versions: Update version to 3.3.5

Merge branch 'bugfix/fix-modem-sleep-mr-v3.3' into 'release/v3.3'
Fix the bug of modem sleep See merge request espressif/esp-idf!12861
2021-03-25 10:23:16 +08:00 · 2021-03-24 09:06:57 +00:00 · 2021-03-23 21:29:33 +08:00 · 2021-03-23 06:41:56 +00:00 · 2021-03-15 14:30:34 +08:00 · 2021-03-15 03:26:08 +00:00
579 changed files with 19334 additions and 43299 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -19,10 +19,19 @@ variables:
  GET_SOURCES_ATTEMPTS: "10"
  ARTIFACT_DOWNLOAD_ATTEMPTS: "10"

-  # We use get-full-sources.sh script to fetch the submodules and/or re-fetch the repo
-  # if it was corrupted (if submodule update fails this can happen)
-  GIT_STRATEGY: fetch
+  # GIT_STRATEGY is not defined here.
+  # Use an option from  "CI / CD Settings" - "General pipelines".
+
+  # we will download archive for each submodule instead of clone.
+  # we don't do "recursive" when fetch submodule as they're not used in CI now.
  GIT_SUBMODULE_STRATEGY: none
+  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
+  # by default we will fetch all submodules
+  # jobs can overwrite this variable to only fetch submodules they required
+  # set to "none" if don't need to fetch submodules
+  SUBMODULES_TO_FETCH: "all"
+  # tell build system do not check submodule update as we download archive instead of clone
+  IDF_SKIP_CHECK_SUBMODULES: 1

  UNIT_TEST_BUILD_SYSTEM: make
 # IDF environment
@@ -33,21 +42,15 @@ variables:
  APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"

-# Docker images
+  # Docker images
  BOT_DOCKER_IMAGE_TAG: ":latest"
+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
+  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
+  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"

-# When 'fetch' strategy is used, Gitlab removes untracked files before checking out
-# new revision. However if the new revision doesn't include some of the submodules
-# which were present in the old revision, such submodule directories would not be
-# removed by the checkout. This extra step ensures that these stale submodules
-# are removed.
-.git_clean_stale_submodules:  &git_clean_stale_submodules >
-  find . -name '.git' -not -path './.git' -printf '%P\n'
-  | sed 's|/.git||'
-  | xargs -I {} sh -c '
-  grep -q {} .gitmodules
-  ||  (echo "Removing {}, has .git directory but not in .gitmodules file"
-  && rm -rf {});'
+  # Versioned esp-idf-doc env image to use for all document building jobs
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v5"

 # before each job, we need to check if this job is filtered by bot stage/job filter
 .apply_bot_filter: &apply_bot_filter
@@ -58,9 +61,14 @@ variables:
  tools/idf_tools.py --non-interactive install && eval "$(tools/idf_tools.py --non-interactive export)" || exit 1
  fi

+.show_submodule_urls: &show_submodule_urls |
+  git config --get-regexp '^submodule\..*\.url$' || true
+
+.fetch_submodules: &fetch_submodules |
+  python $SUBMODULE_FETCH_TOOL -s $SUBMODULES_TO_FETCH
+
 before_script:
  - source tools/ci/setup_python.sh
-  - *git_clean_stale_submodules
  # apply bot filter in before script
  - *apply_bot_filter
  # add gitlab ssh key
@@ -70,48 +78,33 @@ before_script:
  - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
  - chmod 600 ~/.ssh/id_rsa
  - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
+  - if [ "${LOCAL_GITLAB_SSH_SERVER:-}" ]; then SRV=${LOCAL_GITLAB_SSH_SERVER##*@};SRV=${SRV%%:*};printf "Host %s\n\tStrictHostKeyChecking no\n" "${SRV}" >> ~/.ssh/config; fi
  # Download and install tools, if needed
  - *setup_tools_unless_target_test
-
-  # Set IS_PRIVATE or IS_PUBLIC depending on if our branch is public or not
-  #
-  # (the same regular expressions are used to set these are used in 'only:' sections below
+  # Set some options and environment for CI
  - source tools/ci/configure_ci_environment.sh
-
-  # fetch the submodules (& if necessary re-fetch repo) from gitlab
-  - time ./tools/ci/get-full-sources.sh
+  - export PYTHONPATH="${PYTHONPATH}:${CI_PROJECT_DIR}/tools/ci/python_packages"
+  - *fetch_submodules

 # used for check scripts which we want to run unconditionally
-.do_nothing_before_no_filter:
-  before_script: &do_nothing_before_no_filter
+.before_script_lesser_nofilter: &before_script_lesser_nofilter
+  variables:
+    GIT_SUBMODULE_STRATEGY: none
+  before_script:
+    - echo "Not setting up GitLab key, not fetching submodules, not applying bot filter"
    - source tools/ci/setup_python.sh
-    - *git_clean_stale_submodules
+    - source tools/ci/configure_ci_environment.sh

 # used for everything else where we want to do no prep, except for bot filter
-.do_nothing_before:
-  before_script: &do_nothing_before
-    - source tools/ci/setup_python.sh
-    - *git_clean_stale_submodules
-    # apply bot filter in before script
-    - *apply_bot_filter
+.before_script_lesser: &before_script_lesser
+  variables:
+    GIT_SUBMODULE_STRATEGY: none
+  before_script:
    - echo "Not setting up GitLab key, not fetching submodules"
-    - source tools/ci/configure_ci_environment.sh
-
-.add_gitlab_key_before:
-  before_script: &add_gitlab_key_before
    - source tools/ci/setup_python.sh
-    - *git_clean_stale_submodules
    # apply bot filter in before script
    - *apply_bot_filter
-    - echo "Not fetching submodules"
    - source tools/ci/configure_ci_environment.sh
-    # add gitlab ssh key
-    - mkdir -p ~/.ssh
-    - chmod 700 ~/.ssh
-    - echo -n $GITLAB_KEY > ~/.ssh/id_rsa_base64
-    - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
-    - chmod 600 ~/.ssh/id_rsa
-    - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config

 build_template_app:
  stage: build
@@ -335,7 +328,7 @@ build_docs:
  tags:
    - host_test
  dependencies: []
-  before_script: *do_nothing_before_no_filter
+  <<: *before_script_lesser_nofilter

 verify_cmake_style:
  <<: *check_job_template
@@ -363,7 +356,11 @@ build_docker:
    DOCKER_TMP_IMAGE_NAME: "idf_tmp_image"
  before_script: []
  script:
-    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+    - export LOCAL_CI_REPOSITORY_URL=$CI_REPOSITORY_URL
+    - if [ -n "$LOCAL_GITLAB_HTTPS_HOST" ]; then export LOCAL_CI_REPOSITORY_URL="https://gitlab-ci-token:${CI_JOB_TOKEN}@${LOCAL_GITLAB_HTTPS_HOST}/${CI_PROJECT_PATH}"; fi
+    - echo "Using repository at $LOCAL_CI_REPOSITORY_URL"
+    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${LOCAL_CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+
    # Build
    - docker build --tag ${DOCKER_TMP_IMAGE_NAME} ${DOCKER_BUILD_ARGS} tools/docker/
    # We can't mount $PWD/examples/get-started/blink into the container, see https://gitlab.com/gitlab-org/gitlab-ce/issues/41227.
@@ -605,7 +602,7 @@ push_to_github:
      - $BOT_TRIGGER_WITH_LABEL == null
  when: on_success
  dependencies: []
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
  script:
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
@@ -634,7 +631,7 @@ deploy_docs:
      - $BOT_LABEL_BUILD_DOCS
  dependencies:
    - build_docs
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
  script:
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
@@ -717,7 +714,7 @@ check_examples_cmake_make:
    - master
    - /^release\/v/
    - /^v\d+\.\d+(\.\d+)?($|-)/
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
  script:
    - tools/ci/check_examples_cmake_make.sh

@@ -728,14 +725,13 @@ check_python_style:
    paths:
      - flake8_output.txt
    expire_in: 1 week
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
  script:
    # run it only under Python 3 (it is very slow under Python 2)
    - ${IDF_PATH}/tools/ci/multirun_with_pyenv.sh -p 3.4.8 python -m flake8 --config=$IDF_PATH/.flake8 --output-file=flake8_output.txt --tee --benchmark $IDF_PATH

 check_kconfigs:
  <<: *check_job_template
-  before_script: *do_nothing_before
  artifacts:
    when: on_failure
    paths:
@@ -746,6 +742,7 @@ check_kconfigs:
      - tools/*/*/Kconfig*.new
      - tools/*/*/*/Kconfig*.new
    expire_in: 1 week
+  <<: *before_script_lesser
  script:
    - ${IDF_PATH}/tools/ci/multirun_with_pyenv.sh ${IDF_PATH}/tools/test_check_kconfigs.py
    - ${IDF_PATH}/tools/check_kconfigs.py
@@ -760,7 +757,7 @@ check_ut_cmake_make:
    - /^release\/v/
    - /^v\d+\.\d+(\.\d+)?($|-)/
  dependencies: []
-  before_script: *do_nothing_before
+  <<: *before_script_lesser
  script:
    - tools/ci/check_ut_cmake_make.sh

@@ -768,12 +765,22 @@ check_submodule_sync:
  <<: *check_job_template
  tags:
    - github_sync
+  retry: 2
  variables:
    GIT_STRATEGY: clone
-  retry: 2
+    GIT_SUBMODULE_STRATEGY: none
+    PUBLIC_IDF_URL: "https://github.com/espressif/esp-idf.git"
+  before_script: []
+  after_script: []
  script:
+    - git submodule deinit --force .
+    # setting the default remote URL to the public one, to resolve relative location URLs
+    - git config remote.origin.url ${PUBLIC_IDF_URL}
    # check if all submodules are correctly synced to public repostory
-    - git submodule update --init --recursive
+    - git submodule init
+    - *show_submodule_urls
+    - git submodule update --recursive
+    - echo "IDF was cloned from ${PUBLIC_IDF_URL} completely"

 check_artifacts_expire_time:
  <<: *check_job_template
@@ -792,6 +799,18 @@ check_pipeline_triggered_by_label:
    # We want to make sure some jobs are always executed to detect regression.
    - test "$BOT_LABEL_REGULAR_TEST" = "true" || exit -1

+# For release tag pipelines only, make sure the tag was created with 'git tag -a' so it will update
+# the version returned by 'git describe'
+check_version_tag:
+  extends: .check_job_template
+  only:
+    refs:
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
+  script:
+    - (git cat-file -t $CI_COMMIT_REF_NAME | grep tag) || (echo "ESP-IDF versions must be annotated tags." && exit 1)
+
 assign_test:
  tags:
    - assign_test
@@ -806,6 +825,11 @@ assign_test:
  variables:
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
+    INTEGRATION_CONFIG_OUTPUT_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    PYTHON_VER: 3.7.7
  artifacts:
    paths:
      - components/idf_test/*/CIConfigs
@@ -824,11 +848,11 @@ assign_test:
    # assign unit test cases
    - python $TEST_FW_PATH/CIAssignUnitTest.py $IDF_PATH/components/idf_test/unit_test/TestCaseAll.yml $IDF_PATH/.gitlab-ci.yml $IDF_PATH/components/idf_test/unit_test/CIConfigs
    # clone test script to assign tests
-    - git clone $TEST_SCRIPT_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
-    - cd auto_test_script
    # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t $TEST_CASE_FILE_PATH -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin -o $INTEGRATION_CONFIG_OUTPUT_PATH

 .define_config_file_name: &define_config_file_name |
    JOB_NAME_PREFIX=$(echo ${CI_JOB_NAME} | awk '{print $1}')
@@ -860,6 +884,7 @@ assign_test:
    reports:
        junit: $LOG_PATH/*/XUNIT_RESULT.xml
  variables:
+    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/examples/test_configs"
@@ -870,7 +895,7 @@ assign_test:
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
    # clone test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    - cd $TEST_FW_PATH
    # run test
@@ -922,26 +947,30 @@ assign_test:
      - $LOG_PATH
    expire_in: 1 week
  variables:
+    SUBMODULES_TO_FETCH: "none"
    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
    LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test/integration_test"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/components/idf_test/ModuleDefinition.yml"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
-  before_script: *add_gitlab_key_before
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/components/idf_test/integration_test/KnownIssues"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
+    PYTHON_VER: 3.7.7
  script:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
    # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    - cd ci-test-runner-configs
    # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
-    - cd auto_test_script
+    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
    # run test
-    - python CIRunner.py -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH

 nvs_compatible_test:
  <<: *test_template
@@ -959,17 +988,17 @@ nvs_compatible_test:
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
    # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    - cd ci-test-runner-configs
    # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
-    - cd auto_test_script
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
    # prepare nvs bins
-    - ./Tools/prepare_nvs_bin.sh
+    - cd auto_test_script
+    - ./tools/prepare_nvs_bin.sh
    # run test
-    - python CIRunner.py -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH

 example_test_001:
  <<: *example_test_template
@@ -984,6 +1013,8 @@ example_test_002:
  tags:
    - ESP32
    - Example_ShieldBox_Basic
+  variables:
+    SUBMODULES_TO_FETCH: "components/esptool_py/esptool;components/micro-ecc/micro-ecc"

 .example_test_003:
  <<: *example_test_template
@@ -1324,7 +1355,7 @@ IT_002:

 IT_003:
  <<: *test_template
-  parallel: 13
+  parallel: 14
  tags:
    - ESP32_IDF
    - SSC_T2_5
@@ -1344,7 +1375,7 @@ IT_005:

 IT_006:
  <<: *test_template
-  parallel: 8
+  parallel: 13
  tags:
    - ESP32_IDF
    - SSC_T1_6
@@ -1368,13 +1399,6 @@ IT_009:
    - ESP32_IDF
    - SSC_T1_3

-IT_010:
-  <<: *test_template
-  parallel: 4
-  tags:
-    - ESP32_IDF
-    - SSC_T5_1
-
 IT_011:
  <<: *test_template
  tags:
@@ -1414,6 +1438,7 @@ IT_015:

 IT_016:
  <<: *test_template
+  allow_failure: true
  tags:
    - ESP32_IDF
    - SSC_T50_MESH1
@@ -1426,7 +1451,6 @@ IT_017:

 IT_018:
  <<: *test_template
-  parallel: 2
  tags:
    - ESP32_IDF
    - SSC_T1_9
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,75 +1,80 @@
+#
+# All the relative URL paths are intended to be GitHub ones
+# For Espressif's public projects please use '../../espressif/proj', not a '../proj'
+#
+
 [submodule "components/esp32/lib"]
 	path = components/esp32/lib
-	url = https://github.com/espressif/esp32-wifi-lib.git
+	url = ../../espressif/esp32-wifi-lib.git

 [submodule "components/esptool_py/esptool"]
 	path = components/esptool_py/esptool
-	url = https://github.com/espressif/esptool.git
+	url = ../../espressif/esptool.git

 [submodule "components/bt/lib"]
 	path = components/bt/lib
-	url = https://github.com/espressif/esp32-bt-lib.git
+	url = ../../espressif/esp32-bt-lib.git

 [submodule "components/micro-ecc/micro-ecc"]
 	path = components/micro-ecc/micro-ecc
-	url = https://github.com/kmackay/micro-ecc.git
+	url = ../../kmackay/micro-ecc.git

 [submodule "components/coap/libcoap"]
 	path = components/coap/libcoap
-	url = https://github.com/obgm/libcoap.git
+	url = ../../obgm/libcoap.git

 [submodule "components/aws_iot/aws-iot-device-sdk-embedded-C"]
 	path = components/aws_iot/aws-iot-device-sdk-embedded-C
-	url = https://github.com/espressif/aws-iot-device-sdk-embedded-C.git
+	url = ../../espressif/aws-iot-device-sdk-embedded-C.git

 [submodule "components/nghttp/nghttp2"]
 	path = components/nghttp/nghttp2
-	url = https://github.com/nghttp2/nghttp2.git
+	url = ../../nghttp2/nghttp2.git

 [submodule "components/libsodium/libsodium"]
 	path = components/libsodium/libsodium
-	url = https://github.com/jedisct1/libsodium.git
+	url = ../../jedisct1/libsodium.git

 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
-	url = https://github.com/pellepl/spiffs.git
+	url = ../../pellepl/spiffs.git

 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
-	url = https://github.com/DaveGamble/cJSON.git
+	url = ../../DaveGamble/cJSON.git

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
-	url = https://github.com/espressif/mbedtls.git
+	url = ../../espressif/mbedtls.git

 [submodule "components/asio/asio"]
 	path = components/asio/asio
-	url = https://github.com/espressif/asio.git
+	url = ../../espressif/asio.git

 [submodule "components/expat/expat"]
 	path = components/expat/expat
-	url = https://github.com/libexpat/libexpat.git
+	url = ../../libexpat/libexpat.git

 [submodule "components/lwip/lwip"]
 	path = components/lwip/lwip
-	url = https://github.com/espressif/esp-lwip.git
+	url = ../../espressif/esp-lwip.git

 [submodule "components/mqtt/esp-mqtt"]
 	path = components/mqtt/esp-mqtt
-	url = https://github.com/espressif/esp-mqtt.git
+	url = ../../espressif/esp-mqtt.git

 [submodule "components/protobuf-c/protobuf-c"]
 	path = components/protobuf-c/protobuf-c
-	url = https://github.com/protobuf-c/protobuf-c
+	url = ../../protobuf-c/protobuf-c.git

 [submodule "components/unity/unity"]
 	path = components/unity/unity
-	url = https://github.com/ThrowTheSwitch/Unity
+	url = ../../ThrowTheSwitch/Unity.git

 [submodule "examples/build_system/cmake/import_lib/main/lib/tinyxml2"]
 	path = examples/build_system/cmake/import_lib/main/lib/tinyxml2
-	url = https://github.com/leethomason/tinyxml2
+	url = ../../leethomason/tinyxml2.git

 [submodule "components/nimble/nimble"]
 	path = components/nimble/nimble
-	url = https://github.com/espressif/esp-nimble.git
+	url = ../../espressif/esp-nimble.git
--- a/README.md
+++ b/README.md
@@ -13,6 +13,14 @@ See setup guides for detailed instructions to set up the ESP-IDF:
 * [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
 * [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)

+### Non-GitHub forks
+
+ESP-IDF uses relative locations as its submodules URLs ([.gitmodules](.gitmodules)). So they link to GitHub.
+If ESP-IDF is forked to a Git repository which is not on GitHub, you will need to run the script
+[tools/set-submodules-to-github.sh](tools/set-submodules-to-github.sh) after git clone.
+The script sets absolute URLs for all submodules, allowing `git submodule update --init --recursive` to complete.
+If cloning ESP-IDF from GitHub, this step is not needed.
+
 ## Finding a Project

 As well as the [esp-idf-template](https://github.com/espressif/esp-idf-template) project mentioned in Getting Started, ESP-IDF comes with some example projects in the [examples](examples) directory.
--- a/components/app_update/otatool.py
+++ b/components/app_update/otatool.py
@@ -276,6 +276,10 @@ def erase_ota_partition(args):


 def main():
+    if sys.version_info[0] < 3:
+        print("WARNING: Support for Python 2 is deprecated and will be removed in future versions.")
+    elif sys.version_info[0] == 3 and sys.version_info[1] < 6:
+        print("WARNING: Python 3 versions older than 3.6 are not supported.")
    global quiet

    parser = argparse.ArgumentParser("ESP-IDF OTA Partitions Tool")
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -524,4 +524,21 @@ menu "Security features"
            Reflashable mode so that a new Secure Boot digest can be flashed at the same time as plaintext firmware.
            This combination is not secure and should not be used for a production system.

+    config SECURE_DISABLE_ROM_DL_MODE
+        bool "Permanently disable ROM Download Mode"
+        depends on ESP32_REV_MIN_3
+        default n
+        help
+            If set, during startup the app will burn an eFuse bit to permanently disable the UART ROM
+            Download Mode. This prevents any future use of esptool.py, espefuse.py and similar tools.
+
+            Once disabled, if the SoC is booted with strapping pins set for ROM Download Mode
+            then an error is printed instead.
+
+            It is recommended to enable this option in any production application where Flash
+            Encryption and/or Secure Boot is enabled and access to Download Mode is not required.
+
+            It is also possible to permanently disable Download Mode by calling
+            esp_efuse_disable_rom_download_mode() at runtime.
+
 endmenu  # Security features
--- a/components/bootloader_support/include/esp_flash_encrypt.h
+++ b/components/bootloader_support/include/esp_flash_encrypt.h
@@ -110,7 +110,11 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length);
 * is enabled but secure boot is not used. This should protect against
 * serial re-flashing of an unauthorised code in absence of secure boot.
 *
- * @return 
+ * @note To support disabling UART Download Mode on ESP32 V3 only, this function
+ * doesn't write protect FLASH_CRYPT_CNT but instead sets it to the max value
+ * (effectively the same result but allows burning the UART_DL_DIS efuse later on,
+ * as this is otherwise also disabled if FLASH_CRYPT_CNT is write protected.)
+ *
 */
 void esp_flash_write_protect_crypt_cnt();

--- a/components/bootloader_support/include_bootloader/bootloader_flash.h
+++ b/components/bootloader_support/include_bootloader/bootloader_flash.h
@@ -22,6 +22,7 @@

 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 0x10000
+#define MMAP_ALIGNED_MASK 0x0000FFFF

 /* Provide a Flash API for bootloader_support code,
   that can be used from bootloader or app code.
@@ -35,7 +36,7 @@
 *
 * @return Number of free pages
 */
-uint32_t bootloader_mmap_get_free_pages();
+uint32_t bootloader_mmap_get_free_pages(void);

 /**
 * @brief Map a region of flash to data memory
--- a/components/bootloader_support/include_bootloader/bootloader_sha.h
+++ b/components/bootloader_support/include_bootloader/bootloader_sha.h
@@ -26,7 +26,7 @@

 typedef void *bootloader_sha256_handle_t;

-bootloader_sha256_handle_t bootloader_sha256_start();
+bootloader_sha256_handle_t bootloader_sha256_start(void);

 void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data, size_t data_len);

--- a/components/bootloader_support/include_bootloader/bootloader_utility.h
+++ b/components/bootloader_support/include_bootloader/bootloader_utility.h
@@ -62,3 +62,17 @@ __attribute__((noreturn)) void bootloader_utility_load_boot_image(const bootload
 * It is not recommended to call this function from an app (if called, the app will abort).
 */
 __attribute__((noreturn)) void bootloader_reset(void);
+
+/** @brief Generates the digest of the data between offset & offset+length.
+ *
+ * This function should be used when the size of the data is larger than 3.2MB.
+ * The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-256 
+ * of the data in chunks of 3.2MB, considering the MMU capacity. 
+ * 
+ * @param[in]  flash_offset  Offset of the data in flash.
+ * @param[in]  len           Length of data in bytes.
+ * @param[out] digest        Pointer to buffer where the digest is written, if ESP_OK is returned. 
+ * 
+ * @return ESP_OK if secure boot digest is generated successfully.
+ */
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
--- a/components/bootloader_support/src/bootloader_common.c
+++ b/components/bootloader_support/src/bootloader_common.c
@@ -26,6 +26,8 @@
 #include "esp_flash_partitions.h"
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
+#include "bootloader_config.h"
+#include "bootloader_utility.h"
 #include "soc/gpio_periph.h"
 #include "soc/efuse_reg.h"
 #include "soc/rtc.h"
@@ -186,22 +188,7 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
        size = data.image_len;
    }
    // If image is type by data then hash is calculated for entire image.
-    const void *partition_bin = bootloader_mmap(address, size);
-    if (partition_bin == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", address, size);
-        return ESP_FAIL;
-    }
-    bootloader_sha256_handle_t sha_handle = bootloader_sha256_start();
-    if (sha_handle == NULL) {
-        bootloader_munmap(partition_bin);
-        return ESP_ERR_NO_MEM;
-    }
-    bootloader_sha256_data(sha_handle, partition_bin, size);
-    bootloader_sha256_finish(sha_handle, out_sha_256);
-
-    bootloader_munmap(partition_bin);
-
-    return ESP_OK;
+    return bootloader_sha256_flash_contents(address, size, out_sha_256);
 }

 int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata, bool *valid_two_otadata, bool max)
@@ -247,13 +234,15 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t
        return ESP_ERR_INVALID_ARG;
    }

-    const uint8_t *image = bootloader_mmap(partition->offset, partition->size);
+    const uint32_t app_desc_offset = sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t);
+    const uint32_t mmap_size = app_desc_offset + sizeof(esp_app_desc_t);
+    const uint8_t *image = bootloader_mmap(partition->offset, mmap_size);
    if (image == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, partition->size);
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, mmap_size);
        return ESP_FAIL;
    }

-    memcpy(app_desc, image + sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t), sizeof(esp_app_desc_t));
+    memcpy(app_desc, image + app_desc_offset, sizeof(esp_app_desc_t));
    bootloader_munmap(image);

    if (app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {
--- a/components/bootloader_support/src/bootloader_sha.c
+++ b/components/bootloader_support/src/bootloader_sha.c
@@ -21,7 +21,7 @@
 // App version is a wrapper around mbedTLS SHA API
 #include <mbedtls/sha256.h>

-bootloader_sha256_handle_t bootloader_sha256_start()
+bootloader_sha256_handle_t bootloader_sha256_start(void)
 {
    mbedtls_sha256_context *ctx = (mbedtls_sha256_context *)malloc(sizeof(mbedtls_sha256_context));
    if (!ctx) {
@@ -53,6 +53,7 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
    }
    mbedtls_sha256_free(ctx);
    free(handle);
+    handle = NULL;
 }

 #else // Bootloader version
@@ -70,7 +71,7 @@ static const size_t BLOCK_WORDS = (64/sizeof(uint32_t));
 // Words in final SHA256 digest
 static const size_t DIGEST_WORDS = (32/sizeof(uint32_t));

-bootloader_sha256_handle_t bootloader_sha256_start()
+bootloader_sha256_handle_t bootloader_sha256_start(void)
 {
    // Enable SHA hardware
    ets_sha_enable();
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -703,3 +703,39 @@ void bootloader_reset(void)
    abort();            /* This function should really not be called from application code */
 #endif
 }
+
+
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
+{
+
+    if (digest == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    /* Handling firmware images larger than MMU capacity */
+    uint32_t mmu_free_pages_count = bootloader_mmap_get_free_pages();
+    bootloader_sha256_handle_t sha_handle = NULL;
+
+    sha_handle = bootloader_sha256_start();
+    if (sha_handle == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+
+    while (len > 0) {
+        uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */
+        uint32_t partial_image_len = MIN(len, ((mmu_free_pages_count - mmu_page_offset) * SPI_FLASH_MMU_PAGE_SIZE)); /* Read the image that fits in the free MMU pages */
+
+        const void * image = bootloader_mmap(flash_offset, partial_image_len);
+        if (image == NULL) {
+            bootloader_sha256_finish(sha_handle, NULL);
+            return ESP_FAIL;
+        }
+        bootloader_sha256_data(sha_handle, image, partial_image_len);
+        bootloader_munmap(image);
+
+        flash_offset += partial_image_len;
+        len -= partial_image_len;
+    }
+    bootloader_sha256_finish(sha_handle, digest);
+    return ESP_OK;
+}
--- a/components/bootloader_support/src/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encrypt.c
@@ -199,19 +199,22 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry

    ESP_LOGD(TAG, "All flash regions checked for encryption pass");

+    uint32_t new_flash_crypt_cnt;
+#ifdef CONFIG_FLASH_ENCRYPTION_DISABLE_PLAINTEXT
+    ESP_LOGI(TAG, "Setting FLASH_CRYPT_CNT efuse to max...");
+    new_flash_crypt_cnt = EFUSE_FLASH_CRYPT_CNT;
+#else
    /* Set least significant 0-bit in flash_crypt_cnt */
    int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & EFUSE_RD_FLASH_CRYPT_CNT);
    /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == EFUSE_RD_FLASH_CRYPT_CNT (0x7F) */
-    uint32_t new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
+    new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
+    if (new_flash_crypt_cnt != EFUSE_FLASH_CRYPT_CNT) {
+        ESP_LOGW(TAG, "Not disabling FLASH_CRYPT_CNT - plaintext flashing is still possible");
+    }
+#endif
    ESP_LOGD(TAG, "FLASH_CRYPT_CNT 0x%x -> 0x%x", flash_crypt_cnt, new_flash_crypt_cnt);
    REG_SET_FIELD(EFUSE_BLK0_WDATA0_REG, EFUSE_FLASH_CRYPT_CNT, new_flash_crypt_cnt);

-#ifdef CONFIG_FLASH_ENCRYPTION_DISABLE_PLAINTEXT
-    ESP_LOGI(TAG, "Write protecting FLASH_CRYPT_CNT efuse...");
-    REG_SET_BIT(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_FLASH_CRYPT_CNT);
-#else
-    ESP_LOGW(TAG, "Not disabling FLASH_CRYPT_CNT - plaintext flashing is still possible");
-#endif

    esp_efuse_burn_new_values();

@@ -348,12 +351,19 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length)
    return err;
 }

-void esp_flash_write_protect_crypt_cnt() 
+void esp_flash_write_protect_crypt_cnt()
 {
+    if (!esp_flash_encryption_enabled()) {
+        ESP_LOGE(TAG, "flash encryption not enabled!");
+        return;
+    }
+
    uint32_t efuse_blk0 = REG_READ(EFUSE_BLK0_RDATA0_REG);
    bool flash_crypt_wr_dis = efuse_blk0 & EFUSE_WR_DIS_FLASH_CRYPT_CNT;
-    if(!flash_crypt_wr_dis) { 
-        REG_WRITE(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_FLASH_CRYPT_CNT);
+    unsigned flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_FLASH_CRYPT_CNT);
+    if(!flash_crypt_wr_dis && flash_crypt_cnt != EFUSE_FLASH_CRYPT_CNT) {
+        /* Disable by setting flash_crypt_cnt to max, to still allow disabling UART DL mode on ESP32 rev 3 */
+        REG_SET_FIELD(EFUSE_BLK0_WDATA0_REG, EFUSE_FLASH_CRYPT_CNT, EFUSE_FLASH_CRYPT_CNT);
        esp_efuse_burn_new_values();
    }
 }
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@@ -371,12 +371,12 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/mesh_core/settings.c"
                    "esp_ble_mesh/mesh_core/test.c"
                    "esp_ble_mesh/mesh_core/transport.c"
+                    "esp_ble_mesh/mesh_models/common/device_property.c"
                    "esp_ble_mesh/mesh_models/client/client_common.c"
                    "esp_ble_mesh/mesh_models/client/generic_client.c"
                    "esp_ble_mesh/mesh_models/client/lighting_client.c"
                    "esp_ble_mesh/mesh_models/client/sensor_client.c"
                    "esp_ble_mesh/mesh_models/client/time_scene_client.c"
-                    "esp_ble_mesh/mesh_models/server/device_property.c"
                    "esp_ble_mesh/mesh_models/server/generic_server.c"
                    "esp_ble_mesh/mesh_models/server/lighting_server.c"
                    "esp_ble_mesh/mesh_models/server/sensor_server.c"
--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@@ -480,6 +480,13 @@ menu Bluetooth
        help
            This option can be disabled when the app work only on gatt client mode

+    config GATTS_BLUFI_ENABLE
+        bool "Include blufi function"
+        depends on GATTS_ENABLE
+        default y
+        help
+            This option can be close when the app does not require blufi function.
+
    choice GATTS_SEND_SERVICE_CHANGE_MODE
        prompt "GATTS Service Change Mode"
        default GATTS_SEND_SERVICE_CHANGE_AUTO
@@ -1738,12 +1745,72 @@ if BLE_MESH
            option in the Bluetooth Controller section in menuconfig, which is
            "Scan Duplicate By Device Address and Advertising Data".

