7 @@ UINT8 bta_jv_alloc_sec_id(void)
     return ret;
 
 }
-static int get_sec_id_used(void)
+UNUSED_ATTR static int get_sec_id_used(void)
 {
     int i;
     int used = 0;
@@ -146,12 +147,13 @@ static int get_sec_id_used(void)
             used++;
         }
     }
-    if (used == BTA_JV_NUM_SERVICE_ID)
+    if (used == BTA_JV_NUM_SERVICE_ID) {
         APPL_TRACE_ERROR("get_sec_id_used, sec id exceeds the limit:%d",
                          BTA_JV_NUM_SERVICE_ID);
+    }
     return used;
 }
-static int get_rfc_cb_used(void)
+UNUSED_ATTR static int get_rfc_cb_used(void)
 {
     int i;
     int used = 0;
@@ -160,9 +162,10 @@ static int get_rfc_cb_used(void)
             used++;
         }
     }
-    if (used == BTA_JV_MAX_RFC_CONN)
+    if (used == BTA_JV_MAX_RFC_CONN) {
         APPL_TRACE_ERROR("get_sec_id_used, rfc ctrl block exceeds the limit:%d",
                          BTA_JV_MAX_RFC_CONN);
+    }
     return used;
 }
 
@@ -474,19 +477,21 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                         < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si]) {
                     tBTA_JV_PCB *p_pcb = bta_jv_rfc_port_to_pcb(bta_jv_cb.rfc_cb[hi].rfc_hdl[si]);
                     if (p_pcb) {
-                        if (NULL == p_pcb->p_pm_cb)
+                        if (NULL == p_pcb->p_pm_cb) {
                             APPL_TRACE_WARNING("%s(jv_handle:"
                                                " 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to "
                                                "pm_cb?", __func__, jv_handle, p_pcb->port_handle, i);
+                        }
                         p_cb = &p_pcb->p_pm_cb;
                     }
                 }
             } else {
                 if (jv_handle < BTA_JV_MAX_L2C_CONN) {
                     tBTA_JV_L2C_CB *p_l2c_cb = &bta_jv_cb.l2c_cb[jv_handle];
-                    if (NULL == p_l2c_cb->p_pm_cb)
+                    if (NULL == p_l2c_cb->p_pm_cb) {
                         APPL_TRACE_WARNING("%s(jv_handle: "
                                            "0x%x): p_pm_cb: %d: no link to pm_cb?", __func__, jv_handle, i);
+                    }
                     p_cb = &p_l2c_cb->p_pm_cb;
                 }
             }
@@ -742,9 +747,10 @@ void bta_jv_get_channel_id(tBTA_JV_MSG *p_data)
             bta_jv_cb.scn[channel - 1] = TRUE;
             scn = (UINT8) channel;
         }
-        if (bta_jv_cb.p_dm_cback)
+        if (bta_jv_cb.p_dm_cback) {
             bta_jv_cb.p_dm_cback(BTA_JV_GET_SCN_EVT, (tBTA_JV *)&scn,
                                  p_data->alloc_channel.user_data);
+        }
         return;
     }
     case BTA_JV_CONN_TYPE_L2CAP:
@@ -998,6 +1004,9 @@ static bool create_base_record(const uint32_t sdp_handle, const char *name, cons
     APPL_TRACE_DEBUG("create_base_record: successfully created base service "
                    "record, handle: 0x%08x, scn: %d, name: %s, with_obex: %d",
                    sdp_handle, channel, name, with_obex);
+
+    UNUSED(stage);
+
     return TRUE;
 }
 
@@ -1031,6 +1040,8 @@ static int add_spp_sdp(const char *name, const int channel) {
 
     APPL_TRACE_DEBUG("add_spp_sdp: service registered successfully, "
                    "service_name: %s, handle 0x%08x)", name, handle);
+    UNUSED(stage);
+
     return handle;
 }
 
@@ -1523,6 +1534,7 @@ static int bta_jv_port_data_co_cback(UINT16 port_handle, UINT8 *buf, UINT16 len,
     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
     int ret = 0;
     APPL_TRACE_DEBUG("%s, p_cb:%p, p_pcb:%p, len:%d, type:%d", __func__, p_cb, p_pcb, len, type);
+    UNUSED(p_cb);
     if (p_pcb != NULL) {
         switch (type) {
         case DATA_CO_CALLBACK_TYPE_INCOMING:

components/bt/bluedroid/btc/core/btc_ble_storage.c

@@ -750,7 +750,9 @@ static void _btc_read_le_key(const uint8_t key_type, const size_t key_len, bt_bd
                 *device_added = true;
             }
 
+#if (!CONFIG_BT_STACK_NO_LOG)
             char bd_str[20] = {0};
+#endif
             BTC_TRACE_DEBUG("%s() Adding key type %d for %s", __func__,
                 key_type, bdaddr_to_string(&bd_addr, bd_str, sizeof(bd_str)));
             BTA_DmAddBleKey(bta_bd_addr, (tBTA_LE_KEY_VALUE *)buffer, key_type);

components/bt/bluedroid/btc/core/btc_dm.c

@@ -290,12 +290,36 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 
     }
 
+#if (CONFIG_BT_STACK_NO_LOG)
+    (void) status;
+#endif
     BTC_TRACE_DEBUG("%s, authentication status = %x", __func__, status);
     return;
 
 }
 #endif ///SMP_INCLUDED == TRUE
 
+static void btc_dm_link_up_evt(tBTA_DM_LINK_UP *p_link_up)
+{
+    BD_ADDR bd_addr;
+    bt_bdaddr_t bt_bdaddr;
+
+
+    if (p_link_up->sc_downgrade == 1) {
+        memcpy(bt_bdaddr.address, p_link_up->bd_addr, sizeof(BD_ADDR));
+        if (btc_storage_remove_bonded_device(&bt_bdaddr) == BT_STATUS_SUCCESS) {
+            memcpy(bd_addr, p_link_up->bd_addr, sizeof(BD_ADDR));
+            if (BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS) {
+                BTC_TRACE_EVENT(" %s() Bonding information removed.", __FUNCTION__);
+            } else {
+                BTC_TRACE_ERROR(" %s() BTA_DmRemoveDevice error", __FUNCTION__);
+            }
+        } else {
+            BTC_TRACE_ERROR(" %s() btc_storage_remove_bonded_device error", __FUNCTION__);
+        }
+    }
+}
+
 static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 {
     /* Save link key, if not temporary */
@@ -319,7 +343,7 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
                           __FUNCTION__, p_auth_cmpl->key_type);
                 ret = btc_storage_add_bonded_device(&bd_addr,
                                                     p_auth_cmpl->key, p_auth_cmpl->key_type,
-                                                    16);
+                                                    16, p_auth_cmpl->sc_support);
                 BTC_ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
             } else {
                 BTC_TRACE_DEBUG("%s: Temporary key. Not storing. key_type=0x%x",
@@ -661,12 +685,14 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
         break;
         }
 #endif /* BTC_GAP_BT_INCLUDED  == TRUE */
-    case BTA_DM_LINK_UP_EVT:
     case BTA_DM_LINK_DOWN_EVT:
     case BTA_DM_HW_ERROR_EVT:
         BTC_TRACE_DEBUG( "btc_dm_sec_cback : unhandled event (%d)\n", msg->act );
         break;
-#if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
+    case BTA_DM_LINK_UP_EVT:
+        btc_dm_link_up_evt(&p_data->link_up);
+        break;
+#if ((BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
     case BTA_DM_BLE_AUTH_CMPL_EVT: {
         rsp_app = true;
         ble_msg.act = ESP_GAP_BLE_AUTH_CMPL_EVT;

components/bt/bluedroid/btc/core/btc_main.c

@@ -67,11 +67,18 @@ static void btc_init_bluetooth(void)
     //load the ble local key which has been stored in the flash
     btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
+#if BTA_DYNAMIC_MEMORY
+    deinit_semaphore = xSemaphoreCreateBinary();
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 
 static void btc_deinit_bluetooth(void)
 {
+    /* Wait for the disable operation to complete */
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreTake(deinit_semaphore, BTA_DISABLE_DELAY / portTICK_PERIOD_MS);
+#endif /* #if BTA_DYNAMIC_MEMORY */
     btc_gap_ble_deinit();
     bta_dm_sm_deinit();
 #if (GATTC_INCLUDED)
@@ -87,6 +94,10 @@ static void btc_deinit_bluetooth(void)
     osi_alarm_deinit();
     osi_alarm_delete_mux();
     future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);
+#if BTA_DYNAMIC_MEMORY
+    vSemaphoreDelete(deinit_semaphore);
+    deinit_semaphore = NULL;
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 void btc_main_call_handler(btc_msg_t *msg)

components/bt/bluedroid/btc/core/btc_storage.c

@@ -37,7 +37,8 @@
 bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
         LINK_KEY link_key,
         uint8_t key_type,
-        uint8_t pin_length)
+        uint8_t pin_length,
+        BOOLEAN sc_support)
 {
     bdstr_t bdstr;
 
