versions: Update version to 3.3.6

Bugfix/fix modbus rs485 rts en fail (backport v3.3)

See merge request espressif/esp-idf!14473

.github/workflows/release_zips.yml

@@ -0,0 +1,17 @@
+name: Create zip file with recursive source clone for release
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  release_zips:
+    name: Create release zip file
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Create a recursive clone source zip
+        uses: espressif/github-actions/release_zips@master
+        env:
+            RELEASE_PROJECT_NAME: ESP-IDF
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitlab-ci.yml

@@ -7,6 +7,12 @@ stages:
   - deploy
   - post_check
 
+default:
+  retry:
+    max: 2
+    # In case of a runner failure we could hop to another one, or a network error could go away.
+    when: runner_system_failure
+
 variables:
 # System environment
 
@@ -19,10 +25,19 @@ variables:
   GET_SOURCES_ATTEMPTS: "10"
   ARTIFACT_DOWNLOAD_ATTEMPTS: "10"
 
-  # We use get-full-sources.sh script to fetch the submodules and/or re-fetch the repo
-  # if it was corrupted (if submodule update fails this can happen)
-  GIT_STRATEGY: fetch
+  # GIT_STRATEGY is not defined here.
+  # Use an option from  "CI / CD Settings" - "General pipelines".
+
+  # we will download archive for each submodule instead of clone.
+  # we don't do "recursive" when fetch submodule as they're not used in CI now.
   GIT_SUBMODULE_STRATEGY: none
+  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
+  # by default we will fetch all submodules
+  # jobs can overwrite this variable to only fetch submodules they required
+  # set to "none" if don't need to fetch submodules
+  SUBMODULES_TO_FETCH: "all"
+  # tell build system do not check submodule update as we download archive instead of clone
+  IDF_SKIP_CHECK_SUBMODULES: 1
 
   UNIT_TEST_BUILD_SYSTEM: make
 # IDF environment
@@ -33,21 +48,17 @@ variables:
   APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
   CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
 
-# Docker images
+  # Docker images
   BOT_DOCKER_IMAGE_TAG: ":latest"
+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
+  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
+  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"
+
+# Versioned esp-idf-doc env image to use for all document building jobs
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v7"
+
 
-# When 'fetch' strategy is used, Gitlab removes untracked files before checking out
-# new revision. However if the new revision doesn't include some of the submodules
-# which were present in the old revision, such submodule directories would not be
-# removed by the checkout. This extra step ensures that these stale submodules
-# are removed.
-.git_clean_stale_submodules:  &git_clean_stale_submodules >
-  find . -name '.git' -not -path './.git' -printf '%P\n'
-  | sed 's|/.git||'
-  | xargs -I {} sh -c '
-  grep -q {} .gitmodules
-  ||  (echo "Removing {}, has .git directory but not in .gitmodules file"
-  && rm -rf {});'
 
 # before each job, we need to check if this job is filtered by bot stage/job filter
 .apply_bot_filter: &apply_bot_filter
@@ -58,9 +69,14 @@ variables:
   tools/idf_tools.py --non-interactive install && eval "$(tools/idf_tools.py --non-interactive export)" || exit 1
   fi
 
+.show_submodule_urls: &show_submodule_urls |
+  git config --get-regexp '^submodule\..*\.url$' || true
+
+.fetch_submodules: &fetch_submodules |
+  python $SUBMODULE_FETCH_TOOL -s $SUBMODULES_TO_FETCH
+
 before_script:
   - source tools/ci/setup_python.sh
-  - *git_clean_stale_submodules
   # apply bot filter in before script
   - *apply_bot_filter
   # add gitlab ssh key
@@ -70,48 +86,33 @@ before_script:
   - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
   - chmod 600 ~/.ssh/id_rsa
   - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
+  - if [ "${LOCAL_GITLAB_SSH_SERVER:-}" ]; then SRV=${LOCAL_GITLAB_SSH_SERVER##*@};SRV=${SRV%%:*};printf "Host %s\n\tStrictHostKeyChecking no\n" "${SRV}" >> ~/.ssh/config; fi
   # Download and install tools, if needed
   - *setup_tools_unless_target_test
-
-  # Set IS_PRIVATE or IS_PUBLIC depending on if our branch is public or not
-  #
-  # (the same regular expressions are used to set these are used in 'only:' sections below
+  # Set some options and environment for CI
   - source tools/ci/configure_ci_environment.sh
-
-  # fetch the submodules (& if necessary re-fetch repo) from gitlab
-  - time ./tools/ci/get-full-sources.sh
+  - export PYTHONPATH="${PYTHONPATH}:${CI_PROJECT_DIR}/tools/ci/python_packages"
+  - *fetch_submodules
 
 # used for check scripts which we want to run unconditionally
-.do_nothing_before_no_filter:
-  before_script: &do_nothing_before_no_filter
+.before_script_lesser_nofilter: &before_script_lesser_nofilter
+  variables:
+    GIT_SUBMODULE_STRATEGY: none
+  before_script:
+    - echo "Not setting up GitLab key, not fetching submodules, not applying bot filter"
     - source tools/ci/setup_python.sh
-    - *git_clean_stale_submodules
+    - source tools/ci/configure_ci_environment.sh
 
 # used for everything else where we want to do no prep, except for bot filter
-.do_nothing_before:
-  before_script: &do_nothing_before
-    - source tools/ci/setup_python.sh
-    - *git_clean_stale_submodules
-    # apply bot filter in before script
-    - *apply_bot_filter
+.before_script_lesser: &before_script_lesser
+  variables:
+    GIT_SUBMODULE_STRATEGY: none
+  before_script:
     - echo "Not setting up GitLab key, not fetching submodules"
-    - source tools/ci/configure_ci_environment.sh
-
-.add_gitlab_key_before:
-  before_script: &add_gitlab_key_before
     - source tools/ci/setup_python.sh
-    - *git_clean_stale_submodules
     # apply bot filter in before script
     - *apply_bot_filter
-    - echo "Not fetching submodules"
     - source tools/ci/configure_ci_environment.sh
-    # add gitlab ssh key
-    - mkdir -p ~/.ssh
-    - chmod 700 ~/.ssh
-    - echo -n $GITLAB_KEY > ~/.ssh/id_rsa_base64
-    - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
-    - chmod 600 ~/.ssh/id_rsa
-    - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
 
 build_template_app:
   stage: build
@@ -183,7 +184,7 @@ build_ssc:
     paths:
       - tools/unit-test-app/output
       - components/idf_test/unit_test/TestCaseAll.yml
-    expire_in: 2 days
+    expire_in: 4 days
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
@@ -237,7 +238,7 @@ build_examples_make:
       - build_examples/*/*/*/build/download.config
       - build_examples/*/*/*/build/bootloader/*.bin
       - $LOG_PATH
-    expire_in: 2 days
+    expire_in: 4 days
   variables:
     LOG_PATH: "$CI_PROJECT_DIR/log_examples_make"
   only:
@@ -271,7 +272,7 @@ build_examples_cmake:
       - build_examples_cmake/*/*/*/build/flasher_args.json
       - build_examples_cmake/*/*/*/build/bootloader/*.bin
       - $LOG_PATH
-    expire_in: 2 days
+    expire_in: 4 days
   variables:
     LOG_PATH: "$CI_PROJECT_DIR/log_examples_cmake"
   only:
@@ -291,43 +292,51 @@ build_examples_cmake:
     - mkdir -p ${LOG_PATH}
     - ${IDF_PATH}/tools/ci/build_examples_cmake.sh
 
-build_docs:
+
+.build_docs_template: &build_docs_template
   stage: build
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  image: $ESP_IDF_DOC_ENV_IMAGE
   tags:
     - build_docs
   artifacts:
     when: always
     paths:
-      # English version of documentation
-      - docs/en/doxygen-warning-log.txt
-      - docs/en/sphinx-warning-log.txt
-      - docs/en/sphinx-warning-log-sanitized.txt
-      - docs/en/_build/html
-      - docs/sphinx-err-*
-      # Chinese version of documentation
-      - docs/zh_CN/doxygen-warning-log.txt
-      - docs/zh_CN/sphinx-warning-log.txt
-      - docs/zh_CN/sphinx-warning-log-sanitized.txt
-      - docs/zh_CN/_build/html
-    expire_in: 1 day
+      - docs/*/*.txt
+      - docs/_build/*/html/*
+      - docs/_build/*/latex/*
+    expire_in: 4 days
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
       - $BOT_LABEL_BUILD
       - $BOT_LABEL_BUILD_DOCS
       - $BOT_LABEL_REGULAR_TEST
+  dependencies: []
   script:
+    # Active python 3.6.10 env as this is where Sphinx is installed
+    - source /opt/pyenv/activate && pyenv global 3.6.10
+      # Setup a build dir with both languages to simplify deployment
     - cd docs
+    - mkdir -p _build/$DOCLANG
     - ./check_lang_folder_sync.sh
-    - cd en
+    - cd $DOCLANG
     - make gh-linkcheck
     - make html
     - ../check_doc_warnings.sh
-    - cd ../zh_CN
-    - make gh-linkcheck
-    - make html
+    - make latexpdf LATEXMKOPTS="--f --interaction=nonstopmode --quiet --outdir=build"
     - ../check_doc_warnings.sh
+    - mv -f _build/* ../_build/$DOCLANG
+
+build_docs_en:
+  extends: .build_docs_template
+  variables:
+    DOCLANG: "en"
+
+build_docs_zh_CN:
+  extends: .build_docs_template
+  variables:
+    DOCLANG: "zh_CN"
+
 
 .check_job_template: &check_job_template
   stage: check
@@ -335,7 +344,7 @@ build_docs:
   tags:
     - host_test
   dependencies: []
-  before_script: *do_nothing_before_no_filter
+  <<: *before_script_lesser_nofilter
 
 verify_cmake_style:
   <<: *check_job_template
@@ -363,7 +372,12 @@ build_docker:
     DOCKER_TMP_IMAGE_NAME: "idf_tmp_image"
   before_script: []
   script:
-    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+    - export LOCAL_CI_REPOSITORY_URL=$CI_REPOSITORY_URL
+    - if [ -n "$LOCAL_GITLAB_HTTPS_HOST" ]; then export LOCAL_CI_REPOSITORY_URL="https://gitlab-ci-token:${CI_JOB_TOKEN}@${LOCAL_GITLAB_HTTPS_HOST}/${CI_PROJECT_PATH}"; fi
+    - if [ -n "$LOCAL_GIT_MIRROR" ]; then export LOCAL_CI_REPOSITORY_URL="${LOCAL_GIT_MIRROR}/${CI_PROJECT_PATH}"; fi
+    - echo "Using repository at $LOCAL_CI_REPOSITORY_URL"
+    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${LOCAL_CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+
     # Build
     - docker build --tag ${DOCKER_TMP_IMAGE_NAME} ${DOCKER_BUILD_ARGS} tools/docker/
     # We can't mount $PWD/examples/get-started/blink into the container, see https://gitlab.com/gitlab-org/gitlab-ce/issues/41227.
@@ -597,12 +611,15 @@ push_to_github:
   tags:
     - deploy
   only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
   when: on_success
   dependencies: []
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
   script:
     - mkdir -p ~/.ssh
     - chmod 700 ~/.ssh
@@ -614,44 +631,67 @@ push_to_github:
     - git remote add github git@github.com:espressif/esp-idf.git
     - tools/ci/push_to_github.sh
 
-deploy_docs:
+.deploy_docs_template:
+  extends: .before_script_lesser
   stage: deploy
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  image: $ESP_IDF_DOC_ENV_IMAGE
   tags:
     - deploy
+    - shiny
+  dependencies:
+    - build_docs_en
+    - build_docs_zh_CN
+  variables:
+    DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
+    PYTHONUNBUFFERED: 1
+  script:
+    - mkdir -p ~/.ssh
+    - chmod 700 ~/.ssh
+    - echo -n $DOCS_DEPLOY_PRIVATEKEY > ~/.ssh/id_rsa_base64
+    - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
+    - chmod 600 ~/.ssh/id_rsa
+    - echo -e "Host $DOCS_DEPLOY_SERVER\n\tStrictHostKeyChecking no\n\tUser $DOCS_DEPLOY_SERVER_USER\n" >> ~/.ssh/config
+    - export GIT_VER=$(git describe --always)
+
+    - ${IDF_PATH}/tools/ci/multirun_with_pyenv.sh -p 3.6.10 ${IDF_PATH}/tools/ci/deploy_docs.py
+
+
+# deploys docs to CI_DOCKER_REGISTRY webserver, for internal review
+deploy_docs_preview:
+  extends: .deploy_docs_template
   only:
     refs:
-      - master
-      - /^release\/v/
-      - /^v\d+\.\d+(\.\d+)?($|-)/
       - triggers
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
       - $BOT_LABEL_BUILD_DOCS
-  dependencies:
-    - build_docs
-  before_script: *do_nothing_before
-  script:
-    - mkdir -p ~/.ssh
-    - chmod 700 ~/.ssh
-    - echo -n $DOCS_DEPLOY_KEY > ~/.ssh/id_rsa_base64
-    - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
-    - chmod 600 ~/.ssh/id_rsa
-    - echo -e "Host $DOCS_SERVER\n\tStrictHostKeyChecking no\n\tUser $DOCS_SERVER_USER\n" >> ~/.ssh/config
-    - export GIT_VER=$(git describe --always)
-    - cd docs/en/_build/
-    - mv html $GIT_VER
-    - tar czvf $GIT_VER.tar.gz $GIT_VER
-    - scp $GIT_VER.tar.gz $DOCS_SERVER:$DOCS_PATH/en
-    - ssh $DOCS_SERVER -x "cd $DOCS_PATH/en && tar xzvf $GIT_VER.tar.gz && rm -f latest && ln -s $GIT_VER latest"
-    - cd ../../zh_CN/_build/
-    - mv html $GIT_VER
-    - tar czvf $GIT_VER.tar.gz $GIT_VER
-    - scp $GIT_VER.tar.gz $DOCS_SERVER:$DOCS_PATH/zh_CN
-    - ssh $DOCS_SERVER -x "cd $DOCS_PATH/zh_CN && tar xzvf $GIT_VER.tar.gz && rm -f latest && ln -s $GIT_VER latest"
-    # add link to preview doc
-    - echo "[document preview][en] $CI_DOCKER_REGISTRY/docs/esp-idf/en/${GIT_VER}/index.html"
-    - echo "[document preview][zh_CN] $CI_DOCKER_REGISTRY/docs/esp-idf/zh_CN/${GIT_VER}/index.html"
+  variables:
+    TYPE: "preview"
+    # older branches use DOCS_DEPLOY_KEY, DOCS_SERVER, DOCS_SERVER_USER, DOCS_PATH for preview server so we keep these names for 'preview'
+    DOCS_DEPLOY_PRIVATEKEY: "$DOCS_DEPLOY_KEY"
+    DOCS_DEPLOY_SERVER: "$DOCS_SERVER"
+    DOCS_DEPLOY_SERVER_USER: "$DOCS_SERVER_USER"
+    DOCS_DEPLOY_PATH: "$DOCS_PATH"
+    DOCS_DEPLOY_URL_BASE: "https://$DOCS_PREVIEW_SERVER_URL/docs/esp-idf"
+
+# deploy docs to production webserver
+deploy_docs_production:
+  extends: .deploy_docs_template
+  only:
+    refs:
+      # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+  variables:
+    TYPE: "preview"
+    DOCS_DEPLOY_PRIVATEKEY: "$DOCS_PROD_DEPLOY_KEY"
+    DOCS_DEPLOY_SERVER: "$DOCS_PROD_SERVER"
+    DOCS_DEPLOY_SERVER_USER: "$DOCS_PROD_SERVER_USER"
+    DOCS_DEPLOY_PATH: "$DOCS_PROD_PATH"
+    DOCS_DEPLOY_URL_BASE: "https://docs.espressif.com/projects/esp-idf"
 
 check_doc_links:
   stage: host_test
@@ -695,13 +735,25 @@ check_permissions:
   script:
     - tools/ci/check-executable.sh
 
+check_version:
+  <<: *check_job_template
+  # Don't run this for feature/bugfix branches, so that it is possible to modify
+  # esp_idf_version.h in a branch before tagging the next version.
+  only:
+    - master
+    - /^release\/v/
+    - /^v\d+\.\d+(\.\d+)?($|-)/
+  script:
+    - export IDF_PATH=$PWD
+    - tools/ci/check_idf_version.sh
+
 check_examples_cmake_make:
   <<: *check_job_template
   except:
     - master
     - /^release\/v/
     - /^v\d+\.\d+(\.\d+)?($|-)/
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
   script:
     - tools/ci/check_examples_cmake_make.sh
 
@@ -712,14 +764,13 @@ check_python_style:
     paths:
       - flake8_output.txt
     expire_in: 1 week
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
   script:
     # run it only under Python 3 (it is very slow under Python 2)
     - ${IDF_PATH}/tools/ci/multirun_with_pyenv.sh -p 3.4.8 python -m flake8 --config=$IDF_PATH/.flake8 --output-file=flake8_output.txt --tee --benchmark $IDF_PATH
 
 check_kconfigs:
   <<: *check_job_template
-  before_script: *do_nothing_before
   artifacts:
     when: on_failure
     paths:
@@ -730,6 +781,7 @@ check_kconfigs:
       - tools/*/*/Kconfig*.new
       - tools/*/*/*/Kconfig*.new
     expire_in: 1 week
+  <<: *before_script_lesser
   script:
     - ${IDF_PATH}/tools/ci/multirun_with_pyenv.sh ${IDF_PATH}/tools/test_check_kconfigs.py
     - ${IDF_PATH}/tools/check_kconfigs.py
@@ -744,7 +796,7 @@ check_ut_cmake_make:
     - /^release\/v/
     - /^v\d+\.\d+(\.\d+)?($|-)/
   dependencies: []
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
   script:
     - tools/ci/check_ut_cmake_make.sh
 
@@ -752,12 +804,22 @@ check_submodule_sync:
   <<: *check_job_template
   tags:
     - github_sync
+  retry: 2
   variables:
     GIT_STRATEGY: clone
-  retry: 2
+    GIT_SUBMODULE_STRATEGY: none
+    PUBLIC_IDF_URL: "https://github.com/espressif/esp-idf.git"
+  before_script: []
+  after_script: []
   script:
+    - git submodule deinit --force .
+    # setting the default remote URL to the public one, to resolve relative location URLs
+    - git config remote.origin.url ${PUBLIC_IDF_URL}
     # check if all submodules are correctly synced to public repostory
-    - git submodule update --init --recursive
+    - git submodule init
+    - *show_submodule_urls
+    - git submodule update --recursive
+    - echo "IDF was cloned from ${PUBLIC_IDF_URL} completely"
 
 check_artifacts_expire_time:
   <<: *check_job_template
@@ -776,6 +838,18 @@ check_pipeline_triggered_by_label:
     # We want to make sure some jobs are always executed to detect regression.
     - test "$BOT_LABEL_REGULAR_TEST" = "true" || exit -1
 
+# For release tag pipelines only, make sure the tag was created with 'git tag -a' so it will update
+# the version returned by 'git describe'
+check_version_tag:
+  extends: .check_job_template
+  only:
+    refs:
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+  script:
+    - (git cat-file -t $CI_COMMIT_REF_NAME | grep tag) || (echo "ESP-IDF versions must be annotated tags." && exit 1)
+
 assign_test:
   tags:
     - assign_test
@@ -790,6 +864,11 @@ assign_test:
   variables:
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
+    INTEGRATION_CONFIG_OUTPUT_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    PYTHON_VER: 3.7.7
   artifacts:
     paths:
       - components/idf_test/*/CIConfigs
@@ -808,11 +887,11 @@ assign_test:
     # assign unit test cases
     - python $TEST_FW_PATH/CIAssignUnitTest.py $IDF_PATH/components/idf_test/unit_test/TestCaseAll.yml $IDF_PATH/.gitlab-ci.yml $IDF_PATH/components/idf_test/unit_test/CIConfigs
     # clone test script to assign tests
-    - git clone $TEST_SCRIPT_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
     - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
-    - cd auto_test_script
     # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t $TEST_CASE_FILE_PATH -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin -o $INTEGRATION_CONFIG_OUTPUT_PATH
 
 .define_config_file_name: &define_config_file_name |
     JOB_NAME_PREFIX=$(echo ${CI_JOB_NAME} | awk '{print $1}')
@@ -844,21 +923,25 @@ assign_test:
     reports:
         junit: $LOG_PATH/*/XUNIT_RESULT.xml
   variables:
+    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
     CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/examples/test_configs"
     LOG_PATH: "$CI_PROJECT_DIR/TEST_LOGS"
     ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"
+    PYTHON_VER: 3
   script:
     - *define_config_file_name
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
     - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    - cd $TEST_FW_PATH
+    # git clone the known failure cases repo, run test
+    - ./tools/ci/retry_failed.sh git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
     # run test
-    - python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE
+    - cd $TEST_FW_PATH
+    - python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/known_failure_cases/known_failure_cases.txt
 
 .unit_test_template: &unit_test_template
   <<: *example_test_template
@@ -906,26 +989,30 @@ assign_test:
       - $LOG_PATH
     expire_in: 1 week
   variables:
+    SUBMODULES_TO_FETCH: "none"
     LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
-    LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test/integration_test"
+    LOG_PATH: "${CI_PROJECT_DIR}/TEST_LOGS"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
     MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/components/idf_test/ModuleDefinition.yml"
     CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
-  before_script: *add_gitlab_key_before
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/components/idf_test/integration_test/KnownIssues"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
+    PYTHON_VER: 3.7.7
   script:
     - *define_config_file_name
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
     - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    - cd ci-test-runner-configs
     # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
     - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
-    - cd auto_test_script
+    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
     # run test
-    - python CIRunner.py -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
 
 nvs_compatible_test:
   <<: *test_template
@@ -943,21 +1030,21 @@ nvs_compatible_test:
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
     - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    - cd ci-test-runner-configs
     # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
-    - cd auto_test_script
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
     # prepare nvs bins
-    - ./Tools/prepare_nvs_bin.sh
+    - cd auto_test_script
+    - ./tools/prepare_nvs_bin.sh
     # run test
-    - python CIRunner.py -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
 
 example_test_001:
   <<: *example_test_template
-  parallel: 2
+  parallel: 3
   tags:
     - ESP32
     - Example_WIFI
@@ -968,6 +1055,14 @@ example_test_002:
   tags:
     - ESP32
     - Example_ShieldBox_Basic
+  variables:
+    SUBMODULES_TO_FETCH: "all"
+    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
+    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/examples/test_configs"
+    LOG_PATH: "$CI_PROJECT_DIR/TEST_LOGS"
+    ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"
+    PYTHON_VER: 3
 
 .example_test_003:
   <<: *example_test_template
@@ -975,11 +1070,17 @@ example_test_002:
     - ESP32
     - Example_SDIO
 
-example_test_004:
+example_test_004A:
   <<: *example_test_template
   tags:
     - ESP32
-    - Example_CAN
+    - Example_CAN1
+
+example_test_004B:
+  <<: *example_test_template
+  tags:
+    - ESP32
+    - Example_CAN2
 
 example_test_005:
   <<: *example_test_template
@@ -1212,12 +1313,7 @@ UT_029:
 
 UT_030:
   <<: *unit_test_template
-  tags:
-    - ESP32_IDF
-    - UT_T1_1
-
-UT_031:
-  <<: *unit_test_template
+  parallel: 3
   tags:
     - ESP32_IDF
     - UT_T1_1
@@ -1302,7 +1398,7 @@ IT_002:
 
 IT_003:
   <<: *test_template
-  parallel: 13
+  parallel: 14
   tags:
     - ESP32_IDF
     - SSC_T2_5
@@ -1322,7 +1418,7 @@ IT_005:
 
 IT_006:
   <<: *test_template
-  parallel: 8
+  parallel: 13
   tags:
     - ESP32_IDF
     - SSC_T1_6
@@ -1346,13 +1442,6 @@ IT_009:
     - ESP32_IDF
     - SSC_T1_3
 
-IT_010:
-  <<: *test_template
-  parallel: 4
-  tags:
-    - ESP32_IDF
-    - SSC_T5_1
-
 IT_011:
   <<: *test_template
   tags:
@@ -1392,6 +1481,7 @@ IT_015:
 
 IT_016:
   <<: *test_template
+  allow_failure: true
   tags:
     - ESP32_IDF
     - SSC_T50_MESH1
@@ -1404,7 +1494,6 @@ IT_017:
 
 IT_018:
   <<: *test_template
-  parallel: 2
   tags:
     - ESP32_IDF
     - SSC_T1_9

.gitlab/CODEOWNERS

@@ -0,0 +1,6 @@
+# For the syntax of this file, see:
+#
+#    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
+#
+
+* @esp-idf-codeowners/all-maintainers

.gitmodules

@@ -1,75 +1,80 @@
+#
+# All the relative URL paths are intended to be GitHub ones
+# For Espressif's public projects please use '../../espressif/proj', not a '../proj'
+#
+
 [submodule "components/esp32/lib"]
 	path = components/esp32/lib
-	url = https://github.com/espressif/esp32-wifi-lib.git
+	url = ../../espressif/esp32-wifi-lib.git
 
 [submodule "components/esptool_py/esptool"]
 	path = components/esptool_py/esptool
-	url = https://github.com/espressif/esptool.git
+	url = ../../espressif/esptool.git
 
 [submodule "components/bt/lib"]
 	path = components/bt/lib
-	url = https://github.com/espressif/esp32-bt-lib.git
+	url = ../../espressif/esp32-bt-lib.git
 
 [submodule "components/micro-ecc/micro-ecc"]
 	path = components/micro-ecc/micro-ecc
-	url = https://github.com/kmackay/micro-ecc.git
+	url = ../../kmackay/micro-ecc.git
 
 [submodule "components/coap/libcoap"]
 	path = components/coap/libcoap
-	url = https://github.com/obgm/libcoap.git
+	url = ../../obgm/libcoap.git
 
 [submodule "components/aws_iot/aws-iot-device-sdk-embedded-C"]
 	path = components/aws_iot/aws-iot-device-sdk-embedded-C
-	url = https://github.com/espressif/aws-iot-device-sdk-embedded-C.git
+	url = ../../espressif/aws-iot-device-sdk-embedded-C.git
 
 [submodule "components/nghttp/nghttp2"]
 	path = components/nghttp/nghttp2
-	url = https://github.com/nghttp2/nghttp2.git
+	url = ../../nghttp2/nghttp2.git
 
 [submodule "components/libsodium/libsodium"]
 	path = components/libsodium/libsodium
-	url = https://github.com/jedisct1/libsodium.git
+	url = ../../jedisct1/libsodium.git
 
 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
-	url = https://github.com/pellepl/spiffs.git
+	url = ../../pellepl/spiffs.git
 
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
-	url = https://github.com/DaveGamble/cJSON.git
+	url = ../../DaveGamble/cJSON.git
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
-	url = https://github.com/espressif/mbedtls.git
+	url = ../../espressif/mbedtls.git
 
 [submodule "components/asio/asio"]
 	path = components/asio/asio
-	url = https://github.com/espressif/asio.git
+	url = ../../espressif/asio.git
 
 [submodule "components/expat/expat"]
 	path = components/expat/expat
-	url = https://github.com/libexpat/libexpat.git
+	url = ../../libexpat/libexpat.git
 
 [submodule "components/lwip/lwip"]
 	path = components/lwip/lwip
-	url = https://github.com/espressif/esp-lwip.git
+	url = ../../espressif/esp-lwip.git
 
 [submodule "components/mqtt/esp-mqtt"]
 	path = components/mqtt/esp-mqtt
-	url = https://github.com/espressif/esp-mqtt.git
+	url = ../../espressif/esp-mqtt.git
 
 [submodule "components/protobuf-c/protobuf-c"]
 	path = components/protobuf-c/protobuf-c
-	url = https://github.com/protobuf-c/protobuf-c
+	url = ../../protobuf-c/protobuf-c.git
 
 [submodule "components/unity/unity"]
 	path = components/unity/unity
-	url = https://github.com/ThrowTheSwitch/Unity
+	url = ../../ThrowTheSwitch/Unity.git
 
 [submodule "examples/build_system/cmake/import_lib/main/lib/tinyxml2"]
 	path = examples/build_system/cmake/import_lib/main/lib/tinyxml2
-	url = https://github.com/leethomason/tinyxml2
+	url = ../../leethomason/tinyxml2.git
 
 [submodule "components/nimble/nimble"]
 	path = components/nimble/nimble
-	url = https://github.com/espressif/esp-nimble.git
+	url = ../../espressif/esp-nimble.git

README.md

@@ -1,7 +1,5 @@
 # Espressif IoT Development Framework
 
-[![Documentation Status](https://readthedocs.com/projects/espressif-esp-idf/badge/?version=latest)](https://docs.espressif.com/projects/esp-idf/en/latest/?badge=latest)
-
 ESP-IDF is the official development framework for the [ESP32](https://espressif.com/en/products/hardware/esp32/overview) chip.
 
 # Developing With ESP-IDF
@@ -13,6 +11,14 @@ See setup guides for detailed instructions to set up the ESP-IDF:
 * [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
 * [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
 
+### Non-GitHub forks
+
+ESP-IDF uses relative locations as its submodules URLs ([.gitmodules](.gitmodules)). So they link to GitHub.
+If ESP-IDF is forked to a Git repository which is not on GitHub, you will need to run the script
+[tools/set-submodules-to-github.sh](tools/set-submodules-to-github.sh) after git clone.
+The script sets absolute URLs for all submodules, allowing `git submodule update --init --recursive` to complete.
+If cloning ESP-IDF from GitHub, this step is not needed.
+
 ## Finding a Project
 
 As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in Getting Started, ESP-IDF comes with some example projects in the [examples](examples) directory.

components/app_update/Kconfig.projbuild

@@ -22,4 +22,14 @@ menu "Application manager"
             The PROJECT_NAME variable from the build system will not affect the firmware image.
             This value will not be contained in the esp_app_desc structure.
 
+    config APP_RETRIEVE_LEN_ELF_SHA
+        int "The length of APP ELF SHA is stored in RAM(chars)"
+        default 16
+        range 8 64
+        help
+            At startup, the app will read this many hex characters from the embedded APP ELF SHA-256 hash value
+            and store it in static RAM. This ensures the app ELF SHA-256 value is always available
+            if it needs to be printed by the panic handler code.
+            Changing this value will change the size of a static buffer, in bytes.
+
 endmenu # "Application manager"

components/app_update/esp_app_desc.c

@@ -72,13 +72,35 @@ static inline char IRAM_ATTR to_hex_digit(unsigned val)
     return (val < 10) ? ('0' + val) : ('a' + val - 10);
 }
 
+__attribute__((constructor)) void esp_ota_init_app_elf_sha256(void)
+{
+    esp_ota_get_app_elf_sha256(NULL, 0);
+}
+
+/* The esp_app_desc.app_elf_sha256 should be possible to print in panic handler during cache is disabled.
+ * But because the cache is disabled the reading esp_app_desc.app_elf_sha256 is not right and
+ * can lead to a complete lock-up of the CPU.
+ * For this reason we do a reading of esp_app_desc.app_elf_sha256 while start up in esp_ota_init_app_elf_sha256() 
+ * and keep it in the static s_app_elf_sha256 value.
+ */
 int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
 {
-    size_t n = MIN((size - 1) / 2, sizeof(esp_app_desc.app_elf_sha256));
-    const uint8_t* src = esp_app_desc.app_elf_sha256;
+    static char s_app_elf_sha256[CONFIG_APP_RETRIEVE_LEN_ELF_SHA / 2];
+    static bool first_call = true;
+    if (first_call) {
+        first_call = false;
+        const uint8_t* src = esp_app_desc.app_elf_sha256;
+        for (size_t i = 0; i < sizeof(s_app_elf_sha256); ++i) {
+            s_app_elf_sha256[i] = src[i];
+        }
+    }
+    if (dst == NULL || size == 0) {
+        return 0;
+    }
+    size_t n = MIN((size - 1) / 2, sizeof(s_app_elf_sha256));
     for (size_t i = 0; i < n; ++i) {
-        dst[2*i] = to_hex_digit(src[i] >> 4);
-        dst[2*i + 1] = to_hex_digit(src[i] & 0xf);
+        dst[2*i] = to_hex_digit(s_app_elf_sha256[i] >> 4);
+        dst[2*i + 1] = to_hex_digit(s_app_elf_sha256[i] & 0xf);
     }
     dst[2*n] = 0;
     return 2*n + 1;

components/app_update/esp_ota_ops.c

@@ -165,7 +165,8 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
     if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
         ret = esp_partition_erase_range(partition, 0, partition->size);
     } else {
-        ret = esp_partition_erase_range(partition, 0, (image_size / SPI_FLASH_SEC_SIZE + 1) * SPI_FLASH_SEC_SIZE);
+        const int aligned_erase_size = (image_size + SPI_FLASH_SEC_SIZE - 1) & ~(SPI_FLASH_SEC_SIZE - 1);
+        ret = esp_partition_erase_range(partition, 0, aligned_erase_size);
     }
 
     if (ret != ESP_OK) {

components/app_update/otatool.py

@@ -276,6 +276,10 @@ def erase_ota_partition(args):
 
 
 def main():
+    if sys.version_info[0] < 3:
+        print("WARNING: Support for Python 2 is deprecated and will be removed in future versions.")
+    elif sys.version_info[0] == 3 and sys.version_info[1] < 6:
+        print("WARNING: Python 3 versions older than 3.6 are not supported.")
     global quiet
 
     parser = argparse.ArgumentParser("ESP-IDF OTA Partitions Tool")

components/app_update/test/test_app_desc.c

@@ -4,7 +4,7 @@
 
 TEST_CASE("esp_ota_get_app_elf_sha256 test", "[esp_app_desc]")
 {
-    const int sha256_hex_len = 64;
+    const int sha256_hex_len = CONFIG_APP_RETRIEVE_LEN_ELF_SHA;
     char dst[sha256_hex_len + 2];
     const char fill = 0xcc;
     int res;

components/bootloader/Kconfig.projbuild

@@ -28,20 +28,34 @@ menu "Bootloader config"
         default 4 if LOG_BOOTLOADER_LEVEL_DEBUG
         default 5 if LOG_BOOTLOADER_LEVEL_VERBOSE
 
+    config BOOTLOADER_SPI_CUSTOM_WP_PIN
+        bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
+        depends on FLASHMODE_QIO || FLASHMODE_QOUT
+        default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
+        default n
+        help
+            This setting is only used if the SPI flash pins have been overridden by setting the eFuses
+            SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
+
+            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
+            ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
+            for external SPIRAM if it is enabled.
+
+            If this config item is set to N (default), the correct WP pin will be automatically used for any
+            Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
+            Y and specify the GPIO number connected to the WP.
+
     config BOOTLOADER_SPI_WP_PIN
-        int "SPI Flash WP Pin when customising pins via eFuse (read help)"
+        int "Custom SPI Flash WP Pin"
         range 0 33
         default 7
         depends on FLASHMODE_QIO || FLASHMODE_QOUT
+        #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
         help
-            This value is ignored unless flash mode is set to QIO or QOUT *and* the SPI flash pins have been
-            overriden by setting the eFuses SPI_PAD_CONFIG_xxx.
+            The option "Use custom SPI Flash WP Pin" must be set or this value is ignored
 
-            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka ESP32
-            pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. That pin number is compiled into the
-            bootloader instead.
-
-            The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
+            If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
+            value to the GPIO number of the SPI flash WP pin.
 
     choice BOOTLOADER_VDDSDIO_BOOST
         bool "VDDSDIO LDO voltage"
@@ -223,6 +237,7 @@ endmenu  # Bootloader
 
 
 menu "Security features"
+    visible if !IDF_CMAKE
 
     # These three are the actual options to check in code,
     # selected by the displayed options
@@ -402,6 +417,7 @@ menu "Security features"
     config FLASH_ENCRYPTION_ENABLED
         bool "Enable flash encryption on boot (READ DOCS FIRST)"
         default N
+        select PARTITION_TABLE_MD5 if !ESP32_COMPATIBLE_PRE_V3_1_BOOTLOADERS
         help
             If this option is set, flash contents will be encrypted by the bootloader on first boot.
 
@@ -523,4 +539,21 @@ menu "Security features"
             Reflashable mode so that a new Secure Boot digest can be flashed at the same time as plaintext firmware.
             This combination is not secure and should not be used for a production system.
 
