versions: Update version to 4.4.6

iperf: added sequential numberring of Tx'ed datagrams

See merge request espressif/esp-idf!26085

.gitlab/ci/host-test.yml

@@ -192,9 +192,17 @@ test_idf_tools:
     - export PATH=$(p=$(echo $PATH | tr ":" "\n" | grep -v "/root/.espressif/tools\|/opt/espressif" | tr "\n" ":"); echo ${p%:})
     - cd ${IDF_PATH}/tools/test_idf_tools
     - ./test_idf_tools.py
+
+test_install_python_env:
+  extends: .host_test_template
+  script:
     # Test for create virtualenv. It must be invoked from Python, not from virtualenv.
+    # Remove tools gdbgui, pygdbmi, python-socketio, jinja2, itsdangerous, pygdbmi for virtualenv test to reduce virtualenv setup time
+    # since they are not necessary for this test and are tested elsewhere
+    - sed -E -i '/(^gdbgui|^pygdbmi|^python-socketio|^jinja2|^itsdangerous|^pygdbmi)/d' $IDF_PATH/requirements.txt
     - cd ${IDF_PATH}/tools
     - python3 ./idf_tools.py install-python-env
+  timeout: 4 hours # this requires longer timeout
 
 .test_efuse_table_on_host_template:
   extends: .host_test_template
@@ -235,24 +243,6 @@ test_efuse_table_on_host_esp32h2:
   variables:
     IDF_TARGET: esp32h2
 
-test_espcoredump:
-  extends: .host_test_template
-  artifacts:
-    when: always
-    paths:
-      - components/espcoredump/test/**/.coverage
-      - components/espcoredump/test/**/output
-    expire_in: 1 week
-  variables:
-    IDF_COREDUMP_ELF_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/idf/idf-coredump-elf.git"
-    IDF_COREDUMP_ELF_TAG: idf-20210915
-    # install CMake version specified in tools.json
-    SETUP_TOOLS_LIST: "all"
-  script:
-    - retry_failed git clone ${IDF_COREDUMP_ELF_REPO} -b $IDF_COREDUMP_ELF_TAG
-    - cd ${IDF_PATH}/components/espcoredump/test/
-    - ./test_espcoredump.sh ${CI_PROJECT_DIR}/idf-coredump-elf
-
 test_logtrace_proc:
   extends: .host_test_template
   artifacts:
@@ -291,6 +281,13 @@ test_mkuf2:
     - cd ${IDF_PATH}/tools/test_mkuf2
     - ./test_mkuf2.py
 
+test_sbom:
+  extends:
+    - .host_test_template
+    - .rules:patterns:sbom
+  script:
+    - python ${IDF_PATH}/tools/test_sbom/test_submodules.py
+
 test_autocomplete:
   extends: .host_test_template
   image: $CI_DOCKER_REGISTRY/linux-shells:1

.gitlab/ci/rules.yml

@@ -48,9 +48,10 @@
   - "tools/tools.json"
   - "tools/ci/test_build_system*.sh"
 
-.patterns-custom_test: &patterns-custom_test
-  - "components/espcoredump/**/*"
+.patterns-sbom: &patterns-sbom
+  - "tools/test_sbom/*"
 
+.patterns-custom_test: &patterns-custom_test
   - "tools/ci/python_packages/gitlab_api.py"
   - "tools/ci/python_packages/tiny_test_fw/**/*"
   - "tools/ci/python_packages/ttfw_idf/**/*"
@@ -258,6 +259,14 @@
     - <<: *if-dev-push
       changes: *patterns-sonarqube-files
 
+.rules:patterns:sbom:
+  rules:
+    - <<: *if-protected
+    - <<: *if-dev-push
+      changes: *patterns-sbom
+    - <<: *if-dev-push
+      changes: *patterns-submodule
+
 # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 # DO NOT place comments or maintain any code from this line
 #

.gitlab/ci/target-test.yml

@@ -96,6 +96,12 @@ example_test_001B:
     - ESP32
     - Example_EthKitV1
 
+example_test_httpbin:
+  extends: .example_test_esp32_template
+  tags:
+    - ESP32
+    - httpbin
+
 example_test_001B_V3:
   extends: .example_test_esp32_template
   tags:
@@ -368,6 +374,12 @@ test_app_test_005:
     - ESP32C3
     - Example_GENERIC
 
+test_app_test_006:
+  extends: .test_app_esp32s3_template
+  tags:
+    - ESP32S3
+    - Example_GENERIC
+
 test_app_test_esp32_generic:
   extends: .test_app_esp32_template
   parallel: 5

.gitmodules

@@ -2,6 +2,26 @@
 # All the relative URL paths are intended to be GitHub ones
 # For Espressif's public projects please use '../../espressif/proj', not a '../proj'
 #
+# Submodules SBOM information
+# ---------------------------
+# Submodules, which are used directly and not forked into espressif namespace should
+# contain SBOM information here. Other submodules should have the SBOM manifest file
+# included in the root of their project's repository.
+#
+# The sbom-hash entry records the submodule's checkout SHA as presented in git-tree
+# commit object. For example spiffs submodule
+#
+# $ git ls-tree HEAD components/spiffs/spiffs
+# 160000 commit 0dbb3f71c5f6fae3747a9d935372773762baf852	components/spiffs/spiffs
+#
+# The hash can be also obtained with git submodule command
+#
+# $ git submodule status components/spiffs/spiffs
+# 0dbb3f71c5f6fae3747a9d935372773762baf852 components/spiffs/spiffs (0.2-255-g0dbb3f71c5f6)
+#
+# The submodule SHA recorded here has to match with SHA, which is presented in git-tree.
+# This is checked by CI. Also please don't forget to update the submodule version
+# if you are changing the sbom-hash. This is important for SBOM generation.
 
 [submodule "components/esptool_py/esptool"]
 	path = components/esptool_py/esptool
@@ -14,6 +34,12 @@
 [submodule "components/bootloader/subproject/components/micro-ecc/micro-ecc"]
 	path = components/bootloader/subproject/components/micro-ecc/micro-ecc
 	url = ../../kmackay/micro-ecc.git
+	sbom-version = 1.0
+	sbom-cpe = cpe:2.3:a:micro-ecc_project:micro-ecc:{}:*:*:*:*:*:*:*
+	sbom-supplier = Person: Ken MacKay
+	sbom-url = https://github.com/kmackay/micro-ecc
+	sbom-description = A small and fast ECDH and ECDSA implementation for 8-bit, 32-bit, and 64-bit processors
+	sbom-hash = d037ec89546fad14b5c4d5456c2e23a71e554966
 
 [submodule "components/coap/libcoap"]
 	path = components/coap/libcoap
@@ -30,10 +56,21 @@
 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
 	url = ../../pellepl/spiffs.git
+	sbom-version = 0.2-255-g0dbb3f71c5f6
+	sbom-supplier = Person: Peter Andersson
+	sbom-url = https://github.com/pellepl/spiffs
+	sbom-description = Wear-leveled SPI flash file system for embedded devices
+	sbom-hash = 0dbb3f71c5f6fae3747a9d935372773762baf852
 
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
+	sbom-version = 1.7.15
+	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
+	sbom-supplier = Person: Dave Gamble
+	sbom-url = https://github.com/DaveGamble/cJSON
+	sbom-description = Ultralightweight JSON parser in ANSI C
+	sbom-hash = d348621ca93571343a56862df7de4ff3bc9b5667
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
@@ -58,10 +95,21 @@
 [submodule "components/protobuf-c/protobuf-c"]
 	path = components/protobuf-c/protobuf-c
 	url = ../../protobuf-c/protobuf-c.git
+	sbom-version = 1.4.1
+	sbom-cpe = cpe:2.3:a:protobuf-c_project:protobuf-c:{}:*:*:*:*:*:*:*
+	sbom-supplier = Organization: protobuf-c community <https://groups.google.com/g/protobuf-c>
+	sbom-url = https://github.com/protobuf-c/protobuf-c
+	sbom-description = Protocol Buffers implementation in C
+	sbom-hash = abc67a11c6db271bedbb9f58be85d6f4e2ea8389
 
 [submodule "components/unity/unity"]
 	path = components/unity/unity
 	url = ../../ThrowTheSwitch/Unity.git
+	sbom-version = v2.4.3-51-g7d2bf62b7e6a
+	sbom-supplier = Organization: ThrowTheSwitch community <http://www.throwtheswitch.org>
+	sbom-url = https://github.com/ThrowTheSwitch/Unity
+	sbom-description = Simple Unit Testing for C
+	sbom-hash = 7d2bf62b7e6afaf38153041a9d53c21aeeca9a25
 
 [submodule "examples/build_system/cmake/import_lib/main/lib/tinyxml2"]
 	path = examples/build_system/cmake/import_lib/main/lib/tinyxml2
@@ -90,6 +138,11 @@
 [submodule "components/cmock/CMock"]
 	path = components/cmock/CMock
 	url = ../../ThrowTheSwitch/CMock.git
+	sbom-version = v2.5.2-2-geeecc49ce8af
+	sbom-supplier = Organization: ThrowTheSwitch community <http://www.throwtheswitch.org>
+	sbom-url = https://github.com/ThrowTheSwitch/CMock
+	sbom-description = CMock - Mock/stub generator for C
+	sbom-hash = eeecc49ce8af123cf8ad40efdb9673e37b56230f
 
 [submodule "components/openthread/openthread"]
 	path = components/openthread/openthread

components/app_trace/CMakeLists.txt

@@ -50,10 +50,12 @@ idf_component_register(SRCS "${srcs}"
                        PRIV_REQUIRES soc esp_ipc
                        LDFRAGMENTS linker.lf)
 
-# disable --coverage for this component, as it is used as transport
-# for gcov
-target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
-
-# Force app_trace to also appear later than gcov in link line
-idf_component_get_property(app_trace app_trace COMPONENT_LIB)
-target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+if(CONFIG_APPTRACE_GCOV_ENABLE)
+    # disable --coverage for this component, as it is used as transport
+    # for gcov
+    target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
+    # Force app_trace to appear later than gcov in link line
+    idf_component_get_property(app_trace app_trace COMPONENT_LIB)
+    target_link_libraries(${COMPONENT_LIB} INTERFACE
+        "-Wl,--undefined=gcov_rtio_atexit" $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+endif()

components/bootloader_support/src/bootloader_init.c

@@ -94,4 +94,12 @@ void bootloader_print_banner(void)
 {
     ESP_LOGI(TAG, "ESP-IDF %s 2nd stage bootloader", IDF_VER);
     ESP_LOGI(TAG, "compile time " __TIME__);
+
+#if CONFIG_FREERTOS_UNICORE
+#if (SOC_CPU_CORES_NUM > 1)
+    ESP_EARLY_LOGW(TAG, "Unicore bootloader");
+#endif
+#else
+    ESP_EARLY_LOGI(TAG, "Multicore bootloader");
+#endif
 }

components/bootloader_support/src/esp32/bootloader_soc.c

@@ -3,18 +3,10 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  */
+
 #include <stdbool.h>
 
-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    (void)enable;
-}
-
-void bootloader_ana_bod_reset_config(bool enable)
-{
-    (void)enable;
-}
-
+//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
     (void)enable;

components/bootloader_support/src/esp32c3/bootloader_esp32c3.c

@@ -268,29 +268,29 @@ static inline void bootloader_hardware_init(void)
 
 static inline void bootloader_ana_reset_config(void)
 {
+    //Enable super WDT reset.
+    bootloader_ana_super_wdt_reset_config(true);
+
     /*
-      For origin chip & ECO1: only support swt reset;
-      For ECO2: fix brownout reset bug, support swt & brownout reset;
-      For ECO3: fix clock glitch reset bug, support all reset, include: swt & brownout & clock glitch reset.
+      For origin chip & ECO1: brownout & clock glitch reset not available
+      For ECO2: fix brownout reset bug
+      For ECO3: fix clock glitch reset bug
     */
     switch (efuse_hal_chip_revision()) {
         case 0:
         case 1:
-            //Enable WDT reset. Disable BOR and GLITCH reset
-            bootloader_ana_super_wdt_reset_config(true);
+            //Disable BOD and GLITCH reset
             bootloader_ana_bod_reset_config(false);
             bootloader_ana_clock_glitch_reset_config(false);
             break;
         case 2:
-            //Enable WDT and BOR reset. Disable GLITCH reset
-            bootloader_ana_super_wdt_reset_config(true);
+            //Enable BOD reset. Disable GLITCH reset
             bootloader_ana_bod_reset_config(true);
             bootloader_ana_clock_glitch_reset_config(false);
             break;
         case 3:
         default:
-            //Enable WDT, BOR, and GLITCH reset
-            bootloader_ana_super_wdt_reset_config(true);
+            //Enable BOD, and GLITCH reset
             bootloader_ana_bod_reset_config(true);
             bootloader_ana_clock_glitch_reset_config(true);
             break;

components/bootloader_support/src/esp32c3/bootloader_soc.c

@@ -12,15 +12,15 @@ void bootloader_ana_super_wdt_reset_config(bool enable)
     REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);
 
     if (enable) {
-        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    } else {
         REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    } else {
+        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
     }
 }
 
 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOR_RST);
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOD_RST);
 
     if (enable) {
         REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);

components/bootloader_support/src/esp32s2/bootloader_soc.c

@@ -3,18 +3,10 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  */
+
 #include <stdbool.h>
 
-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    (void)enable;
-}
-
-void bootloader_ana_bod_reset_config(bool enable)
-{
-    (void)enable;
-}
-
+//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
     (void)enable;

components/bootloader_support/src/esp32s3/bootloader_esp32s3.c

@@ -322,7 +322,7 @@ static void bootloader_super_wdt_auto_feed(void)
 
 static inline void bootloader_ana_reset_config(void)
 {
-    //Enable WDT, BOR, and GLITCH reset
+    //Enable WDT, BOD, and GLITCH reset
     bootloader_ana_super_wdt_reset_config(true);
     bootloader_ana_bod_reset_config(true);
     bootloader_ana_clock_glitch_reset_config(true);

components/bootloader_support/src/esp32s3/bootloader_soc.c

@@ -12,15 +12,15 @@ void bootloader_ana_super_wdt_reset_config(bool enable)
     REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);
 
     if (enable) {
-        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    } else {
         REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    } else {
+        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
     }
 }
 
 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOR_RST);
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOD_RST);
 
     if (enable) {
         REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);

components/bt/CMakeLists.txt

@@ -299,6 +299,7 @@ if(CONFIG_BT_ENABLED)
                    "host/bluedroid/stack/gatt/gatt_db.c"
                    "host/bluedroid/stack/gatt/gatt_main.c"
                    "host/bluedroid/stack/gatt/gatt_sr.c"
+                   "host/bluedroid/stack/gatt/gatt_sr_hash.c"
                    "host/bluedroid/stack/gatt/gatt_utils.c"
                    "host/bluedroid/stack/hcic/hciblecmds.c"
                    "host/bluedroid/stack/hcic/hcicmds.c"

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -432,7 +432,7 @@ void esp_blufi_send_notify(void *arg)
         return;
     }
     int rc = 0;
-    rc = ble_gatts_notify_custom(blufi_env.conn_id, gatt_values[1].val_handle, om);
+    rc = ble_gattc_notify_custom(conn_handle, gatt_values[1].val_handle, om);
     if (rc != 0) {
         ESP_LOGE(TAG, "Error in sending notification");
     }

components/bt/controller/esp32/bt.c

@@ -908,7 +908,11 @@ static void *malloc_internal_wrapper(size_t size)
 
 static int32_t IRAM_ATTR read_mac_wrapper(uint8_t mac[6])
 {
-    return esp_read_mac(mac, ESP_MAC_BT);
+    int ret = esp_read_mac(mac, ESP_MAC_BT);
+    ESP_LOGI(BTDM_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
+               mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+
+    return ret;
 }
 
 static void IRAM_ATTR srand_wrapper(unsigned int seed)

components/bt/controller/esp32c3/Kconfig.in

@@ -78,15 +78,29 @@ config BT_CTRL_ADV_DUP_FILT_MAX
     help
         The maxinum number of suplicate scan filter
 
-config BT_CTRL_HW_CCA
-    bool "HW CCA check enable"
-    default n
+choice BT_BLE_CCA_MODE
+    prompt "BLE CCA mode"
+    default BT_BLE_CCA_MODE_NONE
     help
-        It enables HW CCA feature in controller
+        Define BT BLE CCA mode
+
+    config BT_BLE_CCA_MODE_NONE
+        bool "NONE"
+    config BT_BLE_CCA_MODE_HW
+        bool "Hardware"
+    config BT_BLE_CCA_MODE_SW
+        bool "Software"
+endchoice
+
+config BT_BLE_CCA_MODE
+    int
+    default 0 if BT_BLE_CCA_MODE_NONE
+    default 1 if BT_BLE_CCA_MODE_HW
+    default 2 if BT_BLE_CCA_MODE_SW
 
 config BT_CTRL_HW_CCA_VAL
     int "CCA threshold value"
-    range 20 60
+    range 20 100
     default 20
     help
         It is the threshold value of HW CCA, if the value is 30, it means CCA threshold is -30 dBm.
@@ -390,7 +404,7 @@ menu "MODEM SLEEP Options"
                 than other bluetooth low power clock sources.
         config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
             bool "External 32kHz crystal"
-            depends on ESP32C3_RTC_CLK_SRC_EXT_CRYS
+            depends on (ESP32C3_RTC_CLK_SRC_EXT_CRYS || ESP32S3_RTC_CLK_SRC_EXT_CRYS)
             help
                 External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
                 stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
@@ -398,7 +412,7 @@ menu "MODEM SLEEP Options"
 
         config BT_CTRL_LPCLK_SEL_RTC_SLOW
             bool "Internal 150kHz RC oscillator"
-            depends on ESP32C3_RTC_CLK_SRC_INT_RC
+            depends on (ESP32C3_RTC_CLK_SRC_INT_RC || ESP32S3_RTC_CLK_SRC_INT_RC)
             help
                 Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                 in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.

components/bt/controller/esp32c3/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -110,7 +110,7 @@ do{\
 } while(0)
 
 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010006
+#define OSI_VERSION              0x00010007
 #define OSI_MAGIC_VALUE          0xFADEBEAD
 
 /* Types definition
@@ -192,6 +192,8 @@ struct osi_funcs_t {
     void (* _esp_hw_power_down)(void);
     void (* _esp_hw_power_up)(void);
     void (* _ets_backup_dma_copy)(uint32_t reg, uint32_t mem_addr, uint32_t num, bool to_rem);
+    void (* _ets_delay_us)(uint32_t us);
+    void (* _btdm_rom_table_ready)(void);
 };
 
 
@@ -251,6 +253,8 @@ extern void esp_mac_bb_power_up(void);
 extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, bool to_mem);
 #endif
 
+extern void btdm_cca_feature_enable(void);
+
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
 extern uint32_t _btdm_bss_start;
@@ -310,6 +314,7 @@ static void interrupt_off_wrapper(int intr_num);
 static void btdm_hw_mac_power_up_wrapper(void);
 static void btdm_hw_mac_power_down_wrapper(void);
 static void btdm_backup_dma_copy_wrapper(uint32_t reg, uint32_t mem_addr, uint32_t num,  bool to_mem);
+static void btdm_funcs_table_ready_wrapper(void);
 
 static void btdm_slp_tmr_callback(void *arg);
 
@@ -374,6 +379,8 @@ static const struct osi_funcs_t osi_funcs_ro = {
     ._esp_hw_power_down = btdm_hw_mac_power_down_wrapper,
     ._esp_hw_power_up = btdm_hw_mac_power_up_wrapper,
     ._ets_backup_dma_copy = btdm_backup_dma_copy_wrapper,
+    ._ets_delay_us = esp_rom_delay_us,
+    ._btdm_rom_table_ready = btdm_funcs_table_ready_wrapper,
 };
 
 static DRAM_ATTR struct osi_funcs_t *osi_funcs_p;
@@ -912,6 +919,13 @@ static void async_wakeup_request_end(int event)
     return;
 }
 
+static void btdm_funcs_table_ready_wrapper(void)
+{
+#if BT_BLE_CCA_MODE == 2
+    btdm_cca_feature_enable();
+#endif
+}
+
 static void coex_schm_status_bit_set_wrapper(uint32_t type, uint32_t status)
 {
 #if CONFIG_SW_COEXIST_ENABLE
@@ -1340,14 +1354,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
-    esp_phy_enable();
-    s_lp_stat.phy_enabled = 1;
-
     if (btdm_controller_init(cfg) != 0) {
         err = ESP_ERR_NO_MEM;
         goto error;
     }
-    coex_pti_v2();
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
@@ -1377,11 +1387,6 @@ static void bt_controller_deinit_internal(void)
 {
     periph_module_disable(PERIPH_BT_MODULE);
 
-    if (s_lp_stat.phy_enabled) {
-        esp_phy_disable();
-        s_lp_stat.phy_enabled = 0;
-    }
-
     // deinit low power control resources
     do {
 
@@ -1475,6 +1480,12 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
         return ESP_ERR_INVALID_ARG;
     }
 
+    /* Enable PHY when enabling controller to reduce power dissipation after controller init
+     * Notice the init order: esp_phy_enable() -> bt_bb_v2_init_cmplx() -> coex_pti_v2()
+     */
+    esp_phy_enable();
+    s_lp_stat.phy_enabled = 1;
+
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif
@@ -1499,6 +1510,8 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
         goto error;
     }
 
+    coex_pti_v2();
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_ENABLED;
 
     return ret;
@@ -1521,6 +1534,10 @@ error:
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
+    if (s_lp_stat.phy_enabled) {
+        esp_phy_disable();
+        s_lp_stat.phy_enabled = 0;
+    }
     return ret;
 }
 
@@ -1539,6 +1556,10 @@ esp_err_t esp_bt_controller_disable(void)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
+    if (s_lp_stat.phy_enabled) {
+        esp_phy_disable();
+        s_lp_stat.phy_enabled = 0;
+    }
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 

components/bt/esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c

@@ -1615,6 +1615,7 @@ static void bt_mesh_bta_gattc_cb(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
         }
         break;
     case BTA_GATTC_CLOSE_EVT:
+        bta_gattc_clcb_dealloc_by_conn_id(p_data->close.conn_id);
         BT_DBG("BTA_GATTC_CLOSE_EVT");
         break;
     case BTA_GATTC_CONNECT_EVT: {

components/bt/host/bluedroid/Kconfig.in

@@ -200,6 +200,27 @@ config BT_GATTS_SEND_SERVICE_CHANGE_MODE
     default 1 if BT_GATTS_SEND_SERVICE_CHANGE_MANUAL
     default 0
 
+config BT_GATTS_ROBUST_CACHING_ENABLED
+    bool "Enable Robust Caching on Server Side"
+    depends on BT_GATTS_ENABLE
+    default n
+    help
+        This option enable gatt robust caching feature on server
+
+config BT_GATTS_DEVICE_NAME_WRITABLE
+    bool "Allow to write device name by GATT clients"
+    depends on BT_GATTS_ENABLE
+    default n
+    help
+        Enabling this option allows remote GATT clients to write device name
+
+config BT_GATTS_APPEARANCE_WRITABLE
+    bool "Allow to write appearance by GATT clients"
+    depends on BT_GATTS_ENABLE
+    default n
+    help
+        Enabling this option allows remote GATT clients to write appearance
+
 config BT_GATTC_ENABLE
     bool "Include GATT client module(GATTC)"
     depends on BT_BLE_ENABLED
@@ -1085,6 +1106,15 @@ config BT_BLE_RPA_SUPPORTED
         For BLE other chips, devices support network privacy mode and device privacy mode, users can switch the
         two modes according to their own needs. So this option is enabled by default.
 
+config BT_BLE_RPA_TIMEOUT
+    int "Timeout of resolvable private address"
+    depends on BT_BLUEDROID_ENABLED
+    range 1 3600
+    default 900
+    help
+        This set RPA timeout of Controller and Host.
+        Default is 900 s (15 minutes). Range is 1 s to 1 hour (3600 s).
+
 config BT_BLE_50_FEATURES_SUPPORTED
     bool "Enable BLE 5.0 features"
     depends on (BT_BLUEDROID_ENABLED && (IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3))
@@ -1098,3 +1128,24 @@ config BT_BLE_42_FEATURES_SUPPORTED
     default n
     help
         This enables BLE 4.2 features.
+
+config BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
+    bool "Enable BLE periodic advertising sync transfer feature"
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && SOC_ESP_NIMBLE_CONTROLLER)
+    default n
+    help
+        This enables BLE periodic advertising sync transfer feature
+
+config BT_BLE_FEAT_PERIODIC_ADV_ENH
+    bool "Enable periodic adv enhancements(adi support)"
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && SOC_ESP_NIMBLE_CONTROLLER)
+    default n
+    help
+        Enable the periodic advertising enhancements
+
+config BT_BLE_HIGH_DUTY_ADV_INTERVAL
+    bool "Enable BLE high duty advertising interval feature"
+    depends on BT_BLUEDROID_ENABLED
+    default n
+    help
+        This enable BLE high duty advertising interval feature

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 #include "esp_bt_device.h"
@@ -146,7 +138,7 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
     if (ESP_BLE_IS_VALID_PARAM(params->min_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(params->max_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(params->timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-        (params->latency <= ESP_BLE_CONN_LATENCY_MAX || params->latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+        (params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
         ((params->timeout * 10) >= ((1 + params->latency) * ((params->max_int * 5) >> 1))) && params->min_int <= params->max_int) {
 
         msg.sig = BTC_SIG_API_CALL;
@@ -362,7 +354,7 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
     if (ESP_BLE_IS_VALID_PARAM(min_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(max_conn_int, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
         ESP_BLE_IS_VALID_PARAM(supervision_tout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX || slave_latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+        (slave_latency <= ESP_BLE_CONN_LATENCY_MAX) &&
         ((supervision_tout * 10) >= ((1 + slave_latency) * ((max_conn_int * 5) >> 1))) && min_conn_int <= max_conn_int) {
 
         msg.sig = BTC_SIG_API_CALL;
@@ -439,8 +431,7 @@ esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_l
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (raw_data == NULL
-            || (raw_data_len <= 0 || raw_data_len > ESP_BLE_ADV_DATA_LEN_MAX)) {
+    if ((raw_data_len != 0 && raw_data == NULL) || raw_data_len > ESP_BLE_ADV_DATA_LEN_MAX) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -738,6 +729,38 @@ esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len)
                 btc_gap_ble_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_ble_sc_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t p_c[16], uint8_t p_r[16])
+{
+    if (!p_c || !p_r) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    btc_msg_t msg = {0};
+    btc_ble_gap_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT;
+    memcpy(arg.sc_oob_req_reply.bd_addr, bd_addr, ESP_BD_ADDR_LEN);
+    arg.sc_oob_req_reply.p_c = p_c;
+    arg.sc_oob_req_reply.p_r = p_r;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy,
+                btc_gap_ble_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_create_sc_oob_data(void)
+{
+    btc_msg_t msg = {0};
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SC_CR_OOB_DATA_EVT;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
 #endif /* #if (SMP_INCLUDED == TRUE) */
 
 esp_err_t esp_ble_gap_disconnect(esp_bd_addr_t remote_device)
@@ -1029,8 +1052,13 @@ esp_err_t esp_ble_gap_periodic_adv_set_params(uint8_t instance, const esp_ble_ga
 
 }
 
+#if (CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH)
+esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t length,
+                                                                           const uint8_t *data, bool only_update_did)
+#else
 esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t length,
                                                                            const uint8_t *data)
+#endif
 {
     btc_msg_t msg;
     btc_ble_5_gap_args_t arg;
@@ -1044,13 +1072,22 @@ esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t le
     arg.periodic_adv_cfg_data.instance = instance;
     arg.periodic_adv_cfg_data.len = length;
     arg.periodic_adv_cfg_data.data = (uint8_t *)data;
+#if (CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH)
+    arg.periodic_adv_cfg_data.only_update_did = only_update_did;
+#else
+    arg.periodic_adv_cfg_data.only_update_did = false;
+#endif
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), btc_gap_ble_arg_deep_copy,
                 btc_gap_ble_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 
 }
 
+#if (CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH)
+esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance,bool include_adi)
+#else
 esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance)
+#endif
 {
     btc_msg_t msg;
     btc_ble_5_gap_args_t arg;
@@ -1061,6 +1098,11 @@ esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance)
     msg.pid = BTC_PID_GAP_BLE;
     msg.act = BTC_GAP_BLE_PERIODIC_ADV_START;
 
+    #if (CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH)
+    arg.periodic_adv_start.include_adi = include_adi;
+    #else
+    arg.periodic_adv_start.include_adi = false;
+    #endif
     arg.periodic_adv_start.instance = instance;
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL)
@@ -1275,7 +1317,7 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
         if (ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_1m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-            (phy_1m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX || phy_1m_conn_params->latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+            (phy_1m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
             ((phy_1m_conn_params->supervision_timeout * 10) >= ((1 + phy_1m_conn_params->latency) * ((phy_1m_conn_params->interval_max * 5) >> 1))) &&
             (phy_1m_conn_params->interval_min <= phy_1m_conn_params->interval_max)) {
 
@@ -1299,7 +1341,7 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
         if (ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_2m_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-            (phy_2m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX || phy_2m_conn_params->latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+            (phy_2m_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
             ((phy_2m_conn_params->supervision_timeout * 10) >= ((1 + phy_2m_conn_params->latency) * ((phy_2m_conn_params->interval_max * 5) >> 1))) &&
             (phy_2m_conn_params->interval_min <= phy_2m_conn_params->interval_max)) {
 
@@ -1323,7 +1365,7 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
         if (ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
             ESP_BLE_IS_VALID_PARAM(phy_coded_conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
-            (phy_coded_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX || phy_coded_conn_params->latency == ESP_BLE_CONN_PARAM_UNDEF) &&
+            (phy_coded_conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
             ((phy_coded_conn_params->supervision_timeout * 10) >= ((1 + phy_coded_conn_params->latency) * ((phy_coded_conn_params->interval_max * 5) >> 1))) &&
             (phy_coded_conn_params->interval_min <= phy_coded_conn_params->interval_max)) {
 
@@ -1347,3 +1389,95 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
 }
 
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+esp_err_t esp_ble_gap_periodic_adv_recv_enable(uint16_t sync_handle, uint8_t enable)
+{
+    btc_msg_t msg;
+    btc_ble_5_gap_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_PERIODIC_ADV_RECV_ENABLE;
+
+    arg.periodic_adv_recv_en.sync_handle = sync_handle;
+    arg.periodic_adv_recv_en.enable = enable;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_gap_periodic_adv_sync_trans(esp_bd_addr_t addr, uint16_t service_data, uint16_t sync_handle)
+{
+    btc_msg_t msg;
+    btc_ble_5_gap_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    if (addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_PERIODIC_ADV_SYNC_TRANS;
+
+    memcpy(arg.periodic_adv_sync_trans.addr, addr, sizeof(esp_bd_addr_t));
+    arg.periodic_adv_sync_trans.service_data = service_data;
+    arg.periodic_adv_sync_trans.sync_handle = sync_handle;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_gap_periodic_adv_set_info_trans(esp_bd_addr_t addr, uint16_t service_data, uint8_t adv_handle)
+{
+    btc_msg_t msg;
+    btc_ble_5_gap_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    if (addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS;
+
+    memcpy(arg.periodic_adv_set_info_trans.addr, addr, sizeof(esp_bd_addr_t));
+    arg.periodic_adv_set_info_trans.service_data = service_data;
+    arg.periodic_adv_set_info_trans.adv_handle = adv_handle;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_gap_set_periodic_adv_sync_trans_params(esp_bd_addr_t addr, const esp_ble_gap_past_params_t *params)
+{
+    btc_msg_t msg;
+    btc_ble_5_gap_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    if (params == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS;
+
+    if (addr) {
+        memcpy(arg.set_periodic_adv_sync_trans_params.addr, addr, sizeof(esp_bd_addr_t));
+    } else {
+        memset(arg.set_periodic_adv_sync_trans_params.addr, 0, sizeof(esp_bd_addr_t));
+    }
+    memcpy(&arg.set_periodic_adv_sync_trans_params.params, params, sizeof(esp_ble_gap_past_params_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)

components/bt/host/bluedroid/api/esp_gattc_api.c

@@ -447,6 +447,41 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if,
+                                      uint16_t conn_id, esp_gattc_multi_t *read_multi,
+                                      esp_gatt_auth_req_t auth_req)
+{
+    btc_msg_t msg = {0};
+    btc_ble_gattc_args_t arg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    tGATT_TCB       *p_tcb = gatt_get_tcb_by_idx(conn_id);
+    if (!gatt_check_connection_state_by_tcb(p_tcb)) {
+        LOG_WARN("%s, The connection not created.", __func__);
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    if (L2CA_CheckIsCongest(L2CAP_ATT_CID, p_tcb->peer_bda)) {
+        LOG_DEBUG("%s, the l2cap chanel is congest.", __func__);
+        return ESP_FAIL;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GATTC;
+    msg.act = BTC_GATTC_ACT_READ_MULTIPLE_VARIABLE_CHAR;
+    arg.read_multiple.conn_id = BTC_GATT_CREATE_CONN_ID(gattc_if, conn_id);
+    arg.read_multiple.num_attr = read_multi->num_attr;
+    arg.read_multiple.auth_req = auth_req;
+
+    if (read_multi->num_attr > 0) {
+        memcpy(arg.read_multiple.handles, read_multi->handles, sizeof(uint16_t)*read_multi->num_attr);
+    } else {
+        LOG_ERROR("%s(), the num_attr should not be 0.", __func__);
+        return ESP_FAIL;
+    }
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
 
 esp_err_t esp_ble_gattc_read_char_descr (esp_gatt_if_t gattc_if,
                                          uint16_t conn_id, uint16_t handle,

components/bt/host/bluedroid/api/esp_gatts_api.c

@@ -421,4 +421,17 @@ static esp_err_t esp_ble_gatts_add_char_desc_param_check(esp_attr_value_t *char_
     return ESP_OK;
 }
 
+esp_err_t esp_ble_gatts_show_local_database(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GATTS;
+    msg.act = BTC_GATTS_ACT_SHOW_LOCAL_DATABASE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 #endif  ///GATTS_INCLUDED

components/bt/host/bluedroid/api/include/api/esp_bt_defs.h

@@ -55,7 +55,6 @@ typedef enum {
     ESP_BT_STATUS_MEMORY_FULL   = 20,           /* relate to BT_STATUS_MEMORY_FULL in bt_def.h */
     ESP_BT_STATUS_EIR_TOO_LARGE,                /* relate to BT_STATUS_EIR_TOO_LARGE in bt_def.h */
     ESP_BT_STATUS_HCI_SUCCESS   = ESP_BT_STATUS_BASE_FOR_HCI_ERR,
-    ESP_BT_STATUS_HCI_PENDING,
     ESP_BT_STATUS_HCI_ILLEGAL_COMMAND,
     ESP_BT_STATUS_HCI_NO_CONNECTION,
     ESP_BT_STATUS_HCI_HW_FAILURE,
@@ -134,18 +133,20 @@ typedef uint8_t esp_link_key[ESP_BT_OCTET16_LEN];      /* Link Key */
 /// Default GATT interface id
 #define ESP_DEFAULT_GATT_IF             0xff
 
+#if BLE_HIGH_DUTY_ADV_INTERVAL
+#define ESP_BLE_PRIM_ADV_INT_MIN            0x000008     /*!< Minimum advertising interval for undirected and low duty cycle directed advertising */
+#else
 #define ESP_BLE_PRIM_ADV_INT_MIN            0x000020     /*!< Minimum advertising interval for undirected and low duty cycle directed advertising */
+#endif
 #define ESP_BLE_PRIM_ADV_INT_MAX            0xFFFFFF     /*!< Maximum advertising interval for undirected and low duty cycle directed advertising */
 #define ESP_BLE_CONN_INT_MIN                0x0006       /*!< relate to BTM_BLE_CONN_INT_MIN in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_INT_MAX                0x0C80       /*!< relate to BTM_BLE_CONN_INT_MAX in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_LATENCY_MAX            499          /*!< relate to ESP_BLE_CONN_LATENCY_MAX in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MIN           0x000A       /*!< relate to BTM_BLE_CONN_SUP_TOUT_MIN in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MAX           0x0C80       /*!< relate to ESP_BLE_CONN_SUP_TOUT_MAX in stack/btm_ble_api.h */
-#define ESP_BLE_CONN_PARAM_UNDEF            0xffff       /* use this value when a specific value not to be overwritten */ /* relate to ESP_BLE_CONN_PARAM_UNDEF in stack/btm_ble_api.h */
-#define ESP_BLE_SCAN_PARAM_UNDEF            0xffffffff   /* relate to ESP_BLE_SCAN_PARAM_UNDEF in stack/btm_ble_api.h */
 
 /// Check the param is valid or not
-#define ESP_BLE_IS_VALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)) || ((x) == ESP_BLE_CONN_PARAM_UNDEF))
+#define ESP_BLE_IS_VALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)) )
 
 /// UUID type
 typedef struct {
@@ -175,10 +176,10 @@ typedef uint8_t esp_bd_addr_t[ESP_BD_ADDR_LEN];
 
 /// BLE device address type
 typedef enum {
-    BLE_ADDR_TYPE_PUBLIC        = 0x00,
-    BLE_ADDR_TYPE_RANDOM        = 0x01,
-    BLE_ADDR_TYPE_RPA_PUBLIC    = 0x02,
-    BLE_ADDR_TYPE_RPA_RANDOM    = 0x03,
+    BLE_ADDR_TYPE_PUBLIC        = 0x00,     /*!< Public Device Address */
+    BLE_ADDR_TYPE_RANDOM        = 0x01,     /*!< Random Device Address. To set this address, use the function esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr) */
+    BLE_ADDR_TYPE_RPA_PUBLIC    = 0x02,     /*!< Resolvable Private Address (RPA) with public identity address */
+    BLE_ADDR_TYPE_RPA_RANDOM    = 0x03,     /*!< Resolvable Private Address (RPA) with random identity address. To set this address, use the function esp_ble_gap_set_rand_addr(esp_bd_addr_t rand_addr) */
 } esp_ble_addr_type_t;
 