-    config BLE_MESH_ALLOC_FROM_PSRAM_FIRST
-        bool "BLE Mesh will first allocate memory from PSRAM"
+    choice BLE_MESH_MEM_ALLOC_MODE
+        prompt "Memory allocation strategy"
+        default BLE_MESH_MEM_ALLOC_MODE_INTERNAL
+        help
+            Allocation strategy for BLE Mesh stack, essentially provides ability to
+            allocate all required dynamic allocations from,
+
+            - Internal DRAM memory only
+            - External SPIRAM memory only
+            - Either internal or external memory based on default malloc()
+              behavior in ESP-IDF
+
+            Recommended mode here is always internal, since that is most preferred
+            from security perspective. But if application requirement does not allow
+            sufficient free internal memory then alternate mode can be selected.
+
+        config BLE_MESH_MEM_ALLOC_MODE_INTERNAL
+            bool "Internal DRAM"
+
+        config BLE_MESH_ALLOC_FROM_PSRAM_FIRST
+            bool "External SPIRAM"
+            depends on SPIRAM_SUPPORT
+
+        config BLE_MESH_MEM_ALLOC_MODE_DEFAULT
+            bool "Default alloc mode"
+            depends on SPIRAM_SUPPORT
+            help
+                Enable this option to use the default memory allocation strategy when
+                external SPIRAM is enabled. See the SPIRAM options for more details.
+
+    endchoice # BLE_MESH_MEM_ALLOC_MODE
+
+    config BLE_MESH_FREERTOS_STATIC_ALLOC
+        bool "Enable FreeRTOS static allocation"
+        depends on SUPPORT_STATIC_ALLOCATION && SPIRAM_SUPPORT
        default n
        help
-            When this option is enabled, BLE Mesh stack will try to allocate memory
-            from PSRAM firstly. This will save the internal RAM if PSRAM exists.
+            Enable this option to use FreeRTOS static allocation APIs for BLE Mesh,
+            which provides the ability to use different dynamic memory (i.e. SPIRAM)
+            for FreeRTOS objects.
+            If this option is disabled, the FreeRTOS static allocation APIs will not
+            be used, and internal DRAM will be allocated for FreeRTOS objects.
+
+    choice BLE_MESH_FREERTOS_STATIC_ALLOC_MODE
+        prompt "Memory allocation for FreeRTOS objects"
+        depends on BLE_MESH_FREERTOS_STATIC_ALLOC
+        help
+            Choose the memory to be used for FreeRTOS objects.
+
+        config BLE_MESH_FREERTOS_STATIC_ALLOC_EXTERNAL
+            bool "External SPIRAM"
+            depends on SPIRAM_SUPPORT
+            help
+                If enabled, BLE Mesh allocates dynamic memory from external SPIRAM for
+                FreeRTOS objects, i.e. mutex, queue, and task stack. External SPIRAM
+                can only be used for task stack when SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY
+                is enabled. See the SPIRAM options for more details.
+
+    endchoice # BLE_MESH_FREERTOS_STATIC_ALLOC_MODE
+
+    config BLE_MESH_DEINIT
+        bool "Support de-initialize BLE Mesh stack"
+        default y
+        help
+            If enabled, users can use the function esp_ble_mesh_deinit() to de-initialize
+            the whole BLE Mesh stack.

    config BLE_MESH_FAST_PROV
        bool "Enable BLE Mesh Fast Provisioning"
@@ -1838,6 +1905,28 @@ if BLE_MESH
                This option specifies how many application keys the Provisioner can have.
                Indeed, this value decides the number of the application keys which can be added by a Provisioner.

+        config BLE_MESH_PROVISIONER_RECV_HB
+            bool "Support receiving Heartbeat messages"
+            default n
+            help
+                When this option is enabled, Provisioner can call specific functions to enable
+                or disable receiving Heartbeat messages and notify them to the application layer.
+
+        if BLE_MESH_PROVISIONER_RECV_HB
+
+            config BLE_MESH_PROVISIONER_RECV_HB_FILTER_SIZE
+                int "Maximum number of filter entries for receiving Heartbeat messages"
+                default 3
+                range 1 1000
+                help
+                    This option specifies how many heartbeat filter entries Provisioner supports.
+                    The heartbeat filter (acceptlist or rejectlist) entries are used to store a
+                    list of SRC and DST which can be used to decide if a heartbeat message will
+                    be processed and notified to the application layer by Provisioner.
+                    Note: The filter is an empty rejectlist by default.
+
+        endif # BLE_MESH_PROVISIONER_RECV_HB
+
    endif # BLE_MESH_PROVISIONER

    # Virtual option enabled whenever Generic Provisioning layer is needed
@@ -1919,7 +2008,7 @@ if BLE_MESH
            advertising bearer.

    config BLE_MESH_NET_BUF_POOL_USAGE
-        bool "BLE Mesh net buffer pool usage tracking"
+        bool
        default y
        help
            Enable BLE Mesh net buffer pool tracking. This option is used to introduce another
@@ -1977,7 +2066,7 @@ if BLE_MESH
        config BLE_MESH_SEQ_STORE_RATE
            int "How often the sequence number gets updated in storage"
            range 0 1000000
-            default 6
+            default 0
            help
                This value defines how often the local sequence number gets updated in
                persistent storage (i.e. flash). e.g. a value of 100 means that the
@@ -1992,7 +2081,7 @@ if BLE_MESH
        config BLE_MESH_RPL_STORE_TIMEOUT
            int "Minimum frequency that the RPL gets updated in storage"
            range 0 1000000
-            default 5
+            default 0
            help
                This value defines in seconds how soon the RPL (Replay Protection List)
                gets written to persistent storage after a change occurs. If the node
@@ -2521,104 +2610,138 @@ if BLE_MESH
            uses 0 as the timeout value when sending acknowledged messages, then
            the default value will be used which is four seconds.

-    menu "Support for BLE Mesh Client Models"
+    menu "Support for BLE Mesh Foundation models"

        config BLE_MESH_CFG_CLI
-            bool "Configuration Client Model"
+            bool "Configuration Client model"
            help
-                Enable support for Configuration client model.
+                Enable support for Configuration Client model.

        config BLE_MESH_HEALTH_CLI
-            bool "Health Client Model"
+            bool "Health Client model"
            help
-                Enable support for Health client model.
+                Enable support for Health Client model.
+
+        config BLE_MESH_HEALTH_SRV
+            bool "Health Server model"
+            default y
+            help
+                Enable support for Health Server model.
+
+    endmenu #Support for BLE Mesh Foundation models
+
+    menu "Support for BLE Mesh Client/Server models"

        config BLE_MESH_GENERIC_ONOFF_CLI
-            bool "Generic OnOff Client Model"
+            bool "Generic OnOff Client model"
            help
-                Enable support for Generic OnOff client model.
+                Enable support for Generic OnOff Client model.

        config BLE_MESH_GENERIC_LEVEL_CLI
-            bool "Generic Level Client Model"
+            bool "Generic Level Client model"
            help
-                Enable support for Generic Level client model.
+                Enable support for Generic Level Client model.

        config BLE_MESH_GENERIC_DEF_TRANS_TIME_CLI
-            bool "Generic Default Transition Time Client Model"
+            bool "Generic Default Transition Time Client model"
            help
-                Enable support for Generic Default Transition Time client model.
+                Enable support for Generic Default Transition Time Client model.

        config BLE_MESH_GENERIC_POWER_ONOFF_CLI
-            bool "Generic Power OnOff Client Model"
+            bool "Generic Power OnOff Client model"
            help
-                Enable support for Generic Power OnOff client model.
+                Enable support for Generic Power OnOff Client model.

        config BLE_MESH_GENERIC_POWER_LEVEL_CLI
-            bool "Generic Power Level Client Model"
+            bool "Generic Power Level Client model"
            help
-                Enable support for Generic Power Level client model.
+                Enable support for Generic Power Level Client model.

        config BLE_MESH_GENERIC_BATTERY_CLI
-            bool "Generic Battery Client Model"
+            bool "Generic Battery Client model"
            help
-                Enable support for Generic Battery client model.
+                Enable support for Generic Battery Client model.

        config BLE_MESH_GENERIC_LOCATION_CLI
-            bool "Generic Location Client Model"
+            bool "Generic Location Client model"
            help
-                Enable support for Generic Location client model.
+                Enable support for Generic Location Client model.

        config BLE_MESH_GENERIC_PROPERTY_CLI
-            bool "Generic Property Client Model"
+            bool "Generic Property Client model"
            help
-                Enable support for Generic Property client model.
+                Enable support for Generic Property Client model.

        config BLE_MESH_SENSOR_CLI
-            bool "Sensor Client Model"
+            bool "Sensor Client model"
            help
-                Enable support for Sensor client model.
+                Enable support for Sensor Client model.

        config BLE_MESH_TIME_CLI
-            bool "Time Client Model"
+            bool "Time Client model"
            help
-                Enable support for Time client model.
+                Enable support for Time Client model.

        config BLE_MESH_SCENE_CLI
-            bool "Scene Client Model"
+            bool "Scene Client model"
            help
-                Enable support for Scene client model.
+                Enable support for Scene Client model.

        config BLE_MESH_SCHEDULER_CLI
-            bool "Scheduler Client Model"
+            bool "Scheduler Client model"
            help
-                Enable support for Scheduler client model.
+                Enable support for Scheduler Client model.

        config BLE_MESH_LIGHT_LIGHTNESS_CLI
-            bool "Light Lightness Client Model"
+            bool "Light Lightness Client model"
            help
-                Enable support for Light Lightness client model.
+                Enable support for Light Lightness Client model.

        config BLE_MESH_LIGHT_CTL_CLI
-            bool "Light CTL Client Model"
+            bool "Light CTL Client model"
            help
-                Enable support for Light CTL client model.
+                Enable support for Light CTL Client model.

        config BLE_MESH_LIGHT_HSL_CLI
-            bool "Light HSL Client Model"
+            bool "Light HSL Client model"
            help
-                Enable support for Light HSL client model.
+                Enable support for Light HSL Client model.

        config BLE_MESH_LIGHT_XYL_CLI
-            bool "Light XYL Client Model"
+            bool "Light XYL Client model"
            help
-                Enable support for Light XYL client model.
+                Enable support for Light XYL Client model.

        config BLE_MESH_LIGHT_LC_CLI
-            bool "Light LC Client Model"
+            bool "Light LC Client model"
            help
-                Enable support for Light LC client model.
+                Enable support for Light LC Client model.

-    endmenu
+        config BLE_MESH_GENERIC_SERVER
+            bool "Generic server models"
+            default y
+            help
+                Enable support for Generic server models.
+
+        config BLE_MESH_SENSOR_SERVER
+            bool "Sensor server models"
+            default y
+            help
+                Enable support for Sensor server models.
+
+        config BLE_MESH_TIME_SCENE_SERVER
+            bool "Time and Scenes server models"
+            default y
+            help
+                Enable support for Time and Scenes server models.
+
+        config BLE_MESH_LIGHTING_SERVER
+            bool "Lighting server models"
+            default y
+            help
+                Enable support for Lighting server models.
+
+    endmenu #Support for BLE Mesh Client/Server models

    config BLE_MESH_IV_UPDATE_TEST
        bool "Test the IV Update Procedure"
--- a/components/bt/bluedroid/api/esp_a2dp_api.c
+++ b/components/bt/bluedroid/api/esp_a2dp_api.c
@@ -107,13 +107,15 @@ esp_err_t esp_a2d_sink_disconnect(esp_bd_addr_t remote_bda)

    bt_status_t stat;
    btc_msg_t msg;
+    btc_av_args_t arg;

    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_A2DP;
    msg.act = BTC_AV_SINK_API_DISCONNECT_EVT;

    /* Switch to BTC context */
-    stat = btc_transfer_context(&msg, NULL, 0, NULL);
+    memcpy(&(arg.disconn), remote_bda, sizeof(bt_bdaddr_t));
+    stat = btc_transfer_context(&msg, &arg, sizeof(btc_av_args_t), NULL);
    return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }

@@ -219,14 +221,18 @@ esp_err_t esp_a2d_source_disconnect(esp_bd_addr_t remote_bda)
    }

    bt_status_t stat;
+    btc_av_args_t arg;
    btc_msg_t msg;

    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_A2DP;
    msg.act = BTC_AV_SRC_API_DISCONNECT_EVT;

+    memset(&arg, 0, sizeof(btc_av_args_t));
+
    /* Switch to BTC context */
-    stat = btc_transfer_context(&msg, NULL, 0, NULL);
+    memcpy(&(arg.src_disconn), remote_bda, sizeof(bt_bdaddr_t));
+    stat = btc_transfer_context(&msg, &arg, sizeof(btc_av_args_t), NULL);
    return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }

--- a/components/bt/bluedroid/api/esp_blufi_api.c
+++ b/components/bt/bluedroid/api/esp_blufi_api.c
@@ -23,7 +23,7 @@
 #include "osi/future.h"
 #include "btc_gatts.h"
 #include "btc_gatt_util.h"
-
+#if (BLUFI_INCLUDED == TRUE)
 esp_err_t esp_blufi_register_callbacks(esp_blufi_callbacks_t *callbacks)
 {
    if (esp_bluedroid_get_status() == ESP_BLUEDROID_STATUS_UNINITIALIZED) {
@@ -162,3 +162,4 @@ esp_err_t esp_blufi_send_custom_data(uint8_t *data, uint32_t data_len)

    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif  ///BLUFI_INCLUDED == TRUE
--- a/components/bt/bluedroid/api/esp_bt_main.c
+++ b/components/bt/bluedroid/api/esp_bt_main.c
@@ -117,6 +117,7 @@ esp_err_t esp_bluedroid_init(void)
 {
    btc_msg_t msg;
    future_t **future_p;
+    bt_status_t ret;

    if (esp_bt_controller_get_status() != ESP_BT_CONTROLLER_STATUS_ENABLED) {
        LOG_ERROR("Controller not initialised\n");
@@ -135,23 +136,30 @@ esp_err_t esp_bluedroid_init(void)
    future_p = btc_main_get_future_p(BTC_MAIN_INIT_FUTURE);
    *future_p = future_new();
    if (*future_p == NULL) {
-        LOG_ERROR("Bluedroid initialise failed\n");
+        LOG_ERROR("Bluedroid Initialize Fail!");
        return ESP_ERR_NO_MEM;
    }

-    btc_init();
+    /* 
+    * BTC Init
+    */
+    ret = btc_init();
+    if (ret != BT_STATUS_SUCCESS) {
+        LOG_ERROR("Bluedroid Initialize Fail");
+        return ESP_FAIL;
+    }

    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_MAIN_INIT;
    msg.act = BTC_MAIN_ACT_INIT;

    if (btc_transfer_context(&msg, NULL, 0, NULL) != BT_STATUS_SUCCESS) {
-        LOG_ERROR("Bluedroid initialise failed\n");
+        LOG_ERROR("Bluedroid Initialize Fail!");
        return ESP_FAIL;
    }

    if (future_await(*future_p) == FUTURE_FAIL) {
-        LOG_ERROR("Bluedroid initialise failed\n");
+        LOG_ERROR("Bluedroid Initialize Fail!");
        return ESP_FAIL;
    }

--- a/components/bt/bluedroid/api/esp_gap_ble_api.c
+++ b/components/bt/bluedroid/api/esp_gap_ble_api.c
@@ -705,6 +705,16 @@ esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device)
    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+esp_err_t esp_gap_ble_set_authorization(esp_bd_addr_t bd_addr, bool authorize)
+{
+    if (!bd_addr) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    if (BTM_Ble_Authorization(bd_addr, authorize)) {
+        return ESP_OK;
+    }
+    return ESP_FAIL;
+}



--- a/components/bt/bluedroid/api/esp_gap_bt_api.c
+++ b/components/bt/bluedroid/api/esp_gap_bt_api.c
@@ -213,7 +213,7 @@ esp_err_t esp_bt_gap_remove_bond_device(esp_bd_addr_t bd_addr)
 int esp_bt_gap_get_bond_device_num(void)
 {
    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
-        return ESP_FAIL;
+        return ESP_ERR_INVALID_STATE;
    }
    return btc_storage_get_num_bt_bond_devices();
 }
@@ -221,7 +221,6 @@ int esp_bt_gap_get_bond_device_num(void)
 esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
 {
    int ret;
-    int dev_num_total;

    if (dev_num == NULL || dev_list == NULL) {
        return ESP_ERR_INVALID_ARG;
@@ -231,12 +230,7 @@ esp_err_t esp_bt_gap_get_bond_device_list(int *dev_num, esp_bd_addr_t *dev_list)
        return ESP_ERR_INVALID_STATE;
    }

-    dev_num_total = btc_storage_get_num_bt_bond_devices();
-    if (*dev_num > dev_num_total) {
-        *dev_num = dev_num_total;
-    }
-
-    ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, *dev_num);
+    ret = btc_storage_get_bonded_bt_devices_list((bt_bdaddr_t *)dev_list, dev_num);

    return (ret == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
--- a/components/bt/bluedroid/api/esp_gatt_common_api.c
+++ b/components/bt/bluedroid/api/esp_gatt_common_api.c
@@ -50,9 +50,33 @@ esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)

 #if (BLE_INCLUDED == TRUE)
 extern uint16_t L2CA_GetFreePktBufferNum_LE(void);
+/**
+ * @brief           This function is called to get currently sendable packets number on controller,
+ *                  the function is called only in BLE running core and single connection now.
+ *
+ * @return
+ *                  sendable packets number on controller
+ *
+ */

-uint16_t esp_ble_get_sendable_packets_num ()
+uint16_t esp_ble_get_sendable_packets_num (void)
 {
    return L2CA_GetFreePktBufferNum_LE();
 }
+
+/**
+ * @brief           This function is used to query the number of available buffers for the current connection.
+ *                  When you need to query the current available buffer number, it is recommended to use this API.
+ * @param[in]       conn_id: current connection id.
+ * 
+ * @return
+ *                  Number of available buffers for the current connection
+ *
+ */
+extern UINT16 L2CA_GetCurFreePktBufferNum_LE(UINT16 conn_id);
+uint16_t esp_ble_get_cur_sendable_packets_num (uint16_t connid)
+{
+    return L2CA_GetCurFreePktBufferNum_LE(connid);
+}
+
 #endif
--- a/components/bt/bluedroid/api/esp_gattc_api.c
+++ b/components/bt/bluedroid/api/esp_gattc_api.c
@@ -350,6 +350,39 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
+                                      uint16_t conn_id,
+                                      uint16_t start_handle,
+                                      uint16_t end_handle,
+                                      esp_bt_uuid_t *uuid,
+                                      esp_gatt_auth_req_t auth_req)
+{
+    btc_msg_t msg;
+    btc_ble_gattc_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    if (uuid == NULL) {
+        return ESP_GATT_ILLEGAL_PARAMETER;
+    }
+
+    if (L2CA_CheckIsCongest(L2CAP_ATT_CID, conn_id)) {
+        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        return ESP_FAIL;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GATTC;
+    msg.act = BTC_GATTC_ACT_READ_BY_TYPE;
+    arg.read_by_type.conn_id = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
+    arg.read_by_type.s_handle = start_handle;
+    arg.read_by_type.e_handle = end_handle;
+    arg.read_by_type.auth_req = auth_req;
+    memcpy(&(arg.read_by_type.uuid), uuid, sizeof(esp_bt_uuid_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
                                      uint16_t conn_id, esp_gattc_multi_t *read_multi,
                                      esp_gatt_auth_req_t auth_req)
@@ -431,6 +464,9 @@ esp_err_t esp_ble_gattc_write_char(esp_gatt_if_t gattc_if,
    arg.write_char.value = value;
    arg.write_char.write_type = write_type;
    arg.write_char.auth_req = auth_req;
+    if(write_type == ESP_GATT_WRITE_TYPE_NO_RSP){
+        l2ble_update_att_acl_pkt_num(L2CA_ADD_BTC_NUM, NULL);
+    }

    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), btc_gattc_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
@@ -462,6 +498,10 @@ esp_err_t esp_ble_gattc_write_char_descr (esp_gatt_if_t gattc_if,
    arg.write_descr.write_type = write_type;
    arg.write_descr.auth_req = auth_req;

+    if(write_type == ESP_GATT_WRITE_TYPE_NO_RSP){
+        l2ble_update_att_acl_pkt_num(L2CA_ADD_BTC_NUM, NULL);
+    }
+    
    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), btc_gattc_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

--- a/components/bt/bluedroid/api/esp_gatts_api.c
+++ b/components/bt/bluedroid/api/esp_gatts_api.c
@@ -274,6 +274,9 @@ esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id,
    arg.send_ind.value_len = value_len;
    arg.send_ind.value = value;

+    if(need_confirm == false){
+        l2ble_update_att_acl_pkt_num(L2CA_ADD_BTC_NUM, NULL);
+    }
    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t),
                                 btc_gatts_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
--- a/components/bt/bluedroid/api/esp_spp_api.c
+++ b/components/bt/bluedroid/api/esp_spp_api.c
@@ -154,6 +154,17 @@ esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
    return (btc_transfer_context(&msg, &arg, sizeof(btc_spp_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+esp_err_t esp_spp_stop_srv(void)
+{
+    btc_msg_t msg;
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_SPP;
+    msg.act = BTC_SPP_ACT_STOP_SRV;
+
+    return (btc_transfer_context(&msg, NULL, sizeof(btc_spp_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}

 esp_err_t esp_spp_write(uint32_t handle, int len, uint8_t *p_data)
 {
--- a/components/bt/bluedroid/api/include/api/esp_a2dp_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_a2dp_api.h
@@ -76,7 +76,7 @@ typedef enum {

 /// A2DP media control commands
 typedef enum {
-    ESP_A2D_MEDIA_CTRL_NONE = 0,               /*!< dummy command */
+    ESP_A2D_MEDIA_CTRL_NONE = 0,               /*!< Not for application use, use inside stack only. */
    ESP_A2D_MEDIA_CTRL_CHECK_SRC_RDY,          /*!< check whether AVDTP is connected, only used in A2DP source */
    ESP_A2D_MEDIA_CTRL_START,                  /*!< command to set up media transmission channel */
    ESP_A2D_MEDIA_CTRL_STOP,                   /*!< command to stop media transmission */
--- a/components/bt/bluedroid/api/include/api/esp_gap_ble_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_gap_ble_api.h
@@ -287,6 +287,8 @@ typedef enum {
    ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH,
    /* Enable/Disable OOB support */
    ESP_BLE_SM_OOB_SUPPORT,
+    /* Appl encryption key size */
+    ESP_BLE_APP_ENC_KEY_SIZE,
    ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;

@@ -895,7 +897,7 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params);
 esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_data_length);

 /**
- * @brief           This function sets the random address for the application
+ * @brief           This function sets the static Random Address and Non-Resolvable Private Address for the application
 *
 * @param[in]       rand_addr: the random address which should be setting
 *
@@ -1243,6 +1245,18 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
 */
 esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device);

+
+/**
+* @brief           This function is called to authorized a link after Authentication(MITM protection)
+*
+* @param[in]       bd_addr: BD address of the peer device.
+* @param[out]      authorize: Authorized the link or not.
+*
+* @return          - ESP_OK : success
+*                  - other  : failed
+*
+*/
+esp_err_t esp_gap_ble_set_authorization(esp_bd_addr_t bd_addr, bool authorize);
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/bluedroid/api/include/api/esp_gap_bt_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_gap_bt_api.h
@@ -174,6 +174,7 @@ typedef enum {
    ESP_BT_GAP_KEY_NOTIF_EVT,                       /*!< Simple Pairing Passkey Notification */
    ESP_BT_GAP_KEY_REQ_EVT,                         /*!< Simple Pairing Passkey request */
    ESP_BT_GAP_READ_RSSI_DELTA_EVT,                 /*!< read rssi event */
+    ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT,        /*!< remove bond device complete event */
    ESP_BT_GAP_EVT_MAX,
 } esp_bt_gap_cb_event_t;

@@ -271,6 +272,14 @@ typedef union {
    struct key_req_param {
        esp_bd_addr_t bda;                     /*!< remote bluetooth device address*/
    } key_req;                                 /*!< passkey request parameter struct */
+
+    /**
+     * @brief ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT
+     */
+    struct bt_remove_bond_dev_cmpl_evt_param {
+        esp_bd_addr_t bda;                          /*!< remote bluetooth device address*/
+        esp_bt_status_t status;                     /*!< Indicate the remove bond device operation success status */
+    }remove_bond_dev_cmpl;                           /*!< Event parameter of ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT */
 } esp_bt_gap_cb_param_t;

 /**
--- a/components/bt/bluedroid/api/include/api/esp_gatt_common_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_gatt_common_api.h
@@ -46,6 +46,7 @@ extern esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu);

 #if (BLE_INCLUDED == TRUE)
 extern uint16_t esp_ble_get_sendable_packets_num (void);
+extern uint16_t esp_ble_get_cur_sendable_packets_num (uint16_t connid);
 #endif

 #ifdef __cplusplus
--- a/components/bt/bluedroid/api/include/api/esp_gatt_defs.h
+++ b/components/bt/bluedroid/api/include/api/esp_gatt_defs.h
@@ -278,6 +278,8 @@ typedef enum {
 #define    ESP_GATT_PERM_WRITE_ENC_MITM        (1 << 6)   /* bit 6 -  0x0040 */    /* relate to BTA_GATT_PERM_WRITE_ENC_MITM in bta/bta_gatt_api.h */
 #define    ESP_GATT_PERM_WRITE_SIGNED          (1 << 7)   /* bit 7 -  0x0080 */    /* relate to BTA_GATT_PERM_WRITE_SIGNED in bta/bta_gatt_api.h */
 #define    ESP_GATT_PERM_WRITE_SIGNED_MITM     (1 << 8)   /* bit 8 -  0x0100 */    /* relate to BTA_GATT_PERM_WRITE_SIGNED_MITM in bta/bta_gatt_api.h */
+#define    ESP_GATT_PERM_READ_AUTHORIZATION    (1 << 9)   /* bit 9 -  0x0200 */
+#define    ESP_GATT_PERM_WRITE_AUTHORIZATION   (1 << 10)  /* bit 10 - 0x0400 */
 typedef uint16_t esp_gatt_perm_t;

 /* relate to BTA_GATT_CHAR_PROP_BIT_xxx in bta/bta_gatt_api.h */
--- a/components/bt/bluedroid/api/include/api/esp_gattc_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_gattc_api.h
@@ -603,6 +603,29 @@ esp_err_t esp_ble_gattc_read_char (esp_gatt_if_t gattc_if,
                                   uint16_t conn_id,
                                   uint16_t handle,
                                   esp_gatt_auth_req_t auth_req);
+/**
+ * @brief           This function is called to read a service's characteristics of
+ *                  the given characteristic UUID
+ *
+ * @param[in]       gattc_if: Gatt client access interface.
+ * @param[in]       conn_id : connection ID.
+ * @param[in]       start_handle : the attribute start handle.
+ * @param[in]       end_handle : the attribute end handle
+ * @param[in]       uuid : The UUID of attribute which will be read.
+ * @param[in]       auth_req : authenticate request type
+ *
+ * @return
+ *                  - ESP_OK: success
+ *                  - other: failed
+ *
+ */
+esp_err_t esp_ble_gattc_read_by_type (esp_gatt_if_t gattc_if,
+                                      uint16_t conn_id,
+                                      uint16_t start_handle,
+                                      uint16_t end_handle,
+                                      esp_bt_uuid_t *uuid,
+                                      esp_gatt_auth_req_t auth_req);
+