@@ -48,6 +49,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
     int ret = btc_config_set_int(bdstr, BTC_STORAGE_LINK_KEY_TYPE_STR, (int)key_type);
     ret &= btc_config_set_int(bdstr, BTC_STORAGE_PIN_LENGTH_STR, (int)pin_length);
     ret &= btc_config_set_bin(bdstr, BTC_STORAGE_LINK_KEY_STR, link_key, sizeof(LINK_KEY));
+    ret &= btc_config_set_bin(bdstr, BTC_STORAGE_SC_SUPPORT, (uint8_t *)&sc_support, sizeof(sc_support));
     /* write bonded info immediately */
     btc_config_flush();
     btc_config_unlock();
@@ -69,6 +71,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
 static bt_status_t btc_in_fetch_bonded_devices(int add)
 {
     BOOLEAN bt_linkkey_file_found = FALSE;
+    UINT8 sc_support = 0;
 
     btc_config_lock();
     for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end(); iter = btc_config_section_next(iter)) {
@@ -93,9 +96,11 @@ static bt_status_t btc_in_fetch_bonded_devices(int add)
                         uint2devclass((UINT32)cod, dev_class);
                     }
                     btc_config_get_int(name, BTC_STORAGE_PIN_LENGTH_STR, &pin_length);
+                    size = sizeof(sc_support);
+                    btc_config_get_bin(name, BTC_STORAGE_SC_SUPPORT, &sc_support, &size);
 #if (SMP_INCLUDED == TRUE)
                     BTA_DmAddDevice(bd_addr.address, dev_class, link_key, 0, 0,
-                                    (UINT8)linkkey_type, 0, pin_length);
+                                    (UINT8)linkkey_type, 0, pin_length, (UINT8)sc_support);
 #endif  ///SMP_INCLUDED == TRUE
                 }
                 bt_linkkey_file_found = TRUE;
@@ -160,6 +165,9 @@ bt_status_t btc_storage_remove_bonded_device(bt_bdaddr_t *remote_bd_addr)
     if (btc_config_exist(bdstr, BTC_STORAGE_LINK_KEY_STR)) {
         ret &= btc_config_remove(bdstr, BTC_STORAGE_LINK_KEY_STR);
     }
+    if (btc_config_exist(bdstr, BTC_STORAGE_SC_SUPPORT)) {
+        ret &= btc_config_remove(bdstr, BTC_STORAGE_SC_SUPPORT);
+    }
     /* write bonded info immediately */
     btc_config_flush();
     btc_config_unlock();
@@ -187,6 +195,7 @@ int btc_storage_get_num_bt_bond_devices(void)
         if (string_is_bdaddr(name) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
             btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
+            btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
             num_dev++;
         }
@@ -223,6 +232,7 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
         if (string_is_bdaddr(name) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
             btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
+            btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
             string_to_bdaddr(name, &bd_addr);
             memcpy(bond_dev, &bd_addr, sizeof(bt_bdaddr_t));
@@ -232,4 +242,4 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
     btc_config_unlock();
 
     return BT_STATUS_SUCCESS;
-}
+}

components/bt/bluedroid/btc/include/btc/btc_storage.h

@@ -25,6 +25,7 @@
 #define BTC_STORAGE_LINK_KEY_STR        "LinkKey"    /* same as the ble */
 #define BTC_STORAGE_LINK_KEY_TYPE_STR   "LinkKeyType"
 #define BTC_STORAGE_PIN_LENGTH_STR      "PinLength"
+#define BTC_STORAGE_SC_SUPPORT          "SCSupport"
 
 /*******************************************************************************
 **
@@ -40,7 +41,8 @@
 bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
         LINK_KEY link_key,
         uint8_t key_type,
-        uint8_t pin_length);
+        uint8_t pin_length,
+        BOOLEAN sc_support);
 
 /*******************************************************************************
 **

components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c

@@ -147,6 +147,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
             if (blufi_env.prepare_buf == NULL) {
                 blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
+                blufi_env.prepare_len = 0;
                 if (blufi_env.prepare_buf == NULL) {
                     BLUFI_TRACE_ERROR("Blufi prep no mem\n");
                     status = GATT_NO_RESOURCES;
@@ -170,6 +171,15 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
             BTA_GATTS_SendRsp(p_data->req_data.conn_id, p_data->req_data.trans_id,
                           status, &rsp);
 
+            if(status != GATT_SUCCESS) {
+                if (blufi_env.prepare_buf) {
+                    osi_free(blufi_env.prepare_buf);
+                    blufi_env.prepare_buf = NULL;
+                    blufi_env.prepare_len = 0;
+                }
+                BLUFI_TRACE_ERROR("write data error , error code 0x%x\n", status);
+                return;
+            }
             memcpy(blufi_env.prepare_buf + p_data->req_data.p_data->write_req.offset,
                    p_data->req_data.p_data->write_req.value,
                    p_data->req_data.p_data->write_req.len);
@@ -194,13 +204,14 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         BTA_GATTS_SendRsp(p_data->req_data.conn_id, p_data->req_data.trans_id,
                     GATT_SUCCESS, NULL);
 
-        if (p_data->req_data.p_data->exec_write == GATT_PREP_WRITE_EXEC) {
+        if (blufi_env.prepare_buf && p_data->req_data.p_data->exec_write == GATT_PREP_WRITE_EXEC) {
             btc_blufi_recv_handler(blufi_env.prepare_buf, blufi_env.prepare_len);
         }
 
         if (blufi_env.prepare_buf) {
             osi_free(blufi_env.prepare_buf);
             blufi_env.prepare_buf = NULL;
+            blufi_env.prepare_len = 0;
         }
 
         break;
@@ -272,6 +283,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
         blufi_env.conn_id = p_data->conn.conn_id;
         blufi_env.is_connected = true;
+        blufi_env.recv_seq = blufi_env.send_seq = 0;
 
         msg.sig = BTC_SIG_API_CB;
         msg.pid = BTC_PID_BLUFI;
@@ -294,7 +306,6 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
         memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
         blufi_env.conn_id = p_data->conn.conn_id;
-        blufi_env.is_connected = false;
         blufi_env.recv_seq = blufi_env.send_seq = 0;
         blufi_env.sec_mode = 0x0;
 
@@ -418,11 +429,19 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
             blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
             if (blufi_env.aggr_buf == NULL) {
                 BTC_TRACE_ERROR("%s no mem, len %d\n", __func__, blufi_env.total_len);
+                btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
                 return;
             }
         }
-        memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len  - 2);
-        blufi_env.offset += (hdr->data_len - 2);
+        if (blufi_env.offset + hdr->data_len  - 2 <= blufi_env.total_len){
+            memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len  - 2);
+            blufi_env.offset += (hdr->data_len - 2);
+        } else {
+            BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
+            btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+            return;
+        }
+
     } else {
         if (blufi_env.offset > 0) {   /* if previous pkt is frag */
             memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);
@@ -444,6 +463,11 @@ void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
     uint16_t checksum;
     int ret;
 
+    if (blufi_env.is_connected == false) {
+        BTC_TRACE_ERROR("blufi connection has been disconnected \n");
+        return;
+    }
+
     while (remain_len > 0) {
         if (remain_len > blufi_env.frag_size) {
             hdr = osi_malloc(sizeof(struct blufi_hdr) + 2 + blufi_env.frag_size + 2);

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c

@@ -117,7 +117,7 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
     APPL_TRACE_DEBUG("BTC MEDIA (A2DP-DATA) EVENT %u", ctrl);
 
     if (btc_aa_ctrl_cb.a2dp_cmd_pending != ESP_A2D_MEDIA_CTRL_NONE) {
-        APPL_TRACE_DEBUG("un-acked a2dp cmd: %u", btc_aa_ctrl_cb.a2dp_cmd_pending);
+        APPL_TRACE_WARNING("un-acked a2dp cmd: %u", btc_aa_ctrl_cb.a2dp_cmd_pending);
         a2dp_cmd_acknowledge(ctrl, ESP_A2D_MEDIA_CTRL_ACK_BUSY);
         return;
     }
@@ -179,6 +179,11 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
         /* local suspend */
         if (btc_av_stream_started_ready()) {
             btc_dispatch_sm_event(BTC_AV_SUSPEND_STREAM_REQ_EVT, NULL, 0);
+#if (BTC_AV_SINK_INCLUDED == TRUE)
+            if (btc_av_get_peer_sep() == AVDT_TSEP_SRC && btc_av_get_service_id() == BTA_A2DP_SINK_SERVICE_ID) {
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+            }
+#endif
         } else {
             /* we are not in started state; just ack back ok. This can happen if we are
                remotely suspended; clear REMOTE SUSPEND Flag */

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c

@@ -615,6 +615,7 @@ static void btc_a2dp_sink_handle_decoder_reset(tBTC_MEDIA_SINK_CFG_UPDATE *p_msg
 
     int frames_to_process = ((freq_multiple) / (num_blocks * num_subbands)) + 1;
     APPL_TRACE_EVENT(" Frames to be processed in 20 ms %d\n", frames_to_process);
+    UNUSED(frames_to_process);
 }
 
 /*******************************************************************************
@@ -827,6 +828,8 @@ static void btc_a2dp_sink_thread_cleanup(UNUSED_ATTR void *context)
 
     fixed_queue_free(btc_aa_snk_cb.RxSbcQ, osi_free_func);
 
+    btc_aa_snk_cb.RxSbcQ = NULL;
+
     future_ready(btc_a2dp_sink_future, NULL);
 }
 

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c

@@ -495,10 +495,11 @@ static UINT64 time_now_us()
 static void log_tstamps_us(char *comment)
 {
     static UINT64 prev_us = 0;
-    const UINT64 now_us = time_now_us();
+    UINT64 now_us = time_now_us();
     APPL_TRACE_DEBUG("[%s] ts %08llu, diff : %08llu, queue sz %d", comment, now_us, now_us - prev_us,
                      fixed_queue_length(btc_aa_src_cb.TxAaQ));
     prev_us = now_us;
+    UNUSED(prev_us);
 }
 
 /* when true media task discards any tx frames */
@@ -1155,10 +1156,16 @@ static UINT8 btc_get_num_aa_frame(void)
 
         /* calculate nbr of frames pending for this media tick */
         result = btc_aa_src_cb.media_feeding_state.pcm.counter / pcm_bytes_per_frame;
-        if (result > MAX_PCM_FRAME_NUM_PER_TICK) {
-            APPL_TRACE_WARNING("%s() - Limiting frames to be sent from %d to %d"
-                               , __FUNCTION__, result, MAX_PCM_FRAME_NUM_PER_TICK);
-            result = MAX_PCM_FRAME_NUM_PER_TICK;
+
+        /* limit the frames to be sent */
+        UINT32 frm_nb_threshold = MAX_OUTPUT_A2DP_SRC_FRAME_QUEUE_SZ - fixed_queue_length(btc_aa_src_cb.TxAaQ);
+        if (frm_nb_threshold > MAX_PCM_FRAME_NUM_PER_TICK) {
+            frm_nb_threshold = MAX_PCM_FRAME_NUM_PER_TICK;
+        }
+
+        if (result > frm_nb_threshold) {
+            APPL_TRACE_EVENT("Limit frms to send from %d to %d", result, frm_nb_threshold);
+            result = frm_nb_threshold;
         }
         btc_aa_src_cb.media_feeding_state.pcm.counter -= result * pcm_bytes_per_frame;
 