 /// white list address type

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #ifndef __ESP_GAP_BLE_API_H__
 #define __ESP_GAP_BLE_API_H__
@@ -141,7 +133,7 @@ typedef enum {
     ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT,                /*!< When scan parameters set complete, the event comes */
     ESP_GAP_BLE_SCAN_RESULT_EVT,                            /*!< When one scan result ready, the event comes each time */
     ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT,              /*!< When raw advertising data set complete, the event comes */
-    ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT,         /*!< When raw advertising data set complete, the event comes */
+    ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT,         /*!< When raw scan response data set complete, the event comes */
     ESP_GAP_BLE_ADV_START_COMPLETE_EVT,                     /*!< When start advertising complete, the event comes */
     ESP_GAP_BLE_SCAN_START_COMPLETE_EVT,                    /*!< When start scan complete, the event comes */
     //BLE_INCLUDED
@@ -210,6 +202,12 @@ typedef enum {
     ESP_GAP_BLE_SC_OOB_REQ_EVT,                                  /*!< Secure Connection OOB request event */
     ESP_GAP_BLE_SC_CR_LOC_OOB_EVT,                               /*!< Secure Connection create OOB data complete event */
     ESP_GAP_BLE_GET_DEV_NAME_COMPLETE_EVT,                       /*!< When getting BT device name complete, the event comes */
+    //BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
+    ESP_GAP_BLE_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT,           /*!< when set periodic advertising receive enable complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT,            /*!< when periodic advertising sync transfer complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT,        /*!< when periodic advertising set info transfer complete, the event comes */
+    ESP_GAP_BLE_SET_PAST_PARAMS_COMPLETE_EVT,                    /*!< when set periodic advertising sync transfer params complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT,                /*!< when periodic advertising sync transfer received, the event comes */
     ESP_GAP_BLE_EVT_MAX,                                         /*!< when maximum advertising event complete, the event comes */
 } esp_gap_ble_cb_event_t;
 
@@ -594,6 +592,13 @@ typedef struct {
     esp_bt_octet16_t       dhk;                 /*!< the 16 bits of the dh key value */
 } esp_ble_local_id_keys_t;                      /*!< the structure of the ble local id keys value type*/
 
+/**
+* @brief  structure type of the ble local oob data value
+*/
+typedef struct {
+    esp_bt_octet16_t        oob_c;              /*!< the 128 bits of confirmation value */
+    esp_bt_octet16_t        oob_r;              /*!< the 128 bits of randomizer value */
+} esp_ble_local_oob_data_t;
 
 /**
   * @brief Structure associated with ESP_AUTH_CMPL_EVT
@@ -620,6 +625,7 @@ typedef union
     esp_ble_sec_req_t          ble_req;        /*!< BLE SMP related request */
     esp_ble_key_t              ble_key;        /*!< BLE SMP keys used when pairing */
     esp_ble_local_id_keys_t    ble_id_keys;    /*!< BLE IR event */
+    esp_ble_local_oob_data_t   oob_data;       /*!< BLE SMP secure connection OOB data */
     esp_ble_auth_cmpl_t        auth_cmpl;      /*!< Authentication complete indication. */
 } esp_ble_sec_t;                               /*!< BLE security type */
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
@@ -911,6 +917,25 @@ typedef struct {
 
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+/// Periodic advertising sync trans mode
+#define ESP_BLE_GAP_PAST_MODE_NO_SYNC_EVT                 (0x00) /*!< No attempt is made to sync and no periodic adv sync transfer received event */
+#define ESP_BLE_GAP_PAST_MODE_NO_REPORT_EVT               (0x01) /*!< An periodic adv sync transfer received event and no periodic adv report events */
+#define ESP_BLE_GAP_PAST_MODE_DUP_FILTER_DISABLED         (0x02) /*!< Periodic adv report events will be enabled with duplicate filtering disabled */
+#define ESP_BLE_GAP_PAST_MODE_DUP_FILTER_ENABLED          (0x03) /*!< Periodic adv report events will be enabled with duplicate filtering enabled */
+typedef uint8_t esp_ble_gap_past_mode_t;
+
+/**
+* @brief periodic adv sync transfer parameters
+*/
+typedef struct {
+    esp_ble_gap_past_mode_t mode;       /*!< periodic advertising sync transfer mode */
+    uint16_t skip;                      /*!< the number of periodic advertising packets that can be skipped */
+    uint16_t sync_timeout;              /*!< synchronization timeout for the periodic advertising train */
+    uint8_t cte_type;                   /*!< periodic advertising sync transfer CET type */
+} esp_ble_gap_past_params_t;
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 /**
  * @brief Gap callback parameters union
  */
@@ -1309,6 +1334,50 @@ typedef union {
         esp_ble_gap_periodic_adv_report_t params; /*!< periodic advertising report parameters */
     } period_adv_report;                          /*!< Event parameter of ESP_GAP_BLE_PERIODIC_ADV_REPORT_EVT */
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    /**
+     * @brief ESP_GAP_BLE_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT
+     */
+    struct ble_periodic_adv_recv_enable_cmpl_param {
+        esp_bt_status_t status;             /*!< Set periodic advertising receive enable status */
+    } period_adv_recv_enable;               /*!< Event parameter of ESP_GAP_BLE_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT
+     */
+    struct ble_periodic_adv_sync_trans_cmpl_param {
+        esp_bt_status_t status;             /*!< Periodic advertising sync transfer status */
+        esp_bd_addr_t bda;                  /*!< The remote device address */
+    } period_adv_sync_trans;                /*!< Event parameter of ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT
+     */
+    struct ble_periodic_adv_set_info_trans_cmpl_param {
+        esp_bt_status_t status;             /*!< Periodic advertising set info transfer status */
+        esp_bd_addr_t bda;                  /*!< The remote device address */
+    } period_adv_set_info_trans;            /*!< Event parameter of ESP_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_SET_PAST_PARAMS_COMPLETE_EVT
+     */
+    struct ble_set_past_params_cmpl_param {
+        esp_bt_status_t status;             /*!< Set periodic advertising sync transfer params status */
+        esp_bd_addr_t bda;                  /*!< The remote device address */
+    } set_past_params;                      /*!< Event parameter of ESP_GAP_BLE_SET_PAST_PARAMS_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT
+     */
+    struct ble_periodic_adv_sync_trans_recv_param {
+        esp_bt_status_t status;             /*!< Periodic advertising sync transfer received status */
+        esp_bd_addr_t bda;                  /*!< The remote device address */
+        uint16_t service_data;              /*!< The value provided by the peer device */
+        uint16_t sync_handle;               /*!< Periodic advertising sync handle */
+        uint8_t adv_sid;                    /*!< Periodic advertising set id */
+        uint8_t adv_addr_type;              /*!< Periodic advertiser address type */
+        esp_bd_addr_t adv_addr;             /*!< Periodic advertiser address */
+        esp_ble_gap_phy_t adv_phy;          /*!< Periodic advertising PHY */
+        uint16_t adv_interval;              /*!< Periodic advertising interval */
+        uint8_t adv_clk_accuracy;           /*!< Periodic advertising clock accuracy */
+    } past_received;                        /*!< Event parameter of ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT */
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 } esp_ble_gap_cb_param_t;
 
 /**
@@ -1433,9 +1502,17 @@ esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params);
 esp_err_t esp_ble_gap_set_pkt_data_len(esp_bd_addr_t remote_device, uint16_t tx_data_length);
 
 /**
- * @brief           This function sets the static Random Address and Non-Resolvable Private Address for the application
+ * @brief           This function allows configuring either a Non-Resolvable Private Address or a Static Random Address
  *
- * @param[in]       rand_addr: the random address which should be setting
+ * @param[in]       rand_addr: The address to be configured. Refer to the table below for possible address subtypes:
+ *
+ *               | address [47:46] | Address Type             |
+ *               |-----------------|--------------------------|
+ *               |      0b00       | Non-Resolvable Private   |
+ *               |                 | Address                  |
+ *               |-----------------|--------------------------|
+ *               |      0b11       | Static Random Address    |
+ *               |-----------------|--------------------------|
  *
  * @return
  *                  - ESP_OK : success
@@ -1457,7 +1534,7 @@ esp_err_t esp_ble_gap_clear_rand_addr(void);
 
 
 /**
- * @brief           Enable/disable privacy on the local device
+ * @brief           Enable/disable privacy (including address resolution) on the local device
  *
  * @param[in]       privacy_enable   - enable/disable privacy on remote device.
  *
@@ -1538,6 +1615,7 @@ esp_err_t esp_ble_gap_set_prefer_conn_params(esp_bd_addr_t bd_addr,
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
 /**
  * @brief           Set device name to the local device
+ *                  Note: This API don't affect the advertising data
  *
  * @param[in]       name   -  device name.
  *
@@ -1586,7 +1664,7 @@ uint8_t *esp_ble_resolve_adv_data(uint8_t *adv_data, uint8_t type, uint8_t *leng
  * @brief           This function is called to set raw advertising data. User need to fill
  *                  ADV data by self.
  *
- * @param[in]       raw_data : raw advertising data
+ * @param[in]       raw_data : raw advertising data with the format: [Length 1][Data Type 1][Data 1][Length 2][Data Type 2][Data 2] ...
  * @param[in]       raw_data_len : raw advertising data length , less than 31 bytes
  *
  * @return
@@ -1799,6 +1877,29 @@ esp_err_t esp_ble_get_bond_device_list(int *dev_num, esp_ble_bond_dev_t *dev_lis
 */
 esp_err_t esp_ble_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t *TK, uint8_t len);
 
+/**
+* @brief           This function is called to provide the OOB data for
+*                  SMP in response to ESP_GAP_BLE_SC_OOB_REQ_EVT
+*
+* @param[in]       bd_addr: BD address of the peer device.
+* @param[in]       p_c: Confirmation value, it shall be a 128-bit random number
+* @param[in]       p_r: Randomizer value, it should be a 128-bit random number
+*
+* @return          - ESP_OK : success
+*                  - other  : failed
+*
+*/
+esp_err_t esp_ble_sc_oob_req_reply(esp_bd_addr_t bd_addr, uint8_t p_c[16], uint8_t p_r[16]);
+
+/**
+* @brief           This function is called to create the OOB data for
+*                  SMP when secure connection
+*
+* @return          - ESP_OK : success
+*                  - other  : failed
+*
+*/
+esp_err_t esp_ble_create_sc_oob_data(void);
 #endif /* #if (SMP_INCLUDED == TRUE) */
 
 /**
@@ -2016,6 +2117,22 @@ esp_err_t esp_ble_gap_ext_adv_set_clear(void);
 */
 esp_err_t esp_ble_gap_periodic_adv_set_params(uint8_t instance, const esp_ble_gap_periodic_adv_params_t *params);
 
+#if (CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH)
+/**
+* @brief           This function is used to set the data used in periodic advertising PDUs.
+*
+* @param[in]       instance : identifies the advertising set whose periodic advertising parameters are being configured.
+* @param[in]       length : the length of periodic data
+* @param[in]       data : periodic data information
+* @param[in]       only_update_did : If true, only the Advertising DID of the periodic advertising will be updated, and the length and data parameters will be ignored.
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t length,
+                                                                           const uint8_t *data, bool only_update_did);
+#else
 /**
 * @brief           This function is used to set the data used in periodic advertising PDUs.
 *
@@ -2029,6 +2146,21 @@ esp_err_t esp_ble_gap_periodic_adv_set_params(uint8_t instance, const esp_ble_ga
 */
 esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t length,
                                                                            const uint8_t *data);
+#endif
+
+#if (CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH)
+/**
+* @brief           This function is used to request the Controller to enable the periodic advertising for the advertising set specified
+*
+* @param[in]       instance : Used to identify an advertising set
+* @param[in]       include_adi : If true, the ADI (Advertising Data Info) field will be included in AUX_SYNC_IND PDUs
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance,bool include_adi);
+#else
 /**
 * @brief           This function is used to request the Controller to enable the periodic advertising for the advertising set specified
 *
@@ -2039,6 +2171,7 @@ esp_err_t esp_ble_gap_config_periodic_adv_data_raw(uint8_t instance, uint16_t le
 *
 */
 esp_err_t esp_ble_gap_periodic_adv_start(uint8_t instance);
+#endif
 
 /**
 * @brief           This function is used to request the Controller to disable the periodic advertising for the advertising set specified
@@ -2175,6 +2308,61 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
 
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+/**
+* @brief           This function is used to set periodic advertising receive enable
+*
+* @param[in]       sync_handle : Handle of periodic advertising sync
+* @param[in]       enable : Determines whether reporting and duplicate filtering are enabled or disabled
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_periodic_adv_recv_enable(uint16_t sync_handle, uint8_t enable);
+
+/**
+* @brief           This function is used to transfer periodic advertising sync
+*
+* @param[in]       addr : Peer device address
+* @param[in]       service_data : Service data used by Host
+* @param[in]       sync_handle : Handle of periodic advertising sync
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_periodic_adv_sync_trans(esp_bd_addr_t addr,
+                                              uint16_t service_data, uint16_t sync_handle);
+
+/**
+* @brief           This function is used to transfer periodic advertising set info
+*
+* @param[in]       addr : Peer device address
+* @param[in]       service_data : Service data used by Host
+* @param[in]       adv_handle : Handle of advertising set
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_periodic_adv_set_info_trans(esp_bd_addr_t addr,
+                                                  uint16_t service_data, uint8_t adv_handle);
+
+/**
+* @brief           This function is used to set periodic advertising sync transfer params
+*
+* @param[in]       addr : Peer device address
+* @param[in]       params : Params of periodic advertising sync transfer
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_set_periodic_adv_sync_trans_params(esp_bd_addr_t addr,
+                                                         const esp_ble_gap_past_params_t *params);
+#endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 #ifdef __cplusplus
 }
 #endif

components/bt/host/bluedroid/api/include/api/esp_gattc_api.h

@@ -68,6 +68,7 @@ typedef enum {
     ESP_GATTC_SET_ASSOC_EVT           = 44,       /*!< When the ble gattc set the associated address complete, the event comes */
     ESP_GATTC_GET_ADDR_LIST_EVT       = 45,       /*!< When the ble get gattc address list in cache finish, the event comes */
     ESP_GATTC_DIS_SRVC_CMPL_EVT       = 46,       /*!< When the ble discover service complete, the event comes */
+    ESP_GATTC_READ_MULTI_VAR_EVT      = 47,       /*!< When read multiple variable characteristic complete, the event comes */
 } esp_gattc_cb_event_t;
 
 
@@ -133,7 +134,7 @@ typedef union {
     } search_res;                       /*!< Gatt client callback param of ESP_GATTC_SEARCH_RES_EVT */
 
     /**
-     * @brief ESP_GATTC_READ_CHAR_EVT,  ESP_GATTC_READ_DESCR_EVT
+     * @brief ESP_GATTC_READ_CHAR_EVT, ESP_GATTC_READ_DESCR_EVT, ESP_GATTC_READ_MULTIPLE_EVT, ESP_GATTC_READ_MULTI_VAR_EVT
      */
     struct gattc_read_char_evt_param {
 
@@ -367,6 +368,7 @@ esp_err_t esp_ble_gattc_send_mtu_req (esp_gatt_if_t gattc_if, uint16_t conn_id);
  * @brief           This function is called to get service from local cache.
  *                  This function report service search result by a callback
  *                  event, and followed by a service search complete event.
+ *                  Note: 128-bit base UUID will automatically be converted to a 16-bit UUID in the search results. Other types of UUID remain unchanged.
  *
  * @param[in]       gattc_if: Gatt client access interface.
  * @param[in]       conn_id: connection ID.
@@ -660,6 +662,23 @@ esp_err_t esp_ble_gattc_read_multiple(esp_gatt_if_t gattc_if,
                                       uint16_t conn_id, esp_gattc_multi_t *read_multi,
                                       esp_gatt_auth_req_t auth_req);
 
+/**
+ * @brief           This function is called to read multiple variable length characteristic or
+ *                  characteristic descriptors.
+ *
+ * @param[in]       gattc_if: Gatt client access interface.
+ * @param[in]       conn_id : connection ID.
+ * @param[in]       read_multi : pointer to the read multiple parameter.
+ * @param[in]       auth_req : authenticate request type
+ *
+ * @return
+ *                  - ESP_OK: success
+ *                  - other: failed
+ *
+ */
+esp_err_t esp_ble_gattc_read_multiple_variable(esp_gatt_if_t gattc_if,
+                                      uint16_t conn_id, esp_gattc_multi_t *read_multi,
+                                      esp_gatt_auth_req_t auth_req);
 
 /**
  * @brief           This function is called to read a characteristics descriptor.

components/bt/host/bluedroid/api/include/api/esp_gatts_api.h

@@ -473,6 +473,7 @@ esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle);
 /**
  * @brief           Send indicate or notify to GATT client.
  *                  Set param need_confirm as false will send notification, otherwise indication.
+ *                  Note: the size of indicate or notify data need less than MTU size,see "esp_ble_gattc_send_mtu_req".
  *
  * @param[in]       gatts_if: GATT server access interface
  * @param[in]       conn_id - connection id to indicate.
@@ -581,6 +582,16 @@ esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id);
  */
 esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda);
 
+/**
+ * @brief           Print local database (GATT service table)
+ *
+ * @return
+ *                  - ESP_OK : success
+ *                  - other  : failed
+ *
+ */
+esp_err_t esp_ble_gatts_show_local_database(void);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/host/bluedroid/bta/av/bta_av_aact.c

@@ -727,8 +727,7 @@ static void bta_av_adjust_seps_idx(tBTA_AV_SCB *p_scb, UINT8 avdt_handle)
     for (xx = 0; xx < BTA_AV_MAX_SEPS; xx++) {
         APPL_TRACE_DEBUG("av_handle: %d codec_type: %d",
                          p_scb->seps[xx].av_handle, p_scb->seps[xx].codec_type);
-        if ((p_scb->seps[xx].av_handle && p_scb->codec_type == p_scb->seps[xx].codec_type)
-                && (p_scb->seps[xx].av_handle == avdt_handle)) {
+        if ((p_scb->seps[xx].av_handle) && (p_scb->seps[xx].av_handle == avdt_handle)) {
             p_scb->sep_idx      = xx;
             p_scb->avdt_handle  = p_scb->seps[xx].av_handle;
             break;
@@ -1021,6 +1020,7 @@ void bta_av_cleanup(tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
     p_scb->wait = 0;
     p_scb->num_disc_snks = 0;
     p_scb->disc_rsn = 0;
+    p_scb->avdt_handle = 0;
     bta_sys_stop_timer(&p_scb->timer);
     if (p_scb->deregistring) {
         /* remove stream */
@@ -1285,11 +1285,11 @@ void bta_av_setconfig_rsp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
 
         if (p_scb->codec_type == BTA_AV_CODEC_SBC || num > 1) {
             /* if SBC is used by the SNK as INT, discover req is not sent in bta_av_config_ind.
-                       * call disc_res now */
+                       * call cfg_res now */
             /* this is called in A2DP SRC path only, In case of SINK we don't need it  */
             if (local_sep == AVDT_TSEP_SRC) {
-                p_scb->p_cos->disc_res(p_scb->hndl, num, num, 0, p_scb->peer_addr,
-                                       UUID_SERVCLASS_AUDIO_SOURCE);
+                p_scb->p_cos->cfg_res(p_scb->hndl, num, num, 0, p_scb->peer_addr,
+                                      UUID_SERVCLASS_AUDIO_SOURCE);
             }
         } else {
             /* we do not know the peer device and it is using non-SBC codec

components/bt/host/bluedroid/bta/av/bta_av_act.c

@@ -1861,8 +1861,8 @@ void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
             bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
         }
 
-        /* make sure that the timer is not active */
-        bta_sys_stop_timer(&p_scb->timer);
+        /* free the delay timer for AVRC CT */
+        bta_sys_free_timer(&p_scb->timer);
         list_free(p_scb->a2d_list);
         p_scb->a2d_list = NULL;
         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);

components/bt/host/bluedroid/bta/av/bta_av_main.c

@@ -1224,9 +1224,11 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
     } else {
         APPL_TRACE_VERBOSE("handle=0x%x\n", p_msg->layer_specific);
         tBTA_AV_SCB *p_scb = bta_av_hndl_to_scb(p_msg->layer_specific);
-        p_scb->disc_rsn = p_msg->offset;
-        /* stream state machine events */
-        bta_av_ssm_execute(p_scb, p_msg->event, (tBTA_AV_DATA *) p_msg);
+        if (p_scb) {
+            p_scb->disc_rsn = p_msg->offset;
+            /* stream state machine events */
+            bta_av_ssm_execute(p_scb, p_msg->event, (tBTA_AV_DATA *) p_msg);
+        }
     }
     return TRUE;
 }

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -982,10 +982,6 @@ static void bta_dm_process_remove_device(BD_ADDR bd_addr, tBT_TRANSPORT transpor
 
     BTM_SecDeleteDevice(bd_addr, transport);
 
-#if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
-    /* remove all cached GATT information */
-    BTA_GATTC_Refresh(bd_addr, false);
-#endif
     if (bta_dm_cb.p_sec_cback) {
         tBTA_DM_SEC sec_event;
         bdcpy(sec_event.link_down.bd_addr, bd_addr);
@@ -1140,8 +1136,6 @@ void bta_dm_close_acl(tBTA_DM_MSG *p_data)
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
         /* need to remove all pending background connection if any */
         BTA_GATTC_CancelOpen(0, p_remove_acl->bd_addr, FALSE);
-        /* remove all cached GATT information */
-        BTA_GATTC_Refresh(p_remove_acl->bd_addr, false);
 #endif
     }
     /* otherwise, no action needed */
@@ -1448,6 +1442,40 @@ void bta_dm_oob_reply(tBTA_DM_MSG *p_data)
 #endif
 }
 
+/*******************************************************************************
+**
+** Function         bta_dm_sc_oob_reply
+**
+** Description      This function is called to provide the OOB data for
+**                  SMP in response to BLE secure connection OOB request.
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_dm_sc_oob_reply(tBTA_DM_MSG *p_data)
+{
+#if (BLE_INCLUDED)
+    BTM_BleSecureConnectionOobDataReply(p_data->sc_oob_reply.bd_addr, p_data->sc_oob_reply.c, p_data->sc_oob_reply.r);
+#endif
+}
+
+/*******************************************************************************
+**
+** Function         bta_dm_sc_create_oob_data
+**
+** Description      This function is called to create the OOB data for
+**                  SMP when secure connection.
+**
+** Returns          void
+**
+*******************************************************************************/
+void bta_dm_sc_create_oob_data(tBTA_DM_MSG *p_data)
+{
+#if (BLE_INCLUDED)
+    BTM_BleSecureConnectionCreateOobData();
+#endif
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_ci_io_req_act
@@ -3636,8 +3664,6 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
             /* need to remove all pending background connection */
             BTA_GATTC_CancelOpen(0, p_bda, FALSE);
-            /* remove all cached GATT information */
-            BTA_GATTC_Refresh(p_bda, false);
 #endif
         }
 
@@ -3815,8 +3841,6 @@ static BOOLEAN bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr)
 #if (BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE)
         /* need to remove all pending background connection */
         BTA_GATTC_CancelOpen(0, remote_bd_addr, FALSE);
-        /* remove all cached GATT information */
-        BTA_GATTC_Refresh(remote_bd_addr, false);
 #endif
     }
     return is_device_deleted;
@@ -4732,6 +4756,17 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bta_dm_cb.p_sec_cback(BTA_DM_BLE_OOB_REQ_EVT, &sec_event);
         break;
 
+    case BTM_LE_SC_OOB_REQ_EVT:
+        bdcpy(sec_event.ble_req.bd_addr, bda);
+        bta_dm_cb.p_sec_cback(BTA_DM_BLE_SC_OOB_REQ_EVT, &sec_event);
+        break;
+
+    case BTM_LE_SC_LOC_OOB_EVT:
+        memcpy(sec_event.local_oob_data.local_oob_c, p_data->local_oob_data.commitment, BT_OCTET16_LEN);
+        memcpy(sec_event.local_oob_data.local_oob_r, p_data->local_oob_data.randomizer, BT_OCTET16_LEN);
+        bta_dm_cb.p_sec_cback(BTA_DM_BLE_SC_CR_LOC_OOB_EVT, &sec_event);
+        break;
+
     case BTM_LE_NC_REQ_EVT:
         bdcpy(sec_event.key_notif.bd_addr, bda);
         BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,bta_dm_get_remname(), BD_NAME_LEN);
@@ -5057,7 +5092,7 @@ void bta_dm_ble_update_conn_params (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_disconnect (tBTA_DM_MSG *p_data)
 {
-    L2CA_RemoveFixedChnl(L2CAP_ATT_CID, p_data->ble_disconnect.remote_bda);
+    L2CA_BleDisconnect(p_data->ble_disconnect.remote_bda);
 }
 
 /*******************************************************************************
@@ -5679,7 +5714,8 @@ void bta_dm_ble_gap_periodic_adv_cfg_data_raw(tBTA_DM_MSG *p_data)
 
     BTM_BlePeriodicAdvCfgDataRaw(p_data->ble_cfg_periodic_adv_data.instance,
                                  p_data->ble_cfg_periodic_adv_data.length,
-                                 p_data->ble_cfg_periodic_adv_data.data);
+                                 p_data->ble_cfg_periodic_adv_data.data,
+                                 p_data->ble_cfg_periodic_adv_data.only_update_did);
 }
 
 void bta_dm_ble_gap_periodic_adv_enable(tBTA_DM_MSG *p_data)
@@ -5778,6 +5814,37 @@ void bta_dm_ble_gap_set_prefer_ext_conn_params(tBTA_DM_MSG *p_data)
 }
 
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+void bta_dm_ble_gap_periodic_adv_recv_enable(tBTA_DM_MSG *p_data)
+{
+    BTM_BlePeriodicAdvRecvEnable(p_data->ble_periodic_adv_recv_enable.sync_handle,
+                                 p_data->ble_periodic_adv_recv_enable.enable);
+}
+
+void bta_dm_ble_gap_periodic_adv_sync_trans(tBTA_DM_MSG *p_data)
+{
+    BTM_BlePeriodicAdvSyncTrans(p_data->ble_periodic_adv_sync_trans.addr,
+                                p_data->ble_periodic_adv_sync_trans.service_data,
+                                p_data->ble_periodic_adv_sync_trans.sync_handle);
+}
+
+void bta_dm_ble_gap_periodic_adv_set_info_trans(tBTA_DM_MSG *p_data)
+{
+    BTM_BlePeriodicAdvSetInfoTrans(p_data->ble_periodic_adv_set_info_trans.addr,
+                                   p_data->ble_periodic_adv_set_info_trans.service_data,
+                                   p_data->ble_periodic_adv_set_info_trans.adv_hanlde);
+}
+
+void bta_dm_ble_gap_set_periodic_adv_sync_trans_params(tBTA_DM_MSG *p_data)
+{
+    BTM_BleSetPeriodicAdvSyncTransParams(p_data->ble_set_past_params.addr,
+                                         p_data->ble_set_past_params.params.mode,
+                                         p_data->ble_set_past_params.params.skip,
+                                         p_data->ble_set_past_params.params.sync_timeout,
+                                         p_data->ble_set_past_params.params.cte_type);
+}
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 /*******************************************************************************
 **
 ** Function         bta_dm_ble_setup_storage

components/bt/host/bluedroid/bta/dm/bta_dm_api.c

@@ -671,7 +671,7 @@ void BTA_DmLocalOob(void)
 ** Function         BTA_DmOobReply
 **
 **                  This function is called to provide the OOB data for
-**                  SMP in response to BTM_LE_OOB_REQ_EVT
+**                  SMP in response to BTA_LE_OOB_REQ_EVT
 **
 ** Parameters:      bd_addr     - Address of the peer device
 **                  len         - length of simple pairing Randomizer  C
@@ -696,6 +696,55 @@ void BTA_DmOobReply(BD_ADDR bd_addr, UINT8 len, UINT8 *p_value)
         bta_sys_sendmsg(p_msg);
     }
 }
+
+/*******************************************************************************
+**
+** Function         BTA_DmSecureConnectionOobReply
+**
+**                  This function is called to provide the OOB data for
+**                  SMP in response to BTA_LE_OOB_REQ_EVT
+**
+** Parameters:      bd_addr     - Address of the peer device
+**                  p_c         - Pointer to Confirmation
+**                  p_r         - Pointer to Randomizer
+**
+** Returns          void
+**
+*******************************************************************************/
+void BTA_DmSecureConnectionOobReply(BD_ADDR bd_addr, UINT8 *p_c, UINT8 *p_r)
+{
+    tBTA_DM_API_SC_OOB_REPLY    *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_SC_OOB_REPLY *) osi_malloc(sizeof(tBTA_DM_API_OOB_REPLY))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_SC_OOB_REPLY_EVT;
+        if((p_c == NULL) || (p_r == NULL)) {
+            return;
+        }
+        memcpy(p_msg->bd_addr, bd_addr, BD_ADDR_LEN);
+        memcpy(p_msg->c, p_c, BT_OCTET16_LEN);
+        memcpy(p_msg->r, p_r, BT_OCTET16_LEN);
+        bta_sys_sendmsg(p_msg);
+    }
+}
+/*******************************************************************************
+**
+** Function         BTA_DmSecureConnectionCreateOobData
+**
+**                  This function is called to create the OOB data for
+**                  SMP when secure connection
+**
+** Returns          void
+**
+*******************************************************************************/
+void BTA_DmSecureConnectionCreateOobData(void)
+{
+    tBTA_DM_API_SC_CR_OOB_DATA *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_SC_CR_OOB_DATA *) osi_malloc(sizeof(tBTA_DM_API_SC_CR_OOB_DATA))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_SC_CR_OOB_DATA_EVT;
+        bta_sys_sendmsg(p_msg);
+    }
+}
 #endif /* BTM_OOB_INCLUDED */
 /*******************************************************************************
 **
@@ -2804,7 +2853,7 @@ void BTA_DmBleGapConfigExtAdvDataRaw(BOOLEAN is_scan_rsp, UINT8 instance, UINT16
         p_msg->is_scan_rsp = is_scan_rsp;
         p_msg->instance = instance;
         p_msg->length = length;
-        p_msg->data = (UINT8 *)(p_msg + 1);
+        p_msg->data = length != 0 ? (UINT8 *)(p_msg + 1) : NULL;
         if (data) {
             memcpy(p_msg->data, data, length);
         }
@@ -2883,7 +2932,7 @@ void BTA_DmBleGapPeriodicAdvSetParams(UINT8 instance,
 }
 
 void BTA_DmBleGapPeriodicAdvCfgDataRaw(UINT8 instance, UINT16 length,
-                                                           const UINT8 *data)
+                                                           const UINT8 *data,bool only_update_did)
 {
     tBTA_DM_API_CFG_PERIODIC_ADV_DATA *p_msg;
     APPL_TRACE_API("%s, Periodic ADV config data raw.", __func__);
@@ -2894,6 +2943,8 @@ void BTA_DmBleGapPeriodicAdvCfgDataRaw(UINT8 instance, UINT16 length,
         p_msg->length = length;
         p_msg->data = (UINT8 *)(p_msg + 1);
         memcpy(p_msg->data, data, length);
+        p_msg->data = length != 0 ? (UINT8 *)(p_msg + 1) : NULL;
+        p_msg->only_update_did = only_update_did;
         //start sent the msg to the bta system control moudle
         bta_sys_sendmsg(p_msg);
     } else {
@@ -2902,7 +2953,7 @@ void BTA_DmBleGapPeriodicAdvCfgDataRaw(UINT8 instance, UINT16 length,
 
 }
 
-void BTA_DmBleGapPeriodicAdvEnable(BOOLEAN enable, UINT8 instance)
+void BTA_DmBleGapPeriodicAdvEnable(UINT8 enable, UINT8 instance)
 {
     tBTA_DM_API_ENABLE_PERIODIC_ADV *p_msg;
     APPL_TRACE_API("%s, Periodic ADV %s.", __func__, enable ? "start" : "stop");
@@ -3110,4 +3161,72 @@ void BTA_DmBleGapExtConnect(tBLE_ADDR_TYPE own_addr_type, const BD_ADDR peer_add
 
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+void BTA_DmBleGapPeriodicAdvRecvEnable(UINT16 sync_handle, UINT8 enable)
+{
+    tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE *p_msg;
+    p_msg = (tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE *) osi_malloc(sizeof(tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE));
+    if (p_msg != NULL) {
+        memset(p_msg, 0, sizeof(tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE));
+        p_msg->hdr.event = BTA_DM_API_PERIODIC_ADV_RECV_ENABLE_EVT;
+        p_msg->sync_handle = sync_handle;
+        p_msg->enable = enable;
+        //start sent the msg to the bta system control moudle
+        bta_sys_sendmsg(p_msg);
+    } else {
+        APPL_TRACE_ERROR("%s malloc failed", __func__);
+    }
+}
+
+void BTA_DmBleGapPeriodicAdvSyncTrans(BD_ADDR peer_addr, UINT16 service_data, UINT16 sync_handle)
+{
+    tBTA_DM_API_PERIODIC_ADV_SYNC_TRANS *p_msg;
+    p_msg = (tBTA_DM_API_PERIODIC_ADV_SYNC_TRANS *) osi_malloc(sizeof(tBTA_DM_API_PERIODIC_ADV_SYNC_TRANS));
+    if (p_msg != NULL) {
+        memset(p_msg, 0, sizeof(tBTA_DM_API_PERIODIC_ADV_SYNC_TRANS));
+        p_msg->hdr.event = BTA_DM_API_PERIODIC_ADV_SYNC_TRANS_EVT;
+        memcpy(p_msg->addr, peer_addr, sizeof(BD_ADDR));
+        p_msg->service_data = service_data;
+        p_msg->sync_handle = sync_handle;
+        //start sent the msg to the bta system control moudle
+        bta_sys_sendmsg(p_msg);
+    } else {
+        APPL_TRACE_ERROR("%s malloc failed", __func__);
+    }
+}
+
+void BTA_DmBleGapPeriodicAdvSetInfoTrans(BD_ADDR peer_addr, UINT16 service_data, UINT8 adv_handle)
+{
+    tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS *p_msg;
+    p_msg = (tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS *) osi_malloc(sizeof(tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS));
+    if (p_msg != NULL) {
+        memset(p_msg, 0, sizeof(tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS));
+        p_msg->hdr.event = BTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS_EVT;
+        memcpy(p_msg->addr, peer_addr, sizeof(BD_ADDR));
+        p_msg->service_data = service_data;
+        p_msg->adv_hanlde = adv_handle;
+        //start sent the msg to the bta system control moudle
+        bta_sys_sendmsg(p_msg);
+    } else {
+        APPL_TRACE_ERROR("%s malloc failed", __func__);
+    }
+}
+
+void BTA_DmBleGapSetPeriodicAdvSyncTransParams(BD_ADDR peer_addr, tBTA_DM_BLE_PAST_PARAMS *params)
+{
+    tBTA_DM_API_SET_PAST_PARAMS *p_msg;
+    p_msg = (tBTA_DM_API_SET_PAST_PARAMS *) osi_malloc(sizeof(tBTA_DM_API_SET_PAST_PARAMS));
+    if (p_msg != NULL) {
+        memset(p_msg, 0, sizeof(tBTA_DM_API_SET_PAST_PARAMS));
+        p_msg->hdr.event = BTA_DM_API_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS_EVT;
+        memcpy(p_msg->addr, peer_addr, sizeof(BD_ADDR));
+        memcpy(&p_msg->params, params, sizeof(tBTA_DM_BLE_PAST_PARAMS));
+        //start sent the msg to the bta system control moudle
+        bta_sys_sendmsg(p_msg);
+    } else {
+        APPL_TRACE_ERROR("%s malloc failed", __func__);
+    }
+}
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 #endif

components/bt/host/bluedroid/bta/dm/bta_dm_co.c

@@ -349,10 +349,6 @@ void bta_dm_co_ble_io_req(BD_ADDR bd_addr,  tBTA_IO_CAP *p_io_cap,
 
     *p_auth_req = bte_appl_cfg.ble_auth_req | (bte_appl_cfg.ble_auth_req & BTA_LE_AUTH_REQ_MITM) | ((*p_auth_req) & BTA_LE_AUTH_REQ_MITM);
 
-    if (*p_oob_data == BTM_BLE_OOB_ENABLE) {
-        *p_auth_req = (*p_auth_req)&(~BTA_LE_AUTH_REQ_SC_ONLY);
-    }
-
     if (bte_appl_cfg.ble_io_cap <= 4) {
         *p_io_cap = bte_appl_cfg.ble_io_cap;
     }

components/bt/host/bluedroid/bta/dm/bta_dm_main.c

@@ -96,6 +96,8 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
 #if (BTM_OOB_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
     bta_dm_loc_oob,                         /* BTA_DM_API_LOC_OOB_EVT */
     bta_dm_oob_reply,                       /* BTA_DM_API_OOB_REPLY_EVT */
+    bta_dm_sc_oob_reply,                    /* BTA_DM_API_SC_OOB_REPLY_EVT */
+    bta_dm_sc_create_oob_data,              /* BTA_DM_API_SC_CR_OOB_DATA_EVT */
     bta_dm_ci_io_req_act,                   /* BTA_DM_CI_IO_REQ_EVT */
     bta_dm_ci_rmt_oob_act,                  /* BTA_DM_CI_RMT_OOB_EVT */
 #endif /* BTM_OOB_INCLUDED */
@@ -199,7 +201,14 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
     bta_dm_ble_gap_set_ext_scan_params,     /* BTA_DM_API_SET_EXT_SCAN_PARAMS_EVT */
     bta_dm_ble_gap_ext_scan,                /* BTA_DM_API_START_EXT_SCAN_EVT */
     bta_dm_ble_gap_set_prefer_ext_conn_params, /* BTA_DM_API_SET_PERF_EXT_CONN_PARAMS_EVT */
+    NULL,                                   /* BTA_DM_API_EXT_CONN_EVT */
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    bta_dm_ble_gap_periodic_adv_recv_enable, /* BTA_DM_API_PERIODIC_ADV_RECV_ENABLE_EVT */
+    bta_dm_ble_gap_periodic_adv_sync_trans,  /* BTA_DM_API_PERIODIC_ADV_SYNC_TRANS_EVT */
+    bta_dm_ble_gap_periodic_adv_set_info_trans, /* BTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS_EVT */
+    bta_dm_ble_gap_set_periodic_adv_sync_trans_params, /* BTA_DM_API_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS_EVT */
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 };
 
