versions: Update version to 3.2.5

bugfix: fix unable update rssi of hidden ap (backport v3.2)

See merge request espressif/esp-idf!10996

.gitlab-ci.yml

@@ -2,8 +2,7 @@ stages:
   - build
   - assign_test
   - host_test
-  - unit_test
-  - integration_test
+  - target_test
   - check
   - deploy
   - post_check
@@ -20,7 +19,7 @@ variables:
   GET_SOURCES_ATTEMPTS: "10"
   ARTIFACT_DOWNLOAD_ATTEMPTS: "10"
 
-  # We use get_sources.sh script to fetch the submodules and/or re-fetch the repo
+  # We use get-full-sources.sh script to fetch the submodules and/or re-fetch the repo
   # if it was corrupted (if submodule update fails this can happen)
   GIT_STRATEGY: fetch
   GIT_SUBMODULE_STRATEGY: none
@@ -34,8 +33,13 @@ variables:
   APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
   CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
 
-# Docker images
+  # Docker images
   BOT_DOCKER_IMAGE_TAG: ":latest"
+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "${GITLAB_SSH_SERVER}/qa/ci-test-runner-configs.git"
+  CI_AUTO_TEST_SCRIPT_REPO_URL: "${GITLAB_SSH_SERVER}/qa/auto_test_script.git"
+  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"
+
 
 # When 'fetch' strategy is used, Gitlab removes untracked files before checking out
 # new revision. However if the new revision doesn't include some of the submodules
@@ -107,6 +111,14 @@ before_script:
     - chmod 600 ~/.ssh/id_rsa
     - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
 
+# for parallel jobs, CI_JOB_NAME will be "job_name index/total" (for example, "IT_001 1/2")
+# we need to convert to pattern "job_name_index.yml"
+.define_config_file_name: &define_config_file_name |
+    JOB_NAME_PREFIX=$(echo ${CI_JOB_NAME} | awk '{print $1}')
+    JOB_FULL_NAME="${JOB_NAME_PREFIX}_${CI_NODE_INDEX}"
+    CONFIG_FILE="${CONFIG_FILE_PATH}/${JOB_FULL_NAME}.yml"
+
+
 build_template_app:
   stage: build
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
@@ -114,19 +126,21 @@ build_template_app:
     - build
   variables:
     BATCH_BUILD: "1"
-    IDF_CI_BUILD: "1"
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
       - $BOT_LABEL_BUILD
       - $BOT_LABEL_REGULAR_TEST
   script:
-    - git clone https://github.com/espressif/esp-idf-template.git
-    - cd esp-idf-template
+    # Set the variable for 'esp-idf-template' testing
+    - ESP_IDF_TEMPLATE_GIT=${ESP_IDF_TEMPLATE_GIT:-"https://github.com/espressif/esp-idf-template.git"}
+    - git clone ${ESP_IDF_TEMPLATE_GIT}
     # Try to use the same branch name for esp-idf-template that we're
     # using on esp-idf. If it doesn't exist then just stick to the default
     # branch
-    - python $CHECKOUT_REF_SCRIPT esp-idf-template
+    - python $CHECKOUT_REF_SCRIPT esp-idf-template esp-idf-template
+    - cd esp-idf-template
+    - make defconfig
     # Test debug build (default)
     - make all V=1
     # Now test release build
@@ -164,8 +178,8 @@ build_template_app:
       - $BOT_LABEL_REGULAR_TEST
   script:
     - git clone $SSC_REPOSITORY
+    - python $CHECKOUT_REF_SCRIPT SSC SSC
     - cd SSC
-    - python $CHECKOUT_REF_SCRIPT SSC
     - MAKEFLAGS= ./ci_build_ssc.sh "${CI_JOB_NAME}" "${IDF_PATH}/.gitlab-ci.yml"
 
 # don't forget to add to dependency to test_template when adding new build_ssc jobs
@@ -180,25 +194,44 @@ build_ssc_02:
 
 # If you want to add new build ssc jobs, please add it into dependencies of `assign_test` and `.test_template`
 
-build_esp_idf_tests:
+
+.build_esp_idf_unit_test_template: &build_esp_idf_unit_test_template
   <<: *build_template
   artifacts:
     paths:
       - tools/unit-test-app/output
       - components/idf_test/unit_test/TestCaseAll.yml
-      - components/idf_test/unit_test/CIConfigs/*.yml
-    expire_in: 2 days
+    expire_in: 4 days
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
       - $BOT_LABEL_BUILD
       - $BOT_LABEL_UNIT_TEST
       - $BOT_LABEL_REGULAR_TEST
+
+build_esp_idf_tests_make:
+  <<: *build_esp_idf_unit_test_template
   script:
-    - export PATH="$IDF_PATH/tools:$PATH"
-    - cd $CI_PROJECT_DIR/tools/unit-test-app
     - export EXTRA_CFLAGS="-Werror -Werror=deprecated-declarations"
     - export EXTRA_CXXFLAGS=${EXTRA_CFLAGS}
+    - cd $CI_PROJECT_DIR/tools/unit-test-app
+    - MAKEFLAGS= make help # make sure kconfig tools are built in single process
+    - make ut-clean-all-configs
+    - make ut-build-all-configs
+    - python tools/UnitTestParser.py
+    - if [ "$UNIT_TEST_BUILD_SYSTEM" == "make" ]; then exit 0; fi
+    # If Make, delete the CMake built artifacts
+    - rm -rf builds output sdkconfig
+    - rm -rf $CI_PROJECT_DIR/components/idf_test/unit_test/TestCaseAll.yml
+    - rm -rf $CI_PROJECT_DIR/components/idf_test/unit_test/CIConfigs/*.yml
+
+build_esp_idf_tests_cmake:
+  <<: *build_esp_idf_unit_test_template
+  script:
+    - export PATH="$IDF_PATH/tools:$PATH"
+    - export EXTRA_CFLAGS="-Werror -Werror=deprecated-declarations"
+    - export EXTRA_CXXFLAGS=${EXTRA_CFLAGS}
+    - cd $CI_PROJECT_DIR/tools/unit-test-app
     # Build with CMake first
     - idf.py ut-clean-all-configs
     - idf.py ut-build-all-configs
@@ -207,14 +240,8 @@ build_esp_idf_tests:
     - if [ "$UNIT_TEST_BUILD_SYSTEM" == "cmake" ]; then exit 0; fi
     # If Make, delete the CMake built artifacts
     - rm -rf builds output sdkconfig
-    - rm -rf components/idf_test/unit_test/TestCaseAll.yml
-    - rm -rf components/idf_test/unit_test/CIConfigs/*.yml
-    # Then build with Make
-    - cd $CI_PROJECT_DIR/tools/unit-test-app
-    - MAKEFLAGS= make help # make sure kconfig tools are built in single process
-    - make ut-clean-all-configs
-    - make ut-build-all-configs
-    - python tools/UnitTestParser.py
+    - rm -rf $CI_PROJECT_DIR/components/idf_test/unit_test/TestCaseAll.yml
+    - rm -rf $CI_PROJECT_DIR/components/idf_test/unit_test/CIConfigs/*.yml
 
 .build_examples_make_template: &build_examples_make_template
   <<: *build_template
@@ -225,14 +252,14 @@ build_esp_idf_tests:
     when: always
     paths:
       - build_examples/*/*/*/build/*.bin
+      - build_examples/*/*/*/sdkconfig
       - build_examples/*/*/*/build/*.elf
       - build_examples/*/*/*/build/*.map
       - build_examples/*/*/*/build/download.config
       - build_examples/*/*/*/build/bootloader/*.bin
       - $LOG_PATH
-    expire_in: 2 days
+    expire_in: 4 days
   variables:
-    IDF_CI_BUILD: "1"
     LOG_PATH: "$CI_PROJECT_DIR/log_examples_make"
   only:
     variables:
@@ -257,14 +284,14 @@ build_esp_idf_tests:
     when: always
     paths:
       - build_examples_cmake/*/*/*/build/*.bin
+      - build_examples_cmake/*/*/*/sdkconfig
       - build_examples_cmake/*/*/*/build/*.elf
       - build_examples_cmake/*/*/*/build/*.map
       - build_examples_cmake/*/*/*/build/download.config
       - build_examples_cmake/*/*/*/build/bootloader/*.bin
       - $LOG_PATH
-    expire_in: 2 days
+    expire_in: 4 days
   variables:
-    IDF_CI_BUILD: "1"
     LOG_PATH: "$CI_PROJECT_DIR/log_examples_cmake"
   only:
     variables:
@@ -351,7 +378,7 @@ build_docs:
       - docs/zh_CN/sphinx-warning-log.txt
       - docs/zh_CN/sphinx-warning-log-sanitized.txt
       - docs/zh_CN/_build/html
-    expire_in: 1 day
+    expire_in: 4 days
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
@@ -370,9 +397,17 @@ build_docs:
     - make html
     - ../check_doc_warnings.sh
 
-verify_cmake_style:
-  stage: build
+.check_job_template: &check_job_template
+  stage: check
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
+  tags:
+    - host_test
+  dependencies: []
+  before_script: *do_nothing_before_no_filter
+
+verify_cmake_style:
+  <<: *check_job_template
+  stage: build
   only:
     variables:
       - $BOT_TRIGGER_WITH_LABEL == null
@@ -583,9 +618,12 @@ push_to_github:
   tags:
     - deploy
   only:
-    - master
-    - /^release\/v/
-    - /^v\d+\.\d+(\.\d+)?($|-)/
+    refs:
+      - master
+      - /^release\/v/
+      - /^v\d+\.\d+(\.\d+)?($|-)/
+    variables:
+      - $BOT_TRIGGER_WITH_LABEL == null
   when: on_success
   dependencies: []
   before_script: *do_nothing_before
@@ -605,6 +643,7 @@ deploy_docs:
   image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
   tags:
     - deploy
+    - shiny
   only:
     refs:
       - master
@@ -663,14 +702,6 @@ check_doc_links:
     - cd docs
     - make linkcheck
 
-.check_job_template: &check_job_template
-  stage: check
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - build
-  dependencies: []
-  before_script: *do_nothing_before_no_filter
-
 check_line_endings:
   <<: *check_job_template
   script:
@@ -689,6 +720,18 @@ check_permissions:
   script:
     - tools/ci/check-executable.sh
 
+check_version:
+  <<: *check_job_template
+  # Don't run this for feature/bugfix branches, so that it is possible to modify
+  # esp_idf_version.h in a branch before tagging the next version.
+  only:
+    - master
+    - /^release\/v/
+    - /^v\d+\.\d+(\.\d+)?($|-)/
+  script:
+    - export IDF_PATH=$PWD
+    - tools/ci/check_idf_version.sh
+
 check_examples_cmake_make:
   <<: *check_job_template
   except:
@@ -715,8 +758,11 @@ check_ut_cmake_make:
 
 check_submodule_sync:
   <<: *check_job_template
+  tags:
+    - github_sync
   variables:
     GIT_STRATEGY: clone
+  retry: 2
   script:
     # check if all submodules are correctly synced to public repostory
     - git submodule update --init --recursive
@@ -749,10 +795,16 @@ assign_test:
     - build_ssc_00
     - build_ssc_01
     - build_ssc_02
-    - build_esp_idf_tests
+    - build_esp_idf_tests_make
+    - build_esp_idf_tests_cmake
   variables:
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     EXAMPLE_CONFIG_OUTPUT_PATH: "$CI_PROJECT_DIR/examples/test_configs"
+    INTEGRATION_CONFIG_OUTPUT_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    PYTHON_VER: 3.7.7
   artifacts:
     paths:
       - components/idf_test/*/CIConfigs
@@ -772,14 +824,14 @@ assign_test:
     # assign unit test cases
     - python $TEST_FW_PATH/CIAssignUnitTest.py $IDF_PATH/components/idf_test/unit_test/TestCaseAll.yml $IDF_PATH/.gitlab-ci.yml $IDF_PATH/components/idf_test/unit_test/CIConfigs
     # clone test script to assign tests
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
     # assgin integration test cases
-    - python CIAssignTestCases.py -t $IDF_PATH/components/idf_test/integration_test -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t $TEST_CASE_FILE_PATH -c $IDF_PATH/.gitlab-ci.yml -b $IDF_PATH/SSC/ssc_bin -o $INTEGRATION_CONFIG_OUTPUT_PATH
 
 .example_test_template: &example_test_template
-  stage: integration_test
+  stage: target_test
   when: on_success
   only:
     refs:
@@ -814,6 +866,8 @@ assign_test:
     paths:
       - $LOG_PATH
     expire_in: 1 week
+    reports:
+        junit: $LOG_PATH/*/XUNIT_RESULT.xml
   variables:
     TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
     TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
@@ -824,19 +878,19 @@ assign_test:
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
-    - cd ci-test-runner-configs
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     - cd $TEST_FW_PATH
     # run test
     - python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE
 
 .unit_test_template: &unit_test_template
   <<: *example_test_template
-  stage: unit_test
+  stage: target_test
   dependencies:
     - assign_test
-    - build_esp_idf_tests
+    - build_esp_idf_tests_make
+    - build_esp_idf_tests_cmake
   only:
     refs:
       - master
@@ -855,7 +909,7 @@ assign_test:
     ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"
 
 .test_template: &test_template
-  stage: integration_test
+  stage: target_test
   when: on_success
   only:
     refs:
@@ -880,23 +934,27 @@ assign_test:
   variables:
     LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
     LOG_PATH: "$CI_PROJECT_DIR/$CI_COMMIT_SHA"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/components/idf_test/integration_test"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/components/idf_test/ModuleDefinition.yml"
-    CONFIG_FILE: "$CI_PROJECT_DIR/components/idf_test/integration_test/CIConfigs/$CI_JOB_NAME.yml"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/components/idf_test/integration_test/KnownIssues"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages"
+    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
+    PYTHON_VER: 3.7.7
   before_script: *add_gitlab_key_before
   script:
+    - *define_config_file_name
     # first test if config file exists, if not exist, exit 0
     - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
-    - cd ci-test-runner-configs
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - cd auto_test_script
-    - python $CHECKOUT_REF_SCRIPT auto_test_script
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
     # run test
-    - python CIRunner.py -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH -m $MODULE_UPDATE_FILE
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
 
 nvs_compatible_test:
   <<: *test_template
@@ -910,18 +968,21 @@ nvs_compatible_test:
     - ESP32_IDF
     - NVS_Compatible
   script:
+    - *define_config_file_name
+    # first test if config file exists, if not exist, exit 0
+    - test -e $CONFIG_FILE || exit 0
     # clone local test env configs
-    - git clone $TEST_ENV_CONFIG_REPOSITORY
-    - cd ci-test-runner-configs
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs
+    - ./tools/ci/retry_failed.sh git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     # clone test bench
-    - git clone $TEST_SCRIPT_REPOSITORY
-    - cd auto_test_script
-    - git checkout ${CI_COMMIT_REF_NAME} || echo "Using default branch..."
+    - ./tools/ci/retry_failed.sh git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
+    - ./tools/ci/retry_failed.sh git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
+    - python $CHECKOUT_REF_SCRIPT auto_test_script "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
     # prepare nvs bins
-    - ./Tools/prepare_nvs_bin.sh
+    - cd auto_test_script
+    - ./tools/prepare_nvs_bin.sh
     # run test
-    - python CIRunner.py -l "$LOG_PATH/$CI_JOB_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH -m $MODULE_UPDATE_FILE
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOG_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
 
 example_test_001_01:
   <<: *example_test_template
@@ -942,17 +1003,23 @@ example_test_002_01:
     - ESP32
     - Example_ShieldBox_Basic
 
-example_test_003_01:
+.example_test_003_01:
   <<: *example_test_template
   tags:
     - ESP32
     - Example_SDIO
 
-example_test_004_01:
+example_test_004A_01:
   <<: *example_test_template
   tags:
     - ESP32
-    - Example_CAN
+    - Example_CAN1
+
+example_test_004B_01:
+  <<: *example_test_template
+  tags:
+    - ESP32
+    - Example_CAN2
 
 example_test_005_01:
   <<: *example_test_template
@@ -1210,6 +1277,68 @@ UT_001_40:
     - ESP32_IDF
     - UT_T1_1
 
+UT_001_41:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
+UT_001_42:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+
+UT_001_43:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+
+UT_001_44:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+
+UT_001_45:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+
+UT_001_46:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_no32kXTAL
+    - psram
+
+UT_001_47:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+
+UT_001_48:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+
+UT_001_49:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+
+UT_001_50:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_32kXTAL
+    - psram
+
 UT_002_01:
   <<: *unit_test_template
   tags:
@@ -1314,7 +1443,7 @@ UT_004_10:
   tags:
     - ESP32_IDF
     - UT_T1_1
-    - psram    
+    - psram
 
 UT_004_11:
   <<: *unit_test_template
@@ -1336,7 +1465,14 @@ UT_004_13:
     - ESP32_IDF
     - UT_T1_1
     - psram
-    
+
+UT_004_14:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - psram
+
 UT_005_01:
   <<: *unit_test_template
   tags:
@@ -1522,224 +1658,169 @@ UT_012_03:
     - UT_T1_1
     - 8Mpsram
 
+UT_012_04:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T1_1
+    - 8Mpsram
+
+UT_017_01:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+
+UT_017_02:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+
+UT_017_03:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+
+UT_017_04:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+    - psram
+
+UT_017_05:
+  <<: *unit_test_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_1
+    - 8Mpsram
+
 UT_601_01:
   <<: *unit_test_template
   tags:
     - ESP32_IDF
     - UT_T1_1
 
-IT_001_01:
+IT_001:
   <<: *test_template
+  parallel: 3
   tags:
     - ESP32_IDF
     - SSC_T1_4
 
-IT_001_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_4
-
-IT_001_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_4
-
-IT_002_01:
+IT_002:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_2
 
-IT_003_01:
+IT_003:
   <<: *test_template
+  parallel: 14
   tags:
     - ESP32_IDF
     - SSC_T2_5
 
-IT_003_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_04:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_05:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_06:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_07:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_08:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_09:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_10:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_11:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_12:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_003_13:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_004_01:
+IT_004:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_APC
 
-IT_005_01:
+IT_005:
   <<: *test_template
+  parallel: 2
   tags:
     - ESP32_IDF
     - SSC_T1_5
 
-IT_005_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_5
-
-IT_006_01:
+IT_006:
   <<: *test_template
+  parallel: 12
   tags:
     - ESP32_IDF
     - SSC_T1_6
 
-IT_006_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_03:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_04:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_006_05:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_007_01:
+IT_007:
   <<: *test_template
+  parallel: 3
   tags:
     - ESP32_IDF
     - SSC_T1_7
 
-IT_007_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_7
-
-IT_008_01:
+IT_008:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_8
 
-IT_009_01:
+IT_009:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_3
 
-IT_010_01:
+IT_011:
   <<: *test_template
   tags:
     - ESP32_IDF
-    - SSC_T5_1
+    - SSC_T1_MESH1
 
-IT_011_01:
+IT_012:
+  <<: *test_template
+  parallel: 2
+  tags:
+    - ESP32_IDF
+    - SSC_T2_MESH1
+
+IT_013:
   <<: *test_template
   tags:
     - ESP32_IDF
-    - SSC_T50_1
+    - SSC_T3_MESH1
 
-IT_012_01:
+IT_014:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T6_MESH1
+
+IT_015:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T12_MESH1
+
+IT_016:
+  <<: *test_template
+  allow_failure: true
+  tags:
+    - ESP32_IDF
+    - SSC_T50_MESH1
+
+IT_017:
+  <<: *test_template
+  tags:
+    - ESP32_IDF
+    - SSC_T1_MESH2
+
+IT_018:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T1_9
 
-IT_013_01:
+IT_019:
   <<: *test_template
+  parallel: 2
   tags:
     - ESP32_IDF
     - SSC_T2_2
 
-IT_013_02:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_2
-
-IT_014_01:
+IT_020:
   <<: *test_template
   tags:
     - ESP32_IDF
     - SSC_T2_3
-
-IT_015_01:
-  <<: *test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_4

.readthedocs.yml

@@ -0,0 +1,21 @@
+# .readthedocs.yml
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# Required
+version: 2
+
+# Optionally build your docs in additional formats such as PDF and ePub
+formats:
+  - pdf
+
+# Optionally set the version of Python and requirements required to build your docs
+python:
+  version: 2.7
+  install:
+    - requirements: docs/requirements.txt
+
+# We need to list all the submodules included in documentation build by Doxygen
+submodules: 
+  include:
+    - components/mqtt/esp-mqtt

Kconfig

@@ -8,6 +8,10 @@ config IDF_CMAKE
     bool
     option env="IDF_CMAKE"
 
+config IDF_FIRMWARE_CHIP_ID
+    hex
+    default 0x0000
+
 menu "SDK tool configuration"
 config TOOLPREFIX
     string "Compiler toolchain path/prefix"
@@ -132,17 +136,17 @@ choice STACK_CHECK_MODE
 
         - In NORMAL mode (GCC flag: -fstack-protector) only functions that call alloca,
           and functions with buffers larger than 8 bytes are protected.
-        
+
         - STRONG mode (GCC flag: -fstack-protector-strong) is like NORMAL, but includes
           additional functions to be protected -- those that have local array definitions,
           or have references to local frame addresses.
-        
+
         - In OVERALL mode (GCC flag: -fstack-protector-all) all functions are protected.
 
         Modes have the following impact on code performance and coverage:
 
         - performance: NORMAL > STRONG > OVERALL
-        
+
         - coverage: NORMAL < STRONG < OVERALL
 
 

components/app_update/esp_ota_ops.c

@@ -38,9 +38,9 @@
 #include "esp_log.h"
 
 
-#define OTA_MAX(a,b) ((a) >= (b) ? (a) : (b)) 
-#define OTA_MIN(a,b) ((a) <= (b) ? (a) : (b)) 
-#define SUB_TYPE_ID(i) (i & 0x0F) 
+#define OTA_MAX(a,b) ((a) >= (b) ? (a) : (b))
+#define OTA_MIN(a,b) ((a) <= (b) ? (a) : (b))
+#define SUB_TYPE_ID(i) (i & 0x0F)
 
 typedef struct ota_ops_entry_ {
     uint32_t handle;
@@ -145,9 +145,8 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
         if (it->handle == handle) {
             // must erase the partition before writing to it
             assert(it->erased_size > 0 && "must erase the partition before writing to it");
-
-            if(it->wrote_size == 0 && size > 0 && data_bytes[0] != 0xE9) {
-                ESP_LOGE(TAG, "OTA image has invalid magic byte (expected 0xE9, saw 0x%02x", data_bytes[0]);
+            if (it->wrote_size == 0 && it->partial_bytes == 0 && size > 0 && data_bytes[0] != ESP_IMAGE_HEADER_MAGIC) {
+                ESP_LOGE(TAG, "OTA image has invalid magic byte (expected 0xE9, saw 0x%02x)", data_bytes[0]);
                 return ESP_ERR_OTA_VALIDATE_FAILED;
             }
 
@@ -303,10 +302,10 @@ static esp_err_t esp_rewrite_ota_data(esp_partition_subtype_t subtype)
         //named data in first sector as s_ota_select[0], second sector data as s_ota_select[1]
         //e.g.
         //if s_ota_select[0].ota_seq == s_ota_select[1].ota_seq == 0xFFFFFFFF,means ota info partition is in init status
-        //so it will boot factory application(if there is),if there's no factory application,it will boot ota[0] application 
+        //so it will boot factory application(if there is),if there's no factory application,it will boot ota[0] application
         //if s_ota_select[0].ota_seq != 0 and s_ota_select[1].ota_seq != 0,it will choose a max seq ,and get value of max_seq%max_ota_app_number
         //and boot a subtype (mask 0x0F) value is (max_seq - 1)%max_ota_app_number,so if want switch to run ota[x],can use next formulas.
-        //for example, if s_ota_select[0].ota_seq = 4, s_ota_select[1].ota_seq = 5, and there are 8 ota application, 
+        //for example, if s_ota_select[0].ota_seq = 4, s_ota_select[1].ota_seq = 5, and there are 8 ota application,
         //current running is (5-1)%8 = 4,running ota[4],so if we want to switch to run ota[7],
         //we should add s_ota_select[0].ota_seq (is 4) to 4 ,(8-1)%8=7,then it will boot ota[7]
         //if      A=(B - C)%D

components/app_update/test/test_switch_ota.c

@@ -431,7 +431,7 @@ static void test_flow4(void)
 // 2 Stage: run factory -> check it -> copy factory to OTA0          -> reboot  --//--
 // 3 Stage: run OTA0    -> check it -> set_pin_factory_reset         -> reboot  --//--
 // 4 Stage: run factory -> check it -> erase OTA_DATA for next tests -> PASS
-TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0, sets pin_factory_reset, factory", "[app_update][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow4, test_flow4, test_flow4);
+TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0, sets pin_factory_reset, factory", "[app_update][timeout=90][ignore][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow4, test_flow4, test_flow4);
 #endif
 
 #ifdef CONFIG_BOOTLOADER_APP_TEST
@@ -474,5 +474,5 @@ static void test_flow5(void)
 // 2 Stage: run factory    -> check it -> copy factory to Test and set pin_test_app -> reboot  --//--
 // 3 Stage: run test       -> check it -> reset pin_test_app                        -> reboot  --//--
 // 4 Stage: run factory    -> check it -> erase OTA_DATA for next tests             -> PASS
-TEST_CASE_MULTIPLE_STAGES("Switching between factory, test, factory", "[app_update][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow5, test_flow5, test_flow5);
+TEST_CASE_MULTIPLE_STAGES("Switching between factory, test, factory", "[app_update][timeout=90][ignore][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow5, test_flow5, test_flow5);
 #endif

components/bootloader/Kconfig.projbuild

@@ -163,6 +163,7 @@ endmenu  # Bootloader
 
 
 menu "Security features"
+    visible if !IDF_CMAKE
 
 # These three are the actual options to check in code,
 # selected by the displayed options
@@ -426,4 +427,22 @@ config SECURE_BOOT_TEST_MODE
 
 
 endmenu  # Potentially Insecure
+
+    config FLASH_ENCRYPTION_DISABLE_PLAINTEXT
+        bool "Disable serial reflashing of plaintext firmware"
+        depends on FLASH_ENCRYPTION_ENABLED
+        default y if SECURE_BOOT_ENABLED
+        default n if !SECURE_BOOT_ENABLED
+        help
+            If this option is enabled, flash encryption is permanently enabled after first boot by write-protecting
+            the FLASH_CRYPT_CNT efuse. This is the recommended configuration for a secure production system.
+
+            If this option is disabled, FLASH_CRYPT_CNT is left writeable and up to 4 plaintext re-flashes are allowed.
+            An attacker with physical access will be able to read out encrypted flash contents until all plaintext
+            re-flashes have been used up.
+
+            If this option is disabled and hardware Secure Boot is enabled, Secure Boot must be configured in
+            Reflashable mode so that a new Secure Boot digest can be flashed at the same time as plaintext firmware.
+            This combination is not secure and should not be used for a production system.
+
 endmenu  # Security features

components/bootloader/project_include.cmake

@@ -15,10 +15,10 @@ set(bootloader_binary_files
 
 externalproject_add(bootloader
     # TODO: support overriding the bootloader in COMPONENT_PATHS
-    SOURCE_DIR "${IDF_PATH}/components/bootloader/subproject"
+    SOURCE_DIR "${CMAKE_CURRENT_LIST_DIR}/subproject"
     BINARY_DIR "${bootloader_build_dir}"
-    CMAKE_ARGS  -DSDKCONFIG=${SDKCONFIG} -DIDF_PATH=${IDF_PATH} -DEXTRA_COMPONENT_DIRS=${COMPONENT_DIRS}
-                -DTESTS_ALL=0 -DTEST_COMPONENTS=""
+    CMAKE_ARGS  -DSDKCONFIG=${SDKCONFIG} -DIDF_PATH=${IDF_PATH}
+                -DEXTRA_COMPONENT_DIRS=${CMAKE_CURRENT_LIST_DIR}
     INSTALL_COMMAND ""
     BUILD_ALWAYS 1  # no easy way around this...
     BUILD_BYPRODUCTS ${bootloader_binary_files}

components/bootloader/subproject/main/bootloader_start.c

@@ -18,6 +18,7 @@
 #include "esp_log.h"
 #include "rom/gpio.h"
 #include "rom/spi_flash.h"
+#include "rom/rtc.h"
 #include "bootloader_config.h"
 #include "bootloader_init.h"
 #include "bootloader_utility.h"
@@ -74,7 +75,8 @@ static int selected_boot_partition(const bootloader_state_t *bs)
     int boot_index = bootloader_utility_get_selected_boot_partition(bs);
     if (boot_index == INVALID_INDEX) {
         return boot_index; // Unrecoverable failure (not due to corrupt ota data or bad partition contents)
-    } else {
+    }
+    if (rtc_get_reset_reason(0) != DEEPSLEEP_RESET) {
         // Factory firmware.
 #ifdef CONFIG_BOOTLOADER_FACTORY_RESET
         if (bootloader_common_check_long_hold_gpio(CONFIG_BOOTLOADER_NUM_PIN_FACTORY_RESET, CONFIG_BOOTLOADER_HOLD_TIME_GPIO) == 1) {

components/bootloader_support/CMakeLists.txt

@@ -1,6 +1,7 @@
 set(COMPONENT_SRCS "src/bootloader_clock.c"
                    "src/bootloader_common.c"
                    "src/bootloader_flash.c"
+                   "src/bootloader_flash_config.c"
                    "src/bootloader_random.c"
                    "src/bootloader_sha.c"
                    "src/bootloader_utility.c"

components/bootloader_support/include/bootloader_common.h

@@ -14,6 +14,7 @@
 
 #pragma once
 #include "esp_flash_data_types.h"
+#include "esp_image_format.h"
 
 /// Type of hold a GPIO in low state
 typedef enum {
@@ -22,6 +23,11 @@ typedef enum {
     GPIO_NOT_HOLD   = 0     /*!< If the GPIO input is not low */
 } esp_comm_gpio_hold_t;
 
+typedef enum {
+    ESP_IMAGE_BOOTLOADER,
+    ESP_IMAGE_APPLICATION
+} esp_image_type;
+
 /**
  * @brief Calculate crc for the OTA data partition.
  *
@@ -91,3 +97,27 @@ bool bootloader_common_label_search(const char *list, char *label);
  *          - ESP_FAIL: An allocation error occurred.
  */
 esp_err_t bootloader_common_get_sha256_of_partition(uint32_t address, uint32_t size, int type, uint8_t *out_sha_256);
+
+/**
+ * @brief Get chip revision
+ *
+ * @return Chip revision number
+ */
+uint8_t bootloader_common_get_chip_revision(void);
+
+/**
+ * @brief Check if the image (bootloader and application) has valid chip ID and revision
+ *
+ * @param[in] img_hdr: image header
+ * @param[in] type: image type, bootloader or application
+ * @return
+ *      - ESP_OK: image and chip are matched well
+ *      - ESP_FAIL: image doesn't match to the chip
+ */
+esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type);
+
+
+/**
+ * @brief Configure VDDSDIO, call this API to rise VDDSDIO to 1.9V when VDDSDIO regulator is enabled as 1.8V mode.
+ */
+void bootloader_common_vddsdio_configure();

components/bootloader_support/include/bootloader_flash_config.h

@@ -0,0 +1,71 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include "esp_image_format.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Update the flash id in g_rom_flashchip(global esp_rom_spiflash_chip_t structure).
+ *
+ * @return None
+ */
+void bootloader_flash_update_id();
+
+/**
+ * @brief Set the flash CS setup and hold time.
+ *
+ * @note CS setup time is recomemded to be 1.5T, and CS hold time is recommended to be 2.5T.
+ *       cs_setup = 1, cs_setup_time = 0; cs_hold = 1, cs_hold_time = 1.
+ *
+ * @return None
+ */
+void bootloader_flash_cs_timing_config();
+
+/**
+ * @brief Configure SPI flash clock.
+ *
+ * @note This function only set clock frequency for SPI0.
+ *
+ * @param pfhdr Pointer to App image header, from where to fetch flash settings.
+ *
+ * @return None
+ */
+void bootloader_flash_clock_config(const esp_image_header_t* pfhdr);
+
+/**
+ * @brief Configure SPI flash gpio, include the IO matrix and drive strength configuration.
+ *
+ * @param pfhdr Pointer to App image header, from where to fetch flash settings.
+ *
+ * @return None
+ */
+void bootloader_flash_gpio_config(const esp_image_header_t* pfhdr);
+
+/**
+ * @brief Configure SPI flash read dummy based on different mode and frequency.
+ *
+ * @param pfhdr Pointer to App image header, from where to fetch flash settings.
+ *
+ * @return None
+ */
+void bootloader_flash_dummy_config(const esp_image_header_t* pfhdr);
+
+#ifdef __cplusplus
+}
+#endif

components/bootloader_support/include/esp_efuse.h

@@ -91,6 +91,13 @@ esp_err_t esp_efuse_apply_34_encoding(const uint8_t *in_bytes, uint32_t *out_wor
  */
 void esp_efuse_write_random_key(uint32_t blk_wdata0_reg);
 
+/**
+ * @brief   Returns chip version from efuse
+ *
+ * @return chip version
+ */
+uint8_t esp_efuse_get_chip_ver(void);
+
 #ifdef __cplusplus
 }
 #endif

components/bootloader_support/include/esp_image_format.h

@@ -55,6 +55,19 @@ typedef enum {
 
 #define ESP_IMAGE_HEADER_MAGIC 0xE9
 
+/**
+ * @brief ESP chip ID
+ *
+ */
+typedef enum {
+    ESP_CHIP_ID_ESP32 = 0x0000,  /*!< chip ID: ESP32 */
+    ESP_CHIP_ID_INVALID = 0xFFFF /*!< Invalid chip ID (we defined it to make sure the esp_chip_id_t is 2 bytes size) */
+} __attribute__((packed)) esp_chip_id_t;
+
+/** @cond */
+_Static_assert(sizeof(esp_chip_id_t) == 2, "esp_chip_id_t should be 16 bit");
+
+
 /* Main header of binary image */
 typedef struct {
     uint8_t magic;
@@ -71,8 +84,12 @@ typedef struct {
     uint8_t wp_pin;
     /* Drive settings for the SPI flash pins (read by ROM bootloader) */
     uint8_t spi_pin_drv[3];
-    /* Reserved bytes in ESP32 additional header space, currently unused */
-    uint8_t reserved[11];
+    /*!< Chip identification number */
+    esp_chip_id_t chip_id;
+    /*!< Minimum chip revision supported by image */
+    uint8_t min_chip_rev;
+    /*!< Reserved bytes in additional header space, currently unused */
+    uint8_t reserved[8];
     /* If 1, a SHA256 digest "simple hash" (of the entire image) is appended after the checksum. Included in image length. This digest
      * is separate to secure boot and only used for detecting corruption. For secure boot signed images, the signature
      * is appended after this (and the simple hash is included in the signed data). */

components/bootloader_support/include_bootloader/bootloader_flash.h

@@ -30,6 +30,13 @@
    bootloader_support components only.
 */
 
+/**
+ * @brief Get number of free pages
+ *
+ * @return Number of free pages
+ */
+uint32_t bootloader_mmap_get_free_pages();
+
 /**
  * @brief Map a region of flash to data memory
  *
@@ -111,4 +118,21 @@ esp_err_t bootloader_flash_erase_sector(size_t sector);
  */
 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size);
 
+/* Cache MMU block size */
+#define MMU_BLOCK_SIZE    0x00010000
+
+/* Cache MMU address mask (MMU tables ignore bits which are zero) */
+#define MMU_FLASH_MASK    (~(MMU_BLOCK_SIZE - 1))
+
+/**
+ * @brief Calculate the number of cache pages to map
+ * @param size  size of data to map
+ * @param vaddr  virtual address where data will be mapped
+ * @return number of cache MMU pages required to do the mapping
+ */
+static inline uint32_t bootloader_cache_pages_to_map(uint32_t size, uint32_t vaddr)
+{
+    return (size + (vaddr - (vaddr & MMU_FLASH_MASK)) + MMU_BLOCK_SIZE - 1) / MMU_BLOCK_SIZE;
+}
+
 #endif

components/bootloader_support/src/bootloader_clock.c

@@ -31,14 +31,14 @@ void bootloader_clock_configure()
     /* Set CPU to 80MHz. Keep other clocks unmodified. */
     int cpu_freq_mhz = 80;
 
-    /* On ESP32 rev 0, switching to 80MHz if clock was previously set to
+    /* On ESP32 rev 0, switching to 80/160 MHz if clock was previously set to
      * 240 MHz may cause the chip to lock up (see section 3.5 of the errata
-     * document). For rev. 0, switch to 240 instead if it was chosen in
-     * menuconfig.
+     * document). For rev. 0, switch to 240 instead if it has been enabled
+     * previously.
      */
     uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
     if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
-            CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240) {
+            DPORT_REG_GET_FIELD(DPORT_CPU_PER_CONF_REG, DPORT_CPUPERIOD_SEL) == DPORT_CPUPERIOD_SEL_240) {
         cpu_freq_mhz = 240;
     }
 

components/bootloader_support/src/bootloader_common.c

@@ -27,6 +27,11 @@
 #include "bootloader_flash.h"
 #include "bootloader_common.h"
 #include "soc/gpio_periph.h"
+#include "soc/efuse_reg.h"
+#include "soc/rtc.h"
+#include "soc/spi_reg.h"
+#include "soc/efuse_reg.h"
+#include "soc/apb_ctrl_reg.h"
 #include "esp_image_format.h"
 #include "bootloader_sha.h"
 