@@ -1657,6 +1664,8 @@ static void btc_a2dp_source_thread_cleanup(UNUSED_ATTR void *context)
 
     fixed_queue_free(btc_aa_src_cb.TxAaQ, osi_free_func);
 
+    btc_aa_src_cb.TxAaQ = NULL;
+
     future_ready(btc_a2dp_source_future, NULL);
 }
 

components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c

@@ -1199,10 +1199,13 @@ static void bte_av_media_callback(tBTA_AV_EVT event, tBTA_AV_MEDIA *p_data)
             BTC_TRACE_ERROR("ERROR dump_codec_info A2D_ParsSbcInfo fail:%d\n", a2d_status);
         }
     }
+    UNUSED(que_len);
 }
 #else
 static void bte_av_media_callback(tBTA_AV_EVT event, tBTA_AV_MEDIA *p_data)
 {
+    UNUSED(event);
+    UNUSED(p_data);
     BTC_TRACE_WARNING("%s : event %u\n", __func__, event);
 }
 #endif

components/bt/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -251,7 +251,7 @@ static void handle_rc_attributes_rsp ( tAVRC_MSG_VENDOR *vendor_msg)
 
         btc_avrc_ct_cb_to_app(ESP_AVRC_CT_METADATA_RSP_EVT, &param[i]);
 
-        attr_index += (int) vendor_msg->p_vendor_data[7 + attr_index] + 8;
+        attr_index += attr_length + 8;
     }
 }
 
@@ -335,6 +335,8 @@ static void handle_rc_passthrough_rsp ( tBTA_AV_REMOTE_RSP *p_remote_rsp)
     } else {
         BTC_TRACE_ERROR("%s DUT does not support AVRCP controller role", __FUNCTION__);
     }
+
+    UNUSED(status);
 #else
     BTC_TRACE_ERROR("%s AVRCP controller role is not enabled", __FUNCTION__);
 #endif

components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -1167,6 +1167,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                 bta_dm_co_ble_set_max_key_size(key_size);
                 break;
             }
+            case ESP_BLE_SM_MIN_KEY_SIZE: {
+                uint8_t key_size = 0;
+                STREAM_TO_UINT8(key_size, value);
+                bta_dm_co_ble_set_min_key_size(key_size);
+                break;
+            }
             case ESP_BLE_SM_SET_STATIC_PASSKEY: {
                 uint32_t passkey = 0;
                 for(uint8_t i = 0; i < arg->set_security_param.len; i++)

components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -315,7 +315,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int svc_num = 0;
+    uint16_t svc_num = 0;
     tBT_UUID *bta_uuid = NULL;
     if (svc_uuid) {
         bta_uuid = osi_malloc(sizeof(tBT_UUID));
@@ -324,7 +324,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
 
     BTA_GATTC_GetServiceWithUUID(conn_id, bta_uuid, &db, &svc_num);
 
-    if ((status = btc_gattc_check_valid_param(svc_num, offset)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)svc_num, offset)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
@@ -334,7 +334,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)svc_num, ESP_GATT_DB_PRIMARY_SERVICE, offset, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, svc_num, ESP_GATT_DB_PRIMARY_SERVICE, offset, (void *)result, db);
     }
 
     *count = svc_num;
@@ -356,17 +356,17 @@ esp_gatt_status_t btc_ble_gattc_get_all_char(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int char_num = 0;
+    uint16_t char_num = 0;
     BTA_GATTC_GetAllChar(conn_id, start_handle, end_handle, &db, &char_num);
 
-    if ((status = btc_gattc_check_valid_param(char_num, offset)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)char_num, offset)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, offset, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, char_num, ESP_GATT_DB_CHARACTERISTIC, offset, (void *)result, db);
     }
 
     *count = char_num;
@@ -384,17 +384,17 @@ esp_gatt_status_t btc_ble_gattc_get_all_descr(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int descr_num = 0;
+    uint16_t descr_num = 0;
     BTA_GATTC_GetAllDescriptor(conn_id, char_handle, &db, &descr_num);
 
-    if ((status = btc_gattc_check_valid_param(descr_num, offset)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)descr_num, offset)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, offset, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, descr_num, ESP_GATT_DB_DESCRIPTOR, offset, (void *)result, db);
     }
 
     *count = descr_num;
@@ -414,19 +414,19 @@ esp_gatt_status_t btc_ble_gattc_get_char_by_uuid(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int char_num = 0;
+    uint16_t char_num = 0;
     tBT_UUID bta_uuid = {0};
     btc_to_bta_uuid(&bta_uuid, &char_uuid);
     BTA_GATTC_GetCharByUUID(conn_id, start_handle, end_handle, bta_uuid, &db, &char_num);
 
-    if ((status = btc_gattc_check_valid_param(char_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)char_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, char_num, ESP_GATT_DB_CHARACTERISTIC, 0, (void *)result, db);
     }
 
     *count = char_num;
@@ -447,7 +447,7 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_uuid(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int descr_num = 0;
+    uint16_t descr_num = 0;
     tBT_UUID bta_char_uuid = {0};
     tBT_UUID bta_descr_uuid = {0};
     btc_to_bta_uuid(&bta_char_uuid, &char_uuid);
@@ -456,14 +456,14 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_uuid(uint16_t conn_id,
     BTA_GATTC_GetDescrByUUID(conn_id, start_handle, end_handle,
                              bta_char_uuid, bta_descr_uuid, &db, &descr_num);
 
-    if ((status = btc_gattc_check_valid_param(descr_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)descr_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
     }
 
     *count = descr_num;
@@ -482,20 +482,20 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_char_handle(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int descr_num = 0;
+    uint16_t descr_num = 0;
     tBT_UUID bta_descr_uuid = {0};
     btc_to_bta_uuid(&bta_descr_uuid, &descr_uuid);
 
     BTA_GATTC_GetDescrByCharHandle(conn_id, char_handle, bta_descr_uuid, &db, &descr_num);
 
-    if ((status = btc_gattc_check_valid_param(descr_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)descr_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
     }
 
     *count = descr_num;
@@ -516,7 +516,7 @@ esp_gatt_status_t btc_ble_gattc_get_include_service(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int incl_num = 0;
+    uint16_t incl_num = 0;
     tBT_UUID bta_uuid = {0};
 
     if (incl_uuid != NULL) {
@@ -526,14 +526,14 @@ esp_gatt_status_t btc_ble_gattc_get_include_service(uint16_t conn_id,
         BTA_GATTC_GetIncludeService(conn_id, start_handle, end_handle, NULL, &db, &incl_num);
     }
 
-    if ((status = btc_gattc_check_valid_param(incl_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)incl_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     }else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)incl_num, ESP_GATT_DB_INCLUDED_SERVICE, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, incl_num, ESP_GATT_DB_INCLUDED_SERVICE, 0, (void *)result, db);
     }
 
     *count = incl_num;
@@ -552,9 +552,9 @@ esp_gatt_status_t btc_ble_gattc_get_attr_count(uint16_t conn_id,
                                                uint16_t *count)
 {
     if (type == ESP_GATT_DB_ALL) {
-        BTA_GATTC_GetDBSize(conn_id, start_handle, end_handle, (int *)count);
+        BTA_GATTC_GetDBSize(conn_id, start_handle, end_handle, count);
     } else {
-        BTA_GATTC_GetDBSizeByType(conn_id, type, start_handle, end_handle, char_handle, (int *)count);
+        BTA_GATTC_GetDBSizeByType(conn_id, type, start_handle, end_handle, char_handle, count);
     }
 
     return ESP_GATT_OK;
@@ -564,7 +564,7 @@ esp_gatt_status_t btc_ble_gattc_get_db(uint16_t conn_id, uint16_t start_handle,
                                        esp_gattc_db_elem_t *db, uint16_t *count)
 {
     btgatt_db_element_t *get_db = NULL;
-    int num = 0;
+    uint16_t num = 0;
     tBT_UUID bta_uuid;
     uint16_t db_size = 0;
     BTA_GATTC_GetGattDb(conn_id, start_handle, end_handle, &get_db, &num);

components/bt/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -81,72 +81,105 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 
     switch (msg->act) {
     case BTC_GATTS_ACT_SEND_INDICATE: {
-        dst->send_ind.value = (uint8_t *)osi_malloc(src->send_ind.value_len);
-        if (dst->send_ind.value) {
-            memcpy(dst->send_ind.value, src->send_ind.value, src->send_ind.value_len);
+        if (src->send_ind.value && (src->send_ind.value_len > 0)) {
+            dst->send_ind.value = (uint8_t *) osi_malloc(src->send_ind.value_len);
+            if (dst->send_ind.value) {
+                memcpy(dst->send_ind.value, src->send_ind.value, src->send_ind.value_len);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
+            }
         } else {
-            BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
+            dst->send_ind.value = NULL;
+            if (src->send_ind.value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
+            }
         }
         break;
     }
     case BTC_GATTS_ACT_SEND_RESPONSE: {
         if (src->send_rsp.rsp) {
-            dst->send_rsp.rsp = (esp_gatt_rsp_t *)osi_malloc(sizeof(esp_gatt_rsp_t));
+            dst->send_rsp.rsp = (esp_gatt_rsp_t *) osi_malloc(sizeof(esp_gatt_rsp_t));
             if (dst->send_rsp.rsp) {
                 memcpy(dst->send_rsp.rsp, src->send_rsp.rsp, sizeof(esp_gatt_rsp_t));
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
             }
+        } else {
+            BTC_TRACE_WARNING("%s %d, NULL response", __func__, msg->act);
         }
         break;
     