 

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -93,6 +93,8 @@ enum {
 #if (BTM_OOB_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
     BTA_DM_API_LOC_OOB_EVT,
     BTA_DM_API_OOB_REPLY_EVT,
+    BTA_DM_API_SC_OOB_REPLY_EVT,
+    BTA_DM_API_SC_CR_OOB_DATA_EVT,
     BTA_DM_CI_IO_REQ_EVT,
     BTA_DM_CI_RMT_OOB_EVT,
 #endif /* BTM_OOB_INCLUDED */
@@ -198,6 +200,12 @@ enum {
     BTA_DM_API_SET_PERF_EXT_CONN_PARAMS_EVT,
     BTA_DM_API_EXT_CONN_EVT,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    BTA_DM_API_PERIODIC_ADV_RECV_ENABLE_EVT,
+    BTA_DM_API_PERIODIC_ADV_SYNC_TRANS_EVT,
+    BTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS_EVT,
+    BTA_DM_API_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS_EVT,
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
     BTA_DM_MAX_EVT
 };
 
@@ -400,8 +408,23 @@ typedef struct {
     BD_ADDR bd_addr;
     UINT8       len;
     UINT8       value[BT_OCTET16_LEN];
+    UINT8       c[BT_OCTET16_LEN];
+    UINT8       r[BT_OCTET16_LEN];
 } tBTA_DM_API_OOB_REPLY;
 
+/* data type for BTA_DM_API_SC_OOB_REPLY_EVT */
+typedef struct {
+    BT_HDR      hdr;
+    BD_ADDR     bd_addr;
+    UINT8       c[BT_OCTET16_LEN];
+    UINT8       r[BT_OCTET16_LEN];
+} tBTA_DM_API_SC_OOB_REPLY;
+
+/* data type for BTA_DM_API_SC_CR_OOB_DATA_EVT */
+typedef struct {
+    BT_HDR      hdr;
+} tBTA_DM_API_SC_CR_OOB_DATA;
+
 /* data type for BTA_DM_API_CONFIRM_EVT */
 typedef struct {
     BT_HDR      hdr;
@@ -945,12 +968,13 @@ typedef struct {
     UINT8                           instance;
     UINT16                          length;
     UINT8                           *data;
+    BOOLEAN                         only_update_did;
 } tBTA_DM_API_CFG_PERIODIC_ADV_DATA;
 
 typedef struct {
     BT_HDR                          hdr;
     UINT8                           instance;
-    BOOLEAN                         enable;
+    UINT8                           enable;
 } tBTA_DM_API_ENABLE_PERIODIC_ADV;
 
 typedef struct {
@@ -1013,6 +1037,35 @@ typedef struct {
     BD_ADDR                         peer_addr;
 } tBTA_DM_API_EXT_CONN;
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+typedef struct {
+    BT_HDR                          hdr;
+    UINT16                          sync_handle;
+    UINT8                           enable;
+} tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE;
+
+typedef struct {
+    BT_HDR                          hdr;
+    BD_ADDR                         addr;
+    UINT16                          service_data;
+    UINT16                          sync_handle;
+} tBTA_DM_API_PERIODIC_ADV_SYNC_TRANS;
+
+typedef struct {
+    BT_HDR                          hdr;
+    BD_ADDR                         addr;
+    UINT16                          service_data;
+    UINT8                           adv_hanlde;
+} tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS;
+
+typedef struct {
+    BT_HDR                          hdr;
+    BD_ADDR                         addr;
+    tBTA_DM_BLE_PAST_PARAMS         params;
+} tBTA_DM_API_SET_PAST_PARAMS;
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 /* union of all data types */
 typedef union {
     /* event buffer header */
@@ -1054,6 +1107,7 @@ typedef union {
 
     tBTA_DM_API_LOC_OOB     loc_oob;
     tBTA_DM_API_OOB_REPLY   oob_reply;
+    tBTA_DM_API_SC_OOB_REPLY sc_oob_reply;
     tBTA_DM_API_CONFIRM     confirm;
     tBTA_DM_API_KEY_REQ     key_req;
     tBTA_DM_CI_IO_REQ       ci_io_req;
@@ -1152,6 +1206,12 @@ typedef union {
     tBTA_DM_API_EXT_SCAN                ble_ext_scan;
     tBTA_DM_API_SET_PER_EXT_CONN_PARAMS ble_set_per_ext_conn_params;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE ble_periodic_adv_recv_enable;
+    tBTA_DM_API_PERIODIC_ADV_SYNC_TRANS ble_periodic_adv_sync_trans;
+    tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS ble_periodic_adv_set_info_trans;
+    tBTA_DM_API_SET_PAST_PARAMS ble_set_past_params;
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 #endif
 
     tBTA_DM_API_REMOVE_ACL              remove_acl;
@@ -1613,6 +1673,8 @@ extern BOOLEAN bta_dm_check_if_only_hd_connected(BD_ADDR peer_addr);
 #if (BTM_OOB_INCLUDED == TRUE)
 extern void bta_dm_loc_oob(tBTA_DM_MSG *p_data);
 extern void bta_dm_oob_reply(tBTA_DM_MSG *p_data);
+extern void bta_dm_sc_oob_reply(tBTA_DM_MSG *p_data);
+extern void bta_dm_sc_create_oob_data(tBTA_DM_MSG *p_data);
 extern void bta_dm_ci_io_req_act(tBTA_DM_MSG *p_data);
 extern void bta_dm_ci_rmt_oob_act(tBTA_DM_MSG *p_data);
 #endif /* BTM_OOB_INCLUDED */
@@ -1706,4 +1768,14 @@ extern void bta_dm_ble_gap_ext_scan(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_set_prefer_ext_conn_params(tBTA_DM_MSG *p_data);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+extern void bta_dm_ble_gap_periodic_adv_recv_enable(tBTA_DM_MSG *p_data);
+
+extern void bta_dm_ble_gap_periodic_adv_sync_trans(tBTA_DM_MSG *p_data);
+
+extern void bta_dm_ble_gap_periodic_adv_set_info_trans(tBTA_DM_MSG *p_data);
+
+extern void bta_dm_ble_gap_set_periodic_adv_sync_trans_params(tBTA_DM_MSG *p_data);
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 #endif /* BTA_DM_INT_H */

components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c

@@ -126,6 +126,7 @@ static void bta_gattc_enable(tBTA_GATTC_CB *p_cb)
     if (p_cb->state == BTA_GATTC_STATE_DISABLED) {
         /* initialize control block */
         memset(&bta_gattc_cb, 0, sizeof(tBTA_GATTC_CB));
+        bta_gattc_cb.auto_disc = true;
         p_cb->state = BTA_GATTC_STATE_ENABLED;
     } else {
         APPL_TRACE_DEBUG("GATTC is already enabled");
@@ -692,9 +693,11 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             } else
 #endif
             { /* cache is building */
-                p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
-                /* cache load failure, start discovery */
-                bta_gattc_start_discover(p_clcb, NULL);
+                if (bta_gattc_cb.auto_disc) {
+                    p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
+                    /* cache load failure, start discovery */
+                    bta_gattc_start_discover(p_clcb, NULL);
+                }
             }
         } else { /* cache is building */
             p_clcb->state = BTA_GATTC_DISCOVER_ST;
@@ -821,8 +824,6 @@ void bta_gattc_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
         bta_sys_conn_close( BTA_ID_GATTC , BTA_ALL_APP_ID, p_clcb->bda);
     }
 
-    bta_gattc_clcb_dealloc(p_clcb);
-
     if (p_data->hdr.event == BTA_GATTC_API_CLOSE_EVT) {
         cb_data.close.status = GATT_Disconnect(p_data->hdr.layer_specific);
     } else if (p_data->hdr.event == BTA_GATTC_INT_DISCONN_EVT) {
@@ -1174,6 +1175,37 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 }
 /*******************************************************************************
 **
+** Function         bta_gattc_read_multi_var
+**
+** Description      read multiple variable
+**
+** Returns          None.
+*********************************************************************************/
+void bta_gattc_read_multi_var(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
+{
+    tBTA_GATT_STATUS    status = BTA_GATT_OK;
+    tGATT_READ_PARAM    read_param;
+
+    if (bta_gattc_enqueue(p_clcb, p_data)) {
+        memset(&read_param, 0, sizeof(tGATT_READ_PARAM));
+
+        if (status == BTA_GATT_OK) {
+            read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr;
+            read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req;
+            memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles,
+                    sizeof(UINT16) * p_data->api_read_multi.num_attr);
+
+            status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE_VAR, &read_param);
+        }
+
+        /* read fail */
+        if (status != BTA_GATT_OK) {
+            bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
+        }
+    }
+}
+/*******************************************************************************
+**
 ** Function         bta_gattc_write
 **
 ** Description      Write an attribute
@@ -1289,7 +1321,8 @@ void bta_gattc_read_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
         cb_data.read.handle = p_clcb->p_q_cmd->api_read.handle;
     }
 
-    if (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT) {
+    if (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT &&
+        p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_VAR_EVT) {
         event = p_clcb->p_q_cmd->api_read.cmpl_evt;
     } else {
         event = p_clcb->p_q_cmd->api_read_multi.cmpl_evt;
@@ -1426,7 +1459,9 @@ void  bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
             return;
         }
         if (p_clcb->p_q_cmd->hdr.event != bta_gattc_opcode_to_int_evt[op - GATTC_OPTYPE_READ]) {
-            if ((p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT)&&(p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_BY_TYPE_EVT)) {
+            if ((p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT) &&
+                (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_BY_TYPE_EVT) &&
+                (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_VAR_EVT)) {
                 mapped_op = p_clcb->p_q_cmd->hdr.event - BTA_GATTC_API_READ_EVT + GATTC_OPTYPE_READ;
                 if ( mapped_op > GATTC_OPTYPE_INDICATION) {
                     mapped_op = 0;

components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c

@@ -563,6 +563,42 @@ void BTA_GATTC_ReadMultiple(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi,
     return;
 }
 
+/*******************************************************************************
+**
+** Function         BTA_GATTC_ReadMultipleVariable
+**
+** Description      This function is called to read multiple variable length characteristic or
+**                  characteristic descriptors.
+**
+** Parameters       conn_id - connection ID.
+**                    p_read_multi - pointer to the read multiple parameter.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_GATTC_ReadMultipleVariable(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi,
+                            tBTA_GATT_AUTH_REQ auth_req)
+{
+    tBTA_GATTC_API_READ_MULTI  *p_buf;
+    UINT16 len = (UINT16)(sizeof(tBTA_GATTC_API_READ_MULTI));
+
+    if ((p_buf = (tBTA_GATTC_API_READ_MULTI *) osi_malloc(len)) != NULL) {
+        memset(p_buf, 0, len);
+
+        p_buf->hdr.event = BTA_GATTC_API_READ_MULTI_VAR_EVT;
+        p_buf->hdr.layer_specific = conn_id;
+        p_buf->auth_req = auth_req;
+        p_buf->num_attr = p_read_multi->num_attr;
+        p_buf->cmpl_evt = BTA_GATTC_READ_MULTI_VAR_EVT;
+        if (p_buf->num_attr > 0) {
+            memcpy(p_buf->handles, p_read_multi->handles, sizeof(UINT16) * p_read_multi->num_attr);
+	    }
+
+        bta_sys_sendmsg(p_buf);
+    }
+    return;
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_GATTC_Read_by_type
@@ -1103,4 +1139,83 @@ void BTA_GATTC_Broadcast(tBTA_GATTC_IF client_if, BOOLEAN start)
     return;
 }
 
+/* Add For BLE PTS */
+uint8_t BTA_GATTC_AutoDiscoverEnable(uint8_t enable)
+{
+    APPL_TRACE_DEBUG("%s enable %d", __func__, enable);
+
+    bta_gattc_cb.auto_disc = ((enable > 0) ? true : false);
+    GATTC_AutoDiscoverEnable(enable);
+
+    return 0;
+}
+
+typedef struct {
+    UINT16 len;
+    union {
+        UINT16    uuid16;
+        UINT32    uuid32;
+        UINT8     uuid128[LEN_UUID_128];
+    } uuid;
+} __attribute__((packed)) tAPP_UUID;
+
+uint8_t BTA_GATTC_Discover(uint8_t gatt_if, uint16_t conn_id, void *uuid, uint8_t disc_type, uint16_t s_handle, uint16_t e_handle)
+{
+    tGATT_STATUS status;
+    tGATT_DISC_PARAM param;
+    tAPP_UUID *app_uuid = (tAPP_UUID *)uuid;
+
+    conn_id = (UINT16)((((UINT8)conn_id) << 8) | gatt_if);
+    memset(&param, 0, sizeof(tGATT_DISC_PARAM));
+
+    if (disc_type == GATT_DISC_SRVC_ALL || disc_type == GATT_DISC_SRVC_BY_UUID) {
+        param.s_handle = 1;
+        param.e_handle = 0xFFFF;
+    } else {
+        param.s_handle = s_handle;
+        param.e_handle = e_handle;
+    }
+
+    if (app_uuid) {
+        param.service.len = app_uuid->len;
+        if (app_uuid->len == LEN_UUID_16) {
+            param.service.uu.uuid16 = app_uuid->uuid.uuid16;
+        } else if (app_uuid->len == LEN_UUID_32) {
+            param.service.uu.uuid32 = app_uuid->uuid.uuid32;
+        } else if (app_uuid->len == LEN_UUID_128) {
+            memcpy(param.service.uu.uuid128, app_uuid->uuid.uuid128, LEN_UUID_128);
+        } else {
+            APPL_TRACE_ERROR("%s invalid uuid len %u", __func__, app_uuid->len);
+        }
+    }
+
+    status = GATTC_Discover (conn_id, disc_type, &param);
+    if (status != GATT_SUCCESS) {
+        APPL_TRACE_ERROR("%s status %x", __func__, status);
+        return -1;
+    }
+
+    return 0;
+}
+
+uint8_t BTA_GATTC_ReadLongChar(uint8_t gatt_if, uint16_t conn_id, uint16_t handle, uint16_t offset, uint8_t auth_req)
+{
+    tGATT_STATUS status;
+    tGATT_READ_PARAM read_param;
+
+    conn_id = (UINT16)((((UINT8)conn_id) << 8) | gatt_if);
+    memset (&read_param, 0, sizeof(tGATT_READ_PARAM));
+    read_param.partial.handle = handle;
+    read_param.partial.offset = offset;
+    read_param.partial.auth_req = auth_req;
+
+    status = GATTC_Read(conn_id, GATT_READ_PARTIAL, &read_param);
+    if (status != GATT_SUCCESS) {
+        APPL_TRACE_ERROR("%s status %x", __func__, status);
+        return -1;
+    }
+
+    return 0;
+}
+/* End BLE PTS */
 #endif /* defined(GATTC_INCLUDED) && (GATTC_INCLUDED == TRUE) */

components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c

@@ -969,6 +969,10 @@ void bta_gattc_disc_res_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT_
     BOOLEAN          pri_srvc;
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
+    if (bta_gattc_cb.auto_disc == FALSE) {
+        return;
+    }
+
     p_srvc_cb = bta_gattc_find_scb_by_cid(conn_id);
 
     if (p_srvc_cb != NULL && p_clcb != NULL && p_clcb->state == BTA_GATTC_DISCOVER_ST) {
@@ -1042,6 +1046,10 @@ void bta_gattc_disc_cmpl_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT
     tBTA_GATTC_SERV *p_srvc_cb;
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
+    if (bta_gattc_cb.auto_disc == FALSE) {
+        return;
+    }
+
     if ( p_clcb && (status != GATT_SUCCESS || p_clcb->status != GATT_SUCCESS) ) {
         if (status == GATT_SUCCESS) {
             p_clcb->status = status;

components/bt/host/bluedroid/bta/gatt/bta_gattc_co.c

@@ -139,7 +139,7 @@ static bool cacheOpen(BD_ADDR bda, bool to_save, UINT8 *index)
     return ((status == ESP_OK) ? true : false);
 }
 
-static void cacheReset(BD_ADDR bda)
+static void cacheReset(BD_ADDR bda, BOOLEAN update)
 {
     char fname[255] = {0};
     getFilename(fname, bda);
@@ -177,9 +177,16 @@ static void cacheReset(BD_ADDR bda)
         for(UINT8 i = index; i < (num - 1); i++) {
             memcpy(&cache_env->cache_addr[i], &cache_env->cache_addr[i+1], sizeof(cache_addr_info_t));
         }
+        //clear the last cache when delete a addr
+        memset(&cache_env->cache_addr[num-1], 0, sizeof(cache_addr_info_t));
         //reduced the number address counter also
         cache_env->num_addr--;
 
+        //don't need to update addr list to nvs flash
+        if (!update) {
+            return;
+        }
+
         //update addr list to nvs flash
         if(cache_env->num_addr > 0) {
             //update
@@ -376,7 +383,7 @@ void bta_gattc_co_cache_close(BD_ADDR server_bda, UINT16 conn_id)
 *******************************************************************************/
 void bta_gattc_co_cache_reset(BD_ADDR server_bda)
 {
-    cacheReset(server_bda);
+    cacheReset(server_bda, TRUE);
 }
 
 void bta_gattc_co_cache_addr_init(void)
@@ -520,26 +527,29 @@ void bta_gattc_co_cache_addr_save(BD_ADDR bd_addr, hash_key_t hash_key)
     UINT8 index = 0;
     UINT8 new_index = cache_env->num_addr;
     UINT8 *p_buf = osi_malloc(MAX_ADDR_LIST_CACHE_BUF);
-    // check the address list has the same hash key or not
-    if (bta_gattc_co_find_hash_in_cache(hash_key) != INVALID_ADDR_NUM) {
-        APPL_TRACE_DEBUG("%s(), the hash key already in the cache list.", __func__);
-        if ((index = bta_gattc_co_find_addr_in_cache(bd_addr)) != INVALID_ADDR_NUM) {
-            APPL_TRACE_DEBUG("%s(), the hash bd_addr already in the cache list, index = %x", __func__, index);
-            //if the bd_addr already in the address list, update the hash key in it.
-            memcpy(cache_env->cache_addr[index].addr, bd_addr, sizeof(BD_ADDR));
-            memcpy(cache_env->cache_addr[index].hash_key, hash_key, sizeof(hash_key_t));
-        } else {
-            //if the bd_addr didn't in the address list, added the bd_addr to the last of the address list.
-            memcpy(cache_env->cache_addr[new_index].hash_key, hash_key, sizeof(hash_key_t));
-            memcpy(cache_env->cache_addr[new_index].addr, bd_addr, sizeof(BD_ADDR));
-            cache_env->num_addr++;
-        }
+    if (p_buf == NULL) {
+        APPL_TRACE_ERROR("%s malloc failed!", __func__);
+        return;
+    }
 
+    // check the address list has the same address or not
+    // for the same address, it's hash key may be change due to service change
+    if ((index = bta_gattc_co_find_addr_in_cache(bd_addr)) != INVALID_ADDR_NUM) {
+        APPL_TRACE_DEBUG("%s the bd_addr already in the cache list, index = %x", __func__, index);
+        //if the bd_addr already in the address list, update the hash key in it.
+        memcpy(cache_env->cache_addr[index].addr, bd_addr, sizeof(BD_ADDR));
+        memcpy(cache_env->cache_addr[index].hash_key, hash_key, sizeof(hash_key_t));
     } else {
-        APPL_TRACE_DEBUG("%s(), num = %d", __func__, new_index + 1);
+        if (cache_env->num_addr >= MAX_DEVICE_IN_CACHE) {
+            APPL_TRACE_WARNING("%s cache list full and remove the oldest addr info", __func__);
+            cacheReset(cache_env->cache_addr[0].addr, FALSE);
+        }
+        new_index = cache_env->num_addr;
+        assert(new_index < MAX_DEVICE_IN_CACHE);
         memcpy(cache_env->cache_addr[new_index].addr, bd_addr, sizeof(BD_ADDR));
         memcpy(cache_env->cache_addr[new_index].hash_key, hash_key, sizeof(hash_key_t));
         cache_env->num_addr++;
+        APPL_TRACE_DEBUG("%s(), num = %d", __func__, cache_env->num_addr);
     }
 
     nvs_handle_t *fp = &cache_env->addr_fp;
@@ -567,10 +577,10 @@ void bta_gattc_co_cache_addr_save(BD_ADDR bd_addr, hash_key_t hash_key)
             APPL_TRACE_ERROR("%s, Line = %d, nvs flash open fail, err_code = %x", __func__, __LINE__, err_code);
         }
     }
+
     //free the buffer after used.
     osi_free(p_buf);
     return;
-
 }
 
 BOOLEAN bta_gattc_co_cache_new_assoc_list(BD_ADDR src_addr, UINT8 index)

components/bt/host/bluedroid/bta/gatt/bta_gattc_main.c

@@ -66,6 +66,7 @@ enum {
     BTA_GATTC_RESTART_DISCOVER,
     BTA_GATTC_CFG_MTU,
     BTA_GATTC_READ_BY_TYPE,
+    BTA_GATTC_READ_MULTI_VAR,
 
     BTA_GATTC_IGNORE
 };
@@ -100,7 +101,8 @@ const tBTA_GATTC_ACTION bta_gattc_action[] = {
     bta_gattc_disc_close,
     bta_gattc_restart_discover,
     bta_gattc_cfg_mtu,
-    bta_gattc_read_by_type
+    bta_gattc_read_by_type,
+    bta_gattc_read_multi_var,
 };
 
 
@@ -137,6 +139,7 @@ static const UINT8 bta_gattc_st_idle[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_INT_DISCONN_EVT       */    {BTA_GATTC_IGNORE,            BTA_GATTC_IDLE_ST},
 
     /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_FAIL,              BTA_GATTC_IDLE_ST},
+    /* BTA_GATTC_API_READ_MULTI_VAR_EVT */   {BTA_GATTC_FAIL,              BTA_GATTC_IDLE_ST},
 };
 
 /* state table for wait for open state */
@@ -167,6 +170,7 @@ static const UINT8 bta_gattc_st_w4_conn[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_INT_DISCONN_EVT      */     {BTA_GATTC_OPEN_FAIL,          BTA_GATTC_IDLE_ST},
 
     /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_FAIL,               BTA_GATTC_W4_CONN_ST},
+    /* BTA_GATTC_API_READ_MULTI_VAR_EVT */   {BTA_GATTC_FAIL,               BTA_GATTC_W4_CONN_ST},
 };
 
 /* state table for open state */
@@ -198,6 +202,7 @@ static const UINT8 bta_gattc_st_connected[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_INT_DISCONN_EVT        */   {BTA_GATTC_CLOSE,              BTA_GATTC_IDLE_ST},
 
     /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_READ_BY_TYPE,       BTA_GATTC_CONN_ST},
+    /* BTA_GATTC_API_READ_MULTI_VAR_EVT */   {BTA_GATTC_READ_MULTI_VAR,     BTA_GATTC_CONN_ST},
 };
 
 /* state table for discover state */
@@ -228,6 +233,7 @@ static const UINT8 bta_gattc_st_discover[][BTA_GATTC_NUM_COLS] = {
     /* BTA_GATTC_INT_DISCONN_EVT        */   {BTA_GATTC_CLOSE,              BTA_GATTC_IDLE_ST},
 
     /* BTA_GATTC_API_READ_BY_TYPE_EVT   */   {BTA_GATTC_Q_CMD,              BTA_GATTC_DISCOVER_ST},
+    /* BTA_GATTC_API_READ_MULTI_VAR_EVT */   {BTA_GATTC_Q_CMD,              BTA_GATTC_DISCOVER_ST},
 };
 
 /* type for state table */
@@ -487,6 +493,8 @@ static char *gattc_evt_code(tBTA_GATTC_INT_EVT evt_code)
         return "BTA_GATTC_API_CFG_MTU_EVT";
     case BTA_GATTC_API_READ_BY_TYPE_EVT:
         return "BTA_GATTC_API_READ_BY_TYPE_EVT";
+    case BTA_GATTC_API_READ_MULTI_VAR_EVT:
+        return "BTA_GATTC_API_READ_MULTI_VAR_EVT";
     default:
         return "unknown GATTC event code";
     }

components/bt/host/bluedroid/bta/gatt/bta_gattc_utils.c

@@ -322,6 +322,15 @@ void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB *p_clcb)
     }
 }
 
+void bta_gattc_clcb_dealloc_by_conn_id(UINT16 conn_id)
+{
+    tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
+
+    if (p_clcb) {
+        bta_gattc_clcb_dealloc(p_clcb);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         bta_gattc_find_srcb
@@ -421,6 +430,7 @@ tBTA_GATTC_SERV *bta_gattc_srcb_alloc(BD_ADDR bda)
     {
         if (p_tcb->p_srvc_cache != NULL) {
             list_free(p_tcb->p_srvc_cache);
+            p_tcb->p_srvc_cache = NULL;
         }
         osi_free(p_tcb->p_srvc_list);
         p_tcb->p_srvc_list = NULL;

components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c

@@ -906,6 +906,22 @@ void bta_gatts_listen(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
     }
 }
 
+/*******************************************************************************
+**
+** Function         bta_gatts_show_local_database
+**
+** Description      print loacl service database
+**
+** Returns          none.
+**
+*******************************************************************************/
+void bta_gatts_show_local_database (void)
+{
+    if (GATTS_ShowLocalDatabase()) {
+        APPL_TRACE_ERROR("%s failed", __func__);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         bta_gatts_request_cback

components/bt/host/bluedroid/bta/gatt/bta_gatts_api.c

@@ -640,4 +640,41 @@ void BTA_GATTS_Listen(tBTA_GATTS_IF server_if, BOOLEAN start, BD_ADDR_PTR target
     return;
 }
 
+uint8_t BTA_GATTS_SetServiceChangeMode(uint8_t mode)
+{
+    tGATT_STATUS status;
+    APPL_TRACE_DEBUG("%s mode %u", __func__, mode);
+
+    status = GATTS_SetServiceChangeMode(mode);
+    if (status != GATT_SUCCESS) {
+        APPL_TRACE_ERROR("%s status %x", __func__, status);
+        return -1;
+    }
+
+    return 0;
+}
+
+uint8_t BTA_GATTS_SendMultiNotification(uint8_t gatt_if, uint16_t conn_id, void *tuples, uint16_t num_tuples)
+{
+    tGATT_STATUS status;
+    conn_id = (UINT16)((((UINT8)conn_id) << 8) | gatt_if);
+
+    status = GATTS_HandleMultiValueNotification(conn_id, (tGATT_HLV *)tuples, num_tuples);
+    if (status != GATT_SUCCESS) {
+        APPL_TRACE_ERROR("%s status %x", __func__, status);
+        return -1;
+    }
+
+    return 0;
+}
+
+void BTA_GATTS_ShowLocalDatabase(void)
+{
+    BT_HDR  *p_buf;
+
+    if ((p_buf = (BT_HDR *) osi_malloc(sizeof(BT_HDR))) != NULL) {
+        p_buf->event = BTA_GATTS_API_SHOW_LOCAL_DATABASE_EVT;
+        bta_sys_sendmsg(p_buf);
+    }
+}
 #endif /* BTA_GATT_INCLUDED */

components/bt/host/bluedroid/bta/gatt/bta_gatts_co.c

@@ -24,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include "bta/bta_gatts_co.h"
+#include "btc/btc_storage.h"
+#include "btc/btc_ble_storage.h"
 // #include "btif_util.h"
 
 #if (defined(BTIF_INCLUDED) && BTIF_INCLUDED == TRUE)
@@ -159,5 +161,91 @@ BOOLEAN bta_gatts_co_load_handle_range(UINT8 index,
 
     return FALSE;
 }
-#endif
-#endif
+
+#if (SMP_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         bta_gatts_co_cl_feat_save
+**
+** Description      This callout function is executed by GATTS when GATT server
+**                  client support feature is requested to write to NV.
+**
+** Parameter        remote_addr - remote device address
+**                  feature - pointer of client support feature
+**
+** Returns          void.
+**
+*******************************************************************************/
+void bta_gatts_co_cl_feat_save(BD_ADDR remote_addr, UINT8 *feature)
+{
+    bt_bdaddr_t bd_addr;
+
+    memcpy(bd_addr.address, remote_addr, BD_ADDR_LEN);
+    btc_storage_set_gatt_cl_supp_feat(&bd_addr, feature, 1);
+}
+
+/*******************************************************************************
+**
+** Function         bta_gatts_co_db_hash_save
+**
+** Description      This callout function is executed by GATTS when GATT server
+**                  client status is requested to write to NV.
+**
+** Parameter        remote_addr - remote device address
+**                  db_hash - pointer of GATT service datebase hash
+**
+** Returns          void.
+**
+*******************************************************************************/
+void bta_gatts_co_db_hash_save(BD_ADDR remote_addr, BT_OCTET16 db_hash)
+{
+    bt_bdaddr_t bd_addr;
+
+    memcpy(bd_addr.address, remote_addr, BD_ADDR_LEN);
+    btc_storage_set_gatt_db_hash(&bd_addr, db_hash, BT_OCTET16_LEN);
+}
+
+/*******************************************************************************
+**
+** Function         bta_gatts_co_cl_feat_load
+**
+** Description      This callout function is executed by GATTS when GATT server
+**                  client status is requested to load from NV.
+**
+** Parameter        remote_addr - remote device address
+**                  feature - pointer of GATT service datebase hash
+**
+** Returns          void.
+**
+*******************************************************************************/
+void bta_gatts_co_cl_feat_load(BD_ADDR remote_addr, UINT8 *feature)
+{
+    bt_bdaddr_t bd_addr;
+
+    memcpy(bd_addr.address, remote_addr, BD_ADDR_LEN);
+    btc_storage_get_gatt_cl_supp_feat(&bd_addr, feature, 1);
+}
+
+/*******************************************************************************
+**
+** Function         bta_gatts_co_db_hash_load
+**
+** Description      This callout function is executed by GATTS when GATT server
+**                  client status is requested to load from NV.
+**
+** Parameter        remote_addr - remote device address
+**                  db_hash - pointer of GATT service datebase hash
+**
+** Returns          void.
+**
+*******************************************************************************/
+void bta_gatts_co_db_hash_load(BD_ADDR remote_addr, BT_OCTET16 db_hash)
+{
+    bt_bdaddr_t bd_addr;
+
+    memcpy(bd_addr.address, remote_addr, BD_ADDR_LEN);
+    btc_storage_get_gatt_db_hash(&bd_addr, db_hash, BT_OCTET16_LEN);
+}
+#endif // #if (SMP_INCLUDED == TRUE)
+#endif // #if (GATTS_INCLUDED == TRUE)
+#endif // #if (BLE_INCLUDED == TRUE)

components/bt/host/bluedroid/bta/gatt/bta_gatts_main.c

@@ -133,6 +133,9 @@ BOOLEAN bta_gatts_hdl_event(BT_HDR *p_msg)
     case BTA_GATTS_API_SEND_SERVICE_CHANGE_EVT:
         bta_gatts_send_service_change_indication((tBTA_GATTS_DATA *) p_msg);
         break;
+    case BTA_GATTS_API_SHOW_LOCAL_DATABASE_EVT:
+        bta_gatts_show_local_database();
+        break;
     default:
         break;
     }

components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h

@@ -61,6 +61,7 @@ enum {
     BTA_GATTC_INT_DISCONN_EVT,
 
     BTA_GATTC_API_READ_BY_TYPE_EVT,
+    BTA_GATTC_API_READ_MULTI_VAR_EVT,
 
     BTA_GATTC_INT_START_IF_EVT,
     BTA_GATTC_API_REG_EVT,
@@ -394,6 +395,7 @@ enum {
 
 typedef struct {
     UINT8               state;
+    BOOLEAN             auto_disc;  /* internal use: true for auto discovering after connected */
     tBTA_GATTC_CONN     conn_track[BTA_GATTC_CONN_MAX];
     tBTA_GATTC_BG_TCK   bg_track[BTA_GATTC_KNOWN_SR_MAX];
     tBTA_GATTC_RCB      cl_rcb[BTA_GATTC_CL_MAX];
@@ -468,6 +470,7 @@ extern void bta_gattc_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_confirm(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_execute(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
+extern void bta_gattc_read_multi_var(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_ci_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_ci_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);
 extern void bta_gattc_ignore_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data);

components/bt/host/bluedroid/bta/gatt/include/bta_gatts_int.h

@@ -53,7 +53,8 @@ enum {
     BTA_GATTS_API_CLOSE_EVT,
     BTA_GATTS_API_LISTEN_EVT,
     BTA_GATTS_API_DISABLE_EVT,
-    BTA_GATTS_API_SEND_SERVICE_CHANGE_EVT
+    BTA_GATTS_API_SEND_SERVICE_CHANGE_EVT,
+    BTA_GATTS_API_SHOW_LOCAL_DATABASE_EVT
 };
 typedef UINT16 tBTA_GATTS_INT_EVT;
 
@@ -251,6 +252,7 @@ extern void bta_gatts_cancel_open (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg);
 extern void bta_gatts_close (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg);
 extern void bta_gatts_listen(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg);
 extern void bta_gatts_send_service_change_indication (tBTA_GATTS_DATA *p_msg);
+extern void bta_gatts_show_local_database (void);
 
 extern BOOLEAN bta_gatts_uuid_compare(tBT_UUID tar, tBT_UUID src);
 extern tBTA_GATTS_RCB *bta_gatts_find_app_rcb_by_app_if(tBTA_GATTS_IF server_if);

components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c

@@ -94,7 +94,7 @@ static void bta_ag_cback_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data, tBTA_AG_
     /* call app callback with open event */
     open.hdr.handle = bta_ag_scb_to_idx(p_scb);
     open.hdr.app_id = p_scb->app_id;
-    open.status = status;
+    open.hdr.status = status;
     open.service_id = bta_ag_svc_id[p_scb->conn_service];
     if (p_data) {
         /* if p_data is provided then we need to pick the bd address from the open api structure */
@@ -131,7 +131,7 @@ void bta_ag_register(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data)
     /* call app callback with register event */
     reg.hdr.handle = bta_ag_scb_to_idx(p_scb);
     reg.hdr.app_id = p_scb->app_id;
-    reg.status = BTA_AG_SUCCESS;
+    reg.hdr.status = BTA_AG_SUCCESS;
     (*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG *) &reg);
 }
 

components/bt/host/bluedroid/bta/hf_ag/bta_ag_main.c

@@ -461,11 +461,11 @@ void bta_ag_scb_dealloc(tBTA_AG_SCB *p_scb)
 
     APPL_TRACE_DEBUG("bta_ag_scb_dealloc %d", bta_ag_scb_to_idx(p_scb));
     /* stop timers */
-    bta_sys_stop_timer(&p_scb->act_timer);
+    bta_sys_free_timer(&p_scb->act_timer);
 #if (BTM_WBS_INCLUDED == TRUE)
-    bta_sys_stop_timer(&p_scb->cn_timer);
+    bta_sys_free_timer(&p_scb->cn_timer);
 #endif
-    bta_sys_stop_timer(&p_scb->colli_timer);
+    bta_sys_free_timer(&p_scb->colli_timer);
 