@@ -192,3 +197,64 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
 
     return ESP_OK;
 }
+
+void bootloader_common_vddsdio_configure()
+{
+#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
+    rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
+    if (cfg.enable == 1 && cfg.tieh == RTC_VDDSDIO_TIEH_1_8V) {    // VDDSDIO regulator is enabled @ 1.8V
+        cfg.drefh = 3;
+        cfg.drefm = 3;
+        cfg.drefl = 3;
+        cfg.force = 1;
+        rtc_vddsdio_set_config(cfg);
+        ets_delay_us(10); // wait for regulator to become stable
+    }
+#endif // CONFIG_BOOTLOADER_VDDSDIO_BOOST
+}
+
+uint8_t bootloader_common_get_chip_revision(void)
+{
+    uint8_t eco_bit0, eco_bit1, eco_bit2;
+    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
+    eco_bit1 = (REG_READ(EFUSE_BLK0_RDATA5_REG) & 0x100000) >> 20;
+    eco_bit2 = (REG_READ(APB_CTRL_DATE_REG) & 0x80000000) >> 31;
+    uint32_t combine_value = (eco_bit2 << 2) | (eco_bit1 << 1) | eco_bit0;
+    uint8_t chip_ver = 0;
+    switch (combine_value) {
+    case 0:
+        chip_ver = 0;
+        break;
+    case 1:
+        chip_ver = 1;
+        break;
+    case 3:
+        chip_ver = 2;
+        break;
+    case 7:
+        chip_ver = 3;
+        break;
+    default:
+        chip_ver = 0;
+        break;
+    }
+    return chip_ver;
+}
+
+esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
+{
+    esp_err_t err = ESP_OK;
+    esp_chip_id_t chip_id = CONFIG_IDF_FIRMWARE_CHIP_ID;
+    if (chip_id != img_hdr->chip_id) {
+        ESP_LOGE(TAG, "mismatch chip ID, expected %d, found %d", chip_id, img_hdr->chip_id);
+        err = ESP_FAIL;
+    }
+    uint8_t revision = bootloader_common_get_chip_revision();
+    if (revision < img_hdr->min_chip_rev) {
+        ESP_LOGE(TAG, "can't run on lower chip revision, expected %d, found %d", revision, img_hdr->min_chip_rev);
+        err = ESP_FAIL;
+    } else if (revision != img_hdr->min_chip_rev) {
+        ESP_LOGI(TAG, "chip revision: %d, min. %s chip revision: %d", revision, type == ESP_IMAGE_BOOTLOADER ? "bootloader" : "application", img_hdr->min_chip_rev);
+    }
+    return err;
+}

components/bootloader_support/src/bootloader_flash.c

@@ -25,6 +25,11 @@ static const char *TAG = "bootloader_mmap";
 
 static spi_flash_mmap_handle_t map;
 
+uint32_t bootloader_mmap_get_free_pages()
+{
+    return spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
+}
+
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
     if (map) {
@@ -91,14 +96,22 @@ static const char *TAG = "bootloader_flash";
 */
 #define MMU_BLOCK0_VADDR  0x3f400000
 #define MMU_BLOCK50_VADDR 0x3f720000
-#define MMU_FLASH_MASK    0xffff0000
-#define MMU_BLOCK_SIZE    0x00010000
+#define MMU_FREE_PAGES    ((MMU_BLOCK50_VADDR - MMU_BLOCK0_VADDR) / FLASH_BLOCK_SIZE)
 
 static bool mapped;
 
 // Current bootloader mapping (ab)used for bootloader_read()
 static uint32_t current_read_mapping = UINT32_MAX;
 
+uint32_t bootloader_mmap_get_free_pages()
+{
+    /**
+     * Allow mapping up to 50 of the 51 available MMU blocks (last one used for reads)
+     * Since, bootloader_mmap function below assumes it to be 0x320000 (50 pages), we can safely do this.
+     */
+    return MMU_FREE_PAGES;
+}
+
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
 {
     if (mapped) {
@@ -112,10 +125,11 @@ const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
     }
 
     uint32_t src_addr_aligned = src_addr & MMU_FLASH_MASK;
-    uint32_t count = (size + (src_addr - src_addr_aligned) + 0xffff) / MMU_BLOCK_SIZE;
+    uint32_t count = bootloader_cache_pages_to_map(size, src_addr);
     Cache_Read_Disable(0);
     Cache_Flush(0);
-    ESP_LOGD(TAG, "mmu set paddr=%08x count=%d", src_addr_aligned, count );
+    ESP_LOGD(TAG, "mmu set paddr=%08x count=%d size=%x src_addr=%x src_addr_aligned=%x",
+            src_addr & MMU_FLASH_MASK, count, size, src_addr, src_addr_aligned );
     int e = cache_flash_mmu_set(0, 0, MMU_BLOCK0_VADDR, src_addr_aligned, 64, count);
     if (e != 0) {
         ESP_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);

components/bootloader_support/src/bootloader_flash_config.c

@@ -0,0 +1,166 @@
+// Copyright 2018 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include <stdbool.h>
+#include <assert.h>
+#include "string.h"
+#include "sdkconfig.h"
+#include "esp_err.h"
+#include "esp_log.h"
+#include "rom/gpio.h"
+#include "rom/spi_flash.h"
+#include "rom/efuse.h"
+#include "soc/gpio_periph.h"
+#include "soc/efuse_reg.h"
+#include "soc/spi_reg.h"
+#include "soc/spi_pins.h"
+#include "flash_qio_mode.h"
+#include "bootloader_flash_config.h"
+
+void bootloader_flash_update_id()
+{
+    g_rom_flashchip.device_id = bootloader_read_flash_id();
+}
+
+void IRAM_ATTR bootloader_flash_cs_timing_config()
+{
+    SET_PERI_REG_MASK(SPI_USER_REG(0), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(0), SPI_HOLD_TIME_V, 1, SPI_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(0), SPI_SETUP_TIME_V, 0, SPI_SETUP_TIME_S);
+    SET_PERI_REG_MASK(SPI_USER_REG(1), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(1), SPI_HOLD_TIME_V, 1, SPI_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_CTRL2_REG(1), SPI_SETUP_TIME_V, 0, SPI_SETUP_TIME_S);
+}
+
+void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
+{
+    uint32_t spi_clk_div = 0;
+    switch (pfhdr->spi_speed) {
+        case ESP_IMAGE_SPI_SPEED_80M:
+            spi_clk_div = 1;
+            break;
+        case ESP_IMAGE_SPI_SPEED_40M:
+            spi_clk_div = 2;
+            break;
+        case ESP_IMAGE_SPI_SPEED_26M:
+            spi_clk_div = 3;
+            break;
+        case ESP_IMAGE_SPI_SPEED_20M:
+            spi_clk_div = 4;
+            break;
+        default:
+            break;
+    }
+    esp_rom_spiflash_config_clk(spi_clk_div, 0);
+    esp_rom_spiflash_config_clk(spi_clk_div, 1);
+}
+
+void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
+{
+    uint32_t drv = 2;
+    if (pfhdr->spi_speed == ESP_IMAGE_SPI_SPEED_80M) {
+        drv = 3;
+    }
+
+    uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
+    uint32_t pkg_ver = chip_ver & 0x7;
+
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
+        // For ESP32D2WD the SPI pins are already configured
+        // flash clock signal should come from IO MUX.
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
+        // For ESP32PICOD2 the SPI pins are already configured
+        // flash clock signal should come from IO MUX.
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
+        // For ESP32PICOD4 the SPI pins are already configured
+        // flash clock signal should come from IO MUX.
+        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+    } else {
+        const uint32_t spiconfig = ets_efuse_get_spiconfig();
+        if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_CS, SPICS0_OUT_IDX, 0, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_MISO, SPIQ_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_MISO, SPIQ_IN_IDX, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_MOSI, SPID_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_MOSI, SPID_IN_IDX, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_WP, SPIWP_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_WP, SPIWP_IN_IDX, 0);
+            gpio_matrix_out(SPI_IOMUX_PIN_NUM_HD, SPIHD_OUT_IDX, 0, 0);
+            gpio_matrix_in(SPI_IOMUX_PIN_NUM_HD, SPIHD_IN_IDX, 0);
+            //select pin function gpio
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA0_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA1_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA2_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA3_U, PIN_FUNC_GPIO);
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CMD_U, PIN_FUNC_GPIO);
+            // flash clock signal should come from IO MUX.
+            // set drive ability for clock
+            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
+            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
+
+            uint32_t flash_id = g_rom_flashchip.device_id;
+            if (flash_id == FLASH_ID_GD25LQ32C) {
+                // Set drive ability for 1.8v flash in 80Mhz.
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA0_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA1_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA2_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA3_U, FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CMD_U,   FUN_DRV, 3, FUN_DRV_S);
+                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U,   FUN_DRV, 3, FUN_DRV_S);
+            }
+        }
+    }
+}
+
+void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
+{
+    int spi_cache_dummy = 0;
+    uint32_t modebit = READ_PERI_REG(SPI_CTRL_REG(0));
+    if (modebit & SPI_FASTRD_MODE) {
+        if (modebit & SPI_FREAD_QIO) {    //SPI mode is QIO
+            spi_cache_dummy = SPI0_R_QIO_DUMMY_CYCLELEN;
+        } else if (modebit & SPI_FREAD_DIO) {    //SPI mode is DIO
+            spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;
+            SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_ADDR_BITLEN_V, SPI0_R_DIO_ADDR_BITSLEN, SPI_USR_ADDR_BITLEN_S);
+        } else if(modebit & (SPI_FREAD_QUAD | SPI_FREAD_DUAL))  {    //SPI mode is QOUT or DIO
+            spi_cache_dummy = SPI0_R_FAST_DUMMY_CYCLELEN;
+        }
+    }
+
+    extern uint8_t g_rom_spiflash_dummy_len_plus[];
+    switch (pfhdr->spi_speed) {
+        case ESP_IMAGE_SPI_SPEED_80M:
+            g_rom_spiflash_dummy_len_plus[0] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_80M;
+            g_rom_spiflash_dummy_len_plus[1] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_80M;
+            break;
+        case ESP_IMAGE_SPI_SPEED_40M:
+            g_rom_spiflash_dummy_len_plus[0] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_40M;
+            g_rom_spiflash_dummy_len_plus[1] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_40M;
+            break;
+        case ESP_IMAGE_SPI_SPEED_26M:
+        case ESP_IMAGE_SPI_SPEED_20M:
+            g_rom_spiflash_dummy_len_plus[0] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_20M;
+            g_rom_spiflash_dummy_len_plus[1] = ESP_ROM_SPIFLASH_DUMMY_LEN_PLUS_20M;
+            break;
+        default:
+            break;
+    }
+
+    SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + g_rom_spiflash_dummy_len_plus[0],
+            SPI_USR_DUMMY_CYCLELEN_S);
+}

components/bootloader_support/src/bootloader_init.c

@@ -17,6 +17,7 @@
 #include <sys/param.h>
 
 #include "esp_attr.h"
+#include "esp_efuse.h"
 #include "esp_log.h"
 
 #include "rom/cache.h"
@@ -33,12 +34,10 @@
 #include "soc/cpu.h"
 #include "soc/rtc.h"
 #include "soc/dport_reg.h"
-#include "soc/io_mux_reg.h"
 #include "soc/efuse_reg.h"
 #include "soc/rtc_cntl_reg.h"
 #include "soc/timer_group_reg.h"
-#include "soc/gpio_reg.h"
-#include "soc/gpio_sig_map.h"
+#include "soc/gpio_periph.h"
 #include "soc/rtc_wdt.h"
 
 #include "sdkconfig.h"
@@ -50,6 +49,8 @@
 #include "bootloader_random.h"
 #include "bootloader_config.h"
 #include "bootloader_clock.h"
+#include "bootloader_common.h"
+#include "bootloader_flash_config.h"
 
 #include "flash_qio_mode.h"
 
@@ -63,8 +64,7 @@ static const char* TAG = "boot";
 static esp_err_t bootloader_main();
 static void print_flash_info(const esp_image_header_t* pfhdr);
 static void update_flash_config(const esp_image_header_t* pfhdr);
-static void vddsdio_configure();
-static void flash_gpio_configure(const esp_image_header_t* pfhdr);
+static void bootloader_init_flash_configure(const esp_image_header_t* pfhdr);
 static void uart_console_configure(void);
 static void wdt_reset_check(void);
 
@@ -72,6 +72,7 @@ static void wdt_reset_check(void);
 esp_err_t bootloader_init()
 {
     cpu_configure_region_protection();
+    cpu_init_memctl();
 
     /* Sanity check that static RAM is after the stack */
 #ifndef NDEBUG
@@ -118,7 +119,7 @@ esp_err_t bootloader_init()
 
 static esp_err_t bootloader_main()
 {
-    vddsdio_configure();
+    bootloader_common_vddsdio_configure();
     /* Read and keep flash ID, for further use. */
     g_rom_flashchip.device_id = bootloader_read_flash_id();
     esp_image_header_t fhdr;
@@ -126,7 +127,13 @@ static esp_err_t bootloader_main()
         ESP_LOGE(TAG, "failed to load bootloader header!");
         return ESP_FAIL;
     }
-    flash_gpio_configure(&fhdr);
+    /* Check chip ID and minimum chip revision that supported by this image */
+    uint8_t revision = bootloader_common_get_chip_revision();
+    ESP_LOGI(TAG, "Chip Revision: %d", revision);
+    if (bootloader_common_check_chip_validity(&fhdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
+        return ESP_FAIL;
+    }
+    bootloader_init_flash_configure(&fhdr);
 #if (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ == 240)
     //Check if ESP32 is rated for a CPU frequency of 160MHz only
     if (REG_GET_BIT(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_CPU_FREQ_RATED) &&
@@ -286,128 +293,15 @@ static void print_flash_info(const esp_image_header_t* phdr)
 #endif
 }
 
-static void vddsdio_configure()
-{
-#if CONFIG_BOOTLOADER_VDDSDIO_BOOST_1_9V
-    rtc_vddsdio_config_t cfg = rtc_vddsdio_get_config();
-    if (cfg.enable == 1 && cfg.tieh == RTC_VDDSDIO_TIEH_1_8V) {    // VDDSDIO regulator is enabled @ 1.8V
-        cfg.drefh = 3;
-        cfg.drefm = 3;
-        cfg.drefl = 3;
-        cfg.force = 1;
-        rtc_vddsdio_set_config(cfg);
-        ets_delay_us(10); // wait for regulator to become stable
-    }
-#endif // CONFIG_BOOTLOADER_VDDSDIO_BOOST
-}
-
-#define FLASH_CLK_IO      6
-#define FLASH_CS_IO       11
-#define FLASH_SPIQ_IO     7
-#define FLASH_SPID_IO     8
-#define FLASH_SPIWP_IO    10
-#define FLASH_SPIHD_IO    9
-#define FLASH_IO_MATRIX_DUMMY_40M   1
-#define FLASH_IO_MATRIX_DUMMY_80M   2
-#define FLASH_IO_DRIVE_GD_WITH_1V8PSRAM    3
-
 /*
  * Bootloader reads SPI configuration from bin header, so that
  * the burning configuration can be different with compiling configuration.
  */
-static void IRAM_ATTR flash_gpio_configure(const esp_image_header_t* pfhdr)
+static void IRAM_ATTR bootloader_init_flash_configure(const esp_image_header_t* pfhdr)
 {
-    int spi_cache_dummy = 0;
-    int drv = 2;
-    switch (pfhdr->spi_mode) {
-        case ESP_IMAGE_SPI_MODE_QIO:
-            spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;
-            break;
-        case ESP_IMAGE_SPI_MODE_DIO:
-            spi_cache_dummy = SPI0_R_DIO_DUMMY_CYCLELEN;   //qio 3
-            break;
-        case ESP_IMAGE_SPI_MODE_QOUT:
-        case ESP_IMAGE_SPI_MODE_DOUT:
-        default:
-            spi_cache_dummy = SPI0_R_FAST_DUMMY_CYCLELEN;
-            break;
-    }
-
-    /* dummy_len_plus values defined in ROM for SPI flash configuration */
-    extern uint8_t g_rom_spiflash_dummy_len_plus[];
-    switch (pfhdr->spi_speed) {
-        case ESP_IMAGE_SPI_SPEED_80M:
-            g_rom_spiflash_dummy_len_plus[0] = FLASH_IO_MATRIX_DUMMY_80M;
-            g_rom_spiflash_dummy_len_plus[1] = FLASH_IO_MATRIX_DUMMY_80M;
-            SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + FLASH_IO_MATRIX_DUMMY_80M,
-                    SPI_USR_DUMMY_CYCLELEN_S);  //DUMMY
-            drv = 3;
-            break;
-        case ESP_IMAGE_SPI_SPEED_40M:
-            g_rom_spiflash_dummy_len_plus[0] = FLASH_IO_MATRIX_DUMMY_40M;
-            g_rom_spiflash_dummy_len_plus[1] = FLASH_IO_MATRIX_DUMMY_40M;
-            SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + FLASH_IO_MATRIX_DUMMY_40M,
-                    SPI_USR_DUMMY_CYCLELEN_S);  //DUMMY
-            break;
-        default:
-            break;
-    }
-
-    uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-    uint32_t pkg_ver = chip_ver & 0x7;
-
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else {
-        const uint32_t spiconfig = ets_efuse_get_spiconfig();
-        if (spiconfig == EFUSE_SPICONFIG_SPI_DEFAULTS) {
-            gpio_matrix_out(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
-            gpio_matrix_out(FLASH_SPIQ_IO, SPIQ_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPIQ_IO, SPIQ_IN_IDX, 0);
-            gpio_matrix_out(FLASH_SPID_IO, SPID_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPID_IO, SPID_IN_IDX, 0);
-            gpio_matrix_out(FLASH_SPIWP_IO, SPIWP_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPIWP_IO, SPIWP_IN_IDX, 0);
-            gpio_matrix_out(FLASH_SPIHD_IO, SPIHD_OUT_IDX, 0, 0);
-            gpio_matrix_in(FLASH_SPIHD_IO, SPIHD_IN_IDX, 0);
-            //select pin function gpio
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA0_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA1_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA2_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_DATA3_U, PIN_FUNC_GPIO);
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CMD_U, PIN_FUNC_GPIO);
-            // flash clock signal should come from IO MUX.
-            // set drive ability for clock
-            PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-            SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-
-            #if CONFIG_SPIRAM_TYPE_ESPPSRAM32
-            uint32_t flash_id = g_rom_flashchip.device_id;
-            if (flash_id == FLASH_ID_GD25LQ32C) {
-                // Set drive ability for 1.8v flash in 80Mhz.
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA0_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA1_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA2_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_DATA3_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CMD_U, FUN_DRV, 3, FUN_DRV_S);
-                SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, 3, FUN_DRV_S);
-            }
-            #endif
-        }
-    }
+    bootloader_flash_gpio_config(pfhdr);
+    bootloader_flash_dummy_config(pfhdr);
+    bootloader_flash_cs_timing_config();
 }
 
 static void uart_console_configure(void)
@@ -441,10 +335,18 @@ static void uart_console_configure(void)
         // (arrays should be optimized away by the compiler)
         const uint32_t tx_idx_list[3] = { U0TXD_OUT_IDX, U1TXD_OUT_IDX, U2TXD_OUT_IDX };
         const uint32_t rx_idx_list[3] = { U0RXD_IN_IDX, U1RXD_IN_IDX, U2RXD_IN_IDX };
+        const uint32_t uart_reset[3] = { DPORT_UART_RST, DPORT_UART1_RST, DPORT_UART2_RST };
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
+
+        PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
+        gpio_pad_pullup(uart_rx_gpio);
+
         gpio_matrix_out(uart_tx_gpio, tx_idx, 0, 0);
         gpio_matrix_in(uart_rx_gpio, rx_idx, 0);
+
+        DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
+        DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
     }
 #endif // CONFIG_CONSOLE_UART_CUSTOM
 

components/bootloader_support/src/bootloader_random.c

@@ -114,17 +114,18 @@ void bootloader_random_enable(void)
 
 void bootloader_random_disable(void)
 {
-    /* Disable i2s clock */
-    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-
-
     /* Reset some i2s configuration (possibly redundant as we reset entire
        I2S peripheral further down). */
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
     CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
-    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+
+    /* Disable i2s clock */
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
 
     /* Restore SYSCON mode registers */
     CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);

components/bootloader_support/src/bootloader_utility.c

@@ -389,7 +389,7 @@ static void unpack_load_app(const esp_image_metadata_t* data)
     // Find DROM & IROM addresses, to configure cache mappings
     for (int i = 0; i < data->image.segment_count; i++) {
         const esp_image_segment_header_t *header = &data->segments[i];
-        if (header->load_addr >= SOC_IROM_LOW && header->load_addr < SOC_IROM_HIGH) {
+        if (header->load_addr >= SOC_DROM_LOW && header->load_addr < SOC_DROM_HIGH) {
             if (drom_addr != 0) {
                 ESP_LOGE(TAG, MAP_ERR_MSG, "DROM");
             } else {
@@ -399,7 +399,7 @@ static void unpack_load_app(const esp_image_metadata_t* data)
             drom_load_addr = header->load_addr;
             drom_size = header->data_len;
         }
-        if (header->load_addr >= SOC_DROM_LOW && header->load_addr < SOC_DROM_HIGH) {
+        if (header->load_addr >= SOC_IROM_LOW && header->load_addr < SOC_IROM_HIGH) {
             if (irom_addr != 0) {
                 ESP_LOGE(TAG, MAP_ERR_MSG, "IROM");
             } else {
@@ -430,6 +430,7 @@ static void set_cache_and_start_app(
     uint32_t irom_size,
     uint32_t entry_addr)
 {
+    int rc;
     ESP_LOGD(TAG, "configure drom and irom and start");
     Cache_Read_Disable( 0 );
     Cache_Flush( 0 );
@@ -441,20 +442,34 @@ static void set_cache_and_start_app(
         DPORT_PRO_FLASH_MMU_TABLE[i] = DPORT_FLASH_MMU_TABLE_INVALID_VAL;
     }
 
-    uint32_t drom_page_count = (drom_size + 64*1024 - 1) / (64*1024); // round up to 64k
-    ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d", drom_addr & 0xffff0000, drom_load_addr & 0xffff0000, drom_size, drom_page_count );
-    int rc = cache_flash_mmu_set( 0, 0, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    rc = cache_flash_mmu_set( 1, 0, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    uint32_t irom_page_count = (irom_size + 64*1024 - 1) / (64*1024); // round up to 64k
-    ESP_LOGV(TAG, "i mmu set paddr=%08x vaddr=%08x size=%d n=%d", irom_addr & 0xffff0000, irom_load_addr & 0xffff0000, irom_size, irom_page_count );
-    rc = cache_flash_mmu_set( 0, 0, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    rc = cache_flash_mmu_set( 1, 0, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count );
-    ESP_LOGV(TAG, "rc=%d", rc );
-    DPORT_REG_CLR_BIT( DPORT_PRO_CACHE_CTRL1_REG, (DPORT_PRO_CACHE_MASK_IRAM0) | (DPORT_PRO_CACHE_MASK_IRAM1 & 0) | (DPORT_PRO_CACHE_MASK_IROM0 & 0) | DPORT_PRO_CACHE_MASK_DROM0 | DPORT_PRO_CACHE_MASK_DRAM1 );
-    DPORT_REG_CLR_BIT( DPORT_APP_CACHE_CTRL1_REG, (DPORT_APP_CACHE_MASK_IRAM0) | (DPORT_APP_CACHE_MASK_IRAM1 & 0) | (DPORT_APP_CACHE_MASK_IROM0 & 0) | DPORT_APP_CACHE_MASK_DROM0 | DPORT_APP_CACHE_MASK_DRAM1 );
+    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
+    uint32_t drom_page_count = bootloader_cache_pages_to_map(drom_size, drom_load_addr);
+    ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d",
+            drom_addr & MMU_FLASH_MASK, drom_load_addr_aligned, drom_size, drom_page_count);
+    rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+    rc = cache_flash_mmu_set(1, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+
+    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
+    uint32_t irom_page_count = bootloader_cache_pages_to_map(irom_size, irom_load_addr);
+    ESP_LOGV(TAG, "i mmu set paddr=%08x vaddr=%08x size=%d n=%d",
+            irom_addr & MMU_FLASH_MASK, irom_load_addr_aligned, irom_size, irom_page_count);
+    rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+    rc = cache_flash_mmu_set(1, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    ESP_LOGV(TAG, "rc=%d", rc);
+
+    DPORT_REG_CLR_BIT( DPORT_PRO_CACHE_CTRL1_REG,
+            (DPORT_PRO_CACHE_MASK_IRAM0) | (DPORT_PRO_CACHE_MASK_IRAM1 & 0) |
+            (DPORT_PRO_CACHE_MASK_IROM0 & 0) | DPORT_PRO_CACHE_MASK_DROM0 |
+            DPORT_PRO_CACHE_MASK_DRAM1 );
+
+    DPORT_REG_CLR_BIT( DPORT_APP_CACHE_CTRL1_REG,
+            (DPORT_APP_CACHE_MASK_IRAM0) | (DPORT_APP_CACHE_MASK_IRAM1 & 0) |
+            (DPORT_APP_CACHE_MASK_IROM0 & 0) | DPORT_APP_CACHE_MASK_DROM0 |
+            DPORT_APP_CACHE_MASK_DRAM1 );
+
     Cache_Read_Enable( 0 );
 
     // Application will need to do Cache_Flush(1) and Cache_Read_Enable(1)

components/bootloader_support/src/efuse.c

@@ -15,6 +15,7 @@
 #include "esp_log.h"
 #include <string.h>
 #include "bootloader_random.h"
+#include "soc/apb_ctrl_reg.h"
 
 #define EFUSE_CONF_WRITE 0x5A5A /* efuse_pgm_op_ena, force no rd/wr disable */
 #define EFUSE_CONF_READ 0x5AA5 /* efuse_read_op_ena, release force */
@@ -112,3 +113,32 @@ void esp_efuse_write_random_key(uint32_t blk_wdata0_reg)
     bzero(buf, sizeof(buf));
     bzero(raw, sizeof(raw));
 }
+
+// Returns chip version from efuse
+uint8_t esp_efuse_get_chip_ver(void)
+{
+    uint8_t eco_bit0, eco_bit1, eco_bit2;
+    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
+    eco_bit1 = (REG_READ(EFUSE_BLK0_RDATA5_REG) & 0x100000) >> 20;
+    eco_bit2 = (REG_READ(APB_CTRL_DATE_REG) & 0x80000000) >> 31;
+    uint32_t combine_value = (eco_bit2 << 2) | (eco_bit1 << 1) | eco_bit0;
+    uint8_t chip_ver = 0;
+    switch (combine_value) {
+    case 0:
+        chip_ver = 0;
+        break;
+    case 1:
+        chip_ver = 1;
+        break;
+    case 3:
+        chip_ver = 2;
+        break;
+    case 7:
+        chip_ver = 3;
+        break;
+    default:
+        chip_ver = 0;
+        break;
+    }
+    return chip_ver;
+}

components/bootloader_support/src/esp_image_format.c

@@ -24,6 +24,7 @@
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
 #include "bootloader_util.h"
+#include "bootloader_common.h"
 
 /* Checking signatures as part of verifying images is necessary:
    - Always if secure boot is enabled
@@ -280,6 +281,9 @@ static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t
         }
         err = ESP_ERR_IMAGE_INVALID;
     }
+    if (bootloader_common_check_chip_validity(image, ESP_IMAGE_APPLICATION) != ESP_OK) {
+        err = ESP_ERR_IMAGE_INVALID;
+    }
     if (!silent) {
         if (image->spi_mode > ESP_IMAGE_SPI_MODE_SLOW_READ) {
             ESP_LOGW(TAG, "image at 0x%x has invalid SPI mode %d", src_addr, image->spi_mode);
@@ -368,24 +372,22 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
     }
 #endif // BOOTLOADER_BUILD
 
-#ifndef BOOTLOADER_BUILD
-    uint32_t free_page_count = spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
-    ESP_LOGD(TAG, "free data page_count 0x%08x",free_page_count);
-    uint32_t offset_page = 0;
-    while (data_len >= free_page_count * SPI_FLASH_MMU_PAGE_SIZE) {
-        offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0)?1:0;
-        err = process_segment_data(load_addr, data_addr, (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE, do_load, sha_handle, checksum);
+    uint32_t free_page_count = bootloader_mmap_get_free_pages();
+    ESP_LOGD(TAG, "free data page_count 0x%08x", free_page_count);
+
+    int32_t data_len_remain = data_len;
+    while (data_len_remain > 0) {
+        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
+        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
+        data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
+        err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
         if (err != ESP_OK) {
             return err;
         }
-        data_addr += (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
-        data_len -= (free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE;
-    }
-#endif
-    err = process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum);
-    if (err != ESP_OK) {
-        return err;
+        data_addr += data_len;
+        data_len_remain -= data_len;
     }
+
     return ESP_OK;
 
 err:

components/bootloader_support/src/flash_encrypt.c

@@ -163,7 +163,7 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
 
     /* If the last flash_crypt_cnt bit is burned or write-disabled, the
        device can't re-encrypt itself. */
-    if (flash_crypt_wr_dis || flash_crypt_cnt == 0xFF) {
+    if (flash_crypt_wr_dis) {
         ESP_LOGE(TAG, "Cannot re-encrypt data (FLASH_CRYPT_CNT 0x%02x write disabled %d", flash_crypt_cnt, flash_crypt_wr_dis);
         return ESP_FAIL;
     }
@@ -200,11 +200,19 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
     ESP_LOGD(TAG, "All flash regions checked for encryption pass");
 
     /* Set least significant 0-bit in flash_crypt_cnt */
-    int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & 0xFF);
-    /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == 0xFF */
+    int ffs_inv = __builtin_ffs((~flash_crypt_cnt) & EFUSE_RD_FLASH_CRYPT_CNT);
+    /* ffs_inv shouldn't be zero, as zero implies flash_crypt_cnt == EFUSE_RD_FLASH_CRYPT_CNT (0x7F) */
     uint32_t new_flash_crypt_cnt = flash_crypt_cnt + (1 << (ffs_inv - 1));
     ESP_LOGD(TAG, "FLASH_CRYPT_CNT 0x%x -> 0x%x", flash_crypt_cnt, new_flash_crypt_cnt);
     REG_SET_FIELD(EFUSE_BLK0_WDATA0_REG, EFUSE_FLASH_CRYPT_CNT, new_flash_crypt_cnt);
+
+#ifdef CONFIG_FLASH_ENCRYPTION_DISABLE_PLAINTEXT
+    ESP_LOGI(TAG, "Write protecting FLASH_CRYPT_CNT efuse...");
+    REG_SET_BIT(EFUSE_BLK0_WDATA0_REG, EFUSE_WR_DIS_FLASH_CRYPT_CNT);
+#else
+    ESP_LOGW(TAG, "Not disabling FLASH_CRYPT_CNT - plaintext flashing is still possible");
+#endif
+
     esp_efuse_burn_new_values();
 
     ESP_LOGI(TAG, "Flash encryption completed");

components/bootloader_support/src/secure_boot_signatures.c

@@ -21,12 +21,7 @@
 
 #include "uECC.h"
 
-#ifdef BOOTLOADER_BUILD
-#include "rom/sha.h"
-typedef SHA_CTX sha_context;
-#else
-#include "hwcrypto/sha.h"
-#endif
+#include <sys/param.h>
 
 static const char* TAG = "secure_boot";
 
@@ -37,6 +32,9 @@ extern const uint8_t signature_verification_key_end[] asm("_binary_signature_ver
 
 #define DIGEST_LEN 32
 
+/* Mmap source address mask */
+#define MMAP_ALIGNED_MASK 0x0000FFFF
+
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
     uint8_t digest[DIGEST_LEN];
@@ -45,26 +43,44 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 
     ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
 
-    data = bootloader_mmap(src_addr, length + sizeof(esp_secure_boot_sig_block_t));
-    if(data == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr, length+sizeof(esp_secure_boot_sig_block_t));
-        return ESP_FAIL;
+    bootloader_sha256_handle_t handle = bootloader_sha256_start();
+
+    uint32_t free_page_count = bootloader_mmap_get_free_pages();
+    ESP_LOGD(TAG, "free data page_count 0x%08x", free_page_count);
+
+    int32_t data_len_remain = length;
+    uint32_t data_addr = src_addr;
+    while (data_len_remain > 0) {
+        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
+        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
+        uint32_t data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
+        data = (const uint8_t *) bootloader_mmap(data_addr, data_len);
+        if(!data) {
+            ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", data_addr, data_len);
+            bootloader_sha256_finish(handle, NULL);
+            return ESP_FAIL;
+        }
+        bootloader_sha256_data(handle, data, data_len);
+        bootloader_munmap(data);
+
+        data_addr += data_len;
+        data_len_remain -= data_len;
     }
 
-    // Calculate digest of main image
-#ifdef BOOTLOADER_BUILD
-    bootloader_sha256_handle_t handle = bootloader_sha256_start();
-    bootloader_sha256_data(handle, data, length);
+    /* Done! Get the digest */
     bootloader_sha256_finish(handle, digest);
-#else
-    /* Use thread-safe esp-idf SHA function */
-    esp_sha(SHA2_256, data, length, digest);
-#endif
 
-    // Map the signature block and verify the signature
-    sigblock = (const esp_secure_boot_sig_block_t *)(data + length);
+    // Map the signature block
+    sigblock = (const esp_secure_boot_sig_block_t *) bootloader_mmap(src_addr + length, sizeof(esp_secure_boot_sig_block_t));
+    if(!sigblock) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", src_addr + length, sizeof(esp_secure_boot_sig_block_t));
+        return ESP_FAIL;
+    }
+    // Verify the signature
     esp_err_t err = esp_secure_boot_verify_signature_block(sigblock, digest);
-    bootloader_munmap(data);
+    // Unmap
+    bootloader_munmap(sigblock);
+
     return err;
 }
 

components/bt/CMakeLists.txt

@@ -11,6 +11,7 @@ if(CONFIG_BT_ENABLED)
             bluedroid/bta/av/include
             bluedroid/bta/dm/include
             bluedroid/bta/gatt/include
+            bluedroid/bta/hf_client/include
             bluedroid/bta/hh/include
             bluedroid/bta/jv/include
             bluedroid/bta/sdp/include
@@ -93,6 +94,14 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/bta/jv/bta_jv_api.c"
                    "bluedroid/bta/jv/bta_jv_cfg.c"
                    "bluedroid/bta/jv/bta_jv_main.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_act.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_api.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_at.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_cmd.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_main.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_rfc.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_sco.c"
+                   "bluedroid/bta/hf_client/bta_hf_client_sdp.c"
                    "bluedroid/bta/sdp/bta_sdp.c"
                    "bluedroid/bta/sdp/bta_sdp_act.c"
                    "bluedroid/bta/sdp/bta_sdp_api.c"
@@ -122,6 +131,8 @@ if(CONFIG_BT_ENABLED)
                    "bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c"
                    "bluedroid/btc/profile/std/a2dp/btc_av.c"
                    "bluedroid/btc/profile/std/avrc/btc_avrc.c"
+                   "bluedroid/btc/profile/std/hf_client/btc_hf_client.c"
+                   "bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c"
                    "bluedroid/btc/profile/std/gap/btc_gap_ble.c"
                    "bluedroid/btc/profile/std/gap/btc_gap_bt.c"
                    "bluedroid/btc/profile/std/gatt/btc_gatt_common.c"

components/bt/Kconfig

@@ -53,6 +53,57 @@ config BTDM_CONTROLLER_BR_EDR_MAX_SYNC_CONN
         BR/EDR Synchronize maximum connections of bluetooth controller.
         Each connection uses 2KB static DRAM whenever the BT controller is enabled.
 