+    config SECURE_DISABLE_ROM_DL_MODE
+        bool "Permanently disable ROM Download Mode"
+        depends on ESP32_REV_MIN_3
+        default n
+        help
+            If set, during startup the app will burn an eFuse bit to permanently disable the UART ROM
+            Download Mode. This prevents any future use of esptool.py, espefuse.py and similar tools.
+
+            Once disabled, if the SoC is booted with strapping pins set for ROM Download Mode
+            then an error is printed instead.
+
+            It is recommended to enable this option in any production application where Flash
+            Encryption and/or Secure Boot is enabled and access to Download Mode is not required.
+
+            It is also possible to permanently disable Download Mode by calling
+            esp_efuse_disable_rom_download_mode() at runtime.
+
 endmenu  # Security features

components/bootloader/subproject/main/esp32.bootloader.ld

@@ -40,6 +40,7 @@ SECTIONS
      *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
     *liblog.a:(.literal .text .literal.* .text.*)
     *libgcc.a:(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_clock.*(.literal.esp_clk_apb_freq .text.esp_clk_apb_freq)
     *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
@@ -52,6 +53,7 @@ SECTIONS
     *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libsoc.a:rtc_clk.*(.literal.rtc_clk_apb_freq_get .text.rtc_clk_apb_freq_get)
     *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
     *libefuse.a:*.*(.literal .text .literal.* .text.*)
     *(.fini.literal)
@@ -73,6 +75,7 @@ SECTIONS
   .dram0.bss (NOLOAD) :
   {
     . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
     _bss_start = ABSOLUTE(.);
     *(.dynsbss)
     *(.sbss)
@@ -149,7 +152,7 @@ SECTIONS
     *(.gnu.linkonce.lit4.*)
     _lit4_end = ABSOLUTE(.);
     . = ALIGN(4);
-    _heap_start = ABSOLUTE(.);
+    _dram_end = ABSOLUTE(.);
   } >dram_seg
 
   .iram.text :
@@ -161,6 +164,14 @@ SECTIONS
     *(.fini.literal)
     *(.fini)
     *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
     _text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_seg

components/bootloader_support/include/bootloader_flash_config.h

@@ -14,6 +14,7 @@
 
 #pragma once
 
+#include "sdkconfig.h"
 #include "esp_image_format.h"
 
 #ifdef __cplusplus
@@ -66,6 +67,20 @@ void bootloader_flash_gpio_config(const esp_image_header_t* pfhdr);
  */
 void bootloader_flash_dummy_config(const esp_image_header_t* pfhdr);
 
+/**
+ * @brief Return the pin number used for custom SPI flash and/or SPIRAM WP pin
+ *
+ * Can be determined by eFuse values in most cases, or overriden in configuration
+ *
+ * This value is only meaningful if the other SPI flash pins are overriden via eFuse.
+ *
+ * This value is only meaningful if flash is set to QIO or QOUT mode, or if
+ * SPIRAM is enabled.
+ *
+ * @return Pin number to use, or -1 if the default should be kept
+ */
+int bootloader_flash_get_wp_pin(void);
+
 #ifdef __cplusplus
 }
 #endif

components/bootloader_support/include/esp_flash_encrypt.h

@@ -110,7 +110,11 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length);
  * is enabled but secure boot is not used. This should protect against
  * serial re-flashing of an unauthorised code in absence of secure boot.
  *
- * @return 
+ * @note To support disabling UART Download Mode on ESP32 V3 only, this function
+ * doesn't write protect FLASH_CRYPT_CNT but instead sets it to the max value
+ * (effectively the same result but allows burning the UART_DL_DIS efuse later on,
+ * as this is otherwise also disabled if FLASH_CRYPT_CNT is write protected.)
+ *
  */
 void esp_flash_write_protect_crypt_cnt();
 

components/bootloader_support/include/esp_secure_boot.h

@@ -123,6 +123,19 @@ typedef struct {
 
 esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest);
 
+/** @brief Verify the ECDSA secure boot signature block for Secure Boot.
+ *
+ *  Calculates Deterministic ECDSA w/ SHA256 based on the SHA256 hash of the image. ECDSA signature
+ *  verification must be enabled in project configuration to use this function.
+ *
+ * Similar to esp_secure_boot_verify_signature(), but can be used when the digest is precalculated.
+ * @param sig_block Pointer to ECDSA signature block data
+ * @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
+ * @param verified_digest Pointer to 32 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
+ *
+ */
+esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
+
 #define FLASH_OFFS_SECURE_BOOT_IV_DIGEST 0
 
 /** @brief Secure boot IV+digest header */

components/bootloader_support/include_bootloader/bootloader_flash.h

@@ -22,6 +22,7 @@
 
 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 0x10000
+#define MMAP_ALIGNED_MASK 0x0000FFFF
 
 /* Provide a Flash API for bootloader_support code,
    that can be used from bootloader or app code.
@@ -35,7 +36,7 @@
  *
  * @return Number of free pages
  */
-uint32_t bootloader_mmap_get_free_pages();
+uint32_t bootloader_mmap_get_free_pages(void);
 
 /**
  * @brief Map a region of flash to data memory

components/bootloader_support/include_bootloader/bootloader_sha.h

@@ -26,7 +26,7 @@
 
 typedef void *bootloader_sha256_handle_t;
 
-bootloader_sha256_handle_t bootloader_sha256_start();
+bootloader_sha256_handle_t bootloader_sha256_start(void);
 
 void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data, size_t data_len);
 

components/bootloader_support/include_bootloader/bootloader_utility.h

@@ -14,6 +14,7 @@
 #pragma once
 
 #include "esp_image_format.h"
+#include "bootloader_config.h"
 
 /**
  * @brief Load partition table.
@@ -62,3 +63,17 @@ __attribute__((noreturn)) void bootloader_utility_load_boot_image(const bootload
  * It is not recommended to call this function from an app (if called, the app will abort).
  */
 __attribute__((noreturn)) void bootloader_reset(void);
+
+/** @brief Generates the digest of the data between offset & offset+length.
+ *
+ * This function should be used when the size of the data is larger than 3.2MB.
+ * The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-256 
+ * of the data in chunks of 3.2MB, considering the MMU capacity. 
+ * 
+ * @param[in]  flash_offset  Offset of the data in flash.
+ * @param[in]  len           Length of data in bytes.
+ * @param[out] digest        Pointer to buffer where the digest is written, if ESP_OK is returned. 
+ * 
+ * @return ESP_OK if secure boot digest is generated successfully.
+ */
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);

components/bootloader_support/src/bootloader_clock.c

@@ -59,3 +59,12 @@ void bootloader_clock_configure()
     }
 #endif
 }
+
+#ifdef BOOTLOADER_BUILD
+
+int esp_clk_apb_freq(void)
+{
+    return rtc_clk_apb_freq_get();
+}
+
+#endif // BOOTLOADER_BUILD

components/bootloader_support/src/bootloader_common.c

@@ -26,6 +26,8 @@
 #include "esp_flash_partitions.h"
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
+#include "bootloader_config.h"
+#include "bootloader_utility.h"
 #include "soc/gpio_periph.h"
 #include "soc/efuse_reg.h"
 #include "soc/rtc.h"
@@ -186,22 +188,7 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
         size = data.image_len;
     }
     // If image is type by data then hash is calculated for entire image.
-    const void *partition_bin = bootloader_mmap(address, size);
-    if (partition_bin == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", address, size);
-        return ESP_FAIL;
-    }
-    bootloader_sha256_handle_t sha_handle = bootloader_sha256_start();
-    if (sha_handle == NULL) {
-        bootloader_munmap(partition_bin);
-        return ESP_ERR_NO_MEM;
-    }
-    bootloader_sha256_data(sha_handle, partition_bin, size);
-    bootloader_sha256_finish(sha_handle, out_sha_256);
-
-    bootloader_munmap(partition_bin);
-
-    return ESP_OK;
+    return bootloader_sha256_flash_contents(address, size, out_sha_256);
 }
 
 int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata, bool *valid_two_otadata, bool max)
@@ -247,13 +234,15 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t
         return ESP_ERR_INVALID_ARG;
     }
 
-    const uint8_t *image = bootloader_mmap(partition->offset, partition->size);
+    const uint32_t app_desc_offset = sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t);
+    const uint32_t mmap_size = app_desc_offset + sizeof(esp_app_desc_t);
+    const uint8_t *image = bootloader_mmap(partition->offset, mmap_size);
     if (image == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, partition->size);
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, mmap_size);
         return ESP_FAIL;
     }
 
-    memcpy(app_desc, image + sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t), sizeof(esp_app_desc_t));
+    memcpy(app_desc, image + app_desc_offset, sizeof(esp_app_desc_t));
     bootloader_munmap(image);
 
     if (app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {

components/bootloader_support/src/bootloader_flash_config.c

@@ -25,6 +25,7 @@
 #include "soc/spi_reg.h"
 #include "soc/spi_pins.h"
 #include "flash_qio_mode.h"
+#include "bootloader_common.h"
 #include "bootloader_flash_config.h"
 
 void bootloader_flash_update_id()
@@ -62,6 +63,7 @@ void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
             break;
     }
     esp_rom_spiflash_config_clk(spi_clk_div, 0);
+    esp_rom_spiflash_config_clk(spi_clk_div, 1);
 }
 
 void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
@@ -74,18 +76,11 @@ void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
     uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
     uint32_t pkg_ver = chip_ver & 0x7;
 
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302) {
+        // For ESP32D2WD or ESP32-PICO series,the SPI pins are already configured
         // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
@@ -162,4 +157,33 @@ void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
 
     SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + g_rom_spiflash_dummy_len_plus[0],
             SPI_USR_DUMMY_CYCLELEN_S);
+}
+
+#define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD & ESP32-PICO-D4 has this GPIO wired to WP pin of flash */
+#define ESP32_PICO_V3_GPIO 18 /* ESP32-PICO-V3* use this GPIO for WP pin of flash */
+
+int bootloader_flash_get_wp_pin(void)
+{
+#if CONFIG_BOOTLOADER_SPI_CUSTOM_WP_PIN
+    return CONFIG_BOOTLOADER_SPI_WP_PIN; // can be set for bootloader when QIO or QOUT config in use
+#elif CONFIG_SPIRAM_CUSTOM_SPIWP_SD3_PIN
+    return CONFIG_SPIRAM_SPIWP_SD3_PIN; // can be set for app when DIO or DOUT config used for PSRAM only
+#else
+    // no custom value, find it based on the package eFuse value
+    uint8_t chip_ver;
+    uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
+    switch(pkg_ver) {
+    case EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5:
+        return ESP32_D2WD_WP_GPIO;
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2:
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4:
+        /* Same package IDs are used for ESP32-PICO-V3 and ESP32-PICO-D4, silicon version differentiates */
+        chip_ver = bootloader_common_get_chip_revision();
+        return (chip_ver < 3) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302:
+        return ESP32_PICO_V3_GPIO;
+    default:
+        return SPI_IOMUX_PIN_NUM_WP;
+    }
+#endif
 }

components/bootloader_support/src/bootloader_sha.c

@@ -21,7 +21,7 @@
 // App version is a wrapper around mbedTLS SHA API
 #include <mbedtls/sha256.h>
 
-bootloader_sha256_handle_t bootloader_sha256_start()
+bootloader_sha256_handle_t bootloader_sha256_start(void)
 {
     mbedtls_sha256_context *ctx = (mbedtls_sha256_context *)malloc(sizeof(mbedtls_sha256_context));
     if (!ctx) {
@@ -53,6 +53,7 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
     }
     mbedtls_sha256_free(ctx);
     free(handle);
+    handle = NULL;
 }
 
 #else // Bootloader version
@@ -70,7 +71,7 @@ static const size_t BLOCK_WORDS = (64/sizeof(uint32_t));
 // Words in final SHA256 digest
 static const size_t DIGEST_WORDS = (32/sizeof(uint32_t));
 
-bootloader_sha256_handle_t bootloader_sha256_start()
+bootloader_sha256_handle_t bootloader_sha256_start(void)
 {
     // Enable SHA hardware
     ets_sha_enable();

components/bootloader_support/src/bootloader_utility.c

@@ -703,3 +703,39 @@ void bootloader_reset(void)
     abort();            /* This function should really not be called from application code */
 #endif
 }
+
+
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
+{
+
+    if (digest == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    /* Handling firmware images larger than MMU capacity */
+    uint32_t mmu_free_pages_count = bootloader_mmap_get_free_pages();
+    bootloader_sha256_handle_t sha_handle = NULL;
+
+    sha_handle = bootloader_sha256_start();
+    if (sha_handle == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+
+    while (len > 0) {
+        uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */
+        uint32_t partial_image_len = MIN(len, ((mmu_free_pages_count - mmu_page_offset) * SPI_FLASH_MMU_PAGE_SIZE)); /* Read the image that fits in the free MMU pages */
+
+        const void * image = bootloader_mmap(flash_offset, partial_image_len);
+        if (image == NULL) {
+            bootloader_sha256_finish(sha_handle, NULL);
+            return ESP_FAIL;
+        }
+        bootloader_sha256_data(sha_handle, image, partial_image_len);
+        bootloader_munmap(image);
+
+        flash_offset += partial_image_len;
+        len -= partial_image_len;
+    }
+    bootloader_sha256_finish(sha_handle, digest);
+    return ESP_OK;
+}

components/bootloader_support/src/esp_image_format.c

@@ -18,6 +18,7 @@
 #include <soc/cpu.h>
 #include <esp_image_format.h>
 #include <esp_secure_boot.h>
+#include <esp_fault.h>
 #include <esp_log.h>
 #include <esp_spi_flash.h>
 #include <bootloader_flash.h>
@@ -25,6 +26,7 @@
 #include <bootloader_sha.h>
 #include "bootloader_util.h"
 #include "bootloader_common.h"
+#include "soc/soc_memory_layout.h"
 
 /* Checking signatures as part of verifying images is necessary:
    - Always if secure boot is enabled
@@ -92,7 +94,7 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
 
 static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data);
 
-static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data);
+static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data,uint8_t *image_digest, uint8_t *verified_digest);
 static esp_err_t __attribute__((unused)) verify_simple_hash(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data);
 
 static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *part, esp_image_metadata_t *data)
@@ -108,6 +110,12 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     uint32_t checksum_word = ESP_ROM_CHECKSUM_INITIAL;
     bootloader_sha256_handle_t sha_handle = NULL;
 
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
+     /* used for anti-FI checks */
+    uint8_t image_digest[HASH_LEN] = { [ 0 ... 31] = 0xEE };
+    uint8_t verified_digest[HASH_LEN] = { [ 0 ... 31 ] = 0x01 };
+#endif
+
     if (data == NULL || part == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -196,7 +204,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     if (!is_bootloader) {
 #ifdef SECURE_BOOT_CHECK_SIGNATURE
         // secure boot images have a signature appended
-        err = verify_secure_boot_signature(sha_handle, data);
+        err = verify_secure_boot_signature(sha_handle, data, image_digest, verified_digest);
 #else
         // No secure boot, but SHA-256 can be appended for basic corruption detection
         if (sha_handle != NULL && !esp_cpu_in_ocd_debug_mode()) {
@@ -226,7 +234,22 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     }
 
 #ifdef BOOTLOADER_BUILD
-    if (do_load) { // Need to deobfuscate RAM
+
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
+    /* If signature was checked in bootloader build, verified_digest should equal image_digest
+
+       This is to detect any fault injection that caused signature verification to not complete normally.
+
+       Any attack which bypasses this check should be of limited use as the RAM contents are still obfuscated, therefore we do the check
+       immediately before we deobfuscate.
+
+       Note: the conditions for making this check are the same as for setting verify_sha above, but on ESP32 SB V1 we move the test for
+       "only verify signature in bootloader" into the macro so it's tested multiple times.
+     */
+    ESP_FAULT_ASSERT(data->start_addr == ESP_BOOTLOADER_OFFSET || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
+#endif // SECURE_BOOT_CHECK_SIGNATURE
+
+    if (do_load && ram_obfs_value[0] != 0 && ram_obfs_value[1] != 0) { // Need to deobfuscate RAM
         for (int i = 0; i < data->image.segment_count; i++) {
             uint32_t load_addr = data->segments[i].load_addr;
             if (should_load(load_addr)) {
@@ -298,6 +321,127 @@ static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t
     return err;
 }
 
+#ifdef BOOTLOADER_BUILD
+/* Check the region load_addr - load_end doesn't overlap any memory used by the bootloader, registers, or other invalid memory
+ */
+static bool verify_load_addresses(int segment_index, intptr_t load_addr, intptr_t load_end, bool print_error, bool no_recurse)
+{
+    /* Addresses of static data and the "loader" section of bootloader IRAM, all defined in ld script */
+    const char *reason = NULL;
+    extern int _dram_start, _dram_end, _loader_text_start, _loader_text_end;
+    void *load_addr_p = (void *)load_addr;
+    void *load_end_p = (void *)load_end;
+
+    if (load_end == load_addr) {
+        return true; // zero-length segments are fine
+    }
+    assert(load_end > load_addr); // data_len<16MB is checked in verify_segment_header() which is called before this, so this should always be true
+
+    if (esp_ptr_in_dram(load_addr_p) && esp_ptr_in_dram(load_end_p)) { /* Writing to DRAM */
+        /* Check if we're clobbering the stack */
+        intptr_t sp = (intptr_t)get_sp();
+        if (bootloader_util_regions_overlap(sp - STACK_LOAD_HEADROOM, SOC_ROM_STACK_START,
+                                           load_addr, load_end)) {
+            reason = "overlaps bootloader stack";
+            goto invalid;
+        }
+
+        /* Check if we're clobbering static data
+
+           (_dram_start.._dram_end includes bss, data, rodata sections in DRAM)
+         */
+        if (bootloader_util_regions_overlap((intptr_t)&_dram_start, (intptr_t)&_dram_end, load_addr, load_end)) {
+            reason = "overlaps bootloader data";
+            goto invalid;
+        }
+
+        /* LAST DRAM CHECK (recursive): for D/IRAM, check the equivalent IRAM addresses if needed
+
+           Allow for the possibility that even though both pointers are IRAM, only part of the region is in a D/IRAM
+           section. In which case we recurse to check the part which falls in D/IRAM.
+
+           Note: We start with SOC_DIRAM_DRAM_LOW/HIGH and convert that address to IRAM to account for any reversing of word order
+           (chip-specific).
+         */
+        if (!no_recurse && bootloader_util_regions_overlap(SOC_DIRAM_DRAM_LOW, SOC_DIRAM_DRAM_HIGH, load_addr, load_end)) {
+            intptr_t iram_load_addr, iram_load_end;
+
+            if (esp_ptr_in_diram_dram(load_addr_p)) {
+                iram_load_addr = (intptr_t)esp_ptr_diram_dram_to_iram(load_addr_p);
+            } else {
+                iram_load_addr = (intptr_t)esp_ptr_diram_dram_to_iram((void *)SOC_DIRAM_DRAM_LOW);
+            }
+
+            if (esp_ptr_in_diram_dram(load_end_p)) {
+                iram_load_end = (intptr_t)esp_ptr_diram_dram_to_iram(load_end_p);
+            } else {
+                iram_load_end = (intptr_t)esp_ptr_diram_dram_to_iram((void *)SOC_DIRAM_DRAM_HIGH);
+            }
+
+            if (iram_load_end < iram_load_addr) {
+                return verify_load_addresses(segment_index, iram_load_end, iram_load_addr, print_error, true);
+            } else {
+                return verify_load_addresses(segment_index, iram_load_addr, iram_load_end, print_error, true);
+            }
+        }
+    }
+    else if (esp_ptr_in_iram(load_addr_p) && esp_ptr_in_iram(load_end_p)) { /* Writing to IRAM */
+        /* Check for overlap of 'loader' section of IRAM */
+        if (bootloader_util_regions_overlap((intptr_t)&_loader_text_start, (intptr_t)&_loader_text_end,
+                                            load_addr, load_end)) {
+            reason = "overlaps loader IRAM";
+            goto invalid;
+        }
+
+        /* LAST IRAM CHECK (recursive): for D/IRAM, check the equivalent DRAM address if needed
+
+           Allow for the possibility that even though both pointers are IRAM, only part of the region is in a D/IRAM
+           section. In which case we recurse to check the part which falls in D/IRAM.
+           Note: We start with SOC_DIRAM_IRAM_LOW/HIGH and convert that address to DRAM to account for any reversing of word order
+           (chip-specific).
+         */
+        if (!no_recurse && bootloader_util_regions_overlap(SOC_DIRAM_IRAM_LOW, SOC_DIRAM_IRAM_HIGH, load_addr, load_end)) {
+            intptr_t dram_load_addr, dram_load_end;
+
+            if (esp_ptr_in_diram_iram(load_addr_p)) {
+                dram_load_addr = (intptr_t)esp_ptr_diram_iram_to_dram(load_addr_p);
+            } else {
+                dram_load_addr = (intptr_t)esp_ptr_diram_iram_to_dram((void *)SOC_DIRAM_IRAM_LOW);
+            }
+
+            if (esp_ptr_in_diram_iram(load_end_p)) {
+                dram_load_end = (intptr_t)esp_ptr_diram_iram_to_dram(load_end_p);
+            } else {
+                dram_load_end = (intptr_t)esp_ptr_diram_iram_to_dram((void *)SOC_DIRAM_IRAM_HIGH);
+            }
+
+            if (dram_load_end < dram_load_addr) {
+                return verify_load_addresses(segment_index, dram_load_end, dram_load_addr, print_error, true);
+            } else {
+                return verify_load_addresses(segment_index, dram_load_addr, dram_load_end, print_error, true);
+            }
+        }
+    /* Sections entirely in RTC memory won't overlap with a vanilla bootloader but are valid load addresses, thus skipping them from the check */
+    } else if (esp_ptr_in_rtc_iram_fast(load_addr_p) && esp_ptr_in_rtc_iram_fast(load_end_p)){
+        return true;
+    } else if (esp_ptr_in_rtc_dram_fast(load_addr_p) && esp_ptr_in_rtc_dram_fast(load_end_p)){
+        return true;
+    } else if (esp_ptr_in_rtc_slow(load_addr_p) && esp_ptr_in_rtc_slow(load_end_p)) {
+        return true;
+    } else { /* Not a DRAM or an IRAM or RTC Fast IRAM, RTC Fast DRAM or RTC Slow address */
+        reason = "bad load address range";
+        goto invalid;
+    }
+    return true;
+
+ invalid:
+    if (print_error) {
+        ESP_LOGE(TAG, "Segment %d 0x%08x-0x%08x invalid: %s", segment_index, load_addr, load_end, reason);
+    }
+    return false;
+}
+#endif // BOOTLOADER_BUILD
+
 static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
 {
     esp_err_t err;
@@ -337,37 +481,11 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
                  (do_load)?"load":(is_mapping)?"map":"");
     }
 
-
 #ifdef BOOTLOADER_BUILD
     /* Before loading segment, check it doesn't clobber bootloader RAM. */
-    if (do_load) {
-        const intptr_t load_end = load_addr + data_len;
-        if (load_end <= (intptr_t) SOC_DIRAM_DRAM_HIGH) {
-            /* Writing to DRAM */
-            intptr_t sp = (intptr_t)get_sp();
-            if (load_end > sp - STACK_LOAD_HEADROOM) {
-                /* Bootloader .data/.rodata/.bss is above the stack, so this
-                 * also checks that we aren't overwriting these segments.
-                 *
-                 * TODO: This assumes specific arrangement of sections we have
-                 * in the ESP32. Rewrite this in a generic way to support other
-                 * layouts.
-                 */
-                ESP_LOGE(TAG, "Segment %d end address 0x%08x too high (bootloader stack 0x%08x limit 0x%08x)",
-                         index, load_end, sp, sp - STACK_LOAD_HEADROOM);
-                return ESP_ERR_IMAGE_INVALID;
-            }
-        } else {
-            /* Writing to IRAM */
-            const intptr_t loader_iram_start = (intptr_t) &_loader_text_start;
-            const intptr_t loader_iram_end = (intptr_t) &_loader_text_end;
-
-            if (bootloader_util_regions_overlap(loader_iram_start, loader_iram_end,
-                    load_addr, load_end)) {
-                ESP_LOGE(TAG, "Segment %d (0x%08x-0x%08x) overlaps bootloader IRAM (0x%08x-0x%08x)",
-                         index, load_addr, load_end, loader_iram_start, loader_iram_end);
-                return ESP_ERR_IMAGE_INVALID;
-            }
+    if (do_load && data_len > 0) {
+        if (!verify_load_addresses(index, load_addr, load_addr + data_len, true, false)) {
+            return ESP_ERR_IMAGE_INVALID;
         }
     }
 #endif // BOOTLOADER_BUILD
@@ -377,6 +495,10 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
 
     int32_t data_len_remain = data_len;
     while (data_len_remain > 0) {
+#if defined(SECURE_BOOT_CHECK_SIGNATURE) && defined(BOOTLOADER_BUILD)
+        /* Double check the address verification done above */
+        ESP_FAULT_ASSERT(!do_load || verify_load_addresses(0, load_addr, load_addr + data_len_remain, false, false));
+#endif
         uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
         /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
         data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
@@ -572,28 +694,33 @@ static esp_err_t verify_checksum(bootloader_sha256_handle_t sha_handle, uint32_t
 
 static void debug_log_hash(const uint8_t *image_hash, const char *caption);
 
-static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data)
+static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest)
 {
-    uint8_t image_hash[HASH_LEN] = { 0 };
+#ifdef SECURE_BOOT_CHECK_SIGNATURE
+    uint32_t end = data->start_addr + data->image_len;
 
     ESP_LOGI(TAG, "Verifying image signature...");
 
     // For secure boot, we calculate the signature hash over the whole file, which includes any "simple" hash
     // appended to the image for corruption detection
     if (data->image.hash_appended) {
-        const void *simple_hash = bootloader_mmap(data->start_addr + data->image_len - HASH_LEN, HASH_LEN);
+        const void *simple_hash = bootloader_mmap(end - HASH_LEN, HASH_LEN);
         bootloader_sha256_data(sha_handle, simple_hash, HASH_LEN);
         bootloader_munmap(simple_hash);
     }
 
-    bootloader_sha256_finish(sha_handle, image_hash);
+    bootloader_sha256_finish(sha_handle, image_digest);
 
     // Log the hash for debugging
-    debug_log_hash(image_hash, "Calculated secure boot hash");
+    debug_log_hash(image_digest, "Calculated secure boot hash");
 
     // Use hash to verify signature block
-    const esp_secure_boot_sig_block_t *sig_block = bootloader_mmap(data->start_addr + data->image_len, sizeof(esp_secure_boot_sig_block_t));
-    esp_err_t err = esp_secure_boot_verify_signature_block(sig_block, image_hash);
+    esp_err_t err = ESP_ERR_IMAGE_INVALID;
+    const void *sig_block;
+    ESP_FAULT_ASSERT(memcmp(image_digest, verified_digest, HASH_LEN) != 0); /* sanity check that these values start differently */
+    sig_block = bootloader_mmap(data->start_addr + data->image_len, sizeof(esp_secure_boot_sig_block_t));
+    err = esp_secure_boot_verify_ecdsa_signature_block(sig_block, image_digest, verified_digest);
+
     bootloader_munmap(sig_block);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Secure boot signature verification failed");
@@ -614,6 +741,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
         return ESP_ERR_IMAGE_INVALID;
     }
 
+#endif // SECURE_BOOT_CHECK_SIGNATURE
     return ESP_OK;
 }
 

components/bootloader_support/src/flash_encrypt.c

@@ -199,19 +199,22 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
 
     ESP_LOGD(TAG, "All flash regions checked for encryption pass");
 
+    uint32_t new_flash_crypt_cnt;
+#ifdef CONFIG_FLASH_ENCRYPTION_DISABLE_PLAINTEXT
+    ESP_LOGI(TAG, "Setting FLASH_CRYPT_CNT efuse to max...");
+    new_flash_crypt_cnt = EFUSE_FLASH_CRYPT_CNT;
+#else
     /* Set least significant 0-bit in flash_crypt_cnt */
     int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & EFUSE_RD_FLASH_CRYPT_CNT);
     /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == EFUSE_RD_FLASH_CRYPT_CNT (0x7F) */
-    uint32_t new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
+    new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
+    if (new_flash_crypt_cnt != EFUSE_FLASH_CRYPT_CNT) {
+        ESP_LOGW(TAG, "Not disabling FLASH_CRYPT_CNT - plaintext flashing is still possible");
+    }
+#endif
     ESP_LOGD(TAG, "FLASH_CRYPT_CNT 0x%x -> 0x%x", flash_crypt_cnt, new_flash_crypt_cnt);
     REG_SET_FIELD(EFUSE_BLK0_WDATA0_REG, EFUSE_FLASH_CRYPT_CNT, new_flash_crypt_cnt);
 
-#ifdef CONFIG_FLASH_ENCRYPTION_DISABLE_PLAINTEXT
-    ESP_LOGI(TAG, "Write protecting FLASH_CRYPT_CNT efuse...");
-    REG_SET_BIT(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_FLASH_CRYPT_CNT);
-#else
-    ESP_LOGW(TAG, "Not disabling FLASH_CRYPT_CNT - plaintext flashing is still possible");
-#endif
 
     esp_efuse_burn_new_values();
 
@@ -348,12 +351,19 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length)
     return err;
 }
 
-void esp_flash_write_protect_crypt_cnt() 
+void esp_flash_write_protect_crypt_cnt()
 {
+    if (!esp_flash_encryption_enabled()) {
+        ESP_LOGE(TAG, "flash encryption not enabled!");
+        return;
+    }
+
     uint32_t efuse_blk0 = REG_READ(EFUSE_BLK0_RDATA0_REG);
     bool flash_crypt_wr_dis = efuse_blk0 & EFUSE_WR_DIS_FLASH_CRYPT_CNT;
-    if(!flash_crypt_wr_dis) { 
-        REG_WRITE(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_FLASH_CRYPT_CNT);
+    unsigned flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_FLASH_CRYPT_CNT);
+    if(!flash_crypt_wr_dis && flash_crypt_cnt != EFUSE_FLASH_CRYPT_CNT) {
+        /* Disable by setting flash_crypt_cnt to max, to still allow disabling UART DL mode on ESP32 rev 3 */
+        REG_SET_FIELD(EFUSE_BLK0_WDATA0_REG, EFUSE_FLASH_CRYPT_CNT, EFUSE_FLASH_CRYPT_CNT);
         esp_efuse_burn_new_values();
     }
 }

components/bootloader_support/src/flash_qio_mode.c

@@ -13,6 +13,7 @@
 // limitations under the License.
 #include <stddef.h>
 #include <stdint.h>
+#include "bootloader_flash_config.h"
 #include "flash_qio_mode.h"
 #include "esp_log.h"
 #include "esp_err.h"
@@ -71,12 +72,6 @@ static unsigned read_status_8b_xmc25qu64a();
 /* Write 8 bit status of XM25QU64A */
 static void write_status_8b_xmc25qu64a(unsigned new_status);
 
-#define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD has this GPIO wired to WP pin of flash */
-
-#ifndef CONFIG_BOOTLOADER_SPI_WP_PIN // Set in menuconfig if SPI flasher config is set to a quad mode
-#define CONFIG_BOOTLOADER_SPI_WP_PIN ESP32_D2WD_WP_GPIO
-#endif
-
 /* Array of known flash chips and data to enable Quad I/O mode
 
    Manufacturer & flash ID can be tested by running "esptool.py
@@ -169,22 +164,6 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
     uint32_t status;
     const uint32_t spiconfig = ets_efuse_get_spiconfig();
 
-    if (spiconfig != EFUSE_SPICONFIG_SPI_DEFAULTS && spiconfig != EFUSE_SPICONFIG_HSPI_DEFAULTS) {
-        // spiconfig specifies a custom efuse pin configuration. This config defines all pins -except- WP,
-        // which is compiled into the bootloader instead.
-        //
-        // Most commonly an overriden pin mapping means ESP32-D2WD or ESP32-PICOD4.
-        //Warn if chip is ESP32-D2WD/ESP32-PICOD4 but someone has changed the WP pin
-        //assignment from that chip's WP pin.
-        uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-        if (CONFIG_BOOTLOADER_SPI_WP_PIN != ESP32_D2WD_WP_GPIO  &&
-            (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
-             pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
-             pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4)) {
-            ESP_LOGW(TAG, "Chip is ESP32-D2WD/ESP32-PICOD4 but flash WP pin is different value to internal flash");
-        }
-    }
-
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
 
     status = read_status_fn();
@@ -218,7 +197,8 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
 
     esp_rom_spiflash_config_readmode(mode);
 
-    esp_rom_spiflash_select_qio_pins(CONFIG_BOOTLOADER_SPI_WP_PIN, spiconfig);
+    int wp_pin = bootloader_flash_get_wp_pin();
+    esp_rom_spiflash_select_qio_pins(wp_pin, spiconfig);
 
     return ESP_OK;
 }

components/bootloader_support/src/secure_boot_signatures.c

@@ -15,11 +15,22 @@
 
 #include "bootloader_flash.h"
 #include "bootloader_sha.h"
+#include "bootloader_utility.h"
 #include "esp_log.h"
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"
 
-#include "uECC.h"
+#ifdef BOOTLOADER_BUILD
+#include "uECC_verify_antifault.h"
+#else
+#include "mbedtls/sha256.h"
+#include "mbedtls/x509.h"
+#include "mbedtls/md.h"
+#include "mbedtls/platform.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include <string.h>
+#endif
 
 #include <sys/param.h>
 
@@ -38,38 +49,17 @@ extern const uint8_t signature_verification_key_end[] asm("_binary_signature_ver
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
     uint8_t digest[DIGEST_LEN];
-    const uint8_t *data;
+    uint8_t verified_digest[DIGEST_LEN] = { 0 }; /* ignored in this function */
     const esp_secure_boot_sig_block_t *sigblock;
 
     ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
 
-    bootloader_sha256_handle_t handle = bootloader_sha256_start();
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, length, digest);
 
-    uint32_t free_page_count = bootloader_mmap_get_free_pages();
-    ESP_LOGD(TAG, "free data page_count 0x%08x", free_page_count);
-
-    int32_t data_len_remain = length;
-    uint32_t data_addr = src_addr;
-    while (data_len_remain > 0) {
-        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
-        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
-        uint32_t data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
-        data = (const uint8_t *) bootloader_mmap(data_addr, data_len);
-        if(!data) {
-            ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", data_addr, data_len);
-            bootloader_sha256_finish(handle, NULL);
-            return ESP_FAIL;
-        }
-        bootloader_sha256_data(handle, data, data_len);
-        bootloader_munmap(data);
-
-        data_addr += data_len;
-        data_len_remain -= data_len;
+    if (err != ESP_OK) {
+        return err;
     }
 
-    /* Done! Get the digest */
-    bootloader_sha256_finish(handle, digest);
-
     // Map the signature block
     sigblock = (const esp_secure_boot_sig_block_t *) bootloader_mmap(src_addr + length, sizeof(esp_secure_boot_sig_block_t));
     if(!sigblock) {
@@ -77,20 +67,27 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
         return ESP_FAIL;
     }
     // Verify the signature
-    esp_err_t err = esp_secure_boot_verify_signature_block(sigblock, digest);
+    err = esp_secure_boot_verify_ecdsa_signature_block(sigblock, digest, verified_digest);
     // Unmap
     bootloader_munmap(sigblock);
 
     return err;
 }
 
+#ifdef BOOTLOADER_BUILD
 esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest)
+{
+    uint8_t verified_digest[DIGEST_LEN] = { 0 };
+    return esp_secure_boot_verify_ecdsa_signature_block(sig_block, image_digest, verified_digest);
+}
+
+esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
 {
     ptrdiff_t keylen;
     bool is_valid;
 
     keylen = signature_verification_key_end - signature_verification_key_start;
-    if(keylen != SIGNATURE_VERIFICATION_KEYLEN) {
+    if (keylen != SIGNATURE_VERIFICATION_KEYLEN) {
         ESP_LOGE(TAG, "Embedded public verification key has wrong length %d", keylen);
         return ESP_FAIL;
     }
@@ -102,11 +99,88 @@ esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block
 
     ESP_LOGD(TAG, "Verifying secure boot signature");
 
-    is_valid = uECC_verify(signature_verification_key_start,
+    is_valid = uECC_verify_antifault(signature_verification_key_start,
                                 image_digest,
                                 DIGEST_LEN,
                                 sig_block->signature,
-                                uECC_secp256r1());
+                                uECC_secp256r1(),
+                                verified_digest);
     ESP_LOGD(TAG, "Verification result %d", is_valid);
     return is_valid ? ESP_OK : ESP_ERR_IMAGE_INVALID;
 }
+
+#else // BOOTLOADER_BUILD
+
+esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
+{
+#if !(defined(CONFIG_MBEDTLS_ECDSA_C) && defined(CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED))
+    ESP_LOGE(TAG, "Signature verification requires ECDSA & SECP256R1 curve enabled");
+    return ESP_ERR_NOT_SUPPORTED;
+#else
+    ptrdiff_t keylen;
+
+    /* Note: in IDF app image verification we don't add any fault injection resistance, boot-time checks only */
+    memset(verified_digest, 0, DIGEST_LEN);
+
+    keylen = signature_verification_key_end - signature_verification_key_start;
+    if (keylen != SIGNATURE_VERIFICATION_KEYLEN) {
+        ESP_LOGE(TAG, "Embedded public verification key has wrong length %d", keylen);
+        return ESP_FAIL;
+    }
+
+    if (sig_block->version != 0) {
+        ESP_LOGE(TAG, "image has invalid signature version field 0x%08x", sig_block->version);
+        return ESP_FAIL;
+    }
+
+    ESP_LOGD(TAG, "Verifying secure boot signature");
+
+    int ret;
+    mbedtls_mpi r, s;
+
+    mbedtls_mpi_init(&r);
+    mbedtls_mpi_init(&s);
+
+    /* Extract r and s components from RAW ECDSA signature of 64 bytes */
+#define ECDSA_INTEGER_LEN 32
+    ret = mbedtls_mpi_read_binary(&r, &sig_block->signature[0], ECDSA_INTEGER_LEN);
+    if (ret != 0) {
+        ESP_LOGE(TAG, "Failed mbedtls_mpi_read_binary(1), err:%d", ret);
+        return ESP_FAIL;
+    }
+
+    ret = mbedtls_mpi_read_binary(&s, &sig_block->signature[ECDSA_INTEGER_LEN], ECDSA_INTEGER_LEN);
+    if (ret != 0) {
+        ESP_LOGE(TAG, "Failed mbedtls_mpi_read_binary(2), err:%d", ret);
+        mbedtls_mpi_free(&r);
+        return ESP_FAIL;
+    }
+
+    /* Initialise ECDSA context */
+    mbedtls_ecdsa_context ecdsa_context;
+    mbedtls_ecdsa_init(&ecdsa_context);
+
+    mbedtls_ecp_group_load(&ecdsa_context.grp, MBEDTLS_ECP_DP_SECP256R1);
+    size_t plen = mbedtls_mpi_size(&ecdsa_context.grp.P);
+    if (keylen != 2 * plen) {
+        ESP_LOGE(TAG, "Incorrect ECDSA key length %d", keylen);
+        ret = ESP_FAIL;
+        goto cleanup;
+    }
+
+    /* Extract X and Y components from ECDSA public key */
+    MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&ecdsa_context.Q.X, signature_verification_key_start, plen));
+    MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&ecdsa_context.Q.Y, signature_verification_key_start + plen, plen));
+    MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&ecdsa_context.Q.Z, 1));
+
+    ret = mbedtls_ecdsa_verify(&ecdsa_context.grp, image_digest, DIGEST_LEN, &ecdsa_context.Q, &r, &s);
+    ESP_LOGD(TAG, "Verification result %d", ret);
+
+cleanup:
+    mbedtls_mpi_free(&r);
+    mbedtls_mpi_free(&s);
+    mbedtls_ecdsa_free(&ecdsa_context);
+    return ret == 0 ? ESP_OK : ESP_ERR_IMAGE_INVALID;
+#endif // CONFIG_MBEDTLS_ECDSA_C && CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED
+}
+#endif // BOOTLOADER_BUILD

components/bt/CMakeLists.txt

@@ -6,6 +6,8 @@ if(CONFIG_BT_ENABLED)
     if(CONFIG_BLUEDROID_ENABLED)
 
         list(APPEND COMPONENT_PRIV_INCLUDEDIRS
+            common/btc/include
+            common/include
             bluedroid/bta/include
             bluedroid/bta/ar/include
             bluedroid/bta/av/include
@@ -18,7 +20,6 @@ if(CONFIG_BT_ENABLED)
             bluedroid/bta/sys/include
             bluedroid/device/include
             bluedroid/hci/include
-            bluedroid/osi/include
             bluedroid/external/sbc/decoder/include
             bluedroid/external/sbc/encoder/include
             bluedroid/btc/profile/esp/blufi/include
@@ -38,11 +39,29 @@ if(CONFIG_BT_ENABLED)
             bluedroid/stack/a2dp/include
             bluedroid/stack/rfcomm/include
             bluedroid/stack/include
-            bluedroid/common/include)
+            bluedroid/common/include
+            common/btc/include
+            common/include)
 
-        list(APPEND COMPONENT_ADD_INCLUDEDIRS bluedroid/api/include/api)
+        list(APPEND COMPONENT_ADD_INCLUDEDIRS bluedroid/api/include/api
+                       common/osi/include)
 
-        list(APPEND COMPONENT_SRCS "bluedroid/api/esp_a2dp_api.c"
+        list(APPEND COMPONENT_SRCS "common/btc/core/btc_alarm.c"
+                   "common/btc/core/btc_manage.c"
+                   "common/btc/core/btc_task.c"
+                   "common/osi/alarm.c"
+                   "common/osi/allocator.c"
+                   "common/osi/buffer.c"
+                   "common/osi/config.c"
+                   "common/osi/fixed_queue.c"
+                   "common/osi/future.c"
+                   "common/osi/hash_functions.c"
+                   "common/osi/hash_map.c"
+                   "common/osi/list.c"
+                   "common/osi/mutex.c"
+                   "common/osi/osi.c"
+                   "common/osi/semaphore.c"
+                   "bluedroid/api/esp_a2dp_api.c"
                    "bluedroid/api/esp_avrc_api.c"
                    "bluedroid/api/esp_blufi_api.c"
                    "bluedroid/api/esp_bt_device.c"
@@ -109,18 +128,15 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/bta/sys/bta_sys_conn.c"
                    "bluedroid/bta/sys/bta_sys_main.c"
                    "bluedroid/bta/sys/utl.c"
-                   "bluedroid/btc/core/btc_alarm.c"
                    "bluedroid/btc/core/btc_ble_storage.c"
                    "bluedroid/btc/core/btc_config.c"
                    "bluedroid/btc/core/btc_dev.c"
                    "bluedroid/btc/core/btc_dm.c"
                    "bluedroid/btc/core/btc_main.c"
-                   "bluedroid/btc/core/btc_manage.c"
                    "bluedroid/btc/core/btc_profile_queue.c"
                    "bluedroid/btc/core/btc_sec.c"
                    "bluedroid/btc/core/btc_sm.c"
                    "bluedroid/btc/core/btc_storage.c"
-                   "bluedroid/btc/core/btc_task.c"
                    "bluedroid/btc/core/btc_util.c"
                    "bluedroid/btc/profile/esp/blufi/blufi_prf.c"
                    "bluedroid/btc/profile/esp/blufi/blufi_protocol.c"
@@ -173,18 +189,6 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/hci/packet_fragmenter.c"
                    "bluedroid/main/bte_init.c"
                    "bluedroid/main/bte_main.c"
-                   "bluedroid/osi/alarm.c"
-                   "bluedroid/osi/allocator.c"
-                   "bluedroid/osi/buffer.c"
-                   "bluedroid/osi/config.c"
-                   "bluedroid/osi/fixed_queue.c"
-                   "bluedroid/osi/future.c"
-                   "bluedroid/osi/hash_functions.c"
-                   "bluedroid/osi/hash_map.c"
-                   "bluedroid/osi/list.c"
-                   "bluedroid/osi/mutex.c"
-                   "bluedroid/osi/osi.c"
-                   "bluedroid/osi/semaphore.c"
                    "bluedroid/stack/a2dp/a2d_api.c"
                    "bluedroid/stack/a2dp/a2d_sbc.c"
                    "bluedroid/stack/avct/avct_api.c"
@@ -279,6 +283,139 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/stack/smp/smp_l2c.c"
                    "bluedroid/stack/smp/smp_main.c"
                    "bluedroid/stack/smp/smp_utils.c")
+
+        if(CONFIG_BLE_MESH)
+            list(APPEND COMPONENT_SRCS "esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c")
+        endif()
+
+    endif()
+
+    if(CONFIG_BLE_MESH)
+        list(APPEND COMPONENT_ADD_INCLUDEDIRS
+                    "esp_ble_mesh/mesh_common/include"
+                    "esp_ble_mesh/mesh_common/tinycrypt/include"
+                    "esp_ble_mesh/mesh_core"
+                    "esp_ble_mesh/mesh_core/include"
+                    "esp_ble_mesh/mesh_core/storage"
+                    "esp_ble_mesh/btc/include"
+                    "esp_ble_mesh/mesh_models/common/include"
+                    "esp_ble_mesh/mesh_models/client/include"
+                    "esp_ble_mesh/mesh_models/server/include"
+                    "esp_ble_mesh/api/core/include"
+                    "esp_ble_mesh/api/models/include"
+                    "esp_ble_mesh/api")
+
+        list(APPEND COMPONENT_SRCS
+                    "esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_common_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c"
+                    "esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c"
+                    "esp_ble_mesh/api/models/esp_ble_mesh_config_model_api.c"
+                    "esp_ble_mesh/api/models/esp_ble_mesh_generic_model_api.c"
+                    "esp_ble_mesh/api/models/esp_ble_mesh_health_model_api.c"
+                    "esp_ble_mesh/api/models/esp_ble_mesh_lighting_model_api.c"
+                    "esp_ble_mesh/api/models/esp_ble_mesh_sensor_model_api.c"
+                    "esp_ble_mesh/api/models/esp_ble_mesh_time_scene_model_api.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_ble.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_config_model.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_generic_model.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_health_model.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_lighting_model.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_prov.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_sensor_model.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_time_scene_model.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/aes_decrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/aes_encrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/cbc_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ccm_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/cmac_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ctr_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ctr_prng.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_dh.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_dsa.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_platform_specific.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/hmac_prng.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/hmac.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/sha256.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/utils.c"
+                    "esp_ble_mesh/mesh_common/mesh_atomic.c"
+                    "esp_ble_mesh/mesh_common/mesh_buf.c"
+                    "esp_ble_mesh/mesh_common/mesh_common.c"
+                    "esp_ble_mesh/mesh_common/mesh_kernel.c"
+                    "esp_ble_mesh/mesh_common/mesh_mutex.c"
+                    "esp_ble_mesh/mesh_common/mesh_timer.c"
+                    "esp_ble_mesh/mesh_common/mesh_util.c"
+                    "esp_ble_mesh/mesh_core/storage/settings_nvs.c"
+                    "esp_ble_mesh/mesh_core/access.c"
+                    "esp_ble_mesh/mesh_core/adv.c"
+                    "esp_ble_mesh/mesh_core/beacon.c"
+                    "esp_ble_mesh/mesh_core/cfg_cli.c"
+                    "esp_ble_mesh/mesh_core/cfg_srv.c"
+                    "esp_ble_mesh/mesh_core/crypto.c"
+                    "esp_ble_mesh/mesh_core/fast_prov.c"
+                    "esp_ble_mesh/mesh_core/friend.c"
+                    "esp_ble_mesh/mesh_core/health_cli.c"
+                    "esp_ble_mesh/mesh_core/health_srv.c"
+                    "esp_ble_mesh/mesh_core/local_operation.c"
+                    "esp_ble_mesh/mesh_core/lpn.c"
+                    "esp_ble_mesh/mesh_core/main.c"
+                    "esp_ble_mesh/mesh_core/net.c"
+                    "esp_ble_mesh/mesh_core/prov.c"
+                    "esp_ble_mesh/mesh_core/provisioner_main.c"
+                    "esp_ble_mesh/mesh_core/provisioner_prov.c"
+                    "esp_ble_mesh/mesh_core/proxy_client.c"
+                    "esp_ble_mesh/mesh_core/proxy_server.c"
+                    "esp_ble_mesh/mesh_core/settings_uid.c"
+                    "esp_ble_mesh/mesh_core/settings.c"
+                    "esp_ble_mesh/mesh_core/scan.c"
+                    "esp_ble_mesh/mesh_core/test.c"
+                    "esp_ble_mesh/mesh_core/transport.c"
+                    "esp_ble_mesh/mesh_models/common/device_property.c"
+                    "esp_ble_mesh/mesh_models/client/client_common.c"
+                    "esp_ble_mesh/mesh_models/client/generic_client.c"
+                    "esp_ble_mesh/mesh_models/client/lighting_client.c"
+                    "esp_ble_mesh/mesh_models/client/sensor_client.c"
+                    "esp_ble_mesh/mesh_models/client/time_scene_client.c"
+                    "esp_ble_mesh/mesh_models/server/generic_server.c"
+                    "esp_ble_mesh/mesh_models/server/lighting_server.c"
+                    "esp_ble_mesh/mesh_models/server/sensor_server.c"
+                    "esp_ble_mesh/mesh_models/server/server_common.c"
+                    "esp_ble_mesh/mesh_models/server/state_binding.c"
+                    "esp_ble_mesh/mesh_models/server/state_transition.c"
+                    "esp_ble_mesh/mesh_models/server/time_scene_server.c")
+    endif()
+
+    if(CONFIG_NIMBLE_ENABLED)
+
+        if (CONFIG_BLE_MESH)
+            list(APPEND COMPONENT_PRIV_INCLUDEDIRS
+                common/btc/include
+                common/include)
+
+        list(APPEND COMPONENT_ADD_INCLUDEDIRS common/osi/include)
+
+            list(APPEND COMPONENT_SRCS "esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c"
+                   "common/btc/core/btc_alarm.c"
+                   "common/btc/core/btc_manage.c"
+                   "common/btc/core/btc_task.c"
+                   "common/osi/alarm.c"
+                   "common/osi/allocator.c"
+                   "common/osi/buffer.c"
+                   "common/osi/config.c"
+                   "common/osi/fixed_queue.c"
+                   "common/osi/future.c"
+                   "common/osi/hash_functions.c"
+                   "common/osi/hash_map.c"
+                   "common/osi/list.c"
+                   "common/osi/mutex.c"
+                   "common/osi/osi.c"
+                   "common/osi/semaphore.c")
+        endif()
+
     endif()
 endif()
 

components/bt/bluedroid/api/esp_a2dp_api.c

@@ -29,6 +29,10 @@ esp_err_t esp_a2d_sink_init(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_init || g_a2dp_sink_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     btc_msg_t msg;
 
     msg.sig = BTC_SIG_API_CALL;
@@ -46,6 +50,10 @@ esp_err_t esp_a2d_sink_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_sink_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     btc_msg_t msg;
 
     msg.sig = BTC_SIG_API_CALL;
@@ -63,6 +71,10 @@ esp_err_t esp_a2d_sink_register_data_callback(esp_a2d_sink_data_cb_t callback)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_sink_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_A2DP;
@@ -83,6 +95,10 @@ esp_err_t esp_a2d_sink_connect(esp_bd_addr_t remote_bda)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_sink_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     bt_status_t stat;
     btc_av_args_t arg;
     btc_msg_t msg;
@@ -105,15 +121,21 @@ esp_err_t esp_a2d_sink_disconnect(esp_bd_addr_t remote_bda)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_sink_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     bt_status_t stat;
     btc_msg_t msg;
+    btc_av_args_t arg;
 