 /**
 * @brief           This function is called to read multiple characteristic or
--- a/components/bt/bluedroid/api/include/api/esp_spp_api.h
+++ b/components/bt/bluedroid/api/include/api/esp_spp_api.h
@@ -27,7 +27,10 @@ typedef enum {
    ESP_SPP_FAILURE,                /*!< Generic failure. */
    ESP_SPP_BUSY,                   /*!< Temporarily can not handle this request. */
    ESP_SPP_NO_DATA,                /*!< no data. */
-    ESP_SPP_NO_RESOURCE             /*!< No more set pm control block */
+    ESP_SPP_NO_RESOURCE,            /*!< No more resource */
+    ESP_SPP_NEED_INIT,              /*!< SPP module shall init first */
+    ESP_SPP_NEED_DEINIT,            /*!< SPP module shall deinit first */
+    ESP_SPP_NO_CONNECTION,          /*!< connection may have been closed */
 } esp_spp_status_t;

 /* Security Setting Mask, Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.*/
@@ -57,6 +60,7 @@ typedef enum {
 */
 typedef enum {
    ESP_SPP_INIT_EVT                    = 0,                /*!< When SPP is inited, the event comes */
+    ESP_SPP_UNINIT_EVT                  = 1,                /*!< When SPP is uninited, the event comes */
    ESP_SPP_DISCOVERY_COMP_EVT          = 8,                /*!< When SDP discovery complete, the event comes */
    ESP_SPP_OPEN_EVT                    = 26,               /*!< When SPP Client connection open, the event comes */
    ESP_SPP_CLOSE_EVT                   = 27,               /*!< When SPP connection closed, the event comes */
@@ -66,6 +70,7 @@ typedef enum {
    ESP_SPP_CONG_EVT                    = 31,               /*!< When SPP connection congestion status changed, the event comes, only for ESP_SPP_MODE_CB */
    ESP_SPP_WRITE_EVT                   = 33,               /*!< When SPP write operation completes, the event comes, only for ESP_SPP_MODE_CB */
    ESP_SPP_SRV_OPEN_EVT                = 34,               /*!< When SPP Server connection open, the event comes */
+    ESP_SPP_SRV_STOP_EVT                = 35,               /*!< When SPP server stopped, the event comes */
 } esp_spp_cb_event_t;


@@ -80,6 +85,13 @@ typedef union {
        esp_spp_status_t    status;         /*!< status */
    } init;                                 /*!< SPP callback param of SPP_INIT_EVT */

+    /**
+     * @brief SPP_UNINIT_EVT
+     */
+    struct spp_uninit_evt_param {
+        esp_spp_status_t    status;         /*!< status */
+    } uninit;                                 /*!< SPP callback param of SPP_UNINIT_EVT */
+
    /**
     * @brief SPP_DISCOVERY_COMP_EVT
     */
@@ -128,6 +140,14 @@ typedef union {
        uint8_t             sec_id;         /*!< security ID used by this server */
        bool                use_co;         /*!< TRUE to use co_rfc_data */
    } start;                                /*!< SPP callback param of ESP_SPP_START_EVT */
+
+    /**
+     * @brief ESP_SPP_SRV_STOP_EVT
+     */
+    struct spp_srv_stop_evt_param {
+        esp_spp_status_t    status;         /*!< status */
+    } srv_stop;                                 /*!< SPP callback param of ESP_SPP_SRV_STOP_EVT */
+
    /**
     * @brief ESP_SPP_CL_INIT_EVT
     */
@@ -273,6 +293,16 @@ esp_err_t esp_spp_disconnect(uint32_t handle);
 esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
                            esp_spp_role_t role, uint8_t local_scn, const char *name);

+/**
+ * @brief       This function stops a SPP server
+ *              When the server is stopped successfully, the callback is called
+ *              with ESP_SPP_SRV_STOP_EVT.
+ *
+ * @return
+ *              - ESP_OK: success
+ *              - other: failed
+ */
+esp_err_t esp_spp_stop_srv(void);

 /**
 * @brief       This function is used to write data, only for ESP_SPP_MODE_CB.
--- a/components/bt/bluedroid/bta/av/bta_av_act.c
+++ b/components/bt/bluedroid/bta/av/bta_av_act.c
@@ -208,11 +208,8 @@ static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_AD
    UINT16 msg_event = 0;
    UNUSED(result);

-#if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
-    APPL_TRACE_EVENT("rc_ctrl handle: %d event=0x%x", handle, event);
-#else
-    APPL_TRACE_EVENT("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
-#endif
+    APPL_TRACE_EVENT("%s handle: %d event: 0x%x",__func__, handle, event);
+
    if (event == AVRC_OPEN_IND_EVT) {
        /* save handle of opened connection
        bta_av_cb.rc_handle = handle;*/
--- a/components/bt/bluedroid/bta/av/bta_av_main.c
+++ b/components/bt/bluedroid/bta/av/bta_av_main.c
@@ -563,13 +563,8 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
            if (bta_av_cb.features & (BTA_AV_FEAT_RCTG)) {
                /* register with no authorization; let AVDTP use authorization instead */
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
-#if (BTA_AV_WITH_AVCTP_AUTHORIZATION == TRUE)
-                bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
-                                bta_av_cb.sec_mask, BTA_ID_AV);
-#else
                bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
                                (UINT8)(bta_av_cb.sec_mask & (~BTA_SEC_AUTHORIZE)), BTA_ID_AV);
-#endif
                if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
                                p_bta_av_cfg->avrc_src_tg_cat, BTA_ID_AV);
@@ -699,13 +694,8 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
                    /* if TG is not supported, we need to register to AVCT now */
                    if ((bta_av_cb.features & (BTA_AV_FEAT_RCTG)) == 0) {
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
-#if (BTA_AV_WITH_AVCTP_AUTHORIZATION == TRUE)
-                        bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
-                                        bta_av_cb.sec_mask, BTA_ID_AV);
-#else
                        bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
                                        (UINT8)(bta_av_cb.sec_mask & (~BTA_SEC_AUTHORIZE)), BTA_ID_AV);
-#endif
 #endif
                    }
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
--- a/components/bt/bluedroid/bta/dm/bta_dm_act.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_act.c
@@ -610,7 +610,7 @@ void bta_dm_ble_read_adv_tx_power(tBTA_DM_MSG *p_data)
    }
 }

-void bta_dm_ble_read_rssi(tBTA_DM_MSG *p_data)
+void bta_dm_read_rssi(tBTA_DM_MSG *p_data)
 {
    if (p_data->rssi.read_rssi_cb != NULL) {
        BTM_ReadRSSI(p_data->rssi.remote_addr, p_data->rssi.transport, p_data->rssi.read_rssi_cb);
@@ -756,11 +756,13 @@ void bta_dm_remove_device(tBTA_DM_MSG *p_data)
        /* Take the link down first, and mark the device for removal when disconnected */
        for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
            if (!bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, p_dev->bd_addr)
-                && bta_dm_cb.device_list.peer_device[i].transport == transport) {
+#if BLE_INCLUDED == TRUE
+                && bta_dm_cb.device_list.peer_device[i].transport == transport
+#endif
+            ) {
                bta_dm_cb.device_list.peer_device[i].conn_state = BTA_DM_UNPAIRING;
-                btm_remove_acl( p_dev->bd_addr, bta_dm_cb.device_list.peer_device[i].transport);
-                APPL_TRACE_DEBUG("%s:transport = %d", __func__,
-                                 bta_dm_cb.device_list.peer_device[i].transport);
+                btm_remove_acl( p_dev->bd_addr, transport);
+                APPL_TRACE_DEBUG("%s:transport = %d", __func__, transport);
                break;
            }
        }
@@ -3622,9 +3624,9 @@ static void bta_dm_adjust_roles(BOOLEAN delay_role_switch)
                        BTM_SwitchRole (bta_dm_cb.device_list.peer_device[i].peer_bdaddr,
                                        HCI_ROLE_MASTER, NULL);
                    } else {
-                        bta_dm_cb.switch_delay_timer.p_cback =
+                        bta_dm_cb.switch_delay_timer[i].p_cback =
                            (TIMER_CBACK *)&bta_dm_delay_role_switch_cback;
-                        bta_sys_start_timer(&bta_dm_cb.switch_delay_timer, 0, 500);
+                        bta_sys_start_timer(&bta_dm_cb.switch_delay_timer[i], 0, 500);
                    }
                }

--- a/components/bt/bluedroid/bta/dm/bta_dm_api.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_api.c
@@ -206,11 +206,11 @@ void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb)
    }
 }

-void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb)
+void BTA_DmReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb)
 {
    tBTA_DM_API_READ_RSSI *p_msg;
    if ((p_msg = (tBTA_DM_API_READ_RSSI *)osi_malloc(sizeof(tBTA_DM_API_READ_RSSI))) != NULL) {
-        p_msg->hdr.event = BTA_DM_API_BLE_READ_RSSI_EVT;
+        p_msg->hdr.event = BTA_DM_API_READ_RSSI_EVT;
        memcpy(p_msg->remote_addr, remote_addr, sizeof(BD_ADDR));
        p_msg->transport = transport;
        p_msg->read_rssi_cb = cmpl_cb;
--- a/components/bt/bluedroid/bta/dm/bta_dm_co.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_co.c
@@ -51,6 +51,7 @@ tBTE_APPL_CFG bte_appl_cfg = {
    BTM_BLE_MIN_KEY_SIZE,
    BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_DISABLE,
    BTM_BLE_OOB_DISABLE,
+    BTM_BLE_APPL_ENC_KEY_SIZE,
 };
 #endif

@@ -427,6 +428,17 @@ void bta_dm_co_ble_set_min_key_size(UINT8 ble_key_size)
 #endif  ///SMP_INCLUDED == TRUE
 }

+void bta_dm_co_ble_set_appl_enc_key_size(UINT8 ble_key_size)
+{
+#if (SMP_INCLUDED == TRUE)
+    if(ble_key_size >= bte_appl_cfg.ble_min_key_size && ble_key_size <= bte_appl_cfg.ble_max_key_size) {
+        bte_appl_cfg.ble_appl_enc_key_size = ble_key_size;
+    } else {
+        APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
+    }
+#endif  ///SMP_INCLUDED == TRUE
+}
+
 void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable)
 {
 #if (SMP_INCLUDED == TRUE)
--- a/components/bt/bluedroid/bta/dm/bta_dm_main.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_main.c
@@ -159,7 +159,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_remove_device,                   /* BTA_DM_API_REMOVE_DEVICE_EVT */
    bta_dm_update_white_list,               /* BTA_DM_API_UPDATE_WHITE_LIST_EVT */
    bta_dm_ble_read_adv_tx_power,           /* BTA_DM_API_BLE_READ_ADV_TX_POWER_EVT */
-    bta_dm_ble_read_rssi,                   /* BTA_DM_API_BLE_READ_RSSI_EVT */
+    bta_dm_read_rssi,                       /* BTA_DM_API_READ_RSSI_EVT */
    bta_dm_ble_update_duplicate_exceptional_list,/* BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT */
 };

--- a/components/bt/bluedroid/bta/dm/include/bta_dm_int.h
+++ b/components/bt/bluedroid/bta/dm/include/bta_dm_int.h
@@ -155,7 +155,7 @@ enum {
    BTA_DM_API_REMOVE_DEVICE_EVT,
    BTA_DM_API_UPDATE_WHITE_LIST_EVT,
    BTA_DM_API_BLE_READ_ADV_TX_POWER_EVT,
-    BTA_DM_API_BLE_READ_RSSI_EVT,
+    BTA_DM_API_READ_RSSI_EVT,
    BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT,
    BTA_DM_MAX_EVT
 };
@@ -1040,7 +1040,7 @@ typedef struct {


    tBTA_DM_ENCRYPT_CBACK      *p_encrypt_cback;
-    TIMER_LIST_ENT              switch_delay_timer;
+    TIMER_LIST_ENT              switch_delay_timer[BTA_DM_NUM_PEER_DEVICE];

 } tBTA_DM_CB;

@@ -1226,7 +1226,7 @@ extern void bta_dm_disable (tBTA_DM_MSG *p_data);
 extern void bta_dm_set_dev_name (tBTA_DM_MSG *p_data);
 extern void bta_dm_update_white_list(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_read_adv_tx_power(tBTA_DM_MSG *p_data);
-extern void bta_dm_ble_read_rssi(tBTA_DM_MSG *p_data);
+extern void bta_dm_read_rssi(tBTA_DM_MSG *p_data);
 extern void bta_dm_set_visibility (tBTA_DM_MSG *p_data);

 extern void bta_dm_set_scan_config(tBTA_DM_MSG *p_data);
--- a/components/bt/bluedroid/bta/gatt/bta_gattc_act.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gattc_act.c
@@ -1099,6 +1099,41 @@ void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 }
 /*******************************************************************************
 **
+** Function         bta_gattc_read_by_type
+**
+** Description      Read an attribute
+**
+** Returns          None.
+**
+*******************************************************************************/
+void bta_gattc_read_by_type(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
+{
+    if (!bta_gattc_enqueue(p_clcb, p_data)) {
+        return;
+    }
+
+    tGATT_READ_PARAM    read_param;
+    memset (&read_param, 0 ,sizeof(tGATT_READ_PARAM));
+    read_param.service.auth_req = p_data->api_read.auth_req;
+    read_param.service.s_handle = p_data->api_read.s_handle;
+    read_param.service.e_handle = p_data->api_read.e_handle;
+    memcpy(&(read_param.service.uuid), &(p_data->api_read.uuid), sizeof(tBT_UUID));
+
+    tBTA_GATT_STATUS status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_BY_TYPE, &read_param);
+
+    /* read fail */
+    if (status != BTA_GATT_OK) {
+        /* Dequeue the data, if it was enqueued */
+        if (p_clcb->p_q_cmd == p_data) {
+            p_clcb->p_q_cmd = NULL;
+            bta_gattc_pop_command_to_send(p_clcb);
+        }
+
+        bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
+    }
+}
+/*******************************************************************************
+**
 ** Function         bta_gattc_read_multi
 **
 ** Description      read multiple
@@ -1392,7 +1427,7 @@ void  bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
            return;
        }
        if (p_clcb->p_q_cmd->hdr.event != bta_gattc_opcode_to_int_evt[op - GATTC_OPTYPE_READ]) {
-            if (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT) {
+            if ((p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT)&&(p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_BY_TYPE_EVT)) {
                mapped_op = p_clcb->p_q_cmd->hdr.event - BTA_GATTC_API_READ_EVT + GATTC_OPTYPE_READ;
                if ( mapped_op > GATTC_OPTYPE_INDICATION) {
                    mapped_op = 0;
--- a/components/bt/bluedroid/bta/gatt/bta_gattc_api.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gattc_api.c
@@ -31,7 +31,7 @@
 #include "bta/bta_sys.h"
 #include "bta/bta_gatt_api.h"
 #include "bta_gattc_int.h"
-
+#include "stack/l2c_api.h"
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -562,6 +562,39 @@ void BTA_GATTC_ReadMultiple(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi,
    return;
 }

+/*******************************************************************************
+**
+** Function         BTA_GATTC_Read_by_type
+**
+** Description      This function is called to read a attribute value by uuid
+**
+** Parameters       conn_id - connection ID.
+**                  s_handle - start handle.
+**                  e_handle - end hanle
+**                  uuid - The attribute UUID.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_GATTC_Read_by_type(UINT16 conn_id, UINT16 s_handle,UINT16 e_handle, tBT_UUID *uuid, tBTA_GATT_AUTH_REQ auth_req)
+{
+    tBTA_GATTC_API_READ  *p_buf;
+
+    if ((p_buf = (tBTA_GATTC_API_READ *) osi_malloc(sizeof(tBTA_GATTC_API_READ))) != NULL) {
+        memset(p_buf, 0, sizeof(tBTA_GATTC_API_READ));
+
+        p_buf->hdr.event = BTA_GATTC_API_READ_BY_TYPE_EVT;
+        p_buf->hdr.layer_specific = conn_id;
+        p_buf->auth_req = auth_req;
+        p_buf->s_handle = s_handle;
+        p_buf->e_handle = e_handle;
+        memcpy(&(p_buf->uuid), uuid, sizeof(tBT_UUID));
+        p_buf->cmpl_evt = BTA_GATTC_READ_CHAR_EVT;
+
+        bta_sys_sendmsg(p_buf);
+    }
+    return;
+}

 /*******************************************************************************
 **
@@ -603,6 +636,10 @@ void BTA_GATTC_WriteCharValue ( UINT16 conn_id,
            memcpy(p_buf->p_value, p_value, len);
        }

+        if(write_type == BTA_GATTC_TYPE_WRITE_NO_RSP){
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTC_NUM, NULL);
+            l2ble_update_att_acl_pkt_num(L2CA_ADD_BTU_NUM, NULL);
+        }
        bta_sys_sendmsg(p_buf);
    }
    return;
@@ -650,6 +687,10 @@ void BTA_GATTC_WriteCharDescr (UINT16 conn_id,
            memcpy(p_buf->p_value, p_data->p_value, p_data->len);
        }

+        if(write_type == BTA_GATTC_TYPE_WRITE_NO_RSP){
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTC_NUM, NULL);
+            l2ble_update_att_acl_pkt_num(L2CA_ADD_BTU_NUM, NULL);
+        }
        bta_sys_sendmsg(p_buf);
    }
    return;
--- a/components/bt/bluedroid/bta/gatt/bta_gattc_main.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gattc_main.c
@@ -65,6 +65,7 @@ enum {
    BTA_GATTC_DISC_CLOSE,
    BTA_GATTC_RESTART_DISCOVER,
    BTA_GATTC_CFG_MTU,
+    BTA_GATTC_READ_BY_TYPE,

    BTA_GATTC_IGNORE
 };
@@ -98,7 +99,8 @@ const tBTA_GATTC_ACTION bta_gattc_action[] = {
    bta_gattc_ignore_op_cmpl,
    bta_gattc_disc_close,
    bta_gattc_restart_discover,
-    bta_gattc_cfg_mtu
+    bta_gattc_cfg_mtu,
+    bta_gattc_read_by_type
 };


@@ -133,6 +135,7 @@ static const UINT8 bta_gattc_st_idle[][BTA_GATTC_NUM_COLS] = {
    /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE,            BTA_GATTC_IDLE_ST},
    /* BTA_GATTC_INT_DISCONN_EVT       */    {BTA_GATTC_IGNORE,            BTA_GATTC_IDLE_ST},

+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_FAIL,              BTA_GATTC_IDLE_ST},
 };

 /* state table for wait for open state */
@@ -161,6 +164,7 @@ static const UINT8 bta_gattc_st_w4_conn[][BTA_GATTC_NUM_COLS] = {
    /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE,             BTA_GATTC_W4_CONN_ST},
    /* BTA_GATTC_INT_DISCONN_EVT      */     {BTA_GATTC_OPEN_FAIL,          BTA_GATTC_IDLE_ST},

+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_FAIL,               BTA_GATTC_W4_CONN_ST},
 };

 /* state table for open state */
@@ -190,6 +194,7 @@ static const UINT8 bta_gattc_st_connected[][BTA_GATTC_NUM_COLS] = {

    /* BTA_GATTC_INT_DISCONN_EVT        */   {BTA_GATTC_CLOSE,              BTA_GATTC_IDLE_ST},

+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_READ_BY_TYPE,       BTA_GATTC_CONN_ST},
 };

 /* state table for discover state */
@@ -218,6 +223,7 @@ static const UINT8 bta_gattc_st_discover[][BTA_GATTC_NUM_COLS] = {
    /* BTA_GATTC_OP_CMPL_EVT            */   {BTA_GATTC_IGNORE_OP_CMPL,     BTA_GATTC_DISCOVER_ST},
    /* BTA_GATTC_INT_DISCONN_EVT        */   {BTA_GATTC_CLOSE,              BTA_GATTC_IDLE_ST},

+    /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_Q_CMD,              BTA_GATTC_DISCOVER_ST},
 };

 /* type for state table */
@@ -470,6 +476,8 @@ static char *gattc_evt_code(tBTA_GATTC_INT_EVT evt_code)
        return "BTA_GATTC_API_DISABLE_EVT";
    case BTA_GATTC_API_CFG_MTU_EVT:
        return "BTA_GATTC_API_CFG_MTU_EVT";
+    case BTA_GATTC_API_READ_BY_TYPE_EVT:
+        return "BTA_GATTC_API_READ_BY_TYPE_EVT";
    default:
        return "unknown GATTC event code";
    }
--- a/components/bt/bluedroid/bta/gatt/bta_gattc_utils.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gattc_utils.c
@@ -306,8 +306,11 @@ void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB *p_clcb)
                p_srcb->p_srvc_cache = NULL;
            }
        }
-        osi_free(p_clcb->p_q_cmd);
-        p_clcb->p_q_cmd = NULL;
+
+        if ( p_clcb->p_q_cmd != NULL && !list_contains(p_clcb->p_cmd_list, p_clcb->p_q_cmd)){
+            osi_free(p_clcb->p_q_cmd);
+            p_clcb->p_q_cmd = NULL;
+        }
        // don't forget to clear the command queue before dealloc the clcb.
        list_clear(p_clcb->p_cmd_list);
        osi_free((void *)p_clcb->p_cmd_list);
--- a/components/bt/bluedroid/bta/gatt/bta_gatts_act.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gatts_act.c
@@ -35,6 +35,7 @@
 #include "stack/btm_ble_api.h"
 #include <string.h>
 #include "osi/allocator.h"
+#include "stack/l2c_api.h"

 static void bta_gatts_nv_save_cback(BOOLEAN is_saved, tGATTS_HNDL_RANGE *p_hndl_range);
 static BOOLEAN bta_gatts_nv_srv_chg_cback(tGATTS_SRV_CHG_CMD cmd, tGATTS_SRV_CHG_REQ *p_req,
@@ -672,6 +673,7 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                                                      p_msg->api_indicate.len,
                                                      p_msg->api_indicate.value);
            } else {
+                l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTU_NUM, NULL);
                status = GATTS_HandleValueNotification (p_msg->api_indicate.hdr.layer_specific,
                                                        p_msg->api_indicate.attr_id,
                                                        p_msg->api_indicate.len,
--- a/components/bt/bluedroid/bta/gatt/bta_gatts_api.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gatts_api.c
@@ -31,7 +31,7 @@
 #include "bta/bta_gatt_api.h"
 #include "bta_gatts_int.h"
 #include "osi/allocator.h"
-
+#include "stack/l2c_api.h"
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -426,6 +426,11 @@ void BTA_GATTS_HandleValueIndication (UINT16 conn_id, UINT16 attr_id, UINT16 dat
            memcpy(p_buf->value, p_data, data_len);

        }
+
+        if(need_confirm == false){
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTC_NUM, NULL);
+            l2ble_update_att_acl_pkt_num(L2CA_ADD_BTU_NUM, NULL);
+        }
        bta_sys_sendmsg(p_buf);
    }
    return;
--- a/components/bt/bluedroid/bta/gatt/include/bta_gattc_int.h
+++ b/components/bt/bluedroid/bta/gatt/include/bta_gattc_int.h
@@ -59,6 +59,8 @@ enum {
    BTA_GATTC_OP_CMPL_EVT,
    BTA_GATTC_INT_DISCONN_EVT,

+    BTA_GATTC_API_READ_BY_TYPE_EVT,
+
    BTA_GATTC_INT_START_IF_EVT,
    BTA_GATTC_API_REG_EVT,
    BTA_GATTC_API_DEREG_EVT,
@@ -136,6 +138,9 @@ typedef struct {
    BT_HDR                  hdr;
    tBTA_GATT_AUTH_REQ      auth_req;
    UINT16                  handle;
+    UINT16                  s_handle;
+    UINT16                  e_handle;
+    tBT_UUID                uuid;
    tBTA_GATTC_EVT          cmpl_evt;
 } tBTA_GATTC_API_READ;

@@ -449,6 +454,7 @@ extern void bta_gattc_disc_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_dat
 extern void bta_gattc_start_discover(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
+extern void bta_gattc_read_by_type(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_q_cmd(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
--- a/components/bt/bluedroid/bta/include/bta/bta_api.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_api.h
@@ -926,7 +926,7 @@ typedef union {
    tBTA_DM_PIN_REQ             pin_req;            /* PIN request. */
    tBTA_DM_AUTH_CMPL           auth_cmpl;          /* Authentication complete indication. */
    tBTA_DM_AUTHORIZE           authorize;          /* Authorization request. */
-    tBTA_DM_LINK_UP             link_up;            /* ACL connection down event */
+    tBTA_DM_LINK_UP             link_up;            /* ACL connection up event */
    tBTA_DM_LINK_DOWN           link_down;          /* ACL connection down event */
    tBTA_DM_BUSY_LEVEL          busy_level;         /* System busy level */
    tBTA_DM_SP_CFM_REQ          cfm_req;            /* user confirm request */
@@ -1457,7 +1457,7 @@ extern void BTA_DmUpdateWhiteList(BOOLEAN add_remove,  BD_ADDR remote_addr, tBTA

 extern void BTA_DmBleReadAdvTxPower(tBTA_CMPL_CB *cmpl_cb);

-extern void BTA_DmBleReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb);
+extern void BTA_DmReadRSSI(BD_ADDR remote_addr, tBTA_TRANSPORT transport, tBTA_CMPL_CB *cmpl_cb);

 /*******************************************************************************
 **
@@ -2296,8 +2296,8 @@ extern void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_l
 ** Returns          None
 **
 *******************************************************************************/
-extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, 
-                                                BD_ADDR device_info, 
+extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type,
+                                                BD_ADDR device_info,
                                                tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_exceptional_list_cback);

 /*******************************************************************************
--- a/components/bt/bluedroid/bta/include/bta/bta_av_api.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_av_api.h
@@ -36,12 +36,6 @@
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/
-/* Set to TRUE if seperate authorization prompt desired for AVCTP besides A2DP authorization */
-/* Typically FALSE when AVRCP is used in conjunction with A2DP */
-#ifndef BTA_AV_WITH_AVCTP_AUTHORIZATION
-#define BTA_AV_WITH_AVCTP_AUTHORIZATION     FALSE
-#endif
-
 /* AV status values */
 #define BTA_AV_SUCCESS          0       /* successful operation */
 #define BTA_AV_FAIL             1       /* generic failure */
@@ -581,8 +575,7 @@ void BTA_AvDisable(void);
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name,
-                    UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep);
+void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id, tBTA_AV_DATA_CBACK  *p_data_cback, tBTA_AV_CO_FUNCTS *bta_av_cos, UINT8 tsep);

 /*******************************************************************************
 **
--- a/components/bt/bluedroid/bta/include/bta/bta_dm_co.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_dm_co.h
@@ -214,4 +214,6 @@ extern UINT8 bta_dm_co_ble_get_accept_auth_enable(void);
 extern UINT8 bta_dm_co_ble_get_auth_req(void);

 extern void bta_dm_co_ble_oob_support(UINT8 enable);
+
+extern void bta_dm_co_ble_set_appl_enc_key_size(UINT8 ble_key_size);
 #endif
--- a/components/bt/bluedroid/bta/include/bta/bta_gatt_api.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_gatt_api.h
@@ -479,6 +479,8 @@ typedef tGATT_IF tBTA_GATTS_IF;
 #define BTA_GATT_PERM_WRITE_ENC_MITM    GATT_PERM_WRITE_ENC_MITM    /* bit 6 -  0x0040 */
 #define BTA_GATT_PERM_WRITE_SIGNED      GATT_PERM_WRITE_SIGNED      /* bit 7 -  0x0080 */
 #define BTA_GATT_PERM_WRITE_SIGNED_MITM GATT_PERM_WRITE_SIGNED_MITM /* bit 8 -  0x0100 */
+#define BTA_GATT_PERM_READ_AUTHORIZATION GATT_PERM_READ_AUTHORIZATION /* bit 9 - 0x0200 */
+#define BTA_GATT_PERM_WRITE_AUTHORIZATION GATT_PERM_WRITE_AUTHORIZATION /* bit 10 - 0x0400 */
 typedef UINT16 tBTA_GATT_PERM;
 typedef tGATT_ATTR_VAL tBTA_GATT_ATTR_VAL;
 typedef tGATTS_ATTR_CONTROL tBTA_GATTS_ATTR_CONTROL;
@@ -937,6 +939,22 @@ void BTA_GATTC_ReadCharacteristic(UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_
 *******************************************************************************/
 void BTA_GATTC_ReadCharDescr (UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_REQ auth_req);