+choice BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH
+    prompt "BR/EDR Sync(SCO/eSCO) default data path"
+    depends on BTDM_CONTROLLER_MODE_BR_EDR_ONLY || BTDM_CONTROLLER_MODE_BTDM
+    default BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_PCM
+    help
+        SCO data path, i.e. HCI or PCM.
+        SCO data can be sent/received through HCI synchronous packets, or the data
+        can be routed to on-chip PCM module on ESP32. PCM input/output signals can
+        be "matrixed" to GPIOs. The default data path can also be set using API
+        "esp_bredr_sco_datapath_set"
+
+    config BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_HCI
+        bool "HCI"
+    config BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_PCM
+        bool "PCM"
+endchoice
+
+config BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_EFF
+    int
+    default 0 if BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_HCI
+    default 1 if BTDM_CONTROLLER_BR_EDR_SCO_DATA_PATH_PCM
+    default 0
+
+config BTDM_CONTROLLER_AUTO_LATENCY
+    bool "Auto latency"
+    depends on BTDM_CONTROLLER_MODE_BTDM
+    default n
+    help
+        BLE auto latency, used to enhance classic BT performance
+        while classic BT and BLE are enabled at the same time.
+
+config BTDM_CONTROLLER_AUTO_LATENCY_EFF
+    bool
+    default BTDM_CONTROLLER_AUTO_LATENCY if BTDM_CONTROLLER_MODE_BTDM
+    default n
+
+config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT
+    bool "Legacy Authentication Vendor Specific Event Enable"
+    depends on BTDM_CONTROLLER_MODE_BR_EDR_ONLY || BTDM_CONTROLLER_MODE_BTDM
+    default y
+    help
+        To protect from BIAS attack during Legacy authentication,
+        Legacy authentication Vendor specific event should be enabled
+
+
+config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT_EFF
+    bool
+    default BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT if BTDM_CONTROLLER_MODE_BR_EDR_ONLY || BTDM_CONTROLLER_MODE_BTDM
+    default 0
+
+
 config BTDM_CONTROLLER_BLE_MAX_CONN_EFF
     int
     default BTDM_CONTROLLER_BLE_MAX_CONN if BTDM_CONTROLLER_MODE_BLE_ONLY || BTDM_CONTROLLER_MODE_BTDM
@@ -135,7 +186,6 @@ config BTDM_CONTROLLER_MODEM_SLEEP
     default y
     help
         Enable/disable bluetooth controller low power mode.
-        Note that currently there is problem in the combination use of bluetooth modem sleep and Dynamic Frequency Scaling(DFS). So do not enable DFS if bluetooth modem sleep is in use.
 
 choice BTDM_MODEM_SLEEP_MODE
     prompt "Bluetooth Modem sleep mode"
@@ -146,11 +196,13 @@ choice BTDM_MODEM_SLEEP_MODE
 config BTDM_MODEM_SLEEP_MODE_ORIG
     bool "ORIG Mode(sleep with low power clock)"
     help
-        ORIG mode is a deep sleep mode that can be used for dual mode controller. In this mode, bluetooth controller sleeps between BR/EDR frames and BLE events. A low power clock is used to maintain bluetooth reference clock.
+        ORIG mode is a bluetooth sleep mode that can be used for dual mode controller. In this mode, bluetooth controller
+        sleeps between BR/EDR frames and BLE events. A low power clock is used to maintain bluetooth reference clock.
 config BTDM_MODEM_SLEEP_MODE_EVED
-    bool "EVED Mode "
+    bool "EVED Mode(For internal test only)"
     help
-        This mode is for BLE only.
+        EVED mode is for BLE only and is only for internal test. Do not use it for production. this mode is not compatible
+        with DFS nor light sleep
 endchoice
 
 choice BTDM_LOW_POWER_CLOCK
@@ -161,11 +213,14 @@ choice BTDM_LOW_POWER_CLOCK
 
 config BTDM_LPCLK_SEL_MAIN_XTAL
     bool "Main crystal"
+    help
+        Main crystal can be used as low power clock for bluetooth modem sleep. If this option is selected, bluetooth
+        modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but cannot work when light sleep is enabled.
+        Main crystal has a relatively better performance than other bluetooth low power clock sources.
 config BTDM_LPCLK_SEL_EXT_32K_XTAL
     bool "External 32kHz crystal"
     depends on ESP32_RTC_CLOCK_SOURCE_EXTERNAL_CRYSTAL
 endchoice
-
 endmenu
 
 config BLE_SCAN_DUPLICATE
@@ -180,16 +235,16 @@ choice SCAN_DUPLICATE_TYPE
     default SCAN_DUPLICATE_BY_DEVICE_ADDR
     depends on BLE_SCAN_DUPLICATE
     help
-        Scan duplicate have three ways. one is "Scan Duplicate By Device Address", This way is to use advertiser address 
-        filtering. The adv packet of the same address is only allowed to be reported once. Another way is "Scan Duplicate 
-        By Device Address And Advertising Data". This way is to use advertising data and device address filtering. All 
-        different adv packets with the same address are allowed to be reported. The last way is "Scan Duplicate By Advertising 
+        Scan duplicate have three ways. one is "Scan Duplicate By Device Address", This way is to use advertiser address
+        filtering. The adv packet of the same address is only allowed to be reported once. Another way is "Scan Duplicate
+        By Device Address And Advertising Data". This way is to use advertising data and device address filtering. All
+        different adv packets with the same address are allowed to be reported. The last way is "Scan Duplicate By Advertising
         Data". This way is to use advertising data filtering. All same advertising data only allow to be reported once even though
         they are from different devices.
 
 config SCAN_DUPLICATE_BY_DEVICE_ADDR
     bool "Scan Duplicate By Device Address"
-    help 
+    help
         This way is to use advertiser address filtering. The adv packet of the same address is only allowed to be reported once
 
 config SCAN_DUPLICATE_BY_ADV_DATA
@@ -201,7 +256,7 @@ config SCAN_DUPLICATE_BY_ADV_DATA
 config SCAN_DUPLICATE_BY_ADV_DATA_AND_DEVICE_ADDR
     bool "Scan Duplicate By Device Address And Advertising Data"
     help
-    This way is to use advertising data and device address filtering. All different adv packets with the same address are 
+    This way is to use advertising data and device address filtering. All different adv packets with the same address are
     allowed to be reported.
 endchoice
 
@@ -238,7 +293,54 @@ config MESH_DUPLICATE_SCAN_CACHE_SIZE
         Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
         When the maximum amount of device in the filter is reached, the cache will be refreshed.
 
+config BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED
+    bool "BLE adv report flow control supported"
+    depends on (BTDM_CONTROLLER_MODE_BTDM || BTDM_CONTROLLER_MODE_BLE_ONLY)
+    default y
+    help
+        The function is mainly used to enable flow control for advertising reports. When it is enabled,
+        advertising reports will be discarded by the controller if the number of unprocessed advertising
+        reports exceeds the size of BLE adv report flow control.
 
+config BLE_ADV_REPORT_FLOW_CONTROL_NUM
+    int "BLE adv report flow control number"
+    depends on BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED
+    range 50 1000
+    default 100
+    help
+        The number of unprocessed advertising report that Bluedroid can save.If you set
+        `BLE_ADV_REPORT_FLOW_CONTROL_NUM` to a small value, this may cause adv packets lost.
+        If you set `BLE_ADV_REPORT_FLOW_CONTROL_NUM` to a large value, Bluedroid may cache a
+        lot of adv packets and this may cause system memory run out. For example, if you set
+        it to 50, the maximum memory consumed by host is 35 * 50 bytes. Please set
+        `BLE_ADV_REPORT_FLOW_CONTROL_NUM` according to your system free memory and handle adv
+        packets as fast as possible, otherwise it will cause adv packets lost.
+
+config BLE_ADV_REPORT_DISCARD_THRSHOLD
+    int "BLE adv lost event threshold value"
+    depends on BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED
+    range 1 1000
+    default 20
+    help
+        When adv report flow control is enabled, The ADV lost event will be generated when the number
+        of ADV packets lost in the controller reaches this threshold. It is better to set a larger value.
+        If you set `BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
+        may cause adv packets lost more.
+
+menuconfig BTDM_COEX_BT_OPTIONS
+    bool "Coexistence Bluetooth Side Options"
+    depends on SW_COEXIST_ENABLE
+    default n
+    help
+        Options of Bluetooth Side of WiFi and bluetooth coexistence.
+
+config BTDM_COEX_BLE_ADV_HIGH_PRIORITY
+    bool "Improve BLE ADV priority for WiFi & BLE coexistence"
+    depends on BTDM_COEX_BT_OPTIONS
+    default n
+    help
+        Improve BLE ADV coexistence priority to make it better performance.
+        For example, BLE mesh need to enable this option to improve BLE adv performance.
 
 endmenu
 
@@ -277,6 +379,13 @@ config BTC_TASK_STACK_SIZE
     help
         This select btc task stack size
 
+config BTU_TASK_STACK_SIZE
+    int "Bluetooth Bluedroid Host Stack task stack size"
+    depends on BLUEDROID_ENABLED
+    default 4096
+    help
+        This select btu task stack size
+
 config BLUEDROID_MEM_DEBUG
     bool "Bluedroid memory debug"
     depends on BLUEDROID_ENABLED
@@ -331,15 +440,15 @@ endchoice
 choice HFP_AUDIO_DATA_PATH
     prompt "audio(SCO) data path"
     depends on HFP_ENABLE
+    help
+        SCO data path, i.e. HCI or PCM. This option is set using API
+        "esp_bredr_sco_datapath_set" in Bluetooth host. Default SCO data
+        path can also be set in Bluetooth Controller.
 
 config HFP_AUDIO_DATA_PATH_PCM
     bool "PCM"
-    help
-        This enables the Serial Port Profile
 config HFP_AUDIO_DATA_PATH_HCI
     bool "HCI"
-    help
-        This enables the Serial Port Profile
 endchoice
 
 config GATTS_ENABLE
@@ -396,6 +505,13 @@ config BLE_SMP_ENABLE
    help
        This option can be close when the app not used the ble security connect.
 
+config SMP_SLAVE_CON_PARAMS_UPD_ENABLE
+        bool "Slave enable connection parameters update during pairing"
+        depends on BLE_SMP_ENABLE
+        default n
+        help
+            In order to reduce the pairing time, slave actively initiates connection parameters update during pairing.
+
 config BT_STACK_NO_LOG
     bool "Disable BT debug logs (minimize bin size)"
     depends on BLUEDROID_ENABLED
@@ -1180,7 +1296,26 @@ config SMP_ENABLE
    depends on BLUEDROID_ENABLED
    default CLASSIC_BT_ENABLED || BLE_SMP_ENABLE
 
+config BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+    bool "Report adv data and scan response individually when BLE active scan"
+    depends on BLUEDROID_ENABLED && (BTDM_CONTROLLER_MODE_BTDM || BTDM_CONTROLLER_MODE_BLE_ONLY)
+    default n
+    help
+        Originally, when doing BLE active scan, Bluedroid will not report adv to application layer
+        until receive scan response. This option is used to disable the behavior. When enable this option,
+        Bluedroid will report adv data or scan response to application layer immediately.
+
 # Memory reserved at start of DRAM for Bluetooth stack
+
+config BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT
+        int "Timeout of BLE connection establishment"
+        depends on BLUEDROID_ENABLED
+        range 1 60
+        default 30
+        help
+            Bluetooth Connection establishment maximum time, if connection time exceeds this value, the connection
+            establishment fails, ESP_GATTC_OPEN_EVT or ESP_GATTS_OPEN_EVT is triggered.
+
 config BT_RESERVE_DRAM
     hex
     default 0xdb5c if BT_ENABLED

components/bt/bluedroid/api/esp_gap_ble_api.c

@@ -449,6 +449,73 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d
 
 }
 
+esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+    if (!device_info && type <= ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_LINK_ID) {
+        return ESP_ERR_INVALID_SIZE;
+    }
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST;
+    arg.update_duplicate_exceptional_list.subcode = ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_ADD;
+    arg.update_duplicate_exceptional_list.info_type = type;
+    if (device_info) {
+        memcpy(arg.update_duplicate_exceptional_list.device_info, device_info, sizeof(esp_bd_addr_t));
+    }
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+                == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+    if (!device_info && type <= ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_LINK_ID) {
+        return ESP_ERR_INVALID_SIZE;
+    }
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST;
+    arg.update_duplicate_exceptional_list.subcode = ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_REMOVE;
+    arg.update_duplicate_exceptional_list.info_type = type;
+    if (device_info) {
+        memcpy(arg.update_duplicate_exceptional_list.device_info, device_info, sizeof(esp_bd_addr_t));
+    }
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+                == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_gap_clean_duplicate_scan_exceptional_list(esp_duplicate_scan_exceptional_list_type_t list_type)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST;
+    arg.update_duplicate_exceptional_list.subcode = ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_CLEAN;
+    arg.update_duplicate_exceptional_list.info_type = list_type;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+                == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 #if (SMP_INCLUDED == TRUE)
 esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
         void *value, uint8_t len)

components/bt/bluedroid/api/esp_gatt_common_api.c

@@ -46,4 +46,13 @@ esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu)
     arg.set_mtu.mtu = mtu;
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatt_com_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
-}
+}
+
+#if (BLE_INCLUDED == TRUE)
+extern uint16_t L2CA_GetFreePktBufferNum_LE(void);
+
+uint16_t esp_ble_get_sendable_packets_num ()
+{
+    return L2CA_GetFreePktBufferNum_LE();
+}
+#endif

components/bt/bluedroid/api/esp_spp_api.c

@@ -95,6 +95,10 @@ esp_err_t esp_spp_connect(esp_spp_sec_t sec_mask,
     btc_spp_args_t arg;
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (sec_mask != ESP_SPP_SEC_NONE && sec_mask != ESP_SPP_SEC_AUTHORIZE && sec_mask != ESP_SPP_SEC_AUTHENTICATE) {
+        LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only\n");
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_SPP;
     msg.act = BTC_SPP_ACT_CONNECT;
@@ -133,6 +137,10 @@ esp_err_t esp_spp_start_srv(esp_spp_sec_t sec_mask,
         return ESP_ERR_INVALID_ARG;
     }
 
+    if (sec_mask != ESP_SPP_SEC_NONE && sec_mask != ESP_SPP_SEC_AUTHORIZE && sec_mask != ESP_SPP_SEC_AUTHENTICATE) {
+        LOG_WARN("Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only\n");
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_SPP;
     msg.act = BTC_SPP_ACT_START_SRV;

components/bt/bluedroid/api/include/api/esp_blufi_api.h

@@ -83,6 +83,7 @@ typedef enum {
     ESP_BLUFI_DH_PARAM_ERROR,
     ESP_BLUFI_READ_PARAM_ERROR,
     ESP_BLUFI_MAKE_PUBLIC_ERROR,
+    ESP_BLUFI_DATA_FORMAT_ERROR,
 } esp_blufi_error_state_t;
 
 /**

components/bt/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -161,6 +161,7 @@ typedef enum {
     ESP_GAP_BLE_GET_BOND_DEV_COMPLETE_EVT,                  /*!< When get the bond device list complete, the event comes */
     ESP_GAP_BLE_READ_RSSI_COMPLETE_EVT,                     /*!< When read the rssi complete, the event comes */
     ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT,              /*!< When add or remove whitelist complete, the event comes */
+    ESP_GAP_BLE_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_COMPLETE_EVT,  /*!< When update duplicate exceptional list complete, the event comes */
     ESP_GAP_BLE_EVT_MAX,
 } esp_gap_ble_cb_event_t;
 /// This is the old name, just for backwards compatibility
@@ -262,13 +263,23 @@ typedef enum {
 
 typedef enum {
     ESP_BLE_SM_PASSKEY = 0,
+    /* Authentication requirements of local device */
     ESP_BLE_SM_AUTHEN_REQ_MODE,
+    /* The IO capability of local device */
     ESP_BLE_SM_IOCAP_MODE,
+    /* Initiator Key Distribution/Generation */
     ESP_BLE_SM_SET_INIT_KEY,
+    /* Responder Key Distribution/Generation */
     ESP_BLE_SM_SET_RSP_KEY,
+    /* Maximum Encryption key size to support */
     ESP_BLE_SM_MAX_KEY_SIZE,
+    /* Minimum Encryption key size requirement from Peer */
+    ESP_BLE_SM_MIN_KEY_SIZE,
+    /* Set static Passkey */
     ESP_BLE_SM_SET_STATIC_PASSKEY,
+    /* Reset static Passkey */
     ESP_BLE_SM_CLEAR_STATIC_PASSKEY,
+    /* Accept only specified SMP Authentication requirement */
     ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH,
     ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;
@@ -286,7 +297,7 @@ typedef struct {
     esp_ble_adv_type_t      adv_type;           /*!< Advertising type */
     esp_ble_addr_type_t     own_addr_type;      /*!< Owner bluetooth device address type */
     esp_bd_addr_t           peer_addr;          /*!< Peer device bluetooth device address */
-    esp_ble_addr_type_t     peer_addr_type;     /*!< Peer device bluetooth device address type */
+    esp_ble_addr_type_t     peer_addr_type;     /*!< Peer device bluetooth device address type, only support public address type and random address type */
     esp_ble_adv_channel_t   channel_map;        /*!< Advertising channel map */
     esp_ble_adv_filter_t    adv_filter_policy;  /*!< Advertising filter policy */
 } esp_ble_adv_params_t;
@@ -303,9 +314,9 @@ typedef struct {
                                                     Value of 0xFFFF indicates no specific minimum.
                                                     Values not defined above are reserved for future use.*/
 
-    int                     max_interval;           /*!< Advertising data show slave preferred connection max interval. 
+    int                     max_interval;           /*!< Advertising data show slave preferred connection max interval.
                                                     The connection interval in the following manner:
-                                                    connIntervalmax = Conn_Interval_Max * 1.25 ms 
+                                                    connIntervalmax = Conn_Interval_Max * 1.25 ms
                                                     Conn_Interval_Max range: 0x0006 to 0x0C80
                                                     Conn_Interval_Max shall be equal to or greater than the Conn_Interval_Min.
                                                     Value of 0xFFFF indicates no specific maximum.
@@ -366,8 +377,8 @@ typedef struct {
                                                       Range: 0x0004 to 0x4000 Default: 0x0010 (10 ms)
                                                       Time = N * 0.625 msec
                                                       Time Range: 2.5 msec to 10240 msec */
-    esp_ble_scan_duplicate_t  scan_duplicate;       /*!< The Scan_Duplicates parameter controls whether the Link Layer should filter out 
-                                                        duplicate advertising reports (BLE_SCAN_DUPLICATE_ENABLE) to the Host, or if the Link Layer should generate 
+    esp_ble_scan_duplicate_t  scan_duplicate;       /*!< The Scan_Duplicates parameter controls whether the Link Layer should filter out
+                                                        duplicate advertising reports (BLE_SCAN_DUPLICATE_ENABLE) to the Host, or if the Link Layer should generate
                                                         advertising reports for each packet received */
 } esp_ble_scan_params_t;
 
@@ -552,6 +563,7 @@ typedef enum {
     ESP_GAP_SEARCH_DISC_CMPL_EVT           = 4,      /*!< Discovery complete. */
     ESP_GAP_SEARCH_DI_DISC_CMPL_EVT        = 5,      /*!< Discovery complete. */
     ESP_GAP_SEARCH_SEARCH_CANCEL_CMPL_EVT  = 6,      /*!< Search cancelled */
+    ESP_GAP_SEARCH_INQ_DISCARD_NUM_EVT     = 7,      /*!< The number of pkt discarded by flow control */
 } esp_gap_search_evt_t;
 
 /**
@@ -570,6 +582,34 @@ typedef enum{
     ESP_BLE_WHITELIST_REMOVE     = 0X00,    /*!< remove mac from whitelist */
     ESP_BLE_WHITELIST_ADD        = 0X01,    /*!< add address to whitelist */
 }esp_ble_wl_opration_t;
+
+typedef enum {
+    ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_ADD      = 0,  /*!< Add device info into duplicate scan exceptional list */
+    ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_REMOVE,        /*!< Remove device info from duplicate scan exceptional list */
+    ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_CLEAN,         /*!< Clean duplicate scan exceptional list */
+} esp_bt_duplicate_exceptional_subcode_type_t;
+
+#define BLE_BIT(n) (1UL<<(n))
+
+typedef enum {
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_ADV_ADDR       = 0,  /*!< BLE advertising address , device info will be added into ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ADDR_LIST */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_LINK_ID,        /*!< BLE mesh link ID, it is for BLE mesh, device info will be added into ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_LINK_ID_LIST */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_BEACON_TYPE,    /*!< BLE mesh beacon AD type, the format is | Len | 0x2B | Beacon Type | Beacon Data | */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_PROV_SRV_ADV,   /*!< BLE mesh provisioning service uuid, the format is | 0x02 | 0x01 | flags | 0x03 | 0x03 | 0x1827 | .... |` */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_INFO_MESH_PROXY_SRV_ADV,  /*!< BLE mesh adv with proxy service uuid, the format is | 0x02 | 0x01 | flags | 0x03 | 0x03 | 0x1828 | .... |` */
+} esp_ble_duplicate_exceptional_info_type_t;
+
+typedef enum {
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ADDR_LIST                  = BLE_BIT(0),             /*!< duplicate scan exceptional addr list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_LINK_ID_LIST          = BLE_BIT(1),             /*!< duplicate scan exceptional mesh link ID list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_BEACON_TYPE_LIST      = BLE_BIT(2),             /*!< duplicate scan exceptional mesh beacon type list */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_PROV_SRV_ADV_LIST     = BLE_BIT(3),             /*!< duplicate scan exceptional mesh adv with provisioning service uuid */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_MESH_PROXY_SRV_ADV_LIST    = BLE_BIT(4),             /*!< duplicate scan exceptional mesh adv with provisioning service uuid */
+    ESP_BLE_DUPLICATE_SCAN_EXCEPTIONAL_ALL_LIST                   = 0xFFFF,                 /*!< duplicate scan exceptional all list */
+} esp_duplicate_scan_exceptional_list_type_t;
+
+typedef uint8_t esp_duplicate_info_t[ESP_BD_ADDR_LEN];
+
 /**
  * @brief Gap callback parameters union
  */
@@ -607,6 +647,7 @@ typedef union {
         int num_resps;                              /*!< Scan result number */
         uint8_t adv_data_len;                       /*!< Adv data length */
         uint8_t scan_rsp_len;                       /*!< Scan response length */
+        uint32_t num_dis;                          /*!< The number of discard packets */
     } scan_rst;                                     /*!< Event parameter of ESP_GAP_BLE_SCAN_RESULT_EVT */
     /**
      * @brief ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT
@@ -715,6 +756,15 @@ typedef union {
         esp_bt_status_t status;                     /*!< Indicate the add or remove whitelist operation success status */
         esp_ble_wl_opration_t wl_opration;          /*!< The value is ESP_BLE_WHITELIST_ADD if add address to whitelist operation success, ESP_BLE_WHITELIST_REMOVE if remove address from the whitelist operation success */
     } update_whitelist_cmpl;                        /*!< Event parameter of ESP_GAP_BLE_UPDATE_WHITELIST_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_COMPLETE_EVT
+     */
+    struct ble_update_duplicate_exceptional_list_cmpl_evt_param {
+        esp_bt_status_t status;                     /*!< Indicate update duplicate scan exceptional list operation success status */
+        uint8_t         subcode;                    /*!< Define in esp_bt_duplicate_exceptional_subcode_type_t */
+        uint16_t         length;                     /*!< The length of device_info */
+        esp_duplicate_info_t device_info;           /*!< device information, when subcode is ESP_BLE_DUPLICATE_EXCEPTIONAL_LIST_CLEAN, the value is invalid */
+    } update_duplicate_exceptional_list_cmpl;       /*!< Event parameter of ESP_GAP_BLE_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_COMPLETE_EVT */
 } esp_ble_gap_cb_param_t;
 
 /**
@@ -962,8 +1012,7 @@ esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t
  * @param[in]       type   - finding ADV data type
  * @param[out]      length - return the length of ADV data not including type
  *
- * @return          - ESP_OK : success
- *                  - other  : failed
+ * @return          pointer of ADV data
  *
  */
 uint8_t *esp_ble_resolve_adv_data(uint8_t *adv_data, uint8_t type, uint8_t *length);
@@ -1008,6 +1057,45 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d
  */
 esp_err_t esp_ble_gap_read_rssi(esp_bd_addr_t remote_addr);
 
+/**
+ * @brief           This function is called to add a device info into the duplicate scan exceptional list.
+ *
+ *
+ * @param[in]       type: device info type, it is defined in esp_ble_duplicate_exceptional_info_type_t
+ *                  when type is MESH_BEACON_TYPE, MESH_PROV_SRV_ADV or MESH_PROXY_SRV_ADV , device_info is invalid.
+ * @param[in]       device_info: the device information.
+ * @return
+ *                  - ESP_OK : success
+ *                  - other  : failed
+ */
+esp_err_t esp_ble_gap_add_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info);
+
+/**
+ * @brief           This function is called to remove a device info from the duplicate scan exceptional list.
+ *
+ *
+ * @param[in]       type: device info type, it is defined in esp_ble_duplicate_exceptional_info_type_t
+ *                  when type is MESH_BEACON_TYPE, MESH_PROV_SRV_ADV or MESH_PROXY_SRV_ADV , device_info is invalid.
+ * @param[in]       device_info: the device information.
+ * @return
+ *                  - ESP_OK : success
+ *                  - other  : failed
+ */
+esp_err_t esp_ble_gap_remove_duplicate_scan_exceptional_device(esp_ble_duplicate_exceptional_info_type_t type, esp_duplicate_info_t device_info);
+
+/**
+ * @brief           This function is called to clean the duplicate scan exceptional list.
+ *                  This API will delete all device information in the duplicate scan exceptional list.
+ *
+ *
+ * @param[in]       list_type: duplicate scan exceptional list type, the value can be one or more of esp_duplicate_scan_exceptional_list_type_t.
+ *
+ * @return
+ *                  - ESP_OK : success
+ *                  - other  : failed
+ */
+esp_err_t esp_ble_gap_clean_duplicate_scan_exceptional_list(esp_duplicate_scan_exceptional_list_type_t list_type);
+
 #if (SMP_INCLUDED == TRUE)
 /**
 * @brief             Set a GAP security parameter value. Overrides the default value.

components/bt/bluedroid/api/include/api/esp_gatt_common_api.h

@@ -44,6 +44,10 @@ extern "C" {
  */
 extern esp_err_t esp_ble_gatt_set_local_mtu (uint16_t mtu);
 
+#if (BLE_INCLUDED == TRUE)
+extern uint16_t esp_ble_get_sendable_packets_num (void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/bt/bluedroid/api/include/api/esp_gatt_defs.h

@@ -34,7 +34,7 @@ extern "C" {
  * All "ESP_GATT_UUID_xxx" is attribute types
  */
 #define ESP_GATT_UUID_IMMEDIATE_ALERT_SVC           0x1802          /*  Immediate alert Service*/
-#define ESP_GATT_UUID_LINK_LOSS_SVC                 0x1803          /*  Link Loss Service*/                             
+#define ESP_GATT_UUID_LINK_LOSS_SVC                 0x1803          /*  Link Loss Service*/
 #define ESP_GATT_UUID_TX_POWER_SVC                  0x1804          /*  TX Power Service*/
 #define ESP_GATT_UUID_CURRENT_TIME_SVC              0x1805          /*  Current Time Service Service*/
 #define ESP_GATT_UUID_REF_TIME_UPDATE_SVC           0x1806          /*  Reference Time Update Service*/
@@ -68,8 +68,14 @@ extern "C" {
 #define ESP_GATT_UUID_CHAR_PRESENT_FORMAT           0x2904          /*  Characteristic Presentation Format*/
 #define ESP_GATT_UUID_CHAR_AGG_FORMAT               0x2905          /*  Characteristic Aggregate Format*/
 #define ESP_GATT_UUID_CHAR_VALID_RANGE              0x2906          /*  Characteristic Valid Range */
-#define ESP_GATT_UUID_EXT_RPT_REF_DESCR             0x2907
-#define ESP_GATT_UUID_RPT_REF_DESCR                 0x2908
+#define ESP_GATT_UUID_EXT_RPT_REF_DESCR             0x2907          /*  External Report Reference */
+#define ESP_GATT_UUID_RPT_REF_DESCR                 0x2908          /*  Report Reference */
+#define ESP_GATT_UUID_NUM_DIGITALS_DESCR            0x2909          /*  Number of Digitals */
+#define ESP_GATT_UUID_VALUE_TRIGGER_DESCR           0x290A          /*  Value Trigger Setting */
+#define ESP_GATT_UUID_ENV_SENSING_CONFIG_DESCR      0x290B          /*  Environmental Sensing Configuration */
+#define ESP_GATT_UUID_ENV_SENSING_MEASUREMENT_DESCR 0x290C          /*  Environmental Sensing Measurement */
+#define ESP_GATT_UUID_ENV_SENSING_TRIGGER_DESCR     0x290D          /*  Environmental Sensing Trigger Setting */
+#define ESP_GATT_UUID_TIME_TRIGGER_DESCR            0x290E          /*  Time Trigger Setting */
 
 /* GAP Profile Attributes */
 #define ESP_GATT_UUID_GAP_DEVICE_NAME               0x2A00
@@ -299,7 +305,7 @@ typedef enum {
  * @brief Attribute description (used to create database)
  */
  typedef struct
- {   
+ {
      uint16_t uuid_length;              /*!< UUID length */
      uint8_t  *uuid_p;                  /*!< UUID value */
      uint16_t perm;                     /*!< Attribute permission */
@@ -348,23 +354,23 @@ typedef struct
 /**
   * @brief Gatt  include service entry element
   */
-typedef struct 
+typedef struct
 {
-    uint16_t start_hdl;                                     /*!< Gatt  start handle value of included service */
-    uint16_t end_hdl;                                       /*!< Gatt  end handle value of included service */
-    uint16_t uuid;                                          /*!< Gatt  attribute value UUID of included service */
+    uint16_t start_hdl;                                     /*!< Gatt start handle value of included service */
+    uint16_t end_hdl;                                       /*!< Gatt end handle value of included service */
+    uint16_t uuid;                                          /*!< Gatt attribute value UUID of included service */
 } esp_gatts_incl_svc_desc_t;                                /*!< Gatt include service entry element */
 
 /**
   * @brief Gatt  include 128 bit service entry element
   */
-typedef struct 
+typedef struct
 {
-    uint16_t start_hdl;                                     /*!< Gatt  start handle value of included 128 bit service */
-    uint16_t end_hdl;                                       /*!< Gatt  end handle value of included 128 bit service */
-} esp_gatts_incl128_svc_desc_t;                             /*!< Gatt  include 128 bit service entry element */
+    uint16_t start_hdl;                                     /*!< Gatt start handle value of included 128 bit service */
+    uint16_t end_hdl;                                       /*!< Gatt end handle value of included 128 bit service */
+} esp_gatts_incl128_svc_desc_t;                             /*!< Gatt include 128 bit service entry element */
 
-/// Gatt attribute value 
+/// Gatt attribute value
 typedef struct {
     uint8_t           value[ESP_GATT_MAX_ATTR_LEN];         /*!< Gatt attribute value */
     uint16_t          handle;                               /*!< Gatt attribute handle */
@@ -426,8 +432,8 @@ typedef struct {
 /**
   * @brief service element
   */
-typedef struct { 
-    bool                        is_primary;                 /*!< The service flag, true if the service is primary service, else is secondly service */
+typedef struct {
+    bool                        is_primary;                 /*!< The service flag, true if the service is primary service, else is secondary service */
     uint16_t                    start_handle;               /*!< The start handle of the service */
     uint16_t                    end_handle;                 /*!< The end handle of the service */
     esp_bt_uuid_t               uuid;                       /*!< The uuid of the service */

components/bt/bluedroid/api/include/api/esp_hf_client_api.h

@@ -251,9 +251,9 @@ typedef union {
 } esp_hf_client_cb_param_t;
 
 /**
- * @brief           HFP client incoming data callback function, the callback is useful in case of 
+ * @brief           HFP client incoming data callback function, the callback is useful in case of
  *                  Voice Over HCI.
- * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the 
+ * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the
  *                  buffer is allocated inside bluetooth protocol stack and will be released after
  *                  invoke of the callback is finished.
  * @param[in]       len : size(in bytes) in buf
@@ -261,13 +261,13 @@ typedef union {
 typedef void (* esp_hf_client_incoming_data_cb_t)(const uint8_t *buf, uint32_t len);
 
 /**
- * @brief           HFP client outgoing data callback function, the callback is useful in case of 
- *                  Voice Over HCI. Once audio connection is set up and the application layer has 
- *                  prepared data to send, the lower layer will call this function to read data 
+ * @brief           HFP client outgoing data callback function, the callback is useful in case of
+ *                  Voice Over HCI. Once audio connection is set up and the application layer has
+ *                  prepared data to send, the lower layer will call this function to read data
  *                  and then send. This callback is supposed to be implemented as non-blocking,
  *                  and if data is not enough, return value 0 is supposed.
- *                  
- * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the 
+ *
+ * @param[in]       buf : pointer to incoming data(payload of HCI synchronous data packet), the
  *                  buffer is allocated inside bluetooth protocol stack and will be released after
  *                  invoke of the callback is finished.
  * @param[in]       len : size(in bytes) in buf
@@ -326,7 +326,7 @@ esp_err_t esp_hf_client_deinit(void);
 
 /**
  *
- * @brief           Connect to remote bluetooth HFP audio gateway(AG) device, must after esp_a2d_hf_client_init()
+ * @brief           Connect to remote bluetooth HFP audio gateway(AG) device, must after esp_hf_client_init()
  *
  * @param[in]       remote_bda: remote bluetooth device address
  *
@@ -606,7 +606,7 @@ void esp_hf_client_outgoing_data_ready(void);
 
 /**
  * @brief           Initialize the down sampling converter. This is a utility function that can
- *                  only be used in the case that Voice Over HCI is enabled. 
+ *                  only be used in the case that Voice Over HCI is enabled.
  *
  * @param[in]       src_sps: original samples per second(source audio data, i.e. 48000, 32000,
  *                  16000, 44100, 22050, 11025)

components/bt/bluedroid/api/include/api/esp_spp_api.h

@@ -30,7 +30,7 @@ typedef enum {
     ESP_SPP_NO_RESOURCE             /*!< No more set pm control block */
 } esp_spp_status_t;
 
-/* Security Setting Mask */
+/* Security Setting Mask, Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.*/
 #define ESP_SPP_SEC_NONE            0x0000    /*!< No security. relate to BTA_SEC_NONE in bta/bta_api.h */
 #define ESP_SPP_SEC_AUTHORIZE       0x0001    /*!< Authorization required (only needed for out going connection ) relate to BTA_SEC_AUTHORIZE in bta/bta_api.h*/
 #define ESP_SPP_SEC_AUTHENTICATE    0x0012    /*!< Authentication required.  relate to BTA_SEC_AUTHENTICATE in bta/bta_api.h*/
@@ -190,8 +190,7 @@ esp_err_t esp_spp_register_callback(esp_spp_cb_t callback);
 /**
  * @brief       This function is called to init SPP.
  *
- * @param[in]   mode: Choose the mode of SPP, ESP_SPP_MODE_CB or ESP_SPP_MODE_CB.
- *                    Now only supports ESP_SPP_MODE_CB mode, we will continue to update.
+ * @param[in]   mode: Choose the mode of SPP, ESP_SPP_MODE_CB or ESP_SPP_MODE_VFS.
  *
  * @return
  *              - ESP_OK: success
@@ -230,7 +229,7 @@ esp_err_t esp_spp_start_discovery(esp_bd_addr_t bd_addr);
  *              When the connection is established or failed,
  *              the callback is called with ESP_SPP_OPEN_EVT.
  *
- * @param[in]   sec_mask:     Security Setting Mask .
+ * @param[in]   sec_mask:     Security Setting Mask. Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.
  * @param[in]   role:         Master or slave.
  * @param[in]   remote_scn:   Remote device bluetooth device SCN.
  * @param[in]   peer_bd_addr: Remote device bluetooth device address.
@@ -261,7 +260,7 @@ esp_err_t esp_spp_disconnect(uint32_t handle);
  *              When the connection is established, the callback is called
  *              with ESP_SPP_SRV_OPEN_EVT.
  *
- * @param[in]   sec_mask:     Security Setting Mask .
+ * @param[in]   sec_mask:     Security Setting Mask. Security Setting Mask. Suggest to use ESP_SPP_SEC_NONE, ESP_SPP_SEC_AUTHORIZE or ESP_SPP_SEC_AUTHENTICATE only.
  * @param[in]   role:         Master or slave.
  * @param[in]   local_scn:    The specific channel you want to get.
  *                            If channel is 0, means get any channel.

components/bt/bluedroid/bta/av/bta_av_aact.c

@@ -1293,9 +1293,10 @@ void bta_av_setconfig_rsp (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
             /* if SBC is used by the SNK as INT, discover req is not sent in bta_av_config_ind.
                        * call disc_res now */
             /* this is called in A2DP SRC path only, In case of SINK we don't need it  */
-            if (local_sep == AVDT_TSEP_SRC)
+            if (local_sep == AVDT_TSEP_SRC) {
                 p_scb->p_cos->disc_res(p_scb->hndl, num, num, 0, p_scb->peer_addr,
                                        UUID_SERVCLASS_AUDIO_SOURCE);
+            }
         } else {
             /* we do not know the peer device and it is using non-SBC codec
              * we need to know all the SEPs on SNK */

components/bt/bluedroid/bta/av/bta_av_act.c

@@ -829,10 +829,11 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
             if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR) {
                 p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
 #if (AVRC_METADATA_INCLUDED == TRUE)
-                if (p_cb->features & BTA_AV_FEAT_METADATA)
+                if (p_cb->features & BTA_AV_FEAT_METADATA) {
                     p_data->rc_msg.msg.hdr.ctype =
                         bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
                                                     p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
+                }
 #endif
             } else {
                 p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
@@ -890,7 +891,9 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
                 evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
             } else
 #endif
+            {
                 evt = BTA_AV_VENDOR_CMD_EVT;
+            }
         }
         /* else if configured to support vendor specific and it's a response */
         else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
@@ -902,7 +905,9 @@ void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
                 evt = BTA_AV_META_MSG_EVT;
             } else
 #endif
+            {
                 evt = BTA_AV_VENDOR_RSP_EVT;
+            }
 