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_A2DP;
     msg.act = BTC_AV_SINK_API_DISCONNECT_EVT;
 
     /* Switch to BTC context */
-    stat = btc_transfer_context(&msg, NULL, 0, NULL);
+    memcpy(&(arg.disconn), remote_bda, sizeof(bt_bdaddr_t));
+    stat = btc_transfer_context(&msg, &arg, sizeof(btc_av_args_t), NULL);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
@@ -125,6 +147,10 @@ esp_err_t esp_a2d_register_callback(esp_a2d_cb_t callback)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_sink_ongoing_deinit || g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     if (callback == NULL) {
         return ESP_FAIL;
     }
@@ -139,6 +165,10 @@ esp_err_t esp_a2d_media_ctrl(esp_a2d_media_ctrl_t ctrl)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_sink_ongoing_deinit || g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     bt_status_t stat;
     btc_av_args_t arg;
     btc_msg_t msg;
@@ -162,6 +192,10 @@ esp_err_t esp_a2d_source_init(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_init || g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     btc_msg_t msg;
 
     msg.sig = BTC_SIG_API_CALL;
@@ -179,6 +213,10 @@ esp_err_t esp_a2d_source_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     btc_msg_t msg;
 
     msg.sig = BTC_SIG_API_CALL;
@@ -196,6 +234,10 @@ esp_err_t esp_a2d_source_connect(esp_bd_addr_t remote_bda)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     bt_status_t stat;
     btc_av_args_t arg;
     btc_msg_t msg;
@@ -218,15 +260,23 @@ esp_err_t esp_a2d_source_disconnect(esp_bd_addr_t remote_bda)
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_on_deinit || g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     bt_status_t stat;
+    btc_av_args_t arg;
     btc_msg_t msg;
 
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_A2DP;
     msg.act = BTC_AV_SRC_API_DISCONNECT_EVT;
 
+    memset(&arg, 0, sizeof(btc_av_args_t));
+
     /* Switch to BTC context */
-    stat = btc_transfer_context(&msg, NULL, 0, NULL);
+    memcpy(&(arg.src_disconn), remote_bda, sizeof(bt_bdaddr_t));
+    stat = btc_transfer_context(&msg, &arg, sizeof(btc_av_args_t), NULL);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
@@ -236,6 +286,10 @@ esp_err_t esp_a2d_source_register_data_callback(esp_a2d_source_data_cb_t callbac
         return ESP_ERR_INVALID_STATE;
     }
 
+    if (g_a2dp_source_ongoing_deinit) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_A2DP;

components/bt/bluedroid/api/esp_blufi_api.c

@@ -23,7 +23,7 @@
 #include "osi/future.h"
 #include "btc_gatts.h"
 #include "btc_gatt_util.h"
-
+#if (BLUFI_INCLUDED == TRUE)
 esp_err_t esp_blufi_register_callbacks(esp_blufi_callbacks_t *callbacks)
 {
     if (esp_bluedroid_get_status() == ESP_BLUEDROID_STATUS_UNINITIALIZED) {
@@ -162,3 +162,4 @@ esp_err_t esp_blufi_send_custom_data(uint8_t *data, uint32_t data_len)
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif  ///BLUFI_INCLUDED == TRUE

components/bt/bluedroid/api/esp_bt_device.c

@@ -30,7 +30,7 @@ const uint8_t *esp_bt_dev_get_address(void)
 
 esp_err_t esp_bt_dev_set_device_name(const char *name)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_dev_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {

components/bt/bluedroid/api/esp_bt_main.c

@@ -117,6 +117,7 @@ esp_err_t esp_bluedroid_init(void)
 {
     btc_msg_t msg;
     future_t **future_p;
+    bt_status_t ret;
 
     if (esp_bt_controller_get_status() != ESP_BT_CONTROLLER_STATUS_ENABLED) {
         LOG_ERROR("Controller not initialised\n");
@@ -135,23 +136,30 @@ esp_err_t esp_bluedroid_init(void)
     future_p = btc_main_get_future_p(BTC_MAIN_INIT_FUTURE);
     *future_p = future_new();
     if (*future_p == NULL) {
-        LOG_ERROR("Bluedroid initialise failed\n");
+        LOG_ERROR("Bluedroid Initialize Fail!");
         return ESP_ERR_NO_MEM;
     }
 
-    btc_init();
+    /* 
+    * BTC Init
+    */
+    ret = btc_init();
+    if (ret != BT_STATUS_SUCCESS) {
+        LOG_ERROR("Bluedroid Initialize Fail");
+        return ESP_FAIL;
+    }
 
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_MAIN_INIT;
     msg.act = BTC_MAIN_ACT_INIT;
 
     if (btc_transfer_context(&msg, NULL, 0, NULL) != BT_STATUS_SUCCESS) {
-        LOG_ERROR("Bluedroid initialise failed\n");
+        LOG_ERROR("Bluedroid Initialize Fail!");
         return ESP_FAIL;
     }
 
     if (future_await(*future_p) == FUTURE_FAIL) {
-        LOG_ERROR("Bluedroid initialise failed\n");
+        LOG_ERROR("Bluedroid Initialize Fail!");
         return ESP_FAIL;
     }
 

components/bt/bluedroid/api/esp_gap_ble_api.c

@@ -33,7 +33,7 @@ esp_err_t esp_ble_gap_register_callback(esp_gap_ble_cb_t callback)
 
 esp_err_t esp_ble_gap_config_adv_data(esp_ble_adv_data_t *adv_data)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -58,7 +58,7 @@ esp_err_t esp_ble_gap_config_adv_data(esp_ble_adv_data_t *adv_data)
 
 esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -77,7 +77,7 @@ esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params)
 
 esp_err_t esp_ble_gap_start_scanning(uint32_t duration)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -93,7 +93,7 @@ esp_err_t esp_ble_gap_start_scanning(uint32_t duration)
 
 esp_err_t esp_ble_gap_stop_scanning(void)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -105,7 +105,7 @@ esp_err_t esp_ble_gap_stop_scanning(void)
 
 esp_err_t esp_ble_gap_start_advertising(esp_ble_adv_params_t *adv_params)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -120,7 +120,7 @@ esp_err_t esp_ble_gap_start_advertising(esp_ble_adv_params_t *adv_params)
 
 esp_err_t esp_ble_gap_stop_advertising(void)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -134,22 +134,37 @@ esp_err_t esp_ble_gap_stop_advertising(void)
 
 esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+    if(!params) {
+        LOG_ERROR("%s,params is NULL", __func__);
+        return ESP_FAIL;
+    }
 
-    msg.sig = BTC_SIG_API_CALL;
-    msg.pid = BTC_PID_GAP_BLE;
-    msg.act = BTC_GAP_BLE_ACT_UPDATE_CONN_PARAM;
-    memcpy(&arg.conn_update_params.conn_params, params, sizeof(esp_ble_conn_update_params_t));
+    if (ESP_BLE_IS_VALID_PARAM(params->min_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+        ESP_BLE_IS_VALID_PARAM(params->max_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+        ESP_BLE_IS_VALID_PARAM(params->timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+        (params->latency <= ESP_BLE_CONN_LATENCY_MAX || params->latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+        ((params->timeout * 10) >= ((1 + params->latency) * ((params->max_int * 5) >> 1))) && params->min_int <= params->max_int) {
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+        msg.sig = BTC_SIG_API_CALL;
+        msg.pid = BTC_PID_GAP_BLE;
+        msg.act = BTC_GAP_BLE_ACT_UPDATE_CONN_PARAM;
+        memcpy(&arg.conn_update_params.conn_params, params, sizeof(esp_ble_conn_update_params_t));
+
+        return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    } else {
+        LOG_ERROR("%s,invalid connection params:min_int = %d, max_int = %d, latency = %d, timeout = %d",\
+                            __func__, params->min_int, params->max_int, params->latency, params->timeout);
+        return ESP_FAIL;
+    }
 }
 
 esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_data_length)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -166,7 +181,7 @@ esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_
 
 esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -181,7 +196,7 @@ esp_err_t esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr)
 
 esp_err_t esp_ble_gap_clear_rand_addr(void)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
@@ -194,7 +209,7 @@ esp_err_t esp_ble_gap_clear_rand_addr(void)
 
 esp_err_t esp_ble_gap_config_local_privacy (bool privacy_enable)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -210,7 +225,7 @@ esp_err_t esp_ble_gap_config_local_privacy (bool privacy_enable)
 esp_err_t esp_ble_gap_config_local_icon (uint16_t icon)
 {
     esp_err_t ret;
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -289,7 +304,7 @@ esp_err_t esp_ble_gap_config_local_icon (uint16_t icon)
 
 esp_err_t esp_ble_gap_update_whitelist(bool add_remove, esp_bd_addr_t remote_bda)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -322,7 +337,7 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
                                                                  uint16_t min_conn_int, uint16_t max_conn_int,
                                                                  uint16_t slave_latency, uint16_t supervision_tout)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -390,7 +405,7 @@ uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *len
 
 esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_len)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -412,7 +427,7 @@ esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_l
 
 esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -429,7 +444,7 @@ esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr)
 
 esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_data_len)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -451,7 +466,7 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d
 
 esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -475,7 +490,7 @@ esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_ex
 
 esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -499,7 +514,7 @@ esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate
 
 esp_err_t esp_ble_gap_clean_duplicate_scan_exceptional_list(esp_duplicate_scan_exceptional_list_type_t list_type)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
@@ -537,7 +552,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
         }
     }
 
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -555,7 +570,7 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
 
 esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_act)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -572,7 +587,7 @@ esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_ac
 
 esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr, bool accept)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -590,7 +605,7 @@ esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr, bool accept)
 
 esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t passkey)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -608,7 +623,7 @@ esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t pas
 
 esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -625,7 +640,7 @@ esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept)
 
 esp_err_t esp_ble_remove_bond_device(esp_bd_addr_t bd_addr)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GAP_BLE;
@@ -672,7 +687,7 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
         return ESP_ERR_INVALID_ARG;
     }
 
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -692,7 +707,7 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
 
 esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gap_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -705,6 +720,27 @@ esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device)
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_gap_ble_set_authorization(esp_bd_addr_t bd_addr, bool authorize)
+{
+    if (!bd_addr) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    if (BTM_Ble_Authorization(bd_addr, authorize)) {
+        return ESP_OK;
+    }
+    return ESP_FAIL;
+}
+esp_err_t esp_ble_get_current_conn_params(esp_bd_addr_t bd_addr, esp_gap_conn_params_t *conn_params)
+{
+    if(!bd_addr || !conn_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    if(BTM_GetCurrentConnParams(bd_addr, &conn_params->interval, &conn_params->latency, &conn_params->timeout)) {
+        return ESP_OK;
+    }
+    return ESP_ERR_NOT_FOUND;
+}
+
 
 
 

components/bt/bluedroid/api/esp_gap_bt_api.c

@@ -17,6 +17,7 @@
 #include "esp_bt_main.h"
 #include "esp_gap_bt_api.h"
 #include "common/bt_trace.h"
+#include "bta/bta_api.h"
 #include "btc/btc_manage.h"
 #include "btc_gap_bt.h"
 #include "btc/btc_storage.h"
@@ -212,7 +213,7 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr)
 int esp_bt_gap_get_bond_device_num(void)
 {
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
-        return ESP_FAIL;
+        return ESP_ERR_INVALID_STATE;
     }
     return btc_storage_get_num_bt_bond_devices();
 }
@@ -220,7 +221,6 @@ int esp_bt_gap_get_bond_device_num(void)
 esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
 {
     int ret;
-    int dev_num_total;
 
     if (dev_num == NULL || dev_list == NULL) {
         return ESP_ERR_INVALID_ARG;
@@ -230,12 +230,7 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
         return ESP_ERR_INVALID_STATE;
     }
 
-    dev_num_total = btc_storage_get_num_bt_bond_devices();
-    if (*dev_num > dev_num_total) {
-        *dev_num = dev_num_total;
-    }
-
-    ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, *dev_num);
+    ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, dev_num);
 
     return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

components/bt/bluedroid/api/esp_gatt_common_api.c

@@ -31,7 +31,7 @@
  */
 esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatt_com_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -46,4 +46,37 @@ esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)
     arg.set_mtu.mtu = mtu;
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatt_com_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
-}
+}
+
+#if (BLE_INCLUDED == TRUE)
+extern uint16_t L2CA_GetFreePktBufferNum_LE(void);
+/**
+ * @brief           This function is called to get currently sendable packets number on controller,
+ *                  the function is called only in BLE running core and single connection now.
+ *
+ * @return
+ *                  sendable packets number on controller
+ *
+ */
+
+uint16_t esp_ble_get_sendable_packets_num (void)
+{
+    return L2CA_GetFreePktBufferNum_LE();
+}
+
+/**
+ * @brief           This function is used to query the number of available buffers for the current connection.
+ *                  When you need to query the current available buffer number, it is recommended to use this API.
+ * @param[in]       conn_id: current connection id.
+ * 
+ * @return
+ *                  Number of available buffers for the current connection
+ *
+ */
+extern UINT16 L2CA_GetCurFreePktBufferNum_LE(UINT16 conn_id);
+uint16_t esp_ble_get_cur_sendable_packets_num (uint16_t connid)
+{
+    return L2CA_GetCurFreePktBufferNum_LE(connid);
+}
+
+#endif

components/bt/bluedroid/api/esp_gattc_api.c

@@ -38,7 +38,7 @@ esp_err_t esp_ble_gattc_register_callback(esp_gattc_cb_t callback)
 
 esp_err_t esp_ble_gattc_app_register(uint16_t app_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -57,7 +57,7 @@ esp_err_t esp_ble_gattc_app_register(uint16_t app_id)
 
 esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -72,7 +72,7 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 
 esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -90,7 +90,7 @@ esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, e
 
 esp_err_t esp_ble_gattc_close (esp_gatt_if_t gattc_if, uint16_t conn_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -105,7 +105,7 @@ esp_err_t esp_ble_gattc_close (esp_gatt_if_t gattc_if, uint16_t conn_id)
 
 esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -120,7 +120,7 @@ esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id)
 
 esp_err_t esp_ble_gattc_search_service(esp_gatt_if_t gattc_if, uint16_t conn_id, esp_bt_uuid_t *filter_uuid)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -330,7 +330,7 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
                                    uint16_t conn_id, uint16_t handle,
                                    esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -350,11 +350,44 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
+                                      uint16_t conn_id,
+                                      uint16_t start_handle,
+                                      uint16_t end_handle,
+                                      esp_bt_uuid_t *uuid,
+                                      esp_gatt_auth_req_t auth_req)
+{
+    btc_msg_t msg = {0};
+    btc_ble_gattc_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    if (uuid == NULL) {
+        return ESP_GATT_ILLEGAL_PARAMETER;
+    }
+
+    if (L2CA_CheckIsCongest(L2CAP_ATT_CID, conn_id)) {
+        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        return ESP_FAIL;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GATTC;
+    msg.act = BTC_GATTC_ACT_READ_BY_TYPE;
+    arg.read_by_type.conn_id = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
+    arg.read_by_type.s_handle = start_handle;
+    arg.read_by_type.e_handle = end_handle;
+    arg.read_by_type.auth_req = auth_req;
+    memcpy(&(arg.read_by_type.uuid), uuid, sizeof(esp_bt_uuid_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
                                       uint16_t conn_id, esp_gattc_multi_t *read_multi,
                                       esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -385,7 +418,7 @@ esp_err_t esp_ble_gattc_read_char_descr (esp_gatt_if_t gattc_if,
                                          uint16_t conn_id, uint16_t handle,
                                          esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -412,7 +445,7 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if,
                                    esp_gatt_write_type_t write_type,
                                    esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -431,6 +464,9 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if,
     arg.write_char.value = value;
     arg.write_char.write_type = write_type;
     arg.write_char.auth_req = auth_req;
+    if(write_type == ESP_GATT_WRITE_TYPE_NO_RSP){
+        l2ble_update_att_acl_pkt_num(L2CA_ADD_BTC_NUM, NULL);
+    }
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), btc_gattc_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
@@ -442,7 +478,7 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if,
                                           esp_gatt_write_type_t write_type,
                                           esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -462,6 +498,10 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if,
     arg.write_descr.write_type = write_type;
     arg.write_descr.auth_req = auth_req;
 
+    if(write_type == ESP_GATT_WRITE_TYPE_NO_RSP){
+        l2ble_update_att_acl_pkt_num(L2CA_ADD_BTC_NUM, NULL);
+    }
+    
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), btc_gattc_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -472,7 +512,7 @@ esp_err_t esp_ble_gattc_prepare_write(esp_gatt_if_t gattc_if,
                                       uint8_t *value,
                                       esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -502,7 +542,7 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if,
                                                  uint8_t *value,
                                                  esp_gatt_auth_req_t auth_req)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -527,7 +567,7 @@ esp_err_t esp_ble_gattc_prepare_write_char_descr(esp_gatt_if_t gattc_if,
 
 esp_err_t esp_ble_gattc_execute_write (esp_gatt_if_t gattc_if, uint16_t conn_id, bool is_execute)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -544,7 +584,7 @@ esp_err_t esp_ble_gattc_execute_write (esp_gatt_if_t gattc_if, uint16_t conn_id,
 esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if,
                                              esp_bd_addr_t server_bda, uint16_t handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -562,7 +602,7 @@ esp_err_t esp_ble_gattc_register_for_notify (esp_gatt_if_t gattc_if,
 esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if,
                                                esp_bd_addr_t server_bda, uint16_t handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -578,7 +618,7 @@ esp_err_t esp_ble_gattc_unregister_for_notify (esp_gatt_if_t gattc_if,
 
 esp_err_t esp_ble_gattc_cache_refresh(esp_bd_addr_t remote_bda)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -593,7 +633,7 @@ esp_err_t esp_ble_gattc_cache_refresh(esp_bd_addr_t remote_bda)
 
 esp_err_t esp_ble_gattc_cache_assoc(esp_gatt_if_t gattc_if, esp_bd_addr_t src_addr, esp_bd_addr_t assoc_addr, bool is_assoc)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -611,7 +651,7 @@ esp_err_t esp_ble_gattc_cache_assoc(esp_gatt_if_t gattc_if, esp_bd_addr_t src_ad
 
 esp_err_t esp_ble_gattc_cache_get_addr_list(esp_gatt_if_t gattc_if)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

components/bt/bluedroid/api/esp_gatts_api.c

@@ -38,7 +38,7 @@ esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback)
 
 esp_err_t esp_ble_gatts_app_register(uint16_t app_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -59,7 +59,7 @@ esp_err_t esp_ble_gatts_app_register(uint16_t app_id)
 
 esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -75,7 +75,7 @@ esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if)
 esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
                                        esp_gatt_srvc_id_t *service_id, uint16_t num_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -95,7 +95,7 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
                                         uint8_t max_nb_attr,
                                         uint8_t srvc_inst_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -115,7 +115,7 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db
 
 esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t included_service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -134,7 +134,7 @@ esp_err_t esp_ble_gatts_add_char(uint16_t service_handle,  esp_bt_uuid_t  *char_
                                  esp_gatt_perm_t perm, esp_gatt_char_prop_t property, esp_attr_value_t *char_val,
                                  esp_attr_control_t *control)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
     esp_err_t status;
 
@@ -173,7 +173,7 @@ esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
                                         esp_gatt_perm_t perm, esp_attr_value_t *char_descr_val,
                                         esp_attr_control_t *control)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
     esp_err_t status;
 
@@ -208,7 +208,7 @@ esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
 
 esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -223,7 +223,7 @@ esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle)
 
 esp_err_t esp_ble_gatts_start_service(uint16_t service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -238,7 +238,7 @@ esp_err_t esp_ble_gatts_start_service(uint16_t service_handle)
 
 esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -255,7 +255,7 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle)
 esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle,
                                       uint16_t value_len, uint8_t *value, bool need_confirm)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -274,6 +274,9 @@ esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id,
     arg.send_ind.value_len = value_len;
     arg.send_ind.value = value;
 
+    if(need_confirm == false){
+        l2ble_update_att_acl_pkt_num(L2CA_ADD_BTC_NUM, NULL);
+    }
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t),
                                  btc_gatts_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
@@ -281,7 +284,7 @@ esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id,
 esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id, uint32_t trans_id,
                                       esp_gatt_status_t status, esp_gatt_rsp_t *rsp)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -300,7 +303,7 @@ esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id,
 
 esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, const uint8_t *value)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -330,7 +333,7 @@ esp_gatt_status_t esp_ble_gatts_get_attr_value(uint16_t attr_handle, uint16_t *l
 
 esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, bool is_direct)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -348,7 +351,7 @@ esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, b
 
 esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -364,7 +367,7 @@ esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
 
 esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_ble_gatts_args_t arg;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

components/bt/bluedroid/api/esp_spp_api.c

@@ -95,6 +95,10 @@ esp_err_t esp_spp_connect(esp_spp_sec_t sec_mask,
     btc_spp_args_t arg;
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (sec_mask != ESP_SPP_SEC_NONE && sec_mask != ESP_SPP_SEC_AUTHORIZE && sec_mask != ESP_SPP_SEC_AUTHENTICATE) {
+        LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only\n");
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_SPP;
     msg.act = BTC_SPP_ACT_CONNECT;
@@ -129,10 +133,15 @@ esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
     btc_spp_args_t arg;
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (strlen(name) > ESP_SPP_SERVER_NAME_MAX) {
+    if (name == NULL || strlen(name) > ESP_SPP_SERVER_NAME_MAX) {
+        LOG_ERROR("Invalid server name!\n");
         return ESP_ERR_INVALID_ARG;
     }
 
+    if (sec_mask != ESP_SPP_SEC_NONE && sec_mask != ESP_SPP_SEC_AUTHORIZE && sec_mask != ESP_SPP_SEC_AUTHENTICATE) {
+        LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only\n");
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_SPP;
     msg.act = BTC_SPP_ACT_START_SRV;
@@ -146,6 +155,38 @@ esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
     return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_spp_stop_srv(void)
+{
+    btc_msg_t msg;
+    btc_spp_args_t arg;
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_SPP;
+    msg.act = BTC_SPP_ACT_STOP_SRV;
+    arg.stop_srv.scn = BTC_SPP_INVALID_SCN;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_spp_stop_srv_scn(uint8_t scn)
+{
+    btc_msg_t msg;
+    btc_spp_args_t arg;
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    if ((scn == 0) || (scn >= PORT_MAX_RFC_PORTS)) {
+        LOG_ERROR("Invalid SCN!\n");
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_SPP;
+    msg.act = BTC_SPP_ACT_STOP_SRV;
+    arg.stop_srv.scn = scn;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
 
 esp_err_t esp_spp_write(uint32_t handle, int len, uint8_t *p_data)
 {

components/bt/bluedroid/api/include/api/esp_a2dp_api.h

@@ -46,6 +46,12 @@ typedef struct {
     } cie;                                     /*!< A2DP codec information element */
 } __attribute__((packed)) esp_a2d_mcc_t;
 
+/// Bluetooth A2DP Initiation states
+typedef enum {
+    ESP_A2D_DEINIT_SUCCESS = 0,                /*!< A2DP profile deinit successful event */
+    ESP_A2D_INIT_SUCCESS                       /*!< A2DP profile init successful event */
+} esp_a2d_init_state_t;
+
 /// Bluetooth A2DP connection states
 typedef enum {
     ESP_A2D_CONNECTION_STATE_DISCONNECTED = 0, /*!< connection released  */
@@ -76,7 +82,7 @@ typedef enum {
 
 /// A2DP media control commands
 typedef enum {
-    ESP_A2D_MEDIA_CTRL_NONE = 0,               /*!< dummy command */
+    ESP_A2D_MEDIA_CTRL_NONE = 0,               /*!< Not for application use, use inside stack only. */
     ESP_A2D_MEDIA_CTRL_CHECK_SRC_RDY,          /*!< check whether AVDTP is connected, only used in A2DP source */
     ESP_A2D_MEDIA_CTRL_START,                  /*!< command to set up media transmission channel */
     ESP_A2D_MEDIA_CTRL_STOP,                   /*!< command to stop media transmission */
@@ -89,6 +95,7 @@ typedef enum {
     ESP_A2D_AUDIO_STATE_EVT,                   /*!< audio stream transmission state changed event */
     ESP_A2D_AUDIO_CFG_EVT,                     /*!< audio codec is configured, only used for A2DP SINK */
     ESP_A2D_MEDIA_CTRL_ACK_EVT,                /*!< acknowledge event in response to media control commands */
+    ESP_A2D_PROF_STATE_EVT,                    /*!< indicate a2dp deinit complete */
 } esp_a2d_cb_event_t;
 
 /// A2DP state callback parameters
@@ -125,6 +132,13 @@ typedef union {
         esp_a2d_media_ctrl_t cmd;              /*!< media control commands to acknowledge */
         esp_a2d_media_ctrl_ack_t status;       /*!< acknowledgement to media control commands */
     } media_ctrl_stat;                         /*!< status in acknowledgement to media control commands */
+
+    /**
+     * @brief ESP_A2D_PROF_STATE_EVT
+     */
+    struct a2d_prof_stat_param {
+        esp_a2d_init_state_t init_state;        /*!< a2dp profile state param */
+    } a2d_prof_stat;                            /*!< status to indicate a2d prof init or deinit */
 } esp_a2d_cb_param_t;
 
 /**
@@ -193,7 +207,8 @@ esp_err_t esp_a2d_sink_register_data_callback(esp_a2d_sink_data_cb_t callback);
 /**
  *
  * @brief           Initialize the bluetooth A2DP sink module. This function should be called
- *                  after esp_bluedroid_enable() completes successfully
+ *                  after esp_bluedroid_enable() completes successfully, and ESP_A2D_PROF_STATE_EVT
+ *                  with ESP_A2D_INIT_SUCCESS will reported to the APP layer
  *
  * @return
  *                  - ESP_OK: if the initialization request is sent successfully
@@ -207,7 +222,8 @@ esp_err_t esp_a2d_sink_init(void);
 /**
  *
  * @brief           De-initialize for A2DP sink module. This function
- *                  should be called only after esp_bluedroid_enable() completes successfully
+ *                  should be called only after esp_bluedroid_enable() completes successfully,
+ *                  and ESP_A2D_PROF_STATE_EVT with ESP_A2D_DEINIT_SUCCESS will reported to APP layer.
  *
  * @return
  *                  - ESP_OK: success
@@ -264,7 +280,8 @@ esp_err_t esp_a2d_media_ctrl(esp_a2d_media_ctrl_t ctrl);
 /**
  *
  * @brief           Initialize the bluetooth A2DP source module. This function should be called
- *                  after esp_bluedroid_enable() completes successfully
+ *                  after esp_bluedroid_enable() completes successfully, and ESP_A2D_PROF_STATE_EVT
+ *                  with ESP_A2D_INIT_SUCCESS will reported to the APP layer
  *
  * @return
  *                  - ESP_OK: if the initialization request is sent successfully
@@ -278,7 +295,8 @@ esp_err_t esp_a2d_source_init(void);
 /**
  *
  * @brief           De-initialize for A2DP source module. This function
- *                  should be called only after esp_bluedroid_enable() completes successfully
+ *                  should be called only after esp_bluedroid_enable() completes successfully,
+ *                  and ESP_A2D_PROF_STATE_EVT with ESP_A2D_DEINIT_SUCCESS will reported to APP layer.
  *
  * @return
  *                  - ESP_OK: success

components/bt/bluedroid/api/include/api/esp_blufi_api.h

@@ -83,6 +83,7 @@ typedef enum {
     ESP_BLUFI_DH_PARAM_ERROR,
     ESP_BLUFI_READ_PARAM_ERROR,
     ESP_BLUFI_MAKE_PUBLIC_ERROR,
+    ESP_BLUFI_DATA_FORMAT_ERROR,
 } esp_blufi_error_state_t;
 
 /**
@@ -300,6 +301,7 @@ typedef void (* esp_blufi_event_cb_t)(esp_blufi_cb_event_t event, esp_blufi_cb_p
  * @param len  : length of data from phone
  * @param output_data : data want to send to phone
  * @param output_len : length of data want to send to phone
+ * @param need_free : output reporting if memory needs to be freed or not *
  */
 typedef void (*esp_blufi_negotiate_data_handler_t)(uint8_t *data, int len, uint8_t **output_data, int *output_len, bool *need_free);
 
@@ -310,7 +312,7 @@ typedef void (*esp_blufi_negotiate_data_handler_t)(uint8_t *data, int len, uint8
  * @param crypt_len  : length of plain text
  * @return  Nonnegative number is encrypted length, if error, return negative number;
  */
-typedef int (* esp_blufi_encrypt_func_t)(uint8_t iv8, uint8_t *crypt_data, int cyprt_len);
+typedef int (* esp_blufi_encrypt_func_t)(uint8_t iv8, uint8_t *crypt_data, int crypt_len);
 
 /**
  * @brief BLUFI  decrypt the data after negotiate a share key

components/bt/bluedroid/api/include/api/esp_bt_defs.h

@@ -69,7 +69,7 @@ typedef uint8_t esp_link_key[ESP_BT_OCTET16_LEN];      /* Link Key */
 
 #define ESP_BLE_CONN_INT_MIN                0x0006       /*!< relate to BTM_BLE_CONN_INT_MIN in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_INT_MAX                0x0C80       /*!< relate to BTM_BLE_CONN_INT_MAX in stack/btm_ble_api.h */
-#define ESP_BLE_CONN_LATENCY_MAX            500          /*!< relate to ESP_BLE_CONN_LATENCY_MAX in stack/btm_ble_api.h */
+#define ESP_BLE_CONN_LATENCY_MAX            499          /*!< relate to ESP_BLE_CONN_LATENCY_MAX in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MIN           0x000A       /*!< relate to BTM_BLE_CONN_SUP_TOUT_MIN in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MAX           0x0C80       /*!< relate to ESP_BLE_CONN_SUP_TOUT_MAX in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_PARAM_UNDEF            0xffff       /* use this value when a specific value not to be overwritten */ /* relate to ESP_BLE_CONN_PARAM_UNDEF in stack/btm_ble_api.h */

components/bt/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -287,6 +287,8 @@ typedef enum {
     ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH,
     /* Enable/Disable OOB support */
     ESP_BLE_SM_OOB_SUPPORT,
+    /* Appl encryption key size */
+    ESP_BLE_APP_ENC_KEY_SIZE,
     ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;
 
@@ -388,6 +390,15 @@ typedef struct {
                                                         advertising reports for each packet received */
 } esp_ble_scan_params_t;
 
+/// connection parameters information 
+typedef struct {
+    uint16_t             interval;                  /*!< connection interval */
+    uint16_t             latency;                   /*!< Slave latency for the connection in number of connection events. Range: 0x0000 to 0x01F3 */
+    uint16_t             timeout;                   /*!< Supervision timeout for the LE Link. Range: 0x000A to 0x0C80.
+                                                      Mandatory Range: 0x000A to 0x0C80 Time = N * 10 msec
+                                                      Time Range: 100 msec to 32 seconds */
+} esp_gap_conn_params_t;
+
 /// Connection update parameters
 typedef struct {
     esp_bd_addr_t bda;                              /*!< Bluetooth device address */
@@ -895,7 +906,7 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params);
 esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_data_length);
 
 /**
- * @brief           This function sets the random address for the application
+ * @brief           This function sets the static Random Address and Non-Resolvable Private Address for the application
  *
  * @param[in]       rand_addr: the random address which should be setting
  *
@@ -1243,6 +1254,32 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
 */
 esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device);
 
+
+/**
+* @brief           This function is called to authorized a link after Authentication(MITM protection)
+*
+* @param[in]       bd_addr: BD address of the peer device.
+* @param[out]      authorize: Authorized the link or not.
+*
+* @return          - ESP_OK : success
+*                  - other  : failed
+*
+*/
+esp_err_t esp_gap_ble_set_authorization(esp_bd_addr_t bd_addr, bool authorize);
+
+/**
+* @brief           This function is called to read the connection
+*                  parameters information of the device
+*
+* @param[in]       bd_addr: BD address of the peer device.
+* @param[out]      conn_params: the connection parameters information
+*
+* @return          - ESP_OK : success
+*                  - other  : failed
+*
+*/
+esp_err_t esp_ble_get_current_conn_params(esp_bd_addr_t bd_addr, esp_gap_conn_params_t *conn_params);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/bluedroid/api/include/api/esp_gap_bt_api.h

@@ -174,6 +174,7 @@ typedef enum {
     ESP_BT_GAP_KEY_NOTIF_EVT,                       /*!< Simple Pairing Passkey Notification */
     ESP_BT_GAP_KEY_REQ_EVT,                         /*!< Simple Pairing Passkey request */
     ESP_BT_GAP_READ_RSSI_DELTA_EVT,                 /*!< read rssi event */
+    ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT,        /*!< remove bond device complete event */
     ESP_BT_GAP_EVT_MAX,
 } esp_bt_gap_cb_event_t;
 
@@ -271,6 +272,14 @@ typedef union {
     struct key_req_param {
         esp_bd_addr_t bda;                     /*!< remote bluetooth device address*/
     } key_req;                                 /*!< passkey request parameter struct */
+
+    /**
+     * @brief ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT
+     */
+    struct bt_remove_bond_dev_cmpl_evt_param {
+        esp_bd_addr_t bda;                          /*!< remote bluetooth device address*/
+        esp_bt_status_t status;                     /*!< Indicate the remove bond device operation success status */
+    }remove_bond_dev_cmpl;                           /*!< Event parameter of ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT */
 } esp_bt_gap_cb_param_t;
 
 /**
@@ -361,13 +370,15 @@ esp_err_t esp_bt_gap_register_callback(esp_bt_gap_cb_t callback);
 esp_err_t esp_bt_gap_set_scan_mode(esp_bt_scan_mode_t mode);
 
 /**
- * @brief           Start device discovery. This function should be called after esp_bluedroid_enable() completes successfully.
- *                  esp_bt_gap_cb_t will is called with ESP_BT_GAP_DISC_STATE_CHANGED_EVT if discovery is started or halted.
- *                  esp_bt_gap_cb_t will is called with ESP_BT_GAP_DISC_RES_EVT if discovery result is got.
+ * @brief           This function starts Inquiry and Name Discovery. It should be called after esp_bluedroid_enable() completes successfully.
+ *                  When Inquiry is halted and cached results do not contain device name, then Name Discovery will connect to the peer target to get the device name.
+ *                  esp_bt_gap_cb_t will be called with ESP_BT_GAP_DISC_STATE_CHANGED_EVT when Inquriry is started or Name Discovery is completed.
+ *                  esp_bt_gap_cb_t will be called with ESP_BT_GAP_DISC_RES_EVT each time the two types of discovery results are got.
  *
- * @param[in]       mode - inquiry mode
- * @param[in]       inq_len - inquiry duration in 1.28 sec units, ranging from 0x01 to 0x30
- * @param[in]       num_rsps - number of inquiry responses that can be received, value 0 indicates an unlimited number of responses
+ * @param[in]       mode - Inquiry mode
+ * @param[in]       inq_len - Inquiry duration in 1.28 sec units, ranging from 0x01 to 0x30. This parameter only specifies the total duration of the Inquiry process,
+ *                          - when this time expires, Inquiry will be halted.
+ * @param[in]       num_rsps - Number of responses that can be received before the Inquiry is halted, value 0 indicates an unlimited number of responses.
  *
  * @return
  *                  - ESP_OK : Succeed
@@ -378,8 +389,9 @@ esp_err_t esp_bt_gap_set_scan_mode(esp_bt_scan_mode_t mode);
 esp_err_t esp_bt_gap_start_discovery(esp_bt_inq_mode_t mode, uint8_t inq_len, uint8_t num_rsps);
 
 /**
- * @brief           Cancel device discovery. This function should be called after esp_bluedroid_enable() completes successfully
- *                  esp_bt_gap_cb_t will is called with ESP_BT_GAP_DISC_STATE_CHANGED_EVT if discovery is stopped.
+ * @brief           Cancel Inquiry and Name Discovery. This function should be called after esp_bluedroid_enable() completes successfully.
+ *                  esp_bt_gap_cb_t will be called with ESP_BT_GAP_DISC_STATE_CHANGED_EVT if Inquiry or Name Discovery is cancelled by
+ *                  calling this function.
  *
  * @return
  *                  - ESP_OK : Succeed

components/bt/bluedroid/api/include/api/esp_gatt_common_api.h

@@ -44,6 +44,11 @@ extern "C" {
  */
 extern esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu);
 
+#if (BLE_INCLUDED == TRUE)
+extern uint16_t esp_ble_get_sendable_packets_num (void);
+extern uint16_t esp_ble_get_cur_sendable_packets_num (uint16_t connid);
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/bt/bluedroid/api/include/api/esp_gatt_defs.h

@@ -34,7 +34,7 @@ extern "C" {
  * All "ESP_GATT_UUID_xxx" is attribute types
  */
 #define ESP_GATT_UUID_IMMEDIATE_ALERT_SVC           0x1802          /*  Immediate alert Service*/
-#define ESP_GATT_UUID_LINK_LOSS_SVC                 0x1803          /*  Link Loss Service*/                             
+#define ESP_GATT_UUID_LINK_LOSS_SVC                 0x1803          /*  Link Loss Service*/
 #define ESP_GATT_UUID_TX_POWER_SVC                  0x1804          /*  TX Power Service*/
 #define ESP_GATT_UUID_CURRENT_TIME_SVC              0x1805          /*  Current Time Service Service*/
 #define ESP_GATT_UUID_REF_TIME_UPDATE_SVC           0x1806          /*  Reference Time Update Service*/
@@ -68,8 +68,14 @@ extern "C" {
 #define ESP_GATT_UUID_CHAR_PRESENT_FORMAT           0x2904          /*  Characteristic Presentation Format*/
 #define ESP_GATT_UUID_CHAR_AGG_FORMAT               0x2905          /*  Characteristic Aggregate Format*/
 #define ESP_GATT_UUID_CHAR_VALID_RANGE              0x2906          /*  Characteristic Valid Range */
-#define ESP_GATT_UUID_EXT_RPT_REF_DESCR             0x2907
-#define ESP_GATT_UUID_RPT_REF_DESCR                 0x2908
+#define ESP_GATT_UUID_EXT_RPT_REF_DESCR             0x2907          /*  External Report Reference */
+#define ESP_GATT_UUID_RPT_REF_DESCR                 0x2908          /*  Report Reference */
+#define ESP_GATT_UUID_NUM_DIGITALS_DESCR            0x2909          /*  Number of Digitals */
+#define ESP_GATT_UUID_VALUE_TRIGGER_DESCR           0x290A          /*  Value Trigger Setting */
+#define ESP_GATT_UUID_ENV_SENSING_CONFIG_DESCR      0x290B          /*  Environmental Sensing Configuration */
+#define ESP_GATT_UUID_ENV_SENSING_MEASUREMENT_DESCR 0x290C          /*  Environmental Sensing Measurement */
+#define ESP_GATT_UUID_ENV_SENSING_TRIGGER_DESCR     0x290D          /*  Environmental Sensing Trigger Setting */
+#define ESP_GATT_UUID_TIME_TRIGGER_DESCR            0x290E          /*  Time Trigger Setting */
 