+/*******************************************************************************
+**
+** Function         BTA_GATTC_Read_by_type
+**
+** Description      This function is called to read a attribute value by uuid
+**
+** Parameters       conn_id - connection ID.
+**                  s_handle - start handle.
+**                  e_handle - end hanle
+**                  uuid - The attribute UUID.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_GATTC_Read_by_type(UINT16 conn_id, UINT16 s_handle,UINT16 e_handle, tBT_UUID *uuid, tBTA_GATT_AUTH_REQ auth_req);
+
 /*******************************************************************************
 **
 ** Function         BTA_GATTC_WriteCharValue
--- a/components/bt/bluedroid/bta/include/bta/bta_jv_api.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_jv_api.h
@@ -129,11 +129,13 @@ typedef UINT8 tBTA_JV_CONN_STATE;
 /* Java I/F callback events */
 /* events received by tBTA_JV_DM_CBACK */
 #define BTA_JV_ENABLE_EVT           0  /* JV enabled */
+#define BTA_JV_DISABLE_EVT          1  /* JV disabled */
 #define BTA_JV_GET_SCN_EVT          6  /* Reserved an SCN */
 #define BTA_JV_GET_PSM_EVT          7  /* Reserved a PSM */
 #define BTA_JV_DISCOVERY_COMP_EVT   8  /* SDP discovery complete */
 #define BTA_JV_CREATE_RECORD_EVT    11 /* the result for BTA_JvCreateRecord */
 /* events received by tBTA_JV_L2CAP_CBACK */
+#if BTA_JV_L2CAP_INCLUDED
 #define BTA_JV_L2CAP_OPEN_EVT       16 /* open status of L2CAP connection */
 #define BTA_JV_L2CAP_CLOSE_EVT      17 /* L2CAP connection closed */
 #define BTA_JV_L2CAP_START_EVT      18 /* L2CAP server started */
@@ -144,6 +146,7 @@ typedef UINT8 tBTA_JV_CONN_STATE;
 #define BTA_JV_L2CAP_RECEIVE_EVT    23 /* the result for BTA_JvL2capReceive*/
 #define BTA_JV_L2CAP_WRITE_EVT      24 /* the result for BTA_JvL2capWrite*/
 #define BTA_JV_L2CAP_WRITE_FIXED_EVT 25 /* the result for BTA_JvL2capWriteFixed */
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /* events received by tBTA_JV_RFCOMM_CBACK */
 #define BTA_JV_RFCOMM_OPEN_EVT      26 /* open status of RFCOMM Client connection */
@@ -155,7 +158,8 @@ typedef UINT8 tBTA_JV_CONN_STATE;
 #define BTA_JV_RFCOMM_READ_EVT      32 /* the result for BTA_JvRfcommRead */
 #define BTA_JV_RFCOMM_WRITE_EVT     33 /* the result for BTA_JvRfcommWrite*/
 #define BTA_JV_RFCOMM_SRV_OPEN_EVT  34 /* open status of Server RFCOMM connection */
-#define BTA_JV_MAX_EVT              35 /* max number of JV events */
+#define BTA_JV_FREE_SCN_EVT         35 /* FREE an SCN */
+#define BTA_JV_MAX_EVT              36 /* max number of JV events */

 typedef UINT16 tBTA_JV_EVT;

@@ -178,6 +182,7 @@ typedef struct {
    UINT32          handle;     /* The SDP handle */
 } tBTA_JV_CREATE_RECORD;

+#if BTA_JV_L2CAP_INCLUDED
 /* data associated with BTA_JV_L2CAP_OPEN_EVT */
 typedef struct {
    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
@@ -186,18 +191,6 @@ typedef struct {
    INT32           tx_mtu;     /* The transmit MTU */
 } tBTA_JV_L2CAP_OPEN;

-/* data associated with BTA_JV_L2CAP_OPEN_EVT for LE sockets */
-typedef struct {
-    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
-    UINT32          handle;     /* The connection handle */
-    BD_ADDR         rem_bda;    /* The peer address */
-    INT32           tx_mtu;     /* The transmit MTU */
-    void          **p_p_cback;  /* set them for new socket */
-    void          **p_user_data;/* set them for new socket */
-
-} tBTA_JV_L2CAP_LE_OPEN;
-
-
 /* data associated with BTA_JV_L2CAP_CLOSE_EVT */
 typedef struct {
    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
@@ -255,6 +248,22 @@ typedef struct {
    BOOLEAN         cong;       /* congestion status */
 } tBTA_JV_L2CAP_WRITE;

+/* data associated with BTA_JV_L2CAP_OPEN_EVT for LE sockets */
+typedef struct {
+    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
+    UINT32          handle;     /* The connection handle */
+    BD_ADDR         rem_bda;    /* The peer address */
+    INT32           tx_mtu;     /* The transmit MTU */
+    void          **p_p_cback;  /* set them for new socket */
+    void          **p_user_data;/* set them for new socket */
+
+} tBTA_JV_L2CAP_LE_OPEN;
+
+/*data associated with BTA_JV_L2CAP_DATA_IND_EVT if used for LE */
+typedef struct {
+    UINT32          handle;     /* The connection handle */
+    BT_HDR         *p_buf;      /* The incoming data */
+} tBTA_JV_LE_DATA_IND;

 /* data associated with BTA_JV_L2CAP_WRITE_FIXED_EVT */
 typedef struct {
@@ -265,6 +274,7 @@ typedef struct {
    UINT16          len;        /* The length of the data written. */
    BOOLEAN         cong;       /* congestion status */
 } tBTA_JV_L2CAP_WRITE_FIXED;
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /* data associated with BTA_JV_RFCOMM_OPEN_EVT */
 typedef struct {
@@ -272,6 +282,7 @@ typedef struct {
    UINT32          handle;     /* The connection handle */
    BD_ADDR         rem_bda;    /* The peer address */
 } tBTA_JV_RFCOMM_OPEN;
+
 /* data associated with BTA_JV_RFCOMM_SRV_OPEN_EVT */
 typedef struct {
    tBTA_JV_STATUS  status;             /* Whether the operation succeeded or failed. */
@@ -280,7 +291,6 @@ typedef struct {
    BD_ADDR         rem_bda;            /* The peer address */
 } tBTA_JV_RFCOMM_SRV_OPEN;

-
 /* data associated with BTA_JV_RFCOMM_CLOSE_EVT */
 typedef struct {
    tBTA_JV_STATUS  status;      /* Whether the operation succeeded or failed. */
@@ -304,19 +314,13 @@ typedef struct {
    UINT8           sec_id;     /* security ID used by this client */
    BOOLEAN         use_co;     /* TRUE to use co_rfc_data */
 } tBTA_JV_RFCOMM_CL_INIT;
+
 /*data associated with BTA_JV_L2CAP_DATA_IND_EVT & BTA_JV_RFCOMM_DATA_IND_EVT */
 typedef struct {
    UINT32          handle;     /* The connection handle */
    BT_HDR         *p_buf;      /* The incoming data */
 } tBTA_JV_DATA_IND;

-/*data associated with BTA_JV_L2CAP_DATA_IND_EVT if used for LE */
-typedef struct {
-    UINT32          handle;     /* The connection handle */
-    BT_HDR         *p_buf;      /* The incoming data */
-} tBTA_JV_LE_DATA_IND;
-
-
 /* data associated with BTA_JV_RFCOMM_CONG_EVT */
 typedef struct {
    tBTA_JV_STATUS  status;     /* Whether the operation succeeded or failed. */
@@ -341,6 +345,7 @@ typedef struct {
    UINT32          req_id;     /* The req_id in the associated BTA_JvRfcommWrite() */
    int             len;        /* The length of the data written. */
    BOOLEAN         cong;       /* congestion status */
+    BOOLEAN         old_cong;   /* congestion status */
 } tBTA_JV_RFCOMM_WRITE;

 /* data associated with BTA_JV_API_SET_PM_PROFILE_EVT */
@@ -356,6 +361,23 @@ typedef struct {
    tBTA_JV_CONN_STATE  state;  /* JV connection stata */
 } tBTA_JV_NOTIFY_PM_STATE_CHANGE;

+/* indicate server at which status */
+typedef enum {
+    BTA_JV_SERVER_START_FAILED,
+    BTA_JV_SERVER_RUNNING,
+    BTA_JV_SERVER_STATUS_MAX,
+} tBTA_JV_SERVER_STATUS;
+
+typedef struct {
+    tBTA_JV_SERVER_STATUS   server_status;
+    UINT32                  slot_id;
+}tBTA_JV_FREE_SCN_USER_DATA;
+
+/* data associated with BTA_JV_FREE_SCN_EVT  */
+typedef struct {
+    tBTA_JV_STATUS          status; /* Status of the operation */
+    tBTA_JV_SERVER_STATUS   server_status;
+} tBTA_JV_FREE_SCN;

 /* union of data associated with JV callback */
 typedef union {
@@ -365,6 +387,7 @@ typedef union {
    UINT8                   scn;            /* BTA_JV_GET_SCN_EVT */
    UINT16                  psm;            /* BTA_JV_GET_PSM_EVT */
    tBTA_JV_CREATE_RECORD   create_rec;     /* BTA_JV_CREATE_RECORD_EVT */
+#if BTA_JV_L2CAP_INCLUDED
    tBTA_JV_L2CAP_OPEN      l2c_open;       /* BTA_JV_L2CAP_OPEN_EVT */
    tBTA_JV_L2CAP_CLOSE     l2c_close;      /* BTA_JV_L2CAP_CLOSE_EVT */
    tBTA_JV_L2CAP_START     l2c_start;      /* BTA_JV_L2CAP_START_EVT */
@@ -372,6 +395,7 @@ typedef union {
    tBTA_JV_L2CAP_CONG      l2c_cong;       /* BTA_JV_L2CAP_CONG_EVT */
    tBTA_JV_L2CAP_READ      l2c_read;       /* BTA_JV_L2CAP_READ_EVT */
    tBTA_JV_L2CAP_WRITE     l2c_write;      /* BTA_JV_L2CAP_WRITE_EVT */
+#endif /* BTA_JV_L2CAP_INCLUDED */
    tBTA_JV_RFCOMM_OPEN     rfc_open;       /* BTA_JV_RFCOMM_OPEN_EVT */
    tBTA_JV_RFCOMM_SRV_OPEN rfc_srv_open;   /* BTA_JV_RFCOMM_SRV_OPEN_EVT */
    tBTA_JV_RFCOMM_CLOSE    rfc_close;      /* BTA_JV_RFCOMM_CLOSE_EVT */
@@ -382,9 +406,12 @@ typedef union {
    tBTA_JV_RFCOMM_WRITE    rfc_write;      /* BTA_JV_RFCOMM_WRITE_EVT */
    tBTA_JV_DATA_IND        data_ind;       /* BTA_JV_L2CAP_DATA_IND_EVT
                                               BTA_JV_RFCOMM_DATA_IND_EVT */
-    tBTA_JV_LE_DATA_IND      le_data_ind;   /* BTA_JV_L2CAP_LE_DATA_IND_EVT */
+    tBTA_JV_FREE_SCN        free_scn;       /* BTA_JV_FREE_SCN_EVT */
+#if BTA_JV_L2CAP_INCLUDED
    tBTA_JV_L2CAP_LE_OPEN      l2c_le_open;       /* BTA_JV_L2CAP_OPEN_EVT */
+    tBTA_JV_LE_DATA_IND        le_data_ind;   /* BTA_JV_L2CAP_LE_DATA_IND_EVT */
    tBTA_JV_L2CAP_WRITE_FIXED  l2c_write_fixed;      /* BTA_JV_L2CAP_WRITE_FIXED_EVT */
+#endif
 } tBTA_JV;

 /* JAVA DM Interface callback */
@@ -393,8 +420,10 @@ typedef void (tBTA_JV_DM_CBACK)(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_d
 /* JAVA RFCOMM interface callback */
 typedef void *(tBTA_JV_RFCOMM_CBACK)(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data);

+#if BTA_JV_L2CAP_INCLUDED
 /* JAVA L2CAP interface callback */
 typedef void (tBTA_JV_L2CAP_CBACK)(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_Data);
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /* JV configuration structure */
 typedef struct {
@@ -424,12 +453,25 @@ extern tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback);
 **
 ** Function         BTA_JvDisable
 **
-** Description      Disable the Java I/F
+** Description      Disable the Java I/F. When the enable
+**                  operation is complete the callback function will be
+**                  called with a BTA_JV_DISABLE_EVT.
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_JvDisable(void);
+extern void BTA_JvDisable(tBTA_JV_RFCOMM_CBACK *p_cback);
+
+/*******************************************************************************
+**
+** Function         BTA_JvFree
+**
+** Description      Free JV configuration
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_JvFree(void);

 /*******************************************************************************
 **
@@ -484,12 +526,17 @@ extern tBTA_JV_STATUS BTA_JvGetChannelId(int conn_type, void *user_data,
 **
 ** Description      This function frees a SCN/PSM that was used
 **                  by an application running over RFCOMM or L2CAP.
+** Parameters
+**   channel        The channel to free
+**   conn_type      one of BTA_JV_CONN_TYPE_
+**   p_cback        tBTA_JV_RFCOMM_CBACK is called with BTA_JV_FREE_SCN_EVT when server frees a SCN/PSM
+**   user_data      indicate the RFCOMM server status
 **
 ** Returns          BTA_JV_SUCCESS, if the request is being processed.
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type);
+extern tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);

 /*******************************************************************************
 **
@@ -532,6 +579,7 @@ extern tBTA_JV_STATUS BTA_JvCreateRecordByUser(const char *name, UINT32 channel,
 *******************************************************************************/
 extern tBTA_JV_STATUS BTA_JvDeleteRecord(UINT32 handle);

+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function         BTA_JvL2capConnectLE
@@ -739,6 +787,7 @@ extern tBTA_JV_STATUS BTA_JvL2capWrite(UINT32 handle, UINT32 req_id,
 extern tBTA_JV_STATUS BTA_JvL2capWriteFixed(UINT16 channel, BD_ADDR *addr, UINT32 req_id,
        tBTA_JV_L2CAP_CBACK *p_cback,
        UINT8 *p_data, UINT16 len, void *user_data);
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /*******************************************************************************
 **
@@ -769,7 +818,7 @@ extern tBTA_JV_STATUS BTA_JvRfcommConnect(tBTA_SEC sec_mask,
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data);
+extern tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);

 /*******************************************************************************
 **
@@ -786,9 +835,9 @@ extern tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data);
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvRfcommStartServer(tBTA_SEC sec_mask,
-        tBTA_JV_ROLE role, UINT8 local_scn, UINT8 max_session,
-        tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);
+extern tBTA_JV_STATUS BTA_JvRfcommStartServer(tBTA_SEC sec_mask, tBTA_JV_ROLE role,
+                                              UINT8 local_scn, UINT8 max_session,
+                                              tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data);

 /*******************************************************************************
 **
@@ -815,8 +864,7 @@ extern tBTA_JV_STATUS BTA_JvRfcommStopServer(UINT32 handle, void *user_data);
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvRfcommRead(UINT32 handle, UINT32 req_id,
-                                       UINT8 *p_data, UINT16 len);
+extern tBTA_JV_STATUS BTA_JvRfcommRead(UINT32 handle, UINT32 req_id, UINT8 *p_data, UINT16 len);

 /*******************************************************************************
 **
@@ -843,9 +891,20 @@ extern tBTA_JV_STATUS BTA_JvRfcommReady(UINT32 handle, UINT32 *p_data_size);
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-// extern tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id);
 extern tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id, int len, UINT8 *p_data);

+/*******************************************************************************
+**
+** Function         BTA_JvRfcommFlowControl
+**
+** Description      This function gives the credit to the peer
+**
+** Returns          BTA_JV_SUCCESS, if the request is being processed.
+**                  BTA_JV_FAILURE, otherwise.
+**
+*******************************************************************************/
+extern tBTA_JV_STATUS BTA_JvRfcommFlowControl(UINT32 handle, UINT16 credits_given);
+
 /*******************************************************************************
 **
 ** Function    BTA_JVSetPmProfile
@@ -865,8 +924,7 @@ extern tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id, int len, U
 **              BTA_JV_CONN_CLOSE to remove in case of connection close!
 **
 *******************************************************************************/
-extern tBTA_JV_STATUS BTA_JvSetPmProfile(UINT32 handle, tBTA_JV_PM_ID app_id,
-        tBTA_JV_CONN_STATE init_st);
+extern tBTA_JV_STATUS BTA_JvSetPmProfile(UINT32 handle, tBTA_JV_PM_ID app_id, tBTA_JV_CONN_STATE init_st);

 /*******************************************************************************
 **
--- a/components/bt/bluedroid/bta/jv/bta_jv_act.c
+++ b/components/bt/bluedroid/bta/jv/bta_jv_act.c
@@ -48,6 +48,7 @@


 #if (defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE)
+#if BTA_JV_L2CAP_INCLUDED
 /* one of these exists for each client */
 struct fc_client {
    struct fc_client    *next_all_list;
@@ -92,11 +93,10 @@ static void __attribute__((unused)) fc_init(void)
    pthread_once(&fc_init_once,  fc_init_work);
 }

-
 static void fcchan_conn_chng_cbk(UINT16 chan, BD_ADDR bd_addr, BOOLEAN connected,
                                 UINT16 reason, tBT_TRANSPORT );
 static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf);
-
+#endif /* BTA_JV_L2CAP_INCLUDED */  

 extern void uuid_to_string_legacy(bt_uuid_t *p_uuid, char *str);
 static inline void logu(const char *title, const uint8_t *p_uuid)
@@ -114,6 +114,10 @@ static void bta_jv_pm_conn_idle(tBTA_JV_PM_CB *p_cb);
 static void bta_jv_pm_state_change(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE state);
 tBTA_JV_STATUS bta_jv_set_pm_conn_state(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE
                                        new_st);
+static int find_rfc_pcb(void *user_data, tBTA_JV_RFC_CB **cb, tBTA_JV_PCB **pcb);
+static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle);
+static void bta_jv_port_event_sr_cback(UINT32 code, UINT16 port_handle);
+static int bta_jv_port_data_co_cback(UINT16 port_handle, UINT8 *buf, UINT16 len, int type);

 /*******************************************************************************
 **
@@ -288,6 +292,12 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
    BOOLEAN remove_server = FALSE;
    int close_pending = 0;

+    UINT8 used = 0, i, listen = 0;
+    tPORT_STATE port_state;
+    UINT32 event_mask = BTA_JV_RFC_EV_MASK;
+    UINT32 scn_num = (UINT32)p_cb->scn;
+    tBTA_JV evt_data;
+
    if (!p_cb || !p_pcb) {
        APPL_TRACE_ERROR("bta_jv_free_sr_rfc_cb, p_cb or p_pcb cannot be null");
        return BTA_JV_FAILURE;
@@ -363,6 +373,57 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
        }
        p_pcb->handle = 0;
        p_cb->curr_sess--;
+
+        if ((p_cb->max_sess > 1) &&
+            (p_cb->scn != 0) &&
+            (p_cb->curr_sess == p_cb->max_sess - 1)) {
+
+            for (i = 0; i < p_cb->max_sess; i++) {
+                if (p_cb->rfc_hdl[i] != 0) {
+                    p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[i] - 1];
+                    if (p_pcb->state == BTA_JV_ST_SR_LISTEN) {
+                        listen++;
+                    }
+                    used++;
+                }
+            }
+            APPL_TRACE_DEBUG("%s max_sess=%d used:%d curr_sess:%d, listen:%d si:%d",
+                             __func__, p_cb->max_sess, used, p_cb->curr_sess, listen, si);
+            if (used < p_cb->max_sess &&
+                listen == 0 &&
+                0 <= si &&
+                si < BTA_JV_MAX_RFC_SR_SESSION) {
+                /* make sure the server has a listen port */
+                if ((RFCOMM_CreateConnection(p_cb->sec_id, p_cb->scn, TRUE,
+                                             BTA_JV_DEF_RFC_MTU, (UINT8 *)bd_addr_any, &(p_cb->rfc_hdl[si]), bta_jv_port_mgmt_sr_cback) == PORT_SUCCESS) &&
+                    (p_cb->rfc_hdl[si] != 0)) {
+                    p_cb->curr_sess++;
+                    p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[si] - 1];
+                    p_pcb->state = BTA_JV_ST_SR_LISTEN;
+                    p_pcb->port_handle = p_cb->rfc_hdl[si];
+                    // p_pcb->user_data = p_pcb_open->user_data;
+
+                    PORT_ClearKeepHandleFlag(p_pcb->port_handle);
+                    PORT_SetEventCallback(p_pcb->port_handle, bta_jv_port_event_sr_cback);
+                    PORT_SetDataCOCallback(p_pcb->port_handle, bta_jv_port_data_co_cback);
+                    PORT_SetEventMask(p_pcb->port_handle, event_mask);
+                    PORT_GetState(p_pcb->port_handle, &port_state);
+
+                    port_state.fc_type = (PORT_FC_CTS_ON_INPUT | PORT_FC_CTS_ON_OUTPUT);
+
+                    PORT_SetState(p_pcb->port_handle, &port_state);
+                    p_pcb->handle = BTA_JV_RFC_H_S_TO_HDL(p_cb->handle, si);
+                    APPL_TRACE_DEBUG("%s: p_pcb->handle:0x%x, curr_sess:%d", __func__,
+                                     p_pcb->handle, p_cb->curr_sess);
+
+                    evt_data.rfc_srv_open.handle = 0;
+                    evt_data.rfc_srv_open.new_listen_handle = p_pcb->handle;
+                    evt_data.rfc_srv_open.status = BTA_JV_SUCCESS;
+                    p_pcb->user_data = p_cb->p_cback(BTA_JV_RFCOMM_SRV_OPEN_EVT, &evt_data, (void *)scn_num);
+                }
+            }
+        }
+
        if (p_cb->curr_sess == 0) {
            p_cb->scn = 0;
            bta_jv_free_sec_id(&p_cb->sec_id);
@@ -377,6 +438,7 @@ static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pc
    return status;
 }

+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function     bta_jv_free_l2c_cb
@@ -402,6 +464,7 @@ tBTA_JV_STATUS bta_jv_free_l2c_cb(tBTA_JV_L2C_CB *p_cb)
    p_cb->p_cback = NULL;
    return status;
 }
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /*******************************************************************************
 **
@@ -456,10 +519,9 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                }
            }

-            APPL_TRACE_API("%s(jv_handle: 0x%2x), idx: %d, "
-                           "app_id: 0x%x", __func__, jv_handle, i, bta_jv_cb.pm_cb[i].app_id);
-            APPL_TRACE_API("%s, bd_counter = %d, "
-                           "appid_counter = %d", __func__, bd_counter, appid_counter);
+            APPL_TRACE_API("%s(jv_handle: 0x%2x), idx: %d, app_id: 0x%x", __func__, jv_handle, i, bta_jv_cb.pm_cb[i].app_id);
+            APPL_TRACE_API("%s, bd_counter = %d, appid_counter = %d", __func__, bd_counter, appid_counter);
+
            if (bd_counter > 1) {
                bta_jv_pm_conn_idle(&bta_jv_cb.pm_cb[i]);
            }
@@ -478,14 +540,15 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                    tBTA_JV_PCB *p_pcb = bta_jv_rfc_port_to_pcb(bta_jv_cb.rfc_cb[hi].rfc_hdl[si]);
                    if (p_pcb) {
                        if (NULL == p_pcb->p_pm_cb) {
-                            APPL_TRACE_WARNING("%s(jv_handle:"
-                                               " 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to "
-                                               "pm_cb?", __func__, jv_handle, p_pcb->port_handle, i);
+                            APPL_TRACE_WARNING("%s(jv_handle: 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to pm_cb?",
+                                                 __func__, jv_handle, p_pcb->port_handle, i);
                        }
                        p_cb = &p_pcb->p_pm_cb;
                    }
                }
-            } else {
+            } 
+#if BTA_JV_L2CAP_INCLUDED
+            else {
                if (jv_handle < BTA_JV_MAX_L2C_CONN) {
                    tBTA_JV_L2C_CB *p_l2c_cb = &bta_jv_cb.l2c_cb[jv_handle];
                    if (NULL == p_l2c_cb->p_pm_cb) {
@@ -495,6 +558,8 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                    p_cb = &p_l2c_cb->p_pm_cb;
                }
            }
+#endif /* BTA_JV_L2CAP_INCLUDED */
+
            if (p_cb) {
                *p_cb = NULL;
                status = BTA_JV_SUCCESS;
@@ -537,7 +602,9 @@ static tBTA_JV_PM_CB *bta_jv_alloc_set_pm_profile_cb(UINT32 jv_handle, tBTA_JV_P
                        break;
                    }
                }
-            } else {
+            }
+#if BTA_JV_L2CAP_INCLUDED
+            else {
                /* use jv handle for l2cap bd address retrieval */
                for (j = 0; j < BTA_JV_MAX_L2C_CONN; j++) {
                    if (jv_handle == bta_jv_cb.l2c_cb[j].handle) {
@@ -552,6 +619,7 @@ static tBTA_JV_PM_CB *bta_jv_alloc_set_pm_profile_cb(UINT32 jv_handle, tBTA_JV_P
                    }
                }
            }
+#endif /* BTA_JV_L2CAP_INCLUDED */
            APPL_TRACE_API("bta_jv_alloc_set_pm_profile_cb(handle 0x%2x, app_id %d): "
                           "idx: %d, (BTA_JV_PM_MAX_NUM: %d), pp_cb: %p", jv_handle, app_id,
                           i, BTA_JV_PM_MAX_NUM, (void *)pp_cb);
@@ -634,7 +702,6 @@ BOOLEAN bta_jv_check_psm(UINT16 psm)
        }
    }
    return ret;
-
 }

 /*******************************************************************************
@@ -673,7 +740,12 @@ void bta_jv_enable(tBTA_JV_MSG *p_data)
 *******************************************************************************/
 void bta_jv_disable (tBTA_JV_MSG *p_data)
 {
-    UNUSED(p_data);
+    tBTA_JV_STATUS evt_data;
+    evt_data = BTA_JV_SUCCESS;
+    // UNUSED(p_data);
+    if (p_data->disable.p_cback) {
+        p_data->disable.p_cback(BTA_JV_DISABLE_EVT, (tBTA_JV *)&evt_data, NULL);
+    }
 }


@@ -782,7 +854,16 @@ void bta_jv_get_channel_id(tBTA_JV_MSG *p_data)
 *******************************************************************************/
 void bta_jv_free_scn(tBTA_JV_MSG *p_data)
 {
-    UINT16   scn = p_data->free_channel.scn;
+    tBTA_JV_API_FREE_CHANNEL *fc = &(p_data->free_channel);
+    UINT16   scn = fc->scn;
+    tBTA_JV_FREE_SCN evt_data = {
+        .status = BTA_JV_SUCCESS,
+        .server_status = BTA_JV_SERVER_STATUS_MAX,
+    };
+
+    tBTA_JV_FREE_SCN_USER_DATA *user_data = NULL;
+    tBTA_JV_RFC_CB *p_cb = NULL;
+    tBTA_JV_PCB *p_pcb = NULL;

    switch (p_data->free_channel.type) {
    case BTA_JV_CONN_TYPE_RFCOMM: {
@@ -802,6 +883,19 @@ void bta_jv_free_scn(tBTA_JV_MSG *p_data)
    default:
        break;
    }
+
+    if (fc->user_data) {
+        user_data = (tBTA_JV_FREE_SCN_USER_DATA *)fc->user_data;
+        evt_data.server_status = user_data->server_status;
+        if (user_data->server_status == BTA_JV_SERVER_RUNNING && find_rfc_pcb((void *)user_data->slot_id, &p_cb, &p_pcb)) {
+            /* if call bta_jv_rfcomm_stop_server successfully, find_rfc_pcb shall return false */
+            evt_data.status = BTA_JV_FAILURE;
+        }
+
+        if (fc->p_cback) {
+            fc->p_cback(BTA_JV_FREE_SCN_EVT, (tBTA_JV *)&evt_data, (void *)user_data);
+        }
+    }
 }
 static inline tBT_UUID shorten_sdp_uuid(const tBT_UUID *u)
 {
@@ -1092,6 +1186,7 @@ void bta_jv_delete_record(tBTA_JV_MSG *p_data)
    }
 }

+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function     bta_jv_l2cap_client_cback
@@ -1517,6 +1612,7 @@ void bta_jv_l2cap_write_fixed(tBTA_JV_MSG *p_data)

    ls->p_cback(BTA_JV_L2CAP_WRITE_FIXED_EVT, (tBTA_JV *)&evt_data, ls->user_data);
 }
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /*******************************************************************************
 **
@@ -1596,6 +1692,7 @@ static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle)
        evt_data.rfc_close.async = TRUE;
        if (p_pcb->state == BTA_JV_ST_CL_CLOSING) {
            evt_data.rfc_close.async = FALSE;
+            evt_data.rfc_close.status = BTA_JV_SUCCESS;
        }
        //p_pcb->state = BTA_JV_ST_NONE;
        //p_pcb->cong = FALSE;
@@ -1760,9 +1857,10 @@ void bta_jv_rfcomm_close(tBTA_JV_MSG *p_data)
    tBTA_JV_API_RFCOMM_CLOSE *cc = &(p_data->rfcomm_close);
    tBTA_JV_RFC_CB           *p_cb = NULL;
    tBTA_JV_PCB              *p_pcb = NULL;
-    APPL_TRACE_DEBUG("bta_jv_rfcomm_close, rfc handle:%d", cc->handle);
+    tBTA_JV                   evt_data;
+    APPL_TRACE_DEBUG("%s, rfc handle:%d",__func__, cc->handle);
    if (!cc->handle) {
-        APPL_TRACE_ERROR("bta_jv_rfcomm_close, rfc handle is null");
+        APPL_TRACE_ERROR("%s, rfc handle is null", __func__);
        return;
    }