         }
         /* else if not configured to support vendor specific and it's a command */

components/bt/bluedroid/bta/av/bta_av_api.c

@@ -114,7 +114,7 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
         p_buf->hdr.layer_specific   = chnl;
         p_buf->hdr.event = BTA_AV_API_REGISTER_EVT;
         if (p_service_name) {
-            BCM_STRNCPY_S(p_buf->p_service_name, sizeof(p_buf->p_service_name), p_service_name, BTA_SERVICE_NAME_LEN);
+            BCM_STRNCPY_S(p_buf->p_service_name, p_service_name, BTA_SERVICE_NAME_LEN);
             p_buf->p_service_name[BTA_SERVICE_NAME_LEN - 1] = 0;
         } else {
             p_buf->p_service_name[0] = 0;

components/bt/bluedroid/bta/av/bta_av_cfg.c

@@ -40,8 +40,9 @@ const UINT32  bta_av_meta_caps_co_ids[] = {
     AVRC_CO_BROADCOM
 };
 
-/* AVRCP cupported categories */
-#define BTA_AV_RC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
+/* AVRCP supported categories */
+#define BTA_AV_RC_SNK_SUPF_CT       (AVRC_SUPF_CT_CAT1)
+#define BTA_AV_RC_SRC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
 
 /* Added to modify
 **  1. flush timeout
@@ -62,9 +63,11 @@ const UINT16  bta_av_audio_flush_to[] = {
 /* Note: Android doesnt support AVRC_SUPF_TG_GROUP_NAVI  */
 /* Note: if AVRC_SUPF_TG_GROUP_NAVI is set, bta_av_cfg.avrc_group should be TRUE */
 #if AVRC_METADATA_INCLUDED == TRUE
-#define BTA_AV_RC_SUPF_TG       (AVRC_SUPF_TG_CAT1) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
+#define BTA_AV_RC_SNK_SUPF_TG       (AVRC_SUPF_TG_CAT2) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
+#define BTA_AV_RC_SRC_SUPF_TG       (AVRC_SUPF_TG_CAT1) /* TODO: | AVRC_SUPF_TG_APP_SETTINGS) */
 #else
-#define BTA_AV_RC_SUPF_TG       (AVRC_SUPF_TG_CAT1)
+#define BTA_AV_RC_SNK_SUPF_TG       (AVRC_SUPF_TG_CAT2)
+#define BTA_AV_RC_SRC_SUPF_TG       (AVRC_SUPF_TG_CAT1)
 #endif
 
 /*
@@ -95,8 +98,10 @@ const tBTA_AV_CFG bta_av_cfg = {
     48,                     /* AVRCP MTU at L2CAP for control channel */
 #endif
     BTA_AV_MAX_RC_BR_MTU,   /* AVRCP MTU at L2CAP for browsing channel */
-    BTA_AV_RC_SUPF_CT,      /* AVRCP controller categories */
-    BTA_AV_RC_SUPF_TG,      /* AVRCP target categories */
+    BTA_AV_RC_SNK_SUPF_CT,  /* AVRCP controller categories as SNK */
+    BTA_AV_RC_SNK_SUPF_TG,  /* AVRCP target categories as SNK */
+    BTA_AV_RC_SRC_SUPF_CT,  /* AVRCP controller categories as SRC */
+    BTA_AV_RC_SRC_SUPF_TG,  /* AVRCP target categories as SRC */
     672,                    /* AVDTP signaling channel MTU at L2CAP */
     BTA_AV_MAX_A2DP_MTU,    /* AVDTP audio transport channel MTU at L2CAP */
     bta_av_audio_flush_to,  /* AVDTP audio transport channel flush timeout */

components/bt/bluedroid/bta/av/bta_av_main.c

@@ -483,8 +483,7 @@ static void bta_av_api_sink_enable(tBTA_AV_DATA *p_data)
     activate_sink = p_data->hdr.layer_specific;
     APPL_TRACE_DEBUG("bta_av_api_sink_enable %d \n", activate_sink)
     char p_service_name[BTA_SERVICE_NAME_LEN + 1];
-    BCM_STRNCPY_S(p_service_name, sizeof(p_service_name),
-                  BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    BCM_STRNCPY_S(p_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
 
     if (activate_sink) {
         AVDT_SINK_Activate();
@@ -526,7 +525,7 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
     tBTA_UTL_COD    cod;
     UINT8           index = 0;
     char p_avk_service_name[BTA_SERVICE_NAME_LEN + 1];
-    BCM_STRNCPY_S(p_avk_service_name, sizeof(p_avk_service_name), BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    BCM_STRNCPY_S(p_avk_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
 
     memset(&cs, 0, sizeof(tAVDT_CS));
 
@@ -571,9 +570,13 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
                 bta_ar_reg_avct(p_bta_av_cfg->avrc_mtu, p_bta_av_cfg->avrc_br_mtu,
                                 (UINT8)(bta_av_cb.sec_mask & (~BTA_SEC_AUTHORIZE)), BTA_ID_AV);
 #endif
-
-                bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
-                                p_bta_av_cfg->avrc_tg_cat, BTA_ID_AV);
+                if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
+                                p_bta_av_cfg->avrc_src_tg_cat, BTA_ID_AV);
+                } else {
+                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REM_CTRL_TARGET, "AV Remote Control Target\n", NULL,
+                                p_bta_av_cfg->avrc_snk_tg_cat, BTA_ID_AV);
+                }
 #endif
             }
 
@@ -707,8 +710,13 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
                     }
 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
                     /* create an SDP record as AVRC CT. */
-                    bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL, NULL,
-                                    p_bta_av_cfg->avrc_ct_cat, BTA_ID_AV);
+                    if (p_data->api_reg.tsep == AVDT_TSEP_SRC) {
+                        bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, "AV Remote Control Controller\n", NULL,
+                                    p_bta_av_cfg->avrc_src_ct_cat, BTA_ID_AV);
+                    } else {
+                        bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, "AV Remote Control Controller\n", NULL,
+                                    p_bta_av_cfg->avrc_snk_ct_cat, BTA_ID_AV);
+                    }
 #endif
                 }
             }
@@ -1268,7 +1276,7 @@ BOOLEAN bta_av_hdl_event(BT_HDR *p_msg)
 ** Returns          char *
 **
 *******************************************************************************/
-static char *bta_av_st_code(UINT8 state)
+UNUSED_ATTR static char *bta_av_st_code(UINT8 state)
 {
     switch (state) {
     case BTA_AV_INIT_ST: return "INIT";

components/bt/bluedroid/bta/av/bta_av_ssm.c

@@ -28,6 +28,7 @@
 #include <string.h>
 #include "bta/bta_av_co.h"
 #include "bta_av_int.h"
+#include "osi/osi.h"
 
 /*****************************************************************************
 ** Constants and types
@@ -564,7 +565,7 @@ void bta_av_set_scb_sst_incoming (tBTA_AV_SCB *p_scb)
 ** Returns          char *
 **
 *******************************************************************************/
-static char *bta_av_sst_code(UINT8 state)
+UNUSED_ATTR static char *bta_av_sst_code(UINT8 state)
 {
     switch (state) {
     case BTA_AV_INIT_SST: return "INIT";

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -61,7 +61,7 @@ static void bta_dm_sdp_callback (UINT16 sdp_status);
 #if (SMP_INCLUDED == TRUE)
 static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, UINT8 *service_name, UINT8 service_id, BOOLEAN is_originator);
 static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, BOOLEAN min_16_digit);
-static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type);
+static UINT8 bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, LINK_KEY key, UINT8 key_type, BOOLEAN sc_support);
 static UINT8 bta_dm_authentication_complete_cback(BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_name, int result);
 #endif  ///SMP_INCLUDED == TRUE
 static void bta_dm_local_name_cback(BD_ADDR bd_addr);
@@ -127,6 +127,7 @@ static void bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr);
 #endif  ///SMP_INCLUDED == TRUE
 static void bta_dm_observe_results_cb(tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir);
 static void bta_dm_observe_cmpl_cb(void *p_result);
+static void bta_dm_observe_discard_cb (uint32_t num_dis);
 static void bta_dm_delay_role_switch_cback(TIMER_LIST_ENT *p_tle);
 extern void sdpu_uuid16_to_uuid128(UINT16 uuid16, UINT8 *p_uuid128);
 static void bta_dm_disable_timer_cback(TIMER_LIST_ENT *p_tle);
@@ -322,6 +323,9 @@ void bta_dm_deinit_cb(void)
     }
 #endif
     memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreGive(deinit_semaphore);
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 /*******************************************************************************
@@ -635,13 +639,15 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
 
     /* set modes for Discoverability and connectability if not ignore */
     if (p_data->set_visibility.disc_mode != (BTA_DM_IGNORE | BTA_DM_LE_IGNORE)) {
-        if ((p_data->set_visibility.disc_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE)
+        if ((p_data->set_visibility.disc_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE) {
             p_data->set_visibility.disc_mode =
                 ((p_data->set_visibility.disc_mode & ~BTA_DM_LE_IGNORE) | le_disc_mode);
+        }
 
-        if ((p_data->set_visibility.disc_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE)
+        if ((p_data->set_visibility.disc_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE) {
             p_data->set_visibility.disc_mode =
                 ((p_data->set_visibility.disc_mode & ~BTA_DM_IGNORE) | disc_mode);
+        }
 
         BTM_SetDiscoverability(p_data->set_visibility.disc_mode,
                                bta_dm_cb.inquiry_scan_window,
@@ -649,13 +655,15 @@ void bta_dm_set_visibility(tBTA_DM_MSG *p_data)
     }
 
     if (p_data->set_visibility.conn_mode != (BTA_DM_IGNORE | BTA_DM_LE_IGNORE)) {
-        if ((p_data->set_visibility.conn_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE)
+        if ((p_data->set_visibility.conn_mode & BTA_DM_LE_IGNORE) == BTA_DM_LE_IGNORE) {
             p_data->set_visibility.conn_mode =
                 ((p_data->set_visibility.conn_mode & ~BTA_DM_LE_IGNORE) | le_conn_mode);
+        }
 
-        if ((p_data->set_visibility.conn_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE)
+        if ((p_data->set_visibility.conn_mode & BTA_DM_IGNORE) == BTA_DM_IGNORE) {
             p_data->set_visibility.conn_mode =
                 ((p_data->set_visibility.conn_mode & ~BTA_DM_IGNORE) | conn_mode);
+        }
 
         BTM_SetConnectability(p_data->set_visibility.conn_mode,
                               bta_dm_cb.page_scan_window,
@@ -815,7 +823,7 @@ void bta_dm_add_device (tBTA_DM_MSG *p_data)
 
     if (!BTM_SecAddDevice (p_dev->bd_addr, p_dc, p_dev->bd_name, p_dev->features,
                            trusted_services_mask, p_lc, p_dev->key_type, p_dev->io_cap,
-                           p_dev->pin_length)) {
+                           p_dev->pin_length, p_dev->sc_support)) {
         APPL_TRACE_ERROR ("BTA_DM: Error adding device %08x%04x",
                           (p_dev->bd_addr[0] << 24) + (p_dev->bd_addr[1] << 16) + (p_dev->bd_addr[2] << 8) + p_dev->bd_addr[3],
                           (p_dev->bd_addr[4] << 8) + p_dev->bd_addr[5]);
@@ -1664,7 +1672,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
                         if (SDP_FindServiceUUIDInRec(p_sdp_rec, &service_uuid)) {
                             /* send result back to app now, one by one */
                             bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN));
+                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
                             result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
                             result.disc_ble_res.service.len = service_uuid.len;
                             result.disc_ble_res.service.uu.uuid16 = service_uuid.uu.uuid16;
@@ -1805,8 +1813,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
 
                 }
                 bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                              bta_dm_get_remname(), (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
                 /* make sure the string is null terminated */
                 p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -1832,8 +1839,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
             p_msg->disc_result.result.disc_res.result = BTA_FAILURE;
             p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is null terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -1885,10 +1891,12 @@ void bta_dm_disc_result (tBTA_DM_MSG *p_data)
 
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
     /* if any BR/EDR service discovery has been done, report the event */
-    if ((bta_dm_search_cb.services & ((BTA_ALL_SERVICE_MASK | BTA_USER_SERVICE_MASK ) & ~BTA_BLE_SERVICE_MASK)))
-#endif
+    if ((bta_dm_search_cb.services & ((BTA_ALL_SERVICE_MASK | BTA_USER_SERVICE_MASK ) & ~BTA_BLE_SERVICE_MASK))) {
         bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);
-
+    }
+#else
+    bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);
+#endif
     tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *) osi_malloc(sizeof(tBTA_DM_MSG));
 
     /* send a message to change state */
@@ -2154,9 +2162,10 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
                         }
 
                         /* last one? clear the BLE service bit if all discovery has been done */
-                        if (bta_dm_search_cb.uuid_to_search == 0)
+                        if (bta_dm_search_cb.uuid_to_search == 0) {
                             bta_dm_search_cb.services_to_search &=
                                 (tBTA_SERVICE_MASK)(~(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index)));
+                        }
 
                     } else
 #endif
@@ -2214,8 +2223,7 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
             p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
             p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2400,8 +2408,7 @@ static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
         p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
         p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
         bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,  sizeof(BD_NAME),
-                      (char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, (char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
 
         /* make sure the string is terminated */
         p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2545,7 +2552,7 @@ static void bta_dm_service_search_remname_cback (BD_ADDR bd_addr, DEV_CLASS dc,
             rem_name.length = (BD_NAME_LEN - 1);
             rem_name.remote_bd_name[(BD_NAME_LEN - 1)] = 0;
         }
-        BCM_STRNCPY_S((char *)rem_name.remote_bd_name,  sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)rem_name.remote_bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
         rem_name.status = BTM_SUCCESS;
 
         bta_dm_remname_cback(&rem_name);
@@ -2588,7 +2595,7 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 
     /* remote name discovery is done but it could be failed */
     bta_dm_search_cb.name_discover_done = TRUE;
-    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name, sizeof(BD_NAME), (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
+    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name,(char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
     bta_dm_search_cb.peer_name[BD_NAME_LEN] = 0;
 
     BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
@@ -2601,7 +2608,7 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 
     if ((p_msg = (tBTA_DM_REM_NAME *) osi_malloc(sizeof(tBTA_DM_REM_NAME))) != NULL) {
         bdcpy (p_msg->result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, sizeof(BD_NAME), (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
+        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
 
         /* make sure the string is null terminated */
         p_msg->result.disc_res.bd_name[BD_NAME_LEN] = 0;
@@ -2633,7 +2640,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
     bdcpy(sec_event.authorize.bd_addr, bd_addr);
     memcpy(sec_event.authorize.dev_class, dev_class, DEV_CLASS_LEN);
 
-    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
 
     /* make sure the string is null terminated */
     sec_event.authorize.bd_name[BD_NAME_LEN - 1] = 0;
@@ -2666,9 +2673,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
     }
 }
 
-
-
-
+#if (BT_SSP_INCLUDED == TRUE)
 /*******************************************************************************
 **
 ** Function         bta_dm_pinname_cback
@@ -2725,6 +2730,7 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
         bta_dm_cb.p_sec_cback(event, &sec_event);
     }
 }
+#endif /// BT_SSP_INCLUDED == TRUE
 
 /*******************************************************************************
 **
@@ -2744,21 +2750,9 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
         return BTM_NOT_AUTHORIZED;
     }
 
-    /* If the device name is not known, save bdaddr and devclass and initiate a name request */
-    if (bd_name[0] == 0) {
-        bta_dm_cb.pin_evt = BTA_DM_PIN_REQ_EVT;
-        bdcpy(bta_dm_cb.pin_bd_addr, bd_addr);
-        BTA_COPY_DEVICE_CLASS(bta_dm_cb.pin_dev_class, dev_class);
-        if ((BTM_ReadRemoteDeviceName(bd_addr, bta_dm_pinname_cback, BT_TRANSPORT_BR_EDR)) == BTM_CMD_STARTED) {
-            return BTM_CMD_STARTED;
-        }
-
-        APPL_TRACE_WARNING(" bta_dm_pin_cback() -> Failed to start Remote Name Request  ");
-    }
-
     bdcpy(sec_event.pin_req.bd_addr, bd_addr);
     BTA_COPY_DEVICE_CLASS(sec_event.pin_req.dev_class, dev_class);
-    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, sizeof(BD_NAME), (char *)bd_name, (BD_NAME_LEN - 1));
+    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
     sec_event.pin_req.bd_name[BD_NAME_LEN - 1] = 0;
     sec_event.pin_req.min_16_digit = min_16_digit;
 
@@ -2776,7 +2770,8 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_
 **
 *******************************************************************************/
 static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
-                                        BD_NAME bd_name, LINK_KEY key, UINT8 key_type)
+                                        BD_NAME bd_name, LINK_KEY key, UINT8 key_type,
+                                        BOOLEAN sc_support)
 {
     tBTA_DM_SEC sec_event;
     tBTA_DM_AUTH_CMPL *p_auth_cmpl;
@@ -2798,6 +2793,7 @@ static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
         p_auth_cmpl->key_present = TRUE;
         p_auth_cmpl->key_type = key_type;
         p_auth_cmpl->success = TRUE;
+        p_auth_cmpl->sc_support = sc_support;
 
         memcpy(p_auth_cmpl->key, key, LINK_KEY_LEN);
         sec_event.auth_cmpl.fail_reason = HCI_SUCCESS;
@@ -2928,8 +2924,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
                    copy these values into key_notif from cfm_req */
                 bdcpy(sec_event.key_notif.bd_addr, p_data->cfm_req.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->cfm_req.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2950,8 +2945,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
             } else {
                 bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -2972,8 +2966,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
             } else {
                 bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                 BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME),
-                              (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
                 sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
             }
         }
@@ -3002,7 +2995,7 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
 
         bdcpy(sec_event.rmt_oob.bd_addr, p_data->rmt_oob.bd_addr);
         BTA_COPY_DEVICE_CLASS(sec_event.rmt_oob.dev_class, p_data->rmt_oob.dev_class);
-        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, sizeof(BD_NAME), (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
         sec_event.rmt_oob.bd_name[BD_NAME_LEN - 1] = 0;
 
         bta_dm_cb.p_sec_cback(BTA_DM_SP_RMT_OOB_EVT, &sec_event);
@@ -3078,6 +3071,7 @@ static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
 
         switch (p_msg->event) {
         case BTM_BL_CONN_EVT:
+            p_msg->sc_downgrade = p_data->conn.sc_downgrade;
             p_msg->is_new = TRUE;
             bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
 #if BLE_INCLUDED == TRUE
@@ -3304,6 +3298,7 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         APPL_TRACE_DEBUG("%s info: 0x%x", __func__, bta_dm_cb.device_list.peer_device[i].info);
 
         if (bta_dm_cb.p_sec_cback) {
+            conn.link_up.sc_downgrade = p_data->acl_change.sc_downgrade;
             bta_dm_cb.p_sec_cback(BTA_DM_LINK_UP_EVT, (tBTA_DM_SEC *)&conn);
         }
     } else {
@@ -3652,11 +3647,11 @@ static char *bta_dm_get_remname(void)
     char *p_temp;
 
     /* If the name isn't already stored, try retrieving from BTM */
-    if (*p_name == '\0')
+    if (*p_name == '\0') {
         if ((p_temp = BTM_SecReadDevName(bta_dm_search_cb.peer_bdaddr)) != NULL) {
             p_name = p_temp;
         }
-
+    }
     return p_name;
 }
 #endif  ///SDP_INCLUDED == TRUE || SMP_INCLUDED == TRUE
@@ -4271,6 +4266,28 @@ static void bta_dm_observe_cmpl_cb (void *p_result)
     }
 }
 
+/*******************************************************************************
+**
+** Function         bta_dm_observe_discard_cb
+**
+** Description      Callback for BLE Observe lost
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+static void bta_dm_observe_discard_cb (uint32_t num_dis)
+{
+    tBTA_DM_SEARCH  data;
+
+    APPL_TRACE_DEBUG("bta_dm_observe_discard_cb");
+
+    data.inq_dis.num_dis = num_dis;
+    if (bta_dm_search_cb.p_scan_cback) {
+        bta_dm_search_cb.p_scan_cback(BTA_DM_INQ_DISCARD_NUM_EVT, &data);
+    }
+}
+
 #if (SMP_INCLUDED == TRUE)
 /*******************************************************************************
 **
@@ -4316,8 +4333,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bdcpy(sec_event.ble_req.bd_addr, bda);
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.ble_req.bd_name[0] = 0;
         }
@@ -4329,8 +4345,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         bdcpy(sec_event.key_notif.bd_addr, bda);
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.key_notif.bd_name[0] = 0;
         }
@@ -4351,7 +4366,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 
     case BTM_LE_NC_REQ_EVT:
         bdcpy(sec_event.key_notif.bd_addr, bda);
-        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN));
+        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
         sec_event.ble_req.bd_name[BD_NAME_LEN] = 0;
         sec_event.key_notif.passkey = p_data->key_notif;
         bta_dm_cb.p_sec_cback(BTA_DM_BLE_NC_REQ_EVT, &sec_event);
@@ -4371,8 +4386,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 #endif
         p_name = BTM_SecReadDevName(bda);
         if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name,
-                          sizeof(BD_NAME), p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name, p_name, (BD_NAME_LEN));
         } else {
             sec_event.auth_cmpl.bd_name[0] = 0;
         }
@@ -4475,7 +4489,8 @@ void bta_dm_add_ble_device (tBTA_DM_MSG *p_data)
 {
     if (!BTM_SecAddBleDevice (p_data->add_ble_device.bd_addr, NULL,
                               p_data->add_ble_device.dev_type  ,
-                              p_data->add_ble_device.addr_type)) {
+                              p_data->add_ble_device.addr_type,
+                              p_data->add_ble_device.auth_mode)) {
         APPL_TRACE_ERROR ("BTA_DM: Error adding BLE Device for device %08x%04x",
                           (p_data->add_ble_device.bd_addr[0] << 24) + (p_data->add_ble_device.bd_addr[1] << 16) + \
                           (p_data->add_ble_device.bd_addr[2] << 8) + p_data->add_ble_device.bd_addr[3],
@@ -4801,7 +4816,7 @@ void bta_dm_ble_scan (tBTA_DM_MSG *p_data)
         bta_dm_search_cb.p_scan_cback = p_data->ble_scan.p_cback;
 
         if ((status = BTM_BleScan(TRUE, p_data->ble_scan.duration,
-                                     bta_dm_observe_results_cb, bta_dm_observe_cmpl_cb)) != BTM_CMD_STARTED) {
+                                     bta_dm_observe_results_cb, bta_dm_observe_cmpl_cb, bta_dm_observe_discard_cb)) != BTM_CMD_STARTED) {
             APPL_TRACE_WARNING(" %s start scan failed. status=0x%x\n", __FUNCTION__, status);
         }
 
@@ -4811,7 +4826,7 @@ void bta_dm_ble_scan (tBTA_DM_MSG *p_data)
         }
     } else {
         bta_dm_search_cb.p_scan_cback = NULL;
-        status = BTM_BleScan(FALSE, 0, NULL, NULL);
+        status = BTM_BleScan(FALSE, 0, NULL, NULL, NULL);
 
         if (status != BTM_CMD_STARTED){
             APPL_TRACE_WARNING(" %s stop scan failed, status=0x%x\n", __FUNCTION__, status);
@@ -4868,6 +4883,22 @@ void bta_dm_ble_set_adv_params_all  (tBTA_DM_MSG *p_data)
     }
 }
 
+/*******************************************************************************
+**
+** Function         bta_dm_ble_update_duplicate_exceptional_list
+**
+** Description      This function is to update duplicate scan exceptional list
+**
+**
+*******************************************************************************/
+void bta_dm_ble_update_duplicate_exceptional_list(tBTA_DM_MSG *p_data)
+{
+    BTM_UpdateBleDuplicateExceptionalList(p_data->ble_duplicate_exceptional_list.subcode,
+                                          p_data->ble_duplicate_exceptional_list.type,
+                                          p_data->ble_duplicate_exceptional_list.device_info,
+                                          p_data->ble_duplicate_exceptional_list.exceptional_list_cb);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_ble_set_adv_config
@@ -5154,9 +5185,10 @@ void bta_dm_ble_setup_storage (tBTA_DM_MSG *p_data)
                                              p_data->ble_set_storage.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_CFG_STRG_EVT, p_data->ble_set_storage.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5184,9 +5216,10 @@ void bta_dm_ble_enable_batch_scan (tBTA_DM_MSG *p_data)
                                             p_data->ble_enable_scan.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_ENABLE_EVT, p_data->ble_enable_scan.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5210,9 +5243,10 @@ void bta_dm_ble_disable_batch_scan (tBTA_DM_MSG *p_data)
         btm_status = BTM_BleDisableBatchScan(p_data->ble_disable_scan.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_DISABLE_EVT, p_data->ble_enable_scan.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5236,9 +5270,10 @@ void bta_dm_ble_read_scan_reports(tBTA_DM_MSG *p_data)
                                             p_data->ble_read_reports.ref_value);
     }
 
-    if (BTM_CMD_STARTED != btm_status)
+    if (BTM_CMD_STARTED != btm_status) {
         bta_ble_scan_setup_cb(BTM_BLE_BATCH_SCAN_READ_REPTS_EVT, p_data->ble_enable_scan.ref_value,
                               btm_status);
+    }
 }
 
 /*******************************************************************************
@@ -5368,10 +5403,11 @@ void bta_dm_cfg_filter_cond (tBTA_DM_MSG *p_data)
         }
     }
 
-    if (p_data->ble_cfg_filter_cond.p_filt_cfg_cback)
+    if (p_data->ble_cfg_filter_cond.p_filt_cfg_cback) {
         p_data->ble_cfg_filter_cond.p_filt_cfg_cback(BTA_DM_BLE_PF_CONFIG_EVT,
                 p_data->ble_cfg_filter_cond.cond_type, 0, status,
                 p_data->ble_cfg_filter_cond.ref_value);
+    }
     return;
 }
 
@@ -5402,9 +5438,10 @@ void bta_dm_enable_scan_filter(tBTA_DM_MSG *p_data)
         return;
     }
 
-    if (p_data->ble_enable_scan_filt.p_filt_status_cback)
+    if (p_data->ble_enable_scan_filt.p_filt_status_cback) {
         p_data->ble_enable_scan_filt.p_filt_status_cback (BTA_DM_BLE_PF_ENABLE_EVT,
                 p_data->ble_enable_scan_filt.ref_value, status);
+    }
 
 }
 
@@ -5438,9 +5475,10 @@ void bta_dm_scan_filter_param_setup (tBTA_DM_MSG *p_data)
         }
     }
 
-    if (p_data->ble_scan_filt_param_setup.p_filt_param_cback)
+    if (p_data->ble_scan_filt_param_setup.p_filt_param_cback) {
         p_data->ble_scan_filt_param_setup.p_filt_param_cback (BTA_DM_BLE_PF_ENABLE_EVT, 0,
                 p_data->ble_scan_filt_param_setup.ref_value, status);
+    }
 
     return;
 }
@@ -5583,7 +5621,7 @@ static void bta_dm_gatt_disc_result(tBTA_GATT_ID service_id)
 
         /* send result back to app now, one by one */
         bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, sizeof(BD_NAME), bta_dm_get_remname(), (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name,bta_dm_get_remname(), (BD_NAME_LEN - 1));
         result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
         memcpy(&result.disc_ble_res.service, &service_id.uuid, sizeof(tBT_UUID));
 
@@ -5625,8 +5663,7 @@ static void bta_dm_gatt_disc_complete(UINT16 conn_id, tBTA_GATT_STATUS status)
             p_msg->disc_result.result.disc_res.num_uuids = 0;
             p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
             bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, sizeof(BD_NAME),
-                          bta_dm_get_remname(), (BD_NAME_LEN - 1));
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
 
             /* make sure the string is terminated */
             p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
@@ -5750,6 +5787,8 @@ void bta_dm_proc_open_evt(tBTA_GATTC_OPEN *p_data)
                      ((p2[0]) << 24) + ((p2[1]) << 16) + ((p2[2]) << 8) + (p2[3]),
                      ((p2[4]) << 8) + p2[5]);
 
+    UNUSED(p1);
+    UNUSED(p2);
     APPL_TRACE_DEBUG("BTA_GATTC_OPEN_EVT conn_id = %d client_if=%d status = %d" ,
                      p_data->conn_id,
                      p_data->client_if,

components/bt/bluedroid/bta/dm/bta_dm_api.c

@@ -174,7 +174,7 @@ void BTA_DmSetDeviceName(const char *p_name)
     if ((p_msg = (tBTA_DM_API_SET_NAME *) osi_malloc(sizeof(tBTA_DM_API_SET_NAME))) != NULL) {
         p_msg->hdr.event = BTA_DM_API_SET_NAME_EVT;
         /* truncate the name if needed */
-        BCM_STRNCPY_S((char *)p_msg->name, sizeof(p_msg->name), p_name, BD_NAME_LEN - 1);
+        BCM_STRNCPY_S((char *)p_msg->name, p_name, BD_NAME_LEN - 1);
         p_msg->name[BD_NAME_LEN - 1] = 0;
 
         bta_sys_sendmsg(p_msg);
@@ -556,6 +556,7 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
     }
 }
 #endif ///BT_SSP_INCLUDED == TRUE
+#endif  ///SMP_INCLUDED == TRUE
 /*******************************************************************************
 **
 ** Function         BTA_DmAddDevice
@@ -569,7 +570,8 @@ void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passkey)
 *******************************************************************************/
 void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
                      tBTA_SERVICE_MASK trusted_mask, BOOLEAN is_trusted,
-                     UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length)
+                     UINT8 key_type, tBTA_IO_CAP io_cap, UINT8 pin_length,
+                     UINT8 sc_support)
 {
 
     tBTA_DM_API_ADD_DEVICE *p_msg;
@@ -582,6 +584,7 @@ void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class, LINK_KEY link_key,
         p_msg->tm = trusted_mask;
         p_msg->is_trusted = is_trusted;
         p_msg->io_cap = io_cap;
+        p_msg->sc_support = sc_support;
 
         if (link_key) {
             p_msg->link_key_known = TRUE;
@@ -632,7 +635,6 @@ tBTA_STATUS BTA_DmRemoveDevice(BD_ADDR bd_addr, tBT_TRANSPORT transport)
 
     return BTA_SUCCESS;
 }
-#endif  ///SMP_INCLUDED == TRUE
 
 /*******************************************************************************
 **
@@ -797,12 +799,13 @@ void BTA_DmAddBleKey (BD_ADDR bd_addr, tBTA_LE_KEY_VALUE *p_le_key, tBTA_LE_KEY_
 **
 ** Parameters:      bd_addr          - BD address of the peer
 **                  dev_type         - Remote device's device type.
+**                  auth_mode        - auth mode
 **                  addr_type        - LE device address type.
 **
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, tBT_DEVICE_TYPE dev_type)
+void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, int auth_mode, tBT_DEVICE_TYPE dev_type)
 {
     tBTA_DM_API_ADD_BLE_DEVICE *p_msg;
 
@@ -812,6 +815,7 @@ void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, tBT_DEVICE_TY
         p_msg->hdr.event = BTA_DM_API_ADD_BLEDEVICE_EVT;
         bdcpy(p_msg->bd_addr, bd_addr);
         p_msg->addr_type = addr_type;
+        p_msg->auth_mode = auth_mode;
         p_msg->dev_type = dev_type;
 
         bta_sys_sendmsg(p_msg);
@@ -1256,6 +1260,34 @@ void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len,
     }
 }
 
+/*******************************************************************************
+**
+** Function         BTA_DmUpdateDuplicateExceptionalList
+**
+** Description      This function is called to update duplicate scan exceptional list
+**
+** Parameters       subcode : add, remove or clean duplicate scan exceptional list.
+**                  type : device info type.
+**                  device_info:  device info
+**                  p_update_duplicate_ignore_list_cback :  update complete callback.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, BD_ADDR device_info, tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_exceptional_list_cback)
+{
+    tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST *p_msg;
+    if ((p_msg = (tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST *)osi_malloc(sizeof(tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT;
+        p_msg->subcode = subcode;
+        p_msg->type = type;
+        p_msg->exceptional_list_cb = p_update_duplicate_exceptional_list_cback;
+        memcpy(p_msg->device_info, device_info, sizeof(BD_ADDR));
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleSetStorageParams

components/bt/bluedroid/bta/dm/bta_dm_cfg.c

@@ -228,9 +228,9 @@ tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC bta_dm_pm_spec[BTA_DM_NUM_PM_SPEC] = {
             {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
             {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app open */
             {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app close */
-            {{BTA_DM_PM_SNIFF3, 7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
-            {{BTA_DM_PM_SNIFF,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
-            {{BTA_DM_PM_SNIFF,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
+            {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
             {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},   /* busy */
             {{BTA_DM_PM_RETRY,  7000 + BTA_DM_PM_SPEC_TO_OFFSET},   {BTA_DM_PM_NO_ACTION, 0}}    /* mode change retry */
         }

components/bt/bluedroid/bta/dm/bta_dm_co.c

@@ -45,6 +45,7 @@ tBTE_APPL_CFG bte_appl_cfg = {
     BTM_BLE_INITIATOR_KEY_SIZE,
     BTM_BLE_RESPONDER_KEY_SIZE,
     BTM_BLE_MAX_KEY_SIZE,
+    BTM_BLE_MIN_KEY_SIZE,
     BTM_BLE_ONLY_ACCEPT_SPECIFIED_SEC_AUTH_DISABLE
 };
 #endif
@@ -399,7 +400,7 @@ void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key)
 void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size)
 {
 #if (SMP_INCLUDED == TRUE)
-    if(ble_key_size >= BTM_BLE_MIN_KEY_SIZE && ble_key_size <= BTM_BLE_MAX_KEY_SIZE) {
+    if(ble_key_size >= bte_appl_cfg.ble_min_key_size && ble_key_size <= BTM_BLE_MAX_KEY_SIZE) {
         bte_appl_cfg.ble_max_key_size = ble_key_size;
     } else {
         APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
@@ -407,6 +408,17 @@ void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size)
 #endif  ///SMP_INCLUDED == TRUE
 }
 
+void bta_dm_co_ble_set_min_key_size(UINT8 ble_key_size)
+{
+#if (SMP_INCLUDED == TRUE)
+    if(ble_key_size >= BTM_BLE_MIN_KEY_SIZE && ble_key_size <= bte_appl_cfg.ble_max_key_size) {
+        bte_appl_cfg.ble_min_key_size = ble_key_size;
+    } else {
+        APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
+    }
+#endif  ///SMP_INCLUDED == TRUE
+}
+
 void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable)
 {
 #if (SMP_INCLUDED == TRUE)

components/bt/bluedroid/bta/dm/bta_dm_main.c

@@ -157,6 +157,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
     bta_dm_update_white_list,               /* BTA_DM_API_UPDATE_WHITE_LIST_EVT */
     bta_dm_ble_read_adv_tx_power,           /* BTA_DM_API_BLE_READ_ADV_TX_POWER_EVT */
     bta_dm_ble_read_rssi,                   /* BTA_DM_API_BLE_READ_RSSI_EVT */
+    bta_dm_ble_update_duplicate_exceptional_list,/* BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT */
 };
 
 

components/bt/bluedroid/bta/dm/bta_dm_pm.c

@@ -1038,9 +1038,10 @@ static void bta_dm_pm_hid_check(BOOLEAN bScoActive)
             bta_dm_pm_set_sniff_policy( bta_dm_find_peer_device(bta_dm_conn_srvcs.conn_srvc[j].peer_bdaddr), bScoActive);
 
             /* if we had disabled link policy, seems like the hid device stop retrying SNIFF after a few tries. force sniff if needed */
-            if (!bScoActive)
+            if (!bScoActive) {
                 bta_dm_pm_set_mode(bta_dm_conn_srvcs.conn_srvc[j].peer_bdaddr, BTA_DM_PM_NO_ACTION,
                                    BTA_DM_PM_RESTART);
+            }
         }
     }
 

components/bt/bluedroid/bta/dm/include/bta_dm_int.h

@@ -25,7 +25,7 @@
 #define BTA_DM_INT_H
 
 #include "common/bt_target.h"
-
+#include "freertos/semphr.h"
 #if (BLE_INCLUDED == TRUE && (defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE))
 #include "bta/bta_gatt_api.h"
 #endif
@@ -155,6 +155,7 @@ enum {
     BTA_DM_API_UPDATE_WHITE_LIST_EVT,
     BTA_DM_API_BLE_READ_ADV_TX_POWER_EVT,
     BTA_DM_API_BLE_READ_RSSI_EVT,
+    BTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_EVT,
     BTA_DM_MAX_EVT
 };
 