     }
-    case BTC_GATTS_ACT_ADD_CHAR:{
-        if (src->add_char.char_val.attr_value != NULL){
-            dst->add_char.char_val.attr_value = (uint8_t *)osi_malloc(src->add_char.char_val.attr_len);
-            if(dst->add_char.char_val.attr_value != NULL){
+    case BTC_GATTS_ACT_ADD_CHAR: {
+        if (src->add_char.char_val.attr_value && (src->add_char.char_val.attr_len > 0)) {
+            dst->add_char.char_val.attr_value = (uint8_t *) osi_malloc(src->add_char.char_val.attr_len);
+            if (dst->add_char.char_val.attr_value) {
                 memcpy(dst->add_char.char_val.attr_value, src->add_char.char_val.attr_value, 
                         src->add_char.char_val.attr_len);
-            }else{
+            } else {
                 BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
             }
+        } else {
+            dst->add_char.char_val.attr_value = NULL;
+            if (src->add_char.char_val.attr_value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
+            }
         }
         break;
     }
-    case BTC_GATTS_ACT_ADD_CHAR_DESCR:{
-        if(src->add_descr.descr_val.attr_value != NULL){
-            dst->add_descr.descr_val.attr_value = (uint8_t *)osi_malloc(src->add_descr.descr_val.attr_len);
-            if(dst->add_descr.descr_val.attr_value != NULL){
+    case BTC_GATTS_ACT_ADD_CHAR_DESCR: {
+        if (src->add_descr.descr_val.attr_value && (src->add_descr.descr_val.attr_len > 0)) {
+            dst->add_descr.descr_val.attr_value = (uint8_t *) osi_malloc(src->add_descr.descr_val.attr_len);
+            if (dst->add_descr.descr_val.attr_value) {
                 memcpy(dst->add_descr.descr_val.attr_value, src->add_descr.descr_val.attr_value,
                         src->add_descr.descr_val.attr_len);
-            }else{
+            } else {
                 BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
             }
-        }
-        break;
-    }
-    case BTC_GATTS_ACT_CREATE_ATTR_TAB:{
-        uint8_t num_attr = src->create_attr_tab.max_nb_attr;
-        if(src->create_attr_tab.gatts_attr_db != NULL){
-            dst->create_attr_tab.gatts_attr_db = (esp_gatts_attr_db_t *)osi_malloc(sizeof(esp_gatts_attr_db_t)*num_attr);
-            if(dst->create_attr_tab.gatts_attr_db != NULL){
-                memcpy(dst->create_attr_tab.gatts_attr_db, src->create_attr_tab.gatts_attr_db,
-                        sizeof(esp_gatts_attr_db_t)*num_attr);
-            }else{
-                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+        } else {
+            dst->add_descr.descr_val.attr_value = NULL;
+            if (src->add_descr.descr_val.attr_value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
             }
         }
         break;
     }
-   case BTC_GATTS_ACT_SET_ATTR_VALUE:{
-        uint16_t len = src->set_attr_val.length;
-        if(src->set_attr_val.value){
-            dst->set_attr_val.value = (uint8_t *)osi_malloc(len);
-            if(dst->set_attr_val.value != NULL){
-                memcpy(dst->set_attr_val.value, src->set_attr_val.value, len);
-            }else{
+    case BTC_GATTS_ACT_CREATE_ATTR_TAB: {
+        uint8_t num_attr = src->create_attr_tab.max_nb_attr;
+        if (src->create_attr_tab.gatts_attr_db && (num_attr > 0)) {
+            dst->create_attr_tab.gatts_attr_db = (esp_gatts_attr_db_t *) osi_malloc(sizeof(esp_gatts_attr_db_t) * num_attr);
+            if (dst->create_attr_tab.gatts_attr_db) {
+                memcpy(dst->create_attr_tab.gatts_attr_db, src->create_attr_tab.gatts_attr_db,
+                        sizeof(esp_gatts_attr_db_t) * num_attr);
+            } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
             }
+        } else {
+            BTC_TRACE_ERROR("%s %d, NULL data", __func__, msg->act);
+        }
+        break;
+    }
+   case BTC_GATTS_ACT_SET_ATTR_VALUE: {
+        if (src->set_attr_val.value && (src->set_attr_val.length > 0)) {
+            dst->set_attr_val.value = (uint8_t *) osi_malloc(src->set_attr_val.length);
+            if (dst->set_attr_val.value) {
+                memcpy(dst->set_attr_val.value, src->set_attr_val.value, src->set_attr_val.length);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
+        } else {
+            dst->set_attr_val.value = NULL;
+            if (src->set_attr_val.value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
+            }
         }
         break;
     }
@@ -364,7 +397,13 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db,
             case ESP_GATT_UUID_CHAR_AGG_FORMAT:
             case ESP_GATT_UUID_CHAR_VALID_RANGE:
             case ESP_GATT_UUID_EXT_RPT_REF_DESCR:
-            case ESP_GATT_UUID_RPT_REF_DESCR:{
+            case ESP_GATT_UUID_RPT_REF_DESCR:
+            case ESP_GATT_UUID_NUM_DIGITALS_DESCR:
+            case ESP_GATT_UUID_VALUE_TRIGGER_DESCR:
+            case ESP_GATT_UUID_ENV_SENSING_CONFIG_DESCR:
+            case ESP_GATT_UUID_ENV_SENSING_MEASUREMENT_DESCR:
+            case ESP_GATT_UUID_ENV_SENSING_TRIGGER_DESCR:
+            case ESP_GATT_UUID_TIME_TRIGGER_DESCR: {
                 uint16_t svc_hal = btc_creat_tab_env.svc_start_hdl;
                 tBT_UUID bta_char_uuid;
                 esp_bt_uuid_t uuid_temp;
@@ -424,7 +463,7 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat
             case ESP_GATT_UUID_PRI_SERVICE:
             case ESP_GATT_UUID_SEC_SERVICE:
                 if (++svc_num > 1) {
-                    BTC_TRACE_ERROR("Each service table can only created one primary service or secondly service.");
+                    BTC_TRACE_ERROR("Each service table can only created one primary service or secondary service.");
                     return ESP_GATT_ERROR;
                 }
                 break;
@@ -690,10 +729,13 @@ void btc_gatts_call_handler(btc_msg_t *msg)
 #else
         //BTA_DmAddBleDevice(p_cb->bd_addr.address, addr_type, device_type);
 #endif
+        /*
+         not support background connection
         // Mark background connections
         if (!arg->open.is_direct) {
             BTA_DmBleSetBgConnType(BTM_BLE_CONN_AUTO, NULL);
         }
+        */
 
         transport = BTA_GATT_TRANSPORT_LE;
 
@@ -933,4 +975,13 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
     btc_gatts_cb_param_copy_free(msg, p_data);
 }
 
+void btc_congest_callback(tBTA_GATTS *param)
+{
+    esp_ble_gatts_cb_param_t esp_param;
+    esp_gatt_if_t gatts_if = BTC_GATT_GET_GATT_IF(param->congest.conn_id);
+    esp_param.congest.conn_id = BTC_GATT_GET_CONN_ID(param->congest.conn_id);
+    esp_param.congest.congested = param->congest.congested;
+    btc_gatts_cb_to_app(ESP_GATTS_CONGEST_EVT, gatts_if, &esp_param);
+
+}
 #endif  ///GATTS_INCLUDED

components/bt/bluedroid/btc/profile/std/hf_client/btc_hf_client.c

@@ -195,8 +195,9 @@ bt_status_t btc_hf_client_init(void)
 *******************************************************************************/
 static bt_status_t connect_int( bt_bdaddr_t *bd_addr, uint16_t uuid )
 {
-    if (is_connected(bd_addr))
+    if (is_connected(bd_addr)) {
         return BT_STATUS_BUSY;
+    }
 
     btc_hf_client_cb.state = ESP_HF_CLIENT_CONNECTION_STATE_CONNECTING;
     bdcpy(btc_hf_client_cb.connected_bda.address, bd_addr->address);
@@ -713,14 +714,14 @@ static void process_ind_evt(tBTA_HF_CLIENT_IND *ind)
 {
     esp_hf_client_cb_param_t param;
     memset(&param, 0, sizeof(esp_hf_client_cb_param_t));
-    
+
     switch (ind->type)
     {
         case BTA_HF_CLIENT_IND_CALL:
             param.call.status = ind->value;
             btc_hf_client_cb_to_app(ESP_HF_CLIENT_CIND_CALL_EVT, &param);
             break;
-    
+
         case BTA_HF_CLIENT_IND_CALLSETUP:
             param.call_setup.status = ind->value;
             btc_hf_client_cb_to_app(ESP_HF_CLIENT_CIND_CALL_SETUP_EVT, &param);
@@ -787,6 +788,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
             {
                 BTC_TRACE_WARNING("%s: HF CLient open failed, but another device connected. status=%d state=%d connected device=%s",
                         __FUNCTION__, p_data->open.status, btc_hf_client_cb.state, bdaddr_to_string(&btc_hf_client_cb.connected_bda, bdstr, sizeof(bdstr)));
+                UNUSED(bdstr);
                 break;
             }
 
@@ -795,18 +797,20 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 param.conn_stat.state = btc_hf_client_cb.state;
                 param.conn_stat.peer_feat = 0;
                 param.conn_stat.chld_feat = 0;
-            
+
                 memcpy(param.conn_stat.remote_bda, &btc_hf_client_cb.connected_bda,
                        sizeof(esp_bd_addr_t));
 
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_CONNECTION_STATE_EVT, &param);
             } while (0);
-            
-            if (btc_hf_client_cb.state == ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED)
-                bdsetany(btc_hf_client_cb.connected_bda.address);
 
-            if (p_data->open.status != BTA_HF_CLIENT_SUCCESS)
+            if (btc_hf_client_cb.state == ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED) {
+                bdsetany(btc_hf_client_cb.connected_bda.address);
+            }
+
+            if (p_data->open.status != BTA_HF_CLIENT_SUCCESS) {
                 btc_queue_advance();
+            }
 
             break;
 
@@ -820,13 +824,13 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 param.conn_stat.state = btc_hf_client_cb.state;
                 param.conn_stat.peer_feat = btc_hf_client_cb.peer_feat;
                 param.conn_stat.chld_feat = btc_hf_client_cb.chld_feat;
-            
+
                 memcpy(param.conn_stat.remote_bda, &btc_hf_client_cb.connected_bda,
                        sizeof(esp_bd_addr_t));
 
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_CONNECTION_STATE_EVT, &param);
             } while (0);
-            
+
             /* Inform the application about in-band ringtone */
             if (btc_hf_client_cb.peer_feat & BTA_HF_CLIENT_PEER_INBAND)
             {
@@ -839,7 +843,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
 
             btc_queue_advance();
             break;
-            
+
         case BTA_HF_CLIENT_CLOSE_EVT:
             btc_hf_client_cb.state = ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED;
             do {
@@ -847,7 +851,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 param.conn_stat.state = ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED;
                 param.conn_stat.peer_feat = 0;
                 param.conn_stat.chld_feat = 0;
-            
+
                 memcpy(param.conn_stat.remote_bda, &btc_hf_client_cb.connected_bda,
                        sizeof(esp_bd_addr_t));
 