     /* initialize control block */
     memset(p_scb, 0, sizeof(tBTA_AG_SCB));
@@ -831,7 +831,7 @@ static void bta_ag_api_register(tBTA_AG_DATA *p_data)
         APPL_TRACE_DEBUG("bta_ag_api_register: p_scb 0x%08x ", (unsigned int)p_scb);
         bta_ag_sm_execute(p_scb, p_data->hdr.event, p_data);
     } else {
-        reg.status = BTA_AG_FAIL_RESOURCES;
+        reg.hdr.status = BTA_AG_FAIL_RESOURCES;
         (*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG *) &reg);
     }
 }

components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c

@@ -82,15 +82,13 @@ static const tBTM_ESCO_PARAMS bta_ag_esco_params[BTA_AG_NUM_CODECS] =
     {
         BTM_64KBITS_RATE,                   /* TX Bandwidth (64 kbits/sec)              */
         BTM_64KBITS_RATE,                   /* RX Bandwidth (64 kbits/sec)              */
-        10,                                 /* 10 ms (HS/HF can use EV3, 2-EV3, 3-EV3)  */
+        10,                                 /* 10 ms (HS/HF can use EV3, 2-EV3)         */
         BTM_VOICE_SETTING_CVSD,             /* Inp Linear, Air CVSD, 2s Comp, 16bit     */
-       (BTM_SCO_PKT_TYPES_MASK_HV1      +   /* Packet Types                             */
-        BTM_SCO_PKT_TYPES_MASK_HV2      +
-        BTM_SCO_PKT_TYPES_MASK_HV3      +
-        BTM_SCO_PKT_TYPES_MASK_EV3      +
-        BTM_SCO_PKT_TYPES_MASK_EV4      +
-        BTM_SCO_PKT_TYPES_MASK_EV5      +
-        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 +
+       (BTM_SCO_PKT_TYPES_MASK_HV1      |   /* Packet Types                             */
+        BTM_SCO_PKT_TYPES_MASK_HV3      |
+        BTM_SCO_PKT_TYPES_MASK_EV3      |
+        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         BTM_ESCO_RETRANS_POWER               /* Retransmission effort                     */
     },
@@ -100,7 +98,7 @@ static const tBTM_ESCO_PARAMS bta_ag_esco_params[BTA_AG_NUM_CODECS] =
         BTM_64KBITS_RATE,                   /* RX Bandwidth (64 kbits/sec), 8000        */
         8,                                  /* 8 ms                                     */
         BTM_VOICE_SETTING_TRANS,            /* Inp Linear, Transparent, 2s Comp, 16bit  */
-       (BTM_SCO_PKT_TYPES_MASK_EV3      |   /* Packet Types : EV3 + NO_2_EV3            */
+       (BTM_SCO_PKT_TYPES_MASK_EV3      |   /* Packet Types : EV3                       */
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5 |
@@ -113,8 +111,7 @@ static const tBTM_ESCO_PARAMS bta_ag_esco_params[BTA_AG_NUM_CODECS] =
         BTM_64KBITS_RATE,                   /* RX Bandwidth (64 kbits/sec), 8000        */
         13,                                 /* 13 ms                                    */
         BTM_VOICE_SETTING_TRANS,            /* Inp Linear, Transparent, 2s Comp, 16bit  */
-       (BTM_SCO_PKT_TYPES_MASK_EV3      |   /* Packet Types : EV3 + 2-EV3               */
-        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
+       (BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |   /* Packet Types : 2-EV3                     */
         BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         BTM_ESCO_RETRANS_QUALITY            /* Retransmission effort                     */
@@ -124,11 +121,11 @@ static const tBTM_ESCO_PARAMS bta_ag_esco_params[BTA_AG_NUM_CODECS] =
     {
         BTM_64KBITS_RATE,                   /* TX Bandwidth (64 kbits/sec)              */
         BTM_64KBITS_RATE,                   /* RX Bandwidth (64 kbits/sec)              */
-        12,                                 /* 12 ms (HS/HF can use EV3, 2-EV3)  */
+        12,                                 /* 12 ms (HS/HF can use 2-EV3)              */
         BTM_VOICE_SETTING_CVSD,             /* Inp Linear, Air CVSD, 2s Comp, 16bit     */
-        (BTM_SCO_LINK_ALL_PKT_MASK |
-         BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
-         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
+       (BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |   /* Packet Types : 2-EV3                     */
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         BTM_ESCO_RETRANS_QUALITY            /* Retransmission effort                    */
     }
 };
@@ -143,15 +140,13 @@ static const tBTM_ESCO_PARAMS bta_ag_esco_params[] =
     {
         BTM_64KBITS_RATE,                   /* TX Bandwidth (64 kbits/sec)              */
         BTM_64KBITS_RATE,                   /* RX Bandwidth (64 kbits/sec)              */
-        10,                                 /* 10 ms (HS/HF can use EV3, 2-EV3, 3-EV3)  */
+        10,                                 /* 10 ms (HS/HF can use EV3, 2-EV3)         */
         BTM_VOICE_SETTING_CVSD,             /* Inp Linear, Air CVSD, 2s Comp, 16bit     */
-        (BTM_SCO_PKT_TYPES_MASK_HV1      +  /* Packet Types                             */
-        BTM_SCO_PKT_TYPES_MASK_HV2      +
-        BTM_SCO_PKT_TYPES_MASK_HV3      +
-        BTM_SCO_PKT_TYPES_MASK_EV3      +
-        BTM_SCO_PKT_TYPES_MASK_EV4      +
-        BTM_SCO_PKT_TYPES_MASK_EV5      +
-        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 +
+       (BTM_SCO_PKT_TYPES_MASK_HV1      |   /* Packet Types                             */
+        BTM_SCO_PKT_TYPES_MASK_HV3      |
+        BTM_SCO_PKT_TYPES_MASK_EV3      |
+        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         BTM_ESCO_RETRANS_POWER              /* Retransmission effort                      */
     },
@@ -160,11 +155,11 @@ static const tBTM_ESCO_PARAMS bta_ag_esco_params[] =
     {
         BTM_64KBITS_RATE,                   /* TX Bandwidth (64 kbits/sec)              */
         BTM_64KBITS_RATE,                   /* RX Bandwidth (64 kbits/sec)              */
-        12,                                 /* 12 ms (HS/HF can use EV3, 2-EV3)  */
+        12,                                 /* 12 ms (HS/HF can use 2-EV3)              */
         BTM_VOICE_SETTING_CVSD,             /* Inp Linear, Air CVSD, 2s Comp, 16bit     */
-        (BTM_SCO_LINK_ALL_PKT_MASK |
-         BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
-         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
+       (BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         BTM_ESCO_RETRANS_QUALITY            /* Retransmission effort                    */
     }
 };
@@ -1659,7 +1654,8 @@ void bta_ag_sco_conn_rsp(tBTA_AG_SCB *p_scb, tBTM_ESCO_CONN_REQ_EVT_DATA *p_data
             if (p_data->link_type == BTM_LINK_TYPE_SCO)
             {
                 resp.retrans_effort = BTM_ESCO_RETRANS_OFF;
-                resp.packet_types = (BTM_SCO_LINK_ONLY_MASK          |
+                resp.packet_types = (BTM_SCO_PKT_TYPES_MASK_HV1      |
+                                     BTM_SCO_PKT_TYPES_MASK_HV3      |
                                      BTM_SCO_PKT_TYPES_MASK_NO_2_EV3 |
                                      BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
                                      BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
@@ -1674,8 +1670,9 @@ void bta_ag_sco_conn_rsp(tBTA_AG_SCB *p_scb, tBTM_ESCO_CONN_REQ_EVT_DATA *p_data
                     resp.retrans_effort = BTM_ESCO_RETRANS_QUALITY;
                 }
 
-                resp.packet_types = (BTM_SCO_LINK_ALL_PKT_MASK |
+                resp.packet_types = (BTM_SCO_PKT_TYPES_MASK_EV3      |
                                      BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+                                     BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
                                      BTM_SCO_PKT_TYPES_MASK_NO_3_EV5);
             }
         }

components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c

@@ -427,7 +427,8 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
 
     APPL_TRACE_DEBUG("%s index: %u value: %u", __FUNCTION__, index, value);
 
-    if (index >= BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
+    if (index == 0 || index > BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
+        APPL_TRACE_WARNING("%s: Invalid index %d", __FUNCTION__, index);
         return;
     }
 
@@ -435,7 +436,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
         service_availability = value == 0 ? FALSE : TRUE;
     }
 
-    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index];
+    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index - 1];
 
     if (realind >= 0 && realind < BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT) {
         /* get the real in-array index from lookup table by index it comes at */

components/bt/host/bluedroid/bta/hf_client/bta_hf_client_sco.c

@@ -47,7 +47,8 @@ static const tBTM_ESCO_PARAMS bta_hf_client_esco_params[] = {
         .tx_bw = BTM_64KBITS_RATE,
         .max_latency = 10,
         .voice_contfmt = BTM_VOICE_SETTING_CVSD,
-        .packet_types = (BTM_SCO_LINK_ONLY_MASK          |
+        .packet_types = (BTM_SCO_PKT_TYPES_MASK_HV1 |
+        BTM_SCO_PKT_TYPES_MASK_HV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_2_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
@@ -60,9 +61,9 @@ static const tBTM_ESCO_PARAMS bta_hf_client_esco_params[] = {
         .tx_bw = BTM_64KBITS_RATE,
         .max_latency = 10,
         .voice_contfmt = BTM_VOICE_SETTING_CVSD,
-        /* Allow controller to use all types available except 5-slot EDR */
-        .packet_types = (BTM_SCO_LINK_ALL_PKT_MASK |
-        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        /* Packet Types : 2-EV3 */
+        .packet_types = (BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         .retrans_effort = BTM_ESCO_RETRANS_POWER,
     },
@@ -72,10 +73,9 @@ static const tBTM_ESCO_PARAMS bta_hf_client_esco_params[] = {
         .tx_bw = BTM_64KBITS_RATE,
         .max_latency = 13,
         .voice_contfmt = BTM_VOICE_SETTING_TRANS,
-        /* Packet Types : EV3 + 2-EV3               */
-        .packet_types = (BTM_SCO_PKT_TYPES_MASK_EV3  |
+        /* Packet Types : 2-EV3 */
+        .packet_types = (BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
-        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         .retrans_effort = BTM_ESCO_RETRANS_QUALITY,
     },
@@ -86,9 +86,9 @@ static const tBTM_ESCO_PARAMS bta_hf_client_esco_params[] = {
         .tx_bw = BTM_64KBITS_RATE,
         .max_latency = 12,
         .voice_contfmt = BTM_VOICE_SETTING_CVSD,
-        /* Allow controller to use all types available except 5-slot EDR */
-        .packet_types = (BTM_SCO_LINK_ALL_PKT_MASK |
-        BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        /* Packet Types : 2-EV3 */
+        .packet_types = (BTM_SCO_PKT_TYPES_MASK_NO_2_EV5 |
+        BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 |
         BTM_SCO_PKT_TYPES_MASK_NO_3_EV5),
         .retrans_effort = BTM_ESCO_RETRANS_QUALITY,
     }

components/bt/host/bluedroid/bta/include/bta/bta_ag_api.h

@@ -333,8 +333,6 @@ typedef struct
 typedef struct
 {
     tBTA_AG_HDR         hdr;
-    UINT16              handle;
-    tBTA_AG_STATUS      status;
 } tBTA_AG_REGISTER;
 
 /* data associated with BTA_AG_OPEN_EVT */
@@ -343,7 +341,6 @@ typedef struct
     tBTA_AG_HDR         hdr;
     BD_ADDR             bd_addr;
     tBTA_SERVICE_ID     service_id;
-    tBTA_AG_STATUS      status;
 } tBTA_AG_OPEN;
 
 /* data associated with BTA_AG_CLOSE_EVT */

components/bt/host/bluedroid/bta/include/bta/bta_api.h

@@ -659,6 +659,8 @@ typedef UINT8 tBTA_SIG_STRENGTH_MASK;
 #define BTA_DM_SP_KEY_REQ_EVT           30      /* Simple Pairing Passkey request */
 #define BTA_DM_PM_MODE_CHG_EVT          31      /* Mode changed event */
 #define BTA_DM_ACL_LINK_STAT_EVT        32      /* ACL connection status report event */
+#define BTA_DM_BLE_SC_OOB_REQ_EVT       33      /* BLE SMP SC OOB request event */
+#define BTA_DM_BLE_SC_CR_LOC_OOB_EVT    34      /* BLE SMP SC Create Local OOB request event */
 
 typedef UINT8 tBTA_DM_SEC_EVT;
 
@@ -978,6 +980,10 @@ typedef struct {
     tBTA_PM_MODE    mode;               /* the new connection role */
 } tBTA_DM_MODE_CHG;
 
+typedef struct {
+    BT_OCTET16      local_oob_c;    /* Local OOB Data Confirmation/Commitment */
+    BT_OCTET16      local_oob_r;    /* Local OOB Data Randomizer */
+} tBTA_DM_LOC_OOB_DATA;
 
 /* Union of all security callback structures */
 typedef union {
@@ -1003,6 +1009,7 @@ typedef union {
 #if BTA_DM_PM_INCLUDED
     tBTA_DM_MODE_CHG            mode_chg;           /* mode change event */
 #endif ///BTA_DM_PM_INCLUDED
+    tBTA_DM_LOC_OOB_DATA        local_oob_data;     /* Local OOB data generated by us */
 } tBTA_DM_SEC;
 
 /* Security callback */
@@ -1589,7 +1596,14 @@ typedef struct {
 #define BTA_DM_BLE_5_GAP_PERIODIC_ADV_REPORT_EVT                   BTM_BLE_5_GAP_PERIODIC_ADV_REPORT_EVT
 #define BTA_DM_BLE_5_GAP_PERIODIC_ADV_SYNC_LOST_EVT                BTM_BLE_5_GAP_PERIODIC_ADV_SYNC_LOST_EVT
 #define BTA_DM_BLE_5_GAP_PERIODIC_ADV_SYNC_ESTAB_EVT               BTM_BLE_5_GAP_PERIODIC_ADV_SYNC_ESTAB_EVT
-#define BTA_DM_BLE_5_GAP_UNKNOWN_EVT                              BTM_BLE_5_GAP_UNKNOWN_EVT
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define BTA_BLE_GAP_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT          BTM_BLE_GAP_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT
+#define BTA_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT           BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT
+#define BTA_BLE_GAP_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT       BTM_BLE_GAP_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT
+#define BTA_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT                   BTM_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT
+#define BTA_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_RECV_EVT               BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_RECV_EVT
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define BTA_DM_BLE_5_GAP_UNKNOWN_EVT                               BTM_BLE_5_GAP_UNKNOWN_EVT
 typedef tBTM_BLE_5_GAP_EVENT tBTA_DM_BLE_5_GAP_EVENT;
 
 typedef tBTM_BLE_5_GAP_CB_PARAMS tBTA_DM_BLE_5_GAP_CB_PARAMS;
@@ -1599,6 +1613,15 @@ extern tBTM_BLE_5_HCI_CBACK ble_5_hci_cb;
 
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+typedef struct {
+    UINT8 mode;
+    UINT16 skip;
+    UINT16 sync_timeout;
+    UINT8 cte_type;
+} tBTA_DM_BLE_PAST_PARAMS;
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 /*****************************************************************************
 **  External Function Declarations
 *****************************************************************************/
@@ -1933,7 +1956,7 @@ extern void BTA_DmLocalOob(void);
 ** Function         BTA_DmOobReply
 **
 **                  This function is called to provide the OOB data for
-**                  SMP in response to BTM_LE_OOB_REQ_EVT
+**                  SMP in response to BTA_LE_OOB_REQ_EVT
 **
 ** Parameters:      bd_addr     - Address of the peer device
 **                  len         - length of simple pairing Randomizer  C
@@ -1943,6 +1966,33 @@ extern void BTA_DmLocalOob(void);
 **
 *******************************************************************************/
 extern void BTA_DmOobReply(BD_ADDR bd_addr, UINT8 len, UINT8 *p_value);
+
+/*******************************************************************************
+**
+** Function         BTA_DmSecureConnectionOobReply
+**
+**                  This function is called to provide the OOB data for
+**                  SMP in response to BTA_LE_OOB_REQ_EVT when secure connection
+**
+** Parameters:      bd_addr     - Address of the peer device
+**                  p_c         - Pointer to Confirmation
+**                  p_r         - Pointer to Randomizer
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_DmSecureConnectionOobReply(BD_ADDR bd_addr, UINT8 *p_c, UINT8 *p_r);
+/*******************************************************************************
+**
+** Function         BTA_DmSecureConnectionCreateOobData
+**
+**                  This function is called to create the OOB data for
+**                  SMP when secure connection
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_DmSecureConnectionCreateOobData(void);
 #endif /* BTM_OOB_INCLUDED */
 
 /*******************************************************************************
@@ -2947,9 +2997,9 @@ extern void BTA_DmBleGapPeriodicAdvSetParams(UINT8 instance,
                                                          tBTA_DM_BLE_Periodic_Adv_Params *params);
 
 extern void BTA_DmBleGapPeriodicAdvCfgDataRaw(UINT8 instance, UINT16 length,
-                                                           const UINT8 *data);
+                                                           const UINT8 *data,BOOLEAN only_update_did);
 
-extern void BTA_DmBleGapPeriodicAdvEnable(BOOLEAN enable, UINT8 instance);
+extern void BTA_DmBleGapPeriodicAdvEnable(UINT8 enable, UINT8 instance);
 
 extern void BTA_DmBleGapPeriodicAdvCreateSync(tBTA_DM_BLE_Periodic_Sync_Params *params);
 
@@ -2980,6 +3030,16 @@ extern void BTA_DmBleGapPreferExtConnectParamsSet(BD_ADDR bd_addr,
 extern void BTA_DmBleGapExtConnect(tBLE_ADDR_TYPE own_addr_type, const BD_ADDR peer_addr);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+extern void BTA_DmBleGapPeriodicAdvRecvEnable(UINT16 sync_handle, UINT8 enable);
+
+extern void BTA_DmBleGapPeriodicAdvSyncTrans(BD_ADDR peer_addr, UINT16 service_data, UINT16 sync_handle);
+
+extern void BTA_DmBleGapPeriodicAdvSetInfoTrans(BD_ADDR peer_addr, UINT16 service_data, UINT8 adv_handle);
+
+extern void BTA_DmBleGapSetPeriodicAdvSyncTransParams(BD_ADDR peer_addr, tBTA_DM_BLE_PAST_PARAMS *params);
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 #endif
 
 enum {

components/bt/host/bluedroid/bta/include/bta/bta_av_api.h

@@ -256,6 +256,8 @@ typedef BOOLEAN (*tBTA_AV_CO_INIT) (UINT8 *p_codec_type, UINT8 *p_codec_info,
                                     UINT8 *p_num_protect, UINT8 *p_protect_info, UINT8 tsep);
 typedef void (*tBTA_AV_CO_DISC_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
                                      UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
+typedef void (*tBTA_AV_CO_CFG_RES) (tBTA_AV_HNDL hndl, UINT8 num_seps,
+                                     UINT8 num_snk, UINT8 num_src, BD_ADDR addr, UINT16 uuid_local);
 typedef UINT8 (*tBTA_AV_CO_GETCFG) (tBTA_AV_HNDL hndl, tBTA_AV_CODEC codec_type,
                                     UINT8 *p_codec_info, UINT8 *p_sep_info_idx, UINT8 seid,
                                     UINT8 *p_num_protect, UINT8 *p_protect_info);
@@ -285,6 +287,7 @@ typedef BOOLEAN (*tBTA_AVRC_CO_RN_EVT_SUPPORTED) (UINT8 event_id);
 typedef struct {
     tBTA_AV_CO_INIT               init;
     tBTA_AV_CO_DISC_RES           disc_res;
+    tBTA_AV_CO_CFG_RES            cfg_res;
     tBTA_AV_CO_GETCFG             getcfg;
     tBTA_AV_CO_SETCFG             setcfg;
     tBTA_AV_CO_OPEN               open;

components/bt/host/bluedroid/bta/include/bta/bta_gatt_api.h

@@ -185,6 +185,7 @@ typedef UINT8 tBTA_GATT_STATUS;
 #define BTA_GATTC_ASSOC_EVT             39 /* GATTC association address event */
 #define BTA_GATTC_GET_ADDR_LIST_EVT     40 /* GATTC get address list in the cache event */
 #define BTA_GATTC_DIS_SRVC_CMPL_EVT     41 /* GATTC discover service complete */
+#define BTA_GATTC_READ_MULTI_VAR_EVT    42 /* GATTC read multiple variable event */
 
 typedef UINT8 tBTA_GATTC_EVT;
 
@@ -1137,6 +1138,21 @@ extern void BTA_GATTC_ExecuteWrite  (UINT16 conn_id, BOOLEAN is_execute);
 extern void BTA_GATTC_ReadMultiple(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi,
                                    tBTA_GATT_AUTH_REQ auth_req);
 
+/*******************************************************************************
+**
+** Function         BTA_GATTC_ReadMultiple
+**
+** Description      This function is called to read multiple variable length characteristic or
+**                  characteristic descriptors.
+**
+** Parameters       conn_id - connection ID.
+**                    p_read_multi - read multiple parameters.
+**
+** Returns          None
+**
+*******************************************************************************/
+extern void BTA_GATTC_ReadMultipleVariable(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_multi,
+                            tBTA_GATT_AUTH_REQ auth_req);
 
 /*******************************************************************************
 **
@@ -1543,6 +1559,18 @@ void BTA_GATTS_SendServiceChangeIndication(tBTA_GATTS_IF server_if, BD_ADDR remo
 extern void BTA_GATTS_Listen(tBTA_GATTS_IF server_if, BOOLEAN start,
                              BD_ADDR_PTR target_bda);
 
+/*******************************************************************************
+**
+** Function         BTA_GATTS_ShowLocalDatabase
+**
+** Description      print local service database.
+**
+** Returns          void
+**
+*******************************************************************************/
+extern void BTA_GATTS_ShowLocalDatabase(void);
+
+extern void bta_gattc_clcb_dealloc_by_conn_id(UINT16 conn_id);
 
 #ifdef __cplusplus
 

components/bt/host/bluedroid/bta/include/bta/bta_gatts_co.h

@@ -77,5 +77,12 @@ extern BOOLEAN bta_gatts_co_srv_chg(tBTA_GATTS_SRV_CHG_CMD cmd,
 extern  BOOLEAN bta_gatts_co_load_handle_range(UINT8 index,
         tBTA_GATTS_HNDL_RANGE *p_handle);
 
+extern void bta_gatts_co_cl_feat_save(BD_ADDR remote_addr, UINT8 *feature);
+
+extern void bta_gatts_co_db_hash_save(BD_ADDR remote_addr, BT_OCTET16 db_hash);
+
+extern void bta_gatts_co_cl_feat_load(BD_ADDR remote_addr, UINT8 *feature);
+
+extern void bta_gatts_co_db_hash_load(BD_ADDR remote_addr, BT_OCTET16 db_hash);
 
 #endif /* BTA_GATTS_CO_H */

components/bt/host/bluedroid/btc/core/btc_ble_storage.c

@@ -47,7 +47,9 @@ static void _btc_storage_save(void)
                 !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_PID_STR) &&
                 !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_PCSRK_STR) &&
                 !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_LENC_STR) &&
-                !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_LCSRK_STR)) {
+                !btc_config_exist(section, BTC_BLE_STORAGE_LE_KEY_LCSRK_STR) &&
+                !btc_config_exist(section, BTC_BLE_STORAGE_GATT_CL_SUPP_FEAT_STR) &&
+                !btc_config_exist(section, BTC_BLE_STORAGE_GATT_DB_HASH_STR)) {
             iter = btc_config_section_next(iter);
             btc_config_remove_section(section);
             continue;
@@ -930,5 +932,79 @@ int btc_storage_get_num_ble_bond_devices(void)
 
     return num_dev;
 }
+
+bt_status_t btc_storage_get_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len)
+{
+    bdstr_t bdstr;
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    int ret = btc_config_get_bin(bdstr, BTC_BLE_STORAGE_GATT_CL_SUPP_FEAT_STR, value, (size_t *)&len);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+bt_status_t btc_storage_set_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len)
+{
+    int ret;
+    bdstr_t bdstr;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr_t));
+    ret = btc_config_set_bin(bdstr, BTC_BLE_STORAGE_GATT_CL_SUPP_FEAT_STR, value, (size_t)len);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    return BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_get_gatt_db_hash(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len)
+{
+    bdstr_t bdstr;
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    int ret = btc_config_get_bin(bdstr, BTC_BLE_STORAGE_GATT_DB_HASH_STR, value, (size_t *)&len);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+bt_status_t btc_storage_set_gatt_db_hash(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len)
+{
+    int ret;
+    bdstr_t bdstr;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr_t));
+    ret = btc_config_set_bin(bdstr, BTC_BLE_STORAGE_GATT_DB_HASH_STR, value, (size_t)len);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    return BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_remove_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr)
+{
+    bool ret = true;
+    bdstr_t bdstr;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+
+    ret = btc_config_remove(bdstr, BTC_BLE_STORAGE_GATT_CL_SUPP_FEAT_STR);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    return  BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_remove_gatt_db_hash(bt_bdaddr_t *remote_bd_addr)
+{
+    bool ret = true;
+    bdstr_t bdstr;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+
+    ret = btc_config_remove(bdstr, BTC_BLE_STORAGE_GATT_DB_HASH_STR);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    return  BT_STATUS_SUCCESS;
+}
 #endif  ///BLE_INCLUDED == TRUE
 #endif  ///SMP_INCLUDED == TRUE

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -181,6 +181,8 @@ static void btc_dm_remove_ble_bonding_keys(void)
 
     bdcpy(bd_addr.address, btc_dm_cb.pairing_cb.bd_addr);
 
+    btc_storage_remove_gatt_cl_supp_feat(&bd_addr);
+    btc_storage_remove_gatt_db_hash(&bd_addr);
     btc_storage_remove_remote_addr_type(&bd_addr, false);
     btc_storage_remove_ble_dev_auth_mode(&bd_addr, false);
     btc_storage_remove_ble_dev_type(&bd_addr, false);
@@ -817,6 +819,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
 
         if (p_data->link_down.status == HCI_SUCCESS) {
             //remove the bonded key in the config and nvs flash.
+            btc_storage_remove_gatt_cl_supp_feat(&bd_addr);
+            btc_storage_remove_gatt_db_hash(&bd_addr);
             btc_storage_remove_ble_dev_type(&bd_addr, false);
             btc_storage_remove_remote_addr_type(&bd_addr, false);
             btc_storage_remove_ble_dev_auth_mode(&bd_addr, false);
@@ -952,6 +956,19 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
         memcpy(param.ble_security.ble_req.bd_addr, p_data->ble_req.bd_addr, BD_ADDR_LEN);
         break;
     }
+    case BTA_DM_BLE_SC_OOB_REQ_EVT: {
+        rsp_app = true;
+        ble_msg->act = ESP_GAP_BLE_SC_OOB_REQ_EVT;
+        memcpy(param.ble_security.ble_req.bd_addr, p_data->ble_req.bd_addr, BD_ADDR_LEN);
+        break;
+    }
+    case BTA_DM_BLE_SC_CR_LOC_OOB_EVT: {
+        rsp_app = true;
+        ble_msg->act = ESP_GAP_BLE_SC_CR_LOC_OOB_EVT;
+        memcpy(param.ble_security.oob_data.oob_c, p_data->local_oob_data.local_oob_c, BT_OCTET16_LEN);
+        memcpy(param.ble_security.oob_data.oob_r, p_data->local_oob_data.local_oob_r, BT_OCTET16_LEN);
+        break;
+    }
     case BTA_DM_BLE_LOCAL_IR_EVT: {
         rsp_app = true;
         ble_msg->act = ESP_GAP_BLE_LOCAL_IR_EVT;

components/bt/host/bluedroid/btc/include/btc/btc_ble_storage.h

@@ -88,6 +88,20 @@ bt_status_t btc_storage_load_bonded_ble_devices(void);
 bt_status_t btc_storage_get_bonded_ble_devices_list(esp_ble_bond_dev_t *bond_dev, int dev_num);
 
 int btc_storage_get_num_ble_bond_devices(void);
-
 #endif  ///SMP_INCLUDED == TRUE
+
+#define BTC_BLE_STORAGE_GATT_CL_SUPP_FEAT_STR       "GATT_CL_SUPP_FEAT"
+#define BTC_BLE_STORAGE_GATT_DB_HASH_STR            "GATT_DB_HASH"
+
+bt_status_t btc_storage_get_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len);
+
+bt_status_t btc_storage_set_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len);
+
+bt_status_t btc_storage_remove_gatt_cl_supp_feat(bt_bdaddr_t *remote_bd_addr);
+
+bt_status_t btc_storage_get_gatt_db_hash(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len);
+
+bt_status_t btc_storage_set_gatt_db_hash(bt_bdaddr_t *remote_bd_addr, uint8_t *value, int len);
+
+bt_status_t btc_storage_remove_gatt_db_hash(bt_bdaddr_t *remote_bd_addr);
 #endif  ///__BTC_BLE_STORAGE_H__

components/bt/host/bluedroid/btc/profile/std/a2dp/bta_av_co.c

@@ -312,6 +312,58 @@ void bta_av_co_audio_disc_res(tBTA_AV_HNDL hndl, UINT8 num_seps, UINT8 num_snk,
     } else if (uuid_local == UUID_SERVCLASS_AUDIO_SOURCE) {
         p_peer->uuid_to_connect = UUID_SERVCLASS_AUDIO_SINK;
     }
+    p_peer->got_disc_res = TRUE;
+}
+
+/*******************************************************************************
+ **
+ ** Function         bta_av_co_audio_cfg_res
+ **
+ ** Description      This callout function is executed by AV to report the
+ **                  number of stream end points (SEP) were found during the
+ **                  incoming AVDT stream config request process.
+ **
+ **
+ ** Returns          void.
+ **
+ *******************************************************************************/
+void bta_av_co_audio_cfg_res(tBTA_AV_HNDL hndl, UINT8 num_seps, UINT8 num_snk,
+                              UINT8 num_src, BD_ADDR addr, UINT16 uuid_local)
+{
+    tBTA_AV_CO_PEER *p_peer;
+
+    FUNC_TRACE();
+
+    APPL_TRACE_DEBUG("bta_av_co_audio_cfg_res h:x%x num_seps:%d num_snk:%d num_src:%d",
+                     hndl, num_seps, num_snk, num_src);
+
+    /* Find the peer info */
+    p_peer = bta_av_co_get_peer(hndl);
+    if (p_peer == NULL) {
+        APPL_TRACE_ERROR("bta_av_co_audio_cfg_res could not find peer entry");
+        return;
+    }
+
+    /* Sanity check : this should never happen */
+    if (p_peer->opened) {
+        APPL_TRACE_ERROR("bta_av_co_audio_cfg_res peer already opened");
+    }
+
+    /* Copy the discovery results */
+    bdcpy(p_peer->addr, addr);
+    if (!p_peer->got_disc_res) {
+        p_peer->num_snks = num_snk;
+        p_peer->num_srcs = num_src;
+        p_peer->num_seps = num_seps;
+        p_peer->num_rx_snks = 0;
+        p_peer->num_rx_srcs = 0;
+        p_peer->num_sup_snks = 0;
+    }
+    if (uuid_local == UUID_SERVCLASS_AUDIO_SINK) {
+        p_peer->uuid_to_connect = UUID_SERVCLASS_AUDIO_SOURCE;
+    } else if (uuid_local == UUID_SERVCLASS_AUDIO_SOURCE) {
+        p_peer->uuid_to_connect = UUID_SERVCLASS_AUDIO_SINK;
+    }
 }
 
 /*******************************************************************************
@@ -1696,6 +1748,7 @@ BOOLEAN bta_av_co_get_remote_bitpool_pref(UINT8 *min, UINT8 *max)
 const tBTA_AV_CO_FUNCTS bta_av_a2d_cos = {
     bta_av_co_audio_init,
     bta_av_co_audio_disc_res,
+    bta_av_co_audio_cfg_res,
     bta_av_co_audio_getconfig,
     bta_av_co_audio_setconfig,
     bta_av_co_audio_open,

components/bt/host/bluedroid/btc/profile/std/a2dp/include/btc_av_co.h

@@ -61,6 +61,7 @@ typedef struct {
     BOOLEAN         opened;             /* opened */
     UINT16          mtu;                /* maximum transmit unit size */
     UINT16          uuid_to_connect;    /* uuid of peer device */
+    BOOLEAN         got_disc_res;       /* got the results of initiating discovery */
 } tBTA_AV_CO_PEER;
 
 typedef struct {

components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -86,7 +86,8 @@ static void btc_gap_ble_get_dev_name_callback(UINT8 status, char *name)
     param.get_dev_name_cmpl.status = btc_btm_status_to_esp_status(status);
     param.get_dev_name_cmpl.name = (char *)osi_malloc(BTC_MAX_LOC_BD_NAME_LEN + 1);
     if (param.get_dev_name_cmpl.name) {
-        BCM_STRNCPY_S(param.get_dev_name_cmpl.name, name, BTC_MAX_LOC_BD_NAME_LEN + 1);
+        BCM_STRNCPY_S(param.get_dev_name_cmpl.name, name, BTC_MAX_LOC_BD_NAME_LEN);
+        param.get_dev_name_cmpl.name[BTC_MAX_LOC_BD_NAME_LEN] = '\0';
     } else {
         param.get_dev_name_cmpl.status = ESP_BT_STATUS_NOMEM;
     }
@@ -1098,6 +1099,40 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
             param.periodic_adv_sync_estab.adv_clk_accuracy = params->sync_estab.adv_clk_accuracy;
             break;
         }
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+        case BTA_BLE_GAP_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT:
+            msg.act = ESP_GAP_BLE_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT;
+            param.period_adv_recv_enable.status = btc_btm_status_to_esp_status(params->per_adv_recv_enable.status);
+            break;
+        case BTA_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT:
+            msg.act = ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT;
+            param.period_adv_sync_trans.status = btc_btm_status_to_esp_status(params->per_adv_sync_trans.status);
+            memcpy(param.period_adv_sync_trans.bda, params->per_adv_sync_trans.addr, sizeof(BD_ADDR));
+            break;
+        case BTA_BLE_GAP_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT:
+            msg.act = ESP_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT;
+            param.period_adv_set_info_trans.status = btc_btm_status_to_esp_status(params->per_adv_set_info_trans.status);
+            memcpy(param.period_adv_set_info_trans.bda, params->per_adv_set_info_trans.addr, sizeof(BD_ADDR));
+            break;
+        case BTA_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT:
+            msg.act = ESP_GAP_BLE_SET_PAST_PARAMS_COMPLETE_EVT;
+            param.set_past_params.status = btc_btm_status_to_esp_status(params->set_past_params.status);
+            memcpy(param.set_past_params.bda, params->set_past_params.addr, sizeof(BD_ADDR));
+            break;
+        case BTA_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_RECV_EVT:
+            msg.act = ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT;
+            param.past_received.status = btc_btm_status_to_esp_status(params->past_recv.status);
+            memcpy(param.past_received.bda, params->past_recv.addr, sizeof(BD_ADDR));
+            param.past_received.service_data = params->past_recv.service_data;
+            param.past_received.sync_handle = params->past_recv.sync_handle;
+            param.past_received.adv_sid = params->past_recv.adv_sid;
+            param.past_received.adv_addr_type = params->past_recv.adv_addr_type;
+            memcpy(param.past_received.adv_addr, params->past_recv.adv_addr, sizeof(BD_ADDR));
+            param.past_received.adv_phy = params->past_recv.adv_phy;
+            param.past_received.adv_interval = params->past_recv.adv_interval;
+            param.past_received.adv_clk_accuracy = params->past_recv.adv_clk_accuracy;
+            break;
+#endif
         default:
             break;
     }
@@ -1334,6 +1369,27 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         }
         break;
     }
+    case BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT: {
+        btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
+        btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest;
+        if (src->sc_oob_req_reply.p_c) {
+            dst->sc_oob_req_reply.p_c = osi_malloc(BT_OCTET16_LEN);
+            if (dst->sc_oob_req_reply.p_c) {
+                memcpy(dst->sc_oob_req_reply.p_c, src->sc_oob_req_reply.p_c, BT_OCTET16_LEN);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
+        }
+        if (src->sc_oob_req_reply.p_r) {
+            dst->sc_oob_req_reply.p_r = osi_malloc(BT_OCTET16_LEN);
+            if (dst->sc_oob_req_reply.p_r) {
+                memcpy(dst->sc_oob_req_reply.p_r, src->sc_oob_req_reply.p_r, BT_OCTET16_LEN);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
+        }
+        break;
+    }
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW:
     case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
@@ -1459,6 +1515,17 @@ void btc_gap_ble_arg_deep_free(btc_msg_t *msg)
         }
         break;
     }
+    case BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT: {
+        uint8_t *value = ((btc_ble_gap_args_t *)msg->arg)->sc_oob_req_reply.p_c;
+        if (value) {
+            osi_free(value);
+        }
+        value = ((btc_ble_gap_args_t *)msg->arg)->sc_oob_req_reply.p_r;
+        if (value) {
+            osi_free(value);
+        }
+        break;
+    }
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     case BTC_GAP_BLE_CFG_EXT_ADV_DATA_RAW:
     case BTC_GAP_BLE_CFG_EXT_SCAN_RSP_DATA_RAW: {
@@ -1721,6 +1788,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
     case BTC_GAP_BLE_OOB_REQ_REPLY_EVT:
         BTA_DmOobReply(arg->oob_req_reply.bd_addr, arg->oob_req_reply.len, arg->oob_req_reply.p_value);
         break;
+    case BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT:
+        BTA_DmSecureConnectionOobReply(arg->sc_oob_req_reply.bd_addr, arg->sc_oob_req_reply.p_c, arg->sc_oob_req_reply.p_r);
+        break;
+    case BTC_GAP_BLE_SC_CR_OOB_DATA_EVT:
+        BTA_DmSecureConnectionCreateOobData();
+        break;
 #endif  ///SMP_INCLUDED == TRUE
     case BTC_GAP_BLE_DISCONNECT_EVT:
         btc_ble_disconnect(arg->disconnect.remote_device);
@@ -1835,11 +1908,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
         BTC_TRACE_DEBUG("BTC_GAP_BLE_CFG_PERIODIC_ADV_DATA_RAW");
         BTA_DmBleGapPeriodicAdvCfgDataRaw(arg_5->periodic_adv_cfg_data.instance,
                                           arg_5->periodic_adv_cfg_data.len,
-                                          (const UINT8 *)arg_5->periodic_adv_cfg_data.data);
+                                          (const UINT8 *)arg_5->periodic_adv_cfg_data.data,
+                                          arg_5->periodic_adv_cfg_data.only_update_did);
         break;
     case BTC_GAP_BLE_PERIODIC_ADV_START:
         BTC_TRACE_DEBUG("BTC_GAP_BLE_PERIODIC_ADV_START");
-        BTA_DmBleGapPeriodicAdvEnable(TRUE, arg_5->periodic_adv_start.instance);
+        BTA_DmBleGapPeriodicAdvEnable(((arg_5->periodic_adv_start.include_adi)<<1)|0x01, arg_5->periodic_adv_start.instance);
         break;
     case BTC_GAP_BLE_PERIODIC_ADV_STOP:
         BTC_TRACE_DEBUG("BTC_GAP_BLE_PERIODIC_ADV_STOP");
@@ -1921,6 +1995,30 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                                               (const tBTA_DM_BLE_CONN_PARAMS *)&arg_5->set_ext_conn_params.phy_coded_conn_params);
         break;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    case BTC_GAP_BLE_PERIODIC_ADV_RECV_ENABLE:
+        BTC_TRACE_DEBUG("BTC_GAP_BLE_PERIODIC_ADV_RECV_ENABLE");
+        BTA_DmBleGapPeriodicAdvRecvEnable(arg_5->periodic_adv_recv_en.sync_handle,
+                                          arg_5->periodic_adv_recv_en.enable);
+        break;
+    case BTC_GAP_BLE_PERIODIC_ADV_SYNC_TRANS:
+        BTC_TRACE_DEBUG("BTC_GAP_BLE_PERIODIC_ADV_SYNC_TRANS");
+        BTA_DmBleGapPeriodicAdvSyncTrans(arg_5->periodic_adv_sync_trans.addr,
+                                         arg_5->periodic_adv_sync_trans.service_data,
+                                         arg_5->periodic_adv_sync_trans.sync_handle);
+        break;
+    case BTC_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS:
+        BTC_TRACE_DEBUG("BTC_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS");
+        BTA_DmBleGapPeriodicAdvSetInfoTrans(arg_5->periodic_adv_set_info_trans.addr,
+                                            arg_5->periodic_adv_set_info_trans.service_data,
+                                            arg_5->periodic_adv_set_info_trans.adv_handle);
+        break;
+    case BTC_GAP_BLE_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS:
+        BTC_TRACE_DEBUG("BTC_GAP_BLE_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS");
+        BTA_DmBleGapSetPeriodicAdvSyncTransParams(arg_5->set_periodic_adv_sync_trans_params.addr,
+                                                  (tBTA_DM_BLE_PAST_PARAMS *)&arg_5->set_periodic_adv_sync_trans_params.params);
+        break;
+#endif
     default:
         break;
     }