@@ -193,6 +194,14 @@ typedef struct {
     tBTA_ADD_WHITELIST_CBACK *add_wl_cb;
 }tBTA_DM_API_UPDATE_WHITE_LIST;
 
+typedef struct {
+    BT_HDR    hdr;
+    UINT8     subcode;
+    UINT32    type;
+    BD_ADDR   device_info;
+    tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK *exceptional_list_cb;
+}tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST;
+
 typedef struct {
     BT_HDR       hdr;
     tBTA_CMPL_CB *read_tx_power_cb;
@@ -366,6 +375,7 @@ typedef struct {
     UINT8           new_role;
     BD_ADDR         bd_addr;
     UINT8           hci_status;
+    BOOLEAN         sc_downgrade;
 #if BLE_INCLUDED == TRUE
     UINT16          handle;
     tBT_TRANSPORT   transport;
@@ -407,6 +417,7 @@ typedef struct {
     BD_NAME             bd_name;
     UINT8               features[BTA_FEATURE_BYTES_PER_PAGE * (BTA_EXT_FEATURES_PAGE_MAX + 1)];
     UINT8               pin_length;
+    UINT8               sc_support;
 } tBTA_DM_API_ADD_DEVICE;
 
 /* data type for BTA_DM_API_REMOVE_ACL_EVT */
@@ -445,6 +456,7 @@ typedef struct {
     BT_HDR                  hdr;
     BD_ADDR                 bd_addr;
     tBT_DEVICE_TYPE         dev_type ;
+    UINT32                  auth_mode;
     tBLE_ADDR_TYPE          addr_type;
 
 } tBTA_DM_API_ADD_BLE_DEVICE;
@@ -847,6 +859,7 @@ typedef union {
     tBTA_DM_API_TRACK_ADVERTISER        ble_track_advert;
     tBTA_DM_API_ENERGY_INFO             ble_energy_info;
     tBTA_DM_API_BLE_DISCONNECT          ble_disconnect;
+    tBTA_DM_API_UPDATE_DUPLICATE_EXCEPTIONAL_LIST ble_duplicate_exceptional_list;
 #endif
 
     tBTA_DM_API_REMOVE_ACL              remove_acl;
@@ -1180,6 +1193,7 @@ extern tBTA_DM_DI_CB  bta_dm_di_cb;
 #else
 extern tBTA_DM_DI_CB *bta_dm_di_cb_ptr;
 #define bta_dm_di_cb (*bta_dm_di_cb_ptr)
+SemaphoreHandle_t deinit_semaphore;
 #endif
 
 extern BOOLEAN bta_dm_sm_execute(BT_HDR *p_msg);
@@ -1242,7 +1256,7 @@ extern void bta_dm_ble_set_scan_rsp (tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_set_scan_rsp_raw (tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_broadcast (tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_set_data_length(tBTA_DM_MSG *p_data);
-
+extern void bta_dm_ble_update_duplicate_exceptional_list(tBTA_DM_MSG *p_data);
 #if BLE_ANDROID_CONTROLLER_SCAN_FILTER == TRUE
 extern void bta_dm_cfg_filter_cond (tBTA_DM_MSG *p_data);
 extern void bta_dm_scan_filter_param_setup (tBTA_DM_MSG *p_data);

components/bt/bluedroid/bta/gatt/bta_gattc_act.c

@@ -531,7 +531,9 @@ void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *p_clreg
     if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, TRUE, FALSE)) {
         /* always call open to hold a connection */
         if (!GATT_Connect(p_data->client_if, p_data->remote_bda, p_data->remote_addr_type, FALSE, p_data->transport)) {
+#if (!CONFIG_BT_STACK_NO_LOG)
             uint8_t *bda = (uint8_t *)p_data->remote_bda;
+#endif
             status = BTA_GATT_ERROR;
             APPL_TRACE_ERROR("%s unable to connect to remote bd_addr:%02x:%02x:%02x:%02x:%02x:%02x",
                              __func__, bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
@@ -674,7 +676,7 @@ void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
                 bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
                 //register service change
                 bta_gattc_register_service_change_notify(p_clcb->bta_conn_id, p_clcb->bda);
-            } else 
+            } else
 #endif
             { /* cache is building */
                 p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
@@ -743,6 +745,8 @@ void bta_gattc_conncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 void bta_gattc_disconncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 {
     if (p_rcb) {
+        // Clear up the notification registration information by BD_ADDR
+        bta_gattc_clear_notif_registration_by_bda(p_rcb, p_data->int_conn.remote_bda);
         bta_gattc_send_disconnect_cback(p_rcb,
                                      p_data->int_conn.reason,
                                      p_data->int_conn.remote_bda,
@@ -1071,8 +1075,9 @@ void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 *******************************************************************************/
 void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
-    if (!bta_gattc_enqueue(p_clcb, p_data))
+    if (!bta_gattc_enqueue(p_clcb, p_data)) {
         return;
+    }
 
     tGATT_READ_PARAM    read_param;
     memset (&read_param, 0 ,sizeof(tGATT_READ_PARAM));
@@ -1140,8 +1145,9 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 *******************************************************************************/
 void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 {
-    if (!bta_gattc_enqueue(p_clcb, p_data))
+    if (!bta_gattc_enqueue(p_clcb, p_data)) {
         return;
+    }
 
     tBTA_GATT_STATUS    status = BTA_GATT_OK;
     tGATT_VALUE attr;
@@ -1742,7 +1748,7 @@ void bta_gattc_process_api_cache_assoc(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_m
     tBTA_GATTC gattc_cb = {0};
     gattc_cb.set_assoc.client_if = p_msg->api_assoc.client_if;
     BOOLEAN state = FALSE;
-    tBTA_GATTC_CLCB *p_assoc_clcb = bta_gattc_find_clcb_by_cif(p_msg->api_assoc.client_if, 
+    tBTA_GATTC_CLCB *p_assoc_clcb = bta_gattc_find_clcb_by_cif(p_msg->api_assoc.client_if,
                                                              p_msg->api_assoc.assoc_addr, BTA_TRANSPORT_LE);
     tBTA_GATTC_RCB *p_clrcb = bta_gattc_cl_get_regcb(p_msg->api_assoc.client_if);
     if (p_assoc_clcb != NULL) {
@@ -1783,7 +1789,7 @@ void bta_gattc_process_api_cache_assoc(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_m
     }
 
     return;
- 
+
 }
 void bta_gattc_process_api_cache_get_addr_list(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 {

components/bt/bluedroid/bta/gatt/bta_gattc_api.c

@@ -76,7 +76,7 @@ void BTA_GATTC_Disable(void)
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTC module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_client_cb - pointer to the application callback function.
 **
 ** Returns          None
@@ -333,13 +333,13 @@ const tBTA_GATTC_DESCRIPTOR* BTA_GATTC_GetDescriptor(UINT16 conn_id, UINT16 hand
 }
 
 void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid,
-                                  btgatt_db_element_t **db, int *count)
+                                  btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_service_with_uuid(conn_id, svc_uuid, db, count);
 }
 
 void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                          btgatt_db_element_t **db, int *count)
+                          btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_ALL_CHAR,
@@ -354,7 +354,7 @@ void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle
 }
 
 void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
-                                btgatt_db_element_t **db, int *count)
+                                btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_ALL_DESCRI,
@@ -369,7 +369,7 @@ void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
 }
 
 void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid,
-                             btgatt_db_element_t **db, int *count)
+                             btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_CHAR_BY_UUID,
@@ -385,7 +385,7 @@ void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_han
 
 void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t end_handle,
                               tBT_UUID char_uuid, tBT_UUID descr_uuid,
-                              btgatt_db_element_t **db, int *count)
+                              btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_DESCRI_BY_UUID,
@@ -400,7 +400,7 @@ void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t en
 }
 
 void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid,
-                                    btgatt_db_element_t **db, int *count)
+                                    btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_DESCRI_BY_HANDLE,
@@ -415,7 +415,7 @@ void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID
 }
 
 void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                 tBT_UUID *incl_uuid, btgatt_db_element_t **db, int *count)
+                                 tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_db_with_opration(conn_id,
                                    GATT_OP_GET_INCLUDE_SVC,
@@ -429,13 +429,13 @@ void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end
                                    count);
 }
 
-void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count)
+void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count)
 {
     bta_gattc_get_db_size_handle(conn_id, start_handle, end_handle, count);
 }
 
 void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                               UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count)
+                               UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count)
 {
     bta_gattc_get_db_size_with_type_handle(conn_id, type, start_handle, end_handle, char_handle, count);
 }
@@ -454,7 +454,7 @@ void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
 **
 *******************************************************************************/
 void  BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                          btgatt_db_element_t **db, int *count)
+                          btgatt_db_element_t **db, UINT16 *count)
 {
     bta_gattc_get_gatt_db(conn_id, start_handle, end_handle, db, count);
 }

components/bt/bluedroid/bta/gatt/bta_gattc_cache.c

@@ -93,7 +93,7 @@ static char *bta_gattc_attr_type[] = {
 };
 /* utility functions */
 
-bool display_cache_attribute(void *data, void *context) 
+bool display_cache_attribute(void *data, void *context)
 {
     //tBTA_GATTC_CACHE_ATTR *p_attr = data;
     //APPL_TRACE_ERROR("\t Attr handle[%d] uuid[0x%04x] type[%s] prop[0x%1x]",
@@ -102,7 +102,7 @@ bool display_cache_attribute(void *data, void *context)
     return true;
 }
 
-bool display_cache_service(void *data, void *context) 
+bool display_cache_service(void *data, void *context)
 {
     tBTA_GATTC_SERVICE    *p_cur_srvc = data;
     APPL_TRACE_API("Service: handle[%d ~ %d] %s[0x%04x] inst[%d]",
@@ -213,9 +213,9 @@ static void bta_gattc_free(void *ptr)
     osi_free(ptr);
 }
 
-void bta_gattc_insert_sec_service_to_cache(list_t *services, tBTA_GATTC_SERVICE *p_new_srvc) 
+void bta_gattc_insert_sec_service_to_cache(list_t *services, tBTA_GATTC_SERVICE *p_new_srvc)
 {
-    // services/p_new_srvc is NULL 
+    // services/p_new_srvc is NULL
     if (!services || !p_new_srvc) {
         APPL_TRACE_ERROR("%s services/p_new_srvc is NULL", __func__);
         return;
@@ -243,7 +243,7 @@ void bta_gattc_insert_sec_service_to_cache(list_t *services, tBTA_GATTC_SERVICE
                     return;
                 }
             }
-        }  
+        }
     }
 }
 
@@ -314,8 +314,9 @@ static tBTA_GATT_STATUS bta_gattc_add_char_to_cache(tBTA_GATTC_SERV *p_srvc_cb,
     /* TODO(jpawlowski): We should use attribute handle, not value handle to refer to characteristic.
        This is just a temporary workaround.
     */
-    if (service->e_handle < value_handle)
+    if (service->e_handle < value_handle) {
         service->e_handle = value_handle;
+    }
 
     tBTA_GATTC_CHARACTERISTIC *characteristic = osi_malloc(sizeof(tBTA_GATTC_CHARACTERISTIC));
     if (!characteristic) {
@@ -554,10 +555,10 @@ void bta_gattc_update_include_service(const list_t *services) {
             if(include_service && !include_service->included_service) {
                 //update
                 include_service->included_service = bta_gattc_find_matching_service(services, include_service->incl_srvc_s_handle);
-                if(!include_service->included_service) { 
+                if(!include_service->included_service) {
                     //not match, free it
                     list_remove(service->included_svc, include_service);
-                    osi_free(include_service);    
+                    osi_free(include_service);
                 }
             }
         }
@@ -980,12 +981,13 @@ void bta_gattc_disc_res_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT_
                                               p_data->value.incl_service.e_handle,
                                               p_data->value.incl_service.service_type);
 
-            if (!pri_srvc)
+            if (!pri_srvc) {
                 bta_gattc_add_srvc_to_list(p_srvc_cb,
                                            p_data->value.incl_service.s_handle,
                                            p_data->value.incl_service.e_handle,
                                            p_data->value.incl_service.service_type,
                                            FALSE);
+            }
             /* add into database */
             bta_gattc_add_attr_to_cache(p_srvc_cb,
                                         p_data->handle,
@@ -1007,8 +1009,8 @@ void bta_gattc_disc_res_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT_
 
         case GATT_DISC_CHAR_DSCPT:
             bta_gattc_add_attr_to_cache(p_srvc_cb,
-                                        p_data->handle, 
-                                        &p_data->type, 
+                                        p_data->handle,
+                                        &p_data->type,
                                         0,
                                         0 /* incl_srvc_s_handle */,
                                         0 /* incl_srvc_e_handle */,
@@ -1023,8 +1025,9 @@ void bta_gattc_disc_cmpl_cback (UINT16 conn_id, tGATT_DISC_TYPE disc_type, tGATT
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
     if ( p_clcb && (status != GATT_SUCCESS || p_clcb->status != GATT_SUCCESS) ) {
-        if (status == GATT_SUCCESS)
+        if (status == GATT_SUCCESS) {
             p_clcb->status = status;
+        }
         bta_gattc_sm_execute(p_clcb, BTA_GATTC_DISCOVER_CMPL_EVT, NULL);
         return;
     }
@@ -1071,15 +1074,17 @@ void bta_gattc_search_service(tBTA_GATTC_CLCB *p_clcb, tBT_UUID *p_uuid)
 {
     tBTA_GATTC          cb_data;
 
-    if (!p_clcb->p_srcb->p_srvc_cache || list_is_empty(p_clcb->p_srcb->p_srvc_cache))
+    if (!p_clcb->p_srcb->p_srvc_cache || list_is_empty(p_clcb->p_srcb->p_srvc_cache)) {
         return;
+    }
 
     for (list_node_t *sn = list_begin(p_clcb->p_srcb->p_srvc_cache);
          sn != list_end(p_clcb->p_srcb->p_srvc_cache); sn = list_next(sn)) {
         tBTA_GATTC_SERVICE *p_cache = list_node(sn);
 
-        if (!bta_gattc_uuid_compare(p_uuid, &p_cache->uuid, FALSE))
+        if (!bta_gattc_uuid_compare(p_uuid, &p_cache->uuid, FALSE)) {
             continue;
+        }
 
 #if (defined BTA_GATT_DEBUG && BTA_GATT_DEBUG == TRUE)
         APPL_TRACE_DEBUG("found service [0x%04x], inst[%d] handle [%d]",
@@ -1087,8 +1092,9 @@ void bta_gattc_search_service(tBTA_GATTC_CLCB *p_clcb, tBT_UUID *p_uuid)
                           p_cache->handle,
                           p_cache->s_handle);
 #endif
-        if (!p_clcb->p_rcb->p_cback)
+        if (!p_clcb->p_rcb->p_cback) {
             continue;
+        }
 
         memset(&cb_data, 0, sizeof(tBTA_GATTC));
 
@@ -1103,8 +1109,9 @@ void bta_gattc_search_service(tBTA_GATTC_CLCB *p_clcb, tBT_UUID *p_uuid)
 }
 
 list_t* bta_gattc_get_services_srcb(tBTA_GATTC_SERV *p_srcb) {
-    if (!p_srcb || !p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache))
+    if (!p_srcb || !p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) {
         return NULL;
+    }
 
     return p_srcb->p_srvc_cache;
 }
@@ -1112,8 +1119,9 @@ list_t* bta_gattc_get_services_srcb(tBTA_GATTC_SERV *p_srcb) {
 const list_t* bta_gattc_get_services(UINT16 conn_id) {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
-    if (p_clcb == NULL )
+    if (p_clcb == NULL ) {
         return NULL;
+    }
 
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
 
@@ -1121,63 +1129,68 @@ const list_t* bta_gattc_get_services(UINT16 conn_id) {
 }
 
 tBTA_GATTC_SERVICE*  bta_gattc_find_matching_service(const list_t *services, UINT16 handle) {
-    if (!services || list_is_empty(services))
+    if (!services || list_is_empty(services)) {
         return NULL;
+    }
 
     for (list_node_t *sn = list_begin(services);
          sn != list_end(services); sn = list_next(sn)) {
         tBTA_GATTC_SERVICE *service = list_node(sn);
 
-        if (handle >= service->s_handle && handle <= service->e_handle)
+        if (handle >= service->s_handle && handle <= service->e_handle) {
             return service;
+        }
     }
 
     return NULL;
 }
 
-const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle) 
+const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle)
 {
     const list_t *services = bta_gattc_get_services_srcb(p_srcb);
 
     return bta_gattc_find_matching_service(services, handle);
 }
 
-const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle(UINT16 conn_id, UINT16 handle) 
+const tBTA_GATTC_SERVICE*  bta_gattc_get_service_for_handle(UINT16 conn_id, UINT16 handle)
 {
     const list_t *services = bta_gattc_get_services(conn_id);
 
     return bta_gattc_find_matching_service(services, handle);
 }
 
-tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle) 
+tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle)
 {
     const tBTA_GATTC_SERVICE* service = bta_gattc_get_service_for_handle_srcb(p_srcb, handle);
 
-    if (!service)
+    if (!service) {
         return NULL;
+    }
 
     for (list_node_t *cn = list_begin(service->characteristics);
          cn != list_end(service->characteristics); cn = list_next(cn)) {
         tBTA_GATTC_CHARACTERISTIC *p_char = list_node(cn);
-        if (handle == p_char->handle)
+        if (handle == p_char->handle) {
             return p_char;
+        }
     }
 
     return NULL;
 }
 
-tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle) 
+tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle)
 {
    tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
-    if (p_clcb == NULL )
+    if (p_clcb == NULL ) {
         return NULL;
+    }
 
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     return bta_gattc_get_characteristic_srcb(p_srcb, handle);
 }
 
-tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle) 
+tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle)
 {
     const tBTA_GATTC_SERVICE* service = bta_gattc_get_service_for_handle_srcb(p_srcb, handle);
 
@@ -1191,20 +1204,22 @@ tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor_srcb(tBTA_GATTC_SERV *p_srcb, U
         for (list_node_t *dn = list_begin(p_char->descriptors);
              dn != list_end(p_char->descriptors); dn = list_next(dn)) {
             tBTA_GATTC_DESCRIPTOR *p_desc = list_node(dn);
-            if (handle == p_desc->handle)
+            if (handle == p_desc->handle) {
                 return p_desc;
+            }
         }
     }
 
     return NULL;
 }
 
-tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle) 
+tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
-    if (p_clcb == NULL )
+    if (p_clcb == NULL ) {
         return NULL;
+    }
 
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     return bta_gattc_get_descriptor_srcb(p_srcb, handle);
@@ -1212,7 +1227,7 @@ tBTA_GATTC_DESCRIPTOR*  bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle)
 
 void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid,
                                      btgatt_db_element_t **svc_db,
-                                     int *count)
+                                     UINT16 *count)
 {
     const list_t* svc = bta_gattc_get_services(conn_id);
     if(!svc) {
@@ -1286,7 +1301,7 @@ void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       tBT_UUID *descr_uuid,
                                                       UINT16 start_handle, UINT16 end_handle,
                                                       btgatt_db_element_t **char_db,
-                                                      int *count)
+                                                      UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1443,7 +1458,7 @@ void bta_gattc_get_db_with_opration(UINT16 conn_id,
                     }
                 }
             }
-            
+
         }
     }
 
@@ -1476,7 +1491,7 @@ static size_t bta_gattc_get_db_size_with_type(list_t *services,
         }
 
         if (type == BTGATT_DB_PRIMARY_SERVICE || type == BTGATT_DB_SECONDARY_SERVICE) {
-            if ((type == BTGATT_DB_PRIMARY_SERVICE && p_cur_srvc->is_primary) || 
+            if ((type == BTGATT_DB_PRIMARY_SERVICE && p_cur_srvc->is_primary) ||
                 (type == BTGATT_DB_SECONDARY_SERVICE && !p_cur_srvc->is_primary)) {
                 // if the current service is the last service in the db, need to ensure the current service start handle is not less than the start_handle.
                 if (!svc_length) {
@@ -1572,10 +1587,11 @@ static size_t bta_gattc_get_db_size_with_type(list_t *services,
 ** Returns          number of elements inside db from start_handle to end_handle
 *******************************************************************************/
 static size_t bta_gattc_get_db_size(list_t *services,
-                                    UINT16 start_handle, UINT16 end_handle) 
+                                    UINT16 start_handle, UINT16 end_handle)
 {
-    if (!services || list_is_empty(services))
+    if (!services || list_is_empty(services)) {
         return 0;
+    }
 
     size_t db_size = 0;
     UINT16 svc_length = list_length(services) - 1;
@@ -1598,9 +1614,10 @@ static size_t bta_gattc_get_db_size(list_t *services,
         } else {
             db_size++;
         }
-        
-        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics))
+
+        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics)) {
             continue;
+        }
 
         for (list_node_t *cn = list_begin(p_cur_srvc->characteristics);
              cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) {
@@ -1649,7 +1666,7 @@ static size_t bta_gattc_get_db_size(list_t *services,
     return db_size;
 }
 
-void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count)
+void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1657,7 +1674,7 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
         *count = 0;
         return;
     }
-    
+
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     if (!p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) {
         *count = 0;
@@ -1668,7 +1685,7 @@ void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 en
 }
 
 void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                            UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count)
+                                            UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1676,7 +1693,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
         *count = 0;
         return;
     }
-    
+
     tBTA_GATTC_SERV *p_srcb = p_clcb->p_srcb;
     if (!p_srcb->p_srvc_cache || list_is_empty(p_srcb->p_srvc_cache)) {
         *count = 0;
@@ -1694,7 +1711,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
         }
     }
     *count = bta_gattc_get_db_size_with_type(p_srcb->p_srvc_cache, type, NULL, start_handle, end_handle);
-    
+
 }
 
 /*******************************************************************************
@@ -1715,7 +1732,7 @@ void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute
 static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
                                        UINT16 start_handle, UINT16 end_handle,
                                        btgatt_db_element_t **db,
-                                       int *count)
+                                       UINT16 *count)
 {
     APPL_TRACE_DEBUG("%s: start_handle 0x%04x, end_handle 0x%04x",
                      __func__, start_handle, end_handle);
@@ -1786,8 +1803,9 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
                                           p_char->properties);
                 curr_db_attr++;
 
-                if (!p_char->descriptors || list_is_empty(p_char->descriptors))
+                if (!p_char->descriptors || list_is_empty(p_char->descriptors)) {
                     continue;
+                }
 
                 for (list_node_t *dn = list_begin(p_char->descriptors);
                      dn != list_end(p_char->descriptors); dn = list_next(dn)) {
@@ -1815,8 +1833,9 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
             }
         }
 
-        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc))
+        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc)) {
             continue;
+        }
 
         for (list_node_t *isn = list_begin(p_cur_srvc->included_svc);
              isn != list_end(p_cur_srvc->included_svc); isn = list_next(isn)) {
@@ -1861,7 +1880,7 @@ static void bta_gattc_get_gatt_db_impl(tBTA_GATTC_SERV *p_srvc_cb,
 ** Returns          None.
 **
 *******************************************************************************/
-void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, int *count)
+void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count)
 {
     tBTA_GATTC_CLCB *p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
@@ -1983,8 +2002,9 @@ void bta_gattc_fill_nv_attr(tBTA_GATTC_NV_ATTR *p_attr, UINT8 type, UINT16 s_han
 *******************************************************************************/
 void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
 {
-    if (!p_srvc_cb->p_srvc_cache || list_is_empty(p_srvc_cb->p_srvc_cache))
+    if (!p_srvc_cb->p_srvc_cache || list_is_empty(p_srvc_cb->p_srvc_cache)) {
         return;
+    }
 
     int i = 0;
     size_t db_size = bta_gattc_get_db_size(p_srvc_cb->p_srvc_cache, 0x0000, 0xFFFF);
@@ -2017,8 +2037,9 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
          sn != list_end(p_srvc_cb->p_srvc_cache); sn = list_next(sn)) {
         tBTA_GATTC_SERVICE *p_cur_srvc = list_node(sn);
 
-        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics))
+        if (!p_cur_srvc->characteristics || list_is_empty(p_cur_srvc->characteristics)) {
             continue;
+        }
 
         for (list_node_t *cn = list_begin(p_cur_srvc->characteristics);
              cn != list_end(p_cur_srvc->characteristics); cn = list_next(cn)) {
@@ -2034,8 +2055,9 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
                                    0 /* incl_srvc_e_handle */,
                                    FALSE);
 
-            if (!p_char->descriptors || list_is_empty(p_char->descriptors))
+            if (!p_char->descriptors || list_is_empty(p_char->descriptors)) {
                 continue;
+            }
 
             for (list_node_t *dn = list_begin(p_char->descriptors);
                  dn != list_end(p_char->descriptors); dn = list_next(dn)) {
@@ -2053,8 +2075,9 @@ void bta_gattc_cache_save(tBTA_GATTC_SERV *p_srvc_cb, UINT16 conn_id)
             }
         }
 
-        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc))
+        if (!p_cur_srvc->included_svc || list_is_empty(p_cur_srvc->included_svc)) {
             continue;
+        }
 
         for (list_node_t *an = list_begin(p_cur_srvc->included_svc);
              an != list_end(p_cur_srvc->included_svc); an = list_next(an)) {

components/bt/bluedroid/bta/gatt/bta_gattc_co.c

@@ -261,14 +261,18 @@ tBTA_GATT_STATUS bta_gattc_co_cache_open(BD_ADDR server_bda, BOOLEAN to_save, UI
 *******************************************************************************/
 tBTA_GATT_STATUS bta_gattc_co_cache_load(tBTA_GATTC_NV_ATTR *attr, UINT8 index)
 {
+#if (!CONFIG_BT_STACK_NO_LOG)
     UINT16              num_attr = 0;
+#endif
     tBTA_GATT_STATUS    status = BTA_GATT_ERROR;
     size_t length = 0;
     // Read the size of memory space required for blob
     nvs_get_blob(cache_env.cache_addr[index].cache_fp, cache_key, NULL, &length);
     // Read previously saved blob if available
     esp_err_t err_code = nvs_get_blob(cache_env.cache_addr[index].cache_fp, cache_key, attr, &length);
+#if (!CONFIG_BT_STACK_NO_LOG)
     num_attr = length / sizeof(tBTA_GATTC_NV_ATTR);
+#endif
     status = (err_code == ESP_OK && length != 0) ? BTA_GATT_OK : BTA_GATT_ERROR;
     APPL_TRACE_DEBUG("%s() - read=%d, status=%d, err_code = %d",
                      __func__, num_attr, status, err_code);
@@ -323,6 +327,9 @@ void bta_gattc_co_cache_save (BD_ADDR server_bda, UINT16 num_attr,
         status = BTA_GATT_ERROR;
     }
 
+#if CONFIG_BT_STACK_NO_LOG
+    (void) status;
+#endif
     APPL_TRACE_DEBUG("%s() wrote hash_key = %x%x%x%x, num_attr = %d, status = %d.", __func__, hash_key[0], hash_key[1], hash_key[2], hash_key[3], num_attr, status);
 }
 

components/bt/bluedroid/bta/gatt/bta_gattc_utils.c

@@ -416,8 +416,9 @@ tBTA_GATTC_SERV *bta_gattc_srcb_alloc(BD_ADDR bda)
 
     if (p_tcb != NULL)
     {
-        if (p_tcb->p_srvc_cache != NULL)
+        if (p_tcb->p_srvc_cache != NULL) {
             list_free(p_tcb->p_srvc_cache);
+        }
         osi_free(p_tcb->p_srvc_list);
         p_tcb->p_srvc_list = NULL;
         //osi_free_and_reset((void **)&p_tcb->p_srvc_list);
@@ -583,8 +584,9 @@ void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id,
                      * clear boundaries are always around service.
                      */
                     handle = p_clrcb->notif_reg[i].handle;
-                    if (handle >= start_handle && handle <= end_handle)
+                    if (handle >= start_handle && handle <= end_handle) {
                         memset(&p_clrcb->notif_reg[i], 0, sizeof(tBTA_GATTC_NOTIF_REG));
+                    }
                 }
             }
         }
@@ -594,6 +596,30 @@ void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id,
     return;
 }
 
+/*******************************************************************************
+**
+** Function         bta_gattc_clear_notif_registration_by_bda
+**
+** Description      Clear up the notification registration information by BD_ADDR.
+**
+**
+** Returns          None.
+**
+*******************************************************************************/
+void bta_gattc_clear_notif_registration_by_bda(tBTA_GATTC_RCB *p_clrcb, BD_ADDR remote_bda)
+{
+    if(p_clrcb == NULL) {
+        return;
+    }
+    for (uint8_t i = 0 ; i < BTA_GATTC_NOTIF_REG_MAX; i ++) {
+        if (p_clrcb->notif_reg[i].in_use &&
+            !bdcmp(p_clrcb->notif_reg[i].remote_bda, remote_bda))
+        {
+            memset(&p_clrcb->notif_reg[i], 0, sizeof(tBTA_GATTC_NOTIF_REG));
+        }
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         bta_gattc_mark_bg_conn
@@ -637,8 +663,9 @@ BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR_PTR remote_bda
     }
     if (!add) {
         if (remote_bda_ptr) {
-            // bdstr_t bdstr = {0};
+#if (!CONFIG_BT_STACK_NO_LOG)
             char bdstr[18] = {0};
+#endif
             APPL_TRACE_ERROR("%s unable to find the bg connection mask for: %s", __func__,
                              bdaddr_to_string((bt_bdaddr_t *)remote_bda_ptr, bdstr, sizeof(bdstr)));
         }
@@ -936,8 +963,9 @@ void bta_to_btif_uuid(bt_uuid_t *p_dest, tBT_UUID *p_src)
 
     if (p_src->len == LEN_UUID_16 || p_src->len == LEN_UUID_32)
     {
-        for(i=0; i != 16; ++i)
+        for(i=0; i != 16; ++i) {
             p_dest->uu[i] = base_uuid[i];
+        }
     }
 
     switch (p_src->len)

components/bt/bluedroid/bta/gatt/bta_gatts_act.c

@@ -403,7 +403,7 @@ void bta_gatts_add_char(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_msg)
     UINT16          attr_id = 0;
     tBTA_GATTS      cb_data;
 
-    tGATT_ATTR_VAL *p_attr_val = NULL; 
+    tGATT_ATTR_VAL *p_attr_val = NULL;
     tGATTS_ATTR_CONTROL *p_control = NULL;
 
     if(p_msg->api_add_char.attr_val.attr_max_len != 0){
@@ -665,17 +665,18 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                                     &gatt_if, remote_bda, &transport)) {
             p_rcb = bta_gatts_find_app_rcb_by_app_if(gatt_if);
 
-            if (p_msg->api_indicate.need_confirm)
+            if (p_msg->api_indicate.need_confirm) {
 
                 status = GATTS_HandleValueIndication (p_msg->api_indicate.hdr.layer_specific,
                                                       p_msg->api_indicate.attr_id,
                                                       p_msg->api_indicate.len,
                                                       p_msg->api_indicate.value);
-            else
+            } else {
                 status = GATTS_HandleValueNotification (p_msg->api_indicate.hdr.layer_specific,
                                                         p_msg->api_indicate.attr_id,
                                                         p_msg->api_indicate.len,
                                                         p_msg->api_indicate.value);
+            }
 
             /* if over BR_EDR, inform PM for mode change */
             if (transport == BTA_TRANSPORT_BR_EDR) {
@@ -691,16 +692,25 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                 p_rcb && p_cb->rcb[p_srvc_cb->rcb_idx].p_cback) {
             cb_data.req_data.status = status;
             cb_data.req_data.conn_id = p_msg->api_indicate.hdr.layer_specific;
+            cb_data.req_data.value = NULL;
+            cb_data.req_data.data_len = 0;
             cb_data.req_data.handle = p_msg->api_indicate.attr_id;
 
-            cb_data.req_data.value = (uint8_t *)osi_malloc(p_msg->api_indicate.len);
-            if (cb_data.req_data.value != NULL){
-                memset(cb_data.req_data.value, 0, p_msg->api_indicate.len);
-                cb_data.req_data.data_len = p_msg->api_indicate.len;
-                memcpy(cb_data.req_data.value, p_msg->api_indicate.value, p_msg->api_indicate.len);
-            }else{
-                cb_data.req_data.data_len = 0;
-                APPL_TRACE_ERROR("%s, malloc failed", __func__);
+            if (p_msg->api_indicate.value && (p_msg->api_indicate.len > 0)) {
+                cb_data.req_data.value = (uint8_t *) osi_malloc(p_msg->api_indicate.len);
+                if (cb_data.req_data.value != NULL) {
+                    memset(cb_data.req_data.value, 0, p_msg->api_indicate.len);
+                    cb_data.req_data.data_len = p_msg->api_indicate.len;
+                    memcpy(cb_data.req_data.value, p_msg->api_indicate.value, p_msg->api_indicate.len);
+                } else {
+                    APPL_TRACE_ERROR("%s, malloc failed", __func__);
+                }
+            } else {
+                if (p_msg->api_indicate.value) {
+                    APPL_TRACE_ERROR("%s, incorrect length", __func__);
+                } else {
+                    APPL_TRACE_WARNING("%s, NULL value", __func__);
+                }
             }
             (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
             if (cb_data.req_data.value != NULL) {
@@ -851,13 +861,13 @@ void bta_gatts_send_service_change_indication (tBTA_GATTS_DATA *p_msg)
         memcpy(bd_addr, p_msg->api_send_service_change.remote_bda, BD_ADDR_LEN);
         status = GATT_SendServiceChangeIndication(bd_addr);
     } else {
-        status = GATT_SendServiceChangeIndication(NULL);    
+        status = GATT_SendServiceChangeIndication(NULL);
     }
     if (p_rcb && p_rcb->p_cback) {
         service_change.status = status;
         service_change.server_if = p_msg->api_send_service_change.server_if;
         (*p_rcb->p_cback)(BTA_GATTS_SEND_SERVICE_CHANGE_EVT,  (tBTA_GATTS *)&service_change);
-    }   
+    }
 }
 
 /*******************************************************************************
@@ -932,6 +942,9 @@ static void bta_gatts_send_request_cback (UINT16 conn_id,
             cb_data.req_data.trans_id   = trans_id;
             cb_data.req_data.p_data     = (tBTA_GATTS_REQ_DATA *)p_data;
 
+            if(req_type == BTA_GATTS_CONF_EVT) {
+               cb_data.req_data.handle =  p_data->handle;
+            }
             (*p_rcb->p_cback)(req_type,  &cb_data);
         } else {
             APPL_TRACE_ERROR("connection request on gatt_if[%d] is not interested", gatt_if);
@@ -1003,22 +1016,14 @@ static void bta_gatts_conn_cback (tGATT_IF gatt_if, BD_ADDR bda, UINT16 conn_id,
 ** Returns          none.
 **
 *******************************************************************************/
+extern void btc_congest_callback(tBTA_GATTS *param);
 static void bta_gatts_cong_cback (UINT16 conn_id, BOOLEAN congested)
 {
-    tBTA_GATTS_RCB *p_rcb;
-    tGATT_IF gatt_if;
-    tBTA_GATT_TRANSPORT transport;
     tBTA_GATTS cb_data;
 
-    if (GATT_GetConnectionInfor(conn_id, &gatt_if, cb_data.req_data.remote_bda, &transport)) {
-        p_rcb = bta_gatts_find_app_rcb_by_app_if(gatt_if);
+    cb_data.congest.conn_id = conn_id;
+    cb_data.congest.congested = congested;
 
-        if (p_rcb && p_rcb->p_cback) {
-            cb_data.congest.conn_id = conn_id;
-            cb_data.congest.congested = congested;
-
-            (*p_rcb->p_cback)(BTA_GATTS_CONGEST_EVT, &cb_data);
-        }
-    }
+    btc_congest_callback(&cb_data);
 }
 #endif /* GATTS_INCLUDED */

components/bt/bluedroid/bta/gatt/include/bta_gattc_int.h

@@ -498,6 +498,7 @@ extern BOOLEAN bta_gattc_mark_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR_PTR rem
 extern BOOLEAN bta_gattc_check_bg_conn (tBTA_GATTC_IF client_if,  BD_ADDR remote_bda, UINT8 role);
 extern UINT8 bta_gattc_num_reg_app(void);
 extern void bta_gattc_clear_notif_registration(tBTA_GATTC_SERV *p_srcb, UINT16 conn_id, UINT16 start_handle, UINT16 end_handle);
+extern void bta_gattc_clear_notif_registration_by_bda(tBTA_GATTC_RCB *p_clrcb, BD_ADDR remote_bda);
 extern tBTA_GATTC_SERV * bta_gattc_find_srvr_cache(BD_ADDR bda);
 