@@ -1770,9 +1868,21 @@ void bta_jv_rfcomm_close(tBTA_JV_MSG *p_data)
    if (!find_rfc_pcb(user_data, &p_cb, &p_pcb)) {
        return;
    }
+    if(cc->p_cback) {
+        evt_data.rfc_close.status = BTA_JV_SUCCESS;
+        evt_data.rfc_close.port_status = PORT_LOCAL_CLOSED;
+        evt_data.rfc_close.handle = cc->handle;
+        evt_data.rfc_close.async = TRUE;
+        if (p_pcb && (p_pcb->state == BTA_JV_ST_SR_LISTEN ||
+                      p_pcb->state == BTA_JV_ST_SR_OPEN ||
+                      p_pcb->state == BTA_JV_ST_CL_OPEN ||
+                      p_pcb->state == BTA_JV_ST_CL_OPENING)) {
+            evt_data.rfc_close.async = FALSE;
+        }
+        cc->p_cback(BTA_JV_RFCOMM_CLOSE_EVT, (tBTA_JV *)&evt_data, user_data);
+    }
    bta_jv_free_rfc_cb(p_cb, p_pcb);
-    APPL_TRACE_DEBUG("bta_jv_rfcomm_close: sec id in use:%d, rfc_cb in use:%d",
-                     get_sec_id_used(), get_rfc_cb_used());
+    APPL_TRACE_DEBUG("%s: sec id in use:%d, rfc_cb in use:%d", __func__, get_sec_id_used(), get_rfc_cb_used());
 }

 /*******************************************************************************
@@ -1976,6 +2086,8 @@ static tBTA_JV_PCB *bta_jv_add_rfc_port(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pcb
                                 p_pcb->handle, p_cb->curr_sess);
            }
        } else {
+            /* avoid p_pcb always points to the last element of rfc_hdl */
+            p_pcb = p_pcb_open;
            APPL_TRACE_ERROR("bta_jv_add_rfc_port, cannot create new rfc listen port");
        }
    }
@@ -2146,16 +2258,16 @@ void bta_jv_rfcomm_write(tBTA_JV_MSG *p_data)
    evt_data.status = BTA_JV_FAILURE;
    evt_data.handle = p_pcb->handle;
    evt_data.req_id = wc->req_id;
-    evt_data.cong   = p_pcb->cong;
+    evt_data.old_cong = p_pcb->cong;
    bta_jv_pm_conn_busy(p_pcb->p_pm_cb);
-    evt_data.len = wc->len;
-    if (!evt_data.cong &&
+    evt_data.len = -1;
+    if (!evt_data.old_cong &&
            PORT_WriteDataCO(p_pcb->port_handle, &evt_data.len, wc->len, wc->p_data) ==
            PORT_SUCCESS) {
        evt_data.status = BTA_JV_SUCCESS;
    }
    // update congestion flag
-    evt_data.cong   = p_pcb->cong;
+    evt_data.cong = p_pcb->cong;
    if (p_cb->p_cback) {
        p_cb->p_cback(BTA_JV_RFCOMM_WRITE_EVT, (tBTA_JV *)&evt_data, p_pcb->user_data);
    } else {
@@ -2164,6 +2276,24 @@ void bta_jv_rfcomm_write(tBTA_JV_MSG *p_data)

 }

+
+/*******************************************************************************
+**
+** Function     bta_jv_rfcomm_flow_control
+**
+** Description  give credits to the peer
+**
+** Returns      void
+**
+*******************************************************************************/
+void bta_jv_rfcomm_flow_control(tBTA_JV_MSG *p_data)
+{
+    tBTA_JV_API_RFCOMM_FLOW_CONTROL *fc = &(p_data->rfcomm_fc);
+
+    tBTA_JV_PCB *p_pcb = fc->p_pcb;
+    PORT_FlowControl_GiveCredit(p_pcb->port_handle, TRUE, fc->credits_given);
+}
+
 /*******************************************************************************
 **
 ** Function     bta_jv_set_pm_profile
@@ -2351,7 +2481,7 @@ static void bta_jv_pm_state_change(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE
 }
 /**********************************************************************************************/

-
+#if BTA_JV_L2CAP_INCLUDED
 static struct fc_channel *fcchan_get(uint16_t chan, char create)
 {
    struct fc_channel *t = fc_channels;
@@ -2791,6 +2921,6 @@ extern void bta_jv_l2cap_close_fixed (tBTA_JV_MSG *p_data)
        fcclient_free(t);
    }
 }
-
+#endif /* BTA_JV_L2CAP_INCLUDED */

 #endif  ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE
--- a/components/bt/bluedroid/bta/jv/bta_jv_api.c
+++ b/components/bt/bluedroid/bta/jv/bta_jv_api.c
@@ -69,6 +69,16 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback)
    int i;

    APPL_TRACE_API( "BTA_JvEnable");
+
+#if BTA_DYNAMIC_MEMORY == TRUE
+    /* Malloc buffer for JV configuration structure */
+    p_bta_jv_cfg->p_sdp_raw_data = (UINT8 *)osi_malloc(p_bta_jv_cfg->sdp_raw_size);
+    p_bta_jv_cfg->p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_jv_cfg->sdp_db_size);
+    if (p_bta_jv_cfg->p_sdp_raw_data == NULL || p_bta_jv_cfg->p_sdp_db == NULL) {
+        return BTA_JV_NO_DATA;
+    }
+#endif
+
    if (p_cback && FALSE == bta_sys_is_register(BTA_ID_JV)) {
        memset(&bta_jv_cb, 0, sizeof(tBTA_JV_CB));
        /* set handle to invalid value by default */
@@ -85,8 +95,11 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback)
            bta_sys_sendmsg(p_buf);
            status = BTA_JV_SUCCESS;
        }
+    } else if (p_cback == NULL) {
+        APPL_TRACE_ERROR("No p_cback.");
    } else {
-        APPL_TRACE_ERROR("JVenable fails");
+        APPL_TRACE_WARNING("No need to Init again.");
+        // status = BTA_JV_SUCCESS;
    }
    return (status);
 }
@@ -100,18 +113,39 @@ tBTA_JV_STATUS BTA_JvEnable(tBTA_JV_DM_CBACK *p_cback)
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_JvDisable(void)
+void BTA_JvDisable(tBTA_JV_RFCOMM_CBACK *p_cback)
 {
-    BT_HDR  *p_buf;
+    tBTA_JV_API_DISABLE *p_buf;

    APPL_TRACE_API( "BTA_JvDisable");
    bta_sys_deregister(BTA_ID_JV);
-    if ((p_buf = (BT_HDR *) osi_malloc(sizeof(BT_HDR))) != NULL) {
-        p_buf->event = BTA_JV_API_DISABLE_EVT;
+    if ((p_buf = (tBTA_JV_API_DISABLE *) osi_malloc(sizeof(tBTA_JV_API_DISABLE))) != NULL) {
+        p_buf->hdr.event = BTA_JV_API_DISABLE_EVT;
+        p_buf->p_cback = p_cback;
        bta_sys_sendmsg(p_buf);
    }
 }

+/*******************************************************************************
+**
+** Function         BTA_JvFree
+**
+** Description      Free JV configuration
+**
+** Returns          void
+**
+*******************************************************************************/
+void BTA_JvFree(void)
+{
+#if BTA_DYNAMIC_MEMORY == TRUE
+    /* Free buffer for JV configuration structure */
+    osi_free(p_bta_jv_cfg->p_sdp_raw_data);
+    osi_free(p_bta_jv_cfg->p_sdp_db);
+    p_bta_jv_cfg->p_sdp_raw_data = NULL;
+    p_bta_jv_cfg->p_sdp_db = NULL;
+#endif
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_JvIsEnable
@@ -199,12 +233,14 @@ tBTA_JV_STATUS BTA_JvGetChannelId(int conn_type, void *user_data, INT32 channel)
 ** Parameters
 **   channel        The channel to free
 **   conn_type      one of BTA_JV_CONN_TYPE_
+**   p_cback        tBTA_JV_RFCOMM_CBACK is called with when server
+**   user_data      indicate the RFCOMM server status
 **
 ** Returns          BTA_JV_SUCCESS, if the request is being processed.
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type)
+tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data)
 {
    tBTA_JV_STATUS status = BTA_JV_FAILURE;
    tBTA_JV_API_FREE_CHANNEL *p_msg;
@@ -214,6 +250,8 @@ tBTA_JV_STATUS BTA_JvFreeChannel(UINT16 channel, int conn_type)
        p_msg->hdr.event = BTA_JV_API_FREE_SCN_EVT;
        p_msg->scn       = channel;
        p_msg->type      = conn_type;
+        p_msg->p_cback   = p_cback;
+        p_msg->user_data = user_data;
        bta_sys_sendmsg(p_msg);
        status = BTA_JV_SUCCESS;
    }
@@ -310,6 +348,7 @@ tBTA_JV_STATUS BTA_JvDeleteRecord(UINT32 handle)
    return (status);
 }

+#if BTA_JV_L2CAP_INCLUDED
 /*******************************************************************************
 **
 ** Function         BTA_JvL2capConnectLE
@@ -823,6 +862,7 @@ tBTA_JV_STATUS BTA_JvL2capWriteFixed(UINT16 channel, BD_ADDR *addr, UINT32 req_i

    return (status);
 }
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /*******************************************************************************
 **
@@ -868,19 +908,20 @@ tBTA_JV_STATUS BTA_JvRfcommConnect(tBTA_SEC sec_mask,
 ** Function         BTA_JvRfcommClose
 **
 ** Description      This function closes an RFCOMM connection
-**
+**                  When the connection is established or failed,
+**                  tBTA_JV_RFCOMM_CBACK is called with BTA_JV_RFCOMM_CLOSE_EVT
 ** Returns          BTA_JV_SUCCESS, if the request is being processed.
 **                  BTA_JV_FAILURE, otherwise.
 **
 *******************************************************************************/
-tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data)
+tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, tBTA_JV_RFCOMM_CBACK *p_cback, void *user_data)
 {
    tBTA_JV_STATUS status = BTA_JV_FAILURE;
    tBTA_JV_API_RFCOMM_CLOSE *p_msg;
    UINT32  hi = ((handle & BTA_JV_RFC_HDL_MASK) & ~BTA_JV_RFCOMM_MASK) - 1;
    UINT32  si = BTA_JV_RFC_HDL_TO_SIDX(handle);

-    APPL_TRACE_API( "BTA_JvRfcommClose");
+    APPL_TRACE_API( "%s", __func__);
    if (hi < BTA_JV_MAX_RFC_CONN && bta_jv_cb.rfc_cb[hi].p_cback &&
            si < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si] &&
            (p_msg = (tBTA_JV_API_RFCOMM_CLOSE *)osi_malloc(sizeof(tBTA_JV_API_RFCOMM_CLOSE))) != NULL) {
@@ -888,6 +929,7 @@ tBTA_JV_STATUS BTA_JvRfcommClose(UINT32 handle, void *user_data)
        p_msg->handle = handle;
        p_msg->p_cb = &bta_jv_cb.rfc_cb[hi];
        p_msg->p_pcb = &bta_jv_cb.port_cb[p_msg->p_cb->rfc_hdl[si] - 1];
+        p_msg->p_cback = p_cback;
        p_msg->user_data = user_data;
        bta_sys_sendmsg(p_msg);
        status = BTA_JV_SUCCESS;
@@ -1095,6 +1137,38 @@ tBTA_JV_STATUS BTA_JvRfcommWrite(UINT32 handle, UINT32 req_id, int len, UINT8 *p
    return (status);
 }

+/*******************************************************************************
+**
+** Function         BTA_JvRfcommFlowControl
+**
+** Description      This function gives credits to the peer
+**
+** Returns          BTA_JV_SUCCESS, if the request is being processed.
+**                  BTA_JV_FAILURE, otherwise.
+**
+*******************************************************************************/
+tBTA_JV_STATUS BTA_JvRfcommFlowControl(UINT32 handle, UINT16 credits_given)
+{
+    tBTA_JV_STATUS status = BTA_JV_FAILURE;
+    tBTA_JV_API_RFCOMM_FLOW_CONTROL *p_msg;
+    UINT32  hi = ((handle & BTA_JV_RFC_HDL_MASK) & ~BTA_JV_RFCOMM_MASK) - 1;
+    UINT32  si = BTA_JV_RFC_HDL_TO_SIDX(handle);
+
+    APPL_TRACE_API( "BTA_JvRfcommFlowControl");
+    APPL_TRACE_DEBUG( "handle:0x%x, hi:%d, si:%d", handle, hi, si);
+    if (hi < BTA_JV_MAX_RFC_CONN && bta_jv_cb.rfc_cb[hi].p_cback &&
+            si < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si] &&
+            (p_msg = (tBTA_JV_API_RFCOMM_FLOW_CONTROL *)osi_malloc(sizeof(tBTA_JV_API_RFCOMM_FLOW_CONTROL))) != NULL) {
+        p_msg->hdr.event = BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT;
+        p_msg->p_cb = &bta_jv_cb.rfc_cb[hi];
+        p_msg->p_pcb = &bta_jv_cb.port_cb[p_msg->p_cb->rfc_hdl[si] - 1];
+        p_msg->credits_given = credits_given;
+        APPL_TRACE_API( "credits given %d", credits_given);
+        bta_sys_sendmsg(p_msg);
+        status = BTA_JV_SUCCESS;
+    }
+    return (status);
+}

 /*******************************************************************************
 **
--- a/components/bt/bluedroid/bta/jv/bta_jv_cfg.c
+++ b/components/bt/bluedroid/bta/jv/bta_jv_cfg.c
@@ -43,15 +43,22 @@
 * between BTA_JvEnable and BTA_JvDisable
 * p_bta_jv_cfg->p_sdp_raw_data can be allocated before calling BTA_JvStartDiscovery
 * it can be de-allocated after the last call to access the database */
+#if BTA_DYNAMIC_MEMORY == FALSE
 static UINT8 bta_jv_sdp_raw_data[BTA_JV_SDP_RAW_DATA_SIZE];
 static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE];
+#endif

 /* JV configuration structure */
-const tBTA_JV_CFG bta_jv_cfg = {
-    BTA_JV_SDP_RAW_DATA_SIZE,   /* The size of p_sdp_raw_data */
-    BTA_JV_SDP_DB_SIZE,         /* The size of p_sdp_db_data */
-    bta_jv_sdp_raw_data,        /* The data buffer to keep raw data */
+/* const */ tBTA_JV_CFG bta_jv_cfg = {
+    BTA_JV_SDP_RAW_DATA_SIZE, /* The size of p_sdp_raw_data */
+    BTA_JV_SDP_DB_SIZE,       /* The size of p_sdp_db_data */
+#if BTA_DYNAMIC_MEMORY == FALSE
+    bta_jv_sdp_raw_data,                    /* The data buffer to keep raw data */
    (tSDP_DISCOVERY_DB *)bta_jv_sdp_db_data /* The data buffer to keep SDP database */
+#else
+    NULL,
+    NULL
+#endif
 };

 tBTA_JV_CFG *p_bta_jv_cfg = (tBTA_JV_CFG *) &bta_jv_cfg;
--- a/components/bt/bluedroid/bta/jv/bta_jv_main.c
+++ b/components/bt/bluedroid/bta/jv/bta_jv_main.c
@@ -35,6 +35,8 @@

 #if BTA_DYNAMIC_MEMORY == FALSE
 tBTA_JV_CB bta_jv_cb;
+#else
+tBTA_JV_CB *bta_jv_cb_ptr;
 #endif

 /* state machine action enumeration list */
@@ -52,25 +54,30 @@ const tBTA_JV_ACTION bta_jv_action[] = {
    bta_jv_start_discovery,         /* BTA_JV_API_START_DISCOVERY_EVT */
    bta_jv_create_record,           /* BTA_JV_API_CREATE_RECORD_EVT */
    bta_jv_delete_record,           /* BTA_JV_API_DELETE_RECORD_EVT */
+#if BTA_JV_L2CAP_INCLUDED
    bta_jv_l2cap_connect,           /* BTA_JV_API_L2CAP_CONNECT_EVT */
    bta_jv_l2cap_close,             /* BTA_JV_API_L2CAP_CLOSE_EVT */
    bta_jv_l2cap_start_server,      /* BTA_JV_API_L2CAP_START_SERVER_EVT */
    bta_jv_l2cap_stop_server,       /* BTA_JV_API_L2CAP_STOP_SERVER_EVT */
    bta_jv_l2cap_read,              /* BTA_JV_API_L2CAP_READ_EVT */
    bta_jv_l2cap_write,             /* BTA_JV_API_L2CAP_WRITE_EVT */
+#endif /* BTA_JV_L2CAP_INCLUDED */
    bta_jv_rfcomm_connect,          /* BTA_JV_API_RFCOMM_CONNECT_EVT */
    bta_jv_rfcomm_close,            /* BTA_JV_API_RFCOMM_CLOSE_EVT */
    bta_jv_rfcomm_start_server,     /* BTA_JV_API_RFCOMM_START_SERVER_EVT */
    bta_jv_rfcomm_stop_server,      /* BTA_JV_API_RFCOMM_STOP_SERVER_EVT */
    bta_jv_rfcomm_read,             /* BTA_JV_API_RFCOMM_READ_EVT */
    bta_jv_rfcomm_write,            /* BTA_JV_API_RFCOMM_WRITE_EVT */
+    bta_jv_rfcomm_flow_control,     /* BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT */
    bta_jv_set_pm_profile,          /* BTA_JV_API_SET_PM_PROFILE_EVT */
    bta_jv_change_pm_state,         /* BTA_JV_API_PM_STATE_CHANGE_EVT */
+#if BTA_JV_L2CAP_INCLUDED
    bta_jv_l2cap_connect_le,        /* BTA_JV_API_L2CAP_CONNECT_LE_EVT */
    bta_jv_l2cap_start_server_le,   /* BTA_JV_API_L2CAP_START_SERVER_LE_EVT */
    bta_jv_l2cap_stop_server_le,    /* BTA_JV_API_L2CAP_STOP_SERVER_LE_EVT */
    bta_jv_l2cap_write_fixed,       /* BTA_JV_API_L2CAP_WRITE_FIXED_EVT */
    bta_jv_l2cap_close_fixed,       /*  BTA_JV_API_L2CAP_CLOSE_FIXED_EVT */
+#endif /* BTA_JV_L2CAP_INCLUDED */
 };

 /*******************************************************************************
--- a/components/bt/bluedroid/bta/jv/include/bta_jv_int.h
+++ b/components/bt/bluedroid/bta/jv/include/bta_jv_int.h
@@ -48,25 +48,30 @@ enum {
    BTA_JV_API_START_DISCOVERY_EVT,
    BTA_JV_API_CREATE_RECORD_EVT,
    BTA_JV_API_DELETE_RECORD_EVT,
+#if BTA_JV_L2CAP_INCLUDED
    BTA_JV_API_L2CAP_CONNECT_EVT,
    BTA_JV_API_L2CAP_CLOSE_EVT,
    BTA_JV_API_L2CAP_START_SERVER_EVT,
    BTA_JV_API_L2CAP_STOP_SERVER_EVT,
    BTA_JV_API_L2CAP_READ_EVT,
    BTA_JV_API_L2CAP_WRITE_EVT,
+#endif /* BTA_JV_L2CAP_INCLUDED */
    BTA_JV_API_RFCOMM_CONNECT_EVT,
    BTA_JV_API_RFCOMM_CLOSE_EVT,
    BTA_JV_API_RFCOMM_START_SERVER_EVT,
    BTA_JV_API_RFCOMM_STOP_SERVER_EVT,
    BTA_JV_API_RFCOMM_READ_EVT,
    BTA_JV_API_RFCOMM_WRITE_EVT,
+    BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT,
    BTA_JV_API_SET_PM_PROFILE_EVT,
    BTA_JV_API_PM_STATE_CHANGE_EVT,
+#if BTA_JV_L2CAP_INCLUDED
    BTA_JV_API_L2CAP_CONNECT_LE_EVT,
    BTA_JV_API_L2CAP_START_SERVER_LE_EVT,
    BTA_JV_API_L2CAP_STOP_SERVER_LE_EVT,
    BTA_JV_API_L2CAP_WRITE_FIXED_EVT,
    BTA_JV_API_L2CAP_CLOSE_FIXED_EVT,
+#endif /* BTA_JV_L2CAP_INCLUDED */
    BTA_JV_MAX_INT_EVT
 };

@@ -80,6 +85,12 @@ typedef struct {
    tBTA_JV_DM_CBACK   *p_cback;
 } tBTA_JV_API_ENABLE;

+/* data type for BTA_JV_API_DISABLE_EVT */
+typedef struct {
+    BT_HDR          hdr;
+    tBTA_JV_RFCOMM_CBACK   *p_cback;
+} tBTA_JV_API_DISABLE;
+
 /* data type for BTA_JV_API_START_DISCOVERY_EVT */
 typedef struct {
    BT_HDR      hdr;
@@ -115,6 +126,8 @@ enum {
    BTA_JV_ST_SR_CLOSING
 } ;
 typedef UINT8  tBTA_JV_STATE;
+
+#if BTA_JV_L2CAP_INCLUDED
 #define BTA_JV_ST_CL_MAX    BTA_JV_ST_CL_CLOSING
 /* JV L2CAP control block */
 typedef struct {
@@ -127,6 +140,7 @@ typedef struct {
    tBTA_JV_PM_CB      *p_pm_cb;    /* ptr to pm control block, NULL: unused */
    void                *user_data; /* user data for callback from higher layers */
 } tBTA_JV_L2C_CB;
+#endif /* BTA_JV_L2CAP_INCLUDED */

 #define BTA_JV_RFC_HDL_MASK         0xFF
 #define BTA_JV_RFCOMM_MASK          0x80
@@ -156,6 +170,7 @@ typedef struct {
    int                 curr_sess;   /* current sessions count*/
 } tBTA_JV_RFC_CB;

+#if BTA_JV_L2CAP_INCLUDED
 /* data type for BTA_JV_API_L2CAP_CONNECT_EVT & BTA_JV_API_L2CAP_CONNECT_LE_EVT */
 typedef struct {
    BT_HDR              hdr;
@@ -233,6 +248,7 @@ typedef struct {
    UINT16              len;
    void                *user_data;
 } tBTA_JV_API_L2CAP_WRITE_FIXED;
+#endif /* BTA_JV_L2CAP_INCLUDED */

 /* data type for BTA_JV_API_RFCOMM_CONNECT_EVT */
 typedef struct {
@@ -294,12 +310,21 @@ typedef struct {
    tBTA_JV_PCB     *p_pcb;
 } tBTA_JV_API_RFCOMM_WRITE;

+/* data type for BTA_JV_API_RFCOMM_FLOW_CONTROL_EVT */
+typedef struct {
+    BT_HDR      hdr;
+    tBTA_JV_RFC_CB  *p_cb;
+    tBTA_JV_PCB     *p_pcb;
+    UINT16      credits_given;
+} tBTA_JV_API_RFCOMM_FLOW_CONTROL;
+
 /* data type for BTA_JV_API_RFCOMM_CLOSE_EVT */
 typedef struct {
    BT_HDR          hdr;
    UINT32          handle;
    tBTA_JV_RFC_CB  *p_cb;
    tBTA_JV_PCB     *p_pcb;
+    tBTA_JV_RFCOMM_CBACK *p_cback;
    void            *user_data;
 } tBTA_JV_API_RFCOMM_CLOSE;

@@ -326,6 +351,8 @@ typedef struct {
    BT_HDR      hdr;
    INT32       type;       /* One of BTA_JV_CONN_TYPE_ */
    UINT16      scn;
+    tBTA_JV_RFCOMM_CBACK *p_cback;
+    void        *user_data;
 } tBTA_JV_API_FREE_CHANNEL;

 /* data type for BTA_JV_API_ALLOC_CHANNEL_EVT */
@@ -340,24 +367,28 @@ typedef union {
    /* GKI event buffer header */
    BT_HDR                          hdr;
    tBTA_JV_API_ENABLE              enable;
+    tBTA_JV_API_DISABLE             disable;
    tBTA_JV_API_START_DISCOVERY     start_discovery;
    tBTA_JV_API_ALLOC_CHANNEL       alloc_channel;
    tBTA_JV_API_FREE_CHANNEL        free_channel;
    tBTA_JV_API_CREATE_RECORD       create_record;
    tBTA_JV_API_ADD_ATTRIBUTE       add_attr;
+#if BTA_JV_L2CAP_INCLUDED
    tBTA_JV_API_L2CAP_CONNECT       l2cap_connect;
    tBTA_JV_API_L2CAP_READ          l2cap_read;
    tBTA_JV_API_L2CAP_WRITE         l2cap_write;
    tBTA_JV_API_L2CAP_CLOSE         l2cap_close;
    tBTA_JV_API_L2CAP_SERVER        l2cap_server;
+    tBTA_JV_API_L2CAP_WRITE_FIXED   l2cap_write_fixed;
+#endif /* BTA_JV_L2CAP_INCLUDED */
    tBTA_JV_API_RFCOMM_CONNECT      rfcomm_connect;
    tBTA_JV_API_RFCOMM_READ         rfcomm_read;
    tBTA_JV_API_RFCOMM_WRITE        rfcomm_write;
+    tBTA_JV_API_RFCOMM_FLOW_CONTROL rfcomm_fc;
    tBTA_JV_API_SET_PM_PROFILE      set_pm;
    tBTA_JV_API_PM_STATE_CHANGE     change_pm_state;
    tBTA_JV_API_RFCOMM_CLOSE        rfcomm_close;
    tBTA_JV_API_RFCOMM_SERVER       rfcomm_server;
-    tBTA_JV_API_L2CAP_WRITE_FIXED   l2cap_write_fixed;
 } tBTA_JV_MSG;

 /* JV control block */
@@ -368,7 +399,9 @@ typedef struct {
    UINT32                  sdp_handle[BTA_JV_MAX_SDP_REC]; /* SDP records created */
    UINT8                   *p_sel_raw_data;/* the raw data of last service select */
    tBTA_JV_DM_CBACK        *p_dm_cback;
+#if BTA_JV_L2CAP_INCLUDED
    tBTA_JV_L2C_CB          l2c_cb[BTA_JV_MAX_L2C_CONN];    /* index is GAP handle (index) */
+#endif /* BTA_JV_L2CAP_INCLUDED */
    tBTA_JV_RFC_CB          rfc_cb[BTA_JV_MAX_RFC_CONN];
    tBTA_JV_PCB             port_cb[MAX_RFC_PORTS];         /* index of this array is
                                                               the port_handle, */
@@ -407,25 +440,29 @@ extern void bta_jv_free_scn (tBTA_JV_MSG *p_data);
 extern void bta_jv_start_discovery (tBTA_JV_MSG *p_data);
 extern void bta_jv_create_record (tBTA_JV_MSG *p_data);
 extern void bta_jv_delete_record (tBTA_JV_MSG *p_data);
+#if BTA_JV_L2CAP_INCLUDED
 extern void bta_jv_l2cap_connect (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_close (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_start_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_stop_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_read (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_write (tBTA_JV_MSG *p_data);
+#endif /* BTA_JV_L2CAP_INCLUDED */
 extern void bta_jv_rfcomm_connect (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_close (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_start_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_stop_server (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_read (tBTA_JV_MSG *p_data);
 extern void bta_jv_rfcomm_write (tBTA_JV_MSG *p_data);
+extern void bta_jv_rfcomm_flow_control(tBTA_JV_MSG *p_data);
 extern void bta_jv_set_pm_profile (tBTA_JV_MSG *p_data);
 extern void bta_jv_change_pm_state(tBTA_JV_MSG *p_data);
+#if BTA_JV_L2CAP_INCLUDED
 extern void bta_jv_l2cap_connect_le (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_start_server_le (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_stop_server_le (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_write_fixed (tBTA_JV_MSG *p_data);
 extern void bta_jv_l2cap_close_fixed (tBTA_JV_MSG *p_data);
-
+#endif /* BTA_JV_L2CAP_INCLUDED */
 #endif  ///defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE
 #endif /* BTA_JV_INT_H */
--- a/components/bt/bluedroid/bta/sys/bta_sys_main.c
+++ b/components/bt/bluedroid/bta/sys/bta_sys_main.c
@@ -501,7 +501,6 @@ void bta_sys_event(BT_HDR *p_msg)
    if (freebuf) {
        osi_free(p_msg);
    }
-
 }

 /*******************************************************************************
--- a/components/bt/bluedroid/btc/core/btc_dm.c
+++ b/components/bt/bluedroid/btc/core/btc_dm.c
@@ -22,7 +22,7 @@
 #include "common/bt_target.h"
 #include "btc/btc_storage.h"
 #include "btc/btc_ble_storage.h"
-#include "esp_gap_ble_api.h"
+#include "btc_gap_ble.h"
 #include "btm_int.h"
 #include "bta/bta_api.h"
 #include "bta/bta_gatt_api.h"
@@ -304,11 +304,11 @@ static void btc_dm_link_up_evt(tBTA_DM_LINK_UP *p_link_up)
    BD_ADDR bd_addr;
    bt_bdaddr_t bt_bdaddr;

-    memcpy(bd_addr, p_link_up->bd_addr, sizeof(BD_ADDR));
-    memcpy(bt_bdaddr.address, p_link_up->bd_addr, sizeof(BD_ADDR));

    if (p_link_up->sc_downgrade == 1) {
+        memcpy(bt_bdaddr.address, p_link_up->bd_addr, sizeof(BD_ADDR));
        if (btc_storage_remove_bonded_device(&bt_bdaddr) == BT_STATUS_SUCCESS) {
+            memcpy(bd_addr, p_link_up->bd_addr, sizeof(BD_ADDR));
            if (BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS) {
                BTC_TRACE_EVENT(" %s() Bonding information removed.", __FUNCTION__);
            } else {
@@ -404,11 +404,10 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
    memcpy(param.auth_cmpl.bda, p_auth_cmpl->bd_addr, ESP_BD_ADDR_LEN);
    memcpy(param.auth_cmpl.device_name, p_auth_cmpl->bd_name, ESP_BT_GAP_MAX_BDNAME_LEN + 1);