 /* GAP Profile Attributes */
 #define ESP_GATT_UUID_GAP_DEVICE_NAME               0x2A00
@@ -272,6 +278,8 @@ typedef enum {
 #define    ESP_GATT_PERM_WRITE_ENC_MITM        (1 << 6)   /* bit 6 -  0x0040 */    /* relate to BTA_GATT_PERM_WRITE_ENC_MITM in bta/bta_gatt_api.h */
 #define    ESP_GATT_PERM_WRITE_SIGNED          (1 << 7)   /* bit 7 -  0x0080 */    /* relate to BTA_GATT_PERM_WRITE_SIGNED in bta/bta_gatt_api.h */
 #define    ESP_GATT_PERM_WRITE_SIGNED_MITM     (1 << 8)   /* bit 8 -  0x0100 */    /* relate to BTA_GATT_PERM_WRITE_SIGNED_MITM in bta/bta_gatt_api.h */
+#define    ESP_GATT_PERM_READ_AUTHORIZATION    (1 << 9)   /* bit 9 -  0x0200 */
+#define    ESP_GATT_PERM_WRITE_AUTHORIZATION   (1 << 10)  /* bit 10 - 0x0400 */
 typedef uint16_t esp_gatt_perm_t;
 
 /* relate to BTA_GATT_CHAR_PROP_BIT_xxx in bta/bta_gatt_api.h */
@@ -299,7 +307,7 @@ typedef enum {
  * @brief Attribute description (used to create database)
  */
  typedef struct
- {   
+ {
      uint16_t uuid_length;              /*!< UUID length */
      uint8_t  *uuid_p;                  /*!< UUID value */
      uint16_t perm;                     /*!< Attribute permission */
@@ -348,23 +356,23 @@ typedef struct
 /**
   * @brief Gatt  include service entry element
   */
-typedef struct 
+typedef struct
 {
-    uint16_t start_hdl;                                     /*!< Gatt  start handle value of included service */
-    uint16_t end_hdl;                                       /*!< Gatt  end handle value of included service */
-    uint16_t uuid;                                          /*!< Gatt  attribute value UUID of included service */
+    uint16_t start_hdl;                                     /*!< Gatt start handle value of included service */
+    uint16_t end_hdl;                                       /*!< Gatt end handle value of included service */
+    uint16_t uuid;                                          /*!< Gatt attribute value UUID of included service */
 } esp_gatts_incl_svc_desc_t;                                /*!< Gatt include service entry element */
 
 /**
   * @brief Gatt  include 128 bit service entry element
   */
-typedef struct 
+typedef struct
 {
-    uint16_t start_hdl;                                     /*!< Gatt  start handle value of included 128 bit service */
-    uint16_t end_hdl;                                       /*!< Gatt  end handle value of included 128 bit service */
-} esp_gatts_incl128_svc_desc_t;                             /*!< Gatt  include 128 bit service entry element */
+    uint16_t start_hdl;                                     /*!< Gatt start handle value of included 128 bit service */
+    uint16_t end_hdl;                                       /*!< Gatt end handle value of included 128 bit service */
+} esp_gatts_incl128_svc_desc_t;                             /*!< Gatt include 128 bit service entry element */
 
-/// Gatt attribute value 
+/// Gatt attribute value
 typedef struct {
     uint8_t           value[ESP_GATT_MAX_ATTR_LEN];         /*!< Gatt attribute value */
     uint16_t          handle;                               /*!< Gatt attribute handle */
@@ -387,6 +395,17 @@ typedef enum {
     ESP_GATT_WRITE_TYPE_RSP,                                /*!< Gatt write attribute need remote response */
 } esp_gatt_write_type_t;
 
+/**
+  * @brief Connection parameters information
+  */
+typedef struct {
+    uint16_t             interval;                         /*!< connection interval */
+    uint16_t             latency;                          /*!< Slave latency for the connection in number of connection events. Range: 0x0000 to 0x01F3 */
+    uint16_t             timeout;                          /*!< Supervision timeout for the LE Link. Range: 0x000A to 0x0C80.
+                                                                Mandatory Range: 0x000A to 0x0C80 Time = N * 10 msec
+                                                                Time Range: 100 msec to 32 seconds */
+} esp_gatt_conn_params_t;
+
 #define ESP_GATT_IF_NONE    0xff                            /*!< If callback report gattc_if/gatts_if as this macro, means this event is not correspond to any app */
 
 typedef uint8_t    esp_gatt_if_t;                           /*!< Gatt interface type, different application on GATT client use different gatt_if */
@@ -426,8 +445,8 @@ typedef struct {
 /**
   * @brief service element
   */
-typedef struct { 
-    bool                        is_primary;                 /*!< The service flag, true if the service is primary service, else is secondly service */
+typedef struct {
+    bool                        is_primary;                 /*!< The service flag, true if the service is primary service, else is secondary service */
     uint16_t                    start_handle;               /*!< The start handle of the service */
     uint16_t                    end_handle;                 /*!< The end handle of the service */
     esp_bt_uuid_t               uuid;                       /*!< The uuid of the service */

components/bt/bluedroid/api/include/api/esp_gattc_api.h

@@ -209,6 +209,7 @@ typedef union {
     struct gattc_connect_evt_param {
         uint16_t conn_id;               /*!< Connection id */
         esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
+        esp_gatt_conn_params_t conn_params; /*!< current connection parameters */
     } connect;                          /*!< Gatt client callback param of ESP_GATTC_CONNECT_EVT */
 
     /**
@@ -248,7 +249,7 @@ typedef union {
 /**
  * @brief GATT Client callback function type
  * @param event : Event type
- * @param gatts_if : GATT client access interface, normally
+ * @param gattc_if : GATT client access interface, normally
  *                   different gattc_if correspond to different profile
  * @param param : Point to callback parameter, currently is union type
  */
@@ -603,6 +604,29 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
                                    uint16_t conn_id,
                                    uint16_t handle,
                                    esp_gatt_auth_req_t auth_req);
+/**
+ * @brief           This function is called to read a service's characteristics of
+ *                  the given characteristic UUID
+ *
+ * @param[in]       gattc_if: Gatt client access interface.
+ * @param[in]       conn_id : connection ID.
+ * @param[in]       start_handle : the attribute start handle.
+ * @param[in]       end_handle : the attribute end handle
+ * @param[in]       uuid : The UUID of attribute which will be read.
+ * @param[in]       auth_req : authenticate request type
+ *
+ * @return
+ *                  - ESP_OK: success
+ *                  - other: failed
+ *
+ */
+esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
+                                      uint16_t conn_id,
+                                      uint16_t start_handle,
+                                      uint16_t end_handle,
+                                      esp_bt_uuid_t *uuid,
+                                      esp_gatt_auth_req_t auth_req);
+
 
 /**
  * @brief           This function is called to read multiple characteristic or

components/bt/bluedroid/api/include/api/esp_gatts_api.h

@@ -197,6 +197,7 @@ typedef union {
     struct gatts_connect_evt_param {
         uint16_t conn_id;               /*!< Connection id */
         esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
+        esp_gatt_conn_params_t conn_params; /*!< current Connection parameters */
     } connect;                          /*!< Gatt server callback param of ESP_GATTS_CONNECT_EVT */
 
     /**

components/bt/bluedroid/api/include/api/esp_hf_client_api.h

@@ -271,7 +271,7 @@ typedef void (* esp_hf_client_incoming_data_cb_t)(const uint8_t *buf, uint32_t l
  *                  buffer is allocated inside bluetooth protocol stack and will be released after
  *                  invoke of the callback is finished.
  * @param[in]       len : size(in bytes) in buf
- * @param[out]      length of data successfully read
+ * @return          length of data successfully read
  */
 typedef uint32_t (* esp_hf_client_outgoing_data_cb_t)(uint8_t *buf, uint32_t len);
 

components/bt/bluedroid/api/include/api/esp_spp_api.h

@@ -26,11 +26,15 @@ typedef enum {
     ESP_SPP_SUCCESS   = 0,          /*!< Successful operation. */
     ESP_SPP_FAILURE,                /*!< Generic failure. */
     ESP_SPP_BUSY,                   /*!< Temporarily can not handle this request. */
-    ESP_SPP_NO_DATA,                /*!< no data. */
-    ESP_SPP_NO_RESOURCE             /*!< No more set pm control block */
+    ESP_SPP_NO_DATA,                /*!< No data. */
+    ESP_SPP_NO_RESOURCE,            /*!< No more resource */
+    ESP_SPP_NEED_INIT,              /*!< SPP module shall init first */
+    ESP_SPP_NEED_DEINIT,            /*!< SPP module shall deinit first */
+    ESP_SPP_NO_CONNECTION,          /*!< Connection may have been closed */
+    ESP_SPP_NO_SERVER,              /*!< No SPP server */
 } esp_spp_status_t;
 
-/* Security Setting Mask */
+/* Security Setting Mask, Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.*/
 #define ESP_SPP_SEC_NONE            0x0000    /*!< No security. relate to BTA_SEC_NONE in bta/bta_api.h */
 #define ESP_SPP_SEC_AUTHORIZE       0x0001    /*!< Authorization required (only needed for out going connection ) relate to BTA_SEC_AUTHORIZE in bta/bta_api.h*/
 #define ESP_SPP_SEC_AUTHENTICATE    0x0012    /*!< Authentication required.  relate to BTA_SEC_AUTHENTICATE in bta/bta_api.h*/
@@ -57,6 +61,7 @@ typedef enum {
  */
 typedef enum {
     ESP_SPP_INIT_EVT                    = 0,                /*!< When SPP is inited, the event comes */
+    ESP_SPP_UNINIT_EVT                  = 1,                /*!< When SPP is uninited, the event comes */
     ESP_SPP_DISCOVERY_COMP_EVT          = 8,                /*!< When SDP discovery complete, the event comes */
     ESP_SPP_OPEN_EVT                    = 26,               /*!< When SPP Client connection open, the event comes */
     ESP_SPP_CLOSE_EVT                   = 27,               /*!< When SPP connection closed, the event comes */
@@ -66,6 +71,7 @@ typedef enum {
     ESP_SPP_CONG_EVT                    = 31,               /*!< When SPP connection congestion status changed, the event comes, only for ESP_SPP_MODE_CB */
     ESP_SPP_WRITE_EVT                   = 33,               /*!< When SPP write operation completes, the event comes, only for ESP_SPP_MODE_CB */
     ESP_SPP_SRV_OPEN_EVT                = 34,               /*!< When SPP Server connection open, the event comes */
+    ESP_SPP_SRV_STOP_EVT                = 35,               /*!< When SPP server stopped, the event comes */
 } esp_spp_cb_event_t;
 
 
@@ -80,13 +86,22 @@ typedef union {
         esp_spp_status_t    status;         /*!< status */
     } init;                                 /*!< SPP callback param of SPP_INIT_EVT */
 
+    /**
+     * @brief SPP_UNINIT_EVT
+     */
+    struct spp_uninit_evt_param {
+        esp_spp_status_t    status;         /*!< status */
+    } uninit;                                 /*!< SPP callback param of SPP_UNINIT_EVT */
+
     /**
      * @brief SPP_DISCOVERY_COMP_EVT
      */
     struct spp_discovery_comp_evt_param {
-        esp_spp_status_t    status;         /*!< status */
-        uint8_t             scn_num;        /*!< The num of scn_num */
-        uint8_t             scn[ESP_SPP_MAX_SCN];    /*!< channel # */
+
+        esp_spp_status_t status;                   /*!< status */
+        uint8_t scn_num;                           /*!< The num of scn_num */
+        uint8_t scn[ESP_SPP_MAX_SCN];              /*!< channel # */
+        const char *service_name[ESP_SPP_MAX_SCN]; /*!< service_name */
     } disc_comp;                            /*!< SPP callback param of SPP_DISCOVERY_COMP_EVT */
 
     /**
@@ -126,8 +141,18 @@ typedef union {
         esp_spp_status_t    status;         /*!< status */
         uint32_t            handle;         /*!< The connection handle */
         uint8_t             sec_id;         /*!< security ID used by this server */
+        uint8_t             scn;            /*!< Server channel number */
         bool                use_co;         /*!< TRUE to use co_rfc_data */
     } start;                                /*!< SPP callback param of ESP_SPP_START_EVT */
+
+    /**
+     * @brief ESP_SPP_SRV_STOP_EVT
+     */
+    struct spp_srv_stop_evt_param {
+        esp_spp_status_t    status;         /*!< status */
+        uint8_t             scn;            /*!< Server channel number */
+    } srv_stop;                                 /*!< SPP callback param of ESP_SPP_SRV_STOP_EVT */
+
     /**
      * @brief ESP_SPP_CL_INIT_EVT
      */
@@ -229,7 +254,7 @@ esp_err_t esp_spp_start_discovery(esp_bd_addr_t bd_addr);
  *              When the connection is established or failed,
  *              the callback is called with ESP_SPP_OPEN_EVT.
  *
- * @param[in]   sec_mask:     Security Setting Mask .
+ * @param[in]   sec_mask:     Security Setting Mask. Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.
  * @param[in]   role:         Master or slave.
  * @param[in]   remote_scn:   Remote device bluetooth device SCN.
  * @param[in]   peer_bd_addr: Remote device bluetooth device address.
@@ -260,7 +285,7 @@ esp_err_t esp_spp_disconnect(uint32_t handle);
  *              When the connection is established, the callback is called
  *              with ESP_SPP_SRV_OPEN_EVT.
  *
- * @param[in]   sec_mask:     Security Setting Mask .
+ * @param[in]   sec_mask:     Security Setting Mask. Security Setting Mask. Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.
  * @param[in]   role:         Master or slave.
  * @param[in]   local_scn:    The specific channel you want to get.
  *                            If channel is 0, means get any channel.
@@ -273,6 +298,34 @@ esp_err_t esp_spp_disconnect(uint32_t handle);
 esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
                             esp_spp_role_t role, uint8_t local_scn, const char *name);
 
+/**
+
+ * @brief       This function stops all SPP servers.
+ *              The operation will close all active SPP connection first, then the callback function will be called
+ *              with ESP_SPP_CLOSE_EVT, and the number of ESP_SPP_CLOSE_EVT is equal to the number of connection.
+ *              When the operation is completed, the callback is called with ESP_SPP_SRV_STOP_EVT.
+ *              This funciton must be called after esp_spp_init() successful and before esp_spp_deinit().
+ *
+ * @return
+ *              - ESP_OK: success
+ *              - other: failed
+ */
+esp_err_t esp_spp_stop_srv(void);
+
+/**
+ * @brief       This function stops a specific SPP server.
+ *              The operation will close all active SPP connection first on the specific SPP server, then the callback function will be called
+ *              with ESP_SPP_CLOSE_EVT, and the number of ESP_SPP_CLOSE_EVT is equal to the number of connection.
+ *              When the operation is completed, the callback is called with ESP_SPP_SRV_STOP_EVT.
+ *              This funciton must be called after esp_spp_init() successful and before esp_spp_deinit().
+ *
+ * @param[in]   scn:         Server channel number.
+ *
+ * @return
+ *              - ESP_OK: success
+ *              - other: failed
+ */
+esp_err_t esp_spp_stop_srv_scn(uint8_t scn);
 
 /**
  * @brief       This function is used to write data, only for ESP_SPP_MODE_CB.

components/bt/bluedroid/bta/av/bta_av_aact.c

@@ -41,6 +41,7 @@
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
 #include "bta/bta_ar_api.h"
 #endif
+#include "bta/bta_api.h"
 
 /*****************************************************************************
 **  Constants
@@ -528,8 +529,21 @@ static void bta_av_proc_stream_evt(UINT8 handle, BD_ADDR bd_addr, UINT8 event, t
         /* look up application event */
         if ((p_data == NULL) || (p_data->hdr.err_code == 0)) {
             p_msg->hdr.event = bta_av_stream_evt_ok[event];
+            if (p_msg->hdr.event == BTA_AV_STR_START_OK_EVT) {
+                BTA_DmCoexEventTrigger(BTA_COEX_EVT_STREAMING_STARTED);
+            } else if (p_msg->hdr.event == BTA_AV_STR_START_FAIL_EVT ||
+                p_msg->hdr.event == BTA_AV_STR_SUSPEND_CFM_EVT ||
+                p_msg->hdr.event == BTA_AV_STR_CLOSE_EVT) {
+                BTA_DmCoexEventTrigger(BTA_COEX_EVT_STREAMING_STOPPED);
+            }
         } else {
             p_msg->hdr.event = bta_av_stream_evt_fail[event];
+            if (p_msg->hdr.event == BTA_AV_STR_START_FAIL_EVT ||
+                p_msg->hdr.event == BTA_AV_STR_START_OK_EVT ||
+                p_msg->hdr.event == BTA_AV_STR_SUSPEND_CFM_EVT ||
+                p_msg->hdr.event == BTA_AV_STR_CLOSE_EVT) {
+                BTA_DmCoexEventTrigger(BTA_COEX_EVT_STREAMING_STOPPED);
+            }
         }
 
         p_msg->initiator = FALSE;

components/bt/bluedroid/bta/av/bta_av_act.c

@@ -208,11 +208,8 @@ static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_AD
     UINT16 msg_event = 0;
     UNUSED(result);
 
-#if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
-    APPL_TRACE_EVENT("rc_ctrl handle: %d event=0x%x", handle, event);
-#else
-    APPL_TRACE_EVENT("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
-#endif
+    APPL_TRACE_EVENT("%s handle: %d event: 0x%x",__func__, handle, event);
+
     if (event == AVRC_OPEN_IND_EVT) {
         /* save handle of opened connection
         bta_av_cb.rc_handle = handle;*/

components/bt/bluedroid/bta/av/bta_av_api.c

@@ -114,7 +114,7 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
         p_buf->hdr.layer_specific   = chnl;
         p_buf->hdr.event = BTA_AV_API_REGISTER_EVT;
         if (p_service_name) {
-            BCM_STRNCPY_S(p_buf->p_service_name, sizeof(p_buf->p_service_name), p_service_name, BTA_SERVICE_NAME_LEN);
+            BCM_STRNCPY_S(p_buf->p_service_name, p_service_name, BTA_SERVICE_NAME_LEN);
             p_buf->p_service_name[BTA_SERVICE_NAME_LEN - 1] = 0;
         } else {
             p_buf->p_service_name[0] = 0;

components/bt/bluedroid/bta/av/bta_av_cfg.c

@@ -40,8 +40,9 @@ const UINT32  bta_av_meta_caps_co_ids[] = {
     AVRC_CO_BROADCOM
 };
 
-/* AVRCP cupported categories */
-#define BTA_AV_RC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
+/* AVRCP supported categories */
+#define BTA_AV_RC_SNK_SUPF_CT       (AVRC_SUPF_CT_CAT1)
+#define BTA_AV_RC_SRC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
 
 /* Added to modify
 **  1. flush timeout
@@ -62,9 +63,11 @@ const UINT16  bta_av_audio_flush_to[] = {
 /* Note: Android doesnt support AVRC_SUPF_TG_GROUP_NAVI  */
 /* Note: if AVRC_SUPF_TG_GROUP_NAVI is set, bta_av_cfg.avrc_group should be TRUE */
 #if AVRC_METADATA_INCLUDED == TRUE
-#define BTA_AV_RC_SUPF_TG       (AVRC_SUPF_TG_CAT1) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
+#define BTA_AV_RC_SNK_SUPF_TG       (AVRC_SUPF_TG_CAT2) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
+#define BTA_AV_RC_SRC_SUPF_TG       (AVRC_SUPF_TG_CAT1) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
 #else
-#define BTA_AV_RC_SUPF_TG       (AVRC_SUPF_TG_CAT1)
+#define BTA_AV_RC_SNK_SUPF_TG       (AVRC_SUPF_TG_CAT2)
+#define BTA_AV_RC_SRC_SUPF_TG       (AVRC_SUPF_TG_CAT1)
 #endif
 
 /*
@@ -95,8 +98,10 @@ const tBTA_AV_CFG bta_av_cfg = {
     48,                     /* AVRCP MTU at L2CAP for control channel */
 #endif
     BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */
-    BTA_AV_RC_SUPF_CT,      /* AVRCP controller categories */
-    BTA_AV_RC_SUPF_TG,      /* AVRCP target categories */
+    BTA_AV_RC_SNK_SUPF_CT,  /* AVRCP controller categories as SNK */
+    BTA_AV_RC_SNK_SUPF_TG,  /* AVRCP target categories as SNK */
+    BTA_AV_RC_SRC_SUPF_CT,  /* AVRCP controller categories as SRC */
+    BTA_AV_RC_SRC_SUPF_TG,  /* AVRCP target categories as SRC */
     672,                    /* AVDTP signaling channel MTU at L2CAP */
     BTA_AV_MAX_A2DP_MTU,    /* AVDTP audio transport channel MTU at L2CAP */
     bta_av_audio_flush_to,  /* AVDTP audio transport channel flush timeout */

components/bt/bluedroid/bta/av/bta_av_main.c

@@ -483,8 +483,7 @@ static void bta_av_api_sink_enable(tBTA_AV_DATA *p_data)
     activate_sink = p_data->hdr.layer_specific;
     APPL_TRACE_DEBUG("bta_av_api_sink_enable %d \n", activate_sink)
     char p_service_name[BTA_SERVICE_NAME_LEN + 1];
-    BCM_STRNCPY_S(p_service_name, sizeof(p_service_name),
-                  BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    BCM_STRNCPY_S(p_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
 
     if (activate_sink) {
         AVDT_SINK_Activate();
@@ -526,7 +525,7 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
     tBTA_UTL_COD    cod;
     UINT8           index = 0;
     char p_avk_service_name[BTA_SERVICE_NAME_LEN + 1];
-    BCM_STRNCPY_S(p_avk_service_name, sizeof(p_avk_service_name), BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    BCM_STRNCPY_S(p_avk_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
 
     memset(&cs, 0, sizeof(tAVDT_CS));
 
@@ -564,16 +563,15 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
             if (bta_av_cb.features & (BTA_AV_FEAT_RCTG)) {
                 /* register with no authorization; let AVDTP use authorization instead */
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
-#if (BTA_AV_WITH_AVCTP_AUTHORIZATION == TRUE)
-                bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
-                                bta_av_cb.sec_mask, BTA_ID_AV);
-#else
                 bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
                                 (UINT8)(bta_av_cb.sec_mask & (~BTA_SEC_AUTHORIZE)), BTA_ID_AV);
-#endif
-
-                bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
-                                p_bta_av_cfg->avrc_tg_cat, BTA_ID_AV);
+                if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
+                                p_bta_av_cfg->avrc_src_tg_cat, BTA_ID_AV);
+                } else {
+                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
+                                p_bta_av_cfg->avrc_snk_tg_cat, BTA_ID_AV);
+                }
 #endif
             }
 
@@ -696,19 +694,19 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
                     /* if TG is not supported, we need to register to AVCT now */
                     if ((bta_av_cb.features & (BTA_AV_FEAT_RCTG)) == 0) {
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
-#if (BTA_AV_WITH_AVCTP_AUTHORIZATION == TRUE)
-                        bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
-                                        bta_av_cb.sec_mask, BTA_ID_AV);
-#else
                         bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
                                         (UINT8)(bta_av_cb.sec_mask & (~BTA_SEC_AUTHORIZE)), BTA_ID_AV);
-#endif
 #endif
                     }
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
                     /* create an SDP record as AVRC CT. */
-                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL, NULL,
-                                    p_bta_av_cfg->avrc_ct_cat, BTA_ID_AV);
+                    if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                        bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, "AV Remote Control Controller\n", NULL,
+                                    p_bta_av_cfg->avrc_src_ct_cat, BTA_ID_AV);
+                    } else {
+                        bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, "AV Remote Control Controller\n", NULL,
+                                    p_bta_av_cfg->avrc_snk_ct_cat, BTA_ID_AV);
+                    }
 #endif
                 }
             }

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -61,7 +61,7 @@ static void bta_dm_sdp_callback (UINT16 sdp_status);
 #if (SMP_INCLUDED == TRUE)
 static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, UINT8 *service_name, UINT8 service_id, BOOLEAN is_originator);
 static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, BOOLEAN min_16_digit);
-static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type);
+static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type, BOOLEAN sc_support);
 static UINT8 bta_dm_authentication_complete_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, int result);
 #endif  ///SMP_INCLUDED == TRUE
 static void bta_dm_local_name_cback(BD_ADDR bd_addr);
@@ -323,6 +323,9 @@ void bta_dm_deinit_cb(void)
     }
 #endif
     memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreGive(deinit_semaphore);
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 /*******************************************************************************
@@ -607,7 +610,7 @@ void bta_dm_ble_read_adv_tx_power(tBTA_DM_MSG *p_data)
     }
 }
 
-void bta_dm_ble_read_rssi(tBTA_DM_MSG *p_data)
+void bta_dm_read_rssi(tBTA_DM_MSG *p_data)
 {
     if (p_data->rssi.read_rssi_cb != NULL) {
         BTM_ReadRSSI(p_data->rssi.remote_addr, p_data->rssi.transport, p_data->rssi.read_rssi_cb);
@@ -693,7 +696,6 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
     if (p_data->set_visibility.pair_mode != BTA_DM_IGNORE || p_data->set_visibility.conn_paired_only != BTA_DM_IGNORE) {
         BTM_SetPairableMode((BOOLEAN)(!(bta_dm_cb.disable_pair_mode)), bta_dm_cb.conn_paired_only);
     }
-
 }
 
 /*******************************************************************************
@@ -754,11 +756,13 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
         /* Take the link down first, and mark the device for removal when disconnected */
         for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
             if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_dev->bd_addr)
-                && bta_dm_cb.device_list.peer_device[i].transport == transport) {
+#if BLE_INCLUDED == TRUE
+                && bta_dm_cb.device_list.peer_device[i].transport == transport
+#endif
+            ) {
                 bta_dm_cb.device_list.peer_device[i].conn_state = BTA_DM_UNPAIRING;
-                btm_remove_acl( p_dev->bd_addr, bta_dm_cb.device_list.peer_device[i].transport);
-                APPL_TRACE_DEBUG("%s:transport = %d", __func__,
-                                 bta_dm_cb.device_list.peer_device[i].transport);
+                btm_remove_acl( p_dev->bd_addr, transport);
+                APPL_TRACE_DEBUG("%s:transport = %d", __func__, transport);
                 break;
             }
         }
@@ -820,7 +824,7 @@ void bta_dm_add_device (tBTA_DM_MSG *p_data)
 
     if (!BTM_SecAddDevice (p_dev->bd_addr, p_dc, p_dev->bd_name, p_dev->features,
                            trusted_services_mask, p_lc, p_dev->key_type, p_dev->io_cap,
-                           p_dev->pin_length)) {
+                           p_dev->pin_length, p_dev->sc_support)) {
         APPL_TRACE_ERROR ("BTA_DM: Error adding device %08x%04x",
                           (p_dev->bd_addr[0] << 24) + (p_dev->bd_addr[1] << 16) + (p_dev->bd_addr[2] << 8) + p_dev->bd_addr[3],
                           (p_dev->bd_addr[4] << 8) + p_dev->bd_addr[5]);
@@ -1684,7 +1688,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
                         if (SDP_FindServiceUUIDInRec(p_sdp_rec, &service_uuid)) {
                             /* send result back to app now, one by one */
                             bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN));
+                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
                             result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
                             result.disc_ble_res.service.len = service_uuid.len;
                             result.disc_ble_res.service.uu.uuid16 = service_uuid.uu.uuid16;
@@ -1825,8 +1829,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
 
                 }
                 bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                              bta_dm_get_remname(), (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
                 /* make sure the string is null terminated */
                 p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -1852,8 +1855,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
             p_msg->disc_result.result.disc_res.result = BTA_FAILURE;
             p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is null terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2237,8 +2239,7 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
             p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
             p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2423,8 +2424,7 @@ static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
         p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
         p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
         bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,  sizeof(BD_NAME),
-                      (char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, (char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
 
         /* make sure the string is terminated */
         p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2568,7 +2568,7 @@ static void bta_dm_service_search_remname_cback (BD_ADDR bd_addr, DEV_CLASS dc,
             rem_name.length = (BD_NAME_LEN - 1);
             rem_name.remote_bd_name[(BD_NAME_LEN - 1)] = 0;
         }
-        BCM_STRNCPY_S((char *)rem_name.remote_bd_name,  sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)rem_name.remote_bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
         rem_name.status = BTM_SUCCESS;
 
         bta_dm_remname_cback(&rem_name);
@@ -2611,7 +2611,7 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 
     /* remote name discovery is done but it could be failed */
     bta_dm_search_cb.name_discover_done = TRUE;
-    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name, sizeof(BD_NAME), (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
+    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name,(char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
     bta_dm_search_cb.peer_name[BD_NAME_LEN] = 0;
 
     BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
@@ -2624,7 +2624,7 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 
     if ((p_msg = (tBTA_DM_REM_NAME *) osi_malloc(sizeof(tBTA_DM_REM_NAME))) != NULL) {
         bdcpy (p_msg->result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, sizeof(BD_NAME), (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
+        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
 
         /* make sure the string is null terminated */
         p_msg->result.disc_res.bd_name[BD_NAME_LEN] = 0;
@@ -2656,7 +2656,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
     bdcpy(sec_event.authorize.bd_addr, bd_addr);
     memcpy(sec_event.authorize.dev_class, dev_class, DEV_CLASS_LEN);
 
-    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
 
     /* make sure the string is null terminated */
     sec_event.authorize.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2768,7 +2768,7 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
 
     bdcpy(sec_event.pin_req.bd_addr, bd_addr);
     BTA_COPY_DEVICE_CLASS(sec_event.pin_req.dev_class, dev_class);
-    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
     sec_event.pin_req.bd_name[BD_NAME_LEN - 1] = 0;
     sec_event.pin_req.min_16_digit = min_16_digit;
 
@@ -2786,7 +2786,8 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
 **
 *******************************************************************************/
 static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
-                                        BD_NAME bd_name, LINK_KEY key, UINT8 key_type)
+                                        BD_NAME bd_name, LINK_KEY key, UINT8 key_type,
+                                        BOOLEAN sc_support)
 {
     tBTA_DM_SEC sec_event;
     tBTA_DM_AUTH_CMPL *p_auth_cmpl;
@@ -2808,6 +2809,7 @@ static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
         p_auth_cmpl->key_present = TRUE;
         p_auth_cmpl->key_type = key_type;
         p_auth_cmpl->success = TRUE;
+        p_auth_cmpl->sc_support = sc_support;
 
         memcpy(p_auth_cmpl->key, key, LINK_KEY_LEN);
         sec_event.auth_cmpl.fail_reason = HCI_SUCCESS;
@@ -2938,8 +2940,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
                    copy these values into key_notif from cfm_req */
                 bdcpy(sec_event.key_notif.bd_addr, p_data->cfm_req.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->cfm_req.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2960,8 +2961,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
             } else {
                 bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2982,8 +2982,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
             } else {
                 bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -3012,7 +3011,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
 
         bdcpy(sec_event.rmt_oob.bd_addr, p_data->rmt_oob.bd_addr);
         BTA_COPY_DEVICE_CLASS(sec_event.rmt_oob.dev_class, p_data->rmt_oob.dev_class);
-        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, sizeof(BD_NAME), (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
         sec_event.rmt_oob.bd_name[BD_NAME_LEN - 1] = 0;
 
         bta_dm_cb.p_sec_cback(BTA_DM_SP_RMT_OOB_EVT, &sec_event);
@@ -3088,6 +3087,7 @@ static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
 
         switch (p_msg->event) {
         case BTM_BL_CONN_EVT:
+            p_msg->sc_downgrade = p_data->conn.sc_downgrade;
             p_msg->is_new = TRUE;
             bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
 #if BLE_INCLUDED == TRUE
@@ -3314,6 +3314,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         APPL_TRACE_DEBUG("%s info: 0x%x", __func__, bta_dm_cb.device_list.peer_device[i].info);
 
         if (bta_dm_cb.p_sec_cback) {
+            conn.link_up.sc_downgrade = p_data->acl_change.sc_downgrade;
             bta_dm_cb.p_sec_cback(BTA_DM_LINK_UP_EVT, (tBTA_DM_SEC *)&conn);
         }
     } else {
@@ -3623,9 +3624,12 @@ static void bta_dm_adjust_roles(BOOLEAN delay_role_switch)
                         BTM_SwitchRole (bta_dm_cb.device_list.peer_device[i].peer_bdaddr,
                                         HCI_ROLE_MASTER, NULL);
                     } else {
-                        bta_dm_cb.switch_delay_timer.p_cback =
+                        bta_dm_cb.switch_delay_timer[i].p_cback =
                             (TIMER_CBACK *)&bta_dm_delay_role_switch_cback;
-                        bta_sys_start_timer(&bta_dm_cb.switch_delay_timer, 0, 500);
+                        /* Start the timer if not active */
+                        if (!bta_sys_timer_is_active(&bta_dm_cb.switch_delay_timer[i])) {
+                            bta_sys_start_timer(&bta_dm_cb.switch_delay_timer[i], 0, 500);
+                        }
                     }
                 }
 
@@ -4348,8 +4352,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bdcpy(sec_event.ble_req.bd_addr, bda);
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.ble_req.bd_name[0] = 0;
         }
@@ -4361,8 +4364,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bdcpy(sec_event.key_notif.bd_addr, bda);
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.key_notif.bd_name[0] = 0;
         }
@@ -4383,7 +4385,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 
     case BTM_LE_NC_REQ_EVT:
         bdcpy(sec_event.key_notif.bd_addr, bda);
-        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN));
+        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
         sec_event.ble_req.bd_name[BD_NAME_LEN] = 0;
         sec_event.key_notif.passkey = p_data->key_notif;
         bta_dm_cb.p_sec_cback(BTA_DM_BLE_NC_REQ_EVT, &sec_event);
@@ -4403,8 +4405,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 #endif
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.auth_cmpl.bd_name[0] = 0;
         }
@@ -5685,7 +5686,7 @@ static void bta_dm_gatt_disc_result(tBTA_GATT_ID service_id)
 
         /* send result back to app now, one by one */
         bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name,bta_dm_get_remname(), (BD_NAME_LEN - 1));
         result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
         memcpy(&result.disc_ble_res.service, &service_id.uuid, sizeof(tBT_UUID));
 
@@ -5727,8 +5728,7 @@ static void bta_dm_gatt_disc_complete(UINT16 conn_id, tBTA_GATT_STATUS status)
             p_msg->disc_result.result.disc_res.num_uuids = 0;
             p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;

components/bt/bluedroid/bta/dm/bta_dm_api.c

@@ -174,7 +174,7 @@ void BTA_DmSetDeviceName(const char *p_name)
     if ((p_msg = (tBTA_DM_API_SET_NAME *) osi_malloc(sizeof(tBTA_DM_API_SET_NAME))) != NULL) {
         p_msg->hdr.event = BTA_DM_API_SET_NAME_EVT;
         /* truncate the name if needed */
-        BCM_STRNCPY_S((char *)p_msg->name, sizeof(p_msg->name), p_name, BD_NAME_LEN - 1);
+        BCM_STRNCPY_S((char *)p_msg->name, p_name, BD_NAME_LEN - 1);
         p_msg->name[BD_NAME_LEN - 1] = 0;
 
         bta_sys_sendmsg(p_msg);
@@ -206,11 +206,11 @@ void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb)
     }
 }
 
-void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb)
+void BTA_DmReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb)
 {
     tBTA_DM_API_READ_RSSI *p_msg;
     if ((p_msg = (tBTA_DM_API_READ_RSSI *)osi_malloc(sizeof(tBTA_DM_API_READ_RSSI))) != NULL) {
-        p_msg->hdr.event = BTA_DM_API_BLE_READ_RSSI_EVT;
+        p_msg->hdr.event = BTA_DM_API_READ_RSSI_EVT;
         memcpy(p_msg->remote_addr, remote_addr, sizeof(BD_ADDR));
         p_msg->transport = transport;
         p_msg->read_rssi_cb = cmpl_cb;
@@ -586,6 +586,7 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
     }
 }
 #endif ///BT_SSP_INCLUDED == TRUE
+#endif  ///SMP_INCLUDED == TRUE
 /*******************************************************************************
 **
 ** Function         BTA_DmAddDevice
@@ -599,7 +600,8 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
 *******************************************************************************/
 void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
                      tBTA_SERVICE_MASK trusted_mask, BOOLEAN is_trusted,
-                     UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length)
+                     UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length,
+                     UINT8 sc_support)
 {
 
     tBTA_DM_API_ADD_DEVICE *p_msg;
@@ -612,6 +614,7 @@ void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
         p_msg->tm = trusted_mask;
         p_msg->is_trusted = is_trusted;
         p_msg->io_cap = io_cap;
+        p_msg->sc_support = sc_support;
 
         if (link_key) {
             p_msg->link_key_known = TRUE;
@@ -662,7 +665,6 @@ tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 
     return BTA_SUCCESS;
 }
-#endif  ///SMP_INCLUDED == TRUE
 
 /*******************************************************************************
 **
@@ -736,7 +738,7 @@ UINT16 BTA_DmGetConnectionState( BD_ADDR bd_addr )
 **
 ** Description      This function adds a DI record to the local SDP database.
 **
-** Returns          BTA_SUCCESS if record set sucessfully, otherwise error code.
+** Returns          BTA_SUCCESS if record set successfully, otherwise error code.
 **
 *******************************************************************************/
 tBTA_STATUS BTA_DmSetLocalDiRecord( tBTA_DI_RECORD *p_device_info,
@@ -1819,7 +1821,7 @@ void BTA_DmBleConfigLocalIcon(uint16_t icon)
 **                  p_cback: callback function associated to this adv instance.
 **                  p_ref: reference data pointer to this adv instance.
 **
-** Returns          BTA_SUCCESS if command started sucessfully; otherwise failure.
+** Returns          BTA_SUCCESS if command started successfully; otherwise failure.
 **
 *******************************************************************************/
 void BTA_BleEnableAdvInstance (tBTA_BLE_ADV_PARAMS *p_params,
@@ -1857,7 +1859,7 @@ void BTA_BleEnableAdvInstance (tBTA_BLE_ADV_PARAMS *p_params,
 ** Parameters       inst_id: Adv instance to update the parameter.
 **                  p_params: pointer to the adv parameter structure.
 **
-** Returns          BTA_SUCCESS if command started sucessfully; otherwise failure.
+** Returns          BTA_SUCCESS if command started successfully; otherwise failure.
 **
 *******************************************************************************/
 void BTA_BleUpdateAdvInstParam (UINT8 inst_id, tBTA_BLE_ADV_PARAMS *p_params)
@@ -1892,7 +1894,7 @@ void BTA_BleUpdateAdvInstParam (UINT8 inst_id, tBTA_BLE_ADV_PARAMS *p_params)
 **                  memory space can not be freed until BTA_BLE_MULTI_ADV_DATA_EVT
 **                  is sent to application.
 **
-** Returns          BTA_SUCCESS if command started sucessfully; otherwise failure.
+** Returns          BTA_SUCCESS if command started successfully; otherwise failure.
 **
 *******************************************************************************/
 void BTA_BleCfgAdvInstData (UINT8 inst_id, BOOLEAN is_scan_rsp,
@@ -1925,7 +1927,7 @@ void BTA_BleCfgAdvInstData (UINT8 inst_id, BOOLEAN is_scan_rsp,
 **
 ** Parameter        inst_id: instance ID to disable.
 **
-** Returns          BTA_SUCCESS if command started sucessfully; otherwise failure.
+** Returns          BTA_SUCCESS if command started successfully; otherwise failure.
 **
 *******************************************************************************/
 void BTA_BleDisableAdvInstance (UINT8  inst_id)     //this function just used for vendor debug

components/bt/bluedroid/bta/dm/bta_dm_cfg.c

@@ -228,9 +228,9 @@ tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC bta_dm_pm_spec[BTA_DM_NUM_PM_SPEC] = {
             {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
             {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app open */
             {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app close */
-            {{BTA_DM_PM_SNIFF3, 7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
-            {{BTA_DM_PM_SNIFF,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
-            {{BTA_DM_PM_SNIFF,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
             {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},   /* busy */
             {{BTA_DM_PM_RETRY,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}}    /* mode change retry */
         }

components/bt/bluedroid/bta/dm/bta_dm_co.c

@@ -51,6 +51,7 @@ tBTE_APPL_CFG bte_appl_cfg = {
     BTM_BLE_MIN_KEY_SIZE,
     BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_DISABLE,
     BTM_BLE_OOB_DISABLE,
+    BTM_BLE_APPL_ENC_KEY_SIZE,
 };
 #endif
 
@@ -232,8 +233,8 @@ void bta_dm_co_loc_oob(BOOLEAN valid, BT_OCTET16 c, BT_OCTET16 r)
 *******************************************************************************/
 void bta_dm_co_rmt_oob(BD_ADDR bd_addr)
 {
-    BT_OCTET16 p_c;
-    BT_OCTET16 p_r;
+    BT_OCTET16 p_c = {0};
+    BT_OCTET16 p_r = {0};
     BOOLEAN result = FALSE;
 
 #ifdef BTIF_DM_OOB_TEST
@@ -427,6 +428,17 @@ void bta_dm_co_ble_set_min_key_size(UINT8 ble_key_size)
 #endif  ///SMP_INCLUDED == TRUE
 }
 
+void bta_dm_co_ble_set_appl_enc_key_size(UINT8 ble_key_size)
+{
+#if (SMP_INCLUDED == TRUE)
+    if(ble_key_size >= bte_appl_cfg.ble_min_key_size && ble_key_size <= bte_appl_cfg.ble_max_key_size) {
+        bte_appl_cfg.ble_appl_enc_key_size = ble_key_size;
+    } else {
+        APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
+    }
+#endif  ///SMP_INCLUDED == TRUE
+}
+
 void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable)
 {
 #if (SMP_INCLUDED == TRUE)

components/bt/bluedroid/bta/dm/bta_dm_main.c

@@ -28,6 +28,7 @@
 #include "osi/allocator.h"
 #include <string.h>
 
+#include "esp_coexist.h"
 
 /*****************************************************************************
 ** Constants and types
@@ -158,7 +159,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
     bta_dm_remove_device,                   /* BTA_DM_API_REMOVE_DEVICE_EVT */
     bta_dm_update_white_list,               /* BTA_DM_API_UPDATE_WHITE_LIST_EVT */
     bta_dm_ble_read_adv_tx_power,           /* BTA_DM_API_BLE_READ_ADV_TX_POWER_EVT */
-    bta_dm_ble_read_rssi,                   /* BTA_DM_API_BLE_READ_RSSI_EVT */
+    bta_dm_read_rssi,                       /* BTA_DM_API_READ_RSSI_EVT */
     bta_dm_ble_update_duplicate_exceptional_list,/* BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT */
 };
 