 /* discovery functions */
@@ -511,12 +512,12 @@ extern const tBTA_GATTC_SERVICE* bta_gattc_get_service_for_handle(UINT16 conn_id
 tBTA_GATTC_CHARACTERISTIC*  bta_gattc_get_characteristic_srcb(tBTA_GATTC_SERV *p_srcb, UINT16 handle);
 extern tBTA_GATTC_CHARACTERISTIC* bta_gattc_get_characteristic(UINT16 conn_id, UINT16 handle);
 extern tBTA_GATTC_DESCRIPTOR* bta_gattc_get_descriptor(UINT16 conn_id, UINT16 handle);
-extern void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count);
+extern void bta_gattc_get_db_size_handle(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count);
 extern void bta_gattc_get_db_size_with_type_handle(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                                   UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count);
+                                                   UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count);
 extern void bta_gattc_get_service_with_uuid(UINT16 conn_id, tBT_UUID *svc_uuid,
                                             btgatt_db_element_t **svc_db,
-                                            int *count);
+                                            UINT16 *count);
 
 extern void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       bt_gatt_get_db_op_t op,
@@ -526,9 +527,9 @@ extern void bta_gattc_get_db_with_opration(UINT16 conn_id,
                                                       tBT_UUID *descr_uuid,
                                                       UINT16 start_handle, UINT16 end_handle,
                                                       btgatt_db_element_t **char_db,
-                                                      int *count);
+                                                      UINT16 *count);
 
-extern void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, int *count);
+extern void bta_gattc_get_gatt_db(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, btgatt_db_element_t **db, UINT16 *count);
 
 extern tBTA_GATT_STATUS bta_gattc_init_cache(tBTA_GATTC_SERV *p_srvc_cb);
 extern void bta_gattc_rebuild_cache(tBTA_GATTC_SERV *p_srcv, UINT16 num_attr, tBTA_GATTC_NV_ATTR *attr);

components/bt/bluedroid/bta/hf_client/bta_hf_client_api.c

@@ -141,7 +141,7 @@ void BTA_HfClientRegister(tBTA_SEC sec_mask, tBTA_HF_CLIENT_FEAT features,
         p_buf->features = features;
         p_buf->sec_mask = sec_mask;
         if (p_service_name) {
-            BCM_STRNCPY_S(p_buf->name, BTA_SERVICE_NAME_LEN + 1, p_service_name, BTA_SERVICE_NAME_LEN);
+            BCM_STRNCPY_S(p_buf->name, p_service_name, BTA_SERVICE_NAME_LEN);
             p_buf->name[BTA_SERVICE_NAME_LEN] = 0;
         } else {
             p_buf->name[0] = '\0';

components/bt/bluedroid/bta/hf_client/bta_hf_client_at.c

@@ -75,12 +75,12 @@ typedef struct {
 /* CIND: storage room for indicators value range and their statuses */
 static const tBTA_HF_CLIENT_INDICATOR bta_hf_client_indicators[BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT] = {
     /* name                                | min | max | name length - used by parser */
-    {BTA_HF_CLIENT_INDICATOR_BATTERYCHG,     0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_BATTERYCHG)},
-    {BTA_HF_CLIENT_INDICATOR_SIGNAL,         0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_SIGNAL)},
-    {BTA_HF_CLIENT_INDICATOR_SERVICE,        0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_SERVICE)},
     {BTA_HF_CLIENT_INDICATOR_CALL,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_CALL)},
-    {BTA_HF_CLIENT_INDICATOR_ROAM,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_ROAM)},
     {BTA_HF_CLIENT_INDICATOR_CALLSETUP,      0,   3,    sizeof(BTA_HF_CLIENT_INDICATOR_CALLSETUP)},
+    {BTA_HF_CLIENT_INDICATOR_SERVICE,        0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_SERVICE)},
+    {BTA_HF_CLIENT_INDICATOR_SIGNAL,         0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_SIGNAL)},
+    {BTA_HF_CLIENT_INDICATOR_ROAM,           0,   1,    sizeof(BTA_HF_CLIENT_INDICATOR_ROAM)},
+    {BTA_HF_CLIENT_INDICATOR_BATTERYCHG,     0,   5,    sizeof(BTA_HF_CLIENT_INDICATOR_BATTERYCHG)},
     {BTA_HF_CLIENT_INDICATOR_CALLHELD,       0,   2,    sizeof(BTA_HF_CLIENT_INDICATOR_CALLHELD)}
 };
 
@@ -94,7 +94,7 @@ UINT32 service_index = 0;
 BOOLEAN service_availability = TRUE;
 /* helper functions for handling AT commands queueing */
 
-static void bta_hf_client_handle_ok();
+static void bta_hf_client_handle_ok(void);
 
 static void bta_hf_client_clear_queued_at(void)
 {
@@ -268,7 +268,7 @@ static void bta_hf_client_start_at_hold_timer(void)
 **   No buffer parsing is being done here.
 *******************************************************************************/
 
-static void bta_hf_client_handle_ok()
+static void bta_hf_client_handle_ok(void)
 {
     APPL_TRACE_DEBUG("%s", __FUNCTION__);
 
@@ -342,7 +342,7 @@ static void bta_hf_client_handle_error(tBTA_HF_CLIENT_AT_RESULT_TYPE type, UINT1
     bta_hf_client_send_queued_at();
 }
 
-static void bta_hf_client_handle_ring()
+static void bta_hf_client_handle_ring(void)
 {
     APPL_TRACE_DEBUG("%s", __FUNCTION__);
     bta_hf_client_evt_val(BTA_HF_CLIENT_RING_INDICATION, 0);
@@ -427,7 +427,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
 
     APPL_TRACE_DEBUG("%s index: %u value: %u", __FUNCTION__, index, value);
 
-    if (index == 0 || index > BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
+    if (index >= BTA_HF_CLIENT_AT_INDICATOR_COUNT) {
         return;
     }
 
@@ -435,7 +435,7 @@ static void bta_hf_client_handle_ciev(UINT32 index, UINT32 value)
         service_availability = value == 0 ? FALSE : TRUE;
     }
 
-    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index - 1];
+    realind = bta_hf_client_cb.scb.at_cb.indicator_lookup[index];
 
     if (realind >= 0 && realind < BTA_HF_CLIENT_AT_SUPPORTED_INDICATOR_COUNT) {
         /* get the real in-array index from lookup table by index it comes at */
@@ -576,15 +576,17 @@ static void bta_hf_client_handle_btrh( UINT16 code)
 
 /* Check if prefix match and skip spaces if any */
 #define AT_CHECK_EVENT(buf, event) \
-    if (strncmp("\r\n"event, buf,sizeof("\r\n"event) - 1) != 0) return buf; \
-    buf += sizeof("\r\n"event) - 1; \
-    while (*buf == ' ') buf++;
+if (strncmp("\r\n"event,buf,sizeof("\r\n"event) - 1) != 0) \
+    return buf; \
+buf += sizeof("\r\n"event) - 1; \
+while (*buf == ' ') buf++;
 
 /* check for <cr><lf> and forward buffer if match */
 #define AT_CHECK_RN(buf) \
     if (strncmp("\r\n", buf, sizeof("\r\n") - 1) != 0) { \
-        APPL_TRACE_DEBUG("%s missing end <cr><lf>", __FUNCTION__); \
-        return NULL;} \
+        APPL_TRACE_ERROR("%s missing end <cr><lf>", __FUNCTION__); \
+        return NULL;\
+    } \
     buf += sizeof("\r\n") - 1;
 
 /* skip rest of AT string up to <cr> */
@@ -1022,20 +1024,20 @@ static char *bta_hf_client_parse_clcc(char *buffer)
 static char *bta_hf_client_parse_cnum(char *buffer)
 {
     char numstr[33];     /* spec forces 32 chars, plus one for \0*/
-    UINT16 type;
-    UINT16 service = 0; /* 0 in case this optional parameter is not being sent */
+    int type;
+    int service = 0; /* 0 in case this optional parameter is not being sent */
     int res;
     int offset;
 
     AT_CHECK_EVENT(buffer, "+CNUM:");
 
-    res = sscanf(buffer, ",\"%32[^\"]\",%hu,,%hu%n", numstr, &type, &service, &offset);
+    res = sscanf(buffer, ",\"%32[^\"]\",%d%n,,%d%n", numstr, &type, &offset, &service, &offset);
     if (res < 0) {
         return NULL;
     }
 
     if (res == 0) {
-        res = sscanf(buffer, ",\"\",%hu,,%hu%n", &type, &service, &offset);
+        res = sscanf(buffer, ",\"\",%d%n,,%d%n", &type, &offset, &service, &offset);
         if (res < 0) {
             return NULL;
         }
@@ -1045,7 +1047,7 @@ static char *bta_hf_client_parse_cnum(char *buffer)
         numstr[0] = '\0';
     }
 
-    if (res < 3) {
+    if (res < 2) {
         return NULL;
     }
 
@@ -1159,6 +1161,7 @@ static char *bta_hf_client_skip_unknown(char *buffer)
     buffer = tmp + 2;
 
     APPL_TRACE_DEBUG("%s %.*s", __FUNCTION__, buffer - start - 2, start);
+    UNUSED(start);
 
     return buffer;
 }
@@ -1256,7 +1259,7 @@ static void bta_hf_client_at_parse_start(void)
         for (i = 0; i < bta_hf_client_psraser_cb_count; i++) {
             tmp = bta_hf_client_parser_cb[i](buf);
             if (tmp == NULL) {
-                APPL_TRACE_ERROR("HFPCient: AT event/reply parsing failed, skipping");
+                APPL_TRACE_ERROR("HFPCient: AT event/reply parsing failed, skipping %d", i);
                 tmp = bta_hf_client_skip_unknown(buf);
                 break;
             }

components/bt/bluedroid/bta/hf_client/bta_hf_client_sco.c

@@ -308,6 +308,7 @@ static void bta_hf_client_sco_disc_cback(UINT16 sco_idx)
 #if (BTM_SCO_HCI_INCLUDED == TRUE )
         tBTM_STATUS status = BTM_ConfigScoPath(BTM_SCO_ROUTE_PCM, NULL, NULL, TRUE);
         APPL_TRACE_DEBUG("%s close config status = %d", __FUNCTION__, status);
+        UNUSED(status);
         /* SCO clean up here */
         bta_hf_client_sco_co_close();
 #endif

components/bt/bluedroid/bta/hh/bta_hh_act.c

@@ -101,8 +101,10 @@ void bta_hh_api_enable(tBTA_HH_DATA *p_data)
         bta_hh_le_enable();
     } else
 #endif
+    {
         /* signal BTA call back event */
         (* bta_hh_cb.p_cback)(BTA_HH_ENABLE_EVT, (tBTA_HH *)&status);
+    }
 }
 /*******************************************************************************
 **
@@ -901,7 +903,9 @@ void bta_hh_get_dscp_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
         bta_hh_le_get_dscp_act(p_cb);
     } else
 #endif
+    {
         (*bta_hh_cb.p_cback)(BTA_HH_GET_DSCP_EVT, (tBTA_HH *)&p_cb->dscp_info);
+    }
 }
 
 /*******************************************************************************
@@ -934,11 +938,10 @@ void bta_hh_maint_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
                 dev_info.status   = BTA_HH_OK;
             } else
 #endif
-
+            {
                 if (HID_HostAddDev(p_dev_info->bda, p_dev_info->attr_mask, &dev_handle)\
                         == HID_SUCCESS) {
                     dev_info.handle   = dev_handle;
-                    dev_info.status   = BTA_HH_OK;
 
 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
                     /* update DI information */
@@ -966,6 +969,7 @@ void bta_hh_maint_dev_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
                     /* update cb_index[] map */
                     bta_hh_cb.cb_index[dev_handle] = p_cb->index;
                 }
+            }
         } else { /* device already been added */
             dev_info.handle = p_cb->hid_handle;
             dev_info.status = BTA_HH_OK;

components/bt/bluedroid/bta/hh/bta_hh_le.c

@@ -2183,9 +2183,10 @@ void bta_hh_le_write_char_descr_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_b
         case GATT_UUID_HID_BT_KB_INPUT:
         case GATT_UUID_HID_BT_MOUSE_INPUT:
         case GATT_UUID_HID_REPORT:
-            if (p_data->status == BTA_GATT_OK)
+            if (p_data->status == BTA_GATT_OK) {
                 p_dev_cb->hid_srvc[hid_inst_id].report[p_dev_cb->clt_cfg_idx].client_cfg_value =
                     BTA_GATT_CLT_CONFIG_NOTIFICATION;
+            }
             p_dev_cb->clt_cfg_idx ++;
             bta_hh_le_write_rpt_clt_cfg(p_dev_cb, hid_inst_id);
 

components/bt/bluedroid/bta/hh/bta_hh_utils.c

@@ -75,11 +75,12 @@ UINT8  bta_hh_find_cb(BD_ADDR bda)
             return xx;
         }
 #if BTA_HH_DEBUG
-        else
+        else {
             APPL_TRACE_DEBUG("in_use ? [%d] kdev[%d].hid_handle = %d state = [%d]",
                              bta_hh_cb.kdev[xx].in_use, xx,
                              bta_hh_cb.kdev[xx].hid_handle,
                              bta_hh_cb.kdev[xx].state);
+        }
 #endif
     }
 
@@ -123,7 +124,9 @@ void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB *p_cb)
             bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = BTA_HH_IDX_INVALID;
         } else
 #endif
+        {
             bta_hh_cb.cb_index[p_cb->hid_handle] = BTA_HH_IDX_INVALID;
+        }
     }
 
     /* reset device control block */
@@ -486,11 +489,12 @@ UINT8 bta_hh_dev_handle_to_cb_idx(UINT8 dev_handle)
 #endif
     } else
 #endif
+    {
         /* regular HID device checking */
         if (dev_handle < BTA_HH_MAX_KNOWN ) {
             index = bta_hh_cb.cb_index[dev_handle];
         }
-
+    }
     return index;
 
 }

components/bt/bluedroid/bta/include/bta/bta_api.h

@@ -399,6 +399,8 @@ typedef struct {
     UINT8                   tx_power;
 } tBTA_BLE_ADV_DATA;
 
+typedef void (tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTA_STATUS status, uint8_t subcode, uint32_t length, uint8_t *device_info);
+
 typedef void (tBTA_SET_ADV_DATA_CMPL_CBACK) (tBTA_STATUS status);
 
 typedef tBTM_START_ADV_CMPL_CBACK tBTA_START_ADV_CMPL_CBACK;
@@ -767,6 +769,7 @@ typedef struct {
     tBLE_ADDR_TYPE  addr_type;          /* Peer device address type */
     tBT_DEVICE_TYPE dev_type;
     UINT8           auth_mode;
+    BOOLEAN           sc_support;         /* Denotes if peer device supported secure connection while bonding. */
 } tBTA_DM_AUTH_CMPL;
 
 
@@ -782,6 +785,7 @@ typedef struct {
 
 /* Structure associated with BTA_DM_LINK_UP_EVT */
 typedef struct {
+    BOOLEAN         sc_downgrade;       /* Security downgrade state. */
     BD_ADDR         bd_addr;            /* BD address peer device. */
 #if BLE_INCLUDED == TRUE
     tBTA_TRANSPORT  link_type;
@@ -1022,6 +1026,7 @@ typedef struct {
 #define BTA_DM_DISC_CMPL_EVT            4       /* Discovery complete. */
 #define BTA_DM_DI_DISC_CMPL_EVT         5       /* Discovery complete. */
 #define BTA_DM_SEARCH_CANCEL_CMPL_EVT   6       /* Search cancelled */
+#define BTA_DM_INQ_DISCARD_NUM_EVT      7       /* The number of inquiry discarded packets */
 
 typedef UINT8 tBTA_DM_SEARCH_EVT;
 
@@ -1053,6 +1058,11 @@ typedef struct {
     UINT8           num_resps;          /* Number of inquiry responses. */
 } tBTA_DM_INQ_CMPL;
 
+/* Structure associated with BTA_DM_INQ_DISCARD_NUM_EVT */
+typedef struct {
+    UINT32           num_dis;          /* The number of inquiry discarded packets. */
+} tBTA_DM_INQ_DISCARD;
+
 /* Structure associated with BTA_DM_DI_DISC_CMPL_EVT */
 typedef struct {
     BD_ADDR             bd_addr;        /* BD address peer device. */
@@ -1090,6 +1100,7 @@ typedef union {
     tBTA_DM_DISC_RES    disc_res;       /* Discovery result for a peer device. */
     tBTA_DM_DISC_BLE_RES    disc_ble_res;   /* Discovery result for GATT based service */
     tBTA_DM_DI_DISC_CMPL    di_disc;        /* DI discovery result for a peer device */
+    tBTA_DM_INQ_DISCARD     inq_dis;       /* the discarded packets information of inquiry */
 } tBTA_DM_SEARCH;
 
 /* Structure of search callback event and structures */
@@ -1658,7 +1669,8 @@ extern void BTA_DmPasskeyReqReply(BOOLEAN accept, BD_ADDR bd_addr, UINT32 passke
 extern void BTA_DmAddDevice(BD_ADDR bd_addr, DEV_CLASS dev_class,
                             LINK_KEY link_key, tBTA_SERVICE_MASK trusted_mask,
                             BOOLEAN is_trusted, UINT8 key_type,
-                            tBTA_IO_CAP io_cap, UINT8 pin_length);
+                            tBTA_IO_CAP io_cap, UINT8 pin_length,
+                            UINT8 sc_support);
 
 /*******************************************************************************
 **
@@ -1870,12 +1882,13 @@ extern void BTA_DmBleConfirmReply(BD_ADDR bd_addr, BOOLEAN accept);
 **
 ** Parameters:      bd_addr          - BD address of the peer
 **                  dev_type         - Remote device's device type.
+**                  auth_mode        - auth mode
 **                  addr_type        - LE device address type.
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type,
+extern void BTA_DmAddBleDevice(BD_ADDR bd_addr, tBLE_ADDR_TYPE addr_type, int auth_mode,
                                tBT_DEVICE_TYPE dev_type);
 
 
@@ -2236,6 +2249,24 @@ extern void BTA_DmBleSetScanRsp (tBTA_BLE_AD_MASK data_mask,
 extern void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len,
                                     tBTA_SET_ADV_DATA_CMPL_CBACK *p_scan_rsp_data_cback);
 
+/*******************************************************************************
+**
+** Function         BTA_DmUpdateDuplicateExceptionalList
+**
+** Description      This function is called to update duplicate scan exceptional list
+**
+** Parameters       subcode : add, remove or clean duplicate scan exceptional list.
+**                  type : device info type.
+**                  device_info:  device info
+**                  p_update_duplicate_ignore_list_cback :  update complete callback.
+**
+** Returns          None
+**
+*******************************************************************************/
+extern void BTA_DmUpdateDuplicateExceptionalList(UINT8 subcode, UINT32 type, 
+                                                BD_ADDR device_info, 
+                                                tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_exceptional_list_cback);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleBroadcast

components/bt/bluedroid/bta/include/bta/bta_av_api.h

@@ -509,8 +509,10 @@ typedef struct {
     UINT32  company_id;         /* AVRCP Company ID */
     UINT16  avrc_mtu;           /* AVRCP MTU at L2CAP for control channel */
     UINT16  avrc_br_mtu;        /* AVRCP MTU at L2CAP for browsing channel */
-    UINT16  avrc_ct_cat;        /* AVRCP controller categories */
-    UINT16  avrc_tg_cat;        /* AVRCP target categories */
+    UINT16  avrc_snk_ct_cat;    /* AVRCP controller categories as SNK */
+    UINT16  avrc_snk_tg_cat;    /* AVRCP target categories SNK */
+    UINT16  avrc_src_ct_cat;    /* AVRCP controller categories as SRC */
+    UINT16  avrc_src_tg_cat;    /* AVRCP target categories as SRC */
     UINT16  sig_mtu;            /* AVDTP signaling channel MTU at L2CAP */
     UINT16  audio_mtu;          /* AVDTP audio transport channel MTU at L2CAP */
     const UINT16 *p_audio_flush_to;/* AVDTP audio transport channel flush timeout */

components/bt/bluedroid/bta/include/bta/bta_dm_co.h

@@ -205,6 +205,8 @@ extern void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key);
 
 extern void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size);
 
+extern void bta_dm_co_ble_set_min_key_size(UINT8 ble_key_size);
+
 extern void bta_dm_co_ble_set_accept_auth_enable(UINT8 enable);
 
 extern UINT8 bta_dm_co_ble_get_accept_auth_enable(void);

components/bt/bluedroid/bta/include/bta/bta_gatt_api.h

@@ -152,7 +152,7 @@ typedef UINT8 tBTA_GATT_STATUS;
 #define BTA_GATTC_CLOSE_EVT             5   /* GATTC  close request status event */
 #define BTA_GATTC_SEARCH_CMPL_EVT       6   /* GATT discovery complete event */
 #define BTA_GATTC_SEARCH_RES_EVT        7   /* GATT discovery result event */
-#define BTA_GATTC_READ_DESCR_EVT        8   /* GATT read characterisitc descriptor event */
+#define BTA_GATTC_READ_DESCR_EVT        8   /* GATT read characteristic descriptor event */
 #define BTA_GATTC_WRITE_DESCR_EVT       9   /* GATT write characteristic descriptor event */
 #define BTA_GATTC_NOTIF_EVT             10  /* GATT attribute notification event */
 #define BTA_GATTC_PREP_WRITE_EVT        11  /* GATT prepare write  event */
@@ -739,7 +739,7 @@ extern void BTA_GATTC_Disable(void);
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTC module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_client_cb - pointer to the application callback function.
 **
 ** Returns          None
@@ -867,32 +867,32 @@ extern const tBTA_GATTC_CHARACTERISTIC* BTA_GATTC_GetCharacteristic(UINT16 conn_
 *******************************************************************************/
 extern const tBTA_GATTC_DESCRIPTOR* BTA_GATTC_GetDescriptor(UINT16 conn_id, UINT16 handle);
 
-extern void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid, 
-                                         btgatt_db_element_t **db, int *count);
+extern void BTA_GATTC_GetServiceWithUUID(UINT16 conn_id, tBT_UUID *svc_uuid,
+                                         btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetAllChar(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                 btgatt_db_element_t **db, int *count);
+                                 btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetAllDescriptor(UINT16 conn_id, UINT16 char_handle,
-                                       btgatt_db_element_t **db, int *count);
+                                       btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetCharByUUID(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, tBT_UUID char_uuid,
-                                    btgatt_db_element_t **db, int *count);
+                                    btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetDescrByUUID(UINT16 conn_id, uint16_t start_handle, uint16_t end_handle,
                                      tBT_UUID char_uuid, tBT_UUID descr_uuid,
-                                     btgatt_db_element_t **db, int *count);
+                                     btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetDescrByCharHandle(UINT16 conn_id, UINT16 char_handle, tBT_UUID descr_uuid,
-                                           btgatt_db_element_t **db, int *count);
+                                           btgatt_db_element_t **db, UINT16 *count);
 
 extern void BTA_GATTC_GetIncludeService(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                        tBT_UUID *incl_uuid, btgatt_db_element_t **db, int *count);
+                                        tBT_UUID *incl_uuid, btgatt_db_element_t **db, UINT16 *count);
 
-extern void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, int *count);
+extern void BTA_GATTC_GetDBSize(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle, UINT16 *count);
 
 extern void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_t type,
-                                      UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, int *count);
+                                      UINT16 start_handle, UINT16 end_handle, UINT16 char_handle, UINT16 *count);
 
 /*******************************************************************************
 **
@@ -907,7 +907,7 @@ extern void BTA_GATTC_GetDBSizeByType(UINT16 conn_id, bt_gatt_db_attribute_type_
 **
 *******************************************************************************/
 extern void BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle,
-                                btgatt_db_element_t **db, int *count);
+                                btgatt_db_element_t **db, UINT16 *count);
 
 /*******************************************************************************
 **
@@ -1202,7 +1202,7 @@ extern void BTA_GATTS_Disable(void);
 ** Description      This function is called to register application callbacks
 **                    with BTA GATTS module.
 **
-** Parameters       p_app_uuid - applicaiton UUID
+** Parameters       p_app_uuid - application UUID
 **                  p_cback - pointer to the application callback function.
 **
 ** Returns          None
@@ -1325,7 +1325,7 @@ extern void  BTA_GATTS_DeleteService(UINT16 service_id);
 ** Description      This function is called to start a service.
 **
 ** Parameters       service_id: the service ID to be started.
-**                  sup_transport: supported trasnport.
+**                  sup_transport: supported transport.
 **
 ** Returns          None.
 **

components/bt/bluedroid/bta/include/bta/bta_hf_client_api.h

@@ -115,15 +115,16 @@ typedef UINT8 tBTA_HF_CLIENT_EVT;
 
 typedef UINT8 tBTA_HF_CLIENT_STATUS;
 
-/* indicator type */
-#define BTA_HF_CLIENT_IND_BATTCH    0  /* Battery charge indicator */
-#define BTA_HF_CLIENT_IND_SIGNAL    1  /* Signal Strength indicator */
-#define BTA_HF_CLIENT_IND_SERVICE   2  /* Service availability indicator */
-#define BTA_HF_CLIENT_IND_CALL      3  /* Standard call status indicator*/
-#define BTA_HF_CLIENT_IND_ROAM      4  /* Roaming status indicator */
-#define BTA_HF_CLIENT_IND_CALLSETUP 5  /* Call setup status indicator */
-#define BTA_HF_CLIENT_IND_CALLHELD  6  /* Call hold status indicator */
-
+/* indicator constants HFP 1.1 and later */
+#define BTA_HF_CLIENT_IND_CALL             0   /* position of call indicator */
+#define BTA_HF_CLIENT_IND_CALLSETUP        1   /* position of callsetup indicator */
+#define BTA_HF_CLIENT_IND_SERVICE          2   /* position of service indicator */
+/* indicator constants HFP 1.5 and later */
+#define BTA_HF_CLIENT_IND_SIGNAL           3   /* position of signal strength indicator */
+#define BTA_HF_CLIENT_IND_ROAM             4   /* position of roaming indicator */
+#define BTA_HF_CLIENT_IND_BATTCH           5   /* position of battery charge indicator */
+#define BTA_HF_CLIENT_IND_CALLHELD         6   /* position of callheld indicator */
+#define BTA_HF_CLIENT_IND_BEARER           7   /* position of bearer indicator */
 typedef UINT8 tBTA_HF_CLIENT_IND_TYPE;
 
 /* AT commands */

components/bt/bluedroid/bta/jv/bta_jv_act.c

@@ -26,6 +26,7 @@
 #include <stdlib.h>
 
 #include "osi/allocator.h"
+#include "osi/osi.h"
 #include "stack/bt_types.h"
 #include "bta/utl.h"
 #include "bta/bta_sys.h"
@@ -137,7 +138,7 @@ UINT8 bta_jv_alloc_sec_id(void)
     return ret;
 
 }
-static int get_sec_id_used(void)
+UNUSED_ATTR static int get_sec_id_used(void)
 {
     int i;
     int used = 0;
@@ -146,12 +147,13 @@ static int get_sec_id_used(void)
             used++;
         }
     }
-    if (used == BTA_JV_NUM_SERVICE_ID)
+    if (used == BTA_JV_NUM_SERVICE_ID) {
         APPL_TRACE_ERROR("get_sec_id_used, sec id exceeds the limit:%d",
                          BTA_JV_NUM_SERVICE_ID);
+    }
     return used;
 }
-static int get_rfc_cb_used(void)
+UNUSED_ATTR static int get_rfc_cb_used(void)
 {
     int i;
     int used = 0;
@@ -160,9 +162,10 @@ static int get_rfc_cb_used(void)
             used++;
         }
     }
-    if (used == BTA_JV_MAX_RFC_CONN)
+    if (used == BTA_JV_MAX_RFC_CONN) {
         APPL_TRACE_ERROR("get_sec_id_used, rfc ctrl block exceeds the limit:%d",
                          BTA_JV_MAX_RFC_CONN);
+    }
     return used;
 }
 
@@ -474,19 +477,21 @@ static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
                         < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si]) {
                     tBTA_JV_PCB *p_pcb = bta_jv_rfc_port_to_pcb(bta_jv_cb.rfc_cb[hi].rfc_hdl[si]);
                     if (p_pcb) {
-                        if (NULL == p_pcb->p_pm_cb)
+                        if (NULL == p_pcb->p_pm_cb) {
                             APPL_TRACE_WARNING("%s(jv_handle:"
                                                " 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to "
                                                "pm_cb?", __func__, jv_handle, p_pcb->port_handle, i);
+                        }
                         p_cb = &p_pcb->p_pm_cb;
                     }
                 }
             } else {
                 if (jv_handle < BTA_JV_MAX_L2C_CONN) {
                     tBTA_JV_L2C_CB *p_l2c_cb = &bta_jv_cb.l2c_cb[jv_handle];
-                    if (NULL == p_l2c_cb->p_pm_cb)
+                    if (NULL == p_l2c_cb->p_pm_cb) {
                         APPL_TRACE_WARNING("%s(jv_handle: "
                                            "0x%x): p_pm_cb: %d: no link to pm_cb?", __func__, jv_handle, i);
+                    }
                     p_cb = &p_l2c_cb->p_pm_cb;
                 }
             }
@@ -742,9 +747,10 @@ void bta_jv_get_channel_id(tBTA_JV_MSG *p_data)
             bta_jv_cb.scn[channel - 1] = TRUE;
             scn = (UINT8) channel;
         }
-        if (bta_jv_cb.p_dm_cback)
+        if (bta_jv_cb.p_dm_cback) {
             bta_jv_cb.p_dm_cback(BTA_JV_GET_SCN_EVT, (tBTA_JV *)&scn,
                                  p_data->alloc_channel.user_data);
+        }
         return;
     }
     case BTA_JV_CONN_TYPE_L2CAP:
@@ -998,6 +1004,9 @@ static bool create_base_record(const uint32_t sdp_handle, const char *name, cons
     APPL_TRACE_DEBUG("create_base_record: successfully created base service "
                    "record, handle: 0x%08x, scn: %d, name: %s, with_obex: %d",
                    sdp_handle, channel, name, with_obex);
+
+    UNUSED(stage);
+
     return TRUE;
 }
 
@@ -1031,6 +1040,8 @@ static int add_spp_sdp(const char *name, const int channel) {
 
     APPL_TRACE_DEBUG("add_spp_sdp: service registered successfully, "
                    "service_name: %s, handle 0x%08x)", name, handle);
+    UNUSED(stage);
+
     return handle;
 }
 
@@ -1523,6 +1534,7 @@ static int bta_jv_port_data_co_cback(UINT16 port_handle, UINT8 *buf, UINT16 len,
     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
     int ret = 0;
     APPL_TRACE_DEBUG("%s, p_cb:%p, p_pcb:%p, len:%d, type:%d", __func__, p_cb, p_pcb, len, type);
+    UNUSED(p_cb);
     if (p_pcb != NULL) {
         switch (type) {
         case DATA_CO_CALLBACK_TYPE_INCOMING:

components/bt/bluedroid/btc/core/btc_ble_storage.c

@@ -553,6 +553,91 @@ bt_status_t btc_storage_remove_ble_dev_type(bt_bdaddr_t *remote_bd_addr, bool fl
     return ret;
 }
 
+static bt_status_t _btc_storage_set_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, uint8_t auth_mode, bool flush)
+{
+    int ret;
+    bdstr_t bdstr;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr_t));
+    ret = btc_config_set_int(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR, (int)auth_mode);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    if (flush) {
+        _btc_storage_save();
+    }
+
+    return BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_set_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, uint8_t auth_mode, bool flush)
+{
+    bt_status_t ret;
+
+    btc_config_lock();
+    ret = _btc_storage_set_ble_dev_auth_mode(remote_bd_addr, auth_mode, flush);
+    btc_config_unlock();
+
+    return ret;
+}
+
+static bt_status_t _btc_storage_get_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, int* auth_mode)
+{
+    bdstr_t bdstr;
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    int ret = btc_config_get_int(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR, auth_mode);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+bt_status_t btc_storage_get_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, int* auth_mode)
+{
+    bt_status_t ret;
+
+    btc_config_lock();
+    ret = _btc_storage_get_ble_dev_auth_mode(remote_bd_addr, auth_mode);
+    btc_config_unlock();
+
+    return ret;
+}
+
+static bt_status_t _btc_storage_remove_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, bool flush)
+{
+    bool ret = true;
+    bdstr_t bdstr;
+    uint32_t auth_mode = 0;
+
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+
+    ret = btc_config_get_int(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR, (int *)&auth_mode);
+    if (ret == false) {
+        //cannot find the key, just return SUCCESS, indicate already removed
+        return BT_STATUS_SUCCESS;
+    }
+
+    ret = btc_config_remove(bdstr, BTC_BLE_STORAGE_LE_AUTH_MODE_STR);
+    if (ret == false) {
+        return BT_STATUS_FAIL;
+    }
+
+    if (flush) {
+        _btc_storage_save();
+    }
+
+    return  BT_STATUS_SUCCESS;
+}
+
+bt_status_t btc_storage_remove_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, bool flush)
+{
+    bt_status_t ret;
+
+    btc_config_lock();
+    ret = _btc_storage_remove_ble_dev_auth_mode(remote_bd_addr, flush);
+    btc_config_unlock();
+
+    return ret;
+}
+
 static bt_status_t _btc_storage_set_remote_addr_type(bt_bdaddr_t *remote_bd_addr, uint8_t addr_type, bool flush)
 {
     int ret;
@@ -657,11 +742,17 @@ static void _btc_read_le_key(const uint8_t key_type, const size_t key_len, bt_bd
             bdcpy(bta_bd_addr, bd_addr.address);
 
             if (!*device_added) {
-                BTA_DmAddBleDevice(bta_bd_addr, addr_type, BT_DEVICE_TYPE_BLE);
+                int auth_mode = 0;
+                if(_btc_storage_get_ble_dev_auth_mode(&bd_addr, &auth_mode) != BT_STATUS_SUCCESS) {
+                    BTC_TRACE_WARNING("%s Failed to get auth mode from flash, please erase flash and download the firmware again", __func__);
+                }
+                BTA_DmAddBleDevice(bta_bd_addr, addr_type, auth_mode, BT_DEVICE_TYPE_BLE);
                 *device_added = true;
             }
 
+#if (!CONFIG_BT_STACK_NO_LOG)
             char bd_str[20] = {0};
+#endif
             BTC_TRACE_DEBUG("%s() Adding key type %d for %s", __func__,
                 key_type, bdaddr_to_string(&bd_addr, bd_str, sizeof(bd_str)));
             BTA_DmAddBleKey(bta_bd_addr, (tBTA_LE_KEY_VALUE *)buffer, key_type);

components/bt/bluedroid/btc/core/btc_dm.c

@@ -176,6 +176,7 @@ static void btc_dm_remove_ble_bonding_keys(void)
     bdcpy(bd_addr.address, pairing_cb.bd_addr);
 
     btc_storage_remove_remote_addr_type(&bd_addr, false);
+    btc_storage_remove_ble_dev_auth_mode(&bd_addr, false);
     btc_storage_remove_ble_dev_type(&bd_addr, false);
     btc_storage_remove_ble_bonding_keys(&bd_addr);
 }
@@ -261,9 +262,14 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
         BTC_TRACE_DEBUG ("%s, -  pairing_cb.bd_addr: %08x%04x", __func__,
                              (pairing_cb.bd_addr[0] << 24) + (pairing_cb.bd_addr[1] << 16) + (pairing_cb.bd_addr[2] << 8) + pairing_cb.bd_addr[3],
                              (pairing_cb.bd_addr[4] << 8) + pairing_cb.bd_addr[5]);
+        // Check if need to save BLE keys
+        if((p_auth_cmpl->auth_mode & SMP_AUTH_GEN_BOND) == 0) {
+            return;
+        }
          if (btc_storage_get_remote_addr_type(&bdaddr, &addr_type) != BT_STATUS_SUCCESS) {
             btc_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type, true);
         }
+        btc_storage_set_ble_dev_auth_mode(&bdaddr, p_auth_cmpl->auth_mode, true);
         btc_dm_save_ble_bonding_keys();
     } else {
         /*Map the HCI fail reason  to  bt status  */
@@ -284,12 +290,36 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 
     }
 
+#if (CONFIG_BT_STACK_NO_LOG)
+    (void) status;
+#endif
     BTC_TRACE_DEBUG("%s, authentication status = %x", __func__, status);
     return;
 