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -122,7 +122,8 @@ static void btc_gattc_copy_req_data(btc_msg_t *msg, void *p_dest, void *p_src)
     switch (msg->act) {
         case BTA_GATTC_READ_DESCR_EVT:
         case BTA_GATTC_READ_CHAR_EVT:
-        case BTA_GATTC_READ_MULTIPLE_EVT: {
+        case BTA_GATTC_READ_MULTIPLE_EVT:
+        case BTA_GATTC_READ_MULTI_VAR_EVT: {
             if (p_src_data->read.p_value && p_src_data->read.p_value->p_value) {
                 p_dest_data->read.p_value = (tBTA_GATT_UNFMT  *)osi_malloc(sizeof(tBTA_GATT_UNFMT) + p_src_data->read.p_value->len);
                 p_dest_data->read.p_value->p_value = (uint8_t *)(p_dest_data->read.p_value + 1);
@@ -158,7 +159,8 @@ static void btc_gattc_free_req_data(btc_msg_t *msg)
     switch (msg->act) {
         case BTA_GATTC_READ_DESCR_EVT:
         case BTA_GATTC_READ_CHAR_EVT:
-        case BTA_GATTC_READ_MULTIPLE_EVT: {
+        case BTA_GATTC_READ_MULTIPLE_EVT:
+        case BTA_GATTC_READ_MULTI_VAR_EVT: {
             if (arg->read.p_value) {
                 osi_free(arg->read.p_value);
             }
@@ -604,6 +606,14 @@ static void btc_gattc_read_multiple_char(btc_ble_gattc_args_t *arg)
     BTA_GATTC_ReadMultiple(arg->read_multiple.conn_id, &bta_multi, arg->read_multiple.auth_req);
 }
 
+static void btc_gattc_read_multiple_variable_char(btc_ble_gattc_args_t *arg)
+{
+    tBTA_GATTC_MULTI bta_multi;
+    bta_multi.num_attr = arg->read_multiple.num_attr;
+    memcpy(bta_multi.handles, arg->read_multiple.handles, BTA_GATTC_MULTI_MAX);
+    BTA_GATTC_ReadMultipleVariable(arg->read_multiple.conn_id, &bta_multi, arg->read_multiple.auth_req);
+}
+
 static void btc_gattc_read_char_descr(btc_ble_gattc_args_t *arg)
 {
     BTA_GATTC_ReadCharDescr(arg->read_descr.conn_id, arg->read_descr.handle, arg->read_descr.auth_req);
@@ -727,6 +737,9 @@ void btc_gattc_call_handler(btc_msg_t *msg)
     case BTC_GATTC_ACT_READ_MULTIPLE_CHAR:
         btc_gattc_read_multiple_char(arg);
         break;
+    case BTC_GATTC_ACT_READ_MULTIPLE_VARIABLE_CHAR:
+        btc_gattc_read_multiple_variable_char(arg);
+        break;
     case BTC_GATTC_ACT_READ_CHAR_DESCR:
         btc_gattc_read_char_descr(arg);
         break;
@@ -864,6 +877,11 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
         btc_gattc_cb_to_app(ESP_GATTC_READ_MULTIPLE_EVT, gattc_if, &param);
         break;
     }
+    case BTA_GATTC_READ_MULTI_VAR_EVT: {
+        set_read_value(&gattc_if, &param, &arg->read);
+        btc_gattc_cb_to_app(ESP_GATTC_READ_MULTI_VAR_EVT, gattc_if, &param);
+        break;
+    }
     case BTA_GATTC_WRITE_DESCR_EVT: {
         tBTA_GATTC_WRITE *write = &arg->write;
 
@@ -922,6 +940,8 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
     case BTA_GATTC_CLOSE_EVT: {
         tBTA_GATTC_CLOSE *close = &arg->close;
 
+        // Free gattc clcb in BTC task to avoid race condition
+        bta_gattc_clcb_dealloc_by_conn_id(close->conn_id);
         gattc_if = close->client_if;
         param.close.status = close->status;
         param.close.conn_id = BTC_GATT_GET_CONN_ID(close->conn_id);

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -498,6 +498,11 @@ esp_gatt_status_t btc_gatts_get_attr_value(uint16_t attr_handle, uint16_t *lengt
      return BTA_GetAttributeValue(attr_handle, length, value);
 }
 
+esp_gatt_status_t btc_gatts_show_local_database(void)
+{
+    BTA_GATTS_ShowLocalDatabase();
+    return ESP_GATT_OK;
+}
 
 static void btc_gatts_cb_param_copy_req(btc_msg_t *msg, void *p_dest, void *p_src)
 {
@@ -741,6 +746,9 @@ void btc_gatts_call_handler(btc_msg_t *msg)
         BTA_GATTS_SendServiceChangeIndication(arg->send_service_change.gatts_if, remote_bda);
         break;
     }
+    case BTC_GATTS_ACT_SHOW_LOCAL_DATABASE:
+        BTA_GATTS_ShowLocalDatabase();
+        break;
     default:
         break;
     }

components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c

@@ -112,6 +112,14 @@ do {
     hf_local_param[idx].btc_hf_cb.num_active = 0;  \
     hf_local_param[idx].btc_hf_cb.num_held = 0;
 
+#define CHECK_HF_IDX(idx)                                            \
+do {                                                                 \
+    if ((idx < 0) || (idx >= BTC_HF_NUM_CB)) {                       \
+        BTC_TRACE_ERROR("%s: Invalid index %d", __FUNCTION__, idx);  \
+        return;                                                      \
+    }                                                                \
+} while (0)
+
 /************************************************************************************
 **                                Static Function
 ************************************************************************************/
@@ -1201,19 +1209,9 @@ void btc_hf_cb_handler(btc_msg_t *msg)
     tBTA_AG *p_data = (tBTA_AG *)msg->arg;
     esp_hf_cb_param_t  param;
     bdstr_t bdstr;
-    int idx;
-
-    if (p_data == NULL) {
-        idx = BTC_HF_INVALID_IDX;
-    } else {
-        idx = p_data->hdr.handle - 1;
-    }
+    int idx = BTC_HF_INVALID_IDX;
 
     BTC_TRACE_DEBUG("%s: event = %s", __FUNCTION__, dump_hf_event(event));
-    if ((idx < 0) || (idx >= BTC_HF_NUM_CB)) {
-        BTC_TRACE_ERROR("%s: Invalid index %d", __FUNCTION__, idx);
-        return;
-    }
 
     switch (event) {
         case BTA_AG_ENABLE_EVT:
@@ -1222,6 +1220,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_REGISTER_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             hf_local_param[idx].btc_hf_cb.handle = p_data->reg.hdr.handle;
             BTC_TRACE_DEBUG("%s: BTA_AG_REGISTER_EVT," "hf_local_param[%d].btc_hf_cb.handle = %d",
                             __FUNCTION__, idx, hf_local_param[idx].btc_hf_cb.handle);
@@ -1230,7 +1230,9 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_OPEN_EVT:
         {
-            if (p_data->open.status == BTA_AG_SUCCESS)
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
+            if (p_data->open.hdr.status == BTA_AG_SUCCESS)
             {
                 bdcpy(hf_local_param[idx].btc_hf_cb.connected_bda.address, p_data->open.bd_addr);
                 hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_CONNECTED;
@@ -1241,7 +1243,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
                 hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_DISCONNECTED;
             } else {
                 BTC_TRACE_WARNING("%s: AG open failed, but another device connected. status=%d state=%d connected device=%s", __FUNCTION__,
-                                    p_data->open.status, hf_local_param[idx].btc_hf_cb.connection_state,
+                                    p_data->open.hdr.status, hf_local_param[idx].btc_hf_cb.connection_state,
                                     bdaddr_to_string(&hf_local_param[idx].btc_hf_cb.connected_bda, bdstr, sizeof(bdstr)));
                 break;
             }
@@ -1258,13 +1260,15 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             if (hf_local_param[idx].btc_hf_cb.connection_state  == ESP_HF_CONNECTION_STATE_DISCONNECTED)
                 bdsetany(hf_local_param[idx].btc_hf_cb.connected_bda.address);
 
-            if (p_data->open.status != BTA_AG_SUCCESS)
+            if (p_data->open.hdr.status != BTA_AG_SUCCESS)
                 btc_queue_advance();
             break;
         }
 
         case BTA_AG_CONN_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             clock_gettime(CLOCK_MONOTONIC, &(hf_local_param[idx].btc_hf_cb.connected_timestamp));
             BTC_TRACE_DEBUG("%s: BTA_AG_CONN_EVT, idx = %d ", __FUNCTION__, idx);
             hf_local_param[idx].btc_hf_cb.peer_feat = p_data->conn.peer_feat;
@@ -1286,6 +1290,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_CLOSE_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             hf_local_param[idx].btc_hf_cb.connected_timestamp.tv_sec = 0;
             hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_DISCONNECTED;
             BTC_TRACE_DEBUG("%s: BTA_AG_CLOSE_EVT," "hf_local_param[%d].btc_hf_cb.handle = %d", __FUNCTION__,
@@ -1307,6 +1313,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_AUDIO_OPEN_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             do {
                 memset(&param, 0, sizeof(esp_hf_cb_param_t));
                 param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTED;
@@ -1318,6 +1326,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_AUDIO_MSBC_OPEN_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             do {
                 memset(&param, 0, sizeof(esp_hf_cb_param_t));
                 param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTED_MSBC;
@@ -1328,6 +1338,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         }
         case BTA_AG_AUDIO_CLOSE_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             do {
                 memset(&param, 0, sizeof(esp_hf_cb_param_t));
                 param.audio_stat.state = ESP_HF_AUDIO_STATE_DISCONNECTED;
@@ -1339,6 +1351,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_AT_BVRA_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             do {
                 memset(&param, 0, sizeof(esp_hf_cb_param_t));
                 param.vra_rep.value = p_data->val.num;
@@ -1456,6 +1470,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         case BTA_AG_AT_BINP_EVT:
         case BTA_AG_AT_BTRH_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             tBTA_AG_RES_DATA ag_res;
             memset(&ag_res, 0, sizeof(ag_res));
             ag_res.ok_flag = BTA_AG_OK_ERROR;
@@ -1466,6 +1482,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
         case BTA_AG_AT_BAC_EVT:
         {
+            idx = p_data->hdr.handle - 1;
+            CHECK_HF_IDX(idx);
             BTC_TRACE_DEBUG("AG Bitmap of peer-codecs %d", p_data->val.num);
 #if (BTM_WBS_INCLUDED == TRUE)
             /* If the peer supports mSBC and the BTC prefferred codec is also mSBC, then
@@ -1485,9 +1503,9 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 #if (BTM_WBS_INCLUDED == TRUE)
         case BTA_AG_WBS_EVT:
         {
-            BTC_TRACE_DEBUG("Set codec status %d codec %d 1=CVSD 2=MSBC", p_data->val.hdr.status, p_data->val.value);
+            BTC_TRACE_DEBUG("Set codec status %d codec %d 1=CVSD 2=MSBC", p_data->val.hdr.status, p_data->val.num);
             memset(&param, 0, sizeof(esp_hf_cb_param_t));
-            param.wbs_rep.codec = p_data->val.value;
+            param.wbs_rep.codec = p_data->val.num;
             btc_hf_cb_to_app(ESP_HF_WBS_RESPONSE_EVT, &param);
             break;
         }

components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h

@@ -1,16 +1,8 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #ifndef __BTC_GAP_BLE_H__
 #define __BTC_GAP_BLE_H__
@@ -26,7 +18,7 @@ extern tBTA_BLE_ADV_DATA *gl_bta_scan_rsp_data_ptr;
 #define gl_bta_scan_rsp_data    (*gl_bta_scan_rsp_data_ptr)
 #endif
 
-#define BLE_ISVALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)) || ((x) == ESP_BLE_CONN_PARAM_UNDEF))
+#define BLE_ISVALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)))
 
 typedef enum {
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
@@ -62,6 +54,8 @@ typedef enum {
     BTC_GAP_BLE_DISCONNECT_EVT,
     BTC_GAP_BLE_REMOVE_BOND_DEV_EVT,
     BTC_GAP_BLE_OOB_REQ_REPLY_EVT,
+    BTC_GAP_BLE_SC_OOB_REQ_REPLY_EVT,
+    BTC_GAP_BLE_SC_CR_OOB_DATA_EVT,
     BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST,
     BTC_GAP_BLE_SET_AFH_CHANNELS,
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
@@ -92,6 +86,12 @@ typedef enum {
     BTC_GAP_BLE_SET_EXT_PEFER_CONNET_PARAMS,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
     BTC_GAP_BLE_ACT_GET_DEV_NAME,
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    BTC_GAP_BLE_PERIODIC_ADV_RECV_ENABLE,
+    BTC_GAP_BLE_PERIODIC_ADV_SYNC_TRANS,
+    BTC_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS,
+    BTC_GAP_BLE_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS,
+#endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 } btc_gap_ble_act_t;
 
 /* btc_ble_gap_args_t */
@@ -209,6 +209,11 @@ typedef union {
         uint8_t len;
         uint8_t *p_value;
     } oob_req_reply;
+    struct sc_oob_req_reply_args {
+        esp_bd_addr_t bd_addr;
+        uint8_t *p_c;
+        uint8_t *p_r;
+    } sc_oob_req_reply;
     //BTC_GAP_BLE_DISCONNECT_EVT
     struct disconnect_args {
         esp_bd_addr_t remote_device;
@@ -291,9 +296,11 @@ typedef union {
         uint8_t instance;
         uint16_t len;
         uint8_t *data;
+        bool only_update_did;
     } periodic_adv_cfg_data;
 
     struct periodic_adv_start_args {
+        bool    include_adi;
         uint8_t instance;
     } periodic_adv_start;
 
@@ -343,6 +350,30 @@ typedef union {
         esp_bd_addr_t peer_addr;
     } ext_conn;
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    struct periodic_adv_recv_en_args {
+        uint16_t sync_handle;
+        uint8_t enable;
+    } periodic_adv_recv_en;
+
+    struct periodic_adv_sync_trans_args {
+        esp_bd_addr_t addr;
+        uint16_t service_data;
+        uint16_t sync_handle;
+    } periodic_adv_sync_trans;
+
+    struct periodic_adv_set_info_trans_args {
+        esp_bd_addr_t addr;
+        uint16_t service_data;
+        uint16_t adv_handle;
+    } periodic_adv_set_info_trans;
+
+    struct set_periodic_adv_sync_trans_params_args {
+        esp_bd_addr_t addr;
+        esp_ble_gap_past_params_t params;
+    } set_periodic_adv_sync_trans_params;
+#endif
+
 } btc_ble_5_gap_args_t;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 

components/bt/host/bluedroid/btc/profile/std/include/btc_gattc.h

@@ -32,6 +32,7 @@ typedef enum {
     BTC_GATTC_ACT_SEARCH_SERVICE,
     BTC_GATTC_ACT_READ_CHAR,
     BTC_GATTC_ACT_READ_MULTIPLE_CHAR,
+    BTC_GATTC_ACT_READ_MULTIPLE_VARIABLE_CHAR,
     BTC_GATTC_ACT_READ_CHAR_DESCR,
     BTC_GATTC_ACT_READ_BY_TYPE,
     BTC_GATTC_ACT_WRITE_CHAR,

components/bt/host/bluedroid/btc/profile/std/include/btc_gatts.h

@@ -38,6 +38,7 @@ typedef enum {
     BTC_GATTS_ACT_OPEN,
     BTC_GATTS_ACT_CLOSE,
     BTC_GATTS_ACT_SEND_SERVICE_CHANGE,
+    BTC_GATTS_ACT_SHOW_LOCAL_DATABASE,
 } btc_gatts_act_t;
 
 /* btc_ble_gatts_args_t */
@@ -172,6 +173,7 @@ void btc_gatts_cb_handler(btc_msg_t *msg);
 void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 void btc_gatts_arg_deep_free(btc_msg_t *msg);
 esp_gatt_status_t btc_gatts_get_attr_value(uint16_t attr_handle, uint16_t *length, uint8_t **value);
+esp_gatt_status_t btc_gatts_show_local_database(void);
 
 
 #endif /* __BTC_GATTS_H__ */

components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h

@@ -125,6 +125,24 @@
 #define UC_BT_BLE_42_FEATURES_SUPPORTED            FALSE
 #endif
 
+#ifdef CONFIG_BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
+#define UC_BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER            CONFIG_BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
+#else
+#define UC_BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER            FALSE
+#endif
+
+#ifdef CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH
+#define UC_BT_BLE_FEAT_PERIODIC_ADV_ENH            CONFIG_BT_BLE_FEAT_PERIODIC_ADV_ENH
+#else
+#define UC_BT_BLE_FEAT_PERIODIC_ADV_ENH            FALSE
+#endif
+
+#ifdef CONFIG_BT_BLE_HIGH_DUTY_ADV_INTERVAL
+#define UC_BT_BLE_HIGH_DUTY_ADV_INTERVAL CONFIG_BT_BLE_HIGH_DUTY_ADV_INTERVAL
+#else
+#define UC_BT_BLE_HIGH_DUTY_ADV_INTERVAL FALSE
+#endif
+
 //GATTS
 #ifdef CONFIG_BT_GATTS_ENABLE
 #define UC_BT_GATTS_ENABLE                  CONFIG_BT_GATTS_ENABLE
@@ -289,12 +307,36 @@
 #define UC_BT_GATTS_SEND_SERVICE_CHANGE_MODE    0
 #endif
 
+#ifdef CONFIG_BT_GATTS_ROBUST_CACHING_ENABLED
+#define UC_BT_GATTS_ROBUST_CACHING_ENABLED      CONFIG_BT_GATTS_ROBUST_CACHING_ENABLED
+#else
+#define UC_BT_GATTS_ROBUST_CACHING_ENABLED      FALSE
+#endif
+
+#ifdef CONFIG_BT_GATTS_DEVICE_NAME_WRITABLE
+#define UC_BT_GATTS_DEVICE_NAME_WRITABLE        CONFIG_BT_GATTS_DEVICE_NAME_WRITABLE
+#else
+#define UC_BT_GATTS_DEVICE_NAME_WRITABLE        FALSE
+#endif
+
+#ifdef CONFIG_BT_GATTS_APPEARANCE_WRITABLE
+#define UC_BT_GATTS_APPEARANCE_WRITABLE         CONFIG_BT_GATTS_APPEARANCE_WRITABLE
+#else
+#define UC_BT_GATTS_APPEARANCE_WRITABLE         FALSE
+#endif
+
 #ifdef CONFIG_BT_BLE_ACT_SCAN_REP_ADV_SCAN
 #define UC_BT_BLE_ACT_SCAN_REP_ADV_SCAN         CONFIG_BT_BLE_ACT_SCAN_REP_ADV_SCAN
 #else
 #define UC_BT_BLE_ACT_SCAN_REP_ADV_SCAN         FALSE
 #endif
 
+#ifdef CONFIG_BT_BLE_RPA_TIMEOUT
+#define UC_BT_BLE_RPA_TIMEOUT                   CONFIG_BT_BLE_RPA_TIMEOUT
+#else
+#define UC_BT_BLE_RPA_TIMEOUT                   900
+#endif
+
 //SCO VOICE OVER HCI
 #ifdef CONFIG_BT_HFP_AUDIO_DATA_PATH_HCI
 #define UC_BT_HFP_AUDIO_DATA_PATH_HCI           CONFIG_BT_HFP_AUDIO_DATA_PATH_HCI

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -183,6 +183,24 @@
 #define BLE_42_FEATURE_SUPPORT   FALSE
 #endif
 
+#if (UC_BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER   TRUE
+#else
+#define BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER   FALSE
+#endif
+
+#if (UC_BT_BLE_FEAT_PERIODIC_ADV_ENH == TRUE)
+#define BLE_FEAT_PERIODIC_ADV_ENH   TRUE
+#else
+#define BLE_FEAT_PERIODIC_ADV_ENH   FALSE
+#endif
+
+#if (UC_BT_BLE_HIGH_DUTY_ADV_INTERVAL == TRUE)
+#define BLE_HIGH_DUTY_ADV_INTERVAL TRUE
+#else
+#define BLE_HIGH_DUTY_ADV_INTERVAL FALSE
+#endif
+
 #if (UC_BT_BLE_RPA_SUPPORTED  == TRUE)
 #define CONTROLLER_RPA_LIST_ENABLE   TRUE
 #else
@@ -484,10 +502,32 @@
 #define GATTS_SEND_SERVICE_CHANGE_MODE UC_BT_GATTS_SEND_SERVICE_CHANGE_MODE
 #endif
 
+#if (UC_BT_GATTS_ROBUST_CACHING_ENABLED == TRUE)
+#define GATTS_ROBUST_CACHING_ENABLED TRUE
+#else
+#define GATTS_ROBUST_CACHING_ENABLED FALSE
+#endif
+
+#if (UC_BT_GATTS_DEVICE_NAME_WRITABLE == TRUE)
+#define GATTS_DEVICE_NAME_WRITABLE TRUE
+#else
+#define GATTS_DEVICE_NAME_WRITABLE FALSE
+#endif
+
+#if (UC_BT_GATTS_APPEARANCE_WRITABLE == TRUE)
+#define GATTS_APPEARANCE_WRITABLE TRUE
+#else
+#define GATTS_APPEARANCE_WRITABLE FALSE
+#endif
+
 #ifdef UC_BT_BLE_ACT_SCAN_REP_ADV_SCAN
 #define BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY    UC_BT_BLE_ACT_SCAN_REP_ADV_SCAN
 #endif
 
+#ifdef UC_BT_BLE_RPA_TIMEOUT
+#define BTM_BLE_PRIVATE_ADDR_INT UC_BT_BLE_RPA_TIMEOUT
+#endif
+
 /* This feature is used to eanble interleaved scan*/
 #ifndef BTA_HOST_INTERLEAVE_SEARCH
 #define BTA_HOST_INTERLEAVE_SEARCH FALSE
@@ -1467,7 +1507,7 @@
 
 /* The maximum number of simultaneous client and server connections. */
 #ifndef SDP_MAX_CONNECTIONS
-#define SDP_MAX_CONNECTIONS         2 // 4
+#define SDP_MAX_CONNECTIONS         4
 #endif
 
 /* The MTU size for the L2CAP configuration. */

components/bt/host/bluedroid/device/controller.c

@@ -30,7 +30,7 @@
 #include "device/version.h"
 #include "osi/future.h"
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
-const bt_event_mask_t BLE_EVENT_MASK = { "\x00\x00\x00\x00\x00\x0f\xff\xff" };
+const bt_event_mask_t BLE_EVENT_MASK = { "\x00\x00\x00\x00\x00\xff\xff\xff" };
 #else
 const bt_event_mask_t BLE_EVENT_MASK = { "\x00\x00\x00\x00\x00\x00\x06\x7f" };
 #endif

components/bt/host/bluedroid/stack/btm/btm_ble.c

@@ -497,6 +497,62 @@ void BTM_BleOobDataReply(BD_ADDR bd_addr, UINT8 res, UINT8 len, UINT8 *p_data)
 #endif
 }
 
+/*******************************************************************************
+**
+** Function         BTM_BleSecureConnectionOobDataReply
+**
+** Description      This function is called to provide the OOB data for
+**                  SMP in response to BTM_LE_SC_OOB_REQ_EVT when secure connection
+**
+** Parameters:      bd_addr     - Address of the peer device
+**                  p_c         - pointer to Confirmation
+**                  p_r         - pointer to Randomizer
+**
+*******************************************************************************/
+void BTM_BleSecureConnectionOobDataReply(BD_ADDR bd_addr, UINT8 *p_c, UINT8 *p_r)
+{
+#if SMP_INCLUDED == TRUE
+    tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
+
+    BTM_TRACE_DEBUG ("%s", __func__);
+
+    if (p_dev_rec == NULL) {
+        BTM_TRACE_ERROR("%s Unknown device", __func__);
+        return;
+    }
+
+    p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED;
+
+    tSMP_SC_OOB_DATA oob;
+    memset(&oob, 0, sizeof(tSMP_SC_OOB_DATA));
+
+    oob.peer_oob_data.present = true;
+    memcpy(&oob.peer_oob_data.commitment, p_c, BT_OCTET16_LEN);
+    memcpy(&oob.peer_oob_data.randomizer, p_r, BT_OCTET16_LEN);
+    oob.peer_oob_data.addr_rcvd_from.type = p_dev_rec->ble.ble_addr_type;
+    memcpy(oob.peer_oob_data.addr_rcvd_from.bda, bd_addr, BD_ADDR_LEN);
+
+    SMP_SecureConnectionOobDataReply((UINT8 *)&oob);
+#endif
+}
+
+/*******************************************************************************
+**
+** Function         BTM_BleSecureConnectionCreateOobData
+**
+** Description      This function is called to create the OOB data for
+**                  SMP when secure connection
+**
+*******************************************************************************/
+void BTM_BleSecureConnectionCreateOobData(void)
+{
+#if SMP_INCLUDED == TRUE
+    BTM_TRACE_DEBUG ("%s", __func__);
+
+    SMP_CreateLocalSecureConnectionsOobData();
+#endif
+}
+
 /******************************************************************************
 **
 ** Function         BTM_BleSetConnScanParams
@@ -2224,7 +2280,15 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
 
         }
     } else {
-        BTM_TRACE_ERROR("btm_proc_smp_cback received for unknown device");
+        if (event == SMP_SC_LOC_OOB_DATA_UP_EVT) {
+            tBTM_LE_EVT_DATA evt_data;
+            memcpy(&evt_data.local_oob_data, &p_data->loc_oob_data, sizeof(tSMP_LOC_OOB_DATA));
+            if (btm_cb.api.p_le_callback) {
+                (*btm_cb.api.p_le_callback)(event, bd_addr, &evt_data);
+            }
+        } else {
+            BTM_TRACE_ERROR("btm_proc_smp_cback received for unknown device");
+        }
     }
     return 0;
 }

components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c

@@ -690,7 +690,7 @@ end:
     return status;
 }
 
-tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data)
+tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data,BOOLEAN only_update_did)
 {
     tBTM_STATUS status = BTM_SUCCESS;
     tHCI_STATUS err = HCI_SUCCESS;
@@ -698,6 +698,13 @@ tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data
     UINT8 operation = 0;
     UINT16 data_offset = 0;
     tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+    if (only_update_did)
+    {
+        len = 0;
+        data = NULL;
+        rem_len = 0;
+        operation = BTM_BLE_ADV_DATA_OP_UNCHANGED_DATA;
+    }
 
     if ((status = btm_ble_ext_adv_set_data_validate(instance, len, data)) != BTM_SUCCESS) {
        BTM_TRACE_ERROR("%s, invalid extend adv data.", __func__);
@@ -708,7 +715,9 @@ tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data
         UINT8 send_data_len = (rem_len > BTM_BLE_PERIODIC_ADV_DATA_LEN_MAX) ? BTM_BLE_PERIODIC_ADV_DATA_LEN_MAX : rem_len;
 
         if (len <= BTM_BLE_EXT_ADV_DATA_LEN_MAX) {
-            operation = BTM_BLE_ADV_DATA_OP_COMPLETE;
+            if (!only_update_did) {
+                operation = BTM_BLE_ADV_DATA_OP_COMPLETE;
+            }
         } else {
             if (rem_len == len) {
                 operation = BTM_BLE_ADV_DATA_OP_FIRST_FRAG;
@@ -734,7 +743,7 @@ end:
     return status;
 }
 
-tBTM_STATUS BTM_BlePeriodicAdvEnable(UINT8 instance, BOOLEAN enable)
+tBTM_STATUS BTM_BlePeriodicAdvEnable(UINT8 instance, UINT8 enable)
 {
     tBTM_STATUS status = BTM_SUCCESS;
     tHCI_STATUS err = HCI_SUCCESS;
@@ -1029,7 +1038,6 @@ void BTM_BleSetPreferExtenedConnParams (BD_ADDR bd_addr, tBTM_EXT_CONN_PARAMS *p
     return;
 }
 
-
 void btm_ble_extended_init(void)
 {
 
@@ -1079,7 +1087,7 @@ static tBTM_STATUS btm_ble_ext_adv_params_validate(tBTM_BLE_GAP_EXT_ADV_PARAMS *
 
 static tBTM_STATUS btm_ble_ext_adv_set_data_validate(UINT8 instance, UINT16 len, UINT8 *data)
 {
-    if (!data) {
+    if (data == NULL && len > 0) {
         BTM_TRACE_ERROR("%s, the extend adv data is NULL. line %d", __func__, __LINE__);
         return BTM_ILLEGAL_VALUE;
     }
@@ -1280,3 +1288,144 @@ void btm_ble_periodic_adv_sync_establish_evt(tBTM_BLE_PERIOD_ADV_SYNC_ESTAB *par
 }
 
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+void btm_ble_periodic_adv_sync_trans_complete(UINT16 op_code, UINT8 hci_status, UINT16 conn_handle)
+{
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+    UINT8 evt = BTM_BLE_5_GAP_UNKNOWN_EVT;
+    tL2C_LCB *p_lcb = l2cu_find_lcb_by_handle(conn_handle);
+
+    switch (op_code) {
+    case HCI_BLE_PERIOD_ADV_SYNC_TRANS:
+        evt = BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT;
+        break;
+    case HCI_BLE_PERIOD_ADV_SET_INFO_TRANS:
+        evt = BTM_BLE_GAP_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT;
+        break;
+    case HCI_BLE_SET_PAST_PARAMS:
+        evt = BTM_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT;
+        break;
+    default:
+        return;
+    }
+
+    cb_params.per_adv_sync_trans.status = BTM_SUCCESS;
+    if(hci_status != HCI_SUCCESS) {
+        cb_params.per_adv_sync_trans.status = BTM_ILLEGAL_VALUE;
+        BTM_TRACE_ERROR("%s error status %d", __func__, hci_status);
+    }
+
+    if(p_lcb) {
+       memcpy(cb_params.per_adv_sync_trans.addr, p_lcb->remote_bd_addr, BD_ADDR_LEN);
+    }
+
+    BTM_ExtBleCallbackTrigger(evt, &cb_params);
+}
+
+void BTM_BlePeriodicAdvRecvEnable(UINT16 sync_handle, UINT8 enable)
+{
+    tHCI_STATUS err = HCI_SUCCESS;
+    tBTM_STATUS status = BTM_SUCCESS;
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+
+    if ((err = btsnd_hcic_ble_set_periodic_adv_recv_enable(sync_handle, enable)) != HCI_SUCCESS) {
+        BTM_TRACE_ERROR("%s cmd err=0x%x", __func__, err);
+        status = BTM_ILLEGAL_VALUE;
+    }
+
+    cb_params.status = status;
+    BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT, &cb_params);
+}
+
+void BTM_BlePeriodicAdvSyncTrans(BD_ADDR bd_addr, UINT16 service_data, UINT16 sync_handle)
+{
+    tBTM_STATUS status = BTM_SUCCESS;
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+
+    tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_LE);
+    if (!p_lcb) {
+        BTM_TRACE_ERROR("%s, invalid parameters", __func__);
+        status = BTM_ILLEGAL_VALUE;
+    }
+
+    if (status != BTM_SUCCESS) {
+        cb_params.per_adv_sync_trans.status = status;
+        memcpy(cb_params.per_adv_sync_trans.addr, bd_addr, sizeof(BD_ADDR));
+        BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT, &cb_params);
+        return;
+    }
+
+    btsnd_hcic_ble_periodic_adv_sync_trans(p_lcb->handle, service_data, sync_handle);
+}
+
+void BTM_BlePeriodicAdvSetInfoTrans(BD_ADDR bd_addr, UINT16 service_data, UINT8 adv_handle)
+{
+    tBTM_STATUS status = BTM_SUCCESS;
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+    tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_LE);
+
+    if (!p_lcb) {
+        BTM_TRACE_ERROR("%s, invalid parameters", __func__);
+        status = BTM_ILLEGAL_VALUE;
+    }
+
+    if (status != BTM_SUCCESS) {
+        cb_params.per_adv_sync_trans.status = status;
+        memcpy(cb_params.per_adv_sync_trans.addr, bd_addr, sizeof(BD_ADDR));
+        BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT, &cb_params);
+        return;
+    }
+
+    btsnd_hcic_ble_periodic_adv_set_info_trans(p_lcb->handle, service_data, adv_handle);
+}
+
+void BTM_BleSetPeriodicAdvSyncTransParams(BD_ADDR bd_addr, UINT8 mode, UINT16 skip, UINT16 sync_timeout, UINT8 cte_type)
+{
+    tBTM_STATUS status = BTM_SUCCESS;
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+
+    // Set default past params
+    if (bdaddr_is_empty((bt_bdaddr_t *)bd_addr)) {
+        tHCI_STATUS err = HCI_SUCCESS;
+        if ((err = btsnd_hcic_ble_set_default_periodic_adv_sync_trans_params(mode, skip, sync_timeout, cte_type)) != HCI_SUCCESS) {
+            BTM_TRACE_ERROR("%s cmd err=0x%x", __func__, err);
+            status = BTM_ILLEGAL_VALUE;
+        }
+
+        cb_params.set_past_params.status = status;
+        memset(cb_params.set_past_params.addr, 0, sizeof(BD_ADDR));
+        BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT, &cb_params);
+        return;
+    }
+
+    tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_LE);
+    if (!p_lcb) {
+        BTM_TRACE_ERROR("%s, invalid parameters", __func__);
+        status = BTM_ILLEGAL_VALUE;
+    }
+
+    if (status != BTM_SUCCESS) {
+        cb_params.set_past_params.status = status;
+        memcpy(cb_params.set_past_params.addr, bd_addr, sizeof(BD_ADDR));
+        BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT, &cb_params);
+        return;
+    }
+
+    btsnd_hcic_ble_set_periodic_adv_sync_trans_params(p_lcb->handle, mode, skip, sync_timeout, cte_type);
+}
+
+void btm_ble_periodic_adv_sync_trans_recv_evt(tBTM_BLE_PERIOD_ADV_SYNC_TRANS_RECV *params)
+{
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
+
+    if (!params) {
+        BTM_TRACE_ERROR("%s, Invalid params.", __func__);
+        return;
+    }
+
+    memcpy(&cb_params.past_recv, params, sizeof(tBTM_BLE_PERIOD_ADV_SYNC_TRANS_RECV));
+
+    BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_RECV_EVT, &cb_params);
+}
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)

components/bt/host/bluedroid/stack/btm/btm_ble_gap.c

@@ -869,15 +869,6 @@ BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK
         return FALSE;
     }
 