-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);

    if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
    }

 #endif /// BTC_GAP_BT_INCLUDED == TRUE
@@ -427,11 +426,10 @@ static void btc_dm_pin_req_evt(tBTA_DM_PIN_REQ *p_pin_req)
    param.pin_req.min_16_digit = p_pin_req->min_16_digit;
    memcpy(param.pin_req.bda, p_pin_req->bd_addr, ESP_BD_ADDR_LEN);

-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);

    if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
    }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
@@ -455,11 +453,10 @@ static void btc_dm_sp_cfm_req_evt(tBTA_DM_SP_CFM_REQ *p_cfm_req)
    param.cfm_req.num_val = p_cfm_req->num_val;
    memcpy(param.cfm_req.bda, p_cfm_req->bd_addr, ESP_BD_ADDR_LEN);

-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);

    if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
    }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
@@ -476,11 +473,10 @@ static void btc_dm_sp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF *p_key_notif)
    param.key_notif.passkey = p_key_notif->passkey;
    memcpy(param.key_notif.bda, p_key_notif->bd_addr, ESP_BD_ADDR_LEN);

-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);

    if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
    }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
@@ -496,16 +492,43 @@ static void btc_dm_sp_key_req_evt(tBTA_DM_SP_KEY_REQ *p_key_req)
    msg.act = BTC_GAP_BT_KEY_REQ_EVT;
    memcpy(param.key_req.bda, p_key_req->bd_addr, ESP_BD_ADDR_LEN);

-    ret = btc_transfer_context(&msg, &param,
-                               sizeof(esp_bt_gap_cb_param_t), NULL);
+    ret = btc_inter_profile_call(&msg, &param);

    if (ret != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
    }
 #endif /// BTC_GAP_BT_INCLUDED == TRUE
 }
 #endif /// BT_SSP_INCLUDED == TRUE

+static void btc_dm_dev_unpaired_evt(tBTA_DM_LINK_DOWN *p_link_down)
+{
+    esp_bt_gap_cb_param_t param;
+    BTC_TRACE_DEBUG("%s",__func__);
+    memcpy(param.remove_bond_dev_cmpl.bda, p_link_down->bd_addr, ESP_BD_ADDR_LEN);
+    btm_set_bond_type_dev(p_link_down->bd_addr, BOND_TYPE_UNKNOWN);
+    if (p_link_down->status == HCI_SUCCESS) {
+        //remove the bonded key in the config and nvs flash.
+        param.remove_bond_dev_cmpl.status = btc_storage_remove_bonded_device((bt_bdaddr_t *)param.remove_bond_dev_cmpl.bda);
+    } else {
+        param.remove_bond_dev_cmpl.status = ESP_BT_STATUS_FAIL;
+    }
+
+#if (BTC_GAP_BT_INCLUDED == TRUE)
+    bt_status_t ret;
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_REMOVE_BOND_DEV_COMPLETE_EVT;
+
+    ret = btc_inter_profile_call(&msg, &param);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
+    }
+#endif /// BTC_GAP_BT_INCLUDED == TRUE
+}
+
 tBTA_SERVICE_MASK btc_get_enabled_services_mask(void)
 {
    return btc_enabled_services;
@@ -643,16 +666,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
 #endif ///BT_SSP_INCLUDED == TRUE

    case BTA_DM_DEV_UNPAIRED_EVT: {
-#if (SMP_INCLUDED == TRUE)
-        bt_bdaddr_t bd_addr;
-        BTC_TRACE_DEBUG("BTA_DM_DEV_UNPAIRED_EVT");
-        memcpy(bd_addr.address, p_data->link_down.bd_addr, sizeof(BD_ADDR));
-        btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
-        if (p_data->link_down.status == HCI_SUCCESS) {
-            //remove the bonded key in the config and nvs flash.
-            btc_storage_remove_bonded_device(&bd_addr);
-        }
-#endif /* #if (SMP_INCLUDED == TRUE) */
+        btc_dm_dev_unpaired_evt(&p_data->link_down);
        break;
    }
    case BTA_DM_BLE_DEV_UNPAIRED_EVT: {
@@ -685,13 +699,14 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
        break;
        }
 #endif /* BTC_GAP_BT_INCLUDED  == TRUE */
-    case BTA_DM_LINK_UP_EVT:
-        btc_dm_link_up_evt(&p_data->link_up);
    case BTA_DM_LINK_DOWN_EVT:
    case BTA_DM_HW_ERROR_EVT:
        BTC_TRACE_DEBUG( "btc_dm_sec_cback : unhandled event (%d)\n", msg->act );
        break;
-#if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
+    case BTA_DM_LINK_UP_EVT:
+        btc_dm_link_up_evt(&p_data->link_up);
+        break;
+#if ((BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
    case BTA_DM_BLE_AUTH_CMPL_EVT: {
        rsp_app = true;
        ble_msg.act = ESP_GAP_BLE_AUTH_CMPL_EVT;
@@ -854,11 +869,10 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
    }

    if (rsp_app) {
-        ret = btc_transfer_context(&ble_msg, &param,
-                                   sizeof(esp_ble_gap_cb_param_t), NULL);
+        ret = btc_inter_profile_call(&ble_msg, &param);

        if (ret != BT_STATUS_SUCCESS) {
-            BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+            BTC_TRACE_ERROR("%s btc_inter_profile_call failed\n", __func__);
        }
    }
    btc_dm_sec_arg_deep_free(msg);
--- a/components/bt/bluedroid/btc/core/btc_storage.c
+++ b/components/bt/bluedroid/btc/core/btc_storage.c
@@ -201,7 +201,6 @@ int btc_storage_get_num_bt_bond_devices(void)
        }
    }
    btc_config_unlock();
-
    return num_dev;
 }

@@ -215,15 +214,17 @@ int btc_storage_get_num_bt_bond_devices(void)
 **                  BT_STATUS_FAIL otherwise
 **
 *******************************************************************************/
-bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int dev_num)
+bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int *dev_num)
 {
    bt_bdaddr_t bd_addr;
+    int in_dev_num = *dev_num; /* buffer size */
+    int out_dev_num = 0; /* bond_dev size */

    btc_config_lock();
    for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end();
            iter = btc_config_section_next(iter)) {

-        if (dev_num-- <= 0) {
+        if (in_dev_num <= 0) {
            break;
        }

@@ -236,9 +237,12 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
            btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
            string_to_bdaddr(name, &bd_addr);
            memcpy(bond_dev, &bd_addr, sizeof(bt_bdaddr_t));
+            in_dev_num--;
+            out_dev_num++;
            bond_dev++;
        }
    }
+    *dev_num = out_dev_num; /* out_dev_num <= in_dev_num */
    btc_config_unlock();

    return BT_STATUS_SUCCESS;
--- a/components/bt/bluedroid/btc/include/btc/btc_storage.h
+++ b/components/bt/bluedroid/btc/include/btc/btc_storage.h
@@ -89,6 +89,6 @@ int btc_storage_get_num_bt_bond_devices(void);
 **                  BT_STATUS_FAIL otherwise
 **
 *******************************************************************************/
-bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int dev_num);
+bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int *dev_num);

 #endif /* BTC_STORAGE_H */
--- a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
@@ -36,8 +36,9 @@
 #include "blufi_int.h"

 #include "esp_blufi_api.h"
+#include "esp_gatt_common_api.h"

-#if (GATTS_INCLUDED == TRUE)
+#if (BLUFI_INCLUDED == TRUE)

 #define BT_BD_ADDR_STR         "%02x:%02x:%02x:%02x:%02x:%02x"
 #define BT_BD_ADDR_HEX(addr)   addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]
@@ -283,6 +284,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
        blufi_env.conn_id = p_data->conn.conn_id;
        blufi_env.is_connected = true;
+        blufi_env.recv_seq = blufi_env.send_seq = 0;

        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
@@ -305,7 +307,6 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)

        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
        blufi_env.conn_id = p_data->conn.conn_id;
-        blufi_env.is_connected = false;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
        blufi_env.sec_mode = 0x0;

@@ -456,6 +457,7 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
        }
    }
 }
+
 void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
 {
    struct blufi_hdr *hdr = NULL;
@@ -463,6 +465,11 @@ void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
    uint16_t checksum;
    int ret;

+    if (blufi_env.is_connected == false) {
+        BTC_TRACE_ERROR("blufi connection has been disconnected \n");
+        return;
+    }
+
    while (remain_len > 0) {
        if (remain_len > blufi_env.frag_size) {
            hdr = osi_malloc(sizeof(struct blufi_hdr) + 2 + blufi_env.frag_size + 2);
@@ -526,10 +533,21 @@ void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
            remain_len -= hdr->data_len;
        }

-        btc_blufi_send_notify((uint8_t *)hdr,
+retry:
+        if (blufi_env.is_connected == false) {
+            return;
+        }
+
+        if (esp_ble_get_cur_sendable_packets_num(BTC_GATT_GET_CONN_ID(blufi_env.conn_id)) > 0) {
+            btc_blufi_send_notify((uint8_t *)hdr,
                ((hdr->fc & BLUFI_FC_CHECK) ?
                 hdr->data_len + sizeof(struct blufi_hdr) + 2 :
                 hdr->data_len + sizeof(struct blufi_hdr)));
+        } else {
+            BTC_TRACE_WARNING("%s wait to send blufi custom data\n", __func__);
+            vTaskDelay(pdMS_TO_TICKS(10));
+            goto retry;
+        }

        osi_free(hdr);
        hdr =  NULL;
@@ -1117,4 +1135,4 @@ uint16_t btc_blufi_get_version(void)
    return BTC_BLUFI_VERSION;
 }

-#endif	///GATTS_INCLUDED == TRUE
+#endif  ///BLUFI_INCLUDED == TRUE
--- a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c
@@ -35,7 +35,7 @@

 //#include "esp_wifi.h"

-#if (GATTS_INCLUDED == TRUE)
+#if (BLUFI_INCLUDED == TRUE)
 extern tBLUFI_ENV blufi_env;

 void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
@@ -269,4 +269,5 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
    }
 }

-#endif	///(GATTS_INCLUDED == TRUE)
+#endif  ///BLUFI_INCLUDED == TRUE
+
--- a/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
@@ -15,6 +15,7 @@
 #ifndef __BLUFI_INT_H__
 #define __BLUFI_INT_H__

+#if (BLUFI_INCLUDED == TRUE)
 #define BTC_BLUFI_GREAT_VER   0x01  //Version + Subversion
 #define BTC_BLUFI_SUB_VER     0x02  //Version + Subversion
 #define BTC_BLUFI_VERSION     ((BTC_BLUFI_GREAT_VER<<8)|BTC_BLUFI_SUB_VER)  //Version + Subversion
@@ -184,3 +185,4 @@ void btc_blufi_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 void btc_blufi_cb_deep_free(btc_msg_t *msg);

 #endif /* __BLUFI_INT_H__ */
+#endif  ///BLUFI_INCLUDED == TRUE
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp.c
@@ -38,7 +38,7 @@
 *******************************************************************************/
 void btc_a2dp_on_init(void)
 {
-    //tput_mon(1, 0, 1);
+    BTC_TRACE_EVENT("A2DP Initialized.");
 }

 /*****************************************************************************
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c
@@ -127,12 +127,16 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
    switch (ctrl) {
    case ESP_A2D_MEDIA_CTRL_CHECK_SRC_RDY:
 #if BTC_AV_SRC_INCLUDED
-        if (btc_a2dp_source_is_task_shutting_down()) {
-            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
-        } else if ((btc_av_stream_ready() == TRUE) ||
-                   (btc_av_stream_started_ready() == TRUE)) {
-            /* check whether av is ready to setup a2dp datapath */
-            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+        if (btc_av_get_service_id() == BTA_A2DP_SOURCE_SERVICE_ID) {
+            if (btc_a2dp_source_is_task_shutting_down()) {
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
+            } else if ((btc_av_stream_ready() == TRUE) ||
+                    (btc_av_stream_started_ready() == TRUE)) {
+                /* check whether av is ready to setup a2dp datapath */
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+            } else {
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
+            }
        } else {
            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
        }
@@ -159,6 +163,10 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
        }
        break;
    case ESP_A2D_MEDIA_CTRL_STOP:
+        if (btc_av_is_connected() == FALSE) {
+            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
+            break;
+        }
 #if BTC_AV_SRC_INCLUDED
        if (btc_av_get_peer_sep() == AVDT_TSEP_SNK && !btc_a2dp_source_is_streaming() &&
                btc_av_get_service_id() == BTA_A2DP_SOURCE_SERVICE_ID) {
@@ -174,7 +182,6 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
        }
 #endif
        break;
-
    case ESP_A2D_MEDIA_CTRL_SUSPEND:
        /* local suspend */
        if (btc_av_stream_started_ready()) {
@@ -184,14 +191,15 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
            }
 #endif
-        } else {
+        } else if (btc_av_is_connected() == TRUE) {
            /* we are not in started state; just ack back ok. This can happen if we are
               remotely suspended; clear REMOTE SUSPEND Flag */
            btc_av_clear_remote_suspend_flag();
            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+        } else {
+            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
        }
        break;
-
    default :
        APPL_TRACE_ERROR("### A2DP-MEDIA EVENT %u NOT HANDLED ###", ctrl);
        btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c
@@ -1290,8 +1290,6 @@ BOOLEAN btc_media_aa_read_feeding(void)
    /* Read Data from data channel */
    nb_byte_read = btc_aa_src_data_read((uint8_t *)read_buffer, read_size);

-    //tput_mon(TRUE, nb_byte_read, FALSE);
-
    if (nb_byte_read < read_size) {
        APPL_TRACE_WARNING("### UNDERRUN :: ONLY READ %d BYTES OUT OF %d ###",
                           nb_byte_read, read_size);
--- a/components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c
+++ b/components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c
@@ -42,6 +42,13 @@

 #if BTC_AV_INCLUDED

+// global variable to inidcate avrc is initialized with a2dp
+bool g_av_with_rc;
+// global variable to indicate a2dp is initialized
+bool g_a2dp_on_init;
+// global variable to indicate a2dp is deinitialized
+bool g_a2dp_on_deinit;
+
 /*****************************************************************************
 **  Constants & Macros
 ******************************************************************************/
@@ -86,6 +93,10 @@ typedef struct {
    uint16_t uuid;
 } btc_av_connect_req_t;

+typedef struct {
+    bt_bdaddr_t target_bda;
+} btc_av_disconn_req_t;
+
 /*****************************************************************************
 **  Static variables
 ******************************************************************************/
@@ -284,7 +295,7 @@ static void btc_report_audio_state(esp_a2d_audio_state_t state, bt_bdaddr_t *bd_

 static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
 {
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
              dump_av_sm_event_name(event), btc_av_cb.flags);

    switch (event) {
@@ -309,20 +320,34 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
    case BTA_AV_PENDING_EVT:
    case BTC_AV_CONNECT_REQ_EVT: {
        if (event == BTC_AV_CONNECT_REQ_EVT) {
-            memcpy(&btc_av_cb.peer_bda, &((btc_av_connect_req_t *)p_data)->target_bda,
-                   sizeof(bt_bdaddr_t));
-            BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
-                       TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
+            memcpy(&btc_av_cb.peer_bda, &((btc_av_connect_req_t *)p_data)->target_bda, sizeof(bt_bdaddr_t));
+            if (g_av_with_rc) {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                        TRUE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
+            } else {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                        FALSE, BTA_SEC_AUTHENTICATE, ((btc_av_connect_req_t *)p_data)->uuid);
+            }
        } else if (event == BTA_AV_PENDING_EVT) {
            bdcpy(btc_av_cb.peer_bda.address, ((tBTA_AV *)p_data)->pend.bd_addr);
-            UINT16 uuid = (btc_av_cb.service_id == BTA_A2DP_SOURCE_SERVICE_ID) ? UUID_SERVCLASS_AUDIO_SOURCE :
-                UUID_SERVCLASS_AUDIO_SINK;
-            BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
-                       TRUE, BTA_SEC_AUTHENTICATE, uuid);
+            UINT16 uuid = (btc_av_cb.service_id == BTA_A2DP_SOURCE_SERVICE_ID) ? UUID_SERVCLASS_AUDIO_SOURCE : UUID_SERVCLASS_AUDIO_SINK;
+            if (g_av_with_rc) {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                        TRUE, BTA_SEC_AUTHENTICATE, uuid);
+            } else {
+                BTA_AvOpen(btc_av_cb.peer_bda.address, btc_av_cb.bta_handle,
+                       FALSE, BTA_SEC_AUTHENTICATE, uuid);
+            }
        }
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_OPENING);
    } break;

+
+    case BTC_AV_DISCONNECT_REQ_EVT:
+        BTC_TRACE_WARNING("No Link At All.");
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &((btc_av_disconn_req_t *)p_data)->target_bda, 0);
+        break;
+
    case BTA_AV_RC_OPEN_EVT:
        /* IOP_FIX: Jabra 620 only does RC open without AV open whenever it connects. So
         * as per the AV WP, an AVRC connection cannot exist without an AV connection. Therefore,
@@ -333,7 +358,6 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
         *
         * TODO: We may need to do this only on an AVRCP Play. FixMe
         */
-
 #if BTC_AV_SRC_INCLUDED
        BTC_TRACE_DEBUG("BTA_AV_RC_OPEN_EVT received w/o AV");
        tle_av_open_on_rc = osi_alarm_new("AVconn", btc_initiate_av_open_tmr_hdlr, NULL, BTC_TIMEOUT_AV_OPEN_ON_RC_SECS * 1000);
@@ -361,15 +385,13 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)
        break;

    default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
        return FALSE;
-
    }
-
    return TRUE;
 }
-/*****************************************************************************
+
+    /*****************************************************************************
 **
 ** Function        btc_av_state_opening_handler
 **
@@ -382,7 +404,7 @@ static BOOLEAN btc_av_state_idle_handler(btc_sm_event_t event, void *p_data)

 static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
 {
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
              dump_av_sm_event_name(event), btc_av_cb.flags);

    switch (event) {
@@ -395,35 +417,36 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
        break;

    case BTA_AV_REJECT_EVT:
-        BTC_TRACE_DEBUG(" Received  BTA_AV_REJECT_EVT \n");
+        BTC_TRACE_WARNING(" Received  BTA_AV_REJECT_EVT \n");
        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), 0);
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
        break;

    case BTA_AV_OPEN_EVT: {
        tBTA_AV *p_bta_data = (tBTA_AV *)p_data;
-        esp_a2d_connection_state_t state;
+        esp_a2d_connection_state_t conn_stat;
        btc_sm_state_t av_state;
        BTC_TRACE_DEBUG("status:%d, edr 0x%x, peer sep %d\n", p_bta_data->open.status,
                        p_bta_data->open.edr, p_bta_data->open.sep);

        if (p_bta_data->open.status == BTA_AV_SUCCESS) {
-            state = ESP_A2D_CONNECTION_STATE_CONNECTED;
-            av_state = BTC_AV_STATE_OPENED;
            btc_av_cb.edr = p_bta_data->open.edr;
-
            btc_av_cb.peer_sep = p_bta_data->open.sep;
+
+            conn_stat = ESP_A2D_CONNECTION_STATE_CONNECTED;
+            av_state = BTC_AV_STATE_OPENED;
        } else {
-            BTC_TRACE_WARNING("BTA_AV_OPEN_EVT::FAILED status: %d\n",
-                     p_bta_data->open.status );
-            state = ESP_A2D_CONNECTION_STATE_DISCONNECTED;
-            av_state  = BTC_AV_STATE_IDLE;
+            BTC_TRACE_WARNING("BTA_AV_OPEN_EVT::FAILED status: %d\n", p_bta_data->open.status );
+
+            conn_stat = ESP_A2D_CONNECTION_STATE_DISCONNECTED;
+            av_state = BTC_AV_STATE_IDLE;
        }

        /* inform the application of the event */
-        btc_report_connection_state(state, &(btc_av_cb.peer_bda), 0);
+        btc_report_connection_state(conn_stat, &(btc_av_cb.peer_bda), 0);
        /* change state to open/idle based on the status */
        btc_sm_change_state(btc_av_cb.sm_handle, av_state);
+
        if (btc_av_cb.peer_sep == AVDT_TSEP_SNK) {
            /* if queued PLAY command,  send it now */
            /* necessary to add this?
@@ -432,8 +455,12 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
            */
        } else if (btc_av_cb.peer_sep == AVDT_TSEP_SRC &&
                   (p_bta_data->open.status == BTA_AV_SUCCESS)) {
-            /* Bring up AVRCP connection too */
-            BTA_AvOpenRc(btc_av_cb.bta_handle);
+            /* Bring up AVRCP connection too if AVRC Initialized */
+            if(g_av_with_rc) {
+                BTA_AvOpenRc(btc_av_cb.bta_handle);
+            } else {
+                BTC_TRACE_WARNING("AVRC not Init, not using it.");
+            }
        }
        btc_queue_advance();
    } break;
@@ -473,11 +500,10 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)
            break;
        }

-        CHECK_RC_EVENT(event, p_data);
+    CHECK_RC_EVENT(event, p_data);

    default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
        return FALSE;

    }
@@ -498,7 +524,7 @@ static BOOLEAN btc_av_state_opening_handler(btc_sm_event_t event, void *p_data)

 static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
 {
-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
              dump_av_sm_event_name(event), btc_av_cb.flags);

    switch (event) {
@@ -539,9 +565,7 @@ static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
    case BTA_AV_CLOSE_EVT: {
        tBTA_AV_CLOSE *close = (tBTA_AV_CLOSE *)p_data;
        /* inform the application that we are disconnecting */
-        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda),
-                                    close->disc_rsn);
-
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), close->disc_rsn);
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
        break;
    }
@@ -552,14 +576,12 @@ static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
        break;

    default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
        return FALSE;
    }
    return TRUE;
 }

-
 /*****************************************************************************
 **
 ** Function     btc_av_state_opened_handler
@@ -569,12 +591,11 @@ static BOOLEAN btc_av_state_closing_handler(btc_sm_event_t event, void *p_data)
 ** Returns      TRUE if event was processed, FALSE otherwise
 **
 *******************************************************************************/
-
 static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
 {
    tBTA_AV *p_av = (tBTA_AV *)p_data;

-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+     BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
              dump_av_sm_event_name(event), btc_av_cb.flags);

    if ( (event == BTA_AV_REMOTE_CMD_EVT) && (btc_av_cb.flags & BTC_AV_FLAG_REMOTE_SUSPEND) &&
@@ -654,10 +675,9 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)

    case BTC_AV_DISCONNECT_REQ_EVT:
        BTA_AvClose(btc_av_cb.bta_handle);
-        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC) {
+        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC && g_av_with_rc == true) {
            BTA_AvCloseRc(btc_av_cb.bta_handle);
        }
-
        /* inform the application that we are disconnecting */
        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTING, &(btc_av_cb.peer_bda), 0);
        break;
@@ -665,17 +685,15 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
    case BTA_AV_CLOSE_EVT: {
        /* avdtp link is closed */
        btc_a2dp_on_stopped(NULL);
-
        tBTA_AV_CLOSE *close = (tBTA_AV_CLOSE *)p_data;
        /* inform the application that we are disconnected */
-        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda),
-                                    close->disc_rsn);
-
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), close->disc_rsn);
        /* change state to idle, send acknowledgement if start is pending */
        if (btc_av_cb.flags & BTC_AV_FLAG_PENDING_START) {
            btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_FAILURE);
            /* pending start flag will be cleared when exit current state */
        }
+        /* change state to idle, send acknowledgement if start is pending */
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
        break;
    }
@@ -703,11 +721,10 @@ static BOOLEAN btc_av_state_opened_handler(btc_sm_event_t event, void *p_data)
        btc_queue_advance();
        break;

-        CHECK_RC_EVENT(event, p_data);
+    CHECK_RC_EVENT(event, p_data);

    default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
        return FALSE;

    }
@@ -728,27 +745,22 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
 {
    tBTA_AV *p_av = (tBTA_AV *)p_data;

-    BTC_TRACE_DEBUG("%s event:%s flags %x\n", __FUNCTION__,
+    BTC_TRACE_DEBUG("%s event: %s flags %x\n", __FUNCTION__,
              dump_av_sm_event_name(event), btc_av_cb.flags);

    switch (event) {
    case BTC_SM_ENTER_EVT:
-
        /* we are again in started state, clear any remote suspend flags */
        btc_av_cb.flags &= ~BTC_AV_FLAG_REMOTE_SUSPEND;
-
        btc_report_audio_state(ESP_A2D_AUDIO_STATE_STARTED, &(btc_av_cb.peer_bda));
-
        /* increase the a2dp consumer task priority temporarily when start
        ** audio playing, to avoid overflow the audio packet queue. */
        // adjust_priority_a2dp(TRUE);
-
        break;

    case BTC_SM_EXIT_EVT:
        /* restore the a2dp consumer task priority when stop audio playing. */
        // adjust_priority_a2dp(FALSE);
-
        break;

    case BTC_AV_START_STREAM_REQ_EVT:
@@ -763,11 +775,9 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
    /* fixme -- use suspend = true always to work around issue with BTA AV */
    case BTC_AV_STOP_STREAM_REQ_EVT:
    case BTC_AV_SUSPEND_STREAM_REQ_EVT:
-
        /* set pending flag to ensure btc task is not trying to restart
           stream while suspend is in progress */
        btc_av_cb.flags |= BTC_AV_FLAG_LOCAL_SUSPEND_PENDING;
-
        /* if we were remotely suspended but suspend locally, local suspend
           always overrides */
        btc_av_cb.flags &= ~BTC_AV_FLAG_REMOTE_SUSPEND;
@@ -787,25 +797,19 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
        break;

    case BTC_AV_DISCONNECT_REQ_EVT:
-
        /* request avdtp to close */
        BTA_AvClose(btc_av_cb.bta_handle);
-        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC) {
+        if (btc_av_cb.peer_sep == AVDT_TSEP_SRC && g_av_with_rc == true) {
            BTA_AvCloseRc(btc_av_cb.bta_handle);
        }
-
        /* inform the application that we are disconnecting */
        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTING, &(btc_av_cb.peer_bda), 0);
-
        /* wait in closing state until fully closed */
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_CLOSING);
        break;

    case BTA_AV_SUSPEND_EVT:
-
-        BTC_TRACE_DEBUG("BTA_AV_SUSPEND_EVT status %d, init %d\n",
-                 p_av->suspend.status, p_av->suspend.initiator);
-
+        BTC_TRACE_DEBUG("BTA_AV_SUSPEND_EVT status %d, init %d\n", p_av->suspend.status, p_av->suspend.initiator);
        /* a2dp suspended, stop media task until resumed */
        btc_a2dp_on_suspended(&p_av->suspend);

@@ -824,7 +828,6 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
        if (p_av->suspend.initiator != TRUE) {
            /* remote suspend, notify HAL and await audioflinger to
               suspend/stop stream */
-
            /* set remote suspend flag to block media task from restarting
               stream only if we did not already initiate a local suspend */
            if ((btc_av_cb.flags & BTC_AV_FLAG_LOCAL_SUSPEND_PENDING) == 0) {
@@ -843,31 +846,24 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
        break;

    case BTA_AV_STOP_EVT:
-
        btc_av_cb.flags |= BTC_AV_FLAG_PENDING_STOP;
        btc_a2dp_on_stopped(&p_av->suspend);
-
        btc_report_audio_state(ESP_A2D_AUDIO_STATE_STOPPED, &(btc_av_cb.peer_bda));

        /* if stop was successful, change state to open */
        if (p_av->suspend.status == BTA_AV_SUCCESS) {
            btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_OPENED);
        }
-
        break;

    case BTA_AV_CLOSE_EVT: {
-
        btc_av_cb.flags |= BTC_AV_FLAG_PENDING_STOP;
-
        /* avdtp link is closed */
        btc_a2dp_on_stopped(NULL);

        tBTA_AV_CLOSE *close = (tBTA_AV_CLOSE *)p_data;
        /* inform the application that we are disconnected */
-        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda),
-                                    close->disc_rsn);
-
+        btc_report_connection_state(ESP_A2D_CONNECTION_STATE_DISCONNECTED, &(btc_av_cb.peer_bda), close->disc_rsn);
        btc_sm_change_state(btc_av_cb.sm_handle, BTC_AV_STATE_IDLE);
        break;
    }
@@ -875,10 +871,8 @@ static BOOLEAN btc_av_state_started_handler(btc_sm_event_t event, void *p_data)
    CHECK_RC_EVENT(event, p_data);

    default:
-        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__,
-                 dump_av_sm_event_name(event));
+        BTC_TRACE_WARNING("%s : unhandled event:%s\n", __FUNCTION__, dump_av_sm_event_name(event));
        return FALSE;
-
    }
    return TRUE;
 }
@@ -957,7 +951,6 @@ static void btc_av_event_free_data(btc_sm_event_t event, void *p_data)
 ** Returns          bt_status_t
 **
 *******************************************************************************/
-
 static bt_status_t btc_av_init(int service_id)
 {
    if (btc_av_cb.sm_handle == NULL) {
@@ -974,6 +967,8 @@ static bt_status_t btc_av_init(int service_id)
        }

        if (!stat) {
+            g_a2dp_on_init = false;
+            g_a2dp_on_deinit = true;
            return BT_STATUS_FAIL;
        }