 }
 #endif ///SMP_INCLUDED == TRUE
 
+static void btc_dm_link_up_evt(tBTA_DM_LINK_UP *p_link_up)
+{
+    BD_ADDR bd_addr;
+    bt_bdaddr_t bt_bdaddr;
+
+
+    if (p_link_up->sc_downgrade == 1) {
+        memcpy(bt_bdaddr.address, p_link_up->bd_addr, sizeof(BD_ADDR));
+        if (btc_storage_remove_bonded_device(&bt_bdaddr) == BT_STATUS_SUCCESS) {
+            memcpy(bd_addr, p_link_up->bd_addr, sizeof(BD_ADDR));
+            if (BTA_DmRemoveDevice(bd_addr, BT_TRANSPORT_BR_EDR) == BTA_SUCCESS) {
+                BTC_TRACE_EVENT(" %s() Bonding information removed.", __FUNCTION__);
+            } else {
+                BTC_TRACE_ERROR(" %s() BTA_DmRemoveDevice error", __FUNCTION__);
+            }
+        } else {
+            BTC_TRACE_ERROR(" %s() btc_storage_remove_bonded_device error", __FUNCTION__);
+        }
+    }
+}
+
 static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 {
     /* Save link key, if not temporary */
@@ -313,7 +343,7 @@ static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
                           __FUNCTION__, p_auth_cmpl->key_type);
                 ret = btc_storage_add_bonded_device(&bd_addr,
                                                     p_auth_cmpl->key, p_auth_cmpl->key_type,
-                                                    16);
+                                                    16, p_auth_cmpl->sc_support);
                 BTC_ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
             } else {
                 BTC_TRACE_DEBUG("%s: Temporary key. Not storing. key_type=0x%x",
@@ -638,6 +668,7 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
             //remove the bonded key in the config and nvs flash.
             btc_storage_remove_ble_dev_type(&bd_addr, false);
             btc_storage_remove_remote_addr_type(&bd_addr, false);
+            btc_storage_remove_ble_dev_auth_mode(&bd_addr, false);
             param.remove_bond_dev_cmpl.status = btc_storage_remove_ble_bonding_keys(&bd_addr);
         }
         ble_msg.act = ESP_GAP_BLE_REMOVE_BOND_DEV_COMPLETE_EVT;
@@ -654,12 +685,14 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
         break;
         }
 #endif /* BTC_GAP_BT_INCLUDED  == TRUE */
-    case BTA_DM_LINK_UP_EVT:
     case BTA_DM_LINK_DOWN_EVT:
     case BTA_DM_HW_ERROR_EVT:
         BTC_TRACE_DEBUG( "btc_dm_sec_cback : unhandled event (%d)\n", msg->act );
         break;
-#if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
+    case BTA_DM_LINK_UP_EVT:
+        btc_dm_link_up_evt(&p_data->link_up);
+        break;
+#if ((BLE_INCLUDED == TRUE) && (SMP_INCLUDED == TRUE))
     case BTA_DM_BLE_AUTH_CMPL_EVT: {
         rsp_app = true;
         ble_msg.act = ESP_GAP_BLE_AUTH_CMPL_EVT;

components/bt/bluedroid/btc/core/btc_main.c

@@ -64,14 +64,21 @@ static void btc_init_bluetooth(void)
     bte_main_boot_entry(btc_init_callback);
 #if (SMP_INCLUDED)
     btc_config_init();
-    //load the ble local key whitch has been store in the flash
+    //load the ble local key which has been stored in the flash
     btc_dm_load_ble_local_keys();
 #endif /* #if (SMP_INCLUDED) */
+#if BTA_DYNAMIC_MEMORY
+    deinit_semaphore = xSemaphoreCreateBinary();
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 
 static void btc_deinit_bluetooth(void)
 {
+    /* Wait for the disable operation to complete */
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreTake(deinit_semaphore, BTA_DISABLE_DELAY / portTICK_PERIOD_MS);
+#endif /* #if BTA_DYNAMIC_MEMORY */
     btc_gap_ble_deinit();
     bta_dm_sm_deinit();
 #if (GATTC_INCLUDED)
@@ -87,6 +94,10 @@ static void btc_deinit_bluetooth(void)
     osi_alarm_deinit();
     osi_alarm_delete_mux();
     future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);
+#if BTA_DYNAMIC_MEMORY
+    vSemaphoreDelete(deinit_semaphore);
+    deinit_semaphore = NULL;
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 void btc_main_call_handler(btc_msg_t *msg)

components/bt/bluedroid/btc/core/btc_storage.c

@@ -37,7 +37,8 @@
 bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
         LINK_KEY link_key,
         uint8_t key_type,
-        uint8_t pin_length)
+        uint8_t pin_length,
+        BOOLEAN sc_support)
 {
     bdstr_t bdstr;
 
@@ -48,6 +49,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
     int ret = btc_config_set_int(bdstr, BTC_STORAGE_LINK_KEY_TYPE_STR, (int)key_type);
     ret &= btc_config_set_int(bdstr, BTC_STORAGE_PIN_LENGTH_STR, (int)pin_length);
     ret &= btc_config_set_bin(bdstr, BTC_STORAGE_LINK_KEY_STR, link_key, sizeof(LINK_KEY));
+    ret &= btc_config_set_bin(bdstr, BTC_STORAGE_SC_SUPPORT, (uint8_t *)&sc_support, sizeof(sc_support));
     /* write bonded info immediately */
     btc_config_flush();
     btc_config_unlock();
@@ -69,6 +71,7 @@ bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
 static bt_status_t btc_in_fetch_bonded_devices(int add)
 {
     BOOLEAN bt_linkkey_file_found = FALSE;
+    UINT8 sc_support = 0;
 
     btc_config_lock();
     for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end(); iter = btc_config_section_next(iter)) {
@@ -93,9 +96,11 @@ static bt_status_t btc_in_fetch_bonded_devices(int add)
                         uint2devclass((UINT32)cod, dev_class);
                     }
                     btc_config_get_int(name, BTC_STORAGE_PIN_LENGTH_STR, &pin_length);
+                    size = sizeof(sc_support);
+                    btc_config_get_bin(name, BTC_STORAGE_SC_SUPPORT, &sc_support, &size);
 #if (SMP_INCLUDED == TRUE)
                     BTA_DmAddDevice(bd_addr.address, dev_class, link_key, 0, 0,
-                                    (UINT8)linkkey_type, 0, pin_length);
+                                    (UINT8)linkkey_type, 0, pin_length, (UINT8)sc_support);
 #endif  ///SMP_INCLUDED == TRUE
                 }
                 bt_linkkey_file_found = TRUE;
@@ -160,6 +165,9 @@ bt_status_t btc_storage_remove_bonded_device(bt_bdaddr_t *remote_bd_addr)
     if (btc_config_exist(bdstr, BTC_STORAGE_LINK_KEY_STR)) {
         ret &= btc_config_remove(bdstr, BTC_STORAGE_LINK_KEY_STR);
     }
+    if (btc_config_exist(bdstr, BTC_STORAGE_SC_SUPPORT)) {
+        ret &= btc_config_remove(bdstr, BTC_STORAGE_SC_SUPPORT);
+    }
     /* write bonded info immediately */
     btc_config_flush();
     btc_config_unlock();
@@ -187,6 +195,7 @@ int btc_storage_get_num_bt_bond_devices(void)
         if (string_is_bdaddr(name) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
             btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
+            btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
             num_dev++;
         }
@@ -223,6 +232,7 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
         if (string_is_bdaddr(name) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_TYPE_STR) &&
             btc_config_exist(name, BTC_STORAGE_PIN_LENGTH_STR) &&
+            btc_config_exist(name, BTC_STORAGE_SC_SUPPORT) &&
             btc_config_exist(name, BTC_STORAGE_LINK_KEY_STR)) {
             string_to_bdaddr(name, &bd_addr);
             memcpy(bond_dev, &bd_addr, sizeof(bt_bdaddr_t));
@@ -232,4 +242,4 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int de
     btc_config_unlock();
 
     return BT_STATUS_SUCCESS;
-}
+}

components/bt/bluedroid/btc/include/btc/btc_ble_storage.h

@@ -32,6 +32,7 @@
 #define BTC_BLE_STORAGE_LE_KEY_LENC_STR             "LE_KEY_LENC"
 #define BTC_BLE_STORAGE_LE_KEY_LID_STR              "LE_KEY_LID"
 #define BTC_BLE_STORAGE_LE_KEY_LCSRK_STR            "LE_KEY_LCSRK"
+#define BTC_BLE_STORAGE_LE_AUTH_MODE_STR            "AuthMode"
 
 #define BTC_BLE_STORAGE_LOCAL_ADAPTER_STR           "Adapter"
 #define BTC_BLE_STORAGE_LE_LOCAL_KEY_IR_STR         "LE_LOCAL_KEY_IR"
@@ -66,6 +67,12 @@ bt_status_t btc_storage_remove_ble_local_keys(void);
 
 bt_status_t btc_storage_get_ble_local_key(uint8_t key_type, char *key_value, int key_len);
 
+bt_status_t btc_storage_set_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, uint8_t auth_mode, bool flush);
+
+bt_status_t btc_storage_get_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, int* auth_mode);
+
+bt_status_t btc_storage_remove_ble_dev_auth_mode(bt_bdaddr_t *remote_bd_addr, bool flush);
+
 bt_status_t btc_storage_get_remote_addr_type(bt_bdaddr_t *remote_bd_addr, int *addr_type);
 
 bt_status_t btc_storage_set_remote_addr_type(bt_bdaddr_t *remote_bd_addr, uint8_t addr_type, bool flush);

components/bt/bluedroid/btc/include/btc/btc_storage.h

@@ -25,6 +25,7 @@
 #define BTC_STORAGE_LINK_KEY_STR        "LinkKey"    /* same as the ble */
 #define BTC_STORAGE_LINK_KEY_TYPE_STR   "LinkKeyType"
 #define BTC_STORAGE_PIN_LENGTH_STR      "PinLength"
+#define BTC_STORAGE_SC_SUPPORT          "SCSupport"
 
 /*******************************************************************************
 **
@@ -40,7 +41,8 @@
 bt_status_t btc_storage_add_bonded_device(bt_bdaddr_t *remote_bd_addr,
         LINK_KEY link_key,
         uint8_t key_type,
-        uint8_t pin_length);
+        uint8_t pin_length,
+        BOOLEAN sc_support);
 
 /*******************************************************************************
 **

components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c

@@ -147,6 +147,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
             if (blufi_env.prepare_buf == NULL) {
                 blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
+                blufi_env.prepare_len = 0;
                 if (blufi_env.prepare_buf == NULL) {
                     BLUFI_TRACE_ERROR("Blufi prep no mem\n");
                     status = GATT_NO_RESOURCES;
@@ -170,6 +171,15 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
             BTA_GATTS_SendRsp(p_data->req_data.conn_id, p_data->req_data.trans_id,
                           status, &rsp);
 
+            if(status != GATT_SUCCESS) {
+                if (blufi_env.prepare_buf) {
+                    osi_free(blufi_env.prepare_buf);
+                    blufi_env.prepare_buf = NULL;
+                    blufi_env.prepare_len = 0;
+                }
+                BLUFI_TRACE_ERROR("write data error , error code 0x%x\n", status);
+                return;
+            }
             memcpy(blufi_env.prepare_buf + p_data->req_data.p_data->write_req.offset,
                    p_data->req_data.p_data->write_req.value,
                    p_data->req_data.p_data->write_req.len);
@@ -194,13 +204,14 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         BTA_GATTS_SendRsp(p_data->req_data.conn_id, p_data->req_data.trans_id,
                     GATT_SUCCESS, NULL);
 
-        if (p_data->req_data.p_data->exec_write == GATT_PREP_WRITE_EXEC) {
+        if (blufi_env.prepare_buf && p_data->req_data.p_data->exec_write == GATT_PREP_WRITE_EXEC) {
             btc_blufi_recv_handler(blufi_env.prepare_buf, blufi_env.prepare_len);
         }
 
         if (blufi_env.prepare_buf) {
             osi_free(blufi_env.prepare_buf);
             blufi_env.prepare_buf = NULL;
+            blufi_env.prepare_len = 0;
         }
 
         break;
@@ -272,6 +283,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
         blufi_env.conn_id = p_data->conn.conn_id;
         blufi_env.is_connected = true;
+        blufi_env.recv_seq = blufi_env.send_seq = 0;
 
         msg.sig = BTC_SIG_API_CB;
         msg.pid = BTC_PID_BLUFI;
@@ -294,7 +306,6 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
 
         memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
         blufi_env.conn_id = p_data->conn.conn_id;
-        blufi_env.is_connected = false;
         blufi_env.recv_seq = blufi_env.send_seq = 0;
         blufi_env.sec_mode = 0x0;
 
@@ -418,11 +429,19 @@ static void btc_blufi_recv_handler(uint8_t *data, int len)
             blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
             if (blufi_env.aggr_buf == NULL) {
                 BTC_TRACE_ERROR("%s no mem, len %d\n", __func__, blufi_env.total_len);
+                btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
                 return;
             }
         }
-        memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len  - 2);
-        blufi_env.offset += (hdr->data_len - 2);
+        if (blufi_env.offset + hdr->data_len  - 2 <= blufi_env.total_len){
+            memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data + 2, hdr->data_len  - 2);
+            blufi_env.offset += (hdr->data_len - 2);
+        } else {
+            BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
+            btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+            return;
+        }
+
     } else {
         if (blufi_env.offset > 0) {   /* if previous pkt is frag */
             memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);
@@ -444,6 +463,11 @@ void btc_blufi_send_encap(uint8_t type, uint8_t *data, int total_data_len)
     uint16_t checksum;
     int ret;
 
+    if (blufi_env.is_connected == false) {
+        BTC_TRACE_ERROR("blufi connection has been disconnected \n");
+        return;
+    }
+
     while (remain_len > 0) {
         if (remain_len > blufi_env.frag_size) {
             hdr = osi_malloc(sizeof(struct blufi_hdr) + 2 + blufi_env.frag_size + 2);

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_control.c

@@ -117,7 +117,7 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
     APPL_TRACE_DEBUG("BTC MEDIA (A2DP-DATA) EVENT %u", ctrl);
 
     if (btc_aa_ctrl_cb.a2dp_cmd_pending != ESP_A2D_MEDIA_CTRL_NONE) {
-        APPL_TRACE_DEBUG("un-acked a2dp cmd: %u", btc_aa_ctrl_cb.a2dp_cmd_pending);
+        APPL_TRACE_WARNING("un-acked a2dp cmd: %u", btc_aa_ctrl_cb.a2dp_cmd_pending);
         a2dp_cmd_acknowledge(ctrl, ESP_A2D_MEDIA_CTRL_ACK_BUSY);
         return;
     }
@@ -179,6 +179,11 @@ void btc_a2dp_control_media_ctrl(esp_a2d_media_ctrl_t ctrl)
         /* local suspend */
         if (btc_av_stream_started_ready()) {
             btc_dispatch_sm_event(BTC_AV_SUSPEND_STREAM_REQ_EVT, NULL, 0);
+#if (BTC_AV_SINK_INCLUDED == TRUE)
+            if (btc_av_get_peer_sep() == AVDT_TSEP_SRC && btc_av_get_service_id() == BTA_A2DP_SINK_SERVICE_ID) {
+                btc_a2dp_control_command_ack(ESP_A2D_MEDIA_CTRL_ACK_SUCCESS);
+            }
+#endif
         } else {
             /* we are not in started state; just ack back ok. This can happen if we are
                remotely suspended; clear REMOTE SUSPEND Flag */

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c

@@ -143,9 +143,21 @@ static inline void btc_a2d_data_cb_to_app(const uint8_t *data, uint32_t len)
     }
 }
 
-OI_CODEC_SBC_DECODER_CONTEXT context;
-OI_UINT32 contextData[CODEC_DATA_WORDS(2, SBC_CODEC_FAST_FILTER_BUFFERS)];
-OI_INT16 pcmData[15 * SBC_MAX_SAMPLES_PER_FRAME * SBC_MAX_CHANNELS];
+#define BTC_SBC_DEC_CONTEXT_DATA_LEN (CODEC_DATA_WORDS(2, SBC_CODEC_FAST_FILTER_BUFFERS))
+#define BTC_SBC_DEC_PCM_DATA_LEN (15 * SBC_MAX_SAMPLES_PER_FRAME * SBC_MAX_CHANNELS)
+
+#if BTC_SBC_DEC_DYNAMIC_MEMORY == FALSE
+static OI_CODEC_SBC_DECODER_CONTEXT btc_sbc_decoder_context;
+static OI_UINT32 btc_sbc_decoder_context_data[BTC_SBC_DEC_CONTEXT_DATA_LEN];
+static OI_INT16 btc_sbc_pcm_data[BTC_SBC_DEC_PCM_DATA_LEN];
+#else
+static OI_CODEC_SBC_DECODER_CONTEXT *btc_sbc_decoder_context_ptr;
+static OI_UINT32 *btc_sbc_decoder_context_data;
+static OI_INT16 *btc_sbc_pcm_data;
+#define btc_sbc_decoder_context (*btc_sbc_decoder_context_ptr)
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == FALSE */
+
+
 
 /*****************************************************************************
  **  Misc helper functions
@@ -235,6 +247,16 @@ bool btc_a2dp_sink_startup(void)
 
     APPL_TRACE_EVENT("## A2DP SINK START MEDIA THREAD ##");
 
+#if (BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE)
+    btc_sbc_decoder_context_ptr = osi_calloc(sizeof(OI_CODEC_SBC_DECODER_CONTEXT));
+    btc_sbc_decoder_context_data = osi_calloc(BTC_SBC_DEC_CONTEXT_DATA_LEN * sizeof(OI_UINT32));
+    btc_sbc_pcm_data = osi_calloc(BTC_SBC_DEC_PCM_DATA_LEN * sizeof(OI_INT16));
+    if (!btc_sbc_decoder_context_ptr || !btc_sbc_decoder_context_data || !btc_sbc_pcm_data) {
+        APPL_TRACE_ERROR("failed to allocate SBC decoder");
+        goto error_exit;
+    }
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE */
+
     btc_aa_snk_queue_set = xQueueCreateSet(BTC_A2DP_SINK_TASK_QUEUE_SET_LEN);
     configASSERT(btc_aa_snk_queue_set);
     btc_aa_snk_data_queue = xQueueCreate(BTC_A2DP_SINK_DATA_QUEUE_LEN, sizeof(int32_t));
@@ -280,6 +302,21 @@ error_exit:;
         vQueueDelete(btc_aa_snk_queue_set);
         btc_aa_snk_queue_set = NULL;
     }
+#if (BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE)
+    if (btc_sbc_decoder_context_ptr) {
+        osi_free(btc_sbc_decoder_context_ptr);
+        btc_sbc_decoder_context_ptr = NULL;
+    }
+    if (btc_sbc_decoder_context_data) {
+        osi_free(btc_sbc_decoder_context_data);
+        btc_sbc_decoder_context_data = NULL;
+    }
+    if (btc_sbc_pcm_data) {
+        osi_free(btc_sbc_pcm_data);
+        btc_sbc_pcm_data = NULL;
+    }
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE */
+
     return false;
 }
 
@@ -306,6 +343,17 @@ void btc_a2dp_sink_shutdown(void)
 
     vQueueDelete(btc_aa_snk_queue_set);
     btc_aa_snk_queue_set = NULL;
+
+#if (BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE)
+    osi_free(btc_sbc_decoder_context_ptr);
+    btc_sbc_decoder_context_ptr = NULL;
+
+    osi_free(btc_sbc_decoder_context_data);
+    btc_sbc_decoder_context_data = NULL;
+
+    osi_free(btc_sbc_pcm_data);
+    btc_sbc_pcm_data = NULL;
+#endif /* BTC_SBC_DEC_DYNAMIC_MEMORY == TRUE */
 }
 
 /*****************************************************************************
@@ -467,7 +515,8 @@ static void btc_a2dp_sink_handle_decoder_reset(tBTC_MEDIA_SINK_CFG_UPDATE *p_msg
 
     btc_aa_snk_cb.rx_flush = FALSE;
     APPL_TRACE_EVENT("Reset to sink role");
-    status = OI_CODEC_SBC_DecoderReset(&context, contextData, sizeof(contextData), 2, 2, FALSE);
+    status = OI_CODEC_SBC_DecoderReset(&btc_sbc_decoder_context, btc_sbc_decoder_context_data,
+                                       BTC_SBC_DEC_CONTEXT_DATA_LEN * sizeof(OI_UINT32), 2, 2, FALSE);
     if (!OI_SUCCESS(status)) {
         APPL_TRACE_ERROR("OI_CODEC_SBC_DecoderReset failed with error code %d\n", status);
     }
@@ -566,6 +615,7 @@ static void btc_a2dp_sink_handle_decoder_reset(tBTC_MEDIA_SINK_CFG_UPDATE *p_msg
 
     int frames_to_process = ((freq_multiple) / (num_blocks * num_subbands)) + 1;
     APPL_TRACE_EVENT(" Frames to be processed in 20 ms %d\n", frames_to_process);
+    UNUSED(frames_to_process);
 }
 
 /*******************************************************************************
@@ -582,11 +632,11 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
     UINT8 *sbc_start_frame = ((UINT8 *)(p_msg + 1) + p_msg->offset + 1);
     int count;
     UINT32 pcmBytes, availPcmBytes;
-    OI_INT16 *pcmDataPointer = pcmData; /*Will be overwritten on next packet receipt*/
+    OI_INT16 *pcmDataPointer = btc_sbc_pcm_data; /*Will be overwritten on next packet receipt*/
     OI_STATUS status;
     int num_sbc_frames = p_msg->num_frames_to_be_processed;
     UINT32 sbc_frame_len = p_msg->len - 1;
-    availPcmBytes = sizeof(pcmData);
+    availPcmBytes = BTC_SBC_DEC_PCM_DATA_LEN * sizeof(OI_INT16);
 
     /* XXX: Check if the below check is correct, we are checking for peer to be sink when we are sink */
     if (btc_av_get_peer_sep() == AVDT_TSEP_SNK || (btc_aa_snk_cb.rx_flush)) {
@@ -603,7 +653,7 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
 
     for (count = 0; count < num_sbc_frames && sbc_frame_len != 0; count ++) {
         pcmBytes = availPcmBytes;
-        status = OI_CODEC_SBC_DecodeFrame(&context, (const OI_BYTE **)&sbc_start_frame,
+        status = OI_CODEC_SBC_DecodeFrame(&btc_sbc_decoder_context, (const OI_BYTE **)&sbc_start_frame,
                                           (OI_UINT32 *)&sbc_frame_len,
                                           (OI_INT16 *)pcmDataPointer,
                                           (OI_UINT32 *)&pcmBytes);
@@ -617,7 +667,7 @@ static void btc_a2dp_sink_handle_inc_media(tBT_SBC_HDR *p_msg)
         p_msg->len = sbc_frame_len + 1;
     }
 
-    btc_a2d_data_cb_to_app((uint8_t *)pcmData, (sizeof(pcmData) - availPcmBytes));
+    btc_a2d_data_cb_to_app((uint8_t *)btc_sbc_pcm_data, (BTC_SBC_DEC_PCM_DATA_LEN * sizeof(OI_INT16) - availPcmBytes));
 }
 
 /*******************************************************************************
@@ -778,6 +828,8 @@ static void btc_a2dp_sink_thread_cleanup(UNUSED_ATTR void *context)
 
     fixed_queue_free(btc_aa_snk_cb.RxSbcQ, osi_free_func);
 
+    btc_aa_snk_cb.RxSbcQ = NULL;
+
     future_ready(btc_a2dp_sink_future, NULL);
 }
 

components/bt/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c

@@ -156,7 +156,6 @@ typedef struct {
     tBTC_AV_FEEDING_MODE feeding_mode;
     tBTC_AV_MEDIA_FEEDINGS_STATE media_feeding_state;
     tBTC_AV_MEDIA_FEEDINGS media_feeding;
-    SBC_ENC_PARAMS encoder;
     osi_alarm_t *media_alarm;
 } tBTC_A2DP_SOURCE_CB;
 
@@ -187,6 +186,13 @@ static QueueSetHandle_t btc_aa_src_queue_set;
 static esp_a2d_source_data_cb_t btc_aa_src_data_cb = NULL;
 static UINT64 last_frame_us = 0;
 
+#if BTC_SBC_ENC_DYNAMIC_MEMORY == FALSE
+static SBC_ENC_PARAMS btc_sbc_encoder;
+#else
+static SBC_ENC_PARAMS *btc_sbc_encoder_ptr;
+#define btc_sbc_encoder (*btc_sbc_encoder_ptr)
+#endif /* BTC_SBC_ENC_DYNAMIC_MEMORY == FALSE */
+
 void btc_a2dp_src_reg_data_cb(esp_a2d_source_data_cb_t callback)
 {
     // todo: critical section protection
@@ -310,6 +316,14 @@ bool btc_a2dp_source_startup(void)
 
     APPL_TRACE_EVENT("## A2DP SOURCE START MEDIA THREAD ##");
 
+#if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE
+    btc_sbc_encoder_ptr = osi_calloc(sizeof(SBC_ENC_PARAMS));
+    if (!btc_sbc_encoder_ptr) {
+        APPL_TRACE_ERROR("failed to allocate SBC encoder");
+        goto error_exit;
+    }
+#endif /* #if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE */
+
     btc_aa_src_queue_set = xQueueCreateSet(BTC_A2DP_SOURCE_TASK_QUEUE_SET_LEN);
     configASSERT(btc_aa_src_queue_set);
     btc_aa_src_data_queue = xQueueCreate(BTC_A2DP_SOURCE_DATA_QUEUE_LEN, sizeof(void *));
@@ -355,6 +369,12 @@ error_exit:;
         vQueueDelete(btc_aa_src_queue_set);
         btc_aa_src_queue_set = NULL;
     }
+#if (BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE)
+    if (btc_sbc_encoder_ptr) {
+        osi_free(btc_sbc_encoder_ptr);
+        btc_sbc_encoder_ptr = NULL;
+    }
+#endif /* #if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE */
     return false;
 }
 
@@ -381,6 +401,11 @@ void btc_a2dp_source_shutdown(void)
 
     vQueueDelete(btc_aa_src_queue_set);
     btc_aa_src_queue_set = NULL;
+
+#if (BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE)
+    osi_free(btc_sbc_encoder_ptr);
+    btc_sbc_encoder_ptr = NULL;
+#endif /* #if BTC_SBC_ENC_DYNAMIC_MEMORY == TRUE */
 }
 
 /*****************************************************************************
@@ -470,10 +495,11 @@ static UINT64 time_now_us()
 static void log_tstamps_us(char *comment)
 {
     static UINT64 prev_us = 0;
-    const UINT64 now_us = time_now_us();
+    UINT64 now_us = time_now_us();
     APPL_TRACE_DEBUG("[%s] ts %08llu, diff : %08llu, queue sz %d", comment, now_us, now_us - prev_us,
                      fixed_queue_length(btc_aa_src_cb.TxAaQ));
     prev_us = now_us;
+    UNUSED(prev_us);
 }
 
 /* when true media task discards any tx frames */
@@ -794,13 +820,14 @@ static void btc_a2dp_source_enc_init(BT_HDR *p_msg)
     btc_aa_src_cb.timestamp = 0;
 
     /* SBC encoder config (enforced even if not used) */
-    btc_aa_src_cb.encoder.s16ChannelMode = pInitAudio->ChannelMode;
-    btc_aa_src_cb.encoder.s16NumOfSubBands = pInitAudio->NumOfSubBands;
-    btc_aa_src_cb.encoder.s16NumOfBlocks = pInitAudio->NumOfBlocks;
-    btc_aa_src_cb.encoder.s16AllocationMethod = pInitAudio->AllocationMethod;
-    btc_aa_src_cb.encoder.s16SamplingFreq = pInitAudio->SamplingFreq;
 
-    btc_aa_src_cb.encoder.u16BitRate = btc_a2dp_source_get_sbc_rate();
+    btc_sbc_encoder.s16ChannelMode = pInitAudio->ChannelMode;
+    btc_sbc_encoder.s16NumOfSubBands = pInitAudio->NumOfSubBands;
+    btc_sbc_encoder.s16NumOfBlocks = pInitAudio->NumOfBlocks;
+    btc_sbc_encoder.s16AllocationMethod = pInitAudio->AllocationMethod;
+    btc_sbc_encoder.s16SamplingFreq = pInitAudio->SamplingFreq;
+
+    btc_sbc_encoder.u16BitRate = btc_a2dp_source_get_sbc_rate();
 
     /* Default transcoding is PCM to SBC, modified by feeding configuration */
     btc_aa_src_cb.TxTranscoding = BTC_MEDIA_TRSCD_PCM_2_SBC;
@@ -811,14 +838,14 @@ static void btc_a2dp_source_enc_init(BT_HDR *p_msg)
     APPL_TRACE_EVENT("btc_a2dp_source_enc_init mtu %d, peer mtu %d",
                      btc_aa_src_cb.TxAaMtuSize, pInitAudio->MtuSize);
     APPL_TRACE_EVENT("      ch mode %d, subnd %d, nb blk %d, alloc %d, rate %d, freq %d",
-                     btc_aa_src_cb.encoder.s16ChannelMode, btc_aa_src_cb.encoder.s16NumOfSubBands,
-                     btc_aa_src_cb.encoder.s16NumOfBlocks,
-                     btc_aa_src_cb.encoder.s16AllocationMethod, btc_aa_src_cb.encoder.u16BitRate,
-                     btc_aa_src_cb.encoder.s16SamplingFreq);
+                     btc_sbc_encoder.s16ChannelMode, btc_sbc_encoder.s16NumOfSubBands,
+                     btc_sbc_encoder.s16NumOfBlocks,
+                     btc_sbc_encoder.s16AllocationMethod, btc_sbc_encoder.u16BitRate,
+                     btc_sbc_encoder.s16SamplingFreq);
 
     /* Reset entirely the SBC encoder */
-    SBC_Encoder_Init(&(btc_aa_src_cb.encoder));
-    APPL_TRACE_DEBUG("btc_a2dp_source_enc_init bit pool %d", btc_aa_src_cb.encoder.s16BitPool);
+    SBC_Encoder_Init(&(btc_sbc_encoder));
+    APPL_TRACE_DEBUG("btc_a2dp_source_enc_init bit pool %d", btc_sbc_encoder.s16BitPool);
 }
 
 
@@ -835,7 +862,7 @@ static void btc_a2dp_source_enc_init(BT_HDR *p_msg)
 static void btc_a2dp_source_enc_update(BT_HDR *p_msg)
 {
     tBTC_MEDIA_UPDATE_AUDIO *pUpdateAudio = (tBTC_MEDIA_UPDATE_AUDIO *) p_msg;
-    SBC_ENC_PARAMS *pstrEncParams = &btc_aa_src_cb.encoder;
+    SBC_ENC_PARAMS *pstrEncParams = &btc_sbc_encoder;
     UINT16 s16SamplingFreq;
     SINT16 s16BitPool = 0;
     SINT16 s16BitRate;
@@ -928,19 +955,19 @@ static void btc_a2dp_source_enc_update(BT_HDR *p_msg)
             if (s16BitPool > pUpdateAudio->MaxBitPool) {
                 APPL_TRACE_DEBUG("%s computed bitpool too large (%d)",  __FUNCTION__, s16BitPool);
                 /* Decrease bitrate */
-                btc_aa_src_cb.encoder.u16BitRate -= BTC_MEDIA_BITRATE_STEP;
+                btc_sbc_encoder.u16BitRate -= BTC_MEDIA_BITRATE_STEP;
                 /* Record that we have decreased the bitrate */
                 protect |= 1;
             } else if (s16BitPool < pUpdateAudio->MinBitPool) {
                 APPL_TRACE_WARNING("%s computed bitpool too small (%d)", __FUNCTION__, s16BitPool);
 
                 /* Increase bitrate */
-                UINT16 previous_u16BitRate = btc_aa_src_cb.encoder.u16BitRate;
-                btc_aa_src_cb.encoder.u16BitRate += BTC_MEDIA_BITRATE_STEP;
+                UINT16 previous_u16BitRate = btc_sbc_encoder.u16BitRate;
+                btc_sbc_encoder.u16BitRate += BTC_MEDIA_BITRATE_STEP;
                 /* Record that we have increased the bitrate */
                 protect |= 2;
                 /* Check over-flow */
-                if (btc_aa_src_cb.encoder.u16BitRate < previous_u16BitRate) {
+                if (btc_sbc_encoder.u16BitRate < previous_u16BitRate) {
                     protect |= 3;
                 }
             } else {
@@ -957,10 +984,10 @@ static void btc_a2dp_source_enc_update(BT_HDR *p_msg)
         pstrEncParams->s16BitPool = s16BitPool;
 
         APPL_TRACE_DEBUG("%s final bit rate %d, final bit pool %d", __FUNCTION__,
-                         btc_aa_src_cb.encoder.u16BitRate, btc_aa_src_cb.encoder.s16BitPool);
+                         btc_sbc_encoder.u16BitRate, btc_sbc_encoder.s16BitPool);
 
         /* make sure we reinitialize encoder with new settings */
-        SBC_Encoder_Init(&(btc_aa_src_cb.encoder));
+        SBC_Encoder_Init(&(btc_sbc_encoder));
     }
 }
 
@@ -991,10 +1018,10 @@ static void btc_a2dp_source_pcm2sbc_init(tBTC_MEDIA_INIT_AUDIO_FEEDING *p_feedin
     case 32000:
     case 48000:
         /* For these sampling_freq the AV connection must be 48000 */
-        if (btc_aa_src_cb.encoder.s16SamplingFreq != SBC_sf48000) {
+        if (btc_sbc_encoder.s16SamplingFreq != SBC_sf48000) {
             /* Reconfiguration needed at 48000 */
             APPL_TRACE_DEBUG("SBC Reconfiguration needed at 48000");
-            btc_aa_src_cb.encoder.s16SamplingFreq = SBC_sf48000;
+            btc_sbc_encoder.s16SamplingFreq = SBC_sf48000;
             reconfig_needed = TRUE;
         }
         break;
@@ -1003,10 +1030,10 @@ static void btc_a2dp_source_pcm2sbc_init(tBTC_MEDIA_INIT_AUDIO_FEEDING *p_feedin
     case 22050:
     case 44100:
         /* For these sampling_freq the AV connection must be 44100 */
-        if (btc_aa_src_cb.encoder.s16SamplingFreq != SBC_sf44100) {
+        if (btc_sbc_encoder.s16SamplingFreq != SBC_sf44100) {
             /* Reconfiguration needed at 44100 */
             APPL_TRACE_DEBUG("SBC Reconfiguration needed at 44100");
-            btc_aa_src_cb.encoder.s16SamplingFreq = SBC_sf44100;
+            btc_sbc_encoder.s16SamplingFreq = SBC_sf44100;
             reconfig_needed = TRUE;
         }
         break;
@@ -1016,21 +1043,21 @@ static void btc_a2dp_source_pcm2sbc_init(tBTC_MEDIA_INIT_AUDIO_FEEDING *p_feedin
     }
 
     /* Some AV Headsets do not support Mono => always ask for Stereo */
-    if (btc_aa_src_cb.encoder.s16ChannelMode == SBC_MONO) {
+    if (btc_sbc_encoder.s16ChannelMode == SBC_MONO) {
         APPL_TRACE_DEBUG("SBC Reconfiguration needed in Stereo");
-        btc_aa_src_cb.encoder.s16ChannelMode = SBC_JOINT_STEREO;
+        btc_sbc_encoder.s16ChannelMode = SBC_JOINT_STEREO;
         reconfig_needed = TRUE;
     }
 
     if (reconfig_needed != FALSE) {
         APPL_TRACE_DEBUG("%s :: mtu %d", __FUNCTION__, btc_aa_src_cb.TxAaMtuSize);
         APPL_TRACE_DEBUG("ch mode %d, nbsubd %d, nb %d, alloc %d, rate %d, freq %d",
-                         btc_aa_src_cb.encoder.s16ChannelMode,
-                         btc_aa_src_cb.encoder.s16NumOfSubBands, btc_aa_src_cb.encoder.s16NumOfBlocks,
-                         btc_aa_src_cb.encoder.s16AllocationMethod, btc_aa_src_cb.encoder.u16BitRate,
-                         btc_aa_src_cb.encoder.s16SamplingFreq);
+                         btc_sbc_encoder.s16ChannelMode,
+                         btc_sbc_encoder.s16NumOfSubBands, btc_sbc_encoder.s16NumOfBlocks,
+                         btc_sbc_encoder.s16AllocationMethod, btc_sbc_encoder.u16BitRate,
+                         btc_sbc_encoder.s16SamplingFreq);
 
-        SBC_Encoder_Init(&(btc_aa_src_cb.encoder));
+        SBC_Encoder_Init(&(btc_sbc_encoder));
     } else {
         APPL_TRACE_DEBUG("%s no SBC reconfig needed", __FUNCTION__);
     }
@@ -1105,8 +1132,8 @@ static UINT8 btc_get_num_aa_frame(void)
 
     switch (btc_aa_src_cb.TxTranscoding) {
     case BTC_MEDIA_TRSCD_PCM_2_SBC: {
-        UINT32 pcm_bytes_per_frame = btc_aa_src_cb.encoder.s16NumOfSubBands *
-                                     btc_aa_src_cb.encoder.s16NumOfBlocks *
+        UINT32 pcm_bytes_per_frame = btc_sbc_encoder.s16NumOfSubBands *
+                                     btc_sbc_encoder.s16NumOfBlocks *
                                      btc_aa_src_cb.media_feeding.cfg.pcm.num_channel *
                                      btc_aa_src_cb.media_feeding.cfg.pcm.bit_per_sample / 8;
 
@@ -1129,10 +1156,16 @@ static UINT8 btc_get_num_aa_frame(void)
 