-    if (p_cb->inq_var.state != BTM_BLE_IDLE) {
-        BTM_TRACE_ERROR("Advertising or scaning now, can't set privacy ");
-        if (random_cb && random_cb->set_local_privacy_cback){
-            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_FAIL);
-            random_cb->set_local_privacy_cback = NULL;
-        }
-        return FALSE;
-    }
-
 #if (defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE)
     uint8_t addr_resolution = 0;
 #endif  /* defined(GAP_INCLUDED) && GAP_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */
@@ -886,22 +877,12 @@ BOOLEAN BTM_BleConfigPrivacy(BOOLEAN privacy_mode, tBTM_SET_LOCAL_PRIVACY_CBACK
         memset(p_cb->addr_mgnt_cb.resolvale_addr, 0, BD_ADDR_LEN);
         p_cb->addr_mgnt_cb.own_addr_type = BLE_ADDR_PUBLIC;
         p_cb->privacy_mode = BTM_PRIVACY_NONE;
-        if (random_cb && random_cb->set_local_privacy_cback){
-            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_SUCCESS);
-            random_cb->set_local_privacy_cback = NULL;
-        }
         // Disable RPA function
         btsnd_hcic_ble_set_addr_resolution_enable(FALSE);
     } else { /* privacy is turned on*/
 #if (CONTROLLER_RPA_LIST_ENABLE == FALSE)
         /* always set host random address, used when privacy 1.1 or priavcy 1.2 is disabled */
         btm_gen_resolvable_private_addr((void *)btm_gen_resolve_paddr_low);
-#else
-        /* Controller generates RPA, Host don't need to set random address */
-        if (random_cb && random_cb->set_local_privacy_cback){
-            (*random_cb->set_local_privacy_cback)(BTM_SET_PRIVACY_SUCCESS);
-            random_cb->set_local_privacy_cback = NULL;
-        }
 #endif
 
         if (BTM_BleMaxMultiAdvInstanceCount() > 0) {
@@ -1019,7 +1000,7 @@ uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *
             memcpy(btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr, btm_cb.ble_ctr_cb.addr_mgnt_cb.resolvale_addr, BD_ADDR_LEN);
             btsnd_hcic_ble_set_random_addr(btm_cb.ble_ctr_cb.addr_mgnt_cb.resolvale_addr);
         }else {
-            BTM_TRACE_ERROR ("No random address yet, please set random address and try\n");
+            BTM_TRACE_ERROR ("No random address yet, please set random address using API \"esp_ble_gap_set_rand_addr\" and retry\n");
             if(cb) {
                 (* cb)(HCI_ERR_ESP_VENDOR_FAIL);
             }
@@ -1068,17 +1049,28 @@ uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *
 #else
 uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb)
 {
+    tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
+
     if((*own_bda_type == BLE_ADDR_RANDOM) || (*own_bda_type == BLE_ADDR_RANDOM_ID)) {
-        if((btm_cb.ble_ctr_cb.addr_mgnt_cb.exist_addr_bit & BTM_BLE_GAP_ADDR_BIT_RANDOM) != BTM_BLE_GAP_ADDR_BIT_RANDOM) {
+        if((p_cb->exist_addr_bit & BTM_BLE_GAP_ADDR_BIT_RANDOM) != BTM_BLE_GAP_ADDR_BIT_RANDOM) {
             BTM_TRACE_ERROR("No random address yet, please set random address and try\n");
             if(cb) {
                 (* cb)(HCI_ERR_ESP_VENDOR_FAIL);
             }
             return BTM_ILLEGAL_VALUE;
         }
+
+        // If a device is using RPA, it shall also have an Identity Address
+        if ((*own_bda_type == BLE_ADDR_RANDOM_ID) && BTM_BLE_IS_NON_RESLVE_BDA(p_cb->static_rand_addr)) {
+            BTM_TRACE_ERROR("No identity address yet, please set static random address and try\n");
+            if (cb) {
+                (* cb)(HCI_ERR_ESP_VENDOR_FAIL);
+            }
+            return BTM_ILLEGAL_VALUE;
+        }
     }
 
-    btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type = *own_bda_type;
+    p_cb->own_addr_type = *own_bda_type;
 
     return BTM_SUCCESS;
 }

components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c

@@ -377,6 +377,45 @@ void btm_ble_read_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len)
         btm_ble_refresh_peer_resolvable_private_addr(pseudo_bda, rra, rra_type);
     }
 }
+
+/*******************************************************************************
+**
+** Function         btm_ble_set_addr_resolution_enable_complete
+**
+** Description      This function is called when the command to set address
+**                  resolution enable completes.
+**
+** Parameters       p: Pointer to the command complete event data.
+**                  evt_len: Length of the event data.
+**
+** Returns          void
+**
+*******************************************************************************/
+void btm_ble_set_addr_resolution_enable_complete(UINT8 *p, UINT16 evt_len)
+{
+    UINT8 status;
+
+    STREAM_TO_UINT8(status, p);
+
+    BTM_TRACE_DEBUG("%s status = %d", __func__, status);
+
+    tBTM_LE_RANDOM_CB *random_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
+
+    if (!(random_cb && random_cb->set_local_privacy_cback)) {
+        return;
+    }
+
+    if (status == HCI_SUCCESS) {
+        random_cb->set_local_privacy_cback(BTM_SUCCESS);
+        return;
+    } else if (status == HCI_ERR_COMMAND_DISALLOWED) {
+        BTM_TRACE_ERROR("a non-connected activity is ongoing, such as advertising and scanning");
+    } else {
+        BTM_TRACE_ERROR("set local privacy failed");
+    }
+    random_cb->set_local_privacy_cback(BTM_ILLEGAL_VALUE);
+}
+
 /*******************************************************************************
                 VSC that implement controller based privacy
 ********************************************************************************/

components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h

@@ -84,8 +84,10 @@
 typedef UINT8   tBTM_BLE_SEC_REQ_ACT;
 
 #define BLE_STATIC_PRIVATE_MSB_MASK          0x3f
-#define BLE_RESOLVE_ADDR_MSB                 0x40   /*  most significant bit, bit7, bit6 is 01 to be resolvable random */
+#define BLE_NON_RESOLVE_ADDR_MSB             0x00   /* most significant bit, bit7, bit6 is 00 to be non-resolvable random */
+#define BLE_RESOLVE_ADDR_MSB                 0x40   /* most significant bit, bit7, bit6 is 01 to be resolvable random */
 #define BLE_RESOLVE_ADDR_MASK                0xc0   /* bit 6, and bit7 */
+#define BTM_BLE_IS_NON_RESLVE_BDA(x)        ((x[0] & BLE_RESOLVE_ADDR_MASK) == BLE_NON_RESOLVE_ADDR_MSB)
 #define BTM_BLE_IS_RESOLVE_BDA(x)           ((x[0] & BLE_RESOLVE_ADDR_MASK) == BLE_RESOLVE_ADDR_MSB)
 
 /* LE scan activity bit mask, continue with LE inquiry bits */
@@ -143,8 +145,6 @@ typedef struct {
 
 #define BTM_BLE_ISVALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)) || ((x) == BTM_BLE_CONN_PARAM_UNDEF))
 
-#define BTM_BLE_PRIVATE_ADDR_INT    900  /* 15 minutes minimum for random address refreshing */
-
 typedef struct {
     UINT16 discoverable_mode;
     UINT16 connectable_mode;
@@ -484,6 +484,7 @@ BOOLEAN btm_random_pseudo_to_identity_addr(BD_ADDR random_pseudo, UINT8 *p_stati
 void btm_ble_refresh_peer_resolvable_private_addr(BD_ADDR pseudo_bda, BD_ADDR rra, UINT8 rra_type);
 void btm_ble_refresh_local_resolvable_private_addr(BD_ADDR pseudo_addr, BD_ADDR local_rpa);
 void btm_ble_read_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len) ;
+void btm_ble_set_addr_resolution_enable_complete(UINT8 *p, UINT16 evt_len) ;
 void btm_ble_remove_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len);
 void btm_ble_add_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len);
 void btm_ble_clear_resolving_list_complete(UINT8 *p, UINT16 evt_len);
@@ -534,6 +535,10 @@ void btm_ble_periodic_adv_sync_lost_evt(tBTM_BLE_PERIOD_ADV_SYNC_LOST *params);
 void btm_ble_periodic_adv_sync_establish_evt(tBTM_BLE_PERIOD_ADV_SYNC_ESTAB *params);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+void btm_ble_periodic_adv_sync_trans_recv_evt(tBTM_BLE_PERIOD_ADV_SYNC_TRANS_RECV *params);
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 /*
 #ifdef __cplusplus
 }

components/bt/host/bluedroid/stack/btm/include/btm_int.h

@@ -1085,6 +1085,9 @@ void btm_create_sync_callback(UINT8 status);
 void btm_set_phy_callback(UINT8 status);
 void btm_read_phy_callback(uint8_t hci_status, uint16_t conn_handle, uint8_t tx_phy, uint8_t rx_phy);
 #endif
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+void btm_ble_periodic_adv_sync_trans_complete(UINT16 op_code, UINT8 hci_status, UINT16 conn_handle);
+#endif
 /* Internal functions provided by btm_sco.c
 ********************************************
 */

components/bt/host/bluedroid/stack/btu/btu_hcif.c

@@ -145,8 +145,10 @@ static void btu_ble_periodic_adv_sync_lost_evt(UINT8 *p);
 static void btu_ble_scan_timeout_evt(UINT8 *p);
 static void btu_ble_adv_set_terminate_evt(UINT8 *p);
 static void btu_ble_scan_req_received_evt(UINT8 *p);
-
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+static void btu_ble_periodic_adv_sync_trans_recv(UINT8 *p);
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 
 extern osi_sem_t adv_enable_sem;
 extern osi_sem_t adv_data_sem;
@@ -413,6 +415,11 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg)
         case HCI_BLE_CHANNEL_SELECT_ALG:
             break;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+        case HCI_BLE_PERIOD_ADV_SYNC_TRANS_RECV_EVT:
+            btu_ble_periodic_adv_sync_trans_recv(p);
+            break;
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
         }
         break;
 #endif /* BLE_INCLUDED */
@@ -1077,7 +1084,10 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
         break;
 
     case HCI_BLE_READ_RESOLVABLE_ADDR_LOCAL:
+        break;
     case HCI_BLE_SET_ADDR_RESOLUTION_ENABLE:
+        btm_ble_set_addr_resolution_enable_complete(p, evt_len);
+        break;
     case HCI_BLE_SET_RAND_PRIV_ADDR_TIMOUT:
         break;
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
@@ -1107,6 +1117,21 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
         btm_ble_test_command_complete(p);
         break;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    case HCI_BLE_SET_PERIOD_ADV_RECV_ENABLE:
+    case HCI_BLE_SET_DEFAULT_PAST_PARAMS:
+        break;
+    case HCI_BLE_PERIOD_ADV_SYNC_TRANS:
+    case HCI_BLE_PERIOD_ADV_SET_INFO_TRANS:
+    case HCI_BLE_SET_PAST_PARAMS: {
+        UINT8 status;
+        UINT16 conn_handle;
+        STREAM_TO_UINT8(status, p);
+        STREAM_TO_UINT16(conn_handle, p);
+        btm_ble_periodic_adv_sync_trans_complete(opcode, status, conn_handle);
+        break;
+    }
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 #endif
 #endif /* (BLE_INCLUDED == TRUE) */
 
@@ -2303,6 +2328,39 @@ static void btu_ble_scan_req_received_evt(UINT8 *p)
     btm_ble_scan_req_received_evt(&req_received);
 }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+static void btu_ble_periodic_adv_sync_trans_recv(UINT8 *p)
+{
+    UINT16 conn_handle;
+    tL2C_LCB *p_lcb = NULL;
+    tBTM_BLE_PERIOD_ADV_SYNC_TRANS_RECV past_recv = {0};
+
+    if (!p) {
+        HCI_TRACE_ERROR("%s, Invalid params.", __func__);
+        return;
+    }
+
+    STREAM_TO_UINT8(past_recv.status, p);
+    STREAM_TO_UINT16(conn_handle, p);
+    STREAM_TO_UINT16(past_recv.service_data, p);
+    STREAM_TO_UINT16(past_recv.sync_handle, p);
+    STREAM_TO_UINT8(past_recv.adv_sid, p);
+    STREAM_TO_UINT8(past_recv.adv_addr_type, p);
+    STREAM_TO_BDADDR(past_recv.adv_addr, p);
+    STREAM_TO_UINT8(past_recv.adv_phy, p);
+    STREAM_TO_UINT16(past_recv.adv_interval, p);
+    STREAM_TO_UINT8(past_recv.adv_clk_accuracy, p);
+
+    p_lcb = l2cu_find_lcb_by_handle(conn_handle);
+    if(p_lcb) {
+       memcpy(past_recv.addr, p_lcb->remote_bd_addr, BD_ADDR_LEN);
+    }
+
+    btm_ble_periodic_adv_sync_trans_recv_evt(&past_recv);
+}
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 /**********************************************
 ** End of BLE Events Handler
 ***********************************************/

components/bt/host/bluedroid/stack/gap/gap_ble.c

@@ -298,12 +298,34 @@ UINT8 gap_proc_write_req( tGATTS_REQ_TYPE type, tGATT_WRITE_REQ *p_data)
     UNUSED(type);
 
     for (i = 0; i < GAP_MAX_CHAR_NUM; i ++, p_db_attr ++) {
-        if (p_data-> handle == p_db_attr->handle) {
+        if (p_data->handle == p_db_attr->handle) {
+            switch (p_db_attr->uuid) {
+                #if (GATTS_DEVICE_NAME_WRITABLE == TRUE)
+                case GATT_UUID_GAP_DEVICE_NAME: {
+                    UINT8 *p_val = p_data->value;
+                    p_val[p_data->len] = '\0';
+                    BTM_SetLocalDeviceName((char *)p_val);
+                    return GATT_SUCCESS;
+                }
+                #endif
+                #if (GATTS_APPEARANCE_WRITABLE == TRUE)
+                case GATT_UUID_GAP_ICON: {
+                    UINT8 *p_val = p_data->value;
+                    if (p_data->len != sizeof(UINT16)) {
+                        return GATT_INVALID_ATTR_LEN;
+                    }
+                    STREAM_TO_UINT16(p_db_attr->attr_value.icon, p_val);
+                    return GATT_SUCCESS;
+                }
+                #endif
+                default:
+                    break;
+            }
             return GATT_WRITE_NOT_PERMIT;
         }
     }
-    return GATT_NOT_FOUND;
 
+    return GATT_NOT_FOUND;
 }
 
 /******************************************************************************
@@ -393,17 +415,26 @@ void gap_attr_db_init(void)
     */
     uuid.len = LEN_UUID_16;
     uuid.uu.uuid16 = p_db_attr->uuid = GATT_UUID_GAP_DEVICE_NAME;
-    p_db_attr->handle = GATTS_AddCharacteristic(service_handle, &uuid, GATT_PERM_READ, GATT_CHAR_PROP_BIT_READ,
-											NULL, NULL);
+    p_db_attr->handle = GATTS_AddCharacteristic(service_handle, &uuid,
+                        #if (GATTS_DEVICE_NAME_WRITABLE == TRUE)
+                        GATT_PERM_READ | GATT_PERM_WRITE,
+                        GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_WRITE_NR,
+                        #else
+                        GATT_PERM_READ, GATT_CHAR_PROP_BIT_READ,
+                        #endif
+                        NULL, NULL);
     p_db_attr ++;
 
     /* add Icon characteristic
     */
     uuid.uu.uuid16   = p_db_attr->uuid = GATT_UUID_GAP_ICON;
-    p_db_attr->handle = GATTS_AddCharacteristic(service_handle,
-                        &uuid,
-                        GATT_PERM_READ,
-                        GATT_CHAR_PROP_BIT_READ,
+    p_db_attr->handle = GATTS_AddCharacteristic(service_handle, &uuid,
+                        #if (GATTS_APPEARANCE_WRITABLE == TRUE)
+                        GATT_PERM_READ | GATT_PERM_WRITE,
+                        GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_WRITE_NR,
+                        #else
+                        GATT_PERM_READ, GATT_CHAR_PROP_BIT_READ,
+                        #endif
                         NULL, NULL);
     p_db_attr ++;
 

components/bt/host/bluedroid/stack/gatt/att_protocol.c

@@ -197,7 +197,7 @@ BT_HDR *attp_build_read_by_type_value_cmd (UINT16 payload_size, tGATT_FIND_TYPE_
 ** Returns          None.
 **
 *******************************************************************************/
-BT_HDR *attp_build_read_multi_cmd(UINT16 payload_size, UINT16 num_handle, UINT16 *p_handle)
+BT_HDR *attp_build_read_multi_cmd(UINT8 op_code, UINT16 payload_size, UINT16 num_handle, UINT16 *p_handle)
 {
     BT_HDR      *p_buf = NULL;
     UINT8       *p, i = 0;
@@ -208,7 +208,7 @@ BT_HDR *attp_build_read_multi_cmd(UINT16 payload_size, UINT16 num_handle, UINT16
         p_buf->offset = L2CAP_MIN_OFFSET;
         p_buf->len = 1;
 
-        UINT8_TO_STREAM (p, GATT_REQ_READ_MULTI);
+        UINT8_TO_STREAM (p, op_code);
 
         for (i = 0; i < num_handle && p_buf->len + 2 <= payload_size; i ++) {
             UINT16_TO_STREAM (p, *(p_handle + i));
@@ -304,7 +304,7 @@ BT_HDR *attp_build_value_cmd (UINT16 payload_size, UINT8 op_code, UINT16 handle,
             UINT8_TO_STREAM (p, pair_len);
             p_buf->len += 1;
         }
-        if (op_code != GATT_RSP_READ_BLOB && op_code != GATT_RSP_READ) {
+        if (op_code != GATT_RSP_READ_BLOB && op_code != GATT_RSP_READ && op_code != GATT_HANDLE_MULTI_VALUE_NOTIF) {
             UINT16_TO_STREAM (p, handle);
             p_buf->len += 2;
         }
@@ -391,6 +391,7 @@ BT_HDR *attp_build_sr_msg(tGATT_TCB *p_tcb, UINT8 op_code, tGATT_SR_MSG *p_msg)
     case GATT_RSP_READ:
     case GATT_HANDLE_VALUE_NOTIF:
     case GATT_HANDLE_VALUE_IND:
+    case GATT_HANDLE_MULTI_VALUE_NOTIF:
     case GATT_RSP_ERROR:
     case GATT_RSP_MTU:
     /* Need to check the validation of parameter p_msg*/
@@ -417,6 +418,7 @@ BT_HDR *attp_build_sr_msg(tGATT_TCB *p_tcb, UINT8 op_code, tGATT_SR_MSG *p_msg)
     case GATT_RSP_READ:
     case GATT_HANDLE_VALUE_NOTIF:
     case GATT_HANDLE_VALUE_IND:
+    case GATT_HANDLE_MULTI_VALUE_NOTIF:
         p_cmd = attp_build_value_cmd(p_tcb->payload_size,
                                      op_code,
                                      p_msg->attr_value.handle,
@@ -613,7 +615,8 @@ tGATT_STATUS attp_send_cl_msg (tGATT_TCB *p_tcb, UINT16 clcb_idx, UINT8 op_code,
             break;
 
         case GATT_REQ_READ_MULTI:
-            p_cmd = attp_build_read_multi_cmd(p_tcb->payload_size,
+        case GATT_REQ_READ_MULTI_VAR:
+            p_cmd = attp_build_read_multi_cmd(op_code, p_tcb->payload_size,
                                               p_msg->read_multi.num_handles,
                                               p_msg->read_multi.handles);
             break;

components/bt/host/bluedroid/stack/gatt/gatt_api.c

@@ -122,6 +122,20 @@ BOOLEAN  GATTS_NVRegister (const tGATT_APPL_INFO *p_cb_info)
     return status;
 }
 
+static void gatt_update_for_database_change(void)
+{
+    UINT8 i;
+
+    gatts_calculate_datebase_hash(gatt_cb.database_hash);
+
+    for (i = 0; i < GATT_MAX_PHY_CHANNEL; i++) {
+        tGATT_TCB *p_tcb = gatt_get_tcb_by_idx(i);
+        if (p_tcb && p_tcb->in_use) {
+            gatt_sr_update_cl_status(p_tcb, false);
+        }
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         GATTS_CreateService
@@ -167,8 +181,10 @@ UINT16 GATTS_CreateService (tGATT_IF gatt_if, tBT_UUID *p_svc_uuid,
     } else {
         if ( (p_svc_uuid->len == LEN_UUID_16) && (p_svc_uuid->uu.uuid16 == UUID_SERVCLASS_GATT_SERVER)) {
             s_hdl =  gatt_cb.hdl_cfg.gatt_start_hdl;
+            save_hdl = TRUE;
         } else if ((p_svc_uuid->len == LEN_UUID_16) && (p_svc_uuid->uu.uuid16 == UUID_SERVCLASS_GAP_SERVER)) {
             s_hdl = gatt_cb.hdl_cfg.gap_start_hdl;
+            save_hdl = TRUE;
         } else {
             p_list = p_list_info->p_first;
 
@@ -398,7 +414,8 @@ BOOLEAN GATTS_DeleteService (tGATT_IF gatt_if, tBT_UUID *p_svc_uuid, UINT16 svc_
         GATT_TRACE_DEBUG ("Delete a new service changed item - the service has not yet started");
         osi_free(fixed_queue_try_remove_from_queue(gatt_cb.pending_new_srv_start_q, p_buf));
     } else {
-        if (GATTS_SEND_SERVICE_CHANGE_MODE == GATTS_SEND_SERVICE_CHANGE_AUTO) {
+        gatt_update_for_database_change();
+        if (gatt_cb.srv_chg_mode == GATTS_SEND_SERVICE_CHANGE_AUTO) {
             gatt_proc_srv_chg();
         }
     }
@@ -510,7 +527,8 @@ tGATT_STATUS GATTS_StartService (tGATT_IF gatt_if, UINT16 service_handle,
     if ( (p_buf = gatt_sr_is_new_srv_chg(&p_list->asgn_range.app_uuid128,
                                          &p_list->asgn_range.svc_uuid,
                                          p_list->asgn_range.svc_inst)) != NULL) {
-        if (GATTS_SEND_SERVICE_CHANGE_MODE == GATTS_SEND_SERVICE_CHANGE_AUTO) {
+        gatt_update_for_database_change();
+        if (gatt_cb.srv_chg_mode == GATTS_SEND_SERVICE_CHANGE_AUTO) {
             gatt_proc_srv_chg();
         }
         /* remove the new service element after the srv changed processing is completed*/
@@ -980,6 +998,7 @@ tGATT_STATUS GATTC_Read (UINT16 conn_id, tGATT_READ_TYPE type, tGATT_READ_PARAM
             memcpy(&p_clcb->uuid, &p_read->service.uuid, sizeof(tBT_UUID));
             break;
         case GATT_READ_MULTIPLE:
+        case GATT_READ_MULTIPLE_VAR:
             p_clcb->s_handle = 0;
             /* copy multiple handles in CB */
             p_read_multi = (tGATT_READ_MULTI *)osi_malloc(sizeof(tGATT_READ_MULTI));
@@ -1171,6 +1190,12 @@ tGATT_STATUS GATTC_SendHandleValueConfirm (UINT16 conn_id, UINT16 handle)
     return ret;
 }
 
+tGATT_STATUS GATTC_AutoDiscoverEnable(UINT8 enable)
+{
+    gatt_cb.auto_disc = (enable > 0) ? TRUE : FALSE;
+    return GATT_SUCCESS;
+}
+
 #endif  ///GATTC_INCLUDED == TRUE
 
 /*******************************************************************************/
@@ -1543,7 +1568,8 @@ tGATT_STATUS GATT_SendServiceChangeIndication (BD_ADDR bd_addr)
     tGATT_TCB           *p_tcb;
     tBT_TRANSPORT      transport;
     tGATT_STATUS status = GATT_NOT_FOUND;
-    if (GATTS_SEND_SERVICE_CHANGE_MODE == GATTS_SEND_SERVICE_CHANGE_AUTO) {
+
+    if (gatt_cb.srv_chg_mode == GATTS_SEND_SERVICE_CHANGE_AUTO) {
         status = GATT_WRONG_STATE;
         GATT_TRACE_ERROR ("%s can't send service change indication manually, please configure the option through menuconfig", __func__);
         return status;
@@ -1675,4 +1701,78 @@ BOOLEAN GATT_Listen (tGATT_IF gatt_if, BOOLEAN start, BD_ADDR_PTR bd_addr)
     return gatt_update_listen_mode();
 }
 
+tGATT_STATUS GATTS_SetServiceChangeMode(UINT8 mode)
+{
+    if (mode > GATTS_SEND_SERVICE_CHANGE_MANUAL) {
+        GATT_TRACE_ERROR("%s invalid service change mode %u", __func__, mode);
+        return GATT_VALUE_NOT_ALLOWED;
+    }
+
+    gatt_cb.srv_chg_mode = mode;
+    return GATT_SUCCESS;
+}
+
+tGATT_STATUS GATTS_HandleMultiValueNotification (UINT16 conn_id, tGATT_HLV *tuples, UINT16 num_tuples)
+{
+    tGATT_STATUS    cmd_sent = GATT_ILLEGAL_PARAMETER;
+    BT_HDR          *p_buf;
+    tGATT_VALUE     notif;
+    tGATT_IF        gatt_if = GATT_GET_GATT_IF(conn_id);
+    UINT8           tcb_idx = GATT_GET_TCB_IDX(conn_id);
+    tGATT_REG       *p_reg = gatt_get_regcb(gatt_if);
+    tGATT_TCB       *p_tcb = gatt_get_tcb_by_idx(tcb_idx);
+    UINT8           *p = notif.value;
+    tGATT_HLV       *p_hlv = tuples;
+
+    GATT_TRACE_API ("GATTS_HandleMultiValueNotification");
+
+    if ( (p_reg == NULL) || (p_tcb == NULL)) {
+        GATT_TRACE_ERROR ("GATTS_HandleMultiValueNotification Unknown conn_id: %u \n", conn_id);
+        return (tGATT_STATUS) GATT_INVALID_CONN_ID;
+    }
+
+    if (!gatt_check_connection_state_by_tcb(p_tcb)) {
+        GATT_TRACE_ERROR("connection not established\n");
+        return GATT_WRONG_STATE;
+    }
+
+    if (tuples == NULL) {
+        return GATT_ILLEGAL_PARAMETER;
+    }
+
+    notif.len = 0;
+
+    while (num_tuples) {
+        if (!GATT_HANDLE_IS_VALID (p_hlv->handle)) {
+            return GATT_ILLEGAL_PARAMETER;
+        }
+
+        UINT16_TO_STREAM(p, p_hlv->handle);   //handle
+        UINT16_TO_STREAM(p, p_hlv->length);   //length
+        memcpy (p, p_hlv->value, p_hlv->length); //value
+        GATT_TRACE_DEBUG("%s handle %x, length %u", __func__, p_hlv->handle, p_hlv->length);
+        p += p_hlv->length;
+        notif.len += 4 + p_hlv->length;
+        num_tuples--;
+        p_hlv++;
+    }
+
+    notif.auth_req = GATT_AUTH_REQ_NONE;
+
+    p_buf = attp_build_sr_msg (p_tcb, GATT_HANDLE_MULTI_VALUE_NOTIF, (tGATT_SR_MSG *)&notif);
+    if (p_buf != NULL) {
+        cmd_sent = attp_send_sr_msg (p_tcb, p_buf);
+    } else {
+        cmd_sent = GATT_NO_RESOURCES;
+    }
+
+    return cmd_sent;
+}
+
+tGATT_STATUS GATTS_ShowLocalDatabase(void)
+{
+    gatts_show_local_database();
+    return GATT_SUCCESS;
+}
+
 #endif

components/bt/host/bluedroid/stack/gatt/gatt_attr.c

@@ -29,11 +29,18 @@
 #include "stack/gatt_api.h"
 #include "gatt_int.h"
 #include "stack/sdpdefs.h"
+#include "bta/bta_gatts_co.h"
 
 #if (BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE)
 
+#define BLE_GATT_SR_SUPP_FEAT_EATT_BITMASK 0x01
+#define BLE_GATT_CL_SUPP_FEAT_ROBUST_CACHING_BITMASK 0x01
+#define BLE_GATT_CL_SUPP_FEAT_EATT_BITMASK 0x02
+#define BLE_GATT_CL_SUPP_FEAT_MULTI_NOTIF_BITMASK 0x04
+#define BLE_GATT_CL_SUPP_FEAT_BITMASK 0x07
+
 #define GATTP_MAX_NUM_INC_SVR       0
-#define GATTP_MAX_CHAR_NUM          2
+#define GATTP_MAX_CHAR_NUM          4
 #define GATTP_MAX_ATTR_NUM          (GATTP_MAX_CHAR_NUM * 2 + GATTP_MAX_NUM_INC_SVR + 1)
 #define GATTP_MAX_CHAR_VALUE_SIZE   50
 
@@ -180,30 +187,109 @@ void gatt_profile_clcb_dealloc (tGATT_PROFILE_CLCB *p_clcb)
 ** Returns          GATT_SUCCESS if successfully sent; otherwise error code.
 **
 *******************************************************************************/
-tGATT_STATUS gatt_proc_read (tGATTS_REQ_TYPE type, tGATT_READ_REQ *p_data, tGATTS_RSP *p_rsp)
+tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_REQ *p_data, tGATTS_RSP *p_rsp)
 {
     tGATT_STATUS    status = GATT_NO_RESOURCES;
+    UINT16 len = 0;
+    UINT8 *value;
     UNUSED(type);
 
+    GATT_TRACE_DEBUG("%s handle %x", __func__, p_data->handle);
+
+    UINT8 tcb_idx = GATT_GET_TCB_IDX(conn_id);
+    tGATT_TCB *tcb = gatt_get_tcb_by_idx(tcb_idx);
+
     if (p_data->is_long) {
         p_rsp->attr_value.offset = p_data->offset;
     }
 
     p_rsp->attr_value.handle = p_data->handle;
-    UINT16 len = 0;
-    uint8_t *value;
-    status = GATTS_GetAttributeValue(p_data->handle, &len, &value);
-    if(status == GATT_SUCCESS && len > 0 && value) {
-        if(len > GATT_MAX_ATTR_LEN) {
-            len = GATT_MAX_ATTR_LEN;
+
+    /* handle request for reading service changed */
+    if (p_data->handle == gatt_cb.handle_of_h_r) {
+        status = GATTS_GetAttributeValue(p_data->handle, &len, &value);
+        if(status == GATT_SUCCESS && len > 0 && value) {
+            if(len > GATT_MAX_ATTR_LEN) {
+                len = GATT_MAX_ATTR_LEN;
+            }
+            p_rsp->attr_value.len = len;
+            memcpy(p_rsp->attr_value.value, value, len);
         }
-        p_rsp->attr_value.len = len;
-        memcpy(p_rsp->attr_value.value, value, len);
+    }
+
+    /* handle request for reading client supported features */
+    if (p_data->handle == gatt_cb.handle_of_cl_supported_feat) {
+        if (tcb == NULL) {
+            return GATT_INSUF_RESOURCE;
+        }
+        p_rsp->attr_value.len = 1;
+        memcpy(p_rsp->attr_value.value, &tcb->cl_supp_feat, 1);
+        status = GATT_SUCCESS;
+    }
+
+    /* handle request for reading database hash */
+    if (p_data->handle == gatt_cb.handle_of_database_hash) {
+        p_rsp->attr_value.len = BT_OCTET16_LEN;
+        memcpy(p_rsp->attr_value.value, gatt_cb.database_hash, BT_OCTET16_LEN);
+        gatt_sr_update_cl_status(tcb, true);
+        status = GATT_SUCCESS;
+    }
+
+    /* handle request for reading server supported features */
+    if (p_data->handle == gatt_cb.handle_of_sr_supported_feat) {
+        p_rsp->attr_value.len = 1;
+        memcpy(p_rsp->attr_value.value, &gatt_cb.gatt_sr_supported_feat_mask, 1);
+        status = GATT_SUCCESS;
     }
 
     return status;
 }
 
+static tGATT_STATUS gatt_sr_write_cl_supp_feat(UINT16 conn_id, tGATT_WRITE_REQ *p_data)
+{
+    UINT8 val_new;
+    UINT8 val_old;
+    UINT8 val_xor;
+    UINT8 val_and;
+    UINT8 *p = p_data->value;
+    UINT8 tcb_idx = GATT_GET_TCB_IDX(conn_id);
+    tGATT_TCB *p_tcb = gatt_get_tcb_by_idx(tcb_idx);
+
+    GATT_TRACE_DEBUG("%s len %u, feat %x", __func__, p_data->len, *p);
+
+    if (p_tcb == NULL) {
+        GATT_TRACE_ERROR("%s no conn", __func__);
+        return GATT_NOT_FOUND;
+    }
+
+    if (p_data->len != 1) {
+        GATT_TRACE_ERROR("%s len %u", __func__, p_data->len);
+        return GATT_INVALID_PDU;
+    }
+
+    STREAM_TO_UINT8(val_new, p);
+    val_new = (val_new & BLE_GATT_CL_SUPP_FEAT_BITMASK);
+
+    if (val_new == 0) {
+        GATT_TRACE_ERROR("%s bit cannot be all zero", __func__);
+        return GATT_VALUE_NOT_ALLOWED;
+    }
+
+    val_old = p_tcb->cl_supp_feat;
+    val_xor = val_old ^ val_new;
+    val_and = val_xor & val_new;
+    if (val_and != val_xor) {
+        GATT_TRACE_ERROR("%s bit cannot be reset", __func__);
+        return GATT_VALUE_NOT_ALLOWED;
+    }
+
+    p_tcb->cl_supp_feat = val_new;
+#if (SMP_INCLUDED == TRUE)
+    bta_gatts_co_cl_feat_save(p_tcb->peer_bda, &p_tcb->cl_supp_feat);
+#endif
+    return GATT_SUCCESS;
+}
+
 /******************************************************************************
 **
 ** Function         gatt_proc_write_req
@@ -213,12 +299,29 @@ tGATT_STATUS gatt_proc_read (tGATTS_REQ_TYPE type, tGATT_READ_REQ *p_data, tGATT
 ** Returns          GATT_SUCCESS if successfully sent; otherwise error code.
 **
 *******************************************************************************/
-tGATT_STATUS gatt_proc_write_req( tGATTS_REQ_TYPE type, tGATT_WRITE_REQ *p_data)
+tGATT_STATUS gatt_proc_write_req(UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_WRITE_REQ *p_data)
 {
     if(p_data->len > GATT_MAX_ATTR_LEN) {
         p_data->len = GATT_MAX_ATTR_LEN;
     }
-   return GATTS_SetAttributeValue(p_data->handle,
+
+    if (p_data->handle == gatt_cb.handle_of_h_r) {
+        return GATT_WRITE_NOT_PERMIT;
+    }
+
+    if (p_data->handle == gatt_cb.handle_of_cl_supported_feat) {
+        return gatt_sr_write_cl_supp_feat(conn_id, p_data);
+    }
+
+    if (p_data->handle == gatt_cb.handle_of_database_hash) {
+        return GATT_WRITE_NOT_PERMIT;
+    }
+
+    if (p_data->handle == gatt_cb.handle_of_sr_supported_feat) {
+        return GATT_WRITE_NOT_PERMIT;
+    }
+
+    return GATTS_SetAttributeValue(p_data->handle,
                            p_data->len,
                            p_data->value);
 
@@ -244,14 +347,14 @@ static void gatt_request_cback (UINT16 conn_id, UINT32 trans_id, tGATTS_REQ_TYPE
 
     switch (type) {
     case GATTS_REQ_TYPE_READ:
-        status = gatt_proc_read(type, &p_data->read_req, &rsp_msg);
+        status = gatt_proc_read(conn_id, type, &p_data->read_req, &rsp_msg);
         break;
 
     case GATTS_REQ_TYPE_WRITE:
         if (!p_data->write_req.need_rsp) {
             ignore = TRUE;
         }
-        status = gatt_proc_write_req(type, &p_data->write_req);
+        status = gatt_proc_write_req(conn_id, type, &p_data->write_req);
         break;
 
     case GATTS_REQ_TYPE_WRITE_EXEC:
@@ -370,8 +473,21 @@ void gatt_profile_db_init (void)
     };
 
     GATTS_AddCharDescriptor (service_handle, GATT_PERM_READ | GATT_PERM_WRITE , &descr_uuid, &attr_val, NULL);
-    /* start service
-    */
+
+    /* add Client Supported Features characteristic */
+    uuid.uu.uuid16 = GATT_UUID_CLIENT_SUP_FEAT;
+    gatt_cb.handle_of_cl_supported_feat = GATTS_AddCharacteristic(service_handle, &uuid, GATT_PERM_READ | GATT_PERM_WRITE,
+        GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_WRITE, NULL, NULL);
+
+    /* add Database Hash characteristic */
+    uuid.uu.uuid16 = GATT_UUID_GATT_DATABASE_HASH;
+    gatt_cb.handle_of_database_hash = GATTS_AddCharacteristic(service_handle, &uuid, GATT_PERM_READ, GATT_CHAR_PROP_BIT_READ, NULL, NULL);
+
+    /* add Server Supported Features characteristic */
+    uuid.uu.uuid16 = GATT_UUID_SERVER_SUP_FEAT;
+    gatt_cb.handle_of_sr_supported_feat = GATTS_AddCharacteristic(service_handle, &uuid, GATT_PERM_READ, GATT_CHAR_PROP_BIT_READ, NULL, NULL);
+
+    /* start service */
     status = GATTS_StartService (gatt_cb.gatt_if, service_handle, GATTP_TRANSPORT_SUPPORTED );
 
 #if (CONFIG_BT_STACK_NO_LOG)
@@ -576,4 +692,106 @@ void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable, tBT_TRANSP
     gatt_cl_start_config_ccc(p_clcb);
 }
 