@@ -980,7 +984,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 memset(&param, 0, sizeof(esp_hf_client_cb_param_t));
                 param.audio_stat.state = ESP_HF_CLIENT_AUDIO_STATE_CONNECTED;
                 memcpy(param.audio_stat.remote_bda, &btc_hf_client_cb.connected_bda,
-                       sizeof(esp_bd_addr_t));                
+                       sizeof(esp_bd_addr_t));
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_AUDIO_STATE_EVT, &param);
             } while (0);
             break;
@@ -989,7 +993,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 memset(&param, 0, sizeof(esp_hf_client_cb_param_t));
                 param.audio_stat.state = ESP_HF_CLIENT_AUDIO_STATE_CONNECTED_MSBC;
                 memcpy(param.audio_stat.remote_bda, &btc_hf_client_cb.connected_bda,
-                       sizeof(esp_bd_addr_t));                
+                       sizeof(esp_bd_addr_t));
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_AUDIO_STATE_EVT, &param);
             } while (0);
             break;

components/bt/bluedroid/btc/profile/std/spp/btc_spp.c

@@ -315,6 +315,7 @@ static void btc_spp_init(btc_spp_args_t *arg)
 {
     if (osi_mutex_new(&spp_local_param.spp_slot_mutex) != 0) {
         BTC_TRACE_ERROR("%s osi_mutex_new failed\n", __func__);
+        return;
     }
     spp_local_param.spp_mode = arg->init.mode;
     spp_local_param.spp_slot_id = 0;
@@ -323,6 +324,10 @@ static void btc_spp_init(btc_spp_args_t *arg)
 
 static void btc_spp_uninit(void)
 {
+    if (!spp_local_param.spp_slot_mutex) {
+        BTC_TRACE_ERROR("%s SPP have not been init\n", __func__);
+        return;
+    }
     osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
     for (size_t i = 1; i <= BTA_JV_MAX_RFC_SR_SESSION; i++) {
         if (spp_local_param.spp_slots[i] != NULL && spp_local_param.spp_slots[i]->connected) {

components/bt/bluedroid/common/include/common/bt_target.h

@@ -95,6 +95,10 @@
 #define CLASSIC_BT_INCLUDED         FALSE
 #endif /* CLASSIC_BT_INCLUDED */
 
+#ifndef CLASSIC_BT_GATT_INCLUDED
+#define CLASSIC_BT_GATT_INCLUDED    FALSE
+#endif /* CLASSIC_BT_GATT_INCLUDED */
+
 #ifndef CONFIG_GATTC_CACHE_NVS_FLASH
 #define CONFIG_GATTC_CACHE_NVS_FLASH         FALSE
 #endif /* CONFIG_GATTC_CACHE_NVS_FLASH */
@@ -130,6 +134,16 @@
 #define BLE_PRIVACY_SPT           FALSE
 #endif  /* CONFIG_SMP_ENABLE */
 
+#ifdef CONFIG_SMP_SLAVE_CON_PARAMS_UPD_ENABLE
+#if(CONFIG_SMP_SLAVE_CON_PARAMS_UPD_ENABLE)
+#define SMP_SLAVE_CON_PARAMS_UPD_ENABLE  TRUE
+#else
+#define SMP_SLAVE_CON_PARAMS_UPD_ENABLE  FALSE
+#endif
+#else
+#define SMP_SLAVE_CON_PARAMS_UPD_ENABLE  FALSE
+#endif
+
 #ifndef CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED
 #define BLE_ADV_REPORT_FLOW_CONTROL  FALSE
 #else
@@ -138,13 +152,13 @@
 
 #ifndef CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_NUM
 #define BLE_ADV_REPORT_FLOW_CONTROL_NUM   100
-#else 
+#else
 #define BLE_ADV_REPORT_FLOW_CONTROL_NUM     CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_NUM
 #endif /* CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_NUM */
 
 #ifndef CONFIG_BLE_ADV_REPORT_DISCARD_THRSHOLD
 #define BLE_ADV_REPORT_DISCARD_THRSHOLD  20
-#else 
+#else
 #define BLE_ADV_REPORT_DISCARD_THRSHOLD  CONFIG_BLE_ADV_REPORT_DISCARD_THRSHOLD
 #endif /* CONFIG_BLE_ADV_REPORT_DISCARD_THRSHOLD */
 
@@ -153,6 +167,12 @@
 #define GATT_MAX_PHY_CHANNEL CONFIG_BT_ACL_CONNECTIONS
 #endif  /* CONFIG_BT_ACL_CONNECTIONS */
 
+#if(CONFIG_BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT)
+#define BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT CONFIG_BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT
+#else
+#define BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT 30
+#endif
+
 //------------------Added from bdroid_buildcfg.h---------------------
 #ifndef L2CAP_EXTFEA_SUPPORTED_MASK
 #define L2CAP_EXTFEA_SUPPORTED_MASK (L2CAP_EXTFEA_ENH_RETRANS | L2CAP_EXTFEA_STREAM_MODE | L2CAP_EXTFEA_NO_CRC | L2CAP_EXTFEA_FIXED_CHNLS)

components/bt/bluedroid/common/include/common/bte_appl.h

@@ -31,6 +31,7 @@ typedef struct {
     UINT8   ble_init_key;
     UINT8   ble_resp_key;
     UINT8   ble_max_key_size;
+    UINT8   ble_min_key_size;
     UINT8   ble_accept_auth_enable;
 #endif
 
@@ -47,4 +48,4 @@ typedef struct {
 #endif
 } tBTE_BT_APPL_CFG;
 
-extern tBTE_BT_APPL_CFG bte_bt_appl_cfg;
+extern tBTE_BT_APPL_CFG bte_bt_appl_cfg;

components/bt/bluedroid/device/interop.c

@@ -27,6 +27,7 @@
 #define CASE_RETURN_STR(const) case const: return #const;
 
 #if (SMP_INCLUDED == TRUE)
+#if (!CONFIG_BT_STACK_NO_LOG)
 static const char *interop_feature_string(const interop_feature_t feature)
 {
     switch (feature) {
@@ -36,7 +37,7 @@ static const char *interop_feature_string(const interop_feature_t feature)
 
     return "UNKNOWN";
 }
-
+#endif // (!CONFIG_BT_STACK_NO_LOG)
 // Interface functions
 bool interop_match(const interop_feature_t feature, const bt_bdaddr_t *addr)
 {
@@ -47,7 +48,9 @@ bool interop_match(const interop_feature_t feature, const bt_bdaddr_t *addr)
     for (size_t i = 0; i != db_size; ++i) {
         if (feature == interop_database[i].feature &&
                 memcmp(addr, &interop_database[i].addr, interop_database[i].len) == 0) {
+#if (!CONFIG_BT_STACK_NO_LOG)
             char bdstr[20] = {0};
+#endif
             LOG_WARN("%s() Device %s is a match for interop workaround %s", __func__,
                      bdaddr_to_string(addr, bdstr, sizeof(bdstr)), interop_feature_string(feature));
             return true;

components/bt/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c

@@ -145,9 +145,10 @@ void sbc_enc_bit_alloc_mono(SBC_ENC_PARAMS *pstrCodecParams)
         for (s32Sb = 0; s32Sb < s32NumOfSubBands; s32Sb++) {
             if (*(ps16GenBufPtr) < s32BitSlice + 2) {
                 *(ps16GenArrPtr) = 0;
-            } else
+            } else {
                 *(ps16GenArrPtr) = ((*(ps16GenBufPtr) - s32BitSlice) < 16) ?
                                    (SINT16)(*(ps16GenBufPtr) - s32BitSlice) : 16;
+            }
 
             ps16GenBufPtr++;
             ps16GenArrPtr++;

components/bt/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c

@@ -132,9 +132,10 @@ void sbc_enc_bit_alloc_ste(SBC_ENC_PARAMS *pstrCodecParams)
         for (s32Sb = 0; s32Sb < s32NumOfSubBands; s32Sb++) {
             if (*ps16GenBufPtr < s32BitSlice + 2) {
                 *ps16GenArrPtr = 0;
-            } else
+            } else {
                 *ps16GenArrPtr = ((*(ps16GenBufPtr) - s32BitSlice) < 16) ?
                                  (SINT16)(*(ps16GenBufPtr) - s32BitSlice) : 16;
+            }
             ps16GenBufPtr++;
             ps16GenArrPtr++;
         }

components/bt/bluedroid/hci/hci_hal_h4.c

@@ -189,10 +189,10 @@ task_post_status_t hci_hal_h4_task_post(task_post_t timeout)
     evt.par = 0;
 
     if (xQueueSend(xHciH4Queue, &evt, timeout) != pdTRUE) {
-        return TASK_POST_SUCCESS;
+        return TASK_POST_FAIL;
     }
 