@@ -992,6 +987,8 @@ static bt_status_t btc_av_init(int service_id)
        return BT_STATUS_SUCCESS;
    }

+    g_a2dp_on_init = true;
+    g_a2dp_on_deinit = false;
    return BT_STATUS_FAIL;
 }

@@ -1038,11 +1035,13 @@ static void clean_up(int service_id)
            tle_av_open_on_rc = NULL;
        }
 #endif /* BTC_AV_SRC_INCLUDED */
+        btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
    }

-    btc_dm_disable_service(BTA_A2DP_SOURCE_SERVICE_ID);
-
    if (service_id == BTA_A2DP_SINK_SERVICE_ID) {
+#if BTC_AV_SINK_INCLUDED
+        btc_a2dp_sink_shutdown();
+#endif /* BTC_AV_SINK_INCLUDED */
        btc_dm_disable_service(BTA_A2DP_SINK_SERVICE_ID);
    }

@@ -1050,11 +1049,8 @@ static void clean_up(int service_id)
    btc_sm_shutdown(btc_av_cb.sm_handle);
    btc_av_cb.sm_handle = NULL;

-    if (service_id == BTA_A2DP_SINK_SERVICE_ID) {
-#if BTC_AV_SINK_INCLUDED
-        btc_a2dp_sink_shutdown();
-#endif /* BTC_AV_SINK_INCLUDED */
-    }
+    g_a2dp_on_init = false;
+    g_a2dp_on_deinit = true;
 }

 /*******************************************************************************
@@ -1229,10 +1225,16 @@ bt_status_t btc_av_execute_service(BOOLEAN b_enable, UINT8 tsep)
        /* Added BTA_AV_FEAT_NO_SCO_SSPD - this ensures that the BTA does not
         * auto-suspend av streaming on AG events(SCO or Call). The suspend shall
         * be initiated by the app/audioflinger layers */
-        BTA_AvEnable(BTA_SEC_AUTHENTICATE, (BTA_AV_FEAT_NO_SCO_SSPD)
-                     | BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR
-                     | BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
-                     bte_av_callback);
+        if (g_av_with_rc) {
+            BTC_TRACE_WARNING("A2DP Enable with AVRC")
+            BTA_AvEnable(BTA_SEC_AUTHENTICATE, BTA_AV_FEAT_NO_SCO_SSPD |
+                        BTA_AV_FEAT_RCTG | BTA_AV_FEAT_METADATA | BTA_AV_FEAT_VENDOR |
+                        BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL,
+                        bte_av_callback);
+        } else {
+            BTC_TRACE_WARNING("A2DP Enable without AVRC")
+            BTA_AvEnable(BTA_SEC_AUTHENTICATE, BTA_AV_FEAT_NO_SCO_SSPD, bte_av_callback);
+        }
        BTA_AvRegister(BTA_AV_CHNL_AUDIO, BTC_AV_SERVICE_NAME, 0, bte_av_media_callback, &bta_av_a2d_cos, tsep);
    } else {
        BTA_AvDeregister(btc_av_cb.bta_handle);
@@ -1384,7 +1386,9 @@ void btc_a2dp_call_handler(btc_msg_t *msg)
    }
    case BTC_AV_SINK_API_DISCONNECT_EVT: {
        CHECK_BTAV_INIT();
-        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, NULL);
+        btc_av_disconn_req_t disconn_req;   
+        memcpy(&disconn_req.target_bda, &arg->disconn, sizeof(bt_bdaddr_t));
+        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, &disconn_req);
        break;
    }
    case BTC_AV_SINK_API_REG_DATA_CB_EVT: {
@@ -1407,7 +1411,9 @@ void btc_a2dp_call_handler(btc_msg_t *msg)
    }
    case BTC_AV_SRC_API_DISCONNECT_EVT: {
        CHECK_BTAV_INIT();
-        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, NULL);
+        btc_av_disconn_req_t disconn_req;
+        memcpy(&disconn_req.target_bda, &arg->src_disconn, sizeof(bt_bdaddr_t));
+        btc_sm_dispatch(btc_av_cb.sm_handle, BTC_AV_DISCONNECT_REQ_EVT, &disconn_req);
        break;
    }
    case BTC_AV_SRC_API_REG_DATA_CB_EVT: {
--- a/components/bt/bluedroid/btc/profile/std/avrc/btc_avrc.c
+++ b/components/bt/bluedroid/btc/profile/std/avrc/btc_avrc.c
@@ -424,6 +424,14 @@ static void btc_avrc_ct_init(void)
    BTC_TRACE_DEBUG("## %s ##", __FUNCTION__);

    memset (&btc_rc_vb, 0, sizeof(btc_rc_vb));
+
+    if (!g_av_with_rc) {
+        g_av_with_rc = true;
+    }
+    if (g_a2dp_on_init) {
+        BTC_TRACE_WARNING("AVRC Controller is expected to be initialized in advance of A2DP !!!");
+    }
+
    btc_rc_vb.rc_vol_label = MAX_LABEL;
    btc_rc_vb.rc_volume = MAX_VOLUME;
 }
@@ -442,6 +450,13 @@ static void btc_avrc_ct_deinit(void)
 {
    BTC_TRACE_API("## %s ##", __FUNCTION__);

+    if (g_a2dp_on_deinit) {
+        BTC_TRACE_WARNING("A2DP already deinit, AVRC CT shuold deinit in advance of A2DP !!!");
+    }
+    if (g_av_with_rc) {
+        g_av_with_rc = false;
+    }
+
    memset(&btc_rc_vb, 0, sizeof(btc_rc_cb_t));
    BTC_TRACE_API("## %s ## completed", __FUNCTION__);
 }
--- a/components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c
+++ b/components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c
@@ -856,22 +856,38 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *
        • The two most significant bits of the address shall be equal to 1
        • All bits of the random part of the address shall not be equal to 1
        • All bits of the random part of the address shall not be equal to 0
+        A non-resolvable private address is a 48-bit randomly generated address and shall meet the following requirements:
+        • The two most significant bits of the address shall be equal to 0
+        • All bits of the random part of the address shall not be equal to 1
+        • All bits of the random part of the address shall not be equal to 0
        */
        BD_ADDR invalid_rand_addr_a, invalid_rand_addr_b;
        memset(invalid_rand_addr_a, 0xff, sizeof(BD_ADDR));
        memset(invalid_rand_addr_b, 0x00, sizeof(BD_ADDR));
-        invalid_rand_addr_b[0] = invalid_rand_addr_b[0] | BT_STATIC_RAND_ADDR_MASK;
-        if((rand_addr[0] & BT_STATIC_RAND_ADDR_MASK) == BT_STATIC_RAND_ADDR_MASK
-            && memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0
-            && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0){
-            BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
-        } else {
+
+        if((rand_addr[0] & BT_STATIC_RAND_ADDR_MASK) == BT_STATIC_RAND_ADDR_MASK) {
+            invalid_rand_addr_b[0] = invalid_rand_addr_b[0] | BT_STATIC_RAND_ADDR_MASK;
+            if (memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0 && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0) {
+                BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
+            } else {
+                btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
+                BTC_TRACE_ERROR("Invalid static random address, the high bit should be 0b11, bits of the random part shall not be all 1 or 0");
+            }
+        } else if ((rand_addr[0] | BT_NON_RPA_MASK) == BT_NON_RPA_MASK) {
+            invalid_rand_addr_a[0] = invalid_rand_addr_a[0] & BT_NON_RPA_MASK;
+            if (memcmp(invalid_rand_addr_a, rand_addr, BD_ADDR_LEN) != 0 && memcmp(invalid_rand_addr_b, rand_addr, BD_ADDR_LEN) != 0) {
+                BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
+            } else {
+                btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
+                BTC_TRACE_ERROR("Invalid non-resolvable private address, the high bit should be 0b00, bits of the random part shall not be all 1 or 0");
+            }
+        }else {
            btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
-            BTC_TRACE_ERROR("Invalid random address, the high bit should be 0b11, bits of the random part shall not be all 1 or 0");
+            BTC_TRACE_ERROR("Invalid random address type");
        }
    } else {
        btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
-        BTC_TRACE_ERROR("Invalid random addressm, the address value is NULL");
+        BTC_TRACE_ERROR("Invalid address, the address value is NULL");
    }
 }

@@ -1120,7 +1136,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
        BTA_DmUpdateWhiteList(arg->update_white_list.add_remove, arg->update_white_list.remote_bda, btc_add_whitelist_complete_callback);
        break;
    case BTC_GAP_BLE_ACT_READ_RSSI:
-        BTA_DmBleReadRSSI(arg->read_rssi.remote_addr, BTA_TRANSPORT_LE, btc_read_ble_rssi_cmpl_callback);
+        BTA_DmReadRSSI(arg->read_rssi.remote_addr, BTA_TRANSPORT_LE, btc_read_ble_rssi_cmpl_callback);
        break;
    case BTC_GAP_BLE_ACT_SET_CONN_PARAMS:
        BTA_DmSetBlePrefConnParams(arg->set_conn_params.bd_addr, arg->set_conn_params.min_conn_int,
@@ -1220,6 +1236,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                bta_dm_co_ble_oob_support(enable);
                break;
            }
+            case ESP_BLE_APP_ENC_KEY_SIZE: {
+                uint8_t key_size = 0;
+                STREAM_TO_UINT8(key_size, value);
+                bta_dm_co_ble_set_appl_enc_key_size(key_size);
+                break;
+            }
            default:
                break;
        }
--- a/components/bt/bluedroid/btc/profile/std/gap/btc_gap_bt.c
+++ b/components/bt/bluedroid/btc/profile/std/gap/btc_gap_bt.c
@@ -633,7 +633,7 @@ static void btc_gap_bt_read_rssi_delta_cmpl_callback(void *p_data)

 static void btc_gap_bt_read_rssi_delta(btc_gap_bt_args_t *arg)
 {
-    BTA_DmBleReadRSSI(arg->read_rssi_delta.bda.address, BTA_TRANSPORT_BR_EDR, btc_gap_bt_read_rssi_delta_cmpl_callback);
+    BTA_DmReadRSSI(arg->read_rssi_delta.bda.address, BTA_TRANSPORT_BR_EDR, btc_gap_bt_read_rssi_delta_cmpl_callback);
 }

 static esp_err_t btc_gap_bt_remove_bond_device(btc_gap_bt_args_t *arg)
@@ -852,6 +852,7 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg)
    case BTC_GAP_BT_READ_RSSI_DELTA_EVT:
    case BTC_GAP_BT_AUTH_CMPL_EVT:
    case BTC_GAP_BT_PIN_REQ_EVT:
+    case BTC_GAP_BT_REMOVE_BOND_DEV_COMPLETE_EVT:
 #if (BT_SSP_INCLUDED == TRUE)
    case BTC_GAP_BT_CFM_REQ_EVT:
    case BTC_GAP_BT_KEY_NOTIF_EVT:
@@ -905,6 +906,10 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg)
        break;
    }
 #endif ///BT_SSP_INCLUDED == TRUE
+    case BTC_GAP_BT_REMOVE_BOND_DEV_COMPLETE_EVT:{
+        btc_gap_bt_cb_to_app(ESP_BT_GAP_REMOVE_BOND_DEV_COMPLETE_EVT,(esp_bt_gap_cb_param_t *)msg->arg);
+        break;
+    }
    default:
        BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
        break;
--- a/components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c
+++ b/components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c
@@ -613,6 +613,14 @@ static void btc_gattc_read_char_descr(btc_ble_gattc_args_t *arg)
    BTA_GATTC_ReadCharDescr(arg->read_descr.conn_id, arg->read_descr.handle, arg->read_descr.auth_req);
 }

+
+static void btc_gattc_read_by_type(btc_ble_gattc_args_t *arg)
+{
+    tBT_UUID uuid;
+    btc_to_bta_uuid(&uuid, &(arg->read_by_type.uuid));
+    BTA_GATTC_Read_by_type(arg->read_by_type.conn_id, arg->read_by_type.s_handle, arg->read_by_type.e_handle, &uuid, arg->read_by_type.auth_req);
+}
+
 static void btc_gattc_write_char(btc_ble_gattc_args_t *arg)
 {
    BTA_GATTC_WriteCharValue(arg->write_char.conn_id,
@@ -724,6 +732,9 @@ void btc_gattc_call_handler(btc_msg_t *msg)
    case BTC_GATTC_ACT_READ_CHAR_DESCR:
        btc_gattc_read_char_descr(arg);
        break;
+    case BTC_GATTC_ACT_READ_BY_TYPE:
+        btc_gattc_read_by_type(arg);
+        break;
    case BTC_GATTC_ACT_WRITE_CHAR:
        btc_gattc_write_char(arg);
        break;
--- a/components/bt/bluedroid/btc/profile/std/include/btc_av.h
+++ b/components/bt/bluedroid/btc/profile/std/include/btc_av.h
@@ -33,10 +33,17 @@
 #include "bta/bta_av_api.h"

 #if (BTC_AV_INCLUDED == TRUE)
+
+// global variable to inidcate avrc is initialized with a2dp
+extern bool g_av_with_rc;
+// global variable to indicate a2dp is initialized
+extern bool g_a2dp_on_init;
+// global variable to indicate a2dp is deinitialized
+extern bool g_a2dp_on_deinit;
+
 /*******************************************************************************
 **  Type definitions for callback functions
 ********************************************************************************/
-
 enum {
    BTC_AV_DATAPATH_OPEN_EVT, // original UIPC_OPEN_EVT for data channel in bluedroid
    BTC_AV_DATAPATH_MAX_EVT,
@@ -77,6 +84,8 @@ typedef union {
    esp_a2d_mcc_t mcc;
    // BTC_AV_SINK_API_CONNECT_EVT
    bt_bdaddr_t connect;
+    // BTC_AV_SINK_API_DISCONNECT_EVT
+    bt_bdaddr_t disconn;
    // BTC_AV_SINK_API_REG_DATA_CB_EVT
    esp_a2d_sink_data_cb_t data_cb;
 #endif  /* BTC_AV_SINK_INCLUDED */
@@ -85,6 +94,8 @@ typedef union {
    esp_a2d_source_data_cb_t src_data_cb;
    // BTC_AV_SRC_API_CONNECT
    bt_bdaddr_t src_connect;
+    // BTC_AV_SRC_API_DISCONNECT_EVT
+    bt_bdaddr_t src_disconn;
 #endif /* BTC_AV_SRC_INCLUDED */
    // BTC_AV_API_MEDIA_CTRL_EVT
    esp_a2d_media_ctrl_t ctrl;
--- a/components/bt/bluedroid/btc/profile/std/include/btc_gap_bt.h
+++ b/components/bt/bluedroid/btc/profile/std/include/btc_gap_bt.h
@@ -33,6 +33,7 @@ typedef enum {
    BTC_GAP_BT_KEY_NOTIF_EVT,
    BTC_GAP_BT_KEY_REQ_EVT,
    BTC_GAP_BT_READ_RSSI_DELTA_EVT,
+    BTC_GAP_BT_REMOVE_BOND_DEV_COMPLETE_EVT,
 }btc_gap_bt_evt_t;

 typedef enum {
--- a/components/bt/bluedroid/btc/profile/std/include/btc_gattc.h
+++ b/components/bt/bluedroid/btc/profile/std/include/btc_gattc.h
@@ -30,6 +30,7 @@ typedef enum {
    BTC_GATTC_ACT_READ_CHAR,
    BTC_GATTC_ACT_READ_MULTIPLE_CHAR,
    BTC_GATTC_ACT_READ_CHAR_DESCR,
+    BTC_GATTC_ACT_READ_BY_TYPE,
    BTC_GATTC_ACT_WRITE_CHAR,
    BTC_GATTC_ACT_WRITE_CHAR_DESCR,
    BTC_GATTC_ACT_PREPARE_WRITE,
@@ -112,6 +113,14 @@ typedef union {
        uint16_t handle;
        esp_gatt_auth_req_t auth_req;
    } read_descr;
+    // BTC_GATTC_ACT_READ_BY_TYPE
+    struct read_by_type_arg {
+        uint16_t conn_id;
+        uint16_t s_handle;
+        uint16_t e_handle;
+        esp_bt_uuid_t uuid;
+        esp_gatt_auth_req_t auth_req;
+    } read_by_type;
    //BTC_GATTC_ACT_WRITE_CHAR,
    struct write_char_arg {
        uint16_t conn_id;
--- a/components/bt/bluedroid/btc/profile/std/include/btc_spp.h
+++ b/components/bt/bluedroid/btc/profile/std/include/btc_spp.h
@@ -35,6 +35,7 @@ typedef enum {
    BTC_SPP_ACT_CONNECT,
    BTC_SPP_ACT_DISCONNECT,
    BTC_SPP_ACT_START_SRV,
+    BTC_SPP_ACT_STOP_SRV,
    BTC_SPP_ACT_WRITE,
 } btc_spp_act_t;

--- a/components/bt/bluedroid/btc/profile/std/spp/btc_spp.c
+++ b/components/bt/bluedroid/btc/profile/std/spp/btc_spp.c
--- a/components/bt/bluedroid/common/include/common/bt_target.h
+++ b/components/bt/bluedroid/common/include/common/bt_target.h
@@ -96,6 +96,12 @@

 #endif /* #if CONFIG_CLASSIC_BT_ENABLED */

+/* This is set to enable use of GAP L2CAP connections. */
+#if (VND_BT_JV_BTA_L2CAP == TRUE)
+#define BTA_JV_L2CAP_INCLUDED       TRUE
+#define GAP_CONN_INCLUDED           TRUE
+#endif /* VND_BT_JV_BTA_L2CAP */
+
 #ifndef CLASSIC_BT_INCLUDED
 #define CLASSIC_BT_INCLUDED         FALSE
 #endif /* CLASSIC_BT_INCLUDED */
@@ -125,6 +131,12 @@
 #define GATTC_INCLUDED              FALSE
 #endif  /* CONFIG_GATTC_ENABLE */

+#if (CONFIG_GATTS_BLUFI_ENABLE)
+#define BLUFI_INCLUDED              TRUE
+#else
+#define BLUFI_INCLUDED              FALSE
+#endif  /* UC_BT_BLUFI_ENABLE */
+
 #if (CONFIG_GATTC_ENABLE && CONFIG_GATTC_CACHE_NVS_FLASH)
 #define GATTC_CACHE_NVS              TRUE
 #else
@@ -293,6 +305,19 @@
 #define BTA_SDP_INCLUDED FALSE
 #endif

+/* This is set to enable use of GAP L2CAP connections. */
+#ifndef VND_BT_JV_BTA_L2CAP
+#define VND_BT_JV_BTA_L2CAP        FALSE
+#endif
+
+#ifndef BTA_JV_L2CAP_INCLUDED
+#define BTA_JV_L2CAP_INCLUDED       FALSE
+#endif
+
+#ifndef GAP_CONN_INCLUDED
+#define GAP_CONN_INCLUDED           FALSE
+#endif
+
 /******************************************************************************
 **
 ** Stack-layer components
@@ -1341,7 +1366,7 @@

 /* The maximum number of ports supported. */
 #ifndef MAX_RFC_PORTS
-#define MAX_RFC_PORTS               16 /*max is 30*/
+#define MAX_RFC_PORTS               8 /*max is 30*/
 #endif

 /* The maximum simultaneous links to different devices. */
@@ -1710,15 +1735,6 @@ Range: 2 octets
 #define GAP_INCLUDED                TRUE
 #endif

-/* This is set to enable use of GAP L2CAP connections. */
-#ifndef GAP_CONN_INCLUDED
-#if (GAP_INCLUDED == TRUE && CLASSIC_BT_INCLUDED == TRUE)
-#define GAP_CONN_INCLUDED           TRUE
-#else
-#define GAP_CONN_INCLUDED           FALSE
-#endif
-#endif
-
 /* This is set to enable posting event for data write */
 #ifndef GAP_CONN_POST_EVT_INCLUDED
 #define GAP_CONN_POST_EVT_INCLUDED  FALSE
--- a/components/bt/bluedroid/common/include/common/bte_appl.h
+++ b/components/bt/bluedroid/common/include/common/bte_appl.h
@@ -34,6 +34,7 @@ typedef struct {
    UINT8   ble_min_key_size;
    UINT8   ble_accept_auth_enable;
    UINT8   oob_support;
+    UINT8   ble_appl_enc_key_size;
 #endif

 } tBTE_APPL_CFG;
--- a/components/bt/bluedroid/main/bte_init.c
+++ b/components/bt/bluedroid/main/bte_init.c
@@ -116,7 +116,6 @@

 #if BTA_JV_INCLUDED==TRUE
 #include "bta_jv_int.h"
-tBTA_JV_CB *bta_jv_cb_ptr = NULL;
 #endif

 #if BTA_HL_INCLUDED == TRUE
@@ -332,8 +331,10 @@ void BTE_DeinitStack(void)
    bta_sdp_cb_ptr = NULL;
 #endif
 #if (defined BTA_JV_INCLUDED && BTA_JV_INCLUDED == TRUE)
-    osi_free(bta_jv_cb_ptr);
-    bta_jv_cb_ptr = NULL;
+    if (bta_jv_cb_ptr) {
+        osi_free(bta_jv_cb_ptr);
+        bta_jv_cb_ptr = NULL;
+    }
 #endif //JV
 #if (defined BTA_HF_INCLUDED && BTA_HF_INCLUDED == TRUE)
    osi_free(bta_hf_client_cb_ptr);
--- a/components/bt/bluedroid/stack/btm/btm_acl.c
+++ b/components/bt/bluedroid/stack/btm/btm_acl.c
@@ -794,7 +794,7 @@ void btm_acl_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
                BTM_TRACE_WARNING("btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!\n");
                btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
            }
-            BTM_TRACE_ERROR("btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d\n",
+            BTM_TRACE_WARNING("btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d\n",
                            (UINT32)p_dev_rec, p_dev_rec->rs_disc_pending);
            p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
        }
@@ -1140,7 +1140,6 @@ void btm_read_remote_ext_features_complete (UINT8 *p)

    if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
        BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown", max_page);
-        return;
    }

    p_acl_cb = &btm_cb.acl_db[acl_idx];
--- a/components/bt/bluedroid/stack/btm/btm_ble_gap.c
+++ b/components/bt/bluedroid/stack/btm/btm_ble_gap.c
@@ -4375,5 +4375,27 @@ BOOLEAN btm_ble_topology_check(tBTM_BLE_STATE_MASK request_state_mask)
    return rt;
 }

+/*******************************************************************************
+ **
+ ** Function         BTM_Ble_Authorization
+ **
+ ** Description      This function is used to authorize a specified device
+ **
+ ** Returns          TRUE or FALSE
+ **
+ *******************************************************************************/
+BOOLEAN BTM_Ble_Authorization(BD_ADDR bd_addr, BOOLEAN authorize)
+{
+    if (bd_addr == NULL) {
+        BTM_TRACE_ERROR("bd_addr is NULL");
+        return FALSE;
+    }

+    if (btm_sec_dev_authorization(bd_addr, authorize)) {
+        return TRUE;
+    }
+
+    BTM_TRACE_ERROR("Authorization fail");
+    return FALSE;
+}
 #endif  /* BLE_INCLUDED */
--- a/components/bt/bluedroid/stack/btm/btm_sec.c
+++ b/components/bt/bluedroid/stack/btm/btm_sec.c
@@ -2257,7 +2257,7 @@ tBTM_STATUS btm_sec_l2cap_access_req (BD_ADDR bd_addr, UINT16 psm, UINT16 handle
            }
        } else if (!(BTM_SM4_KNOWN & p_dev_rec->sm4)) {
            /* the remote features are not known yet */
-            BTM_TRACE_DEBUG("%s: (%s) remote features unknown!!sec_flags:0x%02x\n", __FUNCTION__,
+            BTM_TRACE_ERROR("%s: (%s) remote features unknown!!sec_flags:0x%02x\n", __FUNCTION__,
                            (is_originator) ? "initiator" : "acceptor", p_dev_rec->sec_flags);

            p_dev_rec->sm4 |= BTM_SM4_REQ_PEND;
@@ -4065,7 +4065,7 @@ void btm_sec_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
                p_dev_rec->sec_flags |= BTM_SEC_16_DIGIT_PIN_AUTHED;
            }
        } else {
-            p_dev_rec->sec_flags |= (BTM_SEC_LE_AUTHENTICATED | BTM_SEC_LE_ENCRYPTED);
+            p_dev_rec->sec_flags |= BTM_SEC_LE_ENCRYPTED;
        }
    }

@@ -6258,3 +6258,39 @@ void btm_sec_handle_remote_legacy_auth_cmp(UINT16 handle)
 }
 #endif /// (CLASSIC_BT_INCLUDED == TRUE)
 #endif  ///SMP_INCLUDED == TRUE
+
+/******************************************************************************
+ **
+ ** Function         btm_sec_dev_authorization
+ **
+ ** Description      This function is used to authorize a specified device(BLE)
+ **
+ ******************************************************************************
+ */
+#if (BLE_INCLUDED == TRUE)
+BOOLEAN btm_sec_dev_authorization(BD_ADDR bd_addr, BOOLEAN authorized)
+{
+#if (SMP_INCLUDED == TRUE)
+    UINT8  sec_flag = 0;
+    tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev(bd_addr);
+    if (p_dev_rec) {
+        sec_flag = (UINT8)(p_dev_rec->sec_flags >> 8);
+        if (!(sec_flag & BTM_SEC_LINK_KEY_AUTHED)) {
+            BTM_TRACE_ERROR("Authorized should after successful Authentication(MITM protection)\n");
+            return FALSE;
+        }
+
+        if (authorized) {
+            p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHORIZATION;
+        } else {
+            p_dev_rec->sec_flags &= ~(BTM_SEC_LE_AUTHORIZATION);
+        }
+    } else {
+        BTM_TRACE_ERROR("%s, can't find device\n", __func__);
+        return FALSE;
+    }
+    return TRUE;
+#endif  ///SMP_INCLUDED == TRUE
+    return FALSE;
+}
+#endif  /// BLE_INCLUDE == TRUE
--- a/components/bt/bluedroid/stack/btm/include/btm_int.h
+++ b/components/bt/bluedroid/stack/btm/include/btm_int.h
@@ -546,6 +546,7 @@ typedef struct {
 #define BTM_SEC_ROLE_SWITCHED   0x40
 #define BTM_SEC_IN_USE          0x80
    /* LE link security flag */
+#define BTM_SEC_LE_AUTHORIZATION   0x0100   /* LE link is authorized */
 #define BTM_SEC_LE_AUTHENTICATED   0x0200   /* LE link is encrypted after pairing with MITM */
 #define BTM_SEC_LE_ENCRYPTED       0x0400   /* LE link is encrypted */
 #define BTM_SEC_LE_NAME_KNOWN      0x0800   /* not used */
@@ -734,7 +735,7 @@ enum {
    BTM_PAIR_STATE_WAIT_LOCAL_OOB_RSP,          /* Waiting for local response to peer OOB data  */
    BTM_PAIR_STATE_WAIT_LOCAL_IOCAPS,           /* Waiting for local IO capabilities and OOB data */
    BTM_PAIR_STATE_INCOMING_SSP,                /* Incoming SSP (got peer IO caps when idle)    */
-    BTM_PAIR_STATE_WAIT_AUTH_COMPLETE,          /* All done, waiting authentication cpmplete    */
+    BTM_PAIR_STATE_WAIT_AUTH_COMPLETE,          /* All done, waiting authentication complete    */
    BTM_PAIR_STATE_WAIT_DISCONNECT              /* Waiting to disconnect the ACL                */
 };
 typedef UINT8 tBTM_PAIRING_STATE;
@@ -1161,6 +1162,7 @@ void btm_sec_handle_remote_legacy_auth_cmp(UINT16 handle);
 void btm_sec_update_legacy_auth_state(tACL_CONN *p_acl_cb, UINT8 legacy_auth_state);
 BOOLEAN btm_sec_legacy_authentication_mutual (tBTM_SEC_DEV_REC *p_dev_rec);

+BOOLEAN btm_sec_dev_authorization(BD_ADDR bd_addr, BOOLEAN authorized);
 /*
 #ifdef __cplusplus
 }
--- a/components/bt/bluedroid/stack/gatt/gatt_cl.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_cl.c
@@ -219,6 +219,7 @@ void gatt_act_write (tGATT_CLCB *p_clcb, UINT8 sec_act)
    if (p_attr) {
        switch (p_clcb->op_subtype) {
        case GATT_WRITE_NO_RSP:
+            l2ble_update_att_acl_pkt_num(L2CA_DECREASE_BTU_NUM, NULL);
            p_clcb->s_handle = p_attr->handle;
            op_code = (sec_act == GATT_SEC_SIGN_DATA) ? GATT_SIGN_CMD_WRITE : GATT_CMD_WRITE;
            rt = gatt_send_write_msg(p_tcb,
--- a/components/bt/bluedroid/stack/gatt/gatt_db.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_db.c
@@ -34,6 +34,7 @@
 #include "gatt_int.h"
 #include "stack/l2c_api.h"
 #include "btm_int.h"
+#include "common/bte_appl.h"

 /********************************************************************************
 **              L O C A L    F U N C T I O N     P R O T O T Y P E S            *
@@ -124,10 +125,15 @@ static tGATT_STATUS gatts_check_attr_readability(tGATT_ATTR16 *p_attr,
    tGATT_PERM      perm = p_attr->permission;