+/*******************************************************************************
+**
+** Function         gatt_sr_is_cl_robust_caching_supported
+**
+** Description      Check if Robust Caching is supported for the connection
+**
+** Returns          true if enabled by client side, otherwise false
+**
+*******************************************************************************/
+static BOOLEAN gatt_sr_is_cl_robust_caching_supported(tGATT_TCB *p_tcb)
+{
+    // Server robust caching not enabled
+    if (!GATTS_ROBUST_CACHING_ENABLED) {
+        return FALSE;
+    }
+
+    return (p_tcb->cl_supp_feat & BLE_GATT_CL_SUPP_FEAT_ROBUST_CACHING_BITMASK);
+}
+
+/*******************************************************************************
+**
+** Function         gatt_sr_is_cl_change_aware
+**
+** Description      Check if the connection is change-aware
+**
+** Returns          true if change aware, otherwise false
+**
+*******************************************************************************/
+BOOLEAN gatt_sr_is_cl_change_aware(tGATT_TCB *p_tcb)
+{
+    // If robust caching is not supported, should always return true by default
+    if (!gatt_sr_is_cl_robust_caching_supported(p_tcb)) {
+        return true;
+    }
+
+    return p_tcb->is_robust_cache_change_aware;
+}
+
+/*******************************************************************************
+**
+** Function         gatt_sr_init_cl_status
+**
+** Description      Restore status for trusted device
+**
+** Returns          none
+**
+*******************************************************************************/
+void gatt_sr_init_cl_status(tGATT_TCB *p_tcb)
+{
+#if (SMP_INCLUDED == TRUE)
+    bta_gatts_co_cl_feat_load(p_tcb->peer_bda, &p_tcb->cl_supp_feat);
+#endif
+
+    // This is used to reset bit when robust caching is disabled
+    if (!GATTS_ROBUST_CACHING_ENABLED) {
+        p_tcb->cl_supp_feat &= ~BLE_GATT_CL_SUPP_FEAT_ROBUST_CACHING_BITMASK;
+    }
+
+    if (gatt_sr_is_cl_robust_caching_supported(p_tcb)) {
+        BT_OCTET16 stored_hash = {0};
+#if (SMP_INCLUDED == TRUE)
+        bta_gatts_co_db_hash_load(p_tcb->peer_bda, stored_hash);
+#endif
+        p_tcb->is_robust_cache_change_aware = (memcmp(stored_hash, gatt_cb.database_hash, BT_OCTET16_LEN) == 0);
+    } else {
+        p_tcb->is_robust_cache_change_aware = true;
+    }
+
+    GATT_TRACE_DEBUG("%s feat %x aware %d", __func__, p_tcb->cl_supp_feat, p_tcb->is_robust_cache_change_aware);
+}
+
+/*******************************************************************************
+**
+** Function         gatt_sr_update_cl_status
+**
+** Description      Update change-aware status for the remote device
+**
+** Returns          none
+**
+*******************************************************************************/
+void gatt_sr_update_cl_status(tGATT_TCB *p_tcb, BOOLEAN chg_aware)
+{
+    if (p_tcb == NULL) {
+        return;
+    }
+
+    // if robust caching is not supported, do nothing
+    if (!gatt_sr_is_cl_robust_caching_supported(p_tcb)) {
+        return;
+    }
+
+    // only when client status is changed from unaware to aware, we should store database hash
+    if (!p_tcb->is_robust_cache_change_aware && chg_aware) {
+#if (SMP_INCLUDED == TRUE)
+        bta_gatts_co_db_hash_save(p_tcb->peer_bda, gatt_cb.database_hash);
+#endif
+    }
+
+    p_tcb->is_robust_cache_change_aware = chg_aware;
+
+    GATT_TRACE_DEBUG("%s status %d", __func__, chg_aware);
+}
 #endif  /* BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */

components/bt/host/bluedroid/stack/gatt/gatt_cl.c

@@ -53,6 +53,7 @@ static const UINT8 disc_type_to_att_opcode[GATT_DISC_MAX] = {
     GATT_REQ_FIND_TYPE_VALUE,      /*  GATT_DISC_SRVC_BY_UUID,  */
     GATT_REQ_READ_BY_TYPE,         /*  GATT_DISC_INC_SRVC,      */
     GATT_REQ_READ_BY_TYPE,         /*  GATT_DISC_CHAR,          */
+    GATT_REQ_READ_BY_TYPE,         /*  GATT_DISC_CHAR_BY_UUID,  */
     GATT_REQ_FIND_INFO             /*  GATT_DISC_CHAR_DSCPT,    */
 };
 
@@ -65,6 +66,8 @@ static const UINT16 disc_type_to_uuid[GATT_DISC_MAX] = {
     0                   /* no type filtering for DISC_CHAR_DSCPT */
 };
 
+// Use for GATTC discover infomation print
+#define GATT_DISC_INFO(fmt, args...) {if (gatt_cb.auto_disc == FALSE) BT_PRINT_I("BT_GATT", fmt, ## args);}
 
 /*******************************************************************************
 **
@@ -107,6 +110,10 @@ void gatt_act_discovery(tGATT_CLCB *p_clcb)
             }
         }
 
+        if (p_clcb->op_subtype == GATT_DISC_CHAR_BY_UUID) {
+            memcpy(&cl_req.browse.uuid, &p_clcb->uuid, sizeof(tBT_UUID));
+        }
+
         st = attp_send_cl_msg(p_clcb->p_tcb, p_clcb->clcb_idx, op_code, &cl_req);
 
         if (st !=  GATT_SUCCESS && st != GATT_CMD_STARTED) {
@@ -181,6 +188,11 @@ void gatt_act_read (tGATT_CLCB *p_clcb, UINT16 offset)
         memcpy (&msg.read_multi, p_clcb->p_attr_buf, sizeof(tGATT_READ_MULTI));
         break;
 
+    case GATT_READ_MULTIPLE_VAR:
+        op_code = GATT_REQ_READ_MULTI_VAR;
+        memcpy (&msg.read_multi, p_clcb->p_attr_buf, sizeof(tGATT_READ_MULTI));
+        break;
+
     case GATT_READ_INC_SRV_UUID128:
         op_code = GATT_REQ_READ;
         msg.handle = p_clcb->s_handle;
@@ -408,6 +420,7 @@ void gatt_process_find_type_value_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UIN
     while (len >= 4) {
         STREAM_TO_UINT16 (result.handle, p);
         STREAM_TO_UINT16 (result.value.group_value.e_handle, p);
+        GATT_DISC_INFO("%s handle %x, end handle %x", __func__, result.handle, result.value.group_value.e_handle);
         memcpy (&result.value.group_value.service_type,  &p_clcb->uuid, sizeof(tBT_UUID));
 
         len -= 4;
@@ -474,6 +487,8 @@ void gatt_process_read_info_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op_c
 
         len -= (uuid_len + 2);
 
+        GATT_DISC_INFO("%s handle %x, uuid %s", __func__, result.handle, gatt_uuid_to_str(&result.type));
+
         if (p_clcb->p_reg->app_cb.p_disc_res_cb) {
             (*p_clcb->p_reg->app_cb.p_disc_res_cb)(p_clcb->conn_id, p_clcb->op_subtype, &result);
         }
@@ -510,7 +525,7 @@ void gatt_proc_disc_error_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 opcode
     case GATT_REQ_FIND_INFO:
         if (reason == GATT_NOT_FOUND) {
             status = GATT_SUCCESS;
-            GATT_TRACE_DEBUG("Discovery completed");
+            GATT_DISC_INFO("Discovery completed");
         }
         break;
     default:
@@ -541,7 +556,7 @@ void gatt_process_error_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8 op_code,
     UNUSED(op_code);
     UNUSED(len);
 
-    GATT_TRACE_DEBUG("gatt_process_error_rsp ");
+    GATT_TRACE_DEBUG("%s", __func__);
     STREAM_TO_UINT8(opcode, p);
     STREAM_TO_UINT16(handle, p);
     STREAM_TO_UINT8(reason, p);
@@ -634,7 +649,7 @@ void gatt_process_notification(tGATT_TCB *p_tcb, UINT8 op_code,
     UINT16          conn_id;
     tGATT_STATUS    encrypt_status;
     UINT8           *p = p_data, i,
-                     event = (op_code == GATT_HANDLE_VALUE_NOTIF) ? GATTC_OPTYPE_NOTIFICATION : GATTC_OPTYPE_INDICATION;
+                     event = (op_code == GATT_HANDLE_VALUE_IND) ? GATTC_OPTYPE_INDICATION: GATTC_OPTYPE_NOTIFICATION;
 
     GATT_TRACE_DEBUG("gatt_process_notification ");
 
@@ -644,8 +659,6 @@ void gatt_process_notification(tGATT_TCB *p_tcb, UINT8 op_code,
     }
 
     STREAM_TO_UINT16 (value.handle, p);
-    value.len = len - 2;
-    memcpy (value.value, p, value.len);
 
     if (!GATT_HANDLE_IS_VALID(value.handle)) {
         /* illegal handle, send ack now */
@@ -655,6 +668,28 @@ void gatt_process_notification(tGATT_TCB *p_tcb, UINT8 op_code,
         return;
     }
 
+    if (op_code == GATT_HANDLE_MULTI_VALUE_NOTIF) {
+        if (len < GATT_NOTIFICATION_MIN_LEN + 2) {
+            GATT_TRACE_ERROR("illegal notification PDU length, discard");
+            return;
+        }
+
+        STREAM_TO_UINT16(value.len, p);
+        if (value.len > len - 4) {
+            return;
+        }
+    } else {
+        value.len = len - 2;
+    }
+
+    if (value.len > GATT_MAX_ATTR_LEN) {
+        GATT_TRACE_ERROR("value length larger than GATT_MAX_ATTR_LEN, discard");
+        return;
+    }
+
+    memcpy(value.value, p, value.len);
+    p += value.len;
+
     if (event == GATTC_OPTYPE_INDICATION) {
         if (p_tcb->ind_count) {
             /* this is an error case that receiving an indication but we
@@ -665,19 +700,16 @@ void gatt_process_notification(tGATT_TCB *p_tcb, UINT8 op_code,
             GATT_TRACE_ERROR("gatt_process_notification rcv Ind. but ind_count=%d (will reset ind_count)",  p_tcb->ind_count);
         }
         p_tcb->ind_count = 0;
-    }
 
-    /* should notify all registered client with the handle value notificaion/indication
-       Note: need to do the indication count and start timer first then do callback
-     */
-
-    for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
-        if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb && (event == GATTC_OPTYPE_INDICATION)) {
-            p_tcb->ind_count++;
+        /* should notify all registered client with the handle value notificaion/indication
+           Note: need to do the indication count and start timer first then do callback
+        */
+        for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+            if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb && (event == GATTC_OPTYPE_INDICATION)) {
+                p_tcb->ind_count++;
+            }
         }
-    }
 
-    if (event == GATTC_OPTYPE_INDICATION) {
         /* start a timer for app confirmation */
         if (p_tcb->ind_count > 0) {
             gatt_start_ind_ack_timer(p_tcb);
@@ -694,6 +726,33 @@ void gatt_process_notification(tGATT_TCB *p_tcb, UINT8 op_code,
         }
     }
 
+    if (op_code != GATT_HANDLE_MULTI_VALUE_NOTIF) {
+        return;
+    }
+
+    if (len < (4 + value.len)) {
+        GATT_TRACE_ERROR("no remain data for multi notification");
+        return;
+    }
+
+    len -= (4 + value.len);
+
+    while (len > 4) {
+        STREAM_TO_UINT16(value.handle, p);
+        STREAM_TO_UINT16(value.len, p);
+        len -= 4;
+        value.len = MIN(len, value.len);
+        memcpy(value.value, p, value.len);
+        p += value.len;
+        len -= value.len;
+
+        for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+            if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+                conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+                (*p_reg->app_cb.p_cmpl_cb) (conn_id, event, encrypt_status, (tGATT_CL_COMPLETE *)&value);
+            }
+        }
+    }
 }
 
 /*******************************************************************************
@@ -746,6 +805,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
 
     while (len >= (handle_len + value_len)) {
         STREAM_TO_UINT16(handle, p);
+        GATT_DISC_INFO("%s op %x, handle %x", __func__, op_code, handle);
 
         if (!GATT_HANDLE_IS_VALID(handle)) {
             gatt_end_operation(p_clcb, GATT_INVALID_HANDLE, NULL);
@@ -775,6 +835,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
                     break;
                 }
             }
+            GATT_DISC_INFO("DISC ALL SVC end handle %x, uuid %s", record_value.group_value.e_handle, gatt_uuid_to_str(&record_value.group_value.service_type));
         }
         /* discover included service */
         else if (p_clcb->operation == GATTC_OPTYPE_DISCOVERY && p_clcb->op_subtype == GATT_DISC_INC_SRVC) {
@@ -790,6 +851,8 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
             if (value_len == 6) {
                 STREAM_TO_UINT16(record_value.incl_service.service_type.uu.uuid16, p);
                 record_value.incl_service.service_type.len = LEN_UUID_16;
+                GATT_DISC_INFO("DISC INC SVC start handle %x, end handle %x, uuid %s",
+                    record_value.incl_service.s_handle, record_value.incl_service.e_handle, gatt_uuid_to_str(&record_value.incl_service.service_type));
             } else if (value_len == 4) {
                 p_clcb->s_handle = record_value.incl_service.s_handle;
                 p_clcb->read_uuid128.wait_for_read_rsp = TRUE;
@@ -797,7 +860,7 @@ void gatt_process_read_by_type_rsp (tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb, UINT8
                 memcpy(&p_clcb->read_uuid128.result, &result, sizeof(result));
                 memcpy(&p_clcb->read_uuid128.result.value, &record_value, sizeof (result.value));
                 p_clcb->op_subtype |= 0x90;
-                gatt_act_read(p_clcb, 0);
+                gatt_act_read(p_clcb, 0);  // read 128-bit uuid of include service
                 return;
             } else {
                 GATT_TRACE_ERROR("gatt_process_read_by_type_rsp INCL_SRVC failed with invalid data value_len=%d", value_len);
@@ -937,6 +1000,9 @@ void gatt_process_read_rsp(tGATT_TCB *p_tcb, tGATT_CLCB *p_clcb,  UINT8 op_code,
 
                 memcpy(p_clcb->read_uuid128.result.value.incl_service.service_type.uu.uuid128, p, len);
                 p_clcb->read_uuid128.result.value.incl_service.service_type.len = LEN_UUID_128;
+                tGATT_INCL_SRVC *inc_srvc = &p_clcb->read_uuid128.result.value.incl_service;
+                GATT_DISC_INFO("DISC INC SRVC start handle %x, end handle %x, uuid %s",
+                    inc_srvc->s_handle, inc_srvc->e_handle, gatt_uuid_to_str(&inc_srvc->service_type));
                 if ( p_clcb->p_reg->app_cb.p_disc_res_cb) {
                     (*p_clcb->p_reg->app_cb.p_disc_res_cb)(p_clcb->conn_id, p_clcb->op_subtype, &p_clcb->read_uuid128.result);
                 }
@@ -1088,7 +1154,8 @@ void gatt_client_handle_server_rsp (tGATT_TCB *p_tcb, UINT8 op_code,
     tGATT_CLCB   *p_clcb = NULL;
     UINT8        rsp_code;
 
-    if (op_code != GATT_HANDLE_VALUE_IND && op_code != GATT_HANDLE_VALUE_NOTIF) {
+    if (op_code != GATT_HANDLE_VALUE_IND && op_code != GATT_HANDLE_VALUE_NOTIF &&
+        op_code != GATT_HANDLE_MULTI_VALUE_NOTIF) {
         p_clcb = gatt_cmd_dequeue(p_tcb, &rsp_code);
 
         rsp_code = gatt_cmd_to_rsp_code(rsp_code);
@@ -1107,8 +1174,8 @@ void gatt_client_handle_server_rsp (tGATT_TCB *p_tcb, UINT8 op_code,
     /* The message has to be smaller than the agreed MTU, len does not count op_code */
     if (len >= p_tcb->payload_size) {
         GATT_TRACE_ERROR("invalid response/indicate pkt size: %d, PDU size: %d", len + 1, p_tcb->payload_size);
-        if (op_code != GATT_HANDLE_VALUE_NOTIF &&
-                op_code != GATT_HANDLE_VALUE_IND) {
+        if (op_code != GATT_HANDLE_VALUE_NOTIF && op_code != GATT_HANDLE_VALUE_IND &&
+            op_code != GATT_HANDLE_MULTI_VALUE_NOTIF) {
             gatt_end_operation(p_clcb, GATT_ERROR, NULL);
         }
     } else {
@@ -1133,6 +1200,7 @@ void gatt_client_handle_server_rsp (tGATT_TCB *p_tcb, UINT8 op_code,
         case GATT_RSP_READ:
         case GATT_RSP_READ_BLOB:
         case GATT_RSP_READ_MULTI:
+        case GATT_RSP_READ_MULTI_VAR:
             gatt_process_read_rsp(p_tcb, p_clcb, op_code, len, p_data);
             break;
 
@@ -1154,6 +1222,7 @@ void gatt_client_handle_server_rsp (tGATT_TCB *p_tcb, UINT8 op_code,
 
         case GATT_HANDLE_VALUE_NOTIF:
         case GATT_HANDLE_VALUE_IND:
+        case GATT_HANDLE_MULTI_VALUE_NOTIF:
             gatt_process_notification(p_tcb, op_code, len, p_data);
             break;
 
@@ -1163,11 +1232,10 @@ void gatt_client_handle_server_rsp (tGATT_TCB *p_tcb, UINT8 op_code,
         }
     }
 
-    if (op_code != GATT_HANDLE_VALUE_IND && op_code != GATT_HANDLE_VALUE_NOTIF) {
+    if (op_code != GATT_HANDLE_VALUE_IND && op_code != GATT_HANDLE_VALUE_NOTIF &&
+        op_code != GATT_HANDLE_MULTI_VALUE_NOTIF) {
         gatt_cl_send_next_cmd_inq(p_tcb);
     }
-
-    return;
 }
 
 #endif  /* BLE_INCLUDED == TRUE && GATTC_INCLUDED == TRUE */

components/bt/host/bluedroid/stack/gatt/gatt_db.c

@@ -35,6 +35,9 @@
 #include "stack/l2c_api.h"
 #include "btm_int.h"
 
+extern tGATT_STATUS gap_proc_read(tGATTS_REQ_TYPE type, tGATT_READ_REQ *p_data, tGATTS_RSP *p_rsp);
+extern tGATT_STATUS gatt_proc_read(UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_REQ *p_data, tGATTS_RSP *p_rsp);
+
 /********************************************************************************
 **              L O C A L    F U N C T I O N     P R O T O T Y P E S            *
 *********************************************************************************/
@@ -764,6 +767,66 @@ tGATT_STATUS gatts_set_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
     return GATT_SUCCESS;
 }
 
+/*******************************************************************************
+**
+** Function         gatts_get_attr_value_internal
+**
+** Description      This function get the attribute value in gap service and gatt service
+**
+** Parameter        attr_handle: the attribute handle
+**                  length: the attribute value length
+**                  value: the pointer to the data to be get to the attribute value in the database
+**
+** Returns          Status of the operation.
+**
+*******************************************************************************/
+static tGATT_STATUS gatts_get_attr_value_internal(UINT16 attr_handle, UINT16 *length, UINT8 **value)
+{
+    UINT8 i;
+    tGATT_READ_REQ read_req;
+    tGATT_STATUS status = GATT_NOT_FOUND;
+    tGATT_SR_REG *p_rcb = gatt_cb.sr_reg;
+    UINT8 service_uuid[LEN_UUID_128] = {0};
+
+    // find the service by handle
+    for (i = 0; i < GATT_MAX_SR_PROFILES; i++, p_rcb++) {
+        if (p_rcb->in_use && p_rcb->s_hdl <= attr_handle && p_rcb->e_hdl >= attr_handle) {
+            break;
+        }
+    }
+
+    // service cb not found
+    if (i == GATT_MAX_SR_PROFILES) {
+        return status;
+    }
+
+    if (p_rcb->app_uuid.len != LEN_UUID_128) {
+        return status;
+    }
+
+    memset(&read_req, 0, sizeof(tGATT_READ_REQ));
+    read_req.handle = attr_handle;
+
+    // read gatt service attribute value
+    memset(service_uuid, 0x81, LEN_UUID_128);
+    if (!memcmp(p_rcb->app_uuid.uu.uuid128, service_uuid, LEN_UUID_128)) {
+        status = gatt_proc_read(0, GATTS_REQ_TYPE_READ, &read_req, &gatt_cb.rsp);
+    }
+
+    // read gap service attribute value
+    memset(service_uuid, 0x82, LEN_UUID_128);
+    if (!memcmp(p_rcb->app_uuid.uu.uuid128, service_uuid, LEN_UUID_128)) {
+        status = gap_proc_read(GATTS_REQ_TYPE_READ, &read_req, &gatt_cb.rsp);
+    }
+
+    if (status == GATT_SUCCESS) {
+        *length = gatt_cb.rsp.attr_value.len;
+        *value = gatt_cb.rsp.attr_value.value;
+    }
+
+    return status;
+}
+
 /*******************************************************************************
 **
 ** Function         gatts_get_attribute_value
@@ -805,7 +868,11 @@ tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
         return GATT_INVALID_PDU;
     }
 
-    p_cur    =  (tGATT_ATTR16 *) p_db->p_attr_list;
+    if (gatts_get_attr_value_internal(attr_handle, length, value) == GATT_SUCCESS) {
+        return GATT_SUCCESS;
+    }
+
+    p_cur = (tGATT_ATTR16 *) p_db->p_attr_list;
 
     while (p_cur != NULL) {
         if (p_cur->handle == attr_handle) {

components/bt/host/bluedroid/stack/gatt/gatt_main.c

@@ -103,6 +103,7 @@ void gatt_init (void)
     memset (&gatt_cb, 0, sizeof(tGATT_CB));
     memset (&fixed_reg, 0, sizeof(tL2CAP_FIXED_CHNL_REG));
 
+    gatt_cb.auto_disc = TRUE;
     gatt_cb.p_clcb_list = list_new(osi_free_func);
     gatt_cb.p_tcb_list  = list_new(osi_free_func);
 #if defined(GATT_INITIAL_TRACE_LEVEL)
@@ -114,6 +115,8 @@ void gatt_init (void)
     gatt_cb.sign_op_queue = fixed_queue_new(QUEUE_SIZE_MAX);
     gatt_cb.srv_chg_clt_q = fixed_queue_new(QUEUE_SIZE_MAX);
     gatt_cb.pending_new_srv_start_q = fixed_queue_new(QUEUE_SIZE_MAX);
+    gatt_cb.srv_chg_mode = GATTS_SEND_SERVICE_CHANGE_MODE;
+
     /* First, register fixed L2CAP channel for ATT over BLE */
     fixed_reg.fixed_chnl_opts.mode         = L2CAP_FCR_BASIC_MODE;
     fixed_reg.fixed_chnl_opts.max_transmit = 0xFF;

components/bt/host/bluedroid/stack/gatt/gatt_sr.c

@@ -277,6 +277,117 @@ static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
     return (FALSE);
 }
 
+static BOOLEAN process_read_multi_var_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
+                                       tGATTS_RSP *p_msg, UINT16 mtu)
+{
+    UINT16          ii;
+    UINT16          total_len;
+    UINT16          len;
+    UINT8           *p;
+
+    GATT_TRACE_DEBUG ("process_read_multi_var rsp status=%d mtu=%d", status, mtu);
+
+	if (p_cmd->multi_rsp_q == NULL) {
+        p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
+	}
+
+    /* Enqueue the response */
+    BT_HDR  *p_buf = (BT_HDR *)osi_malloc(sizeof(tGATTS_RSP));
+    if (p_buf == NULL) {
+        p_cmd->status = GATT_INSUF_RESOURCE;
+        return FALSE;
+    }
+    memcpy((void *)p_buf, (const void *)p_msg, sizeof(tGATTS_RSP));
+
+    fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
+
+    p_cmd->status = status;
+    if (status == GATT_SUCCESS) {
+        GATT_TRACE_DEBUG ("Multi var read count=%d num_hdls=%d",
+                         fixed_queue_length(p_cmd->multi_rsp_q),
+                         p_cmd->multi_req.num_handles);
+        /* Wait till we get all the responses */
+        if (fixed_queue_length(p_cmd->multi_rsp_q) == p_cmd->multi_req.num_handles) {
+            len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
+            if ((p_buf = (BT_HDR *)osi_calloc(len)) == NULL) {
+                p_cmd->status = GATT_INSUF_RESOURCE;
+                return (TRUE);
+            }
+
+            p_buf->offset = L2CAP_MIN_OFFSET;
+            p = (UINT8 *)(p_buf + 1) + p_buf->offset;
+
+            /* First byte in the response is the opcode */
+            *p++ = GATT_RSP_READ_MULTI_VAR;
+            p_buf->len = 1;
+
+            /* Now walk through the buffers puting the data into the response in order */
+            list_t *list = NULL;
+            const list_node_t *node = NULL;
+            if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
+                list = fixed_queue_get_list(p_cmd->multi_rsp_q);
+			}
+            for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
+                tGATTS_RSP *p_rsp = NULL;
+                if (list != NULL) {
+                    if (ii == 0) {
+                        node = list_begin(list);
+                    } else {
+                        node = list_next(node);
+					}
+                    if (node != list_end(list)) {
+                        p_rsp = (tGATTS_RSP *)list_node(node);
+					}
+                }
+
+                if (p_rsp != NULL) {
+
+                    total_len = (p_buf->len + 2);  // value length
+
+                    if (total_len > mtu) {
+                        GATT_TRACE_DEBUG ("multi read variable overflow available len=%d val_len=%d", len, p_rsp->attr_value.len );
+                        break;
+                    }
+                    len = MIN(p_rsp->attr_value.len, (mtu - total_len));  // attribute value length
+
+                    if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
+                        GATT_TRACE_DEBUG("%s handle %x len %u", __func__, p_rsp->attr_value.handle, p_rsp->attr_value.len);
+                        UINT16_TO_STREAM(p, p_rsp->attr_value.len);
+                        memcpy (p, p_rsp->attr_value.value, len);
+                        p += len;
+                        p_buf->len += (2+len);
+                    } else {
+                        p_cmd->status = GATT_NOT_FOUND;
+                        break;
+                    }
+                } else {
+                    p_cmd->status = GATT_NOT_FOUND;
+                    break;
+                }
+
+            } /* loop through all handles*/
+
+            /* Sanity check on the buffer length */
+            if (p_buf->len == 0) {
+                GATT_TRACE_ERROR("%s - nothing found!!", __func__);
+                p_cmd->status = GATT_NOT_FOUND;
+                osi_free (p_buf);
+            } else if (p_cmd->p_rsp_msg != NULL) {
+                osi_free (p_buf);
+            } else {
+                p_cmd->p_rsp_msg = p_buf;
+            }
+
+            return (TRUE);
+        }
+    } else { /* any handle read exception occurs, return error */
+        return (TRUE);
+    }
+
+    /* If here, still waiting */
+    return (FALSE);
+}
+
 /*******************************************************************************
 **
 ** Function         gatt_sr_process_app_rsp
@@ -303,6 +414,10 @@ tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if,
         if (!process_read_multi_rsp (&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) {
             return (GATT_SUCCESS);
         }
+    } else if (op_code == GATT_REQ_READ_MULTI_VAR) {
+        if (!process_read_multi_var_rsp(&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) {
+            return (GATT_SUCCESS);
+        }
     } else {
         if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS) {
             gatt_sr_update_prep_cnt(p_tcb, gatt_if, TRUE, FALSE);
@@ -514,7 +629,7 @@ void gatt_process_read_multi_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
                        sec_flag,
                        key_size))
                     != GATT_SUCCESS) {
-                GATT_TRACE_DEBUG("read permission denied : 0x%02x", err);
+                GATT_TRACE_ERROR("read permission denied : 0x%02x", err);
                 break;
             }
         } else {
@@ -525,13 +640,15 @@ void gatt_process_read_multi_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
         ll -= 2;
     }
 
-    if (ll != 0) {
-        GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request.");
-        err = GATT_INVALID_HANDLE;
-    }
+    if (err == GATT_SUCCESS) {
+        if (ll != 0) {
+            GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request.");
+            err = GATT_INVALID_HANDLE;
+        }
 
-    if (p_tcb->sr_cmd.multi_req.num_handles == 0) {
-        err = GATT_INVALID_HANDLE;
+        if (p_tcb->sr_cmd.multi_req.num_handles == 0) {
+            err = GATT_INVALID_HANDLE;
+        }
     }
 
     if (err == GATT_SUCCESS) {
@@ -1563,6 +1680,9 @@ static BOOLEAN gatts_proc_ind_ack(tGATT_TCB *p_tcb, UINT16 ack_handle)
         gatts_proc_srv_chg_ind_ack(p_tcb);
         /* there is no need to inform the application since srv chg is handled internally by GATT */
         continue_processing = FALSE;
+
+        /* after receiving ack of svc_chg_ind, reset client status */
+        gatt_sr_update_cl_status(p_tcb, true);
     }
 
     gatts_chk_pending_ind(p_tcb);
@@ -1609,6 +1729,85 @@ void gatts_process_value_conf(tGATT_TCB *p_tcb, UINT8 op_code)
     }
 }
 
+static BOOLEAN gatts_handle_db_out_of_sync(tGATT_TCB *p_tcb, UINT8 op_code,
+                                    UINT16 len, UINT8 *p_data)
+{
+    if (gatt_sr_is_cl_change_aware(p_tcb)) {
+        return false;
+    }
+
+    bool should_ignore = true;
+    bool should_rsp = true;
+
+    switch (op_code) {
+        case GATT_REQ_READ_BY_TYPE:
+        {
+            tBT_UUID uuid;
+            UINT16 s_hdl = 0;
+            UINT16 e_hdl = 0;
+            UINT16 db_hash_handle = gatt_cb.handle_of_database_hash;
+            tGATT_STATUS reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
+            if (reason == GATT_SUCCESS &&
+                    (s_hdl <= db_hash_handle && db_hash_handle <= e_hdl) &&
+                    (uuid.uu.uuid16 == GATT_UUID_GATT_DATABASE_HASH)) {
+                should_ignore = false;
+            }
+            break;
+        }
+        case GATT_REQ_READ:
+        // for pts don't process read request
+        #if 0
+        {
+            UINT16 handle = 0;
+            UINT8 *p = p_data;
+            tGATT_STATUS status = GATT_SUCCESS;
+
+            if (len < 2) {
+                status = GATT_INVALID_PDU;
+            } else {
+                STREAM_TO_UINT16(handle, p);
+                len -= 2;
+            }
+
+            if (status == GATT_SUCCESS && handle == gatt_cb.handle_of_database_hash) {
+                should_ignore = false;
+            }
+            break;
+        }
+        #endif
+        case GATT_REQ_READ_BY_GRP_TYPE:
+        case GATT_REQ_FIND_TYPE_VALUE:
+        case GATT_REQ_FIND_INFO:
+        case GATT_REQ_READ_BLOB:
+        case GATT_REQ_READ_MULTI:
+        case GATT_REQ_READ_MULTI_VAR:
+        case GATT_REQ_WRITE:
+        case GATT_REQ_PREPARE_WRITE:
+            break;
+        case GATT_CMD_WRITE:
+        case GATT_SIGN_CMD_WRITE:
+            should_rsp = false;
+            break;
+        case GATT_REQ_MTU:
+        case GATT_REQ_EXEC_WRITE:
+        case GATT_HANDLE_VALUE_CONF:
+        default:
+            should_ignore = false;
+            break;
+    }
+
+    if (should_ignore) {
+        if (should_rsp) {
+            gatt_send_error_rsp(p_tcb, GATT_DATABASE_OUT_OF_SYNC, op_code, 0x0000, false);
+        }
+
+        GATT_TRACE_ERROR("database out of sync op_code %x, should_rsp %d", op_code, should_rsp);
+        gatt_sr_update_cl_status(p_tcb, should_rsp);
+    }
+
+    return should_ignore;
+}
+
 /*******************************************************************************
 **
 ** Function         gatt_server_handle_client_req
@@ -1640,6 +1839,11 @@ void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code,
         }
         /* otherwise, ignore the pkt */
     } else {
+        // handle database out of sync
+        if (gatts_handle_db_out_of_sync(p_tcb, op_code, len, p_data)) {
+            return;
+        }
+
         switch (op_code) {
         case GATT_REQ_READ_BY_GRP_TYPE:         /* discover primary services */
         case GATT_REQ_FIND_TYPE_VALUE:          /* discover service by UUID */
@@ -1678,6 +1882,7 @@ void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code,
             break;
 
         case GATT_REQ_READ_MULTI:
+        case GATT_REQ_READ_MULTI_VAR:
             gatt_process_read_multi_req (p_tcb, op_code, len, p_data);
             break;
 

components/bt/host/bluedroid/stack/gatt/gatt_sr_hash.c

@@ -0,0 +1,256 @@
+#include "common/bt_target.h"
+#include "osi/allocator.h"
+
+#include <string.h>
+#include "gatt_int.h"
+#include "stack/l2c_api.h"
+#include "l2c_int.h"
+#include "smp_int.h"
+
+#if (BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE)
+
+const char *const gatt_attr_name[] = {
+    "primary service",
+    "secondary service",
+    "included service",
+    "characteristic",
+};
+
+const char *const gatt_char_desc_name[] = {
+    "characteristic extended properties",
+    "characteristic user description",
+    "client characteristic configuration",
+    "server characteristic configuration",
+    "characteristic presentation format",
+    "characteristic aggregate format",
+};
+
+static const char *gatt_get_attr_name(UINT16 uuid)
+{
+    if (uuid >= GATT_UUID_PRI_SERVICE && uuid <= GATT_UUID_CHAR_DECLARE) {
+        return gatt_attr_name[uuid - GATT_UUID_PRI_SERVICE];
+    }
+
+    if (uuid >= GATT_UUID_CHAR_EXT_PROP && uuid <= GATT_UUID_CHAR_AGG_FORMAT) {
+        return gatt_char_desc_name[uuid - GATT_UUID_CHAR_EXT_PROP];
+    }
+
+    return "Unknown Attribute";
+}
+
+static void attr_uuid_to_bt_uuid(void *p_attr, tBT_UUID *p_uuid)
+{
+    tGATT_ATTR16 *p_attr16 = (tGATT_ATTR16 *)p_attr;
+
+    if (p_attr16->uuid_type == GATT_ATTR_UUID_TYPE_16) {
+        p_uuid->len = LEN_UUID_16;
+        p_uuid->uu.uuid16 = p_attr16->uuid;
+    } else if (p_attr16->uuid_type == GATT_ATTR_UUID_TYPE_32) {
+        tGATT_ATTR32 *p_attr32 = (tGATT_ATTR32 *)p_attr;
+        p_uuid->len = LEN_UUID_32;
+        p_uuid->uu.uuid32 = p_attr32->uuid;
+    } else if (p_attr16->uuid_type == GATT_ATTR_UUID_TYPE_128) {
+        tGATT_ATTR128 *p_attr128 = (tGATT_ATTR128 *)p_attr;
+        p_uuid->len = LEN_UUID_128;
+        memcpy(p_uuid->uu.uuid128, p_attr128->uuid, LEN_UUID_128);
+    }
+}
+
+static size_t calculate_database_info_size(void)
+{
+    UINT8 i;
+    tGATT_SVC_DB *p_db;
+    tGATT_ATTR16 *p_attr;
+    size_t len = 0;
+
+    for (i = 0; i < GATT_MAX_SR_PROFILES; i++) {
+        p_db = gatt_cb.sr_reg[i].p_db;
+        if (p_db && p_db->p_attr_list) {
+            p_attr = (tGATT_ATTR16 *)p_db->p_attr_list;
+            while (p_attr) {
+                if (p_attr->uuid == GATT_UUID_PRI_SERVICE ||
+                    p_attr->uuid == GATT_UUID_SEC_SERVICE) {
+                    // Service declaration
+                    len += 4 + p_attr->p_value->uuid.len;
+                } else if (p_attr->uuid == GATT_UUID_INCLUDE_SERVICE) {
+                    // Included service declaration
+                    len += 8 + p_attr->p_value->incl_handle.service_type.len;
+                } else if (p_attr->uuid == GATT_UUID_CHAR_DECLARE) {
+                    tBT_UUID char_uuid;
+                    // Characteristic declaration
+                    p_attr = (tGATT_ATTR16 *)p_attr->p_next;
+                    attr_uuid_to_bt_uuid((void *)p_attr, &char_uuid);
+                    // Increment 1 to fetch characteristic uuid from value declaration attribute
+                    len += 7 + char_uuid.len;
+                } else if (p_attr->uuid == GATT_UUID_CHAR_DESCRIPTION ||
+                    p_attr->uuid == GATT_UUID_CHAR_CLIENT_CONFIG ||
+                    p_attr->uuid == GATT_UUID_CHAR_SRVR_CONFIG ||
+                    p_attr->uuid == GATT_UUID_CHAR_PRESENT_FORMAT ||
+                    p_attr->uuid == GATT_UUID_CHAR_AGG_FORMAT) {
+                    // Descriptor
+                    len += 4;
+                } else if (p_attr->uuid == GATT_UUID_CHAR_EXT_PROP) {
+                    // Descriptor
+                    len += 6;
+                }
+                p_attr = (tGATT_ATTR16 *) p_attr->p_next;
+            }
+        }
+    }
+
+    return len;
+}
+
+static void fill_database_info(UINT8 *p_data)
+{
+    UINT8 i;
+    tGATT_SVC_DB *p_db;
+    tGATT_ATTR16 *p_attr;
+
+    for (i = 0; i < GATT_MAX_SR_PROFILES; i++) {
+        p_db = gatt_cb.sr_reg[i].p_db;
+        if (p_db && p_db->p_attr_list) {
+            p_attr = (tGATT_ATTR16 *)p_db->p_attr_list;
+            while (p_attr) {
+                if (p_attr->uuid == GATT_UUID_PRI_SERVICE ||
+                    p_attr->uuid == GATT_UUID_SEC_SERVICE) {
+                    // Service declaration
+                    UINT16_TO_STREAM(p_data, p_attr->handle);
+                    UINT16_TO_STREAM(p_data, p_attr->uuid);
+                    gatt_build_uuid_to_stream(&p_data, p_attr->p_value->uuid);
+                } else if (p_attr->uuid == GATT_UUID_INCLUDE_SERVICE) {
+                    // Included service declaration
+                    UINT16_TO_STREAM(p_data, p_attr->handle);
+                    UINT16_TO_STREAM(p_data, GATT_UUID_INCLUDE_SERVICE);
+                    UINT16_TO_STREAM(p_data, p_attr->p_value->incl_handle.s_handle);
+                    UINT16_TO_STREAM(p_data, p_attr->p_value->incl_handle.e_handle);
+                    gatt_build_uuid_to_stream(&p_data, p_attr->p_value->incl_handle.service_type);
+                } else if (p_attr->uuid == GATT_UUID_CHAR_DECLARE) {
+                    tBT_UUID char_uuid;
+                    // Characteristic declaration
+                    UINT16_TO_STREAM(p_data, p_attr->handle);
+                    UINT16_TO_STREAM(p_data, GATT_UUID_CHAR_DECLARE);
+                    UINT8_TO_STREAM(p_data, p_attr->p_value->char_decl.property);
+                    UINT16_TO_STREAM(p_data, p_attr->p_value->char_decl.char_val_handle);
+                    p_attr = (tGATT_ATTR16 *)p_attr->p_next;
+                    attr_uuid_to_bt_uuid((void *)p_attr, &char_uuid);
+                    // Increment 1 to fetch characteristic uuid from value declaration attribute
+                    gatt_build_uuid_to_stream(&p_data, char_uuid);
+                } else if (p_attr->uuid == GATT_UUID_CHAR_DESCRIPTION ||
+                    p_attr->uuid == GATT_UUID_CHAR_CLIENT_CONFIG ||
+                    p_attr->uuid == GATT_UUID_CHAR_SRVR_CONFIG ||
+                    p_attr->uuid == GATT_UUID_CHAR_PRESENT_FORMAT ||
+                    p_attr->uuid == GATT_UUID_CHAR_AGG_FORMAT) {
+                    // Descriptor
+                    UINT16_TO_STREAM(p_data, p_attr->handle);
+                    UINT16_TO_STREAM(p_data, p_attr->uuid);
+                } else if (p_attr->uuid == GATT_UUID_CHAR_EXT_PROP) {
+                    // Descriptor
+                    UINT16_TO_STREAM(p_data, p_attr->handle);
+                    UINT16_TO_STREAM(p_data, p_attr->uuid);
+                    // TODO: process extended properties descriptor
+                    if (p_attr->p_value->attr_val.attr_len == 2) {
+                        memcpy(p_data, p_attr->p_value->attr_val.attr_val, 2);
+                    } else {
+                        UINT16_TO_STREAM(p_data, 0x0000);
+                    }
+                }
+                p_attr = (tGATT_ATTR16 *) p_attr->p_next;
+            }
+        }
+    }
+}
+
+tGATT_STATUS gatts_calculate_datebase_hash(BT_OCTET16 hash)
+{
+    UINT8 tmp;
+    UINT16 i;
+    UINT16 j;
+    size_t len;
+    UINT8 *data_buf = NULL;
+
+    len = calculate_database_info_size();
+
+    data_buf = (UINT8 *)osi_malloc(len);
+    if (data_buf == NULL) {
+        GATT_TRACE_ERROR ("%s failed to allocate buffer (%u)\n", __func__, len);
+        return GATT_NO_RESOURCES;
+    }
+
+    fill_database_info(data_buf);
+
+    // reverse database info
+    for (i = 0, j = len-1; i < j; i++, j--) {
+        tmp = data_buf[i];
+        data_buf[i] = data_buf[j];
+        data_buf[j] = tmp;
+    }
+
+#if SMP_INCLUDED == TRUE
+    BT_OCTET16 key = {0};
+    aes_cipher_msg_auth_code(key, data_buf, len, 16, hash);
+    //ESP_LOG_BUFFER_HEX("db hash", hash, BT_OCTET16_LEN);
+#endif
+
+    osi_free(data_buf);
+    return GATT_SUCCESS;
+}
+
+void gatts_show_local_database(void)
+{
+    UINT8 i;
+    tGATT_SVC_DB *p_db;
+    tGATT_ATTR16 *p_attr;
+
+    printf("\n================= GATTS DATABASE DUMP START =================\n");
+    for (i = 0; i < GATT_MAX_SR_PROFILES; i++) {
+        p_db = gatt_cb.sr_reg[i].p_db;
+        if (p_db && p_db->p_attr_list) {
+            p_attr = (tGATT_ATTR16 *)p_db->p_attr_list;
+            while (p_attr) {
+                switch (p_attr->uuid) {
+                case GATT_UUID_PRI_SERVICE:
+                case GATT_UUID_SEC_SERVICE:
+                    // Service declaration
+                    printf("%s\n", gatt_get_attr_name(p_attr->uuid));
+                    printf("\tuuid %s\n", gatt_uuid_to_str(&p_attr->p_value->uuid));
+                    printf("\thandle %d\n", p_attr->handle);
+                    printf("\tend_handle %d\n",p_db->end_handle-1);
+                    break;
+                case GATT_UUID_INCLUDE_SERVICE:
+                    // Included service declaration
+                    printf("%s\n", gatt_get_attr_name(p_attr->uuid));
+                    printf("\tuuid %s\t", gatt_uuid_to_str(&p_attr->p_value->incl_handle.service_type));
+                    printf("\thandle %d\n", p_attr->p_value->incl_handle.s_handle);
+                    printf("\tend_handle %d\n", p_attr->p_value->incl_handle.e_handle);
+                    break;
+                case GATT_UUID_CHAR_DECLARE: {
+                    tBT_UUID char_uuid;
+                    tGATT_ATTR16 *p_char_val;
+                    p_char_val = (tGATT_ATTR16 *)p_attr->p_next;
+                    attr_uuid_to_bt_uuid((void *)p_char_val, &char_uuid);
+
+                    printf("%s\n", gatt_get_attr_name(p_attr->uuid));
+                    printf("\tuuid %s\n", gatt_uuid_to_str(&char_uuid));
+                    printf("\tdef_handle %d\n", p_attr->handle);
+                    printf("\tval_handle %d\n", p_attr->p_value->char_decl.char_val_handle);
+                    printf("\tperm 0x%04x, prop 0x%02x\n", p_char_val->permission, p_attr->p_value->char_decl.property);
+                    break;
+                }
+                case GATT_UUID_CHAR_EXT_PROP:
+                case GATT_UUID_CHAR_DESCRIPTION:
+                case GATT_UUID_CHAR_CLIENT_CONFIG:
+                case GATT_UUID_CHAR_SRVR_CONFIG:
+                case GATT_UUID_CHAR_PRESENT_FORMAT:
+                case GATT_UUID_CHAR_AGG_FORMAT:
+                    printf("%s\n", gatt_get_attr_name(p_attr->uuid));
+                    printf("\thandle %d\n", p_attr->handle);
+                    break;
+                }
+                p_attr = (tGATT_ATTR16 *) p_attr->p_next;
+            }
+        }
+    }
+    printf("================= GATTS DATABASE DUMP END =================\n");
+}
+#endif  /* BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */

components/bt/host/bluedroid/stack/gatt/gatt_utils.c

@@ -1090,6 +1090,9 @@ tGATT_TCB *gatt_allocate_tcb_by_bdaddr(BD_ADDR bda, tBT_TRANSPORT transport)
             p_tcb->transport = transport;
         }
         memcpy(p_tcb->peer_bda, bda, BD_ADDR_LEN);
+#if (GATTS_INCLUDED == TRUE)
+        gatt_sr_init_cl_status(p_tcb);
+#endif  ///GATTS_INCLUDED == TRUE
     }
     return p_tcb;
 }
@@ -2910,4 +2913,36 @@ BOOLEAN gatt_update_listen_mode(void)
     return rt;
 
 }
+
+char *gatt_uuid_to_str(const tBT_UUID *uuid)
+{
+    static char dst[48] = {0};
+    const UINT8 *u8p;
+
+    memset(dst, 0, sizeof(dst));
+
+    switch (uuid->len) {
+    case LEN_UUID_16:
+        sprintf(dst, "0x%04x", uuid->uu.uuid16);
+        break;
+    case LEN_UUID_32:
+        sprintf(dst, "0x%08x", uuid->uu.uuid32);
+        break;
+    case LEN_UUID_128:
+        u8p = uuid->uu.uuid128;
+
+        sprintf(dst, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
+                     "%02x%02x%02x%02x%02x%02x",
+                u8p[15], u8p[14], u8p[13], u8p[12],
+                u8p[11], u8p[10],  u8p[9],  u8p[8],
+                 u8p[7],  u8p[6],  u8p[5],  u8p[4],
+                 u8p[3],  u8p[2],  u8p[1],  u8p[0]);
+        break;
+    default:
+        dst[0] = '\0';
+        break;
+    }
+
+    return dst;
+}
 #endif

components/bt/host/bluedroid/stack/gatt/include/gatt_int.h

@@ -405,6 +405,13 @@ typedef struct {
     UINT8           pending_cl_req;
     UINT8           next_slot_inq;    /* index of next available slot in queue */
 
+    /* client supported feature */
+    UINT8           cl_supp_feat;
+    /* server supported feature */
+    UINT8           sr_supp_feat;
+    /* if false, should handle database out of sync */
+    BOOLEAN         is_robust_cache_change_aware;
+
     BOOLEAN         in_use;
     UINT8           tcb_idx;
     tGATT_PREPARE_WRITE_RECORD prepare_write_record;    /* prepare write packets record */
@@ -532,6 +539,12 @@ typedef struct {
     tGATT_PROFILE_CLCB  profile_clcb[GATT_MAX_APPS];
 #endif  ///GATTS_INCLUDED == TRUE
     UINT16              handle_of_h_r;          /* Handle of the handles reused characteristic value */
+    UINT16              handle_of_database_hash;
+    UINT16              handle_of_cl_supported_feat;
+    UINT16              handle_of_sr_supported_feat;
+    BT_OCTET16          database_hash;
+    UINT8               gatt_sr_supported_feat_mask;
+    UINT8               gatt_cl_supported_feat_mask;
 
     tGATT_APPL_INFO       cb_info;
 
@@ -540,6 +553,9 @@ typedef struct {
     tGATT_HDL_CFG           hdl_cfg;
     tGATT_BG_CONN_DEV       bgconn_dev[GATT_MAX_BG_CONN_DEV];
 
+    BOOLEAN             auto_disc;      /* internal use: true for auto discovering after connected */
+    UINT8               srv_chg_mode;   /* internal use: service change mode */
+    tGATTS_RSP          rsp;            /* use to read internal service attribute */
 } tGATT_CB;
 
 typedef struct{
@@ -609,6 +625,7 @@ extern BOOLEAN gatt_parse_uuid_from_cmd(tBT_UUID *p_uuid, UINT16 len, UINT8 **p_
 extern UINT8 gatt_build_uuid_to_stream(UINT8 **p_dst, tBT_UUID uuid);
 extern BOOLEAN gatt_uuid_compare(tBT_UUID src, tBT_UUID tar);
 extern void gatt_convert_uuid32_to_uuid128(UINT8 uuid_128[LEN_UUID_128], UINT32 uuid_32);
+extern char *gatt_uuid_to_str(const tBT_UUID *uuid);
 extern void gatt_sr_get_sec_info(BD_ADDR rem_bda, tBT_TRANSPORT transport, UINT8 *p_sec_flag, UINT8 *p_key_size);
 extern void gatt_start_rsp_timer(UINT16 clcb_idx);
 extern void gatt_start_conf_timer(tGATT_TCB    *p_tcb);
@@ -759,4 +776,11 @@ extern BOOLEAN gatt_check_connection_state_by_tcb(tGATT_TCB *p_tcb);
 extern void gatt_reset_bgdev_list(void);
 extern uint16_t gatt_get_local_mtu(void);
 extern void gatt_set_local_mtu(uint16_t mtu);
+
+extern tGATT_STATUS gatts_calculate_datebase_hash(BT_OCTET16 hash);
+extern void gatts_show_local_database(void);
+
+extern BOOLEAN gatt_sr_is_cl_change_aware(tGATT_TCB *p_tcb);
+extern void gatt_sr_init_cl_status(tGATT_TCB *p_tcb);
+extern void gatt_sr_update_cl_status(tGATT_TCB *tcb, BOOLEAN chg_aware);
 #endif

components/bt/host/bluedroid/stack/hcic/hciblecmds.c

@@ -1273,17 +1273,16 @@ UINT8 btsnd_hcic_ble_set_ext_adv_data(UINT8 adv_handle,
     UINT8_TO_STREAM(pp, operation);
     UINT8_TO_STREAM(pp, fragment_prefrence);
 
-    if (p_data != NULL && data_len > 0) {
-        if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) {
-            data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA;
-        }
-
-        UINT8_TO_STREAM (pp, data_len);
-
-        ARRAY_TO_STREAM (pp, p_data, data_len);
-    } else {
-        return FALSE;
+    if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) {
+        data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA;
     }
+
+    UINT8_TO_STREAM (pp, data_len);
+
+    if (p_data != NULL && data_len > 0){
+        ARRAY_TO_STREAM (pp, p_data, data_len);
+    }
+
     uint8_t status = btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p);
     return status;
 
@@ -1309,16 +1308,13 @@ UINT8 btsnd_hcic_ble_set_ext_adv_scan_rsp_data(UINT8 adv_handle,
 
     memset(pp, 0, data_len);
 
+    if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) {
+        data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA;
+    }
+
+    UINT8_TO_STREAM (pp, data_len);
     if (p_data != NULL && data_len > 0) {
-        if (data_len > HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA) {
-            data_len = HCIC_PARAM_SIZE_EXT_ADV_WRITE_DATA;
-        }
-
-        UINT8_TO_STREAM (pp, data_len);
-
         ARRAY_TO_STREAM (pp, p_data, data_len);
-    } else {
-        return FALSE;
     }
 
     return btu_hcif_send_cmd_sync (LOCAL_BR_EDR_CONTROLLER_ID, p);
@@ -1455,16 +1451,14 @@ UINT8 btsnd_hcic_ble_set_periodic_adv_data(UINT8 adv_handle,
 
     //memset(pp, 0, len);
 
+    if (len > HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA) {
+        len = HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA;
+    }
+
+    UINT8_TO_STREAM (pp, len);
+
     if (p_data != NULL && len > 0) {
-        if (len > HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA) {
-            len = HCIC_PARAM_SIZE_WRITE_PERIODIC_ADV_DATA;
-        }
-
-        UINT8_TO_STREAM (pp, len);
-
         ARRAY_TO_STREAM (pp, p_data, len);
-    } else {
-        return FALSE;
     }
 
     return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p);
@@ -1782,4 +1776,112 @@ UINT8 btsnd_hcic_ble_write_rf_path_compensation(UINT16 rf_tx_path, UINT16 rf_rx_
     return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p);
 }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+UINT8 btsnd_hcic_ble_set_periodic_adv_recv_enable(UINT16 sync_handle, UINT8 enable)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_RECV_ENABLE);
+
+    pp = (UINT8 *)(p + 1);
+
+    UINT16_TO_STREAM(pp, HCI_BLE_SET_PERIOD_ADV_RECV_ENABLE);
+    UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_PERIODIC_ADV_RECV_ENABLE);
+
+    UINT16_TO_STREAM(pp, sync_handle);
+    UINT8_TO_STREAM(pp, enable);
+
+    return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p);
+}
+
+BOOLEAN btsnd_hcic_ble_periodic_adv_sync_trans(UINT16 conn_handle, UINT16 service_data, UINT16 sync_handle)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_SYNC_TRANS);
+
+    pp = (UINT8 *)(p + 1);
+
+    UINT16_TO_STREAM(pp, HCI_BLE_PERIOD_ADV_SYNC_TRANS);
+    UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_PERIODIC_ADV_SYNC_TRANS);
+
+    UINT16_TO_STREAM(pp, conn_handle);
+    UINT16_TO_STREAM(pp, service_data);
+    UINT16_TO_STREAM(pp, sync_handle);
+
+    btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
+    return TRUE;
+}
+
+BOOLEAN btsnd_hcic_ble_periodic_adv_set_info_trans(UINT16 conn_handle, UINT16 service_data, UINT8 adv_handle)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    HCI_TRACE_DEBUG("%s conn handle %x, adv handle %x", __func__, conn_handle, adv_handle);
+
+    HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_PERIODIC_ADV_SET_INFO_TRANS);
+
+    pp = (UINT8 *)(p + 1);
+
+    UINT16_TO_STREAM(pp, HCI_BLE_PERIOD_ADV_SET_INFO_TRANS);
+    UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_PERIODIC_ADV_SET_INFO_TRANS);
+
+    UINT16_TO_STREAM(pp, conn_handle);
+    UINT16_TO_STREAM(pp, service_data);
+    UINT8_TO_STREAM(pp, adv_handle);
+
+    btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
+    return TRUE;
+}
+
+BOOLEAN btsnd_hcic_ble_set_periodic_adv_sync_trans_params(UINT16 conn_handle, UINT8 mode, UINT16 skip, UINT16 sync_timeout, UINT8 cte_type)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    HCI_TRACE_DEBUG("%s conn handle %x, mode %x, sync timeout %x", __func__, conn_handle, mode, sync_timeout);
+
+    HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_PAST_PARAMS);
+
+    pp = (UINT8 *)(p + 1);
+
+    UINT16_TO_STREAM(pp, HCI_BLE_SET_PAST_PARAMS);
+    UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_SET_PAST_PARAMS);
+
+    UINT16_TO_STREAM(pp, conn_handle);
+    UINT8_TO_STREAM(pp, mode);
+    UINT16_TO_STREAM(pp, skip);
+    UINT16_TO_STREAM(pp, sync_timeout);
+    UINT8_TO_STREAM(pp, cte_type);
+
+    btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
+    return TRUE;
+}
+
+UINT8 btsnd_hcic_ble_set_default_periodic_adv_sync_trans_params(UINT8 mode, UINT16 skip, UINT16 sync_timeout, UINT8 cte_type)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    HCI_TRACE_DEBUG("%s mode %x, skip %x, sync timeout %x", __func__, mode, skip, sync_timeout);
+
+    HCIC_BLE_CMD_CREATED(p, pp, HCIC_PARAM_SIZE_SET_DEFAULT_PAST_PARAMS);
+
+    pp = (UINT8 *)(p + 1);
+
+    UINT16_TO_STREAM(pp, HCI_BLE_SET_DEFAULT_PAST_PARAMS);
+    UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_SET_DEFAULT_PAST_PARAMS);
+
+    UINT8_TO_STREAM(pp, mode);
+    UINT16_TO_STREAM(pp, skip);
+    UINT16_TO_STREAM(pp, sync_timeout);
+    UINT8_TO_STREAM(pp, cte_type);
+
+    return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p);
+}
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 #endif

components/bt/host/bluedroid/stack/include/stack/btm_api.h

@@ -1766,6 +1766,7 @@ typedef union {
 #if BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE
     tBTM_LE_COMPLT      complt;     /* BTM_LE_COMPLT_EVT      */
     tSMP_OOB_DATA_TYPE  req_oob_type;
+    tSMP_LOC_OOB_DATA   local_oob_data;
 #endif
     tBTM_LE_KEY         key;
 } tBTM_LE_EVT_DATA;

components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h

@@ -105,8 +105,12 @@ typedef UINT8   tBTM_BLE_SFP;
 #endif
 
 /* adv parameter boundary values */
-#define BTM_BLE_ADV_INT_MIN            0x0020
-#define BTM_BLE_ADV_INT_MAX            0x4000
+#if BLE_HIGH_DUTY_ADV_INTERVAL
+#define BTM_BLE_ADV_INT_MIN            0x0008  /* 5ms */
+#else
+#define BTM_BLE_ADV_INT_MIN            0x0020  /* 20ms */
+#endif
+#define BTM_BLE_ADV_INT_MAX            0x4000  /* 10240ms */
 
 /* Full scan boundary values */
 #define BTM_BLE_ADV_SCAN_FULL_MIN      0x00
@@ -1031,7 +1035,14 @@ typedef void (tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTM_STATUS st
 #define    BTM_BLE_5_GAP_PERIODIC_ADV_REPORT_EVT                   32
 #define    BTM_BLE_5_GAP_PERIODIC_ADV_SYNC_LOST_EVT                33
 #define    BTM_BLE_5_GAP_PERIODIC_ADV_SYNC_ESTAB_EVT               34
-#define    BTM_BLE_5_GAP_UNKNOWN_EVT                               35
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define    BTM_BLE_GAP_PERIODIC_ADV_RECV_ENABLE_COMPLETE_EVT       35
+#define    BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_COMPLETE_EVT        36
+#define    BTM_BLE_GAP_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT    37
+#define    BTM_BLE_GAP_SET_PAST_PARAMS_COMPLETE_EVT                38
+#define    BTM_BLE_GAP_PERIODIC_ADV_SYNC_TRANS_RECV_EVT            39
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define    BTM_BLE_5_GAP_UNKNOWN_EVT                               40
 typedef UINT8 tBTM_BLE_5_GAP_EVENT;
 
 #define BTM_BLE_EXT_ADV_DATA_COMPLETE          0x00
@@ -1241,6 +1252,39 @@ typedef struct {
     UINT16 max_ce_len;
 } tBTM_BLE_CONN_PARAMS;
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+typedef struct {
+    UINT8 status;
+} tBTM_BLE_PERIOD_ADV_RECV_ENABLE_CMPL;
+
+typedef struct {
+    UINT8 status;
+    BD_ADDR addr;
+} tBTM_BLE_PERIOD_ADV_SYNC_TRANS_CMPL;
+
+typedef struct {
+    UINT8 status;
+    BD_ADDR addr;
+} tBTM_BLE_PERIOD_ADV_SET_INFO_TRANS_CMPL;
+
+typedef struct {
+    UINT8 status;
+    BD_ADDR addr;
+} tBTM_BLE_SET_PERIOD_ADV_SYNC_TRANS_PARAMS_CMPL;
+
+typedef struct {
+    UINT8 status;
+    BD_ADDR addr;
+    UINT16 service_data;
+    UINT16 sync_handle;
+    UINT8 adv_sid;
+    UINT8 adv_addr_type;
+    BD_ADDR adv_addr;
+    UINT8 adv_phy;
+    UINT16 adv_interval;
+    UINT8 adv_clk_accuracy;
+} tBTM_BLE_PERIOD_ADV_SYNC_TRANS_RECV;
+#endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 
 typedef union {
     UINT8 status;
@@ -1275,6 +1319,13 @@ typedef union {
     tBTM_PERIOD_ADV_REPORT period_adv_report;
     tBTM_BLE_PERIOD_ADV_SYNC_LOST sync_lost;
     tBTM_BLE_PERIOD_ADV_SYNC_ESTAB sync_estab;
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    tBTM_BLE_PERIOD_ADV_RECV_ENABLE_CMPL per_adv_recv_enable;
+    tBTM_BLE_PERIOD_ADV_SYNC_TRANS_CMPL per_adv_sync_trans;
+    tBTM_BLE_PERIOD_ADV_SET_INFO_TRANS_CMPL per_adv_set_info_trans;
+    tBTM_BLE_SET_PERIOD_ADV_SYNC_TRANS_PARAMS_CMPL set_past_params;
+    tBTM_BLE_PERIOD_ADV_SYNC_TRANS_RECV past_recv;
+#endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 } tBTM_BLE_5_GAP_CB_PARAMS;
 
 typedef struct {
@@ -1809,6 +1860,29 @@ void BTM_BleConfirmReply (BD_ADDR bd_addr, UINT8 res);
 //extern
 void BTM_BleOobDataReply(BD_ADDR bd_addr, UINT8 res, UINT8 len, UINT8 *p_data);
 
+/*******************************************************************************
+**
+** Function         BTM_BleSecureConnectionOobDataReply
+**
+** Description      This function is called to provide the OOB data for
+**                  SMP in response to BTM_LE_SC_OOB_REQ_EVT when secure connection
+**
+** Parameters:      bd_addr     - Address of the peer device
+**                  p_c         - pointer to Confirmation
+**                  p_r         - pointer to Randomizer
+**
+*******************************************************************************/
+void BTM_BleSecureConnectionOobDataReply(BD_ADDR bd_addr, UINT8 *p_c, UINT8 *p_r);
+
+/*******************************************************************************
+**
+** Function         BTM_BleSecureConnectionCreateOobData
+**
+** Description      This function is called to create the OOB data for
+**                  SMP when secure connection
+**
+*******************************************************************************/
+void BTM_BleSecureConnectionCreateOobData(void);
 
 /*******************************************************************************
 **
@@ -2593,9 +2667,9 @@ tBTM_STATUS BTM_BleExtAdvSetClear(void);
 
 tBTM_STATUS BTM_BlePeriodicAdvSetParams(UINT8 instance, tBTM_BLE_Periodic_Adv_Params *params);
 
-tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data);
+tBTM_STATUS BTM_BlePeriodicAdvCfgDataRaw(UINT8 instance, UINT16 len, UINT8 *data, BOOLEAN only_update_did);
 
-tBTM_STATUS BTM_BlePeriodicAdvEnable(UINT8 instance, BOOLEAN enable);
+tBTM_STATUS BTM_BlePeriodicAdvEnable(UINT8 instance, UINT8 enable);
 
 tBTM_STATUS BTM_BlePeriodicAdvCreateSync(tBTM_BLE_Periodic_Sync_Params *params);
 
@@ -2614,7 +2688,16 @@ tBTM_STATUS BTM_BleSetExtendedScanParams(tBTM_BLE_EXT_SCAN_PARAMS *params);
 tBTM_STATUS BTM_BleExtendedScan(BOOLEAN enable, UINT16 duration, UINT16 period);
 
 void BTM_BleSetPreferExtenedConnParams(BD_ADDR bd_addr, tBTM_EXT_CONN_PARAMS *params);
-
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+void BTM_BlePeriodicAdvRecvEnable(UINT16 sync_handle, UINT8 enable);
+
+void BTM_BlePeriodicAdvSyncTrans(BD_ADDR bd_addr, UINT16 service_data, UINT16 sync_handle);
+
+void BTM_BlePeriodicAdvSetInfoTrans(BD_ADDR bd_addr, UINT16 service_data, UINT8 adv_handle);
+
+void BTM_BleSetPeriodicAdvSyncTransParams(BD_ADDR bd_addr, UINT8 mode, UINT16 skip, UINT16 sync_timeout, UINT8 cte_type);
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 #endif

components/bt/host/bluedroid/stack/include/stack/gatt_api.h

@@ -44,6 +44,8 @@
 #define  GATT_INSUF_ENCRYPTION               0x0f
 #define  GATT_UNSUPPORT_GRP_TYPE             0x10
 #define  GATT_INSUF_RESOURCE                 0x11
+#define  GATT_DATABASE_OUT_OF_SYNC           0x12
+#define  GATT_VALUE_NOT_ALLOWED              0x13
 
 
 #define  GATT_NO_RESOURCES                   0x80
@@ -108,8 +110,11 @@ typedef UINT8 tGATT_STATUS;
 #define  GATT_HANDLE_VALUE_NOTIF             0x1B
 #define  GATT_HANDLE_VALUE_IND               0x1D
 #define  GATT_HANDLE_VALUE_CONF              0x1E
+#define  GATT_REQ_READ_MULTI_VAR             0x20
+#define  GATT_RSP_READ_MULTI_VAR             0x21
+#define  GATT_HANDLE_MULTI_VALUE_NOTIF       0x23
 #define  GATT_SIGN_CMD_WRITE                 0xD2 /* changed in V4.0 1101-0010 (signed write)  see write cmd above*/
-#define  GATT_OP_CODE_MAX                    GATT_HANDLE_VALUE_CONF + 1 /* 0x1E = 30 + 1 = 31*/
+#define  GATT_OP_CODE_MAX                    GATT_HANDLE_MULTI_VALUE_NOTIF + 1 /* 0x1E = 30 + 1 = 31*/
 
 #define  GATT_COMMAND_FLAG                   0x40 /* Command Flag: set to one means command */
 
@@ -413,6 +418,7 @@ enum {
     GATT_DISC_SRVC_BY_UUID,     /* discover service of a special type */
     GATT_DISC_INC_SRVC,         /* discover the included service within a service */
     GATT_DISC_CHAR,             /* discover characteristics of a service with/without type requirement */
+    GATT_DISC_CHAR_BY_UUID,     /* discover characteristic with type requirement */
     GATT_DISC_CHAR_DSCPT,       /* discover characteristic descriptors of a character */
     GATT_DISC_MAX               /* maximnun discover type */
 };
@@ -432,6 +438,7 @@ enum {
     GATT_READ_BY_TYPE =        1,
     GATT_READ_BY_HANDLE,
     GATT_READ_MULTIPLE,
+    GATT_READ_MULTIPLE_VAR,
     GATT_READ_CHAR_VALUE,
     GATT_READ_PARTIAL,
     GATT_READ_MAX
@@ -655,6 +662,12 @@ typedef struct {
     tGATTS_NV_SRV_CHG_CBACK    *p_srv_chg_callback;
 } tGATT_APPL_INFO;
 
+typedef struct {
+    UINT16                  handle;
+    UINT16                  length;
+    UINT8                   *value;
+} tGATT_HLV;
+
 /*
 ***********************  End Handle Management Definitions   **********************/
 
@@ -1032,6 +1045,18 @@ extern tGATT_STATUS GATTC_ExecuteWrite (UINT16 conn_id, BOOLEAN is_execute);
 *******************************************************************************/
 extern tGATT_STATUS GATTC_SendHandleValueConfirm (UINT16 conn_id, UINT16 handle);
 
+/*******************************************************************************
+**
+** Function         GATTC_AutoDiscoverEnable
+**
+** Description      This function is called to enable/disable auto discover.
+**
+** Parameters       enable: 0 for disable, otherwise enable.
+**
+** Returns          GATT_SUCCESS if command started successfully.
+**
+*******************************************************************************/
+extern tGATT_STATUS GATTC_AutoDiscoverEnable(UINT8 enable);
 
 /*******************************************************************************
 **
@@ -1226,6 +1251,45 @@ extern BOOLEAN GATT_Listen (tGATT_IF gatt_if, BOOLEAN start, BD_ADDR_PTR bd_addr
 extern void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable,
         tBT_TRANSPORT transport);
 
+/*******************************************************************************
+**
+** Function         GATTS_SetServiceChangeMode
+**
+** Description      Configure service change indication mode
+**
+** Parameters       mode: service change mode
+**
+** Returns          Status.
+**
+*******************************************************************************/
+extern tGATT_STATUS GATTS_SetServiceChangeMode(UINT8 mode);
+
+/*******************************************************************************
+**
+** Function         GATTS_HandleMultiValueNotification
+**
+** Description      This function sends multiple handle value notification to a client.
+**
+** Parameter        conn_id: connection identifier.
+**                  tuples: Pointer to handle-length-value tuple list.
+**                  num_tuples: Number of tuples.
+**
+** Returns          GATT_SUCCESS if successfully sent; otherwise error code.
+**
+*******************************************************************************/
+extern tGATT_STATUS GATTS_HandleMultiValueNotification (UINT16 conn_id, tGATT_HLV *tuples, UINT16 num_tuples);
+
+/*******************************************************************************
+**
+** Function         GATTS_ShowLocalDatabase
+**
+** Description      This function print local service database.
+**
+** Returns          GATT_SUCCESS if successfully sent; otherwise error code.
+**
+*******************************************************************************/
+extern tGATT_STATUS GATTS_ShowLocalDatabase(void);
+
 #ifdef __cplusplus
 
 }

components/bt/host/bluedroid/stack/include/stack/gattdefs.h

@@ -121,4 +121,8 @@
 #define GATT_UUID_SCAN_INT_WINDOW       0x2A4F
 #define GATT_UUID_SCAN_REFRESH          0x2A31
 
+#define GATT_UUID_CLIENT_SUP_FEAT       0x2B29
+#define GATT_UUID_GATT_DATABASE_HASH    0x2B2A
+#define GATT_UUID_SERVER_SUP_FEAT       0x2B3A
+
 #endif

components/bt/host/bluedroid/stack/include/stack/hcidefs.h

@@ -385,6 +385,13 @@
 #define HCI_BLE_WR_RF_PATH_COMPENSATION     (0x004D | HCI_GRP_BLE_CMDS)
 #define HCI_BLE_SET_PRIVACY_MODE            (0x004E | HCI_GRP_BLE_CMDS)
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define HCI_BLE_SET_PERIOD_ADV_RECV_ENABLE  (0x0059 | HCI_GRP_BLE_CMDS)
+#define HCI_BLE_PERIOD_ADV_SYNC_TRANS       (0x005A | HCI_GRP_BLE_CMDS)
+#define HCI_BLE_PERIOD_ADV_SET_INFO_TRANS   (0x005B | HCI_GRP_BLE_CMDS)
+#define HCI_BLE_SET_PAST_PARAMS             (0x005C | HCI_GRP_BLE_CMDS)
+#define HCI_BLE_SET_DEFAULT_PAST_PARAMS     (0x005D | HCI_GRP_BLE_CMDS)
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 // Vendor OGF define
 #define HCI_VENDOR_OGF          0x3F
 
@@ -802,6 +809,9 @@
 #define HCI_BLE_SCAN_REQ_RECEIVED_EVT       0x13
 #define HCI_BLE_CHANNEL_SELECT_ALG          0x14
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define HCI_BLE_PERIOD_ADV_SYNC_TRANS_RECV_EVT 0x18
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 
 /* Definitions for LE Channel Map */
 #define HCI_BLE_CHNL_MAP_SIZE               5
@@ -815,7 +825,6 @@
 **  Defentions for HCI Error Codes that are past in the events
 */
 #define HCI_SUCCESS                                     0x00
-#define HCI_PENDING                                     0x00
 #define HCI_ERR_ILLEGAL_COMMAND                         0x01
 #define HCI_ERR_NO_CONNECTION                           0x02
 #define HCI_ERR_HW_FAILURE                              0x03

components/bt/host/bluedroid/stack/include/stack/hcimsgs.h

@@ -1031,10 +1031,32 @@ UINT8 btsnd_hcic_ble_read_trans_power(void);
 UINT8 btsnd_hcic_ble_read_rf_path_compensation(void);
 
 UINT8 btsnd_hcic_ble_write_rf_path_compensation(UINT16 rf_tx_path, UINT16 rf_rx_path);
+
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
 #define HCIC_PARAM_SIZE_WRITE_AUTHENT_PAYLOAD_TOUT  4
 
 #define HCI__WRITE_AUTHENT_PAYLOAD_TOUT_HANDLE_OFF  0
 #define HCI__WRITE_AUTHENT_PAYLOAD_TOUT_TOUT_OFF    2
 
+#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#define HCIC_PARAM_SIZE_PERIODIC_ADV_RECV_ENABLE                3
+#define HCI_PERIODIC_ADV_RECV_REPORT_EN                         1
+#define HCI_PERIODIC_ADV_RECV_DUP_FILTER_EN                     2
+#define HCIC_PARAM_SIZE_PERIODIC_ADV_SYNC_TRANS                 6
+#define HCIC_PARAM_SIZE_PERIODIC_ADV_SET_INFO_TRANS             5
+#define HCIC_PARAM_SIZE_SET_PAST_PARAMS                         8
+#define HCIC_PARAM_SIZE_SET_DEFAULT_PAST_PARAMS                 6
+
+UINT8 btsnd_hcic_ble_set_periodic_adv_recv_enable(UINT16 sync_handle, UINT8 enable);
+
+BOOLEAN btsnd_hcic_ble_periodic_adv_sync_trans(UINT16 conn_handle, UINT16 service_data, UINT16 sync_handle);
+
+BOOLEAN btsnd_hcic_ble_periodic_adv_set_info_trans(UINT16 conn_handle, UINT16 service_data, UINT8 adv_handle);
+
+BOOLEAN btsnd_hcic_ble_set_periodic_adv_sync_trans_params(UINT16 conn_handle, UINT8 mode, UINT16 skip, UINT16 sync_timeout, UINT8 cte_type);
+
+UINT8 btsnd_hcic_ble_set_default_periodic_adv_sync_trans_params(UINT8 mode, UINT16 skip, UINT16 sync_timeout, UINT8 cte_type);
+#endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
 #endif

components/bt/host/bluedroid/stack/include/stack/l2c_api.h

@@ -1214,6 +1214,19 @@ extern BOOLEAN L2CA_EnableUpdateBleConnParams (BD_ADDR rem_bda, BOOLEAN enable);
 **
 *******************************************************************************/
 extern UINT8 L2CA_GetBleConnRole (BD_ADDR bd_addr);
+
+/*******************************************************************************
+**
+** Function         L2CA_BleDisconnect
+**
+** Description      This function use to disconnect LE connection.
+**
+** Parameters       BD Address of remote
+**
+** Returns          TRUE if disconnect successfully.
+**
+*******************************************************************************/
+extern BOOLEAN L2CA_BleDisconnect (BD_ADDR rem_bda);
 #endif /* (BLE_INCLUDED == TRUE) */
 
 /*******************************************************************************
@@ -1239,6 +1252,7 @@ extern BOOLEAN L2CA_CheckIsCongest(UINT16 fixed_cid, BD_ADDR addr);
 #define  L2CA_DECREASE_BTU_NUM 4
 #define  L2CA_BUFF_INI         5
 #define  L2CA_BUFF_DEINIT      6
+#define  L2CA_BUFF_FREE        7
 
 typedef struct {
     UINT16 conn_id;

components/bt/host/bluedroid/stack/include/stack/l2cdefs.h

@@ -321,4 +321,16 @@
 #define L2CAP_FCR_INIT_CRC            0   /* Initial state of the CRC register */
 #define L2CAP_FCR_SEQ_MODULO          0x3F     /* Mask for sequence numbers (range 0 - 63) */
 
+#define L2CAP_LE_RESULT_CONN_OK     0
+#define L2CAP_LE_RESULT_NO_PSM      2
+#define L2CAP_LE_RESULT_NO_RESOURCES 4
+#define L2CAP_LE_RESULT_INSUFFICIENT_AUTHENTICATION 5
+#define L2CAP_LE_RESULT_INSUFFICIENT_AUTHORIZATION 6
+#define L2CAP_LE_RESULT_INSUFFICIENT_ENCRY_KEY_SIZE 7
+#define L2CAP_LE_RESULT_INSUFFICIENT_ENCRY 8
+#define L2CAP_LE_RESULT_INVALID_SOURCE_CID 9
+#define L2CAP_LE_RESULT_SOURCE_CID_ALREADY_ALLOCATED 0x0A
+#define L2CAP_LE_RESULT_UNACCEPTABLE_PARAMETERS 0x0B
+#define L2CAP_LE_RESULT_INVALID_PARAMETERS 0x0C
+
 #endif