-    return TASK_POST_FAIL;
+    return TASK_POST_SUCCESS;
 }
 
 #if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
@@ -277,8 +277,10 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
     packet->offset++;
     packet->len--;
     if (type == HCI_BLE_EVENT) {
+#if (!CONFIG_BT_STACK_NO_LOG)
         uint8_t len = 0;
         STREAM_TO_UINT8(len, stream);
+#endif
         HCI_TRACE_ERROR("Workround stream corrupted during LE SCAN: pkt_len=%d ble_event_len=%d\n",
                   packet->len, len);
         osi_free(packet);

components/bt/bluedroid/hci/packet_fragmenter.c

@@ -88,6 +88,13 @@ static void fragment_and_dispatch(BT_HDR *packet)
         controller->get_acl_data_size_ble();
 
     max_packet_size = max_data_size + HCI_ACL_PREAMBLE_SIZE;
+    if((packet->len > max_packet_size) && (packet->layer_specific == 0) && (event == MSG_STACK_TO_HC_HCI_ACL)) {
+        packet->event = MSG_HC_TO_STACK_L2C_SEG_XMIT;
+         current_fragment_packet = NULL;
+         callbacks->transmit_finished(packet, false);
+         return;
+
+    }
     remaining_length = packet->len;
     STREAM_TO_UINT16(continuation_handle, stream);
     continuation_handle = APPLY_CONTINUATION_FLAG(continuation_handle);

components/bt/bluedroid/main/bte_init.c

@@ -366,4 +366,9 @@ void BTE_DeinitStack(void)
 #if (defined(A2D_INCLUDED) && A2D_INCLUDED == TRUE)
     A2D_Deinit();
 #endif
+
+#if (defined(RFCOMM_INCLUDED) && RFCOMM_INCLUDED == TRUE)
+    RFCOMM_Deinit();
+#endif
+
 }

components/bt/bluedroid/osi/config.c

@@ -389,7 +389,7 @@ bool config_save(const config_t *config, const char *filename)
     const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
     char *keyname = osi_calloc(keyname_bufsz);
     int config_size = get_config_size(config);
-    char *buf = osi_calloc(config_size + 100);
+    char *buf = osi_calloc(config_size);
     if (!line || !buf || !keyname) {
         err_code |= 0x01;
         goto error;
@@ -409,6 +409,16 @@ bool config_save(const config_t *config, const char *filename)
     for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
         const section_t *section = (const section_t *)list_node(node);
         w_cnt = snprintf(line, 1024, "[%s]\n", section->name);
+        if(w_cnt < 0) {
+            OSI_TRACE_ERROR("snprintf error w_cnt %d.",w_cnt);
+            err_code |= 0x10;
+            goto error;
+        }
+        if(w_cnt_total + w_cnt > config_size) {
+            OSI_TRACE_ERROR("%s, memcpy size (w_cnt + w_cnt_total = %d) is larger than buffer size (config_size = %d).", __func__, (w_cnt + w_cnt_total), config_size);
+            err_code |= 0x20;
+            goto error;
+        }
         OSI_TRACE_DEBUG("section name: %s, w_cnt + w_cnt_total = %d\n", section->name, w_cnt + w_cnt_total);
         memcpy(buf + w_cnt_total, line, w_cnt);
         w_cnt_total += w_cnt;
@@ -417,6 +427,16 @@ bool config_save(const config_t *config, const char *filename)
             const entry_t *entry = (const entry_t *)list_node(enode);
             OSI_TRACE_DEBUG("(key, val): (%s, %s)\n", entry->key, entry->value);
             w_cnt = snprintf(line, 1024, "%s = %s\n", entry->key, entry->value);
+            if(w_cnt < 0) {
+                OSI_TRACE_ERROR("snprintf error w_cnt %d.",w_cnt);
+                err_code |= 0x10;
+                goto error;
+            }
+            if(w_cnt_total + w_cnt > config_size) {
+                OSI_TRACE_ERROR("%s, memcpy size (w_cnt + w_cnt_total = %d) is larger than buffer size.(config_size = %d)", __func__, (w_cnt + w_cnt_total), config_size);
+                err_code |= 0x20;
+                goto error;
+            }
             OSI_TRACE_DEBUG("%s, w_cnt + w_cnt_total = %d", __func__, w_cnt + w_cnt_total);
             memcpy(buf + w_cnt_total, line, w_cnt);
             w_cnt_total += w_cnt;
@@ -523,7 +543,10 @@ static void config_parse(nvs_handle fp, config_t *config)
     const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
     char *keyname = osi_calloc(keyname_bufsz);
     int buf_size = get_config_size_from_flash(fp);
-    char *buf = osi_calloc(buf_size + 100);
+    char *buf = osi_calloc(buf_size);
+    if(buf_size == 0) { //First use nvs
+        goto error;
+    }
     if (!line || !section || !buf || !keyname) {
         err_code |= 0x01;
         goto error;

components/bt/bluedroid/osi/fixed_queue.c

@@ -131,17 +131,19 @@ size_t fixed_queue_capacity(fixed_queue_t *queue)
 
 void fixed_queue_enqueue(fixed_queue_t *queue, void *data)
 {
+    bool status=false; //Flag whether enqueued success
+
     assert(queue != NULL);
     assert(data != NULL);
 
     osi_sem_take(&queue->enqueue_sem, OSI_SEM_MAX_TIMEOUT);
 
     osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
-
-    list_append(queue->list, data);
+    status = list_append(queue->list, data); //Check whether enqueued success
     osi_mutex_unlock(&queue->lock);
 
-    osi_sem_give(&queue->dequeue_sem);
+    if(status == true)
+        osi_sem_give(&queue->dequeue_sem);
 }
 
 void *fixed_queue_dequeue(fixed_queue_t *queue)
@@ -189,7 +191,7 @@ void *fixed_queue_try_dequeue(fixed_queue_t *queue)
         return NULL;
     }
 
-    if (osi_sem_take(queue->dequeue_sem, 0) != 0) {
+    if (osi_sem_take(&queue->dequeue_sem, 0) != 0) {
         return NULL;
     }
 
@@ -243,14 +245,14 @@ void *fixed_queue_try_remove_from_queue(fixed_queue_t *queue, void *data)
 
     osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
     if (list_contains(queue->list, data) &&
-            osi_sem_take(queue->dequeue_sem, 0) == 0) {
+            osi_sem_take(&queue->dequeue_sem, 0) == 0) {
         removed = list_remove(queue->list, data);
         assert(removed);
     }
     osi_mutex_unlock(&queue->lock);
 
     if (removed) {
-        osi_sem_give(queue->enqueue_sem);
+        osi_sem_give(&queue->enqueue_sem);
         return data;
     }
 

components/bt/bluedroid/osi/include/osi/thread.h

@@ -72,7 +72,7 @@ typedef enum {
 #define HCI_H4_QUEUE_LEN                1
 
 #define BTU_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
-#define BTU_TASK_STACK_SIZE             (4096 + BT_TASK_EXTRA_STACK_SIZE)
+#define BTU_TASK_STACK_SIZE             (CONFIG_BTU_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)
 #define BTU_TASK_PRIO                   (configMAX_PRIORITIES - 5)
 #define BTU_TASK_NAME                   "btuT"
 #define BTU_QUEUE_LEN                   50
@@ -95,7 +95,7 @@ typedef enum {
 #define BTC_A2DP_SOURCE_TASK_STACK_SIZE       (CONFIG_A2DP_SOURCE_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE) // by menuconfig
 #define BTC_A2DP_SOURCE_TASK_NAME             "BtA2dSourceT"
 #define BTC_A2DP_SOURCE_TASK_PRIO             (configMAX_PRIORITIES - 3)
-#define BTC_A2DP_SOURCE_DATA_QUEUE_LEN        (3)
+#define BTC_A2DP_SOURCE_DATA_QUEUE_LEN        (1)
 #define BTC_A2DP_SOURCE_CTRL_QUEUE_LEN        (5)
 #define BTC_A2DP_SOURCE_TASK_QUEUE_SET_LEN    (BTC_A2DP_SOURCE_DATA_QUEUE_LEN + BTC_A2DP_SOURCE_CTRL_QUEUE_LEN)
 

components/bt/bluedroid/osi/list.c

@@ -61,8 +61,9 @@ bool list_contains(const list_t *list, const void *data)
   assert(data != NULL);
 
   for (const list_node_t *node = list_begin(list); node != list_end(list); node = list_next(node)) {
-    if (list_node(node) == data)
+    if (list_node(node) == data) {
       return true;
+    }
   }
 
   return false;
@@ -201,8 +202,9 @@ list_node_t *list_foreach(const list_t *list, list_iter_cb callback, void *conte
 
   for (list_node_t *node = list->head; node; ) {
     list_node_t *next = node->next;
-    if (!callback(node->data, context))
+    if (!callback(node->data, context)) {
       return node;
+    }
     node = next;
   }
   return NULL;

components/bt/bluedroid/stack/avct/avct_lcb_act.c

@@ -605,8 +605,9 @@ void avct_lcb_free_msg_ind(tAVCT_LCB *p_lcb, tAVCT_LCB_EVT *p_data)
 {
     UNUSED(p_lcb);
 
-    if (p_data == NULL)
+    if (p_data == NULL) {
         return;
+    }
 
     osi_free(p_data->p_buf);
     p_data->p_buf = NULL;

components/bt/bluedroid/stack/avdt/avdt_api.c

@@ -1195,7 +1195,7 @@ UINT16 AVDT_SendReport(UINT8 handle, AVDT_REPORT_TYPE type,
                     len = AVDT_MAX_CNAME_SIZE;
                 }
                 *p++ = (UINT8)len;
-                BCM_STRNCPY_S((char *)p, len + 1, (char *)p_data->cname, len + 1);
+                BCM_STRNCPY_S((char *)p, (char *)p_data->cname, AVDT_MAX_CNAME_SIZE + 1);
                 p += len;
                 break;
             }

components/bt/bluedroid/stack/avdt/avdt_scb_act.c

@@ -345,8 +345,10 @@ UINT8 *avdt_scb_hdl_report(tAVDT_SCB *p_scb, UINT8 *p, UINT16 len)
         p += 2;
         BE_STREAM_TO_UINT32(ssrc, p);
 
+        UNUSED(ssrc);
         UNUSED(o_p);
         UNUSED(o_v);
+        UNUSED(o_cc);
 
         switch (pt) {
         case AVDT_RTCP_PT_SR:   /* the packet type - SR (Sender Report) */
@@ -627,15 +629,19 @@ void avdt_scb_hdl_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
         avdt_scb_hdl_pkt_frag(p_scb, p_data);
     } else
 #endif
+    {
 #if AVDT_REPORTING == TRUE
         if (p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT) {
             p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
             avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
-        osi_free(p_data->p_pkt);
-        p_data->p_pkt = NULL;
+            osi_free(p_data->p_pkt);
+            p_data->p_pkt = NULL;
         } else
 #endif
+        {
             avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
+        }
+    }
 }
 
 /*******************************************************************************
@@ -1303,7 +1309,9 @@ void avdt_scb_hdl_write_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
 #if AVDT_MULTIPLEXING == TRUE
     if (fixed_queue_is_empty(p_scb->frag_q))
 #endif
+    {
         avdt_scb_hdl_write_req_no_frag(p_scb, p_data);
+    }
 #if AVDT_MULTIPLEXING == TRUE
     else {
         avdt_scb_hdl_write_req_frag(p_scb, p_data);

components/bt/bluedroid/stack/avrc/avrc_utils.c

@@ -120,10 +120,11 @@ BOOLEAN avrc_is_valid_player_attrib_value(UINT8 attrib, UINT8 value)
         result = TRUE;
     }
 