    UNUSED(offset);
+
+#if SMP_INCLUDED == TRUE
+    min_key_size = bte_appl_cfg.ble_appl_enc_key_size;
+#else
    min_key_size = (((perm & GATT_ENCRYPT_KEY_SIZE_MASK) >> 12));
    if (min_key_size != 0 ) {
        min_key_size += 6;
    }
+#endif

    if (!(perm & GATT_READ_ALLOWED)) {
        GATT_TRACE_ERROR( "GATT_READ_NOT_PERMIT\n");
@@ -155,6 +161,11 @@ static tGATT_STATUS gatts_check_attr_readability(tGATT_ATTR16 *p_attr,
        return GATT_INSUF_KEY_SIZE;
    }

+    /* LE Authorization check*/
+    if ((perm & GATT_READ_AUTHORIZATION) && (!(sec_flag & GATT_SEC_FLAG_LKEY_AUTHED) || !(sec_flag & GATT_SEC_FLAG_AUTHORIZATION))) {
+        GATT_TRACE_ERROR( "GATT_INSUF_AUTHORIZATION\n");
+        return GATT_INSUF_AUTHORIZATION;
+    }

    if (read_long) {
        switch (p_attr->uuid) {
@@ -1068,10 +1079,16 @@ tGATT_STATUS gatts_write_attr_perm_check (tGATT_SVC_DB *p_db, UINT8 op_code,
        while (p_attr != NULL) {
            if (p_attr->handle == handle) {
                perm = p_attr->permission;
+
+            #if SMP_INCLUDED == TRUE
+                min_key_size = bte_appl_cfg.ble_appl_enc_key_size;
+            #else
                min_key_size = (((perm & GATT_ENCRYPT_KEY_SIZE_MASK) >> 12));
                if (min_key_size != 0 ) {
                    min_key_size += 6;
                }
+
+            #endif
                GATT_TRACE_DEBUG( "gatts_write_attr_perm_check p_attr->permission =0x%04x min_key_size==0x%04x",
                                  p_attr->permission,
                                  min_key_size);
@@ -1118,6 +1135,11 @@ tGATT_STATUS gatts_write_attr_perm_check (tGATT_SVC_DB *p_db, UINT8 op_code,
                    status = GATT_INSUF_KEY_SIZE;
                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_KEY_SIZE");
                }
+                /* LE Authorization check*/
+                else if ((perm & GATT_WRITE_AUTHORIZATION) && (!(sec_flag & GATT_SEC_FLAG_LKEY_AUTHED) || !(sec_flag & GATT_SEC_FLAG_AUTHORIZATION))){
+                    status = GATT_INSUF_AUTHORIZATION;
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHORIZATION");
+                }
                /* LE security mode 2 attribute  */
                else if (perm & GATT_WRITE_SIGNED_PERM && op_code != GATT_SIGN_CMD_WRITE && !(sec_flag & GATT_SEC_FLAG_ENCRYPTED)
                         &&  (perm & GATT_WRITE_ALLOWED) == 0) {
--- a/components/bt/bluedroid/stack/gatt/gatt_utils.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_utils.c
@@ -1423,7 +1423,7 @@ void gatt_sr_get_sec_info(BD_ADDR rem_bda, tBT_TRANSPORT transport, UINT8 *p_sec

    BTM_GetSecurityFlagsByTransport(rem_bda, &sec_flag, transport);

-    sec_flag &= (GATT_SEC_FLAG_LKEY_UNAUTHED | GATT_SEC_FLAG_LKEY_AUTHED | GATT_SEC_FLAG_ENCRYPTED);
+    sec_flag &= (GATT_SEC_FLAG_LKEY_UNAUTHED | GATT_SEC_FLAG_LKEY_AUTHED | GATT_SEC_FLAG_ENCRYPTED | GATT_SEC_FLAG_AUTHORIZATION);
 #if (SMP_INCLUDED == TRUE)
    *p_key_size = btm_ble_read_sec_key_size(rem_bda);
 #endif  ///SMP_INCLUDED == TRUE
--- a/components/bt/bluedroid/stack/gatt/include/gatt_int.h
+++ b/components/bt/bluedroid/stack/gatt/include/gatt_int.h
@@ -95,6 +95,7 @@ typedef UINT8 tGATT_SEC_ACTION;
 #define GATT_SEC_FLAG_LKEY_UNAUTHED     BTM_SEC_FLAG_LKEY_KNOWN
 #define GATT_SEC_FLAG_LKEY_AUTHED       BTM_SEC_FLAG_LKEY_AUTHED
 #define GATT_SEC_FLAG_ENCRYPTED         BTM_SEC_FLAG_ENCRYPTED
+#define GATT_SEC_FLAG_AUTHORIZATION     BTM_SEC_FLAG_AUTHORIZED
 typedef UINT8 tGATT_SEC_FLAG;

 /* Find Information Response Type
--- a/components/bt/bluedroid/stack/include/stack/a2d_api.h
+++ b/components/bt/bluedroid/stack/include/stack/a2d_api.h
@@ -235,10 +235,6 @@ extern UINT8 A2D_SetTraceLevel (UINT8 new_level);
 ******************************************************************************/
 extern UINT8 A2D_BitsSet(UINT8 num);

-#ifdef __cplusplus
-}
-#endif
-
 /*******************************************************************************
 **
 ** Function         A2D_Init
@@ -251,6 +247,23 @@ extern UINT8 A2D_BitsSet(UINT8 num);
 **
 *******************************************************************************/
 extern void A2D_Init(void);
+
+/*******************************************************************************
+**
+** Function         A2D_Deinit
+**
+** Description      This function is called at stack startup to free the
+**                  control block (if using dynamic memory), and free the
+**                  control block and tracing level.
+**
+** Returns          void
+**
+*******************************************************************************/
 extern void A2D_Deinit(void);
+
+#ifdef __cplusplus
+}
+#endif
+
 #endif  ///A2D_INCLUDED
 #endif /* A2D_API_H */
--- a/components/bt/bluedroid/stack/include/stack/bt_types.h
+++ b/components/bt/bluedroid/stack/include/stack/bt_types.h
@@ -52,6 +52,7 @@ typedef bool BOOLEAN;
 #define BT_EVT_MASK                 0xFF00
 #define BT_SUB_EVT_MASK             0x00FF
 #define BT_STATIC_RAND_ADDR_MASK    0xC0
+#define BT_NON_RPA_MASK             0x3F
 /* To Bluetooth Upper Layers        */
 /************************************/
 #define BT_EVT_TO_BTU_L2C_EVT       0x0900      /* L2CAP event */
--- a/components/bt/bluedroid/stack/include/stack/btm_api.h
+++ b/components/bt/bluedroid/stack/include/stack/btm_api.h
@@ -1430,6 +1430,7 @@ typedef UINT8 tBTM_IO_CAP;
 #define BTM_BLE_RESPONDER_KEY_SIZE 15
 #define BTM_BLE_MAX_KEY_SIZE       16
 #define BTM_BLE_MIN_KEY_SIZE       7
+#define BTM_BLE_APPL_ENC_KEY_SIZE  7

 typedef UINT8 tBTM_AUTH_REQ;

--- a/components/bt/bluedroid/stack/include/stack/btm_ble_api.h
+++ b/components/bt/bluedroid/stack/include/stack/btm_ble_api.h
@@ -2099,6 +2099,17 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length);
 *******************************************************************************/

 tBTM_STATUS BTM_UpdateBleDuplicateExceptionalList(uint8_t subcode, uint32_t type, BD_ADDR device_info, tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK update_exceptional_list_cmp_cb);
+
+/*******************************************************************************
+**
+** Function         BTM_Ble_Authorization
+**
+** Description      This function is used to authorize a specified device
+**
+** Returns          TRUE or FALSE
+**
+*******************************************************************************/
+BOOLEAN BTM_Ble_Authorization(BD_ADDR bd_addr, BOOLEAN authorize);
 /*
 #ifdef __cplusplus
 }
--- a/components/bt/bluedroid/stack/include/stack/gatt_api.h
+++ b/components/bt/bluedroid/stack/include/stack/gatt_api.h
@@ -174,18 +174,21 @@ typedef UINT16 tGATT_DISCONN_REASON;
 #define GATT_PERM_WRITE_ENC_MITM            (1 << 6) /* bit 6 */
 #define GATT_PERM_WRITE_SIGNED              (1 << 7) /* bit 7 */
 #define GATT_PERM_WRITE_SIGNED_MITM         (1 << 8) /* bit 8 */
+#define GATT_PERM_READ_AUTHORIZATION        (1 << 9) /* bit 9 */
+#define GATT_PERM_WRITE_AUTHORIZATION       (1 << 10)/* bit 10 */
 typedef UINT16 tGATT_PERM;

 #define GATT_ENCRYPT_KEY_SIZE_MASK  (0xF000) /* the MS nibble of tGATT_PERM; key size 7=0; size 16=9 */

-#define GATT_READ_ALLOWED                   (GATT_PERM_READ | GATT_PERM_READ_ENCRYPTED | GATT_PERM_READ_ENC_MITM)
+#define GATT_READ_ALLOWED                   (GATT_PERM_READ | GATT_PERM_READ_ENCRYPTED | GATT_PERM_READ_ENC_MITM | GATT_PERM_READ_AUTHORIZATION)
 #define GATT_READ_AUTH_REQUIRED             (GATT_PERM_READ_ENCRYPTED)
 #define GATT_READ_MITM_REQUIRED             (GATT_PERM_READ_ENC_MITM)
 #define GATT_READ_ENCRYPTED_REQUIRED        (GATT_PERM_READ_ENCRYPTED | GATT_PERM_READ_ENC_MITM)
+#define GATT_READ_AUTHORIZATION             (GATT_PERM_READ_AUTHORIZATION)


 #define GATT_WRITE_ALLOWED          (GATT_PERM_WRITE | GATT_PERM_WRITE_ENCRYPTED | GATT_PERM_WRITE_ENC_MITM | \
-                                     GATT_PERM_WRITE_SIGNED | GATT_PERM_WRITE_SIGNED_MITM)
+                                     GATT_PERM_WRITE_SIGNED | GATT_PERM_WRITE_SIGNED_MITM | GATT_PERM_WRITE_AUTHORIZATION)

 #define GATT_WRITE_AUTH_REQUIRED    (GATT_PERM_WRITE_ENCRYPTED | GATT_PERM_WRITE_SIGNED)

@@ -195,6 +198,7 @@ typedef UINT16 tGATT_PERM;

 #define GATT_WRITE_SIGNED_PERM      (GATT_PERM_WRITE_SIGNED | GATT_PERM_WRITE_SIGNED_MITM)

+#define GATT_WRITE_AUTHORIZATION    (GATT_PERM_WRITE_AUTHORIZATION)

 /* Characteristic properties
 */
--- a/components/bt/bluedroid/stack/include/stack/l2c_api.h
+++ b/components/bt/bluedroid/stack/include/stack/l2c_api.h
@@ -29,6 +29,7 @@
 #include "common/bt_target.h"
 #include "stack/l2cdefs.h"
 #include "stack/hcidefs.h"
+#include "osi/fixed_queue.h"

 /*****************************************************************************
 **  Constants
@@ -1227,6 +1228,21 @@ extern UINT16 L2CA_GetDisconnectReason (BD_ADDR remote_bda, tBT_TRANSPORT transp

 extern BOOLEAN L2CA_CheckIsCongest(UINT16 fixed_cid, UINT16 handle);

+#define  L2CA_GET_ATT_NUM      0
+#define  L2CA_ADD_BTC_NUM      1
+#define  L2CA_DECREASE_BTC_NUM 2
+#define  L2CA_ADD_BTU_NUM      3
+#define  L2CA_DECREASE_BTU_NUM 4
+#define  L2CA_BUFF_INI         5
+#define  L2CA_BUFF_DEINIT      6
+
+typedef struct {
+    UINT16 conn_id;
+    UINT16 * get_num;
+} tl2c_buff_param_t;
+
+
+extern void l2ble_update_att_acl_pkt_num(UINT8 type, tl2c_buff_param_t *param);

 #endif /* (BLE_INCLUDED == TRUE) */

--- a/components/bt/bluedroid/stack/include/stack/port_api.h
+++ b/components/bt/bluedroid/stack/include/stack/port_api.h
@@ -409,6 +409,19 @@ extern int PORT_Control (UINT16 handle, UINT8 signal);
 extern int PORT_FlowControl (UINT16 handle, BOOLEAN enable);


+/*******************************************************************************
+**
+** Function         PORT_FlowControl_GiveCredit
+**
+** Description      This function gives specified credits to the peer
+**
+** Parameters:      handle        - Handle returned in the RFCOMM_CreateConnection
+**                  enable        - enables data flow
+**                  credits_given - credits to give
+**
+*******************************************************************************/
+extern int PORT_FlowControl_GiveCredit (UINT16 handle, BOOLEAN enable, UINT16 credits_given);
+
 /*******************************************************************************
 **
 ** Function         PORT_GetModemStatus
--- a/components/bt/bluedroid/stack/include/stack/sdp_api.h
+++ b/components/bt/bluedroid/stack/include/stack/sdp_api.h
@@ -222,7 +222,7 @@ extern BOOLEAN SDP_ServiceSearchRequest (UINT8 *p_bd_addr,
 ** Description      This function queries an SDP server for information.
 **
 **                  The difference between this API function and the function
-**                  SDP_ServiceSearchRequest is that this one does a
+**                  SDP_ServiceSearchRequest2 is that this one does a
 **                  combined ServiceSearchAttributeRequest SDP function.
 **
 ** Returns          TRUE if discovery started, FALSE if failed.
--- a/components/bt/bluedroid/stack/l2cap/include/l2c_int.h
+++ b/components/bt/bluedroid/stack/l2cap/include/l2c_int.h
@@ -52,7 +52,7 @@
 #define L2CAP_LINK_CONNECT_TOUT_EXT  120          /* 120 seconds */
 #define L2CAP_ECHO_RSP_TOUT          30           /* 30 seconds */
 #define L2CAP_LINK_FLOW_CONTROL_TOUT 2            /* 2  seconds */
-#define L2CAP_LINK_DISCONNECT_TOUT   30           /* 30 seconds */
+#define L2CAP_LINK_DISCONNECT_TOUT   45           /* 45 seconds */

 #ifndef L2CAP_CHNL_CONNECT_TOUT      /* BTIF needs to override for internal project needs */
 #define L2CAP_CHNL_CONNECT_TOUT      60           /* 60 seconds */
@@ -73,7 +73,7 @@
 #define L2CAP_DEFAULT_RETRANS_TOUT   2000         /* 2000 milliseconds */
 #define L2CAP_DEFAULT_MONITOR_TOUT   12000        /* 12000 milliseconds */
 #define L2CAP_FCR_ACK_TOUT           200          /* 200 milliseconds */
-
+#define L2CAP_CACHE_ATT_ACL_NUM      10
 /* Define the possible L2CAP channel states. The names of
 ** the states may seem a bit strange, but they are taken from
 ** the Bluetooth specification.
@@ -165,6 +165,10 @@ typedef enum {

 #define L2CAP_MAX_FCR_CFG_TRIES         2       /* Config attempts before disconnecting */

+#ifndef MIN
+#define MIN(a, b) (((a) < (b)) ? (a) : (b))
+#endif
+
 typedef uint8_t tL2C_BLE_FIXED_CHNLS_MASK;

 typedef struct {
--- a/components/bt/bluedroid/stack/l2cap/l2c_api.c
+++ b/components/bt/bluedroid/stack/l2cap/l2c_api.c
@@ -36,6 +36,8 @@
 #include "stack/btu.h"
 #include "stack/btm_api.h"
 #include "osi/allocator.h"
+#include "gatt_int.h"
+#include "freertos/semphr.h"

 #if (CLASSIC_BT_INCLUDED == TRUE)
 /*******************************************************************************
@@ -1877,6 +1879,16 @@ UINT16 L2CA_GetFreePktBufferNum_LE(void)
 {
    return l2cb.controller_le_xmit_window;
 }
+UINT16 L2CA_GetCurFreePktBufferNum_LE(UINT16 conn_id)
+{
+    uint16_t num = 0;
+    tl2c_buff_param_t param;
+    param.conn_id = conn_id;
+    param.get_num = &num;
+    l2ble_update_att_acl_pkt_num(L2CA_GET_ATT_NUM, &param);
+    return num;
+}
+
 #endif

 /*******************************************************************************
@@ -2265,3 +2277,111 @@ UINT16 L2CA_FlushChannel (UINT16 lcid, UINT16 num_to_flush)
    return (num_left);
 }

+/******************************************************************************
+**
+** Function         update_acl_pkt_num
+**
+** Description      Update the number of att acl packets to be sent in xmit_hold_q.
+**
+** Returns          None
+**
+*******************************************************************************/
+
+#if BLE_INCLUDED == TRUE
+void l2ble_update_att_acl_pkt_num(UINT8 type, tl2c_buff_param_t *param)
+{
+    static SemaphoreHandle_t buff_semaphore = NULL ;
+    static INT16 btc_buf;
+    static INT16 btu_buf;
+
+    if(buff_semaphore == NULL && type != L2CA_BUFF_INI){
+        L2CAP_TRACE_ERROR("%s buff_semaphore not init", __func__);
+        return;
+    }
+    switch (type)
+    {
+    case L2CA_ADD_BTC_NUM:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        btc_buf ++;
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
+    case L2CA_DECREASE_BTC_NUM:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        btc_buf --;
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
+    case L2CA_ADD_BTU_NUM:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        btu_buf ++;
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
+    case L2CA_DECREASE_BTU_NUM:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        btu_buf --;
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
+    case L2CA_GET_ATT_NUM:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        INT16 att_acl_pkt_num = 0;
+        INT16 att_max_num = 0;
+        *(param->get_num) = 0;
+        UINT8 tcb_idx = param->conn_id;
+        tGATT_TCB * p_tcb = gatt_get_tcb_by_idx(tcb_idx);
+        if (p_tcb == NULL){
+            L2CAP_TRACE_ERROR("%s not found p_tcb", __func__);
+            xSemaphoreGive(buff_semaphore);
+            break;
+        }
+        tL2C_LCB * p_lcb = l2cu_find_lcb_by_bd_addr (p_tcb->peer_bda, BT_TRANSPORT_LE);
+        if (p_lcb == NULL){
+            L2CAP_TRACE_ERROR("%s not found p_lcb", __func__);
+            xSemaphoreGive(buff_semaphore);
+            break;
+        }
+        fixed_queue_t * queue = p_lcb->p_fixed_ccbs[L2CAP_ATT_CID - L2CAP_FIRST_FIXED_CHNL]->xmit_hold_q;
+        att_max_num = MIN(p_lcb->link_xmit_quota, L2CAP_CACHE_ATT_ACL_NUM);
+        if (queue == NULL){
+            L2CAP_TRACE_ERROR("%s not found queue", __func__);
+            xSemaphoreGive(buff_semaphore);
+            break;
+        }
+        att_acl_pkt_num = fixed_queue_length(queue);
+        if(att_acl_pkt_num < att_max_num){
+            if(btc_buf + btu_buf < att_max_num - att_acl_pkt_num){
+                *(param->get_num) = att_max_num - att_acl_pkt_num - (btc_buf + btu_buf);
+            }
+        }
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
+    case L2CA_BUFF_INI:{
+        btc_buf = 0;
+        btu_buf = 0;
+        buff_semaphore = xSemaphoreCreateBinary();
+        if (buff_semaphore == NULL) {
+            L2CAP_TRACE_ERROR("%s NO MEMORY", __func__);
+            break;
+        }
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
+    case L2CA_BUFF_DEINIT:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        btc_buf = 0;
+        btu_buf = 0;
+        xSemaphoreGive(buff_semaphore);
+        vSemaphoreDelete(buff_semaphore);
+        buff_semaphore = NULL;
+        break;
+    }
+    default:
+        break;
+    }
+}
+#endif
+
+
--- a/components/bt/bluedroid/stack/l2cap/l2c_link.c
+++ b/components/bt/bluedroid/stack/l2cap/l2c_link.c
@@ -1100,10 +1100,10 @@ void l2c_link_check_send_pkts (tL2C_LCB *p_lcb, tL2C_CCB *p_ccb, BT_HDR *p_buf)
 #if (BLE_INCLUDED == TRUE)
        while ( ((l2cb.controller_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
                 (l2cb.controller_le_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_LE)))
-                && (p_lcb->sent_not_acked <= p_lcb->link_xmit_quota))
+                && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
 #else
        while ( (l2cb.controller_xmit_window != 0)
-                && (p_lcb->sent_not_acked <= p_lcb->link_xmit_quota))
+                && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
 #endif
        {
            if (list_is_empty(p_lcb->link_xmit_data_q)) {
@@ -1122,11 +1122,17 @@ void l2c_link_check_send_pkts (tL2C_LCB *p_lcb, tL2C_CCB *p_ccb, BT_HDR *p_buf)
 #if (BLE_INCLUDED == TRUE)
            while ( ((l2cb.controller_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
                     (l2cb.controller_le_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_LE)))
-                    && (p_lcb->sent_not_acked <= p_lcb->link_xmit_quota))
+                    && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
 #else
            while ((l2cb.controller_xmit_window != 0) && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
 #endif
            {
+                //need check flag: partial_segment_being_sent.
+                if ( (p_lcb->partial_segment_being_sent)
+                        || (p_lcb->link_state != LST_CONNECTED)
+                        || (L2C_LINK_CHECK_POWER_MODE (p_lcb)) ) {
+                    break;
+                }
                //L2CAP_TRACE_DEBUG("l2cu_get_next_buffer_to_send = %p",l2cu_get_next_buffer_to_send(p_lcb));
                if ((p_buf = l2cu_get_next_buffer_to_send (p_lcb)) == NULL) {
                    break;
--- a/components/bt/bluedroid/stack/l2cap/l2c_main.c
+++ b/components/bt/bluedroid/stack/l2cap/l2c_main.c
@@ -880,6 +880,10 @@ void l2c_init (void)
    if (l2cb.rcv_pending_q == NULL) {
        L2CAP_TRACE_ERROR("%s unable to allocate memory for link layer control block", __func__);
    }
+
+#if BLE_INCLUDED == TRUE
+    l2ble_update_att_acl_pkt_num(L2CA_BUFF_INI, NULL);
+#endif
 }

 void l2c_free(void)
@@ -889,6 +893,9 @@ void l2c_free(void)
 #if L2C_DYNAMIC_MEMORY
    FREE_AND_RESET(l2c_cb_ptr);
 #endif
+#if BLE_INCLUDED == TRUE
+    l2ble_update_att_acl_pkt_num(L2CA_BUFF_DEINIT, NULL);
+#endif
 }

 /*******************************************************************************
--- a/components/bt/bluedroid/stack/l2cap/l2c_utils.c
+++ b/components/bt/bluedroid/stack/l2cap/l2c_utils.c
@@ -52,6 +52,16 @@ tL2C_LCB *l2cu_allocate_lcb (BD_ADDR p_bd_addr, BOOLEAN is_bonding, tBT_TRANSPOR
    int         xx;
    tL2C_LCB    *p_lcb = &l2cb.lcb_pool[0];

+#if (CLASSIC_BT_INCLUDED == TRUE)
+            /* Check if peer device's and our BD_ADDR is same or not. It
+               should be different to avoid 'Impersonation in the Pin Pairing
+               Protocol' (CVE-2020-26555) vulnerability. */
+            if (memcmp((uint8_t *)p_bd_addr, (uint8_t *)&controller_get_interface()->get_address()->address, sizeof (BD_ADDR)) == 0) {
+                L2CAP_TRACE_ERROR ("%s connection rejected due to same BD ADDR", __func__);
+                return (NULL);
+            }
+#endif
+
    for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_lcb++) {
        if (!p_lcb->in_use) {
            btu_free_timer(&p_lcb->timer_entry);
@@ -2202,7 +2212,7 @@ void l2cu_device_reset (void)
 **
 ** Description      This function initiates an acl connection via HCI
 **
-** Returns          TRUE if successful, FALSE if gki get buffer fails.
+** Returns          TRUE if successful, FALSE if osi get buffer fails.
 **
 *******************************************************************************/
 BOOLEAN l2cu_create_conn (tL2C_LCB *p_lcb, tBT_TRANSPORT transport)
@@ -2309,7 +2319,7 @@ UINT8 l2cu_get_num_hi_priority (void)
 ** Description      This function initiates an acl connection via HCI
 **                  If switch required to create connection it is already done.
 **
-** Returns          TRUE if successful, FALSE if gki get buffer fails.
+** Returns          TRUE if successful, FALSE if osi get buffer fails.
 **
 *******************************************************************************/

@@ -3488,13 +3498,12 @@ BT_HDR *l2cu_get_next_buffer_to_send (tL2C_LCB *p_lcb)
                    L2CAP_TRACE_ERROR("l2cu_get_buffer_to_send: No data to be sent");
                    return (NULL);
                }
+                l2cu_check_channel_congestion (p_ccb);
+                l2cu_set_acl_hci_header (p_buf, p_ccb);
                /* send tx complete */
                if (l2cb.fixed_reg[xx].pL2CA_FixedTxComplete_Cb) {
                    (*l2cb.fixed_reg[xx].pL2CA_FixedTxComplete_Cb)(p_ccb->local_cid, 1);
                }
-
-                l2cu_check_channel_congestion (p_ccb);
-                l2cu_set_acl_hci_header (p_buf, p_ccb);
                return (p_buf);
            }
        }
@@ -3657,7 +3666,7 @@ void l2cu_check_channel_congestion (tL2C_CCB *p_ccb)
        } else {
            tL2C_LCB *p_lcb = p_ccb->p_lcb;
            /* If this channel was not congested but it is congested now, tell the app */
-            if ((q_count > p_ccb->buff_quota) || (p_lcb && (p_ccb->local_cid == L2CAP_ATT_CID) && (p_lcb->link_xmit_quota > 0) && (p_lcb->link_xmit_quota <= p_lcb->sent_not_acked))) {
+            if (q_count > p_ccb->buff_quota || (p_lcb && (p_lcb->link_xmit_data_q) && (list_length(p_lcb->link_xmit_data_q) + q_count) > p_ccb->buff_quota)) {
                p_ccb->cong_sent = TRUE;
                if (p_ccb->p_rcb && p_ccb->p_rcb->api.pL2CA_CongestionStatus_Cb) {
                    L2CAP_TRACE_DEBUG ("L2CAP - Calling CongestionStatus_Cb (TRUE),CID:0x%04x,XmitQ:%u,Quota:%u",
--- a/components/bt/bluedroid/stack/rfcomm/port_api.c
+++ b/components/bt/bluedroid/stack/rfcomm/port_api.c
@@ -897,6 +897,75 @@ int PORT_FlowControl_MaxCredit (UINT16 handle, BOOLEAN enable)
    return (PORT_SUCCESS);
 }

+/*******************************************************************************
+**
+** Function         PORT_FlowControl_GiveCredit
+**
+** Description      This function gives specified credits to the peer
+**
+** Parameters:      handle        - Handle returned in the RFCOMM_CreateConnection
+**                  enable        - enables data flow
+**                  credits_given - credits to give
+**
+*******************************************************************************/
+int PORT_FlowControl_GiveCredit (UINT16 handle, BOOLEAN enable, UINT16 credits_given)
+{
+    tPORT      *p_port;
+    BOOLEAN    old_fc;
+    UINT32     events;
+
+    RFCOMM_TRACE_DEBUG("%s handle:%d enable: %d, cred %d", __func__, handle, enable, credits_given);
+
+    /* Check if handle is valid to avoid crashing */
+    if ((handle == 0) || (handle > MAX_RFC_PORTS)) {
+        return (PORT_BAD_HANDLE);
+    }
+
+    p_port = &rfc_cb.port.port[handle - 1];
+
+    if (!p_port->in_use || (p_port->state == PORT_STATE_CLOSED)) {
+        return (PORT_NOT_OPENED);
+    }
+
+    if (!p_port->rfc.p_mcb) {
+        return (PORT_NOT_OPENED);
+    }
+
+    p_port->rx.user_fc = !enable;
+
+    if (p_port->rfc.p_mcb->flow == PORT_FC_CREDIT) {
+        if (!p_port->rx.user_fc) {
+            port_flow_control_peer(p_port, TRUE, credits_given);
+        }
+    } else {
+        assert(0); // karl: temporarily not allowed
+        old_fc = p_port->local_ctrl.fc;
+
+        /* FC is set if user is set or peer is set */
+        p_port->local_ctrl.fc = (p_port->rx.user_fc | p_port->rx.peer_fc);
+
+        if (p_port->local_ctrl.fc != old_fc) {
+            port_start_control (p_port);
+        }
+    }
+
+    /* Need to take care of the case when we could not deliver events */
+    /* to the application because we were flow controlled */
+    if (enable && (p_port->rx.queue_size != 0)) {
+        assert(0); // karl: temporarily not allowed
+        events = PORT_EV_RXCHAR;
+        if (p_port->rx_flag_ev_pending) {
+            p_port->rx_flag_ev_pending = FALSE;
+            events |= PORT_EV_RXFLAG;
+        }
+
+        events &= p_port->ev_mask;
+        if (p_port->p_callback && events) {
+            p_port->p_callback (events, p_port->inx);
+        }
+    }
+    return (PORT_SUCCESS);
+}

 /*******************************************************************************
 **
--- a/Show More
+++ b/Show More