@@ -452,3 +453,27 @@ BOOLEAN bta_dm_search_sm_execute(BT_HDR *p_msg)
     return TRUE;
 }
 
+void BTA_DmCoexEventTrigger(uint32_t event)
+{
+    switch(event) {
+    case BTA_COEX_EVT_SCAN_STARTED:
+    case BTA_COEX_EVT_SCAN_STOPPED:
+    case BTA_COEX_EVT_SNIFF_ENTER:
+    case BTA_COEX_EVT_SNIFF_EXIT:
+    case BTA_COEX_EVT_A2DP_PAUSED_ENTER:
+    case BTA_COEX_EVT_A2DP_PAUSED_EXIT:
+    case BTA_COEX_EVT_ACL_CONNECTED:
+    case BTA_COEX_EVT_ACL_DISCONNECTED:
+        break;
+    case BTA_COEX_EVT_STREAMING_STARTED:
+        esp_coex_status_bit_set(ESP_COEX_ST_TYPE_BT, ESP_COEX_BT_ST_A2DP_STREAMING);
+        esp_coex_status_bit_clear(ESP_COEX_ST_TYPE_BT, ESP_COEX_BT_ST_A2DP_PAUSED);
+        break;
+    case BTA_COEX_EVT_STREAMING_STOPPED:
+        esp_coex_status_bit_clear(ESP_COEX_ST_TYPE_BT, ESP_COEX_BT_ST_A2DP_STREAMING);
+        esp_coex_status_bit_clear(ESP_COEX_ST_TYPE_BT, ESP_COEX_BT_ST_A2DP_PAUSED);
+        break;
+    default:
+        break;
+    }
+}

components/bt/bluedroid/bta/dm/include/bta_dm_int.h

@@ -25,7 +25,7 @@
 #define BTA_DM_INT_H
 
 #include "common/bt_target.h"
-
+#include "freertos/semphr.h"
 #if (BLE_INCLUDED == TRUE && (defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE))
 #include "bta/bta_gatt_api.h"
 #endif
@@ -155,7 +155,7 @@ enum {
     BTA_DM_API_REMOVE_DEVICE_EVT,
     BTA_DM_API_UPDATE_WHITE_LIST_EVT,
     BTA_DM_API_BLE_READ_ADV_TX_POWER_EVT,
-    BTA_DM_API_BLE_READ_RSSI_EVT,
+    BTA_DM_API_READ_RSSI_EVT,
     BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT,
     BTA_DM_MAX_EVT
 };
@@ -384,6 +384,7 @@ typedef struct {
     UINT8           new_role;
     BD_ADDR         bd_addr;
     UINT8           hci_status;
+    BOOLEAN         sc_downgrade;
 #if BLE_INCLUDED == TRUE
     UINT16          handle;
     tBT_TRANSPORT   transport;
@@ -425,6 +426,7 @@ typedef struct {
     BD_NAME             bd_name;
     UINT8               features[BTA_FEATURE_BYTES_PER_PAGE * (BTA_EXT_FEATURES_PAGE_MAX + 1)];
     UINT8               pin_length;
+    UINT8               sc_support;
 } tBTA_DM_API_ADD_DEVICE;
 
 /* data type for BTA_DM_API_REMOVE_ACL_EVT */
@@ -1038,7 +1040,7 @@ typedef struct {
 
 
     tBTA_DM_ENCRYPT_CBACK      *p_encrypt_cback;
-    TIMER_LIST_ENT              switch_delay_timer;
+    TIMER_LIST_ENT              switch_delay_timer[BTA_DM_NUM_PEER_DEVICE];
 
 } tBTA_DM_CB;
 
@@ -1209,6 +1211,7 @@ extern tBTA_DM_DI_CB  bta_dm_di_cb;
 #else
 extern tBTA_DM_DI_CB *bta_dm_di_cb_ptr;
 #define bta_dm_di_cb (*bta_dm_di_cb_ptr)
+SemaphoreHandle_t deinit_semaphore;
 #endif
 
 extern BOOLEAN bta_dm_sm_execute(BT_HDR *p_msg);
@@ -1223,7 +1226,7 @@ extern void bta_dm_disable (tBTA_DM_MSG *p_data);
 extern void bta_dm_set_dev_name (tBTA_DM_MSG *p_data);
 extern void bta_dm_update_white_list(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_read_adv_tx_power(tBTA_DM_MSG *p_data);
-extern void bta_dm_ble_read_rssi(tBTA_DM_MSG *p_data);
+extern void bta_dm_read_rssi(tBTA_DM_MSG *p_data);
 extern void bta_dm_set_visibility (tBTA_DM_MSG *p_data);
 
 extern void bta_dm_set_scan_config(tBTA_DM_MSG *p_data);

components/bt/bluedroid/bta/gatt/bta_gattc_act.c

@@ -488,9 +488,14 @@ void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
     tBTA_GATTC_DATA gattc_data;
     BOOLEAN found_app = FALSE;
+    tGATT_TCB *p_tcb;
 
-    tGATT_TCB *p_tcb = gatt_find_tcb_by_addr(p_data->api_conn.remote_bda, BT_TRANSPORT_LE);
-    if(p_tcb && p_clcb && p_data) {
+    if (!p_clcb || !p_data) {
+        return;
+    }
+
+    p_tcb = gatt_find_tcb_by_addr(p_data->api_conn.remote_bda, BT_TRANSPORT_LE);
+    if(p_tcb) {
         found_app = gatt_find_specific_app_in_hold_link(p_tcb, p_clcb->p_rcb->client_if);
     }
     /* open/hold a connection */
@@ -729,7 +734,7 @@ void bta_gattc_conncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
     if (p_rcb) {
         bta_gattc_send_connect_cback(p_rcb,
                                      p_data->int_conn.remote_bda,
-                                     p_data->int_conn.hdr.layer_specific);
+                                     p_data->int_conn.hdr.layer_specific, p_data->int_conn.conn_params);
 
     }
 }
@@ -745,6 +750,8 @@ void bta_gattc_conncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 void bta_gattc_disconncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 {
     if (p_rcb) {
+        // Clear up the notification registration information by BD_ADDR
+        bta_gattc_clear_notif_registration_by_bda(p_rcb, p_data->int_conn.remote_bda);
         bta_gattc_send_disconnect_cback(p_rcb,
                                      p_data->int_conn.reason,
                                      p_data->int_conn.remote_bda,
@@ -1097,6 +1104,41 @@ void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 }
 /*******************************************************************************
 **
+** Function         bta_gattc_read_by_type
+**
+** Description      Read an attribute
+**
+** Returns          None.
+**
+*******************************************************************************/
+void bta_gattc_read_by_type(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
+{
+    if (!bta_gattc_enqueue(p_clcb, p_data)) {
+        return;
+    }
+
+    tGATT_READ_PARAM    read_param;
+    memset (&read_param, 0 ,sizeof(tGATT_READ_PARAM));
+    read_param.service.auth_req = p_data->api_read.auth_req;
+    read_param.service.s_handle = p_data->api_read.s_handle;
+    read_param.service.e_handle = p_data->api_read.e_handle;
+    memcpy(&(read_param.service.uuid), &(p_data->api_read.uuid), sizeof(tBT_UUID));
+
+    tBTA_GATT_STATUS status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_BY_TYPE, &read_param);
+
+    /* read fail */
+    if (status != BTA_GATT_OK) {
+        /* Dequeue the data, if it was enqueued */
+        if (p_clcb->p_q_cmd == p_data) {
+            p_clcb->p_q_cmd = NULL;
+            bta_gattc_pop_command_to_send(p_clcb);
+        }
+
+        bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
+    }
+}
+/*******************************************************************************
+**
 ** Function         bta_gattc_read_multi
 **
 ** Description      read multiple
@@ -1115,7 +1157,7 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr;
             read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req;
             memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles,
-                                        sizeof(UINT16) * p_data->api_read_multi.num_attr);
+                    sizeof(UINT16) * p_data->api_read_multi.num_attr);
 
             status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE, &read_param);
         }
@@ -1390,7 +1432,7 @@ void  bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             return;
         }
         if (p_clcb->p_q_cmd->hdr.event != bta_gattc_opcode_to_int_evt[op - GATTC_OPTYPE_READ]) {
-            if (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT) {
+            if ((p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT)&&(p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_BY_TYPE_EVT)) {
                 mapped_op = p_clcb->p_q_cmd->hdr.event - BTA_GATTC_API_READ_EVT + GATTC_OPTYPE_READ;
                 if ( mapped_op > GATTC_OPTYPE_INDICATION) {
                     mapped_op = 0;
@@ -1649,6 +1691,16 @@ static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
 
         p_buf->int_conn.hdr.event            = connected ? BTA_GATTC_INT_CONN_EVT :
                                                BTA_GATTC_INT_DISCONN_EVT;
+        if(p_buf->int_conn.hdr.event == BTA_GATTC_INT_CONN_EVT) {
+            tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
+            if(p_lcb != NULL) {
+                p_buf->int_conn.conn_params.interval = p_lcb->current_used_conn_interval;
+                p_buf->int_conn.conn_params.latency = p_lcb->current_used_conn_latency;
+                p_buf->int_conn.conn_params.timeout = p_lcb->current_used_conn_timeout;
+            } else {
+                APPL_TRACE_WARNING("%s not found connection parameters of the device ", __func__);
+            }
+        } 
         p_buf->int_conn.hdr.layer_specific   = conn_id;
         p_buf->int_conn.client_if            = gattc_if;
         p_buf->int_conn.role                 = L2CA_GetBleConnRole(bda);

components/bt/bluedroid/bta/gatt/bta_gattc_api.c

@@ -31,7 +31,7 @@
 #include "bta/bta_sys.h"
 #include "bta/bta_gatt_api.h"
 #include "bta_gattc_int.h"
-
+#include "stack/l2c_api.h"
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -76,7 +76,7 @@ void BTA_GATTC_Disable(void)
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTC module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_client_cb - pointer to the application callback function.
 **
 ** Returns          None
@@ -298,7 +298,7 @@ void BTA_GATTC_ServiceSearchRequest (UINT16 conn_id, tBT_UUID *p_srvc_uuid)
 ** Returns          returns list_t of tBTA_GATTC_SERVICE or NULL.
 **
 *******************************************************************************/
-const list_t* BTA_GATTC_GetServices(UINT16 conn_id) 
+const list_t* BTA_GATTC_GetServices(UINT16 conn_id)
 {
     return bta_gattc_get_services(conn_id);
 }
@@ -315,7 +315,7 @@ const list_t* BTA_GATTC_GetServices(UINT16 conn_id)
 ** Returns          returns pointer to tBTA_GATTC_CHARACTERISTIC or NULL.
 **
 *******************************************************************************/
-const tBTA_GATTC_CHARACTERISTIC* BTA_GATTC_GetCharacteristic(UINT16 conn_id, UINT16 handle) 
+const tBTA_GATTC_CHARACTERISTIC* BTA_GATTC_GetCharacteristic(UINT16 conn_id, UINT16 handle)
 {
     return bta_gattc_get_characteristic(conn_id, handle);
 }
@@ -338,13 +338,13 @@ const tBTA_GATTC_DESCRIPTOR* BTA_GATTC_GetDescriptor(UINT16 conn_id, UINT16 hand
 }
 
 void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid,
-                                  btgatt_db_element_t **db, int *count)
+                                  btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_service_with_uuid(conn_id, svc_uuid, db, count);
 }
 
 void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                          btgatt_db_element_t **db, int *count)
+                          btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_ALL_CHAR,
@@ -359,7 +359,7 @@ void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle
 }
 
 void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
-                                btgatt_db_element_t **db, int *count)
+                                btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_ALL_DESCRI,
@@ -374,7 +374,7 @@ void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
 }
 
 void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid,
-                             btgatt_db_element_t **db, int *count)
+                             btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_CHAR_BY_UUID,
@@ -390,7 +390,7 @@ void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_han
 
 void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t end_handle,
                               tBT_UUID char_uuid, tBT_UUID descr_uuid,
-                              btgatt_db_element_t **db, int *count)
+                              btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_DESCRI_BY_UUID,
@@ -405,7 +405,7 @@ void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t en
 }
 
 void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid,
-                                    btgatt_db_element_t **db, int *count)
+                                    btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_DESCRI_BY_HANDLE,
@@ -420,7 +420,7 @@ void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID
 }
 
 void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                 tBT_UUID *incl_uuid, btgatt_db_element_t **db, int *count)
+                                 tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_INCLUDE_SVC,
@@ -434,13 +434,13 @@ void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end
                                    count);
 }
 
-void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count)
+void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count)
 {
     bta_gattc_get_db_size_handle(conn_id, start_handle, end_handle, count);
 }
 
 void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                               UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count)
+                               UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count)
 {
     bta_gattc_get_db_size_with_type_handle(conn_id, type, start_handle, end_handle, char_handle, count);
 }
@@ -459,7 +459,7 @@ void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
 **
 *******************************************************************************/
 void  BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                          btgatt_db_element_t **db, int *count)
+                          btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_gatt_db(conn_id, start_handle, end_handle, db, count);
 }
@@ -562,6 +562,39 @@ void BTA_GATTC_ReadMultiple(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi,
     return;
 }
 
+/*******************************************************************************
+**
+** Function         BTA_GATTC_Read_by_type
+**
+** Description      This function is called to read a attribute value by uuid
+**
+** Parameters       conn_id - connection ID.
+**                  s_handle - start handle.
+**                  e_handle - end hanle
+**                  uuid - The attribute UUID.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_GATTC_Read_by_type(UINT16 conn_id, UINT16 s_handle,UINT16 e_handle, tBT_UUID *uuid, tBTA_GATT_AUTH_REQ auth_req)
+{
+    tBTA_GATTC_API_READ  *p_buf;
+
+    if ((p_buf = (tBTA_GATTC_API_READ *) osi_malloc(sizeof(tBTA_GATTC_API_READ))) != NULL) {
+        memset(p_buf, 0, sizeof(tBTA_GATTC_API_READ));
+
+        p_buf->hdr.event = BTA_GATTC_API_READ_BY_TYPE_EVT;
+        p_buf->hdr.layer_specific = conn_id;
+        p_buf->auth_req = auth_req;
+        p_buf->s_handle = s_handle;
+        p_buf->e_handle = e_handle;
+        memcpy(&(p_buf->uuid), uuid, sizeof(tBT_UUID));
+        p_buf->cmpl_evt = BTA_GATTC_READ_CHAR_EVT;
+
+        bta_sys_sendmsg(p_buf);
+    }
+    return;
+}
 
 /*******************************************************************************
 **
@@ -603,6 +636,10 @@ void BTA_GATTC_WriteCharValue ( UINT16 conn_id,
             memcpy(p_buf->p_value, p_value, len);
         }
 
+        if(write_type == BTA_GATTC_TYPE_WRITE_NO_RSP){
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTC_NUM, NULL);
+            l2ble_update_att_acl_pkt_num(L2CA_ADD_BTU_NUM, NULL);
+        }
         bta_sys_sendmsg(p_buf);
     }
     return;
@@ -650,6 +687,10 @@ void BTA_GATTC_WriteCharDescr (UINT16 conn_id,
             memcpy(p_buf->p_value, p_data->p_value, p_data->len);
         }
 
+        if(write_type == BTA_GATTC_TYPE_WRITE_NO_RSP){
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTC_NUM, NULL);
+            l2ble_update_att_acl_pkt_num(L2CA_ADD_BTU_NUM, NULL);
+        }
         bta_sys_sendmsg(p_buf);
     }
     return;
@@ -718,7 +759,7 @@ void BTA_GATTC_PrepareWriteCharDescr  (UINT16 conn_id, UINT16 handle,
                                        tBTA_GATT_AUTH_REQ auth_req)
 {
     tBTA_GATTC_API_WRITE  *p_buf;
-    UINT16  len = sizeof(tBTA_GATTC_API_WRITE) + p_data->len;
+    UINT16  len = sizeof(tBTA_GATTC_API_WRITE);
 
     if (p_data != NULL) {
         len += p_data->len;
@@ -957,7 +998,7 @@ void BTA_GATTC_CacheAssoc(tBTA_GATTC_IF client_if, BD_ADDR src_addr, BD_ADDR ass
         memcpy(p_buf->assoc_addr, assoc_addr, sizeof(BD_ADDR));
 
         bta_sys_sendmsg(p_buf);
-        
+
     }
     return;
 }

components/bt/bluedroid/bta/gatt/bta_gattc_cache.c

@@ -1227,7 +1227,7 @@ tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle)
 
 void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid,
                                      btgatt_db_element_t **svc_db,
-                                     int *count)
+                                     UINT16 *count)
 {
     const list_t* svc = bta_gattc_get_services(conn_id);
     if(!svc) {
@@ -1301,7 +1301,7 @@ void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       tBT_UUID *descr_uuid,
                                                       UINT16 start_handle, UINT16 end_handle,
                                                       btgatt_db_element_t **char_db,
-                                                      int *count)
+                                                      UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1666,7 +1666,7 @@ static size_t bta_gattc_get_db_size(list_t *services,
     return db_size;
 }
 
-void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count)
+void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1685,7 +1685,7 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
 }
 
 void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                            UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count)
+                                            UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1732,7 +1732,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
 static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
                                        UINT16 start_handle, UINT16 end_handle,
                                        btgatt_db_element_t **db,
-                                       int *count)
+                                       UINT16 *count)
 {
     APPL_TRACE_DEBUG("%s: start_handle 0x%04x, end_handle 0x%04x",
                      __func__, start_handle, end_handle);
@@ -1880,7 +1880,7 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
 ** Returns          None.
 **
 *******************************************************************************/
-void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, int *count)
+void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 

components/bt/bluedroid/bta/gatt/bta_gattc_co.c

@@ -154,6 +154,10 @@ static void cacheReset(BD_ADDR bda)
             cache_env.cache_addr[index].is_open = FALSE;
         } else {
             cacheOpen(bda, false, &index);
+            if (index == INVALID_ADDR_NUM) {
+                APPL_TRACE_ERROR("%s INVALID ADDR NUM", __func__);
+                return;
+            }
             if (cache_env.cache_addr[index].is_open) {
                 nvs_erase_all(cache_env.cache_addr[index].cache_fp);
                 nvs_close(cache_env.cache_addr[index].cache_fp);

components/bt/bluedroid/bta/gatt/bta_gattc_main.c

@@ -65,6 +65,7 @@ enum {
     BTA_GATTC_DISC_CLOSE,
     BTA_GATTC_RESTART_DISCOVER,
     BTA_GATTC_CFG_MTU,
+    BTA_GATTC_READ_BY_TYPE,
 
     BTA_GATTC_IGNORE
 };
@@ -98,7 +99,8 @@ const tBTA_GATTC_ACTION bta_gattc_action[] = {
     bta_gattc_ignore_op_cmpl,
     bta_gattc_disc_close,
     bta_gattc_restart_discover,
-    bta_gattc_cfg_mtu
+    bta_gattc_cfg_mtu,
+    bta_gattc_read_by_type
 };
 
 
@@ -133,6 +135,7 @@ static const UINT8 bta_gattc_st_idle[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE,            BTA_GATTC_IDLE_ST},
     /* BTA_GATTC_INT_DISCONN_EVT       */    {BTA_GATTC_IGNORE,            BTA_GATTC_IDLE_ST},
 
+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_FAIL,              BTA_GATTC_IDLE_ST},
 };
 
 /* state table for wait for open state */
@@ -161,6 +164,7 @@ static const UINT8 bta_gattc_st_w4_conn[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE,             BTA_GATTC_W4_CONN_ST},
     /* BTA_GATTC_INT_DISCONN_EVT      */     {BTA_GATTC_OPEN_FAIL,          BTA_GATTC_IDLE_ST},
 
+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_FAIL,               BTA_GATTC_W4_CONN_ST},
 };
 
 /* state table for open state */
@@ -190,6 +194,7 @@ static const UINT8 bta_gattc_st_connected[][BTA_GATTC_NUM_COLS] = {
 
     /* BTA_GATTC_INT_DISCONN_EVT        */   {BTA_GATTC_CLOSE,              BTA_GATTC_IDLE_ST},
 
+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_READ_BY_TYPE,       BTA_GATTC_CONN_ST},
 };
 
 /* state table for discover state */
@@ -218,6 +223,7 @@ static const UINT8 bta_gattc_st_discover[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE_OP_CMPL,     BTA_GATTC_DISCOVER_ST},
     /* BTA_GATTC_INT_DISCONN_EVT        */   {BTA_GATTC_CLOSE,              BTA_GATTC_IDLE_ST},
 
+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_Q_CMD,              BTA_GATTC_DISCOVER_ST},
 };
 
 /* type for state table */
@@ -470,6 +476,8 @@ static char *gattc_evt_code(tBTA_GATTC_INT_EVT evt_code)
         return "BTA_GATTC_API_DISABLE_EVT";
     case BTA_GATTC_API_CFG_MTU_EVT:
         return "BTA_GATTC_API_CFG_MTU_EVT";
+    case BTA_GATTC_API_READ_BY_TYPE_EVT:
+        return "BTA_GATTC_API_READ_BY_TYPE_EVT";
     default:
         return "unknown GATTC event code";
     }

components/bt/bluedroid/bta/gatt/bta_gattc_utils.c

@@ -306,8 +306,11 @@ void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB *p_clcb)
                 p_srcb->p_srvc_cache = NULL;
             }
         }
-        osi_free(p_clcb->p_q_cmd);
-        p_clcb->p_q_cmd = NULL;
+
+        if ( p_clcb->p_q_cmd != NULL && !list_contains(p_clcb->p_cmd_list, p_clcb->p_q_cmd)){
+            osi_free(p_clcb->p_q_cmd);
+            p_clcb->p_q_cmd = NULL;
+        }
         // don't forget to clear the command queue before dealloc the clcb.
         list_clear(p_clcb->p_cmd_list);
         osi_free((void *)p_clcb->p_cmd_list);
@@ -596,6 +599,30 @@ void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id,
     return;
 }
 
+/*******************************************************************************
+**
+** Function         bta_gattc_clear_notif_registration_by_bda
+**
+** Description      Clear up the notification registration information by BD_ADDR.
+**
+**
+** Returns          None.
+**
+*******************************************************************************/
+void bta_gattc_clear_notif_registration_by_bda(tBTA_GATTC_RCB *p_clrcb, BD_ADDR remote_bda)
+{
+    if(p_clrcb == NULL) {
+        return;
+    }
+    for (uint8_t i = 0 ; i < BTA_GATTC_NOTIF_REG_MAX; i ++) {
+        if (p_clrcb->notif_reg[i].in_use &&
+            !bdcmp(p_clrcb->notif_reg[i].remote_bda, remote_bda))
+        {
+            memset(&p_clrcb->notif_reg[i], 0, sizeof(tBTA_GATTC_NOTIF_REG));
+        }
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         bta_gattc_mark_bg_conn
@@ -738,7 +765,7 @@ void bta_gattc_send_open_cback( tBTA_GATTC_RCB *p_clreg, tBTA_GATT_STATUS status
 ** Returns
 **
 *******************************************************************************/
-void bta_gattc_send_connect_cback( tBTA_GATTC_RCB *p_clreg, BD_ADDR remote_bda, UINT16 conn_id)
+void bta_gattc_send_connect_cback( tBTA_GATTC_RCB *p_clreg, BD_ADDR remote_bda, UINT16 conn_id, tBTA_GATT_CONN_PARAMS conn_params)
 {
     tBTA_GATTC      cb_data;
 
@@ -747,6 +774,9 @@ void bta_gattc_send_connect_cback( tBTA_GATTC_RCB *p_clreg, BD_ADDR remote_bda,
 
         cb_data.connect.client_if = p_clreg->client_if;
         cb_data.connect.conn_id = conn_id;
+        cb_data.connect.conn_params.interval = conn_params.interval;
+        cb_data.connect.conn_params.latency = conn_params.latency;
+        cb_data.connect.conn_params.timeout = conn_params.timeout;
         bdcpy(cb_data.connect.remote_bda, remote_bda);
 
         (*p_clreg->p_cback)(BTA_GATTC_CONNECT_EVT, &cb_data);

components/bt/bluedroid/bta/gatt/bta_gatts_act.c

@@ -35,6 +35,8 @@
 #include "stack/btm_ble_api.h"
 #include <string.h>
 #include "osi/allocator.h"
+#include "stack/l2c_api.h"
+#include "l2c_int.h"
 
 static void bta_gatts_nv_save_cback(BOOLEAN is_saved, tGATTS_HNDL_RANGE *p_hndl_range);
 static BOOLEAN bta_gatts_nv_srv_chg_cback(tGATTS_SRV_CHG_CMD cmd, tGATTS_SRV_CHG_REQ *p_req,
@@ -672,6 +674,7 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                                                       p_msg->api_indicate.len,
                                                       p_msg->api_indicate.value);
             } else {
+                l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTU_NUM, NULL);
                 status = GATTS_HandleValueNotification (p_msg->api_indicate.hdr.layer_specific,
                                                         p_msg->api_indicate.attr_id,
                                                         p_msg->api_indicate.len,
@@ -965,7 +968,7 @@ static void bta_gatts_conn_cback (tGATT_IF gatt_if, BD_ADDR bda, UINT16 conn_id,
                                   BOOLEAN connected, tGATT_DISCONN_REASON reason,
                                   tGATT_TRANSPORT transport)
 {
-    tBTA_GATTS      cb_data;
+    tBTA_GATTS      cb_data = {0};
     UINT8           evt = connected ? BTA_GATTS_CONNECT_EVT : BTA_GATTS_DISCONNECT_EVT;
     tBTA_GATTS_RCB  *p_reg;
 
@@ -993,7 +996,16 @@ static void bta_gatts_conn_cback (tGATT_IF gatt_if, BD_ADDR bda, UINT16 conn_id,
                 bta_sys_conn_close( BTA_ID_GATTS , BTA_ALL_APP_ID, bda);
             }
         }
-
+        if(evt == BTA_GATTS_CONNECT_EVT) {
+            tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
+            if(p_lcb != NULL) {
+                cb_data.conn.conn_params.interval = p_lcb->current_used_conn_interval;
+                cb_data.conn.conn_params.latency = p_lcb->current_used_conn_latency;
+                cb_data.conn.conn_params.timeout = p_lcb->current_used_conn_timeout;
+            }else {
+                APPL_TRACE_WARNING("%s not found connection parameters of the device ", __func__);
+            }
+        }
         cb_data.conn.conn_id = conn_id;
         cb_data.conn.server_if = gatt_if;
         cb_data.conn.reason = reason;
@@ -1014,22 +1026,14 @@ static void bta_gatts_conn_cback (tGATT_IF gatt_if, BD_ADDR bda, UINT16 conn_id,
 ** Returns          none.
 **
 *******************************************************************************/
+extern void btc_congest_callback(tBTA_GATTS *param);
 static void bta_gatts_cong_cback (UINT16 conn_id, BOOLEAN congested)
 {
-    tBTA_GATTS_RCB *p_rcb;
-    tGATT_IF gatt_if;
-    tBTA_GATT_TRANSPORT transport;
     tBTA_GATTS cb_data;
 
-    if (GATT_GetConnectionInfor(conn_id, &gatt_if, cb_data.req_data.remote_bda, &transport)) {
-        p_rcb = bta_gatts_find_app_rcb_by_app_if(gatt_if);
+    cb_data.congest.conn_id = conn_id;
+    cb_data.congest.congested = congested;
 
-        if (p_rcb && p_rcb->p_cback) {
-            cb_data.congest.conn_id = conn_id;
-            cb_data.congest.congested = congested;
-
-            (*p_rcb->p_cback)(BTA_GATTS_CONGEST_EVT, &cb_data);
-        }
-    }
+    btc_congest_callback(&cb_data);
 }
 #endif /* GATTS_INCLUDED */

components/bt/bluedroid/bta/gatt/bta_gatts_api.c

@@ -31,7 +31,7 @@
 #include "bta/bta_gatt_api.h"
 #include "bta_gatts_int.h"
 #include "osi/allocator.h"
-
+#include "stack/l2c_api.h"
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -76,7 +76,7 @@ void BTA_GATTS_Disable(void)
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTS module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_cback - pointer to the application callback function.
 **
 ** Returns          None
@@ -347,7 +347,7 @@ void  BTA_GATTS_DeleteService(UINT16 service_id)
 ** Description      This function is called to start a service.
 **
 ** Parameters       service_id: the service ID to be started.
-**                  sup_transport: supported trasnport.
+**                  sup_transport: supported transport.
 **
 ** Returns          None.
 **
@@ -426,6 +426,11 @@ void BTA_GATTS_HandleValueIndication (UINT16 conn_id, UINT16 attr_id, UINT16 dat
             memcpy(p_buf->value, p_data, data_len);
 
         }
+
+        if(need_confirm == false){
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTC_NUM, NULL);
+            l2ble_update_att_acl_pkt_num(L2CA_ADD_BTU_NUM, NULL);
+        }
         bta_sys_sendmsg(p_buf);
     }
     return;

components/bt/bluedroid/bta/gatt/include/bta_gattc_int.h

@@ -59,6 +59,8 @@ enum {
     BTA_GATTC_OP_CMPL_EVT,
     BTA_GATTC_INT_DISCONN_EVT,
 
+    BTA_GATTC_API_READ_BY_TYPE_EVT,
+
     BTA_GATTC_INT_START_IF_EVT,
     BTA_GATTC_API_REG_EVT,
     BTA_GATTC_API_DEREG_EVT,
@@ -136,6 +138,9 @@ typedef struct {
     BT_HDR                  hdr;
     tBTA_GATT_AUTH_REQ      auth_req;
     UINT16                  handle;
+    UINT16                  s_handle;
+    UINT16                  e_handle;
+    tBT_UUID                uuid;
     tBTA_GATTC_EVT          cmpl_evt;
 } tBTA_GATTC_API_READ;
 
@@ -215,6 +220,7 @@ typedef struct {
     tBT_TRANSPORT           transport;
     tGATT_DISCONN_REASON    reason;
     BOOLEAN                 already_connect;
+    tBTA_GATT_CONN_PARAMS   conn_params;
 } tBTA_GATTC_INT_CONN;
 
 typedef struct {
@@ -449,6 +455,7 @@ extern void bta_gattc_disc_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_dat
 extern void bta_gattc_start_discover(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
+extern void bta_gattc_read_by_type(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_q_cmd(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
@@ -466,7 +473,7 @@ extern void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *
 extern void bta_gattc_cancel_bk_conn(tBTA_GATTC_API_CANCEL_OPEN *p_data);
 extern void bta_gattc_send_open_cback( tBTA_GATTC_RCB *p_clreg, tBTA_GATT_STATUS status,
                                        BD_ADDR remote_bda, UINT16 conn_id, tBTA_TRANSPORT transport,  UINT16 mtu);
-extern void bta_gattc_send_connect_cback( tBTA_GATTC_RCB *p_clreg, BD_ADDR remote_bda, UINT16 conn_id);
+extern void bta_gattc_send_connect_cback( tBTA_GATTC_RCB *p_clreg, BD_ADDR remote_bda, UINT16 conn_id, tBTA_GATT_CONN_PARAMS conn_params);
 extern void bta_gattc_send_disconnect_cback( tBTA_GATTC_RCB *p_clreg, tGATT_DISCONN_REASON reason,
                                 BD_ADDR remote_bda, UINT16 conn_id);
 extern void bta_gattc_process_api_refresh(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg);
@@ -498,6 +505,7 @@ extern BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR_PTR rem
 extern BOOLEAN bta_gattc_check_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR remote_bda, UINT8 role);
 extern UINT8 bta_gattc_num_reg_app(void);
 extern void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id, UINT16 start_handle, UINT16 end_handle);
+extern void bta_gattc_clear_notif_registration_by_bda(tBTA_GATTC_RCB *p_clrcb, BD_ADDR remote_bda);
 extern tBTA_GATTC_SERV * bta_gattc_find_srvr_cache(BD_ADDR bda);
 
 /* discovery functions */
@@ -511,12 +519,12 @@ extern const tBTA_GATTC_SERVICE* bta_gattc_get_service_for_handle(UINT16 conn_id
 tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle);
 extern tBTA_GATTC_CHARACTERISTIC* bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle);
 extern tBTA_GATTC_DESCRIPTOR* bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle);
-extern void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count);
+extern void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count);
 extern void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                                   UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count);
+                                                   UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count);
 extern void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid,
                                             btgatt_db_element_t **svc_db,
-                                            int *count);
+                                            UINT16 *count);
 
 extern void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       bt_gatt_get_db_op_t op,
@@ -526,9 +534,9 @@ extern void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       tBT_UUID *descr_uuid,
                                                       UINT16 start_handle, UINT16 end_handle,
                                                       btgatt_db_element_t **char_db,
-                                                      int *count);
+                                                      UINT16 *count);
 
-extern void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, int *count);
+extern void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count);
 
 extern tBTA_GATT_STATUS bta_gattc_init_cache(tBTA_GATTC_SERV *p_srvc_cb);
 extern void bta_gattc_rebuild_cache(tBTA_GATTC_SERV *p_srcv, UINT16 num_attr, tBTA_GATTC_NV_ATTR *attr);

components/bt/bluedroid/bta/hf_client/bta_hf_client_api.c

@@ -141,7 +141,7 @@ void BTA_HfClientRegister(tBTA_SEC sec_mask, tBTA_HF_CLIENT_FEAT features,
         p_buf->features = features;
         p_buf->sec_mask = sec_mask;
         if (p_service_name) {
-            BCM_STRNCPY_S(p_buf->name, BTA_SERVICE_NAME_LEN + 1, p_service_name, BTA_SERVICE_NAME_LEN);
+            BCM_STRNCPY_S(p_buf->name, p_service_name, BTA_SERVICE_NAME_LEN);
             p_buf->name[BTA_SERVICE_NAME_LEN] = 0;
         } else {
             p_buf->name[0] = '\0';

components/bt/bluedroid/bta/hf_client/bta_hf_client_at.c

@@ -75,12 +75,12 @@ typedef struct {
 /* CIND: storage room for indicators value range and their statuses */
 static const tBTA_HF_CLIENT_INDICATOR bta_hf_client_indicators[BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT] = {
     /* name                                | min | max | name length - used by parser */
-    {BTA_HF_CLIENT_INDICATOR_BATTERYCHG,     0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_BATTERYCHG)},
-    {BTA_HF_CLIENT_INDICATOR_SIGNAL,         0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_SIGNAL)},
-    {BTA_HF_CLIENT_INDICATOR_SERVICE,        0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_SERVICE)},
     {BTA_HF_CLIENT_INDICATOR_CALL,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_CALL)},
-    {BTA_HF_CLIENT_INDICATOR_ROAM,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_ROAM)},
     {BTA_HF_CLIENT_INDICATOR_CALLSETUP,      0,   3,    sizeof(BTA_HF_CLIENT_INDICATOR_CALLSETUP)},
+    {BTA_HF_CLIENT_INDICATOR_SERVICE,        0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_SERVICE)},
+    {BTA_HF_CLIENT_INDICATOR_SIGNAL,         0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_SIGNAL)},
+    {BTA_HF_CLIENT_INDICATOR_ROAM,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_ROAM)},
+    {BTA_HF_CLIENT_INDICATOR_BATTERYCHG,     0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_BATTERYCHG)},
     {BTA_HF_CLIENT_INDICATOR_CALLHELD,       0,   2,    sizeof(BTA_HF_CLIENT_INDICATOR_CALLHELD)}
 };
 
@@ -94,7 +94,7 @@ UINT32 service_index = 0;
 BOOLEAN service_availability = TRUE;
 /* helper functions for handling AT commands queueing */
 
-static void bta_hf_client_handle_ok();
+static void bta_hf_client_handle_ok(void);
 
 static void bta_hf_client_clear_queued_at(void)
 {
@@ -268,7 +268,7 @@ static void bta_hf_client_start_at_hold_timer(void)
 **   No buffer parsing is being done here.
 *******************************************************************************/
 
-static void bta_hf_client_handle_ok()
+static void bta_hf_client_handle_ok(void)
 {
     APPL_TRACE_DEBUG("%s", __FUNCTION__);
 
@@ -342,7 +342,7 @@ static void bta_hf_client_handle_error(tBTA_HF_CLIENT_AT_RESULT_TYPE type, UINT1
     bta_hf_client_send_queued_at();
 }
 
-static void bta_hf_client_handle_ring()
+static void bta_hf_client_handle_ring(void)
 {
     APPL_TRACE_DEBUG("%s", __FUNCTION__);
     bta_hf_client_evt_val(BTA_HF_CLIENT_RING_INDICATION, 0);
@@ -427,7 +427,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
 
     APPL_TRACE_DEBUG("%s index: %u value: %u", __FUNCTION__, index, value);
 
-    if (index == 0 || index > BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
+    if (index >= BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
         return;
     }
 
@@ -435,7 +435,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
         service_availability = value == 0 ? FALSE : TRUE;
     }
 
-    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index - 1];
+    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index];
 
     if (realind >= 0 && realind < BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT) {
         /* get the real in-array index from lookup table by index it comes at */
@@ -576,15 +576,17 @@ static void bta_hf_client_handle_btrh( UINT16 code)
 
 /* Check if prefix match and skip spaces if any */
 #define AT_CHECK_EVENT(buf, event) \
-    if (strncmp("\r\n"event, buf,sizeof("\r\n"event) - 1) != 0) return buf; \
-    buf += sizeof("\r\n"event) - 1; \
-    while (*buf == ' ') buf++;
+if (strncmp("\r\n"event,buf,sizeof("\r\n"event) - 1) != 0) \
+    return buf; \
+buf += sizeof("\r\n"event) - 1; \
+while (*buf == ' ') buf++;
 
 /* check for <cr><lf> and forward buffer if match */
 #define AT_CHECK_RN(buf) \
     if (strncmp("\r\n", buf, sizeof("\r\n") - 1) != 0) { \
-        APPL_TRACE_DEBUG("%s missing end <cr><lf>", __FUNCTION__); \
-        return NULL;} \
+        APPL_TRACE_ERROR("%s missing end <cr><lf>", __FUNCTION__); \
+        return NULL;\
+    } \
     buf += sizeof("\r\n") - 1;
 
 /* skip rest of AT string up to <cr> */
@@ -1022,20 +1024,20 @@ static char *bta_hf_client_parse_clcc(char *buffer)
 static char *bta_hf_client_parse_cnum(char *buffer)
 {
     char numstr[33];     /* spec forces 32 chars, plus one for \0*/
-    UINT16 type;
-    UINT16 service = 0; /* 0 in case this optional parameter is not being sent */
+    int type;
+    int service = 0; /* 0 in case this optional parameter is not being sent */
     int res;
     int offset;
 
     AT_CHECK_EVENT(buffer, "+CNUM:");
 
-    res = sscanf(buffer, ",\"%32[^\"]\",%hu,,%hu%n", numstr, &type, &service, &offset);
+    res = sscanf(buffer, ",\"%32[^\"]\",%d%n,,%d%n", numstr, &type, &offset, &service, &offset);
     if (res < 0) {
         return NULL;
     }
 
     if (res == 0) {
-        res = sscanf(buffer, ",\"\",%hu,,%hu%n", &type, &service, &offset);
+        res = sscanf(buffer, ",\"\",%d%n,,%d%n", &type, &offset, &service, &offset);
         if (res < 0) {
             return NULL;
         }
@@ -1045,7 +1047,7 @@ static char *bta_hf_client_parse_cnum(char *buffer)
         numstr[0] = '\0';
     }
 
-    if (res < 3) {
+    if (res < 2) {
         return NULL;
     }
 
@@ -1257,7 +1259,7 @@ static void bta_hf_client_at_parse_start(void)
         for (i = 0; i < bta_hf_client_psraser_cb_count; i++) {
             tmp = bta_hf_client_parser_cb[i](buf);
             if (tmp == NULL) {
-                APPL_TRACE_ERROR("HFPCient: AT event/reply parsing failed, skipping");
+                APPL_TRACE_ERROR("HFPCient: AT event/reply parsing failed, skipping %d", i);
                 tmp = bta_hf_client_skip_unknown(buf);
                 break;
             }

components/bt/bluedroid/bta/hf_client/bta_hf_client_main.c

@@ -214,7 +214,7 @@ const UINT8 bta_hf_client_st_closing[][BTA_HF_CLIENT_NUM_COLS] = {
     /* DISC_OK_EVT */           {BTA_HF_CLIENT_IGNORE,         BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},
     /* DISC_FAIL_EVT */         {BTA_HF_CLIENT_IGNORE,         BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},
     /* SCO_OPEN_EVT */          {BTA_HF_CLIENT_IGNORE,         BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},
-    /* SCO_CLOSE_EVT */         {BTA_HF_CLIENT_IGNORE,         BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},
+    /* SCO_CLOSE_EVT */         {BTA_HF_CLIENT_SCO_CONN_CLOSE, BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},
     /* SEND_AT_CMD_EVT */       {BTA_HF_CLIENT_IGNORE,         BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},
 #if (BTM_SCO_HCI_INCLUDED == TRUE )
     /* CI_SCO_DATA_EVT */       {BTA_HF_CLIENT_IGNORE,         BTA_HF_CLIENT_IGNORE,          BTA_HF_CLIENT_CLOSING_ST},

components/bt/bluedroid/bta/hh/bta_hh_le.c

@@ -850,7 +850,7 @@ void bta_hh_le_register_input_notif(tBTA_HH_DEV_CB *p_dev_cb, UINT8 srvc_inst,
 **
 ** Function         bta_hh_le_open_cmpl
 **
-** Description      HID over GATT connection sucessfully opened
+** Description      HID over GATT connection successfully opened
 **
 *******************************************************************************/
 void bta_hh_le_open_cmpl(tBTA_HH_DEV_CB *p_cb)
@@ -1556,7 +1556,7 @@ void bta_hh_le_srvc_search_cmpl(tBTA_GATTC_SEARCH_CMPL *p_data)
         /* close the connection and report service discovery complete with error */
         bta_hh_le_api_disc_act(p_dev_cb);
     }
-    /* GATT service discovery sucessfully finished */
+    /* GATT service discovery successfully finished */
     else {
         if (p_dev_cb->disc_active  & BTA_HH_LE_DISC_SCPS) {
             p_dev_cb->disc_active  &= ~BTA_HH_LE_DISC_SCPS;

components/bt/bluedroid/bta/include/bta/bta_api.h

@@ -589,10 +589,10 @@ typedef struct {
 
 typedef union {
     tBLE_BD_ADDR                            target_addr;
-    tBTA_DM_BLE_PF_LOCAL_NAME_COND             local_name; /* lcoal name filtering */
-    tBTA_DM_BLE_PF_MANU_COND                   manu_data;  /* manufactuer data filtering */
+    tBTA_DM_BLE_PF_LOCAL_NAME_COND             local_name; /* local name filtering */
+    tBTA_DM_BLE_PF_MANU_COND                   manu_data;  /* manufacturer data filtering */
     tBTA_DM_BLE_PF_UUID_COND                   srvc_uuid;  /* service UUID filtering */
-    tBTA_DM_BLE_PF_UUID_COND                   solicitate_uuid;   /* solicitated service UUID filtering */
+    tBTA_DM_BLE_PF_UUID_COND                   solicitate_uuid;   /* solicited service UUID filtering */
     tBTA_DM_BLE_PF_SRVC_PATTERN_COND           srvc_data;      /* service data pattern */
 } tBTA_DM_BLE_PF_COND_PARAM;
 