-    if (!result)
+    if (!result) {
         AVRC_TRACE_ERROR(
             "avrc_is_valid_player_attrib_value() found not matching attrib(x%x)-value(x%x) pair!",
             attrib, value);
+    }
 
     return result;
 }

components/bt/bluedroid/stack/btm/btm_acl.c

@@ -231,7 +231,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
     UINT8             xx;
 
     BTM_TRACE_DEBUG ("btm_acl_created hci_handle=%d link_role=%d  transport=%d\n",
-                     hci_handle, link_role, transport);
+            hci_handle, link_role, transport);
     /* Ensure we don't have duplicates */
     p = btm_bda_to_acl(bda, transport);
     if (p != (tACL_CONN *)NULL) {
@@ -241,7 +241,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
         p->transport = transport;
 #endif
         BTM_TRACE_DEBUG ("Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x\n",
-                         bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
+                bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
         BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
         return;
     }
@@ -261,20 +261,24 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
 #if BLE_INCLUDED == TRUE
             p->transport = transport;
 #if BLE_PRIVACY_SPT == TRUE
-            if (transport == BT_TRANSPORT_LE)
+            if (transport == BT_TRANSPORT_LE) {
                 btm_ble_refresh_local_resolvable_private_addr(bda,
                         btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
+            }
 #else
             p->conn_addr_type = BLE_ADDR_PUBLIC;
             memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN);
             BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n",
-                         p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]);
+                    p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]);
 #endif
 #endif
             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 
             btm_pm_sm_alloc(xx);
 
+#if (CLASSIC_BT_INCLUDED == TRUE)
+            btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE);
+#endif
 
             if (dc) {
                 memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
@@ -298,28 +302,34 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
 #endif
 
             if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
-                /* If remote features already known, copy them and continue connection setup */
-                if ((p_dev_rec->num_read_pages) &&
-                        (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
-                    memcpy (p->peer_lmp_features, p_dev_rec->features,
-                            (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
-                    p->num_read_pages = p_dev_rec->num_read_pages;
+                if (!p_dev_rec->remote_secure_connection_previous_state) {
+                    /* If remote features already known, copy them and continue connection setup */
+                    if ((p_dev_rec->num_read_pages) &&
+                            (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
+                        memcpy (p->peer_lmp_features, p_dev_rec->features,
+                                (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
+                        p->num_read_pages = p_dev_rec->num_read_pages;
 #if (CLASSIC_BT_INCLUDED == TRUE)
-                    const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
+                        const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
-                    /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+                        /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
 #if (SMP_INCLUDED == TRUE)
-                    btm_sec_set_peer_sec_caps(p, p_dev_rec);
+                        btm_sec_set_peer_sec_caps(p, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
 #if (CLASSIC_BT_INCLUDED == TRUE)
-                    BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
-                    if (req_pend) {
-                        /* Request for remaining Security Features (if any) */
-                        l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
-                    }
+                        BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
+                        if (req_pend) {
+                            /* Request for remaining Security Features (if any) */
+                            l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
+                        }
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
-                    btm_establish_continue (p);
-                    return;
+                        btm_establish_continue (p);
+                        return;
+                    }
+                } else {
+                    /* If remote features indicated secure connection (SC) mode, check the remote feautres again*/
+                    /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/
+                    btm_read_remote_features (p->hci_handle);
                 }
             }
 
@@ -328,13 +338,13 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
             if (p_dev_rec && transport == BT_TRANSPORT_LE) {
 #if BLE_PRIVACY_SPT == TRUE
                 btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr,
-                                             &p->active_remote_addr_type);
+                        &p->active_remote_addr_type);
 #endif
 
                 if (link_role == HCI_ROLE_MASTER) {
                     btsnd_hcic_ble_read_remote_feat(p->hci_handle);
                 } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
-                         && link_role == HCI_ROLE_SLAVE) {
+                        && link_role == HCI_ROLE_SLAVE) {
                     btsnd_hcic_rmt_ver_req (p->hci_handle);
                 } else {
                     btm_establish_continue(p);
@@ -790,6 +800,22 @@ void btm_acl_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
         }
 #endif
     }
+#if (CLASSIC_BT_INCLUDED == TRUE)
+    /* If authentication is done through legacy authentication and esp32 has
+     * not authenticated peer deivce yet, do not proceed for encrytion and
+     * first authenticate it. */
+    else if ((BTM_BothEndsSupportSecureConnections(p->remote_addr) == 0) &&
+            ((p->legacy_auth_state & BTM_ACL_LEGACY_AUTH_SELF) == 0)) {
+        if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL) {
+            if (btm_sec_legacy_authentication_mutual(p_dev_rec)) {
+                btm_sec_update_legacy_auth_state(btm_bda_to_acl(p_dev_rec->bd_addr, BT_TRANSPORT_BR_EDR), BTM_ACL_LEGACY_AUTH_SELF);
+            } else {
+                BTM_TRACE_ERROR("%s failed, Resources not available for Authentication procedure", __FUNCTION__);
+            }
+        }
+    }
+#endif
+
 }
 /*******************************************************************************
 **
@@ -1211,6 +1237,7 @@ void btm_establish_continue (tACL_CONN *p_acl_cb)
         evt_data.conn.p_bdn = p_acl_cb->remote_name;
         evt_data.conn.p_dc  = p_acl_cb->remote_dc;
         evt_data.conn.p_features = p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0];
+        evt_data.conn.sc_downgrade = p_acl_cb->sc_downgrade;
 #if BLE_INCLUDED == TRUE
         evt_data.conn.handle = p_acl_cb->hci_handle;
         evt_data.conn.transport = p_acl_cb->transport;
@@ -2495,15 +2522,17 @@ void btm_acl_chk_peer_pkt_type_support (tACL_CONN *p, UINT16 *p_pkt_type)
     }
 
     /* 2 and 3 MPS support? */
-    if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
+    if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])) {
         /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
                         BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
+    }
 
-    if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
+    if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])) {
         /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
                         BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
+    }
 
     /* EDR 3 and 5 slot support? */
     if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])

components/bt/bluedroid/stack/btm/btm_ble.c

@@ -66,7 +66,7 @@ extern void gatt_notify_enc_cmpl(BD_ADDR bd_addr);
 **                  bd_name          - Name of the peer device.  NULL if unknown.
 **                  dev_type         - Remote device's device type.
 **                  addr_type        - LE device address type.
-**                  auth_mode        - auth mode             
+**                  auth_mode        - auth mode
 **
 ** Returns          TRUE if added OK, else FALSE
 **
@@ -121,8 +121,7 @@ BOOLEAN BTM_SecAddBleDevice (BD_ADDR bd_addr, BD_NAME bd_name, tBT_DEVICE_TYPE d
 
     if (bd_name && bd_name[0]) {
         p_dev_rec->sec_flags |= BTM_SEC_NAME_KNOWN;
-        BCM_STRNCPY_S ((char *)p_dev_rec->sec_bd_name, sizeof (p_dev_rec->sec_bd_name),
-                       (char *)bd_name, BTM_MAX_REM_BD_NAME_LEN);
+        BCM_STRNCPY_S ((char *)p_dev_rec->sec_bd_name,(char *)bd_name, BTM_MAX_REM_BD_NAME_LEN);
     }
     p_dev_rec->device_type |= dev_type;
     p_dev_rec->ble.ble_addr_type = addr_type;
@@ -887,8 +886,9 @@ tBTM_SEC_ACTION btm_ble_determine_security_act(BOOLEAN is_originator, BD_ADDR bd
             return BTM_SEC_OK;
         }
 
-        if (security_required & BTM_SEC_OUT_MITM)
+        if (security_required & BTM_SEC_OUT_MITM) {
             auth_req |= BTM_LE_AUTH_REQ_MITM;
+        }
     }
     else
     {
@@ -898,8 +898,9 @@ tBTM_SEC_ACTION btm_ble_determine_security_act(BOOLEAN is_originator, BD_ADDR bd
             return BTM_SEC_OK;
         }
 
-        if (security_required & BTM_SEC_IN_MITM)
+        if (security_required & BTM_SEC_IN_MITM) {
             auth_req |= BTM_LE_AUTH_REQ_MITM;
+        }
     }
 
     tBTM_BLE_SEC_REQ_ACT ble_sec_act = BTM_BLE_SEC_REQ_ACT_NONE;
@@ -907,11 +908,13 @@ tBTM_SEC_ACTION btm_ble_determine_security_act(BOOLEAN is_originator, BD_ADDR bd
 
     BTM_TRACE_DEBUG ("%s ble_sec_act %d", __func__ , ble_sec_act);
 
-    if (ble_sec_act == BTM_BLE_SEC_REQ_ACT_DISCARD)
+    if (ble_sec_act == BTM_BLE_SEC_REQ_ACT_DISCARD) {
         return BTM_SEC_ENC_PENDING;
+    }
 
-    if (ble_sec_act == BTM_BLE_SEC_REQ_ACT_NONE)
+    if (ble_sec_act == BTM_BLE_SEC_REQ_ACT_NONE) {
         return BTM_SEC_OK;
+    }
 
     UINT8 sec_flag = 0;
     BTM_GetSecurityFlagsByTransport(bdaddr, &sec_flag, BT_TRANSPORT_LE);
@@ -920,11 +923,13 @@ tBTM_SEC_ACTION btm_ble_determine_security_act(BOOLEAN is_originator, BD_ADDR bd
     BOOLEAN is_key_mitm = FALSE;
     if (sec_flag & (BTM_SEC_FLAG_ENCRYPTED| BTM_SEC_FLAG_LKEY_KNOWN))
     {
-        if (sec_flag & BTM_SEC_FLAG_ENCRYPTED)
+        if (sec_flag & BTM_SEC_FLAG_ENCRYPTED) {
             is_link_encrypted = TRUE;
+        }
 
-        if (sec_flag & BTM_SEC_FLAG_LKEY_AUTHED)
+        if (sec_flag & BTM_SEC_FLAG_LKEY_AUTHED) {
             is_key_mitm = TRUE;
+        }
     }
 
     if (auth_req & BTM_LE_AUTH_REQ_MITM)
@@ -933,16 +938,18 @@ tBTM_SEC_ACTION btm_ble_determine_security_act(BOOLEAN is_originator, BD_ADDR bd
         {
             return BTM_SEC_ENCRYPT_MITM;
         } else {
-            if (is_link_encrypted)
+            if (is_link_encrypted) {
                 return BTM_SEC_OK;
-            else
+            } else {
                 return BTM_SEC_ENCRYPT;
+            }
         }
     } else {
-        if (is_link_encrypted)
+        if (is_link_encrypted) {
             return BTM_SEC_OK;
-        else
+        } else {
             return BTM_SEC_ENCRYPT_NO_MITM;
+        }
     }
 
     return BTM_SEC_OK;
@@ -1012,8 +1019,9 @@ BOOLEAN btm_ble_start_sec_check(BD_ADDR bd_addr, UINT16 psm, BOOLEAN is_originat
             break;
     }
 
-    if (ble_sec_act == BTM_BLE_SEC_NONE)
+    if (ble_sec_act == BTM_BLE_SEC_NONE) {
         return status;
+    }
 
     tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_LE);
     p_lcb->sec_act = sec_act;
@@ -1468,13 +1476,14 @@ tBTM_STATUS btm_ble_set_encryption (BD_ADDR bd_addr, void *p_ref_data, UINT8 lin
                 break;
             }
         }
-
+#if (SMP_SLAVE_CON_PARAMS_UPD_ENABLE == TRUE)
         // already have encrypted information, do not need to update connection parameters
         if(link_role == BTM_ROLE_SLAVE && (p_rec->ble.key_type & BTM_LE_KEY_PENC)) {
             p_rec->ble.skip_update_conn_param = true;
         } else {
             p_rec->ble.skip_update_conn_param = false;
         }
+#endif
         if (SMP_Pair(bd_addr) == SMP_STARTED) {
             cmd = BTM_CMD_STARTED;
             p_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
@@ -1921,9 +1930,7 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
     UINT8       role, status, bda_type;
     UINT16      handle;
     BD_ADDR     bda;
-#if (BLE_PRIVACY_SPT == TRUE)
     BD_ADDR     local_rpa, peer_rpa;
-#endif  ///BLE_PRIVACY_SPT == TRUE
     UINT16      conn_interval, conn_latency, conn_timeout;
     BOOLEAN     match = FALSE;
     UNUSED(evt_len);
@@ -1934,14 +1941,13 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
     STREAM_TO_BDADDR   (bda, p);
     BTM_TRACE_DEBUG("status = %d, handle = %d, role = %d, bda_type = %d",status,handle,role,bda_type);
     if (status == 0) {
-#if (BLE_PRIVACY_SPT == TRUE )
-        peer_addr_type = bda_type;
-        match = btm_identity_addr_to_random_pseudo (bda, &bda_type, TRUE);
-
         if (enhanced) {
             STREAM_TO_BDADDR   (local_rpa, p);
             STREAM_TO_BDADDR   (peer_rpa, p);
         }
+#if (BLE_PRIVACY_SPT == TRUE )
+        peer_addr_type = bda_type;
+        match = btm_identity_addr_to_random_pseudo (bda, &bda_type, TRUE);
 
         /* possiblly receive connection complete with resolvable random on
            slave role while the device has been paired */
@@ -1996,9 +2002,18 @@ void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
             btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE);
 #endif
         }
+
     }
 
-    btm_ble_update_mode_operation(role, bda, status);
+    BOOLEAN bg_con = btm_ble_update_mode_operation(role, bda, status);
+    if (status != HCI_SUCCESS && !bg_con) {
+        // notify connection failed
+        l2c_link_hci_disc_comp (handle, status);
+#if (SMP_INCLUDED == TRUE)
+        /* Notify security manager */
+        btm_sec_disconnected (handle, status);
+#endif  ///SMP_INCLUDED == TRUE
+    }
 }
 
 

components/bt/bluedroid/stack/btm/btm_ble_adv_filter.c

@@ -312,9 +312,10 @@ void btm_ble_scan_pf_cmpl_cback(tBTM_VSC_CMPL *p_params)
         if (HCI_SUCCESS == status) {
             if (memcmp(&btm_ble_adv_filt_cb.cur_filter_target.bda, &na_bda, BD_ADDR_LEN) == 0) {
                 btm_ble_cs_update_pf_counter(action, cond_type, NULL, num_avail);
-            } else
+            } else {
                 btm_ble_cs_update_pf_counter(action, cond_type,
                                              &btm_ble_adv_filt_cb.cur_filter_target, num_avail);
+            }
         }
 
         /* send ADV PF operation complete */
@@ -855,9 +856,10 @@ tBTM_STATUS btm_ble_update_uuid_filter(tBTM_BLE_SCAN_COND_OP action,
                                          len,
                                          param,
                                          btm_ble_scan_pf_cmpl_cback)) != BTM_NO_RESOURCES) {
-        if (p_uuid_cond && p_uuid_cond->p_target_addr)
+        if (p_uuid_cond && p_uuid_cond->p_target_addr) {
             memcpy(&btm_ble_adv_filt_cb.cur_filter_target, p_uuid_cond->p_target_addr,
                    sizeof(tBLE_BD_ADDR));
+        }
         else {
             memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
         }
@@ -914,15 +916,17 @@ tBTM_STATUS btm_ble_clear_scan_pf_filter(tBTM_BLE_SCAN_COND_OP action,
         /* clear manufactuer data filter */
         st = btm_ble_update_pf_manu_data(BTM_BLE_SCAN_COND_CLEAR, filt_index, NULL,
                                          BTM_BLE_PF_MANU_DATA, cb_evt, ref_value);
-        if (BTM_CMD_STARTED == st)
+        if (BTM_CMD_STARTED == st) {
             btm_ble_advfilt_enq_op_q(action, BTM_BLE_META_PF_MANU_DATA, cb_evt,
                                      ref_value, NULL, NULL);
+        }
 
         /* clear local name filter */
         st = btm_ble_update_pf_local_name(BTM_BLE_SCAN_COND_CLEAR, filt_index, NULL);
-        if (BTM_CMD_STARTED == st)
+        if (BTM_CMD_STARTED == st) {
             btm_ble_advfilt_enq_op_q(action, BTM_BLE_META_PF_LOCAL_NAME, cb_evt,
                                      ref_value, NULL, NULL);
+        }
 
         /* update the counter for service data */
         st = btm_ble_update_srvc_data_change(BTM_BLE_SCAN_COND_CLEAR, filt_index, NULL);
@@ -936,16 +940,18 @@ tBTM_STATUS btm_ble_clear_scan_pf_filter(tBTM_BLE_SCAN_COND_OP action,
 
         st = btm_ble_update_uuid_filter(BTM_BLE_SCAN_COND_CLEAR, filt_index,
                                         BTM_BLE_PF_SRVC_SOL_UUID, NULL, cb_evt, ref_value);
-        if (BTM_CMD_STARTED == st)
+        if (BTM_CMD_STARTED == st) {
             btm_ble_advfilt_enq_op_q(action, BTM_BLE_META_PF_SOL_UUID, cb_evt,
                                      ref_value, NULL, NULL);
+        }
 
         /* clear service data filter */
         st = btm_ble_update_pf_manu_data(BTM_BLE_SCAN_COND_CLEAR, filt_index, NULL,
                                          BTM_BLE_PF_SRVC_DATA_PATTERN, cb_evt, ref_value);
-        if (BTM_CMD_STARTED == st)
+        if (BTM_CMD_STARTED == st) {
             btm_ble_advfilt_enq_op_q(action, BTM_BLE_META_PF_SRVC_DATA, cb_evt,
                                      ref_value, NULL, NULL);
+        }
     }
 
     /* select feature based on control block settings */
@@ -1053,9 +1059,10 @@ tBTM_STATUS BTM_BleAdvFilterParamSetup(int action, tBTM_BLE_PF_FILT_INDEX filt_i
 
         if (cmn_ble_vsc_cb.version_supported == BTM_VSC_CHIP_CAPABILITY_L_VERSION) {
             len = BTM_BLE_ADV_FILT_META_HDR_LENGTH + BTM_BLE_ADV_FILT_FEAT_SELN_LEN;
-        } else
+        } else {
             len = BTM_BLE_ADV_FILT_META_HDR_LENGTH + BTM_BLE_ADV_FILT_FEAT_SELN_LEN +
                   BTM_BLE_ADV_FILT_TRACK_NUM;
+        }
 
         if ((st = BTM_VendorSpecificCommand (HCI_BLE_ADV_FILTER_OCF,
                                              (UINT8)len,

components/bt/bluedroid/stack/btm/btm_ble_batchscan.c

@@ -427,9 +427,10 @@ void btm_ble_batchscan_vsc_cmpl_cback (tBTM_VSC_CMPL *p_params)
             if (0 == num_records) {
                 btm_ble_batchscan_deq_rep_data(report_format, &ref_value, &num_records,
                                                &p_data, &data_len);
-                if (NULL != ble_batchscan_cb.p_scan_rep_cback)
+                if (NULL != ble_batchscan_cb.p_scan_rep_cback) {
                     ble_batchscan_cb.p_scan_rep_cback(ref_value, report_format, num_records,
                                                       data_len, p_data, status);
+                }
             } else {
                 if ((len - 4) > 0) {
                     btm_ble_batchscan_enq_rep_data(report_format, num_records, p, len - 4);
@@ -439,9 +440,10 @@ void btm_ble_batchscan_vsc_cmpl_cback (tBTM_VSC_CMPL *p_params)
                         btm_ble_batchscan_deq_rep_data(report_format, &ref_value, &num_records,
                                                        &p_data, &data_len);
                         /* Send whatever is available, in case of a command failure */
-                        if (NULL != ble_batchscan_cb.p_scan_rep_cback && NULL != p_data)
+                        if (NULL != ble_batchscan_cb.p_scan_rep_cback && NULL != p_data) {
                             ble_batchscan_cb.p_scan_rep_cback(ref_value, report_format,
                                                               num_records, data_len, p_data, status);
+                        }
                     }
                 }
             }