@@ -769,6 +769,7 @@ typedef struct {
     tBLE_ADDR_TYPE  addr_type;          /* Peer device address type */
     tBT_DEVICE_TYPE dev_type;
     UINT8           auth_mode;
+    BOOLEAN           sc_support;         /* Denotes if peer device supported secure connection while bonding. */
 } tBTA_DM_AUTH_CMPL;
 
 
@@ -784,6 +785,7 @@ typedef struct {
 
 /* Structure associated with BTA_DM_LINK_UP_EVT */
 typedef struct {
+    BOOLEAN         sc_downgrade;       /* Security downgrade state. */
     BD_ADDR         bd_addr;            /* BD address peer device. */
 #if BLE_INCLUDED == TRUE
     tBTA_TRANSPORT  link_type;
@@ -924,7 +926,7 @@ typedef union {
     tBTA_DM_PIN_REQ             pin_req;            /* PIN request. */
     tBTA_DM_AUTH_CMPL           auth_cmpl;          /* Authentication complete indication. */
     tBTA_DM_AUTHORIZE           authorize;          /* Authorization request. */
-    tBTA_DM_LINK_UP             link_up;            /* ACL connection down event */
+    tBTA_DM_LINK_UP             link_up;            /* ACL connection up event */
     tBTA_DM_LINK_DOWN           link_down;          /* ACL connection down event */
     tBTA_DM_BUSY_LEVEL          busy_level;         /* System busy level */
     tBTA_DM_SP_CFM_REQ          cfm_req;            /* user confirm request */
@@ -1204,7 +1206,7 @@ typedef UINT16 tBTA_DM_LP_MASK;
 #define BTA_DM_PM_ACTIVE       0x40       /* prefers active mode */
 #define BTA_DM_PM_RETRY        0x80       /* retry power mode based on current settings */
 #define BTA_DM_PM_SUSPEND      0x04       /* prefers suspend mode */
-#define BTA_DM_PM_NO_PREF      0x01       /* service has no prefernce on power mode setting. eg. connection to service got closed */
+#define BTA_DM_PM_NO_PREF      0x01       /* service has no preference on power mode setting. eg. connection to service got closed */
 
 typedef UINT8 tBTA_DM_PM_ACTION;
 
@@ -1375,6 +1377,7 @@ typedef UINT8 tBTA_DM_LINK_TYPE;
 #define ALLOW_ALL_FILTER     0x00
 #define LOWEST_RSSI_VALUE     129
 
+
 /*****************************************************************************
 **  External Function Declarations
 *****************************************************************************/
@@ -1454,7 +1457,7 @@ extern void BTA_DmUpdateWhiteList(BOOLEAN add_remove,  BD_ADDR remote_addr, tBTA
 
 extern void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb);
 
-extern void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb);
+extern void BTA_DmReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb);
 
 /*******************************************************************************
 **
@@ -1683,7 +1686,8 @@ extern void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passke
 extern void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class,
                             LINK_KEY link_key, tBTA_SERVICE_MASK trusted_mask,
                             BOOLEAN is_trusted, UINT8 key_type,
-                            tBTA_IO_CAP io_cap, UINT8 pin_length);
+                            tBTA_IO_CAP io_cap, UINT8 pin_length,
+                            UINT8 sc_support);
 
 /*******************************************************************************
 **
@@ -1732,7 +1736,7 @@ extern UINT16 BTA_DmGetConnectionState( BD_ADDR bd_addr );
 **
 ** Description      This function adds a DI record to the local SDP database.
 **
-** Returns          BTA_SUCCESS if record set sucessfully, otherwise error code.
+** Returns          BTA_SUCCESS if record set successfully, otherwise error code.
 **
 *******************************************************************************/
 extern tBTA_STATUS BTA_DmSetLocalDiRecord( tBTA_DI_RECORD *p_device_info,
@@ -2292,8 +2296,8 @@ extern void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_l
 ** Returns          None
 **
 *******************************************************************************/
-extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, 
-                                                BD_ADDR device_info, 
+extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type,
+                                                BD_ADDR device_info,
                                                 tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_exceptional_list_cback);
 
 /*******************************************************************************
@@ -2601,6 +2605,21 @@ extern void BTA_VendorInit  (void);
 *******************************************************************************/
 extern void BTA_VendorCleanup (void);
 
+enum {
+    BTA_COEX_EVT_SCAN_STARTED = 1,
+    BTA_COEX_EVT_SCAN_STOPPED,
+    BTA_COEX_EVT_ACL_CONNECTED,
+    BTA_COEX_EVT_ACL_DISCONNECTED,
+    BTA_COEX_EVT_STREAMING_STARTED,
+    BTA_COEX_EVT_STREAMING_STOPPED,
+    BTA_COEX_EVT_SNIFF_ENTER,
+    BTA_COEX_EVT_SNIFF_EXIT,
+    BTA_COEX_EVT_A2DP_PAUSED_ENTER,
+    BTA_COEX_EVT_A2DP_PAUSED_EXIT,
+};
+
+extern void BTA_DmCoexEventTrigger(uint32_t event);
+
 #endif
 
 #ifdef __cplusplus

components/bt/bluedroid/bta/include/bta/bta_av_api.h

@@ -36,12 +36,6 @@
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/
-/* Set to TRUE if seperate authorization prompt desired for AVCTP besides A2DP authorization */
-/* Typically FALSE when AVRCP is used in conjunction with A2DP */
-#ifndef BTA_AV_WITH_AVCTP_AUTHORIZATION
-#define BTA_AV_WITH_AVCTP_AUTHORIZATION     FALSE
-#endif
-
 /* AV status values */
 #define BTA_AV_SUCCESS          0       /* successful operation */
 #define BTA_AV_FAIL             1       /* generic failure */
@@ -509,8 +503,10 @@ typedef struct {
     UINT32  company_id;         /* AVRCP Company ID */
     UINT16  avrc_mtu;           /* AVRCP MTU at L2CAP for control channel */
     UINT16  avrc_br_mtu;        /* AVRCP MTU at L2CAP for browsing channel */
-    UINT16  avrc_ct_cat;        /* AVRCP controller categories */
-    UINT16  avrc_tg_cat;        /* AVRCP target categories */
+    UINT16  avrc_snk_ct_cat;    /* AVRCP controller categories as SNK */
+    UINT16  avrc_snk_tg_cat;    /* AVRCP target categories SNK */
+    UINT16  avrc_src_ct_cat;    /* AVRCP controller categories as SRC */
+    UINT16  avrc_src_tg_cat;    /* AVRCP target categories as SRC */
     UINT16  sig_mtu;            /* AVDTP signaling channel MTU at L2CAP */
     UINT16  audio_mtu;          /* AVDTP audio transport channel MTU at L2CAP */
     const UINT16 *p_audio_flush_to;/* AVDTP audio transport channel flush timeout */
@@ -579,8 +575,7 @@ void BTA_AvDisable(void);
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name,
-                    UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep);
+void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep);
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/include/bta/bta_dm_co.h

@@ -214,4 +214,6 @@ extern UINT8 bta_dm_co_ble_get_accept_auth_enable(void);
 extern UINT8 bta_dm_co_ble_get_auth_req(void);
 
 extern void bta_dm_co_ble_oob_support(UINT8 enable);
+
+extern void bta_dm_co_ble_set_appl_enc_key_size(UINT8 ble_key_size);
 #endif

components/bt/bluedroid/bta/include/bta/bta_gatt_api.h

@@ -152,7 +152,7 @@ typedef UINT8 tBTA_GATT_STATUS;
 #define BTA_GATTC_CLOSE_EVT             5   /* GATTC  close request status event */
 #define BTA_GATTC_SEARCH_CMPL_EVT       6   /* GATT discovery complete event */
 #define BTA_GATTC_SEARCH_RES_EVT        7   /* GATT discovery result event */
-#define BTA_GATTC_READ_DESCR_EVT        8   /* GATT read characterisitc descriptor event */
+#define BTA_GATTC_READ_DESCR_EVT        8   /* GATT read characteristic descriptor event */
 #define BTA_GATTC_WRITE_DESCR_EVT       9   /* GATT write characteristic descriptor event */
 #define BTA_GATTC_NOTIF_EVT             10  /* GATT attribute notification event */
 #define BTA_GATTC_PREP_WRITE_EVT        11  /* GATT prepare write  event */
@@ -200,6 +200,12 @@ typedef struct {
     UINT8               name_spc;   /* The name space of the description */
 } tBTA_GATT_CHAR_PRES;
 
+typedef struct {
+    UINT16             interval;
+    UINT16             latency;
+    UINT16             timeout;
+} tBTA_GATT_CONN_PARAMS;
+
 #define BTA_GATT_CLT_CONFIG_NONE               GATT_CLT_CONFIG_NONE         /* 0x0000    */
 #define BTA_GATT_CLT_CONFIG_NOTIFICATION       GATT_CLT_CONFIG_NOTIFICATION /* 0x0001 */
 #define BTA_GATT_CLT_CONFIG_INDICATION         GATT_CLT_CONFIG_INDICATION   /* 0x0002 */
@@ -397,6 +403,7 @@ typedef struct {
     UINT16              conn_id;
     tBTA_GATTC_IF       client_if;
     BD_ADDR             remote_bda;
+    tBTA_GATT_CONN_PARAMS conn_params;
 } tBTA_GATTC_CONNECT;
 
 typedef struct {
@@ -479,6 +486,8 @@ typedef tGATT_IF tBTA_GATTS_IF;
 #define BTA_GATT_PERM_WRITE_ENC_MITM    GATT_PERM_WRITE_ENC_MITM    /* bit 6 -  0x0040 */
 #define BTA_GATT_PERM_WRITE_SIGNED      GATT_PERM_WRITE_SIGNED      /* bit 7 -  0x0080 */
 #define BTA_GATT_PERM_WRITE_SIGNED_MITM GATT_PERM_WRITE_SIGNED_MITM /* bit 8 -  0x0100 */
+#define BTA_GATT_PERM_READ_AUTHORIZATION GATT_PERM_READ_AUTHORIZATION /* bit 9 - 0x0200 */
+#define BTA_GATT_PERM_WRITE_AUTHORIZATION GATT_PERM_WRITE_AUTHORIZATION /* bit 10 - 0x0400 */
 typedef UINT16 tBTA_GATT_PERM;
 typedef tGATT_ATTR_VAL tBTA_GATT_ATTR_VAL;
 typedef tGATTS_ATTR_CONTROL tBTA_GATTS_ATTR_CONTROL;
@@ -604,6 +613,7 @@ typedef struct {
     UINT16              conn_id;
     tBTA_GATT_REASON    reason; /* report disconnect reason */
     tBTA_GATT_TRANSPORT transport;
+    tBTA_GATT_CONN_PARAMS conn_params;
 } tBTA_GATTS_CONN;
 
 typedef struct {
@@ -739,7 +749,7 @@ extern void BTA_GATTC_Disable(void);
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTC module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_client_cb - pointer to the application callback function.
 **
 ** Returns          None
@@ -867,32 +877,32 @@ extern const tBTA_GATTC_CHARACTERISTIC* BTA_GATTC_GetCharacteristic(UINT16 conn_
 *******************************************************************************/
 extern const tBTA_GATTC_DESCRIPTOR* BTA_GATTC_GetDescriptor(UINT16 conn_id, UINT16 handle);
 
-extern void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid, 
-                                         btgatt_db_element_t **db, int *count);
+extern void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid,
+                                         btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                 btgatt_db_element_t **db, int *count);
+                                 btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
-                                       btgatt_db_element_t **db, int *count);
+                                       btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid,
-                                    btgatt_db_element_t **db, int *count);
+                                    btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t end_handle,
                                      tBT_UUID char_uuid, tBT_UUID descr_uuid,
-                                     btgatt_db_element_t **db, int *count);
+                                     btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid,
-                                           btgatt_db_element_t **db, int *count);
+                                           btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                        tBT_UUID *incl_uuid, btgatt_db_element_t **db, int *count);
+                                        tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count);
 
-extern void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count);
+extern void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count);
 
 extern void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                      UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count);
+                                      UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count);
 
 /*******************************************************************************
 **
@@ -907,7 +917,7 @@ extern void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_
 **
 *******************************************************************************/
 extern void BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                btgatt_db_element_t **db, int *count);
+                                btgatt_db_element_t **db, UINT16 *count);
 
 /*******************************************************************************
 **
@@ -937,6 +947,22 @@ void BTA_GATTC_ReadCharacteristic(UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_
 *******************************************************************************/
 void BTA_GATTC_ReadCharDescr (UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_REQ auth_req);
 
+/*******************************************************************************
+**
+** Function         BTA_GATTC_Read_by_type
+**
+** Description      This function is called to read a attribute value by uuid
+**
+** Parameters       conn_id - connection ID.
+**                  s_handle - start handle.
+**                  e_handle - end hanle
+**                  uuid - The attribute UUID.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_GATTC_Read_by_type(UINT16 conn_id, UINT16 s_handle,UINT16 e_handle, tBT_UUID *uuid, tBTA_GATT_AUTH_REQ auth_req);
+
 /*******************************************************************************
 **
 ** Function         BTA_GATTC_WriteCharValue
@@ -1202,7 +1228,7 @@ extern void BTA_GATTS_Disable(void);
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTS module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_cback - pointer to the application callback function.
 **
 ** Returns          None
@@ -1325,7 +1351,7 @@ extern void  BTA_GATTS_DeleteService(UINT16 service_id);
 ** Description      This function is called to start a service.
 **
 ** Parameters       service_id: the service ID to be started.
-**                  sup_transport: supported trasnport.
+**                  sup_transport: supported transport.
 **
 ** Returns          None.
 **

components/bt/bluedroid/bta/include/bta/bta_hf_client_api.h

@@ -115,15 +115,16 @@ typedef UINT8 tBTA_HF_CLIENT_EVT;
 
 typedef UINT8 tBTA_HF_CLIENT_STATUS;
 
-/* indicator type */
-#define BTA_HF_CLIENT_IND_BATTCH    0  /* Battery charge indicator */
-#define BTA_HF_CLIENT_IND_SIGNAL    1  /* Signal Strength indicator */
-#define BTA_HF_CLIENT_IND_SERVICE   2  /* Service availability indicator */
-#define BTA_HF_CLIENT_IND_CALL      3  /* Standard call status indicator*/
-#define BTA_HF_CLIENT_IND_ROAM      4  /* Roaming status indicator */
-#define BTA_HF_CLIENT_IND_CALLSETUP 5  /* Call setup status indicator */
-#define BTA_HF_CLIENT_IND_CALLHELD  6  /* Call hold status indicator */
-
+/* indicator constants HFP 1.1 and later */
+#define BTA_HF_CLIENT_IND_CALL             0   /* position of call indicator */
+#define BTA_HF_CLIENT_IND_CALLSETUP        1   /* position of callsetup indicator */
+#define BTA_HF_CLIENT_IND_SERVICE          2   /* position of service indicator */
+/* indicator constants HFP 1.5 and later */
+#define BTA_HF_CLIENT_IND_SIGNAL           3   /* position of signal strength indicator */
+#define BTA_HF_CLIENT_IND_ROAM             4   /* position of roaming indicator */
+#define BTA_HF_CLIENT_IND_BATTCH           5   /* position of battery charge indicator */
+#define BTA_HF_CLIENT_IND_CALLHELD         6   /* position of callheld indicator */
+#define BTA_HF_CLIENT_IND_BEARER           7   /* position of bearer indicator */
 typedef UINT8 tBTA_HF_CLIENT_IND_TYPE;
 
 /* AT commands */

components/bt/bluedroid/bta/include/bta/bta_jv_api.h

@@ -129,11 +129,13 @@ typedef UINT8 tBTA_JV_CONN_STATE;
 /* Java I/F callback events */
 /* events received by tBTA_JV_DM_CBACK */
 #define BTA_JV_ENABLE_EVT           0  /* JV enabled */
+#define BTA_JV_DISABLE_EVT          1  /* JV disabled */
 #define BTA_JV_GET_SCN_EVT          6  /* Reserved an SCN */
 #define BTA_JV_GET_PSM_EVT          7  /* Reserved a PSM */
 #define BTA_JV_DISCOVERY_COMP_EVT   8  /* SDP discovery complete */
 #define BTA_JV_CREATE_RECORD_EVT    11 /* the result for BTA_JvCreateRecord */
 /* events received by tBTA_JV_L2CAP_CBACK */
+#if BTA_JV_L2CAP_INCLUDED
 #define BTA_JV_L2CAP_OPEN_EVT       16 /* open status of L2CAP connection */
 #define BTA_JV_L2CAP_CLOSE_EVT      17 /* L2CAP connection closed */
 #define BTA_JV_L2CAP_START_EVT      18 /* L2CAP server started */
@@ -144,6 +146,7 @@ typedef UINT8 tBTA_JV_CONN_STATE;
 #define BTA_JV_L2CAP_RECEIVE_EVT    23 /* the result for BTA_JvL2capReceive*/
 #define BTA_JV_L2CAP_WRITE_EVT      24 /* the result for BTA_JvL2capWrite*/
 #define BTA_JV_L2CAP_WRITE_FIXED_EVT 25 /* the result for BTA_JvL2capWriteFixed */
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /* events received by tBTA_JV_RFCOMM_CBACK */
 #define BTA_JV_RFCOMM_OPEN_EVT      26 /* open status of RFCOMM Client connection */
@@ -155,7 +158,8 @@ typedef UINT8 tBTA_JV_CONN_STATE;
 #define BTA_JV_RFCOMM_READ_EVT      32 /* the result for BTA_JvRfcommRead */
 #define BTA_JV_RFCOMM_WRITE_EVT     33 /* the result for BTA_JvRfcommWrite*/
 #define BTA_JV_RFCOMM_SRV_OPEN_EVT  34 /* open status of Server RFCOMM connection */
-#define BTA_JV_MAX_EVT              35 /* max number of JV events */
+#define BTA_JV_FREE_SCN_EVT         35 /* FREE an SCN */
+#define BTA_JV_MAX_EVT              36 /* max number of JV events */
 
 typedef UINT16 tBTA_JV_EVT;
 
@@ -167,9 +171,10 @@ typedef struct {
 
 /* data associated with BTA_JV_DISCOVERY_COMP_EVT_ */
 typedef struct {
-    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
-    UINT8 scn_num;              /* num of channel */
-    UINT8 scn[BTA_JV_MAX_SCN];  /* channel # */
+    tBTA_JV_STATUS status;                    /* Whether the operation succeeded or failed. */
+    UINT8 scn_num;                            /* num of channel */
+    UINT8 scn[BTA_JV_MAX_SCN];                /* channel # */
+    const char *service_name[BTA_JV_MAX_SCN]; /* service_name */
 } tBTA_JV_DISCOVERY_COMP;
 
 /* data associated with BTA_JV_CREATE_RECORD_EVT */
@@ -178,6 +183,7 @@ typedef struct {
     UINT32          handle;     /* The SDP handle */
 } tBTA_JV_CREATE_RECORD;
 
+#if BTA_JV_L2CAP_INCLUDED
 /* data associated with BTA_JV_L2CAP_OPEN_EVT */
 typedef struct {
     tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
@@ -186,18 +192,6 @@ typedef struct {
     INT32           tx_mtu;     /* The transmit MTU */
 } tBTA_JV_L2CAP_OPEN;
 
-/* data associated with BTA_JV_L2CAP_OPEN_EVT for LE sockets */
-typedef struct {
-    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
-    UINT32          handle;     /* The connection handle */
-    BD_ADDR         rem_bda;    /* The peer address */
-    INT32           tx_mtu;     /* The transmit MTU */
-    void          **p_p_cback;  /* set them for new socket */
-    void          **p_user_data;/* set them for new socket */
-
-} tBTA_JV_L2CAP_LE_OPEN;
-
-
 /* data associated with BTA_JV_L2CAP_CLOSE_EVT */
 typedef struct {
     tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
@@ -255,6 +249,22 @@ typedef struct {
     BOOLEAN         cong;       /* congestion status */
 } tBTA_JV_L2CAP_WRITE;
 
+/* data associated with BTA_JV_L2CAP_OPEN_EVT for LE sockets */
+typedef struct {
+    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
+    UINT32          handle;     /* The connection handle */
+    BD_ADDR         rem_bda;    /* The peer address */
+    INT32           tx_mtu;     /* The transmit MTU */
+    void          **p_p_cback;  /* set them for new socket */
+    void          **p_user_data;/* set them for new socket */
+
+} tBTA_JV_L2CAP_LE_OPEN;
+
+/*data associated with BTA_JV_L2CAP_DATA_IND_EVT if used for LE */
+typedef struct {
+    UINT32          handle;     /* The connection handle */
+    BT_HDR         *p_buf;      /* The incoming data */
+} tBTA_JV_LE_DATA_IND;
 
 /* data associated with BTA_JV_L2CAP_WRITE_FIXED_EVT */
 typedef struct {
@@ -265,6 +275,7 @@ typedef struct {
     UINT16          len;        /* The length of the data written. */
     BOOLEAN         cong;       /* congestion status */
 } tBTA_JV_L2CAP_WRITE_FIXED;
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /* data associated with BTA_JV_RFCOMM_OPEN_EVT */
 typedef struct {
@@ -272,6 +283,7 @@ typedef struct {
     UINT32          handle;     /* The connection handle */
     BD_ADDR         rem_bda;    /* The peer address */
 } tBTA_JV_RFCOMM_OPEN;
+
 /* data associated with BTA_JV_RFCOMM_SRV_OPEN_EVT */
 typedef struct {
     tBTA_JV_STATUS  status;             /* Whether the operation succeeded or failed. */
@@ -280,7 +292,6 @@ typedef struct {
     BD_ADDR         rem_bda;            /* The peer address */
 } tBTA_JV_RFCOMM_SRV_OPEN;
 
-
 /* data associated with BTA_JV_RFCOMM_CLOSE_EVT */
 typedef struct {
     tBTA_JV_STATUS  status;      /* Whether the operation succeeded or failed. */
@@ -294,6 +305,7 @@ typedef struct {
     tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
     UINT32          handle;     /* The connection handle */
     UINT8           sec_id;     /* security ID used by this server */
+    UINT8           scn;        /* Server channe number */
     BOOLEAN         use_co;     /* TRUE to use co_rfc_data */
 } tBTA_JV_RFCOMM_START;
 
@@ -304,19 +316,13 @@ typedef struct {
     UINT8           sec_id;     /* security ID used by this client */
     BOOLEAN         use_co;     /* TRUE to use co_rfc_data */
 } tBTA_JV_RFCOMM_CL_INIT;
+
 /*data associated with BTA_JV_L2CAP_DATA_IND_EVT & BTA_JV_RFCOMM_DATA_IND_EVT */
 typedef struct {
     UINT32          handle;     /* The connection handle */
     BT_HDR         *p_buf;      /* The incoming data */
 } tBTA_JV_DATA_IND;
 
-/*data associated with BTA_JV_L2CAP_DATA_IND_EVT if used for LE */
-typedef struct {
-    UINT32          handle;     /* The connection handle */
-    BT_HDR         *p_buf;      /* The incoming data */
-} tBTA_JV_LE_DATA_IND;
-
-
 /* data associated with BTA_JV_RFCOMM_CONG_EVT */
 typedef struct {
     tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
@@ -341,6 +347,7 @@ typedef struct {
     UINT32          req_id;     /* The req_id in the associated BTA_JvRfcommWrite() */
     int             len;        /* The length of the data written. */
     BOOLEAN         cong;       /* congestion status */
+    BOOLEAN         old_cong;   /* congestion status */
 } tBTA_JV_RFCOMM_WRITE;
 
 /* data associated with BTA_JV_API_SET_PM_PROFILE_EVT */
@@ -356,6 +363,24 @@ typedef struct {
     tBTA_JV_CONN_STATE  state;  /* JV connection stata */
 } tBTA_JV_NOTIFY_PM_STATE_CHANGE;
 
+/* indicate server at which status */
+typedef enum {
+    BTA_JV_SERVER_START_FAILED,
+    BTA_JV_SERVER_RUNNING,
+    BTA_JV_SERVER_STATUS_MAX,
+} tBTA_JV_SERVER_STATUS;
+
+typedef struct {
+    tBTA_JV_SERVER_STATUS   server_status;
+    UINT32                  slot_id;
+}tBTA_JV_FREE_SCN_USER_DATA;
+
+/* data associated with BTA_JV_FREE_SCN_EVT  */
+typedef struct {
+    tBTA_JV_STATUS          status;         /* Status of the operation */
+    tBTA_JV_SERVER_STATUS   server_status;  /* Server status */
+    UINT8                   scn;            /* Server channe number */
+} tBTA_JV_FREE_SCN;
 
 /* union of data associated with JV callback */
 typedef union {
@@ -365,6 +390,7 @@ typedef union {
     UINT8                   scn;            /* BTA_JV_GET_SCN_EVT */
     UINT16                  psm;            /* BTA_JV_GET_PSM_EVT */
     tBTA_JV_CREATE_RECORD   create_rec;     /* BTA_JV_CREATE_RECORD_EVT */
+#if BTA_JV_L2CAP_INCLUDED
     tBTA_JV_L2CAP_OPEN      l2c_open;       /* BTA_JV_L2CAP_OPEN_EVT */
     tBTA_JV_L2CAP_CLOSE     l2c_close;      /* BTA_JV_L2CAP_CLOSE_EVT */
     tBTA_JV_L2CAP_START     l2c_start;      /* BTA_JV_L2CAP_START_EVT */
@@ -372,6 +398,7 @@ typedef union {
     tBTA_JV_L2CAP_CONG      l2c_cong;       /* BTA_JV_L2CAP_CONG_EVT */
     tBTA_JV_L2CAP_READ      l2c_read;       /* BTA_JV_L2CAP_READ_EVT */
     tBTA_JV_L2CAP_WRITE     l2c_write;      /* BTA_JV_L2CAP_WRITE_EVT */
+#endif /* BTA_JV_L2CAP_INCLUDED */
     tBTA_JV_RFCOMM_OPEN     rfc_open;       /* BTA_JV_RFCOMM_OPEN_EVT */
     tBTA_JV_RFCOMM_SRV_OPEN rfc_srv_open;   /* BTA_JV_RFCOMM_SRV_OPEN_EVT */
     tBTA_JV_RFCOMM_CLOSE    rfc_close;      /* BTA_JV_RFCOMM_CLOSE_EVT */
@@ -382,9 +409,12 @@ typedef union {
     tBTA_JV_RFCOMM_WRITE    rfc_write;      /* BTA_JV_RFCOMM_WRITE_EVT */
     tBTA_JV_DATA_IND        data_ind;       /* BTA_JV_L2CAP_DATA_IND_EVT
                                                BTA_JV_RFCOMM_DATA_IND_EVT */
-    tBTA_JV_LE_DATA_IND      le_data_ind;   /* BTA_JV_L2CAP_LE_DATA_IND_EVT */
+    tBTA_JV_FREE_SCN        free_scn;       /* BTA_JV_FREE_SCN_EVT */
+#if BTA_JV_L2CAP_INCLUDED
     tBTA_JV_L2CAP_LE_OPEN      l2c_le_open;       /* BTA_JV_L2CAP_OPEN_EVT */
+    tBTA_JV_LE_DATA_IND        le_data_ind;   /* BTA_JV_L2CAP_LE_DATA_IND_EVT */
     tBTA_JV_L2CAP_WRITE_FIXED  l2c_write_fixed;      /* BTA_JV_L2CAP_WRITE_FIXED_EVT */
+#endif
 } tBTA_JV;
 
 /* JAVA DM Interface callback */
@@ -393,8 +423,10 @@ typedef void (tBTA_JV_DM_CBACK)(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_d
 /* JAVA RFCOMM interface callback */
 typedef void *(tBTA_JV_RFCOMM_CBACK)(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data);
 
+#if BTA_JV_L2CAP_INCLUDED
 /* JAVA L2CAP interface callback */
 typedef void (tBTA_JV_L2CAP_CBACK)(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_Data);
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /* JV configuration structure */
 typedef struct {
@@ -424,12 +456,25 @@ extern tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback);
 **
 ** Function         BTA_JvDisable
 **
-** Description      Disable the Java I/F
+** Description      Disable the Java I/F. When the enable
+**                  operation is complete the callback function will be
+**                  called with a BTA_JV_DISABLE_EVT.
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_JvDisable(void);
+extern void BTA_JvDisable(tBTA_JV_RFCOMM_CBACK *p_cback);
+
+/*******************************************************************************
+**
+** Function         BTA_JvFree
+**
+** Description      Free JV configuration
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_JvFree(void);
 
 /*******************************************************************************
 **
@@ -484,12 +529,17 @@ extern tBTA_JV_STATUS BTA_JvGetChannelId(int conn_type, void *user_data,
 **
 ** Description      This function frees a SCN/PSM that was used
 **                  by an application running over RFCOMM or L2CAP.
+** Parameters
+**   channel        The channel to free
+**   conn_type      one of BTA_JV_CONN_TYPE_
+**   p_cback        tBTA_JV_RFCOMM_CBACK is called with BTA_JV_FREE_SCN_EVT when server frees a SCN/PSM
+**   user_data      indicate the RFCOMM server status
 **
 ** Returns          BTA_JV_SUCCESS, if the request is being processed.
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type);
+extern tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);
 
 /*******************************************************************************
 **
@@ -532,6 +582,7 @@ extern tBTA_JV_STATUS BTA_JvCreateRecordByUser(const char *name, UINT32 channel,
 *******************************************************************************/
 extern tBTA_JV_STATUS BTA_JvDeleteRecord(UINT32 handle);
 
+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function         BTA_JvL2capConnectLE
@@ -739,6 +790,7 @@ extern tBTA_JV_STATUS BTA_JvL2capWrite(UINT32 handle, UINT32 req_id,
 extern tBTA_JV_STATUS BTA_JvL2capWriteFixed(UINT16 channel, BD_ADDR *addr, UINT32 req_id,
         tBTA_JV_L2CAP_CBACK *p_cback,
         UINT8 *p_data, UINT16 len, void *user_data);
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /*******************************************************************************
 **
@@ -769,7 +821,7 @@ extern tBTA_JV_STATUS BTA_JvRfcommConnect(tBTA_SEC sec_mask,
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data);
+extern tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);
 
 /*******************************************************************************
 **
@@ -786,9 +838,9 @@ extern tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data);
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvRfcommStartServer(tBTA_SEC sec_mask,
-        tBTA_JV_ROLE role, UINT8 local_scn, UINT8 max_session,
-        tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);
+extern tBTA_JV_STATUS BTA_JvRfcommStartServer(tBTA_SEC sec_mask, tBTA_JV_ROLE role,
+                                              UINT8 local_scn, UINT8 max_session,
+                                              tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);
 
 /*******************************************************************************
 **
@@ -815,8 +867,7 @@ extern tBTA_JV_STATUS BTA_JvRfcommStopServer(UINT32 handle, void *user_data);
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvRfcommRead(UINT32 handle, UINT32 req_id,
-                                       UINT8 *p_data, UINT16 len);
+extern tBTA_JV_STATUS BTA_JvRfcommRead(UINT32 handle, UINT32 req_id, UINT8 *p_data, UINT16 len);
 
 /*******************************************************************************
 **
@@ -843,9 +894,20 @@ extern tBTA_JV_STATUS BTA_JvRfcommReady(UINT32 handle, UINT32 *p_data_size);
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-// extern tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id);
 extern tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id, int len, UINT8 *p_data);
 
+/*******************************************************************************
+**
+** Function         BTA_JvRfcommFlowControl
+**
+** Description      This function gives the credit to the peer
+**
+** Returns          BTA_JV_SUCCESS, if the request is being processed.
+**                  BTA_JV_FAILURE, otherwise.
+**
+*******************************************************************************/
+extern tBTA_JV_STATUS BTA_JvRfcommFlowControl(UINT32 handle, UINT16 credits_given);
+
 /*******************************************************************************
  **
  ** Function    BTA_JVSetPmProfile
@@ -865,8 +927,7 @@ extern tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id, int len, U
  **              BTA_JV_CONN_CLOSE to remove in case of connection close!
  **
  *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvSetPmProfile(UINT32 handle, tBTA_JV_PM_ID app_id,
-        tBTA_JV_CONN_STATE init_st);
+extern tBTA_JV_STATUS BTA_JvSetPmProfile(UINT32 handle, tBTA_JV_PM_ID app_id, tBTA_JV_CONN_STATE init_st);
 
 /*******************************************************************************
 **

components/bt/bluedroid/bta/include/bta/bta_sys.h

@@ -225,6 +225,7 @@ extern void bta_sys_sendmsg(void *p_msg);
 extern void bta_sys_start_timer(TIMER_LIST_ENT *p_tle, UINT16 type, INT32 timeout_ms);
 extern void bta_sys_stop_timer(TIMER_LIST_ENT *p_tle);
 extern void bta_sys_free_timer(TIMER_LIST_ENT *p_tle);
+extern BOOLEAN bta_sys_timer_is_active(TIMER_LIST_ENT *p_tle);
 extern void bta_sys_disable(tBTA_SYS_HW_MODULE module);
 extern UINT32 bta_sys_get_remaining_ticks(TIMER_LIST_ENT *p_target_tle);
 

components/bt/bluedroid/bta/jv/bta_jv_act.c

@@ -48,6 +48,7 @@
 
 
 #if (defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE)
+#if BTA_JV_L2CAP_INCLUDED
 /* one of these exists for each client */
 struct fc_client {
     struct fc_client    *next_all_list;
@@ -92,11 +93,10 @@ static void __attribute__((unused)) fc_init(void)
     pthread_once(&fc_init_once,  fc_init_work);
 }
 
-
 static void fcchan_conn_chng_cbk(UINT16 chan, BD_ADDR bd_addr, BOOLEAN connected,
                                  UINT16 reason, tBT_TRANSPORT );
 static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf);
-
+#endif /* BTA_JV_L2CAP_INCLUDED */  
 
 extern void uuid_to_string_legacy(bt_uuid_t *p_uuid, char *str);
 static inline void logu(const char *title, const uint8_t *p_uuid)
@@ -114,6 +114,10 @@ static void bta_jv_pm_conn_idle(tBTA_JV_PM_CB *p_cb);
 static void bta_jv_pm_state_change(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE state);
 tBTA_JV_STATUS bta_jv_set_pm_conn_state(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE
                                         new_st);
+static int find_rfc_pcb(void *user_data, tBTA_JV_RFC_CB **cb, tBTA_JV_PCB **pcb);
+static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle);
+static void bta_jv_port_event_sr_cback(UINT32 code, UINT16 port_handle);
+static int bta_jv_port_data_co_cback(UINT16 port_handle, UINT8 *buf, UINT16 len, int type);
 
 /*******************************************************************************
 **
@@ -288,6 +292,12 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
     BOOLEAN remove_server = FALSE;
     int close_pending = 0;
 
+    UINT8 used = 0, i, listen = 0;
+    tPORT_STATE port_state;
+    UINT32 event_mask = BTA_JV_RFC_EV_MASK;
+    UINT32 scn_num = (UINT32)p_cb->scn;
+    tBTA_JV evt_data;
+
     if (!p_cb || !p_pcb) {
         APPL_TRACE_ERROR("bta_jv_free_sr_rfc_cb, p_cb or p_pcb cannot be null");
         return BTA_JV_FAILURE;
@@ -363,6 +373,57 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
         }
         p_pcb->handle = 0;
         p_cb->curr_sess--;
+
+        if ((p_cb->max_sess > 1) &&
+            (p_cb->scn != 0) &&
+            (p_cb->curr_sess == p_cb->max_sess - 1)) {
+
+            for (i = 0; i < p_cb->max_sess; i++) {
+                if (p_cb->rfc_hdl[i] != 0) {
+                    p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[i] - 1];
+                    if (p_pcb->state == BTA_JV_ST_SR_LISTEN) {
+                        listen++;
+                    }
+                    used++;
+                }
+            }
+            APPL_TRACE_DEBUG("%s max_sess=%d used:%d curr_sess:%d, listen:%d si:%d",
+                             __func__, p_cb->max_sess, used, p_cb->curr_sess, listen, si);
+            if (used < p_cb->max_sess &&
+                listen == 0 &&
+                0 <= si &&
+                si < BTA_JV_MAX_RFC_SR_SESSION) {
+                /* make sure the server has a listen port */
+                if ((RFCOMM_CreateConnection(p_cb->sec_id, p_cb->scn, TRUE,
+                                             BTA_JV_DEF_RFC_MTU, (UINT8 *)bd_addr_any, &(p_cb->rfc_hdl[si]), bta_jv_port_mgmt_sr_cback) == PORT_SUCCESS) &&
+                    (p_cb->rfc_hdl[si] != 0)) {
+                    p_cb->curr_sess++;
+                    p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[si] - 1];
+                    p_pcb->state = BTA_JV_ST_SR_LISTEN;
+                    p_pcb->port_handle = p_cb->rfc_hdl[si];
+                    // p_pcb->user_data = p_pcb_open->user_data;
+
+                    PORT_ClearKeepHandleFlag(p_pcb->port_handle);
+                    PORT_SetEventCallback(p_pcb->port_handle, bta_jv_port_event_sr_cback);
+                    PORT_SetDataCOCallback(p_pcb->port_handle, bta_jv_port_data_co_cback);
+                    PORT_SetEventMask(p_pcb->port_handle, event_mask);
+                    PORT_GetState(p_pcb->port_handle, &port_state);
+
+                    port_state.fc_type = (PORT_FC_CTS_ON_INPUT | PORT_FC_CTS_ON_OUTPUT);
+
+                    PORT_SetState(p_pcb->port_handle, &port_state);
+                    p_pcb->handle = BTA_JV_RFC_H_S_TO_HDL(p_cb->handle, si);
+                    APPL_TRACE_DEBUG("%s: p_pcb->handle:0x%x, curr_sess:%d", __func__,
+                                     p_pcb->handle, p_cb->curr_sess);
+
+                    evt_data.rfc_srv_open.handle = 0;
+                    evt_data.rfc_srv_open.new_listen_handle = p_pcb->handle;
+                    evt_data.rfc_srv_open.status = BTA_JV_SUCCESS;
+                    p_pcb->user_data = p_cb->p_cback(BTA_JV_RFCOMM_SRV_OPEN_EVT, &evt_data, (void *)scn_num);
+                }
+            }
+        }
+
         if (p_cb->curr_sess == 0) {
             p_cb->scn = 0;
             bta_jv_free_sec_id(&p_cb->sec_id);
@@ -377,6 +438,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
     return status;
 }
 
+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function     bta_jv_free_l2c_cb
@@ -402,6 +464,7 @@ tBTA_JV_STATUS bta_jv_free_l2c_cb(tBTA_JV_L2C_CB *p_cb)
     p_cb->p_cback = NULL;
     return status;
 }
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /*******************************************************************************
 **
@@ -456,10 +519,9 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                 }
             }
 
-            APPL_TRACE_API("%s(jv_handle: 0x%2x), idx: %d, "
-                           "app_id: 0x%x", __func__, jv_handle, i, bta_jv_cb.pm_cb[i].app_id);
-            APPL_TRACE_API("%s, bd_counter = %d, "
-                           "appid_counter = %d", __func__, bd_counter, appid_counter);
+            APPL_TRACE_API("%s(jv_handle: 0x%2x), idx: %d, app_id: 0x%x", __func__, jv_handle, i, bta_jv_cb.pm_cb[i].app_id);
+            APPL_TRACE_API("%s, bd_counter = %d, appid_counter = %d", __func__, bd_counter, appid_counter);
+
             if (bd_counter > 1) {
                 bta_jv_pm_conn_idle(&bta_jv_cb.pm_cb[i]);
             }
@@ -478,14 +540,15 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                     tBTA_JV_PCB *p_pcb = bta_jv_rfc_port_to_pcb(bta_jv_cb.rfc_cb[hi].rfc_hdl[si]);
                     if (p_pcb) {
                         if (NULL == p_pcb->p_pm_cb) {
-                            APPL_TRACE_WARNING("%s(jv_handle:"
-                                               " 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to "
-                                               "pm_cb?", __func__, jv_handle, p_pcb->port_handle, i);
+                            APPL_TRACE_WARNING("%s(jv_handle: 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to pm_cb?",
+                                                 __func__, jv_handle, p_pcb->port_handle, i);
                         }
                         p_cb = &p_pcb->p_pm_cb;
                     }
                 }
-            } else {
+            } 
+#if BTA_JV_L2CAP_INCLUDED
+            else {
                 if (jv_handle < BTA_JV_MAX_L2C_CONN) {
                     tBTA_JV_L2C_CB *p_l2c_cb = &bta_jv_cb.l2c_cb[jv_handle];
                     if (NULL == p_l2c_cb->p_pm_cb) {
@@ -495,6 +558,8 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                     p_cb = &p_l2c_cb->p_pm_cb;
                 }
             }
+#endif /* BTA_JV_L2CAP_INCLUDED */
+
             if (p_cb) {
                 *p_cb = NULL;
                 status = BTA_JV_SUCCESS;
@@ -537,7 +602,9 @@ static tBTA_JV_PM_CB *bta_jv_alloc_set_pm_profile_cb(UINT32 jv_handle, tBTA_JV_P
                         break;
                     }
                 }
-            } else {
+            }
+#if BTA_JV_L2CAP_INCLUDED
+            else {
                 /* use jv handle for l2cap bd address retrieval */
                 for (j = 0; j < BTA_JV_MAX_L2C_CONN; j++) {
                     if (jv_handle == bta_jv_cb.l2c_cb[j].handle) {
@@ -552,6 +619,7 @@ static tBTA_JV_PM_CB *bta_jv_alloc_set_pm_profile_cb(UINT32 jv_handle, tBTA_JV_P
                     }
                 }
             }
+#endif /* BTA_JV_L2CAP_INCLUDED */
             APPL_TRACE_API("bta_jv_alloc_set_pm_profile_cb(handle 0x%2x, app_id %d): "
                            "idx: %d, (BTA_JV_PM_MAX_NUM: %d), pp_cb: %p", jv_handle, app_id,
                            i, BTA_JV_PM_MAX_NUM, (void *)pp_cb);
@@ -634,7 +702,6 @@ BOOLEAN bta_jv_check_psm(UINT16 psm)
         }
     }
     return ret;
-
 }
 
 /*******************************************************************************
@@ -673,7 +740,12 @@ void bta_jv_enable(tBTA_JV_MSG *p_data)
 *******************************************************************************/
 void bta_jv_disable (tBTA_JV_MSG *p_data)
 {
-    UNUSED(p_data);
+    tBTA_JV_STATUS evt_data;
+    evt_data = BTA_JV_SUCCESS;
+    // UNUSED(p_data);
+    if (p_data->disable.p_cback) {
+        p_data->disable.p_cback(BTA_JV_DISABLE_EVT, (tBTA_JV *)&evt_data, NULL);
+    }
 }
 
 
@@ -782,7 +854,17 @@ void bta_jv_get_channel_id(tBTA_JV_MSG *p_data)
 *******************************************************************************/
 void bta_jv_free_scn(tBTA_JV_MSG *p_data)
 {
-    UINT16   scn = p_data->free_channel.scn;
+    tBTA_JV_API_FREE_CHANNEL *fc = &(p_data->free_channel);
+    UINT16   scn = fc->scn;
+    tBTA_JV_FREE_SCN evt_data = {
+        .status = BTA_JV_SUCCESS,
+        .server_status = BTA_JV_SERVER_STATUS_MAX,
+        .scn = scn
+    };
+
+    tBTA_JV_FREE_SCN_USER_DATA *user_data = NULL;
+    tBTA_JV_RFC_CB *p_cb = NULL;
+    tBTA_JV_PCB *p_pcb = NULL;
 
     switch (p_data->free_channel.type) {
     case BTA_JV_CONN_TYPE_RFCOMM: {
@@ -802,6 +884,19 @@ void bta_jv_free_scn(tBTA_JV_MSG *p_data)
     default:
         break;
     }
+
+    if (fc->user_data) {
+        user_data = (tBTA_JV_FREE_SCN_USER_DATA *)fc->user_data;
+        evt_data.server_status = user_data->server_status;
+        if (user_data->server_status == BTA_JV_SERVER_RUNNING && find_rfc_pcb((void *)user_data->slot_id, &p_cb, &p_pcb)) {
+            /* if call bta_jv_rfcomm_stop_server successfully, find_rfc_pcb shall return false */
+            evt_data.status = BTA_JV_FAILURE;
+        }
+
+        if (fc->p_cback) {
+            fc->p_cback(BTA_JV_FREE_SCN_EVT, (tBTA_JV *)&evt_data, (void *)user_data);
+        }
+    }
 }
 static inline tBT_UUID shorten_sdp_uuid(const tBT_UUID *u)
 {
@@ -857,6 +952,7 @@ static void bta_jv_start_discovery_cback(UINT16 result, void *user_data)
         status = BTA_JV_FAILURE;
         if (result == SDP_SUCCESS || result == SDP_DB_FULL) {
             tSDP_DISC_REC       *p_sdp_rec = NULL;
+            tSDP_DISC_ATTR *p_attr = NULL;
             tSDP_PROTOCOL_ELEM  pe;
             logu("bta_jv_cb.uuid", bta_jv_cb.uuid.uu.uuid128);
             tBT_UUID su = shorten_sdp_uuid(&bta_jv_cb.uuid);
@@ -865,7 +961,13 @@ static void bta_jv_start_discovery_cback(UINT16 result, void *user_data)
                 p_sdp_rec = SDP_FindServiceUUIDInDb(p_bta_jv_cfg->p_sdp_db, &su, p_sdp_rec);
                 APPL_TRACE_DEBUG("p_sdp_rec:%p", p_sdp_rec);
                 if (p_sdp_rec && SDP_FindProtocolListElemInRec(p_sdp_rec, UUID_PROTOCOL_RFCOMM, &pe)){
-                    dcomp.scn[dcomp.scn_num++] = (UINT8) pe.params[0];
+                    dcomp.scn[dcomp.scn_num] = (UINT8) pe.params[0];
+                    if ((p_attr = SDP_FindAttributeInRec(p_sdp_rec, ATTR_ID_SERVICE_NAME)) != NULL) {
+                        dcomp.service_name[dcomp.scn_num] = (char *)p_attr->attr_value.v.array;
+                    } else {
+                        dcomp.service_name[dcomp.scn_num] = NULL;
+                    }
+                    dcomp.scn_num++;
                     status = BTA_JV_SUCCESS;
                 }
             } while (p_sdp_rec);
@@ -1092,6 +1194,7 @@ void bta_jv_delete_record(tBTA_JV_MSG *p_data)
     }
 }
 
+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function     bta_jv_l2cap_client_cback
@@ -1517,6 +1620,7 @@ void bta_jv_l2cap_write_fixed(tBTA_JV_MSG *p_data)
 
     ls->p_cback(BTA_JV_L2CAP_WRITE_FIXED_EVT, (tBTA_JV *)&evt_data, ls->user_data);
 }
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /*******************************************************************************
 **
@@ -1596,6 +1700,7 @@ static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle)
         evt_data.rfc_close.async = TRUE;
         if (p_pcb->state == BTA_JV_ST_CL_CLOSING) {
             evt_data.rfc_close.async = FALSE;
+            evt_data.rfc_close.status = BTA_JV_SUCCESS;
         }
         //p_pcb->state = BTA_JV_ST_NONE;
         //p_pcb->cong = FALSE;
@@ -1760,9 +1865,10 @@ void bta_jv_rfcomm_close(tBTA_JV_MSG *p_data)
     tBTA_JV_API_RFCOMM_CLOSE *cc = &(p_data->rfcomm_close);
     tBTA_JV_RFC_CB           *p_cb = NULL;
     tBTA_JV_PCB              *p_pcb = NULL;
-    APPL_TRACE_DEBUG("bta_jv_rfcomm_close, rfc handle:%d", cc->handle);
+    tBTA_JV                   evt_data;
+    APPL_TRACE_DEBUG("%s, rfc handle:%d",__func__, cc->handle);
     if (!cc->handle) {
-        APPL_TRACE_ERROR("bta_jv_rfcomm_close, rfc handle is null");
+        APPL_TRACE_ERROR("%s, rfc handle is null", __func__);
         return;
     }
 
@@ -1770,9 +1876,21 @@ void bta_jv_rfcomm_close(tBTA_JV_MSG *p_data)
     if (!find_rfc_pcb(user_data, &p_cb, &p_pcb)) {
         return;
     }
+    if(cc->p_cback) {
+        evt_data.rfc_close.status = BTA_JV_SUCCESS;
+        evt_data.rfc_close.port_status = PORT_LOCAL_CLOSED;
+        evt_data.rfc_close.handle = cc->handle;
+        evt_data.rfc_close.async = TRUE;
+        if (p_pcb && (p_pcb->state == BTA_JV_ST_SR_LISTEN ||
+                      p_pcb->state == BTA_JV_ST_SR_OPEN ||
+                      p_pcb->state == BTA_JV_ST_CL_OPEN ||
+                      p_pcb->state == BTA_JV_ST_CL_OPENING)) {
+            evt_data.rfc_close.async = FALSE;
+        }
+        cc->p_cback(BTA_JV_RFCOMM_CLOSE_EVT, (tBTA_JV *)&evt_data, user_data);
+    }
     bta_jv_free_rfc_cb(p_cb, p_pcb);
-    APPL_TRACE_DEBUG("bta_jv_rfcomm_close: sec id in use:%d, rfc_cb in use:%d",
-                     get_sec_id_used(), get_rfc_cb_used());
+    APPL_TRACE_DEBUG("%s: sec id in use:%d, rfc_cb in use:%d", __func__, get_sec_id_used(), get_rfc_cb_used());
 }
 
 /*******************************************************************************
@@ -1976,6 +2094,8 @@ static tBTA_JV_PCB *bta_jv_add_rfc_port(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pcb
                                  p_pcb->handle, p_cb->curr_sess);
             }
         } else {
+            /* avoid p_pcb always points to the last element of rfc_hdl */
+            p_pcb = p_pcb_open;
             APPL_TRACE_ERROR("bta_jv_add_rfc_port, cannot create new rfc listen port");
         }
     }
@@ -2043,6 +2163,7 @@ void bta_jv_rfcomm_start_server(tBTA_JV_MSG *p_data)
         evt_data.status = BTA_JV_SUCCESS;
         evt_data.handle = p_pcb->handle;
         evt_data.sec_id = sec_id;
+        evt_data.scn = rs->local_scn;
         evt_data.use_co = TRUE;
 
         PORT_ClearKeepHandleFlag(handle);
@@ -2146,16 +2267,16 @@ void bta_jv_rfcomm_write(tBTA_JV_MSG *p_data)
     evt_data.status = BTA_JV_FAILURE;
     evt_data.handle = p_pcb->handle;
     evt_data.req_id = wc->req_id;
-    evt_data.cong   = p_pcb->cong;
+    evt_data.old_cong = p_pcb->cong;
     bta_jv_pm_conn_busy(p_pcb->p_pm_cb);
-    evt_data.len = wc->len;
-    if (!evt_data.cong &&
+    evt_data.len = -1;
+    if (!evt_data.old_cong &&
             PORT_WriteDataCO(p_pcb->port_handle, &evt_data.len, wc->len, wc->p_data) ==
             PORT_SUCCESS) {
         evt_data.status = BTA_JV_SUCCESS;
     }
     // update congestion flag
-    evt_data.cong   = p_pcb->cong;
+    evt_data.cong = p_pcb->cong;
     if (p_cb->p_cback) {
         p_cb->p_cback(BTA_JV_RFCOMM_WRITE_EVT, (tBTA_JV *)&evt_data, p_pcb->user_data);
     } else {
@@ -2164,6 +2285,24 @@ void bta_jv_rfcomm_write(tBTA_JV_MSG *p_data)
 
 }
 
+
+/*******************************************************************************
+**
+** Function     bta_jv_rfcomm_flow_control
+**
+** Description  give credits to the peer
+**
+** Returns      void
+**
+*******************************************************************************/
+void bta_jv_rfcomm_flow_control(tBTA_JV_MSG *p_data)
+{
+    tBTA_JV_API_RFCOMM_FLOW_CONTROL *fc = &(p_data->rfcomm_fc);
+
+    tBTA_JV_PCB *p_pcb = fc->p_pcb;
+    PORT_FlowControl_GiveCredit(p_pcb->port_handle, TRUE, fc->credits_given);
+}
+
 /*******************************************************************************
  **
  ** Function     bta_jv_set_pm_profile
@@ -2351,7 +2490,7 @@ static void bta_jv_pm_state_change(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE
 }
 /**********************************************************************************************/
 
-
+#if BTA_JV_L2CAP_INCLUDED
 static struct fc_channel *fcchan_get(uint16_t chan, char create)
 {
     struct fc_channel *t = fc_channels;
@@ -2791,6 +2930,6 @@ extern void bta_jv_l2cap_close_fixed (tBTA_JV_MSG *p_data)
         fcclient_free(t);
     }
 }
-
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 #endif  ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE

components/bt/bluedroid/bta/jv/bta_jv_api.c

@@ -69,6 +69,16 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback)
     int i;
 
     APPL_TRACE_API( "BTA_JvEnable");
+
+#if BTA_DYNAMIC_MEMORY == TRUE
+    /* Malloc buffer for JV configuration structure */
+    p_bta_jv_cfg->p_sdp_raw_data = (UINT8 *)osi_malloc(p_bta_jv_cfg->sdp_raw_size);
+    p_bta_jv_cfg->p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_jv_cfg->sdp_db_size);
+    if (p_bta_jv_cfg->p_sdp_raw_data == NULL || p_bta_jv_cfg->p_sdp_db == NULL) {
+        return BTA_JV_NO_DATA;
+    }
+#endif
+
     if (p_cback && FALSE == bta_sys_is_register(BTA_ID_JV)) {
         memset(&bta_jv_cb, 0, sizeof(tBTA_JV_CB));
         /* set handle to invalid value by default */
@@ -85,8 +95,11 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback)
             bta_sys_sendmsg(p_buf);
             status = BTA_JV_SUCCESS;
         }
+    } else if (p_cback == NULL) {
+        APPL_TRACE_ERROR("No p_cback.");
     } else {
-        APPL_TRACE_ERROR("JVenable fails");
+        APPL_TRACE_WARNING("No need to Init again.");
+        // status = BTA_JV_SUCCESS;
     }
     return (status);
 }
@@ -100,18 +113,39 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback)
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_JvDisable(void)
+void BTA_JvDisable(tBTA_JV_RFCOMM_CBACK *p_cback)
 {
-    BT_HDR  *p_buf;
+    tBTA_JV_API_DISABLE *p_buf;
 
     APPL_TRACE_API( "BTA_JvDisable");
     bta_sys_deregister(BTA_ID_JV);
-    if ((p_buf = (BT_HDR *) osi_malloc(sizeof(BT_HDR))) != NULL) {
-        p_buf->event = BTA_JV_API_DISABLE_EVT;
+    if ((p_buf = (tBTA_JV_API_DISABLE *) osi_malloc(sizeof(tBTA_JV_API_DISABLE))) != NULL) {
+        p_buf->hdr.event = BTA_JV_API_DISABLE_EVT;
+        p_buf->p_cback = p_cback;
         bta_sys_sendmsg(p_buf);
     }
 }
 
+/*******************************************************************************
+**
+** Function         BTA_JvFree
+**
+** Description      Free JV configuration
+**
+** Returns          void
+**
+*******************************************************************************/
+void BTA_JvFree(void)
+{
+#if BTA_DYNAMIC_MEMORY == TRUE
+    /* Free buffer for JV configuration structure */
+    osi_free(p_bta_jv_cfg->p_sdp_raw_data);
+    osi_free(p_bta_jv_cfg->p_sdp_db);
+    p_bta_jv_cfg->p_sdp_raw_data = NULL;
+    p_bta_jv_cfg->p_sdp_db = NULL;
+#endif
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_JvIsEnable
@@ -199,12 +233,14 @@ tBTA_JV_STATUS BTA_JvGetChannelId(int conn_type, void *user_data, INT32 channel)
 ** Parameters
 **   channel        The channel to free
 **   conn_type      one of BTA_JV_CONN_TYPE_
+**   p_cback        tBTA_JV_RFCOMM_CBACK is called with when server
+**   user_data      indicate the RFCOMM server status
 **
 ** Returns          BTA_JV_SUCCESS, if the request is being processed.
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type)
+tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data)
 {
     tBTA_JV_STATUS status = BTA_JV_FAILURE;
     tBTA_JV_API_FREE_CHANNEL *p_msg;
@@ -214,6 +250,8 @@ tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type)
         p_msg->hdr.event = BTA_JV_API_FREE_SCN_EVT;
         p_msg->scn       = channel;
         p_msg->type      = conn_type;
+        p_msg->p_cback   = p_cback;
+        p_msg->user_data = user_data;
         bta_sys_sendmsg(p_msg);
         status = BTA_JV_SUCCESS;
     }
@@ -310,6 +348,7 @@ tBTA_JV_STATUS BTA_JvDeleteRecord(UINT32 handle)
     return (status);
 }
 
+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function         BTA_JvL2capConnectLE
@@ -823,6 +862,7 @@ tBTA_JV_STATUS BTA_JvL2capWriteFixed(UINT16 channel, BD_ADDR *addr, UINT32 req_i
 
     return (status);
 }
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /*******************************************************************************
 **
@@ -868,19 +908,20 @@ tBTA_JV_STATUS BTA_JvRfcommConnect(tBTA_SEC sec_mask,
 ** Function         BTA_JvRfcommClose
 **
 ** Description      This function closes an RFCOMM connection
-**
+**                  When the connection is established or failed,
+**                  tBTA_JV_RFCOMM_CBACK is called with BTA_JV_RFCOMM_CLOSE_EVT
 ** Returns          BTA_JV_SUCCESS, if the request is being processed.
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data)
+tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data)
 {
     tBTA_JV_STATUS status = BTA_JV_FAILURE;
     tBTA_JV_API_RFCOMM_CLOSE *p_msg;
     UINT32  hi = ((handle & BTA_JV_RFC_HDL_MASK) & ~BTA_JV_RFCOMM_MASK) - 1;
     UINT32  si = BTA_JV_RFC_HDL_TO_SIDX(handle);
 
-    APPL_TRACE_API( "BTA_JvRfcommClose");
+    APPL_TRACE_API( "%s", __func__);
     if (hi < BTA_JV_MAX_RFC_CONN && bta_jv_cb.rfc_cb[hi].p_cback &&
             si < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si] &&
             (p_msg = (tBTA_JV_API_RFCOMM_CLOSE *)osi_malloc(sizeof(tBTA_JV_API_RFCOMM_CLOSE))) != NULL) {
@@ -888,6 +929,7 @@ tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data)
         p_msg->handle = handle;
         p_msg->p_cb = &bta_jv_cb.rfc_cb[hi];
         p_msg->p_pcb = &bta_jv_cb.port_cb[p_msg->p_cb->rfc_hdl[si] - 1];
+        p_msg->p_cback = p_cback;
         p_msg->user_data = user_data;
         bta_sys_sendmsg(p_msg);
         status = BTA_JV_SUCCESS;
@@ -1095,6 +1137,38 @@ tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id, int len, UINT8 *p
     return (status);
 }
 
+/*******************************************************************************
+**
+** Function         BTA_JvRfcommFlowControl
+**
+** Description      This function gives credits to the peer
+**
+** Returns          BTA_JV_SUCCESS, if the request is being processed.
+**                  BTA_JV_FAILURE, otherwise.
+**
+*******************************************************************************/
+tBTA_JV_STATUS BTA_JvRfcommFlowControl(UINT32 handle, UINT16 credits_given)
+{
+    tBTA_JV_STATUS status = BTA_JV_FAILURE;
+    tBTA_JV_API_RFCOMM_FLOW_CONTROL *p_msg;
+    UINT32  hi = ((handle & BTA_JV_RFC_HDL_MASK) & ~BTA_JV_RFCOMM_MASK) - 1;
+    UINT32  si = BTA_JV_RFC_HDL_TO_SIDX(handle);
+
+    APPL_TRACE_API( "BTA_JvRfcommFlowControl");
+    APPL_TRACE_DEBUG( "handle:0x%x, hi:%d, si:%d", handle, hi, si);
+    if (hi < BTA_JV_MAX_RFC_CONN && bta_jv_cb.rfc_cb[hi].p_cback &&
+            si < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si] &&
+            (p_msg = (tBTA_JV_API_RFCOMM_FLOW_CONTROL *)osi_malloc(sizeof(tBTA_JV_API_RFCOMM_FLOW_CONTROL))) != NULL) {
+        p_msg->hdr.event = BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT;
+        p_msg->p_cb = &bta_jv_cb.rfc_cb[hi];
+        p_msg->p_pcb = &bta_jv_cb.port_cb[p_msg->p_cb->rfc_hdl[si] - 1];
+        p_msg->credits_given = credits_given;
+        APPL_TRACE_API( "credits given %d", credits_given);
+        bta_sys_sendmsg(p_msg);
+        status = BTA_JV_SUCCESS;
+    }
+    return (status);
+}
 
 /*******************************************************************************
  **

components/bt/bluedroid/bta/jv/bta_jv_cfg.c

@@ -43,15 +43,22 @@
  * between BTA_JvEnable and BTA_JvDisable
  * p_bta_jv_cfg->p_sdp_raw_data can be allocated before calling BTA_JvStartDiscovery
  * it can be de-allocated after the last call to access the database */
+#if BTA_DYNAMIC_MEMORY == FALSE
 static UINT8 bta_jv_sdp_raw_data[BTA_JV_SDP_RAW_DATA_SIZE];
 static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE];
+#endif
 
 /* JV configuration structure */
-const tBTA_JV_CFG bta_jv_cfg = {
-    BTA_JV_SDP_RAW_DATA_SIZE,   /* The size of p_sdp_raw_data */
-    BTA_JV_SDP_DB_SIZE,         /* The size of p_sdp_db_data */
-    bta_jv_sdp_raw_data,        /* The data buffer to keep raw data */
+/* const */ tBTA_JV_CFG bta_jv_cfg = {
+    BTA_JV_SDP_RAW_DATA_SIZE, /* The size of p_sdp_raw_data */
+    BTA_JV_SDP_DB_SIZE,       /* The size of p_sdp_db_data */
+#if BTA_DYNAMIC_MEMORY == FALSE
+    bta_jv_sdp_raw_data,                    /* The data buffer to keep raw data */
     (tSDP_DISCOVERY_DB *)bta_jv_sdp_db_data /* The data buffer to keep SDP database */
+#else
+    NULL,
+    NULL
+#endif
 };
 
 tBTA_JV_CFG *p_bta_jv_cfg = (tBTA_JV_CFG *) &bta_jv_cfg;

components/bt/bluedroid/bta/jv/bta_jv_main.c

@@ -35,6 +35,8 @@
 
 #if BTA_DYNAMIC_MEMORY == FALSE
 tBTA_JV_CB bta_jv_cb;
+#else
+tBTA_JV_CB *bta_jv_cb_ptr;
 #endif
 
 /* state machine action enumeration list */
@@ -52,25 +54,30 @@ const tBTA_JV_ACTION bta_jv_action[] = {
     bta_jv_start_discovery,         /* BTA_JV_API_START_DISCOVERY_EVT */
     bta_jv_create_record,           /* BTA_JV_API_CREATE_RECORD_EVT */
     bta_jv_delete_record,           /* BTA_JV_API_DELETE_RECORD_EVT */
+#if BTA_JV_L2CAP_INCLUDED
     bta_jv_l2cap_connect,           /* BTA_JV_API_L2CAP_CONNECT_EVT */
     bta_jv_l2cap_close,             /* BTA_JV_API_L2CAP_CLOSE_EVT */
     bta_jv_l2cap_start_server,      /* BTA_JV_API_L2CAP_START_SERVER_EVT */
     bta_jv_l2cap_stop_server,       /* BTA_JV_API_L2CAP_STOP_SERVER_EVT */
     bta_jv_l2cap_read,              /* BTA_JV_API_L2CAP_READ_EVT */
     bta_jv_l2cap_write,             /* BTA_JV_API_L2CAP_WRITE_EVT */
+#endif /* BTA_JV_L2CAP_INCLUDED */
     bta_jv_rfcomm_connect,          /* BTA_JV_API_RFCOMM_CONNECT_EVT */
     bta_jv_rfcomm_close,            /* BTA_JV_API_RFCOMM_CLOSE_EVT */
     bta_jv_rfcomm_start_server,     /* BTA_JV_API_RFCOMM_START_SERVER_EVT */
     bta_jv_rfcomm_stop_server,      /* BTA_JV_API_RFCOMM_STOP_SERVER_EVT */
     bta_jv_rfcomm_read,             /* BTA_JV_API_RFCOMM_READ_EVT */
     bta_jv_rfcomm_write,            /* BTA_JV_API_RFCOMM_WRITE_EVT */
+    bta_jv_rfcomm_flow_control,     /* BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT */
     bta_jv_set_pm_profile,          /* BTA_JV_API_SET_PM_PROFILE_EVT */
     bta_jv_change_pm_state,         /* BTA_JV_API_PM_STATE_CHANGE_EVT */
+#if BTA_JV_L2CAP_INCLUDED
     bta_jv_l2cap_connect_le,        /* BTA_JV_API_L2CAP_CONNECT_LE_EVT */
     bta_jv_l2cap_start_server_le,   /* BTA_JV_API_L2CAP_START_SERVER_LE_EVT */
     bta_jv_l2cap_stop_server_le,    /* BTA_JV_API_L2CAP_STOP_SERVER_LE_EVT */
     bta_jv_l2cap_write_fixed,       /* BTA_JV_API_L2CAP_WRITE_FIXED_EVT */
     bta_jv_l2cap_close_fixed,       /*  BTA_JV_API_L2CAP_CLOSE_FIXED_EVT */
+#endif /* BTA_JV_L2CAP_INCLUDED */
 };
 
 /*******************************************************************************

components/bt/bluedroid/bta/jv/include/bta_jv_int.h

@@ -48,25 +48,30 @@ enum {
     BTA_JV_API_START_DISCOVERY_EVT,
     BTA_JV_API_CREATE_RECORD_EVT,
     BTA_JV_API_DELETE_RECORD_EVT,
+#if BTA_JV_L2CAP_INCLUDED
     BTA_JV_API_L2CAP_CONNECT_EVT,
     BTA_JV_API_L2CAP_CLOSE_EVT,
     BTA_JV_API_L2CAP_START_SERVER_EVT,
     BTA_JV_API_L2CAP_STOP_SERVER_EVT,
     BTA_JV_API_L2CAP_READ_EVT,
     BTA_JV_API_L2CAP_WRITE_EVT,
+#endif /* BTA_JV_L2CAP_INCLUDED */
     BTA_JV_API_RFCOMM_CONNECT_EVT,
     BTA_JV_API_RFCOMM_CLOSE_EVT,
     BTA_JV_API_RFCOMM_START_SERVER_EVT,
     BTA_JV_API_RFCOMM_STOP_SERVER_EVT,
     BTA_JV_API_RFCOMM_READ_EVT,
     BTA_JV_API_RFCOMM_WRITE_EVT,
+    BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT,
     BTA_JV_API_SET_PM_PROFILE_EVT,
     BTA_JV_API_PM_STATE_CHANGE_EVT,
+#if BTA_JV_L2CAP_INCLUDED
     BTA_JV_API_L2CAP_CONNECT_LE_EVT,
     BTA_JV_API_L2CAP_START_SERVER_LE_EVT,
     BTA_JV_API_L2CAP_STOP_SERVER_LE_EVT,
     BTA_JV_API_L2CAP_WRITE_FIXED_EVT,
     BTA_JV_API_L2CAP_CLOSE_FIXED_EVT,
+#endif /* BTA_JV_L2CAP_INCLUDED */
     BTA_JV_MAX_INT_EVT
 };
 
@@ -80,6 +85,12 @@ typedef struct {
     tBTA_JV_DM_CBACK   *p_cback;
 } tBTA_JV_API_ENABLE;
 
+/* data type for BTA_JV_API_DISABLE_EVT */
+typedef struct {
+    BT_HDR          hdr;
+    tBTA_JV_RFCOMM_CBACK   *p_cback;
+} tBTA_JV_API_DISABLE;
+
 /* data type for BTA_JV_API_START_DISCOVERY_EVT */
 typedef struct {
     BT_HDR      hdr;
@@ -115,6 +126,8 @@ enum {
     BTA_JV_ST_SR_CLOSING
 } ;
 typedef UINT8  tBTA_JV_STATE;
+
+#if BTA_JV_L2CAP_INCLUDED
 #define BTA_JV_ST_CL_MAX    BTA_JV_ST_CL_CLOSING
 /* JV L2CAP control block */
 typedef struct {
@@ -127,6 +140,7 @@ typedef struct {
     tBTA_JV_PM_CB      *p_pm_cb;    /* ptr to pm control block, NULL: unused */
     void                *user_data; /* user data for callback from higher layers */
 } tBTA_JV_L2C_CB;
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 #define BTA_JV_RFC_HDL_MASK         0xFF
 #define BTA_JV_RFCOMM_MASK          0x80
@@ -156,6 +170,7 @@ typedef struct {
     int                 curr_sess;   /* current sessions count*/
 } tBTA_JV_RFC_CB;
 
+#if BTA_JV_L2CAP_INCLUDED
 /* data type for BTA_JV_API_L2CAP_CONNECT_EVT & BTA_JV_API_L2CAP_CONNECT_LE_EVT */
 typedef struct {
     BT_HDR              hdr;
@@ -233,6 +248,7 @@ typedef struct {
     UINT16              len;
     void                *user_data;
 } tBTA_JV_API_L2CAP_WRITE_FIXED;
+#endif /* BTA_JV_L2CAP_INCLUDED */
 
 /* data type for BTA_JV_API_RFCOMM_CONNECT_EVT */
 typedef struct {
@@ -294,12 +310,21 @@ typedef struct {
     tBTA_JV_PCB     *p_pcb;
 } tBTA_JV_API_RFCOMM_WRITE;
 
+/* data type for BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT */
+typedef struct {
+    BT_HDR      hdr;
+    tBTA_JV_RFC_CB  *p_cb;
+    tBTA_JV_PCB     *p_pcb;
+    UINT16      credits_given;
+} tBTA_JV_API_RFCOMM_FLOW_CONTROL;
+
 /* data type for BTA_JV_API_RFCOMM_CLOSE_EVT */
 typedef struct {
     BT_HDR          hdr;
     UINT32          handle;
     tBTA_JV_RFC_CB  *p_cb;
     tBTA_JV_PCB     *p_pcb;
+    tBTA_JV_RFCOMM_CBACK *p_cback;
     void            *user_data;
 } tBTA_JV_API_RFCOMM_CLOSE;
 
@@ -326,6 +351,8 @@ typedef struct {
     BT_HDR      hdr;
     INT32       type;       /* One of BTA_JV_CONN_TYPE_ */
     UINT16      scn;
+    tBTA_JV_RFCOMM_CBACK *p_cback;
+    void        *user_data;
 } tBTA_JV_API_FREE_CHANNEL;
 
 /* data type for BTA_JV_API_ALLOC_CHANNEL_EVT */
@@ -340,24 +367,28 @@ typedef union {
     /* GKI event buffer header */
     BT_HDR                          hdr;
     tBTA_JV_API_ENABLE              enable;
+    tBTA_JV_API_DISABLE             disable;
     tBTA_JV_API_START_DISCOVERY     start_discovery;
     tBTA_JV_API_ALLOC_CHANNEL       alloc_channel;
     tBTA_JV_API_FREE_CHANNEL        free_channel;
     tBTA_JV_API_CREATE_RECORD       create_record;
     tBTA_JV_API_ADD_ATTRIBUTE       add_attr;
+#if BTA_JV_L2CAP_INCLUDED
     tBTA_JV_API_L2CAP_CONNECT       l2cap_connect;
     tBTA_JV_API_L2CAP_READ          l2cap_read;
     tBTA_JV_API_L2CAP_WRITE         l2cap_write;
     tBTA_JV_API_L2CAP_CLOSE         l2cap_close;
     tBTA_JV_API_L2CAP_SERVER        l2cap_server;
+    tBTA_JV_API_L2CAP_WRITE_FIXED   l2cap_write_fixed;
+#endif /* BTA_JV_L2CAP_INCLUDED */
     tBTA_JV_API_RFCOMM_CONNECT      rfcomm_connect;
     tBTA_JV_API_RFCOMM_READ         rfcomm_read;
     tBTA_JV_API_RFCOMM_WRITE        rfcomm_write;
+    tBTA_JV_API_RFCOMM_FLOW_CONTROL rfcomm_fc;
     tBTA_JV_API_SET_PM_PROFILE      set_pm;
     tBTA_JV_API_PM_STATE_CHANGE     change_pm_state;
     tBTA_JV_API_RFCOMM_CLOSE        rfcomm_close;
     tBTA_JV_API_RFCOMM_SERVER       rfcomm_server;
-    tBTA_JV_API_L2CAP_WRITE_FIXED   l2cap_write_fixed;
 } tBTA_JV_MSG;
 
 /* JV control block */
@@ -368,7 +399,9 @@ typedef struct {
     UINT32                  sdp_handle[BTA_JV_MAX_SDP_REC]; /* SDP records created */
     UINT8                   *p_sel_raw_data;/* the raw data of last service select */
     tBTA_JV_DM_CBACK        *p_dm_cback;
+#if BTA_JV_L2CAP_INCLUDED
     tBTA_JV_L2C_CB          l2c_cb[BTA_JV_MAX_L2C_CONN];    /* index is GAP handle (index) */
+#endif /* BTA_JV_L2CAP_INCLUDED */
     tBTA_JV_RFC_CB          rfc_cb[BTA_JV_MAX_RFC_CONN];
     tBTA_JV_PCB             port_cb[MAX_RFC_PORTS];         /* index of this array is
                                                                the port_handle, */
@@ -407,25 +440,29 @@ extern void bta_jv_free_scn (tBTA_JV_MSG *p_data);
 extern void bta_jv_start_discovery (tBTA_JV_MSG *p_data);
 extern void bta_jv_create_record (tBTA_JV_MSG *p_data);
 extern void bta_jv_delete_record (tBTA_JV_MSG *p_data);
+#if BTA_JV_L2CAP_INCLUDED
 extern void bta_jv_l2cap_connect (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_close (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_start_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_stop_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_read (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_write (tBTA_JV_MSG *p_data);
+#endif /* BTA_JV_L2CAP_INCLUDED */
 extern void bta_jv_rfcomm_connect (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_close (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_start_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_stop_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_read (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_write (tBTA_JV_MSG *p_data);
+extern void bta_jv_rfcomm_flow_control(tBTA_JV_MSG *p_data);
 extern void bta_jv_set_pm_profile (tBTA_JV_MSG *p_data);
 extern void bta_jv_change_pm_state(tBTA_JV_MSG *p_data);
+#if BTA_JV_L2CAP_INCLUDED
 extern void bta_jv_l2cap_connect_le (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_start_server_le (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_stop_server_le (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_write_fixed (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_close_fixed (tBTA_JV_MSG *p_data);
-
+#endif /* BTA_JV_L2CAP_INCLUDED */
 #endif  ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE
 #endif /* BTA_JV_INT_H */

components/bt/bluedroid/bta/sys/bta_sys_main.c

@@ -501,7 +501,6 @@ void bta_sys_event(BT_HDR *p_msg)
     if (freebuf) {
         osi_free(p_msg);
     }
-
 }
 
 /*******************************************************************************
@@ -635,6 +634,26 @@ UINT32 bta_sys_get_remaining_ticks(TIMER_LIST_ENT *p_target_tle)
     return remaining_ms;
 }
 
+/*******************************************************************************
+**
+** Function         bta_sys_timer_is_active
+**
+** Description      Get info of one-shot timer is active or not.
+**
+** Returns          true if timer is exist and active, false otherwise.
+**
+*******************************************************************************/
+BOOLEAN bta_sys_timer_is_active(TIMER_LIST_ENT *p_tle)
+{
+    assert(p_tle != NULL);
+
+    osi_alarm_t *alarm = hash_map_get(bta_alarm_hash_map, p_tle);
+    if (alarm != NULL && osi_alarm_is_active(alarm)) {
+        return TRUE;
+    }
+
+    return FALSE;
+}
 
 /*******************************************************************************
 **

components/bt/bluedroid/btc/core/btc_ble_storage.c

@@ -80,7 +80,7 @@ static void _btc_storage_save(void)
             //delete device info
             string_to_bdaddr(need_remove_section, &bd_addr);
             BTM_SecDeleteDevice(bd_addr.address, BT_TRANSPORT_LE);
-            //delet config info
+            //delete config info
             if(btc_config_remove_section(need_remove_section)) {
                 BTIF_TRACE_WARNING("exceeded the maximum nubmer of bonded devices, delete the last device info : %s", need_remove_section);
             }
@@ -893,11 +893,12 @@ bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev
         if (_btc_storage_get_ble_bonding_key(&bd_addr, BTM_LE_KEY_PID, buffer, sizeof(tBTM_LE_PID_KEYS)) == BT_STATUS_SUCCESS) {
             bond_dev->bond_key.key_mask |= ESP_BLE_ID_KEY_MASK;
             tBTM_LE_PID_KEYS *pid_key = (tBTM_LE_PID_KEYS *) buffer;
-            memcpy(&bond_dev->bond_key.pid_key.irk, pid_key->irk, BT_OCTET16_LEN);
+            //Note: The memory size of the pid_key.addr_type in bond_key is different from that of (tBTM_LE_PID_KEYS) *pid_key.
+            memcpy(&bond_dev->bond_key.pid_key.irk, pid_key->irk, ESP_BT_OCTET16_LEN);
             bond_dev->bond_key.pid_key.addr_type = pid_key->addr_type;
-            memcpy(&bond_dev->bond_key.pid_key.static_addr, pid_key->static_addr, sizeof(BD_ADDR));
+            memcpy(&bond_dev->bond_key.pid_key.static_addr, pid_key->static_addr, ESP_BD_ADDR_LEN);
         }
-        //serch for the next bond device
+        //search for the next bond device
         bond_dev++;
     }
     btc_config_unlock();

components/bt/bluedroid/btc/core/btc_dm.c

@@ -22,7 +22,7 @@
 #include "common/bt_target.h"
 #include "btc/btc_storage.h"
 #include "btc/btc_ble_storage.h"
-#include "esp_gap_ble_api.h"
+#include "btc_gap_ble.h"
 #include "btm_int.h"
 #include "bta/bta_api.h"
 #include "bta/bta_gatt_api.h"
@@ -103,7 +103,7 @@ void btc_dm_sec_arg_deep_copy(btc_msg_t *msg, void *dst, void *src)
 
 void btc_dm_sec_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC *data)
 {
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
 
     msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_DM_SEC;
@@ -299,6 +299,27 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 }
 #endif ///SMP_INCLUDED == TRUE
 
+static void btc_dm_link_up_evt(tBTA_DM_LINK_UP *p_link_up)
+{
+    BD_ADDR bd_addr;
+    bt_bdaddr_t bt_bdaddr;
+
+
+    if (p_link_up->sc_downgrade == 1) {
+        memcpy(bt_bdaddr.address, p_link_up->bd_addr, sizeof(BD_ADDR));
+        if (btc_storage_remove_bonded_device(&bt_bdaddr) == BT_STATUS_SUCCESS) {
+            memcpy(bd_addr, p_link_up->bd_addr, sizeof(BD_ADDR));
+            if (BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS) {
+                BTC_TRACE_EVENT(" %s() Bonding information removed.", __FUNCTION__);
+            } else {
+                BTC_TRACE_ERROR(" %s() BTA_DmRemoveDevice error", __FUNCTION__);
+            }
+        } else {
+            BTC_TRACE_ERROR(" %s() btc_storage_remove_bonded_device error", __FUNCTION__);
+        }
+    }
+}
+
 static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 {
     /* Save link key, if not temporary */
@@ -322,7 +343,7 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
                           __FUNCTION__, p_auth_cmpl->key_type);
                 ret = btc_storage_add_bonded_device(&bd_addr,
                                                     p_auth_cmpl->key, p_auth_cmpl->key_type,
-                                                    16);
+                                                    16, p_auth_cmpl->sc_support);
                 BTC_ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
             } else {
                 BTC_TRACE_DEBUG("%s: Temporary key. Not storing. key_type=0x%x",
@@ -370,6 +391,7 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
             break;
         default:
             status =  BT_STATUS_FAIL;
+            break;
         }
     }
 #if (BTC_GAP_BT_INCLUDED == TRUE)
@@ -383,11 +405,10 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
     memcpy(param.auth_cmpl.bda, p_auth_cmpl->bd_addr, ESP_BD_ADDR_LEN);
     memcpy(param.auth_cmpl.device_name, p_auth_cmpl->bd_name, ESP_BT_GAP_MAX_BDNAME_LEN + 1);
 
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);
 
     if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
     }
 
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
@@ -406,11 +427,10 @@ static void btc_dm_pin_req_evt(tBTA_DM_PIN_REQ *p_pin_req)
     param.pin_req.min_16_digit = p_pin_req->min_16_digit;
     memcpy(param.pin_req.bda, p_pin_req->bd_addr, ESP_BD_ADDR_LEN);
 
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);
 
     if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
     }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
@@ -434,11 +454,10 @@ static void btc_dm_sp_cfm_req_evt(tBTA_DM_SP_CFM_REQ *p_cfm_req)
     param.cfm_req.num_val = p_cfm_req->num_val;
     memcpy(param.cfm_req.bda, p_cfm_req->bd_addr, ESP_BD_ADDR_LEN);
 
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);
 
     if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
     }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
@@ -455,11 +474,10 @@ static void btc_dm_sp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF *p_key_notif)
     param.key_notif.passkey = p_key_notif->passkey;
     memcpy(param.key_notif.bda, p_key_notif->bd_addr, ESP_BD_ADDR_LEN);
 
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);
 
     if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
     }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
@@ -475,16 +493,43 @@ static void btc_dm_sp_key_req_evt(tBTA_DM_SP_KEY_REQ *p_key_req)
     msg.act = BTC_GAP_BT_KEY_REQ_EVT;
     memcpy(param.key_req.bda, p_key_req->bd_addr, ESP_BD_ADDR_LEN);
 
-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);
 
     if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
     }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
 #endif /// BT_SSP_INCLUDED == TRUE
 
+static void btc_dm_dev_unpaired_evt(tBTA_DM_LINK_DOWN *p_link_down)
+{
+    esp_bt_gap_cb_param_t param;
+    BTC_TRACE_DEBUG("%s",__func__);
+    memcpy(param.remove_bond_dev_cmpl.bda, p_link_down->bd_addr, ESP_BD_ADDR_LEN);
+    btm_set_bond_type_dev(p_link_down->bd_addr, BOND_TYPE_UNKNOWN);
+    if (p_link_down->status == HCI_SUCCESS) {
+        //remove the bonded key in the config and nvs flash.
+        param.remove_bond_dev_cmpl.status = btc_storage_remove_bonded_device((bt_bdaddr_t *)param.remove_bond_dev_cmpl.bda);
+    } else {
+        param.remove_bond_dev_cmpl.status = ESP_BT_STATUS_FAIL;
+    }
+
+#if (BTC_GAP_BT_INCLUDED == TRUE)
+    bt_status_t ret;
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_REMOVE_BOND_DEV_COMPLETE_EVT;
+
+    ret = btc_inter_profile_call(&msg, &param);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
+    }
+#endif /// BTC_GAP_BT_INCLUDED == TRUE
+}
+
 tBTA_SERVICE_MASK btc_get_enabled_services_mask(void)
 {
     return btc_enabled_services;
@@ -622,16 +667,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
 #endif ///BT_SSP_INCLUDED == TRUE
 
     case BTA_DM_DEV_UNPAIRED_EVT: {
-#if (SMP_INCLUDED == TRUE)
-        bt_bdaddr_t bd_addr;
-        BTC_TRACE_DEBUG("BTA_DM_DEV_UNPAIRED_EVT");
-        memcpy(bd_addr.address, p_data->link_down.bd_addr, sizeof(BD_ADDR));
-        btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
-        if (p_data->link_down.status == HCI_SUCCESS) {
-            //remove the bonded key in the config and nvs flash.
-            btc_storage_remove_bonded_device(&bd_addr);
-        }
-#endif /* #if (SMP_INCLUDED == TRUE) */
+        btc_dm_dev_unpaired_evt(&p_data->link_down);
         break;
     }
     case BTA_DM_BLE_DEV_UNPAIRED_EVT: {
@@ -664,12 +700,14 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
         break;
         }
 #endif /* BTC_GAP_BT_INCLUDED  == TRUE */
-    case BTA_DM_LINK_UP_EVT:
     case BTA_DM_LINK_DOWN_EVT:
     case BTA_DM_HW_ERROR_EVT:
         BTC_TRACE_DEBUG( "btc_dm_sec_cback : unhandled event (%d)\n", msg->act );
         break;
-#if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
+    case BTA_DM_LINK_UP_EVT:
+        btc_dm_link_up_evt(&p_data->link_up);
+        break;
+#if ((BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
     case BTA_DM_BLE_AUTH_CMPL_EVT: {
         rsp_app = true;
         ble_msg.act = ESP_GAP_BLE_AUTH_CMPL_EVT;
@@ -706,8 +744,12 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
                 pairing_cb.ble.is_pid_key_rcvd = TRUE;
                 memcpy(&pairing_cb.ble.pid_key, &p_data->ble_key.p_key_value->pid_key,
                             sizeof(tBTM_LE_PID_KEYS));
-                memcpy(&param.ble_security.ble_key.p_key_value.pid_key,
-                             &p_data->ble_key.p_key_value->pid_key, sizeof(tBTM_LE_PID_KEYS));
+                //Note: The memory size of the addr_type in ble_security.ble_key.p_key_value.pid_key is different from that of p_data->ble_key.p_key_value->pid_key.
+                memcpy(&param.ble_security.ble_key.p_key_value.pid_key.irk,
+                             &p_data->ble_key.p_key_value->pid_key.irk, ESP_BT_OCTET16_LEN);
+                param.ble_security.ble_key.p_key_value.pid_key.addr_type = p_data->ble_key.p_key_value->pid_key.addr_type;
+                memcpy(&param.ble_security.ble_key.p_key_value.pid_key.static_addr,
+                             &p_data->ble_key.p_key_value->pid_key.static_addr, ESP_BD_ADDR_LEN);
                 break;
             }
             case BTM_LE_KEY_PCSRK: {
@@ -828,11 +870,10 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
     }
 
     if (rsp_app) {
-        ret = btc_transfer_context(&ble_msg, &param,
-                                   sizeof(esp_ble_gap_cb_param_t), NULL);
+        ret = btc_inter_profile_call(&ble_msg, &param);
 
         if (ret != BT_STATUS_SUCCESS) {
-            BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+            BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
         }
     }
     btc_dm_sec_arg_deep_free(msg);

components/bt/bluedroid/btc/core/btc_main.c

@@ -67,11 +67,18 @@ static void btc_init_bluetooth(void)
     //load the ble local key which has been stored in the flash
     btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
+#if BTA_DYNAMIC_MEMORY
+    deinit_semaphore = xSemaphoreCreateBinary();
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 
 static void btc_deinit_bluetooth(void)
 {
+    /* Wait for the disable operation to complete */
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreTake(deinit_semaphore, BTA_DISABLE_DELAY / portTICK_PERIOD_MS);
+#endif /* #if BTA_DYNAMIC_MEMORY */
     btc_gap_ble_deinit();
     bta_dm_sm_deinit();
 #if (GATTC_INCLUDED)
@@ -87,6 +94,10 @@ static void btc_deinit_bluetooth(void)
     osi_alarm_deinit();
     osi_alarm_delete_mux();
     future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);
+#if BTA_DYNAMIC_MEMORY
+    vSemaphoreDelete(deinit_semaphore);
+    deinit_semaphore = NULL;
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 void btc_main_call_handler(btc_msg_t *msg)

components/bt/bluedroid/btc/core/btc_storage.c

@@ -37,7 +37,8 @@
 bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
         LINK_KEY link_key,
         uint8_t key_type,
-        uint8_t pin_length)
+        uint8_t pin_length,
+        BOOLEAN sc_support)
 {
     bdstr_t bdstr;
 
@@ -48,6 +49,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
     int ret = btc_config_set_int(bdstr, BTC_STORAGE_LINK_KEY_TYPE_STR, (int)key_type);
     ret &= btc_config_set_int(bdstr, BTC_STORAGE_PIN_LENGTH_STR, (int)pin_length);
     ret &= btc_config_set_bin(bdstr, BTC_STORAGE_LINK_KEY_STR, link_key, sizeof(LINK_KEY));
+    ret &= btc_config_set_bin(bdstr, BTC_STORAGE_SC_SUPPORT, (uint8_t *)&sc_support, sizeof(sc_support));
     /* write bonded info immediately */
     btc_config_flush();
     btc_config_unlock();
@@ -69,6 +71,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
 static bt_status_t btc_in_fetch_bonded_devices(int add)
 {
     BOOLEAN bt_linkkey_file_found = FALSE;
+    UINT8 sc_support = 0;
 
     btc_config_lock();
     for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end(); iter = btc_config_section_next(iter)) {
@@ -93,9 +96,11 @@ static bt_status_t btc_in_fetch_bonded_devices(int add)
                         uint2devclass((UINT32)cod, dev_class);
                     }
                     btc_config_get_int(name, BTC_STORAGE_PIN_LENGTH_STR, &pin_length);
+                    size = sizeof(sc_support);
+                    btc_config_get_bin(name, BTC_STORAGE_SC_SUPPORT, &sc_support, &size);
 #if (SMP_INCLUDED == TRUE)
                     BTA_DmAddDevice(bd_addr.address, dev_class, link_key, 0, 0,
-                                    (UINT8)linkkey_type, 0, pin_length);
+                                    (UINT8)linkkey_type, 0, pin_length, (UINT8)sc_support);
 #endif  ///SMP_INCLUDED == TRUE
                 }
                 bt_linkkey_file_found = TRUE;
@@ -160,6 +165,9 @@ bt_status_t btc_storage_remove_bonded_device(bt_bdaddr_t *remote_bd_addr)
     if (btc_config_exist(bdstr, BTC_STORAGE_LINK_KEY_STR)) {
         ret &= btc_config_remove(bdstr, BTC_STORAGE_LINK_KEY_STR);
     }
+    if (btc_config_exist(bdstr, BTC_STORAGE_SC_SUPPORT)) {
+        ret &= btc_config_remove(bdstr, BTC_STORAGE_SC_SUPPORT);
+    }
     /* write bonded info immediately */
     btc_config_flush();
     btc_config_unlock();
@@ -187,12 +195,12 @@ int btc_storage_get_num_bt_bond_devices(void)
         if (string_is_bdaddr(name) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
             btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
+            btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
             num_dev++;
         }
     }
     btc_config_unlock();
-
     return num_dev;
 }
 
@@ -206,15 +214,17 @@ int btc_storage_get_num_bt_bond_devices(void)
 **                  BT_STATUS_FAIL otherwise
 **
 *******************************************************************************/
-bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int dev_num)
+bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int *dev_num)
 {
     bt_bdaddr_t bd_addr;
+    int in_dev_num = *dev_num; /* buffer size */
+    int out_dev_num = 0; /* bond_dev size */
 
     btc_config_lock();
     for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end();
             iter = btc_config_section_next(iter)) {
 
-        if (dev_num-- <= 0) {
+        if (in_dev_num <= 0) {
             break;
         }
 
@@ -223,13 +233,17 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
         if (string_is_bdaddr(name) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
             btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
+            btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
             string_to_bdaddr(name, &bd_addr);
             memcpy(bond_dev, &bd_addr, sizeof(bt_bdaddr_t));
+            in_dev_num--;
+            out_dev_num++;
             bond_dev++;
         }
     }
+    *dev_num = out_dev_num; /* out_dev_num <= in_dev_num */
     btc_config_unlock();
 
     return BT_STATUS_SUCCESS;
-}
+}

components/bt/bluedroid/btc/include/btc/btc_storage.h

@@ -25,6 +25,7 @@
 #define BTC_STORAGE_LINK_KEY_STR        "LinkKey"    /* same as the ble */
 #define BTC_STORAGE_LINK_KEY_TYPE_STR   "LinkKeyType"
 #define BTC_STORAGE_PIN_LENGTH_STR      "PinLength"
+#define BTC_STORAGE_SC_SUPPORT          "SCSupport"
 
 /*******************************************************************************
 **
@@ -40,7 +41,8 @@
 bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
         LINK_KEY link_key,
         uint8_t key_type,
-        uint8_t pin_length);
+        uint8_t pin_length,
+        BOOLEAN sc_support);
 
 /*******************************************************************************
 **
@@ -87,6 +89,6 @@ int btc_storage_get_num_bt_bond_devices(void);
 **                  BT_STATUS_FAIL otherwise
 **
 *******************************************************************************/
-bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int dev_num);
+bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int *dev_num);
 
 #endif /* BTC_STORAGE_H */

components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c

@@ -36,8 +36,9 @@
 #include "blufi_int.h"
 
 #include "esp_blufi_api.h"
+#include "esp_gatt_common_api.h"
 
-#if (GATTS_INCLUDED == TRUE)
+#if (BLUFI_INCLUDED == TRUE)
 
 #define BT_BD_ADDR_STR         "%02x:%02x:%02x:%02x:%02x:%02x"
 #define BT_BD_ADDR_HEX(addr)   addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]
@@ -147,6 +148,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
             if (blufi_env.prepare_buf == NULL) {
                 blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
+                blufi_env.prepare_len = 0;
                 if (blufi_env.prepare_buf == NULL) {
                     BLUFI_TRACE_ERROR("Blufi prep no mem\n");
                     status = GATT_NO_RESOURCES;
@@ -174,6 +176,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                 if (blufi_env.prepare_buf) {
                     osi_free(blufi_env.prepare_buf);
                     blufi_env.prepare_buf = NULL;
+                    blufi_env.prepare_len = 0;
                 }
                 BLUFI_TRACE_ERROR("write data error , error code 0x%x\n", status);
                 return;
@@ -209,6 +212,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         if (blufi_env.prepare_buf) {
             osi_free(blufi_env.prepare_buf);
             blufi_env.prepare_buf = NULL;
+            blufi_env.prepare_len = 0;
         }
 
         break;
@@ -280,6 +284,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
         blufi_env.conn_id = p_data->conn.conn_id;
         blufi_env.is_connected = true;
+        blufi_env.recv_seq = blufi_env.send_seq = 0;
 
         msg.sig = BTC_SIG_API_CB;
         msg.pid = BTC_PID_BLUFI;
@@ -302,7 +307,6 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
         memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
         blufi_env.conn_id = p_data->conn.conn_id;
-        blufi_env.is_connected = false;
         blufi_env.recv_seq = blufi_env.send_seq = 0;
         blufi_env.sec_mode = 0x0;
 
@@ -426,11 +430,19 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
             blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
             if (blufi_env.aggr_buf == NULL) {
                 BTC_TRACE_ERROR("%s no mem, len %d\n", __func__, blufi_env.total_len);
+                btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
                 return;
             }
         }
-        memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len  - 2);
-        blufi_env.offset += (hdr->data_len - 2);
+        if (blufi_env.offset + hdr->data_len  - 2 <= blufi_env.total_len){
+            memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len  - 2);
+            blufi_env.offset += (hdr->data_len - 2);
+        } else {
+            BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
+            btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+            return;
+        }
+
     } else {
         if (blufi_env.offset > 0) {   /* if previous pkt is frag */
             memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);
@@ -445,6 +457,7 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
         }
     }
 }
+
 void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
 {
     struct blufi_hdr *hdr = NULL;
@@ -452,6 +465,11 @@ void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
     uint16_t checksum;
     int ret;
 
+    if (blufi_env.is_connected == false) {
+        BTC_TRACE_ERROR("blufi connection has been disconnected \n");
+        return;
+    }
+
     while (remain_len > 0) {
         if (remain_len > blufi_env.frag_size) {
             hdr = osi_malloc(sizeof(struct blufi_hdr) + 2 + blufi_env.frag_size + 2);
@@ -515,10 +533,21 @@ void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
             remain_len -= hdr->data_len;
         }
 
-        btc_blufi_send_notify((uint8_t *)hdr,
+retry:
+        if (blufi_env.is_connected == false) {
+            return;
+        }
+
+        if (esp_ble_get_cur_sendable_packets_num(BTC_GATT_GET_CONN_ID(blufi_env.conn_id)) > 0) {
+            btc_blufi_send_notify((uint8_t *)hdr,
                 ((hdr->fc & BLUFI_FC_CHECK) ?
                  hdr->data_len + sizeof(struct blufi_hdr) + 2 :
                  hdr->data_len + sizeof(struct blufi_hdr)));
+        } else {
+            BTC_TRACE_WARNING("%s wait to send blufi custom data\n", __func__);
+            vTaskDelay(pdMS_TO_TICKS(10));
+            goto retry;
+        }
 
         osi_free(hdr);
         hdr =  NULL;
@@ -585,7 +614,7 @@ static void btc_blufi_wifi_conn_report(uint8_t opmode, uint8_t sta_conn_state, u
             *p++ = info->softap_max_conn_num;
         }
         if (info->softap_channel_set) {
-            *p++ = BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_MAX_CONN_NUM;
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_CHANNEL;
             *p++ = 1;
             *p++ = info->softap_channel;
         }
@@ -1106,4 +1135,4 @@ uint16_t btc_blufi_get_version(void)
     return BTC_BLUFI_VERSION;
 }
 
-#endif	///GATTS_INCLUDED == TRUE
+#endif  ///BLUFI_INCLUDED == TRUE

components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c

@@ -35,7 +35,7 @@
 
 //#include "esp_wifi.h"
 
-#if (GATTS_INCLUDED == TRUE)
+#if (BLUFI_INCLUDED == TRUE)
 extern tBLUFI_ENV blufi_env;
 
 void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
@@ -269,4 +269,5 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
     }
 }
 
-#endif	///(GATTS_INCLUDED == TRUE)
+#endif  ///BLUFI_INCLUDED == TRUE
+

components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h

@@ -15,6 +15,7 @@
 #ifndef __BLUFI_INT_H__
 #define __BLUFI_INT_H__
 
+#if (BLUFI_INCLUDED == TRUE)
 #define BTC_BLUFI_GREAT_VER   0x01  //Version + Subversion
 #define BTC_BLUFI_SUB_VER     0x02  //Version + Subversion
 #define BTC_BLUFI_VERSION     ((BTC_BLUFI_GREAT_VER<<8)|BTC_BLUFI_SUB_VER)  //Version + Subversion
@@ -184,3 +185,4 @@ void btc_blufi_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 void btc_blufi_cb_deep_free(btc_msg_t *msg);
 
 #endif /* __BLUFI_INT_H__ */
+#endif  ///BLUFI_INCLUDED == TRUE

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp.c

@@ -38,7 +38,7 @@
 *******************************************************************************/
 void btc_a2dp_on_init(void)
 {
-    //tput_mon(1, 0, 1);
+    BTC_TRACE_EVENT("A2DP Initialized.");
 }
 
 /*****************************************************************************

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c

@@ -127,12 +127,16 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
     switch (ctrl) {
     case ESP_A2D_MEDIA_CTRL_CHECK_SRC_RDY:
 #if BTC_AV_SRC_INCLUDED
-        if (btc_a2dp_source_is_task_shutting_down()) {
-            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
-        } else if ((btc_av_stream_ready() == TRUE) ||
-                   (btc_av_stream_started_ready() == TRUE)) {
-            /* check whether av is ready to setup a2dp datapath */
-            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+        if (btc_av_get_service_id() == BTA_A2DP_SOURCE_SERVICE_ID) {
+            if (btc_a2dp_source_is_task_shutting_down()) {
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
+            } else if ((btc_av_stream_ready() == TRUE) ||
+                    (btc_av_stream_started_ready() == TRUE)) {
+                /* check whether av is ready to setup a2dp datapath */
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+            } else {
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
+            }
         } else {
             btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
         }
@@ -159,6 +163,10 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
         }
         break;
     case ESP_A2D_MEDIA_CTRL_STOP:
+        if (btc_av_is_connected() == FALSE) {
+            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
+            break;
+        }
 #if BTC_AV_SRC_INCLUDED
         if (btc_av_get_peer_sep() == AVDT_TSEP_SNK && !btc_a2dp_source_is_streaming() &&
                 btc_av_get_service_id() == BTA_A2DP_SOURCE_SERVICE_ID) {
@@ -174,7 +182,6 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
         }
 #endif
         break;
-
     case ESP_A2D_MEDIA_CTRL_SUSPEND:
         /* local suspend */
         if (btc_av_stream_started_ready()) {
@@ -184,14 +191,15 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
                 btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
             }
 #endif
-        } else {
+        } else if (btc_av_is_connected() == TRUE) {
             /* we are not in started state; just ack back ok. This can happen if we are
                remotely suspended; clear REMOTE SUSPEND Flag */
             btc_av_clear_remote_suspend_flag();
             btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+        } else {
+            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
         }
         break;
-
     default :
         APPL_TRACE_ERROR("### A2DP-MEDIA EVENT %u NOT HANDLED ###", ctrl);
         btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c

@@ -88,7 +88,8 @@ enum {
    layers we might need to temporarily buffer up data */
 
 /* 18 frames is equivalent to 6.89*18*2.9 ~= 360 ms @ 44.1 khz, 20 ms mediatick */
-#define MAX_OUTPUT_A2DP_SNK_FRAME_QUEUE_SZ     (18)
+#define JITTER_BUFFER_WATER_LEVEL (15)
+#define MAX_OUTPUT_A2DP_SNK_FRAME_QUEUE_SZ     (18 + JITTER_BUFFER_WATER_LEVEL)
 
 typedef struct {
     UINT16 num_frames_to_be_processed;
@@ -458,7 +459,7 @@ static void btc_a2dp_sink_data_ready(UNUSED_ATTR void *context)
     tBT_SBC_HDR *p_msg;
 
     if (fixed_queue_is_empty(btc_aa_snk_cb.RxSbcQ)) {
-        APPL_TRACE_DEBUG("  QUE  EMPTY ");
+        APPL_TRACE_ERROR("  QUE  EMPTY ");
     } else {
         if (btc_aa_snk_cb.rx_flush == TRUE) {
             btc_a2dp_sink_flush_q(btc_aa_snk_cb.RxSbcQ);
@@ -775,8 +776,13 @@ UINT8 btc_a2dp_sink_enque_buf(BT_HDR *p_pkt)
                                             p_pkt->offset + p_pkt->len)) != NULL) {
         memcpy(p_msg, p_pkt, (sizeof(BT_HDR) + p_pkt->offset + p_pkt->len));
         p_msg->num_frames_to_be_processed = (*((UINT8 *)(p_msg + 1) + p_msg->offset)) & 0x0f;
-        APPL_TRACE_VERBOSE("btc_a2dp_sink_enque_buf %d + \n", p_msg->num_frames_to_be_processed);
+        APPL_TRACE_DEBUG("btc_a2dp_sink_enque_buf %d + \n", p_msg->num_frames_to_be_processed);
         fixed_queue_enqueue(btc_aa_snk_cb.RxSbcQ, p_msg);
+
+        if (fixed_queue_length(btc_aa_snk_cb.RxSbcQ) < JITTER_BUFFER_WATER_LEVEL) {
+            return fixed_queue_length(btc_aa_snk_cb.RxSbcQ);
+        }
+
         btc_a2dp_sink_data_post(BTC_A2DP_SINK_DATA_EVT);
     } else {
         /* let caller deal with a failed allocation */

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c

@@ -1290,8 +1290,6 @@ BOOLEAN btc_media_aa_read_feeding(void)
     /* Read Data from data channel */
     nb_byte_read = btc_aa_src_data_read((uint8_t *)read_buffer, read_size);
 
-    //tput_mon(TRUE, nb_byte_read, FALSE);
-
     if (nb_byte_read < read_size) {
         APPL_TRACE_WARNING("### UNDERRUN :: ONLY READ %d BYTES OUT OF %d ###",
                            nb_byte_read, read_size);
@@ -1503,7 +1501,7 @@ static void btc_a2dp_source_handle_timer(UNUSED_ATTR void *context)
     log_tstamps_us("media task tx timer");
 
 #if (BTA_AV_INCLUDED == TRUE)
-    if (btc_a2dp_source_state != BTC_A2DP_SOURCE_STATE_ON){
+    if (btc_a2dp_source_state != BTC_A2DP_SOURCE_STATE_ON || g_a2dp_source_ongoing_deinit){
         return;
     }
 

components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c

@@ -42,6 +42,18 @@
 
 #if BTC_AV_INCLUDED
 
+// global variable to inidcate avrc is initialized with a2dp
+bool g_av_with_rc;
+// global variable to indicate a2dp is initialized
+bool g_a2dp_on_init;
+// global variable to indicate a2dp is deinitialized
+bool g_a2dp_on_deinit;
+// global variable to indicate a2dp source deinitialization is ongoing
+bool g_a2dp_source_ongoing_deinit;
+// global variable to indicate a2dp sink deinitialization is ongoing
+bool g_a2dp_sink_ongoing_deinit;
+
+
 /*****************************************************************************
 **  Constants & Macros
 ******************************************************************************/
@@ -86,6 +98,10 @@ typedef struct {
     uint16_t uuid;
 } btc_av_connect_req_t;
 
+typedef struct {
+    bt_bdaddr_t target_bda;
+} btc_av_disconn_req_t;
+
 /*****************************************************************************
 **  Static variables
 ******************************************************************************/
@@ -120,6 +136,7 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *data);
 static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *data);
 static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *data);
 static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *data);
+static void clean_up(int service_id);
 
 #if BTC_AV_SRC_INCLUDED
 static bt_status_t btc_a2d_src_init(void);
@@ -284,7 +301,7 @@ static void btc_report_audio_state(esp_a2d_audio_state_t state, bt_bdaddr_t *bd_
 
 static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
 {
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
               dump_av_sm_event_name(event), btc_av_cb.flags);
 
     switch (event) {
@@ -309,20 +326,34 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
     case BTA_AV_PENDING_EVT:
     case BTC_AV_CONNECT_REQ_EVT: {
         if (event == BTC_AV_CONNECT_REQ_EVT) {
-            memcpy(&btc_av_cb.peer_bda, &((btc_av_connect_req_t *)p_data)->target_bda,
-                   sizeof(bt_bdaddr_t));
-            BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
-                       TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
+            memcpy(&btc_av_cb.peer_bda, &((btc_av_connect_req_t *)p_data)->target_bda, sizeof(bt_bdaddr_t));
+            if (g_av_with_rc) {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                        TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
+            } else {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                        FALSE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
+            }
         } else if (event == BTA_AV_PENDING_EVT) {
             bdcpy(btc_av_cb.peer_bda.address, ((tBTA_AV *)p_data)->pend.bd_addr);
-            UINT16 uuid = (btc_av_cb.service_id == BTA_A2DP_SOURCE_SERVICE_ID) ? UUID_SERVCLASS_AUDIO_SOURCE :
-                UUID_SERVCLASS_AUDIO_SINK;
-            BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
-                       TRUE, BTA_SEC_AUTHENTICATE, uuid);
+            UINT16 uuid = (btc_av_cb.service_id == BTA_A2DP_SOURCE_SERVICE_ID) ? UUID_SERVCLASS_AUDIO_SOURCE : UUID_SERVCLASS_AUDIO_SINK;
+            if (g_av_with_rc) {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                        TRUE, BTA_SEC_AUTHENTICATE, uuid);
+            } else {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                       FALSE, BTA_SEC_AUTHENTICATE, uuid);
+            }
         }
         btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_OPENING);
     } break;
 
+
+    case BTC_AV_DISCONNECT_REQ_EVT:
+        BTC_TRACE_WARNING("No Link At All.");
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &((btc_av_disconn_req_t *)p_data)->target_bda, 0);
+        break;
+
     case BTA_AV_RC_OPEN_EVT:
         /* IOP_FIX: Jabra 620 only does RC open without AV open whenever it connects. So
          * as per the AV WP, an AVRC connection cannot exist without an AV connection. Therefore,
@@ -333,7 +364,6 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
          *
          * TODO: We may need to do this only on an AVRCP Play. FixMe
          */
-
 #if BTC_AV_SRC_INCLUDED
         BTC_TRACE_DEBUG("BTA_AV_RC_OPEN_EVT received w/o AV");
         tle_av_open_on_rc = osi_alarm_new("AVconn", btc_initiate_av_open_tmr_hdlr, NULL, BTC_TIMEOUT_AV_OPEN_ON_RC_SECS * 1000);
@@ -361,15 +391,13 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
         break;
 
     default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
         return FALSE;
-
     }
-
     return TRUE;
 }
-/*****************************************************************************
+
+    /*****************************************************************************
 **
 ** Function        btc_av_state_opening_handler
 **
@@ -382,7 +410,7 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
 
 static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
 {
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
               dump_av_sm_event_name(event), btc_av_cb.flags);
 
     switch (event) {
@@ -395,35 +423,36 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
         break;
 
     case BTA_AV_REJECT_EVT:
-        BTC_TRACE_DEBUG(" Received  BTA_AV_REJECT_EVT \n");
+        BTC_TRACE_WARNING(" Received  BTA_AV_REJECT_EVT \n");
         btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), 0);
         btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
         break;
 
     case BTA_AV_OPEN_EVT: {
         tBTA_AV *p_bta_data = (tBTA_AV *)p_data;
-        esp_a2d_connection_state_t state;
+        esp_a2d_connection_state_t conn_stat;
         btc_sm_state_t av_state;
         BTC_TRACE_DEBUG("status:%d, edr 0x%x, peer sep %d\n", p_bta_data->open.status,
                         p_bta_data->open.edr, p_bta_data->open.sep);
 
         if (p_bta_data->open.status == BTA_AV_SUCCESS) {
-            state = ESP_A2D_CONNECTION_STATE_CONNECTED;
-            av_state = BTC_AV_STATE_OPENED;
             btc_av_cb.edr = p_bta_data->open.edr;
-
             btc_av_cb.peer_sep = p_bta_data->open.sep;
+
+            conn_stat = ESP_A2D_CONNECTION_STATE_CONNECTED;
+            av_state = BTC_AV_STATE_OPENED;
         } else {
-            BTC_TRACE_WARNING("BTA_AV_OPEN_EVT::FAILED status: %d\n",
-                     p_bta_data->open.status );
-            state = ESP_A2D_CONNECTION_STATE_DISCONNECTED;
-            av_state  = BTC_AV_STATE_IDLE;
+            BTC_TRACE_WARNING("BTA_AV_OPEN_EVT::FAILED status: %d\n", p_bta_data->open.status );
+
+            conn_stat = ESP_A2D_CONNECTION_STATE_DISCONNECTED;
+            av_state = BTC_AV_STATE_IDLE;
         }
 
         /* inform the application of the event */
-        btc_report_connection_state(state, &(btc_av_cb.peer_bda), 0);
+        btc_report_connection_state(conn_stat, &(btc_av_cb.peer_bda), 0);
         /* change state to open/idle based on the status */
         btc_sm_change_state(btc_av_cb.sm_handle, av_state);
+
         if (btc_av_cb.peer_sep == AVDT_TSEP_SNK) {
             /* if queued PLAY command,  send it now */
             /* necessary to add this?
@@ -432,8 +461,12 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
             */
         } else if (btc_av_cb.peer_sep == AVDT_TSEP_SRC &&
                    (p_bta_data->open.status == BTA_AV_SUCCESS)) {
-            /* Bring up AVRCP connection too */
-            BTA_AvOpenRc(btc_av_cb.bta_handle);
+            /* Bring up AVRCP connection too if AVRC Initialized */
+            if(g_av_with_rc) {
+                BTA_AvOpenRc(btc_av_cb.bta_handle);
+            } else {
+                BTC_TRACE_WARNING("AVRC not Init, not using it.");
+            }
         }
         btc_queue_advance();
     } break;
@@ -473,11 +506,10 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
             break;
         }
 
-        CHECK_RC_EVENT(event, p_data);
+    CHECK_RC_EVENT(event, p_data);
 
     default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
         return FALSE;
 
     }
@@ -498,7 +530,7 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
 
 static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
 {
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
               dump_av_sm_event_name(event), btc_av_cb.flags);
 
     switch (event) {
@@ -539,9 +571,7 @@ static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
     case BTA_AV_CLOSE_EVT: {
         tBTA_AV_CLOSE *close = (tBTA_AV_CLOSE *)p_data;
         /* inform the application that we are disconnecting */
-        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda),
-                                    close->disc_rsn);
-
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), close->disc_rsn);
         btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
         break;
     }
@@ -552,14 +582,12 @@ static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
         break;
 
     default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
         return FALSE;
     }
     return TRUE;
 }
 
-
 /*****************************************************************************
 **
 ** Function     btc_av_state_opened_handler
@@ -569,12 +597,11 @@ static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
 ** Returns      TRUE if event was processed, FALSE otherwise
 **
 *******************************************************************************/
-
 static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
 {
     tBTA_AV *p_av = (tBTA_AV *)p_data;
 
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+     BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
               dump_av_sm_event_name(event), btc_av_cb.flags);
 
     if ( (event == BTA_AV_REMOTE_CMD_EVT) && (btc_av_cb.flags & BTC_AV_FLAG_REMOTE_SUSPEND) &&
@@ -654,10 +681,9 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
 
     case BTC_AV_DISCONNECT_REQ_EVT:
         BTA_AvClose(btc_av_cb.bta_handle);
-        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC) {
+        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC && g_av_with_rc == true) {
             BTA_AvCloseRc(btc_av_cb.bta_handle);
         }
-
         /* inform the application that we are disconnecting */
         btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTING, &(btc_av_cb.peer_bda), 0);
         break;
@@ -665,18 +691,22 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
     case BTA_AV_CLOSE_EVT: {
         /* avdtp link is closed */
         btc_a2dp_on_stopped(NULL);
-
         tBTA_AV_CLOSE *close = (tBTA_AV_CLOSE *)p_data;
         /* inform the application that we are disconnected */
-        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda),
-                                    close->disc_rsn);
-
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), close->disc_rsn);
         /* change state to idle, send acknowledgement if start is pending */
         if (btc_av_cb.flags & BTC_AV_FLAG_PENDING_START) {
             btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
             /* pending start flag will be cleared when exit current state */
         }
+        /* change state to idle, send acknowledgement if start is pending */
         btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
+
+        if (g_a2dp_source_ongoing_deinit) {
+            clean_up(BTA_A2DP_SOURCE_SERVICE_ID);
+        } else if (g_a2dp_sink_ongoing_deinit) {
+            clean_up(BTA_A2DP_SINK_SERVICE_ID);
+        }
         break;
     }
 
@@ -703,11 +733,10 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
         btc_queue_advance();
         break;
 
-        CHECK_RC_EVENT(event, p_data);
+    CHECK_RC_EVENT(event, p_data);
 
     default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
         return FALSE;
 
     }
@@ -728,27 +757,22 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
 {
     tBTA_AV *p_av = (tBTA_AV *)p_data;
 
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
               dump_av_sm_event_name(event), btc_av_cb.flags);
 
     switch (event) {
     case BTC_SM_ENTER_EVT:
-
         /* we are again in started state, clear any remote suspend flags */
         btc_av_cb.flags &= ~BTC_AV_FLAG_REMOTE_SUSPEND;
-
         btc_report_audio_state(ESP_A2D_AUDIO_STATE_STARTED, &(btc_av_cb.peer_bda));
-
         /* increase the a2dp consumer task priority temporarily when start
         ** audio playing, to avoid overflow the audio packet queue. */
         // adjust_priority_a2dp(TRUE);
-
         break;
 
     case BTC_SM_EXIT_EVT:
         /* restore the a2dp consumer task priority when stop audio playing. */
         // adjust_priority_a2dp(FALSE);
-
         break;
 
     case BTC_AV_START_STREAM_REQ_EVT:
@@ -763,11 +787,9 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
     /* fixme -- use suspend = true always to work around issue with BTA AV */
     case BTC_AV_STOP_STREAM_REQ_EVT:
     case BTC_AV_SUSPEND_STREAM_REQ_EVT:
-
         /* set pending flag to ensure btc task is not trying to restart
            stream while suspend is in progress */
         btc_av_cb.flags |= BTC_AV_FLAG_LOCAL_SUSPEND_PENDING;
-
         /* if we were remotely suspended but suspend locally, local suspend
            always overrides */
         btc_av_cb.flags &= ~BTC_AV_FLAG_REMOTE_SUSPEND;
@@ -787,25 +809,19 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
         break;
 
     case BTC_AV_DISCONNECT_REQ_EVT:
-
         /* request avdtp to close */
         BTA_AvClose(btc_av_cb.bta_handle);
-        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC) {
+        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC && g_av_with_rc == true) {
             BTA_AvCloseRc(btc_av_cb.bta_handle);
         }
-
         /* inform the application that we are disconnecting */
         btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTING, &(btc_av_cb.peer_bda), 0);
-
         /* wait in closing state until fully closed */
         btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_CLOSING);
         break;
 
     case BTA_AV_SUSPEND_EVT:
-
-        BTC_TRACE_DEBUG("BTA_AV_SUSPEND_EVT status %d, init %d\n",
-                 p_av->suspend.status, p_av->suspend.initiator);
-
+        BTC_TRACE_DEBUG("BTA_AV_SUSPEND_EVT status %d, init %d\n", p_av->suspend.status, p_av->suspend.initiator);
         /* a2dp suspended, stop media task until resumed */
         btc_a2dp_on_suspended(&p_av->suspend);
 
@@ -824,7 +840,6 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
         if (p_av->suspend.initiator != TRUE) {
             /* remote suspend, notify HAL and await audioflinger to
                suspend/stop stream */
-
             /* set remote suspend flag to block media task from restarting
                stream only if we did not already initiate a local suspend */
             if ((btc_av_cb.flags & BTC_AV_FLAG_LOCAL_SUSPEND_PENDING) == 0) {
@@ -843,42 +858,39 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
         break;
 
     case BTA_AV_STOP_EVT:
-
         btc_av_cb.flags |= BTC_AV_FLAG_PENDING_STOP;
         btc_a2dp_on_stopped(&p_av->suspend);
-
         btc_report_audio_state(ESP_A2D_AUDIO_STATE_STOPPED, &(btc_av_cb.peer_bda));
 
         /* if stop was successful, change state to open */
         if (p_av->suspend.status == BTA_AV_SUCCESS) {
             btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_OPENED);
         }
-
         break;
 
     case BTA_AV_CLOSE_EVT: {
-
         btc_av_cb.flags |= BTC_AV_FLAG_PENDING_STOP;
-
         /* avdtp link is closed */
         btc_a2dp_on_stopped(NULL);
 
         tBTA_AV_CLOSE *close = (tBTA_AV_CLOSE *)p_data;
         /* inform the application that we are disconnected */
-        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda),
-                                    close->disc_rsn);
-
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), close->disc_rsn);
         btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
+
+        if (g_a2dp_source_ongoing_deinit) {
+            clean_up(BTA_A2DP_SOURCE_SERVICE_ID);
+        } else if (g_a2dp_sink_ongoing_deinit) {
+            clean_up(BTA_A2DP_SINK_SERVICE_ID);
+        }
         break;
     }
 
     CHECK_RC_EVENT(event, p_data);
 
     default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
         return FALSE;
-
     }
     return TRUE;
 }
@@ -957,7 +969,6 @@ static void btc_av_event_free_data(btc_sm_event_t event, void *p_data)
 ** Returns          bt_status_t
 **
 *******************************************************************************/
-
 static bt_status_t btc_av_init(int service_id)
 {
     if (btc_av_cb.sm_handle == NULL) {
@@ -974,7 +985,11 @@ static bt_status_t btc_av_init(int service_id)
         }
 
         if (!stat) {
-            return BT_STATUS_FAIL;
+            g_a2dp_on_init = false;
+            g_a2dp_on_deinit = true;
+            g_a2dp_source_ongoing_deinit = false;
+            g_a2dp_sink_ongoing_deinit = false;
+            goto av_init_fail;
         }
 
         /* Also initialize the AV state machine */
@@ -986,12 +1001,20 @@ static bt_status_t btc_av_init(int service_id)
         } else {
             btc_dm_enable_service(BTA_A2DP_SOURCE_SERVICE_ID);
         }
-
         btc_a2dp_on_init();
+        g_a2dp_on_init = true;
+        g_a2dp_on_deinit = false;
+        g_a2dp_source_ongoing_deinit = false;
+        g_a2dp_sink_ongoing_deinit = false;
 
+        esp_a2d_cb_param_t param;
+        memset(&param, 0, sizeof(esp_a2d_cb_param_t));
+        param.a2d_prof_stat.init_state = ESP_A2D_INIT_SUCCESS;
+        btc_a2d_cb_to_app(ESP_A2D_PROF_STATE_EVT, &param);
         return BT_STATUS_SUCCESS;
     }
 
+av_init_fail:
     return BT_STATUS_FAIL;
 }
 
@@ -1038,11 +1061,13 @@ static void clean_up(int service_id)
             tle_av_open_on_rc = NULL;
         }
 #endif /* BTC_AV_SRC_INCLUDED */
+        btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
     }
 
-    btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
-
     if (service_id == BTA_A2DP_SINK_SERVICE_ID) {
+#if BTC_AV_SINK_INCLUDED
+        btc_a2dp_sink_shutdown();
+#endif /* BTC_AV_SINK_INCLUDED */
         btc_dm_disable_service(BTA_A2DP_SINK_SERVICE_ID);
     }
 
@@ -1050,11 +1075,15 @@ static void clean_up(int service_id)
     btc_sm_shutdown(btc_av_cb.sm_handle);
     btc_av_cb.sm_handle = NULL;
 
-    if (service_id == BTA_A2DP_SINK_SERVICE_ID) {
-#if BTC_AV_SINK_INCLUDED
-        btc_a2dp_sink_shutdown();
-#endif /* BTC_AV_SINK_INCLUDED */
-    }
+    esp_a2d_cb_param_t param;
+    memset(&param, 0, sizeof(esp_a2d_cb_param_t));
+    param.a2d_prof_stat.init_state = ESP_A2D_DEINIT_SUCCESS;
+    btc_a2d_cb_to_app(ESP_A2D_PROF_STATE_EVT, &param);
+
+    g_a2dp_on_init = false;
+    g_a2dp_on_deinit = true;
+    g_a2dp_source_ongoing_deinit = false;
+    g_a2dp_sink_ongoing_deinit = false;
 }
 
 /*******************************************************************************
@@ -1229,10 +1258,16 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable, UINT8 tsep)
         /* Added BTA_AV_FEAT_NO_SCO_SSPD - this ensures that the BTA does not
          * auto-suspend av streaming on AG events(SCO or Call). The suspend shall
          * be initiated by the app/audioflinger layers */
-        BTA_AvEnable(BTA_SEC_AUTHENTICATE, (BTA_AV_FEAT_NO_SCO_SSPD)
-                     | BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR
-                     | BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
-                     bte_av_callback);
+        if (g_av_with_rc) {
+            BTC_TRACE_WARNING("A2DP Enable with AVRC")
+            BTA_AvEnable(BTA_SEC_AUTHENTICATE, BTA_AV_FEAT_NO_SCO_SSPD |
+                        BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR |
+                        BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
+                        bte_av_callback);
+        } else {
+            BTC_TRACE_WARNING("A2DP Enable without AVRC")
+            BTA_AvEnable(BTA_SEC_AUTHENTICATE, BTA_AV_FEAT_NO_SCO_SSPD, bte_av_callback);
+        }
         BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos, tsep);
     } else {
         BTA_AvDeregister(btc_av_cb.bta_handle);
@@ -1384,7 +1419,9 @@ void btc_a2dp_call_handler(btc_msg_t *msg)
     }
     case BTC_AV_SINK_API_DISCONNECT_EVT: {
         CHECK_BTAV_INIT();
-        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, NULL);
+        btc_av_disconn_req_t disconn_req;
+        memcpy(&disconn_req.target_bda, &arg->disconn, sizeof(bt_bdaddr_t));
+        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, &disconn_req);
         break;
     }
     case BTC_AV_SINK_API_REG_DATA_CB_EVT: {
@@ -1407,7 +1444,9 @@ void btc_a2dp_call_handler(btc_msg_t *msg)
     }
     case BTC_AV_SRC_API_DISCONNECT_EVT: {
         CHECK_BTAV_INIT();
-        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, NULL);
+        btc_av_disconn_req_t disconn_req;
+        memcpy(&disconn_req.target_bda, &arg->src_disconn, sizeof(bt_bdaddr_t));
+        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, &disconn_req);
         break;
     }
     case BTC_AV_SRC_API_REG_DATA_CB_EVT: {
@@ -1472,7 +1511,15 @@ static bt_status_t btc_a2d_sink_connect(bt_bdaddr_t *remote_bda)
 
 static void btc_a2d_sink_deinit(void)
 {
-    clean_up(BTA_A2DP_SINK_SERVICE_ID);
+    g_a2dp_sink_ongoing_deinit = true;
+    if (btc_av_is_connected()) {
+        BTA_AvClose(btc_av_cb.bta_handle);
+        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC && g_av_with_rc == true) {
+            BTA_AvCloseRc(btc_av_cb.bta_handle);
+        }
+    } else {
+        clean_up(BTA_A2DP_SINK_SERVICE_ID);
+    }
 }
 
 #endif /* BTC_AV_SINK_INCLUDED */
@@ -1497,7 +1544,15 @@ static bt_status_t btc_a2d_src_init(void)
 
 static void btc_a2d_src_deinit(void)
 {
-    clean_up(BTA_A2DP_SOURCE_SERVICE_ID);
+    g_a2dp_source_ongoing_deinit = true;
+    if (btc_av_is_connected()) {
+        BTA_AvClose(btc_av_cb.bta_handle);
+        if (btc_av_cb.peer_sep == AVDT_TSEP_SNK && g_av_with_rc == true) {
+            BTA_AvCloseRc(btc_av_cb.bta_handle);
+        }
+    } else {
+        clean_up(BTA_A2DP_SOURCE_SERVICE_ID);
+    }
 }
 
 static bt_status_t btc_a2d_src_connect(bt_bdaddr_t *remote_bda)