         /* calculate nbr of frames pending for this media tick */
         result = btc_aa_src_cb.media_feeding_state.pcm.counter / pcm_bytes_per_frame;
-        if (result > MAX_PCM_FRAME_NUM_PER_TICK) {
-            APPL_TRACE_WARNING("%s() - Limiting frames to be sent from %d to %d"
-                               , __FUNCTION__, result, MAX_PCM_FRAME_NUM_PER_TICK);
-            result = MAX_PCM_FRAME_NUM_PER_TICK;
+
+        /* limit the frames to be sent */
+        UINT32 frm_nb_threshold = MAX_OUTPUT_A2DP_SRC_FRAME_QUEUE_SZ - fixed_queue_length(btc_aa_src_cb.TxAaQ);
+        if (frm_nb_threshold > MAX_PCM_FRAME_NUM_PER_TICK) {
+            frm_nb_threshold = MAX_PCM_FRAME_NUM_PER_TICK;
+        }
+
+        if (result > frm_nb_threshold) {
+            APPL_TRACE_EVENT("Limit frms to send from %d to %d", result, frm_nb_threshold);
+            result = frm_nb_threshold;
         }
         btc_aa_src_cb.media_feeding_state.pcm.counter -= result * pcm_bytes_per_frame;
 
@@ -1162,12 +1195,12 @@ static UINT8 btc_get_num_aa_frame(void)
 
 BOOLEAN btc_media_aa_read_feeding(void)
 {
-    UINT16 blocm_x_subband = btc_aa_src_cb.encoder.s16NumOfSubBands * \
-                             btc_aa_src_cb.encoder.s16NumOfBlocks;
+    UINT16 blocm_x_subband = btc_sbc_encoder.s16NumOfSubBands * \
+                             btc_sbc_encoder.s16NumOfBlocks;
     UINT32 read_size;
     UINT16 sbc_sampling = 48000;
     UINT32 src_samples;
-    UINT16 bytes_needed = blocm_x_subband * btc_aa_src_cb.encoder.s16NumOfChannels * \
+    UINT16 bytes_needed = blocm_x_subband * btc_sbc_encoder.s16NumOfChannels * \
                           btc_aa_src_cb.media_feeding.cfg.pcm.bit_per_sample / 8;
     static UINT16 up_sampled_buffer[SBC_MAX_NUM_FRAME * SBC_MAX_NUM_OF_BLOCKS
                                     * SBC_MAX_NUM_OF_CHANNELS * SBC_MAX_NUM_OF_SUBBANDS * 2];
@@ -1181,7 +1214,7 @@ BOOLEAN btc_media_aa_read_feeding(void)
     UINT32  nb_byte_read = 0;
 
     /* Get the SBC sampling rate */
-    switch (btc_aa_src_cb.encoder.s16SamplingFreq) {
+    switch (btc_sbc_encoder.s16SamplingFreq) {
     case SBC_sf48000:
         sbc_sampling = 48000;
         break;
@@ -1199,7 +1232,7 @@ BOOLEAN btc_media_aa_read_feeding(void)
     if (sbc_sampling == btc_aa_src_cb.media_feeding.cfg.pcm.sampling_freq) {
         read_size = bytes_needed - btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue;
         nb_byte_read = btc_aa_src_data_read(
-                           ((uint8_t *)btc_aa_src_cb.encoder.as16PcmBuffer) +
+                           ((uint8_t *)btc_sbc_encoder.as16PcmBuffer) +
                            btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue,
                            read_size);
         if (nb_byte_read == read_size) {
@@ -1293,7 +1326,7 @@ BOOLEAN btc_media_aa_read_feeding(void)
     /* only copy the pcm sample when we have up-sampled enough PCM */
     if (btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue >= bytes_needed) {
         /* Copy the output pcm samples in SBC encoding buffer */
-        memcpy((UINT8 *)btc_aa_src_cb.encoder.as16PcmBuffer,
+        memcpy((UINT8 *)btc_sbc_encoder.as16PcmBuffer,
                (UINT8 *)up_sampled_buffer,
                bytes_needed);
         /* update the residue */
@@ -1322,8 +1355,8 @@ BOOLEAN btc_media_aa_read_feeding(void)
 static void btc_media_aa_prep_sbc_2_send(UINT8 nb_frame)
 {
     BT_HDR *p_buf;
-    UINT16 blocm_x_subband = btc_aa_src_cb.encoder.s16NumOfSubBands *
-                             btc_aa_src_cb.encoder.s16NumOfBlocks;
+    UINT16 blocm_x_subband = btc_sbc_encoder.s16NumOfSubBands *
+                             btc_sbc_encoder.s16NumOfBlocks;
 
     while (nb_frame) {
         if (NULL == (p_buf = osi_malloc(BTC_MEDIA_AA_BUF_SIZE))) {
@@ -1339,27 +1372,27 @@ static void btc_media_aa_prep_sbc_2_send(UINT8 nb_frame)
 
         do {
             /* Write @ of allocated buffer in encoder.pu8Packet */
-            btc_aa_src_cb.encoder.pu8Packet = (UINT8 *) (p_buf + 1) + p_buf->offset + p_buf->len;
+            btc_sbc_encoder.pu8Packet = (UINT8 *) (p_buf + 1) + p_buf->offset + p_buf->len;
             /* Fill allocated buffer with 0 */
-            memset(btc_aa_src_cb.encoder.as16PcmBuffer, 0, blocm_x_subband
-                   * btc_aa_src_cb.encoder.s16NumOfChannels);
+            memset(btc_sbc_encoder.as16PcmBuffer, 0, blocm_x_subband
+                   * btc_sbc_encoder.s16NumOfChannels);
 
             /* Read PCM data and upsample them if needed */
             if (btc_media_aa_read_feeding()) {
                 /* SBC encode and descramble frame */
-                SBC_Encoder(&(btc_aa_src_cb.encoder));
-                A2D_SbcChkFrInit(btc_aa_src_cb.encoder.pu8Packet);
-                A2D_SbcDescramble(btc_aa_src_cb.encoder.pu8Packet, btc_aa_src_cb.encoder.u16PacketLength);
+                SBC_Encoder(&(btc_sbc_encoder));
+                A2D_SbcChkFrInit(btc_sbc_encoder.pu8Packet);
+                A2D_SbcDescramble(btc_sbc_encoder.pu8Packet, btc_sbc_encoder.u16PacketLength);
                 /* Update SBC frame length */
-                p_buf->len += btc_aa_src_cb.encoder.u16PacketLength;
+                p_buf->len += btc_sbc_encoder.u16PacketLength;
                 nb_frame--;
                 p_buf->layer_specific++;
             } else {
                 APPL_TRACE_WARNING("btc_media_aa_prep_sbc_2_send underflow %d, %d",
                                    nb_frame, btc_aa_src_cb.media_feeding_state.pcm.aa_feed_residue);
                 btc_aa_src_cb.media_feeding_state.pcm.counter += nb_frame *
-                        btc_aa_src_cb.encoder.s16NumOfSubBands *
-                        btc_aa_src_cb.encoder.s16NumOfBlocks *
+                        btc_sbc_encoder.s16NumOfSubBands *
+                        btc_sbc_encoder.s16NumOfBlocks *
                         btc_aa_src_cb.media_feeding.cfg.pcm.num_channel *
                         btc_aa_src_cb.media_feeding.cfg.pcm.bit_per_sample / 8;
                 /* no more pcm to read */
@@ -1372,7 +1405,7 @@ static void btc_media_aa_prep_sbc_2_send(UINT8 nb_frame)
                 }
             }
 
-        } while (((p_buf->len + btc_aa_src_cb.encoder.u16PacketLength) < btc_aa_src_cb.TxAaMtuSize)
+        } while (((p_buf->len + btc_sbc_encoder.u16PacketLength) < btc_aa_src_cb.TxAaMtuSize)
                  && (p_buf->layer_specific < 0x0F) && nb_frame);
 
         if (p_buf->len) {
@@ -1631,6 +1664,8 @@ static void btc_a2dp_source_thread_cleanup(UNUSED_ATTR void *context)
 
     fixed_queue_free(btc_aa_src_cb.TxAaQ, osi_free_func);
 
+    btc_aa_src_cb.TxAaQ = NULL;
+
     future_ready(btc_a2dp_source_future, NULL);
 }
 

components/bt/bluedroid/btc/profile/std/a2dp/btc_av.c

@@ -1199,10 +1199,13 @@ static void bte_av_media_callback(tBTA_AV_EVT event, tBTA_AV_MEDIA *p_data)
             BTC_TRACE_ERROR("ERROR dump_codec_info A2D_ParsSbcInfo fail:%d\n", a2d_status);
         }
     }
+    UNUSED(que_len);
 }
 #else
 static void bte_av_media_callback(tBTA_AV_EVT event, tBTA_AV_MEDIA *p_data)
 {
+    UNUSED(event);
+    UNUSED(p_data);
     BTC_TRACE_WARNING("%s : event %u\n", __func__, event);
 }
 #endif

components/bt/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -251,7 +251,7 @@ static void handle_rc_attributes_rsp ( tAVRC_MSG_VENDOR *vendor_msg)
 
         btc_avrc_ct_cb_to_app(ESP_AVRC_CT_METADATA_RSP_EVT, &param[i]);
 
-        attr_index += (int) vendor_msg->p_vendor_data[7 + attr_index] + 8;
+        attr_index += attr_length + 8;
     }
 }
 
@@ -335,6 +335,8 @@ static void handle_rc_passthrough_rsp ( tBTA_AV_REMOTE_RSP *p_remote_rsp)
     } else {
         BTC_TRACE_ERROR("%s DUT does not support AVRCP controller role", __FUNCTION__);
     }
+
+    UNUSED(status);
 #else
     BTC_TRACE_ERROR("%s AVRCP controller role is not enabled", __FUNCTION__);
 #endif

components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -426,6 +426,35 @@ static void btc_stop_adv_callback(uint8_t status)
     }
 }
 
+void btc_update_duplicate_exceptional_list_callback(tBTA_STATUS status, uint8_t subcode, uint32_t length, uint8_t *device_info)
+{
+    esp_ble_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_COMPLETE_EVT;
+    param.update_duplicate_exceptional_list_cmpl.status = status;
+    param.update_duplicate_exceptional_list_cmpl.subcode = subcode;
+    if(length > sizeof(param.update_duplicate_exceptional_list_cmpl.device_info)) {
+        length = sizeof(param.update_duplicate_exceptional_list_cmpl.device_info);
+    }
+    param.update_duplicate_exceptional_list_cmpl.length = length;
+    memcpy(param.update_duplicate_exceptional_list_cmpl.device_info, device_info, length);
+    ret = btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+}
+
+static void btc_ble_update_duplicate_exceptional_list(uint8_t subcode, uint32_t info_type, BD_ADDR device_info,
+                                 tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK p_update_duplicate_ignore_list_cback)
+{
+    BTA_DmUpdateDuplicateExceptionalList(subcode, info_type, device_info, p_update_duplicate_ignore_list_cback);
+}
+
 static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBTA_START_ADV_CMPL_CBACK start_adv_cback)
 {
     tBLE_BD_ADDR peer_addr;
@@ -452,6 +481,10 @@ static void btc_ble_start_advertising (esp_ble_adv_params_t *ble_adv_params, tBT
         status = ESP_BT_STATUS_PARM_INVALID;
         BTC_TRACE_ERROR("Invalid advertisting channel map parameters.\n");
     }
+    if (!BLE_ISVALID_PARAM(ble_adv_params->peer_addr_type, BLE_ADDR_TYPE_PUBLIC, BLE_ADDR_TYPE_RANDOM)) {
+        status = ESP_BT_STATUS_PARM_INVALID;
+        BTC_TRACE_ERROR("Invalid advertisting peer address type parameters.\n");
+    }
     if(status != ESP_BT_STATUS_SUCCESS) {
         if(start_adv_cback) {
             start_adv_cback(status);
@@ -571,6 +604,9 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data
     case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
         BTC_TRACE_DEBUG("BTA_DM_SEARCH_CANCEL_CMPL_EVT\n");
         break;
+    case BTA_DM_INQ_DISCARD_NUM_EVT:
+        param.scan_rst.num_dis = p_data->inq_dis.num_dis;
+        break;
     default:
         BTC_TRACE_ERROR("%s : Unknown event 0x%x\n", __FUNCTION__, event);
         return;
@@ -831,7 +867,7 @@ static void btc_ble_set_rand_addr (BD_ADDR rand_addr, tBTA_SET_RAND_ADDR_CBACK *
             BTA_DmSetRandAddress(rand_addr, btc_set_rand_addr_callback);
         } else {
             btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
-            BTC_TRACE_ERROR("Invalid random address, the high bit should be 0b11, all bits of the random part shall not be to 1 or 0");
+            BTC_TRACE_ERROR("Invalid random address, the high bit should be 0b11, bits of the random part shall not be all 1 or 0");
         }
     } else {
         btc_set_rand_addr_callback(BTM_INVALID_STATIC_RAND_ADDR);
@@ -1082,6 +1118,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                                       arg->cfg_scan_rsp_data_raw.raw_scan_rsp_len,
                                       btc_scan_rsp_data_raw_callback);
         break;
+    case BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST:
+        btc_ble_update_duplicate_exceptional_list(arg->update_duplicate_exceptional_list.subcode,
+                                                arg->update_duplicate_exceptional_list.info_type,
+                                                arg->update_duplicate_exceptional_list.device_info,
+                                                btc_update_duplicate_exceptional_list_callback);
+        break;
 #if (SMP_INCLUDED == TRUE)
     case BTC_GAP_BLE_SET_ENCRYPTION_EVT: {
         BD_ADDR bd_addr;
@@ -1125,6 +1167,12 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                 bta_dm_co_ble_set_max_key_size(key_size);
                 break;
             }
+            case ESP_BLE_SM_MIN_KEY_SIZE: {
+                uint8_t key_size = 0;
+                STREAM_TO_UINT8(key_size, value);
+                bta_dm_co_ble_set_min_key_size(key_size);
+                break;
+            }
             case ESP_BLE_SM_SET_STATIC_PASSKEY: {
                 uint32_t passkey = 0;
                 for(uint8_t i = 0; i < arg->set_security_param.len; i++)

components/bt/bluedroid/btc/profile/std/gap/btc_gap_bt.c

@@ -750,7 +750,7 @@ void btc_gap_bt_arg_deep_free(btc_msg_t *msg)
         break;
 #endif ///BT_SSP_INCLUDED == TRUE
     default:
-        BTC_TRACE_ERROR("Unhandled deep copy %d\n", msg->act);
+        BTC_TRACE_ERROR("Unhandled deep copy %d, arg: %p\n", msg->act, arg);
         break;
     }
 }

components/bt/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -315,7 +315,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int svc_num = 0;
+    uint16_t svc_num = 0;
     tBT_UUID *bta_uuid = NULL;
     if (svc_uuid) {
         bta_uuid = osi_malloc(sizeof(tBT_UUID));
@@ -324,7 +324,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
 
     BTA_GATTC_GetServiceWithUUID(conn_id, bta_uuid, &db, &svc_num);
 
-    if ((status = btc_gattc_check_valid_param(svc_num, offset)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)svc_num, offset)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
@@ -334,7 +334,7 @@ esp_gatt_status_t btc_ble_gattc_get_service(uint16_t conn_id, esp_bt_uuid_t *svc
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)svc_num, ESP_GATT_DB_PRIMARY_SERVICE, offset, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, svc_num, ESP_GATT_DB_PRIMARY_SERVICE, offset, (void *)result, db);
     }
 
     *count = svc_num;
@@ -356,17 +356,17 @@ esp_gatt_status_t btc_ble_gattc_get_all_char(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int char_num = 0;
+    uint16_t char_num = 0;
     BTA_GATTC_GetAllChar(conn_id, start_handle, end_handle, &db, &char_num);
 
-    if ((status = btc_gattc_check_valid_param(char_num, offset)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)char_num, offset)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, offset, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, char_num, ESP_GATT_DB_CHARACTERISTIC, offset, (void *)result, db);
     }
 
     *count = char_num;
@@ -384,17 +384,17 @@ esp_gatt_status_t btc_ble_gattc_get_all_descr(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int descr_num = 0;
+    uint16_t descr_num = 0;
     BTA_GATTC_GetAllDescriptor(conn_id, char_handle, &db, &descr_num);
 
-    if ((status = btc_gattc_check_valid_param(descr_num, offset)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)descr_num, offset)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, offset, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, descr_num, ESP_GATT_DB_DESCRIPTOR, offset, (void *)result, db);
     }
 
     *count = descr_num;
@@ -414,19 +414,19 @@ esp_gatt_status_t btc_ble_gattc_get_char_by_uuid(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int char_num = 0;
+    uint16_t char_num = 0;
     tBT_UUID bta_uuid = {0};
     btc_to_bta_uuid(&bta_uuid, &char_uuid);
     BTA_GATTC_GetCharByUUID(conn_id, start_handle, end_handle, bta_uuid, &db, &char_num);
 
-    if ((status = btc_gattc_check_valid_param(char_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)char_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)char_num, ESP_GATT_DB_CHARACTERISTIC, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, char_num, ESP_GATT_DB_CHARACTERISTIC, 0, (void *)result, db);
     }
 
     *count = char_num;
@@ -447,7 +447,7 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_uuid(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int descr_num = 0;
+    uint16_t descr_num = 0;
     tBT_UUID bta_char_uuid = {0};
     tBT_UUID bta_descr_uuid = {0};
     btc_to_bta_uuid(&bta_char_uuid, &char_uuid);
@@ -456,14 +456,14 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_uuid(uint16_t conn_id,
     BTA_GATTC_GetDescrByUUID(conn_id, start_handle, end_handle,
                              bta_char_uuid, bta_descr_uuid, &db, &descr_num);
 
-    if ((status = btc_gattc_check_valid_param(descr_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)descr_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
     }
 
     *count = descr_num;
@@ -482,20 +482,20 @@ esp_gatt_status_t btc_ble_gattc_get_descr_by_char_handle(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int descr_num = 0;
+    uint16_t descr_num = 0;
     tBT_UUID bta_descr_uuid = {0};
     btc_to_bta_uuid(&bta_descr_uuid, &descr_uuid);
 
     BTA_GATTC_GetDescrByCharHandle(conn_id, char_handle, bta_descr_uuid, &db, &descr_num);
 
-    if ((status = btc_gattc_check_valid_param(descr_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)descr_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     } else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, descr_num, ESP_GATT_DB_DESCRIPTOR, 0, (void *)result, db);
     }
 
     *count = descr_num;
@@ -516,7 +516,7 @@ esp_gatt_status_t btc_ble_gattc_get_include_service(uint16_t conn_id,
 {
     esp_gatt_status_t status;
     btgatt_db_element_t *db = NULL;
-    int incl_num = 0;
+    uint16_t incl_num = 0;
     tBT_UUID bta_uuid = {0};
 
     if (incl_uuid != NULL) {
@@ -526,14 +526,14 @@ esp_gatt_status_t btc_ble_gattc_get_include_service(uint16_t conn_id,
         BTA_GATTC_GetIncludeService(conn_id, start_handle, end_handle, NULL, &db, &incl_num);
     }
 
-    if ((status = btc_gattc_check_valid_param(incl_num, 0)) != ESP_GATT_OK) {
+    if ((status = btc_gattc_check_valid_param((int)incl_num, 0)) != ESP_GATT_OK) {
         if (db) {
             osi_free(db);
         }
         *count = 0;
         return status;
     }else {
-        btc_gattc_fill_gatt_db_conversion(*count, (uint16_t)incl_num, ESP_GATT_DB_INCLUDED_SERVICE, 0, (void *)result, db);
+        btc_gattc_fill_gatt_db_conversion(*count, incl_num, ESP_GATT_DB_INCLUDED_SERVICE, 0, (void *)result, db);
     }
 
     *count = incl_num;
@@ -552,9 +552,9 @@ esp_gatt_status_t btc_ble_gattc_get_attr_count(uint16_t conn_id,
                                                uint16_t *count)
 {
     if (type == ESP_GATT_DB_ALL) {
-        BTA_GATTC_GetDBSize(conn_id, start_handle, end_handle, (int *)count);
+        BTA_GATTC_GetDBSize(conn_id, start_handle, end_handle, count);
     } else {
-        BTA_GATTC_GetDBSizeByType(conn_id, type, start_handle, end_handle, char_handle, (int *)count);
+        BTA_GATTC_GetDBSizeByType(conn_id, type, start_handle, end_handle, char_handle, count);
     }
 
     return ESP_GATT_OK;
@@ -564,7 +564,7 @@ esp_gatt_status_t btc_ble_gattc_get_db(uint16_t conn_id, uint16_t start_handle,
                                        esp_gattc_db_elem_t *db, uint16_t *count)
 {
     btgatt_db_element_t *get_db = NULL;
-    int num = 0;
+    uint16_t num = 0;
     tBT_UUID bta_uuid;
     uint16_t db_size = 0;
     BTA_GATTC_GetGattDb(conn_id, start_handle, end_handle, &get_db, &num);

components/bt/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -81,72 +81,105 @@ void btc_gatts_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 
     switch (msg->act) {
     case BTC_GATTS_ACT_SEND_INDICATE: {
-        dst->send_ind.value = (uint8_t *)osi_malloc(src->send_ind.value_len);
-        if (dst->send_ind.value) {
-            memcpy(dst->send_ind.value, src->send_ind.value, src->send_ind.value_len);
+        if (src->send_ind.value && (src->send_ind.value_len > 0)) {
+            dst->send_ind.value = (uint8_t *) osi_malloc(src->send_ind.value_len);
+            if (dst->send_ind.value) {
+                memcpy(dst->send_ind.value, src->send_ind.value, src->send_ind.value_len);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
+            }
         } else {
-            BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
+            dst->send_ind.value = NULL;
+            if (src->send_ind.value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
+            }
         }
         break;
     }
     case BTC_GATTS_ACT_SEND_RESPONSE: {
         if (src->send_rsp.rsp) {
-            dst->send_rsp.rsp = (esp_gatt_rsp_t *)osi_malloc(sizeof(esp_gatt_rsp_t));
+            dst->send_rsp.rsp = (esp_gatt_rsp_t *) osi_malloc(sizeof(esp_gatt_rsp_t));
             if (dst->send_rsp.rsp) {
                 memcpy(dst->send_rsp.rsp, src->send_rsp.rsp, sizeof(esp_gatt_rsp_t));
             } else {
                 BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
             }
+        } else {
+            BTC_TRACE_WARNING("%s %d, NULL response", __func__, msg->act);
         }
         break;
     
     }
-    case BTC_GATTS_ACT_ADD_CHAR:{
-        if (src->add_char.char_val.attr_value != NULL){
-            dst->add_char.char_val.attr_value = (uint8_t *)osi_malloc(src->add_char.char_val.attr_len);
-            if(dst->add_char.char_val.attr_value != NULL){
+    case BTC_GATTS_ACT_ADD_CHAR: {
+        if (src->add_char.char_val.attr_value && (src->add_char.char_val.attr_len > 0)) {
+            dst->add_char.char_val.attr_value = (uint8_t *) osi_malloc(src->add_char.char_val.attr_len);
+            if (dst->add_char.char_val.attr_value) {
                 memcpy(dst->add_char.char_val.attr_value, src->add_char.char_val.attr_value, 
                         src->add_char.char_val.attr_len);
-            }else{
+            } else {
                 BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
             }
+        } else {
+            dst->add_char.char_val.attr_value = NULL;
+            if (src->add_char.char_val.attr_value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
+            }
         }
         break;
     }
-    case BTC_GATTS_ACT_ADD_CHAR_DESCR:{
-        if(src->add_descr.descr_val.attr_value != NULL){
-            dst->add_descr.descr_val.attr_value = (uint8_t *)osi_malloc(src->add_descr.descr_val.attr_len);
-            if(dst->add_descr.descr_val.attr_value != NULL){
+    case BTC_GATTS_ACT_ADD_CHAR_DESCR: {
+        if (src->add_descr.descr_val.attr_value && (src->add_descr.descr_val.attr_len > 0)) {
+            dst->add_descr.descr_val.attr_value = (uint8_t *) osi_malloc(src->add_descr.descr_val.attr_len);
+            if (dst->add_descr.descr_val.attr_value) {
                 memcpy(dst->add_descr.descr_val.attr_value, src->add_descr.descr_val.attr_value,
                         src->add_descr.descr_val.attr_len);
-            }else{
+            } else {
                 BTC_TRACE_ERROR("%s %d no mem\n", __func__, msg->act);
             }
-        }
-        break;
-    }
-    case BTC_GATTS_ACT_CREATE_ATTR_TAB:{
-        uint8_t num_attr = src->create_attr_tab.max_nb_attr;
-        if(src->create_attr_tab.gatts_attr_db != NULL){
-            dst->create_attr_tab.gatts_attr_db = (esp_gatts_attr_db_t *)osi_malloc(sizeof(esp_gatts_attr_db_t)*num_attr);
-            if(dst->create_attr_tab.gatts_attr_db != NULL){
-                memcpy(dst->create_attr_tab.gatts_attr_db, src->create_attr_tab.gatts_attr_db,
-                        sizeof(esp_gatts_attr_db_t)*num_attr);
-            }else{
-                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+        } else {
+            dst->add_descr.descr_val.attr_value = NULL;
+            if (src->add_descr.descr_val.attr_value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
             }
         }
         break;
     }
-   case BTC_GATTS_ACT_SET_ATTR_VALUE:{
-        uint16_t len = src->set_attr_val.length;
-        if(src->set_attr_val.value){
-            dst->set_attr_val.value = (uint8_t *)osi_malloc(len);
-            if(dst->set_attr_val.value != NULL){
-                memcpy(dst->set_attr_val.value, src->set_attr_val.value, len);
-            }else{
+    case BTC_GATTS_ACT_CREATE_ATTR_TAB: {
+        uint8_t num_attr = src->create_attr_tab.max_nb_attr;
+        if (src->create_attr_tab.gatts_attr_db && (num_attr > 0)) {
+            dst->create_attr_tab.gatts_attr_db = (esp_gatts_attr_db_t *) osi_malloc(sizeof(esp_gatts_attr_db_t) * num_attr);
+            if (dst->create_attr_tab.gatts_attr_db) {
+                memcpy(dst->create_attr_tab.gatts_attr_db, src->create_attr_tab.gatts_attr_db,
+                        sizeof(esp_gatts_attr_db_t) * num_attr);
+            } else {
                 BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
             }
+        } else {
+            BTC_TRACE_ERROR("%s %d, NULL data", __func__, msg->act);
+        }
+        break;
+    }
+   case BTC_GATTS_ACT_SET_ATTR_VALUE: {
+        if (src->set_attr_val.value && (src->set_attr_val.length > 0)) {
+            dst->set_attr_val.value = (uint8_t *) osi_malloc(src->set_attr_val.length);
+            if (dst->set_attr_val.value) {
+                memcpy(dst->set_attr_val.value, src->set_attr_val.value, src->set_attr_val.length);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
+        } else {
+            dst->set_attr_val.value = NULL;
+            if (src->set_attr_val.value) {
+                BTC_TRACE_ERROR("%s %d, invalid length", __func__, msg->act);
+            } else {
+                BTC_TRACE_WARNING("%s %d, NULL value", __func__, msg->act);
+            }
         }
         break;
     }
@@ -364,7 +397,13 @@ static void btc_gatts_act_create_attr_tab(esp_gatts_attr_db_t *gatts_attr_db,
             case ESP_GATT_UUID_CHAR_AGG_FORMAT:
             case ESP_GATT_UUID_CHAR_VALID_RANGE:
             case ESP_GATT_UUID_EXT_RPT_REF_DESCR:
-            case ESP_GATT_UUID_RPT_REF_DESCR:{
+            case ESP_GATT_UUID_RPT_REF_DESCR:
+            case ESP_GATT_UUID_NUM_DIGITALS_DESCR:
+            case ESP_GATT_UUID_VALUE_TRIGGER_DESCR:
+            case ESP_GATT_UUID_ENV_SENSING_CONFIG_DESCR:
+            case ESP_GATT_UUID_ENV_SENSING_MEASUREMENT_DESCR:
+            case ESP_GATT_UUID_ENV_SENSING_TRIGGER_DESCR:
+            case ESP_GATT_UUID_TIME_TRIGGER_DESCR: {
                 uint16_t svc_hal = btc_creat_tab_env.svc_start_hdl;
                 tBT_UUID bta_char_uuid;
                 esp_bt_uuid_t uuid_temp;
@@ -424,7 +463,7 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat
             case ESP_GATT_UUID_PRI_SERVICE:
             case ESP_GATT_UUID_SEC_SERVICE:
                 if (++svc_num > 1) {
-                    BTC_TRACE_ERROR("Each service table can only created one primary service or secondly service.");
+                    BTC_TRACE_ERROR("Each service table can only created one primary service or secondary service.");
                     return ESP_GATT_ERROR;
                 }
                 break;
@@ -690,10 +729,13 @@ void btc_gatts_call_handler(btc_msg_t *msg)
 #else
         //BTA_DmAddBleDevice(p_cb->bd_addr.address, addr_type, device_type);
 #endif
+        /*
+         not support background connection
         // Mark background connections
         if (!arg->open.is_direct) {
             BTA_DmBleSetBgConnType(BTM_BLE_CONN_AUTO, NULL);
         }
+        */
 
         transport = BTA_GATT_TRANSPORT_LE;
 
@@ -933,4 +975,13 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
     btc_gatts_cb_param_copy_free(msg, p_data);
 }
 
+void btc_congest_callback(tBTA_GATTS *param)
+{
+    esp_ble_gatts_cb_param_t esp_param;
+    esp_gatt_if_t gatts_if = BTC_GATT_GET_GATT_IF(param->congest.conn_id);
+    esp_param.congest.conn_id = BTC_GATT_GET_CONN_ID(param->congest.conn_id);
+    esp_param.congest.congested = param->congest.congested;
+    btc_gatts_cb_to_app(ESP_GATTS_CONGEST_EVT, gatts_if, &esp_param);
+
+}
 #endif  ///GATTS_INCLUDED

components/bt/bluedroid/btc/profile/std/hf_client/btc_hf_client.c

@@ -195,8 +195,9 @@ bt_status_t btc_hf_client_init(void)
 *******************************************************************************/
 static bt_status_t connect_int( bt_bdaddr_t *bd_addr, uint16_t uuid )
 {
-    if (is_connected(bd_addr))
+    if (is_connected(bd_addr)) {
         return BT_STATUS_BUSY;
+    }
 
     btc_hf_client_cb.state = ESP_HF_CLIENT_CONNECTION_STATE_CONNECTING;
     bdcpy(btc_hf_client_cb.connected_bda.address, bd_addr->address);
@@ -713,14 +714,14 @@ static void process_ind_evt(tBTA_HF_CLIENT_IND *ind)
 {
     esp_hf_client_cb_param_t param;
     memset(&param, 0, sizeof(esp_hf_client_cb_param_t));
-    
+
     switch (ind->type)
     {
         case BTA_HF_CLIENT_IND_CALL:
             param.call.status = ind->value;
             btc_hf_client_cb_to_app(ESP_HF_CLIENT_CIND_CALL_EVT, &param);
             break;
-    
+
         case BTA_HF_CLIENT_IND_CALLSETUP:
             param.call_setup.status = ind->value;
             btc_hf_client_cb_to_app(ESP_HF_CLIENT_CIND_CALL_SETUP_EVT, &param);
@@ -787,6 +788,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
             {
                 BTC_TRACE_WARNING("%s: HF CLient open failed, but another device connected. status=%d state=%d connected device=%s",
                         __FUNCTION__, p_data->open.status, btc_hf_client_cb.state, bdaddr_to_string(&btc_hf_client_cb.connected_bda, bdstr, sizeof(bdstr)));
+                UNUSED(bdstr);
                 break;
             }
 
@@ -795,18 +797,20 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 param.conn_stat.state = btc_hf_client_cb.state;
                 param.conn_stat.peer_feat = 0;
                 param.conn_stat.chld_feat = 0;
-            
+
                 memcpy(param.conn_stat.remote_bda, &btc_hf_client_cb.connected_bda,
                        sizeof(esp_bd_addr_t));
 
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_CONNECTION_STATE_EVT, &param);
             } while (0);
-            
-            if (btc_hf_client_cb.state == ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED)
-                bdsetany(btc_hf_client_cb.connected_bda.address);
 
-            if (p_data->open.status != BTA_HF_CLIENT_SUCCESS)
+            if (btc_hf_client_cb.state == ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED) {
+                bdsetany(btc_hf_client_cb.connected_bda.address);
+            }
+
+            if (p_data->open.status != BTA_HF_CLIENT_SUCCESS) {
                 btc_queue_advance();
+            }
 
             break;
 
@@ -820,13 +824,13 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 param.conn_stat.state = btc_hf_client_cb.state;
                 param.conn_stat.peer_feat = btc_hf_client_cb.peer_feat;
                 param.conn_stat.chld_feat = btc_hf_client_cb.chld_feat;
-            
+
                 memcpy(param.conn_stat.remote_bda, &btc_hf_client_cb.connected_bda,
                        sizeof(esp_bd_addr_t));
 
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_CONNECTION_STATE_EVT, &param);
             } while (0);
-            
+
             /* Inform the application about in-band ringtone */
             if (btc_hf_client_cb.peer_feat & BTA_HF_CLIENT_PEER_INBAND)
             {
@@ -839,7 +843,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
 
             btc_queue_advance();
             break;
-            
+
         case BTA_HF_CLIENT_CLOSE_EVT:
             btc_hf_client_cb.state = ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED;
             do {
@@ -847,7 +851,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 param.conn_stat.state = ESP_HF_CLIENT_CONNECTION_STATE_DISCONNECTED;
                 param.conn_stat.peer_feat = 0;
                 param.conn_stat.chld_feat = 0;
-            
+
                 memcpy(param.conn_stat.remote_bda, &btc_hf_client_cb.connected_bda,
                        sizeof(esp_bd_addr_t));
 
@@ -980,7 +984,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 memset(&param, 0, sizeof(esp_hf_client_cb_param_t));
                 param.audio_stat.state = ESP_HF_CLIENT_AUDIO_STATE_CONNECTED;
                 memcpy(param.audio_stat.remote_bda, &btc_hf_client_cb.connected_bda,
-                       sizeof(esp_bd_addr_t));                
+                       sizeof(esp_bd_addr_t));
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_AUDIO_STATE_EVT, &param);
             } while (0);
             break;
@@ -989,7 +993,7 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                 memset(&param, 0, sizeof(esp_hf_client_cb_param_t));
                 param.audio_stat.state = ESP_HF_CLIENT_AUDIO_STATE_CONNECTED_MSBC;
                 memcpy(param.audio_stat.remote_bda, &btc_hf_client_cb.connected_bda,
-                       sizeof(esp_bd_addr_t));                
+                       sizeof(esp_bd_addr_t));
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_AUDIO_STATE_EVT, &param);
             } while (0);
             break;

components/bt/bluedroid/btc/profile/std/include/btc_gap_ble.h

@@ -46,6 +46,7 @@ typedef enum {
     BTC_GAP_BLE_CONFIRM_REPLY_EVT,
     BTC_GAP_BLE_DISCONNECT_EVT,
     BTC_GAP_BLE_REMOVE_BOND_DEV_EVT,
+    BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST,
 } btc_gap_ble_act_t;
 
 /* btc_ble_gap_args_t */
@@ -94,6 +95,12 @@ typedef union {
         bool add_remove;
         esp_bd_addr_t remote_bda;
     }update_white_list;
+    //BTC_GAP_BLE_UPDATE_DUPLICATE_SCAN_EXCEPTIONAL_LIST
+    struct update_duplicate_exceptional_list_args {
+        uint8_t  subcode;
+        uint32_t  info_type;
+        esp_duplicate_info_t device_info;
+    }update_duplicate_exceptional_list;
     //BTC_GAP_BLE_ACT_SET_CONN_PARAMS
     struct set_conn_params_args {
         esp_bd_addr_t bd_addr;

components/bt/bluedroid/btc/profile/std/spp/btc_spp.c

@@ -315,6 +315,7 @@ static void btc_spp_init(btc_spp_args_t *arg)
 {
     if (osi_mutex_new(&spp_local_param.spp_slot_mutex) != 0) {
         BTC_TRACE_ERROR("%s osi_mutex_new failed\n", __func__);
+        return;
     }
     spp_local_param.spp_mode = arg->init.mode;
     spp_local_param.spp_slot_id = 0;
@@ -323,6 +324,10 @@ static void btc_spp_init(btc_spp_args_t *arg)
 
 static void btc_spp_uninit(void)
 {
+    if (!spp_local_param.spp_slot_mutex) {
+        BTC_TRACE_ERROR("%s SPP have not been init\n", __func__);
+        return;
+    }
     osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
     for (size_t i = 1; i <= BTA_JV_MAX_RFC_SR_SESSION; i++) {
         if (spp_local_param.spp_slots[i] != NULL && spp_local_param.spp_slots[i]->connected) {

components/bt/bluedroid/common/include/common/bt_target.h

@@ -95,6 +95,10 @@
 #define CLASSIC_BT_INCLUDED         FALSE
 #endif /* CLASSIC_BT_INCLUDED */
 
+#ifndef CLASSIC_BT_GATT_INCLUDED
+#define CLASSIC_BT_GATT_INCLUDED    FALSE
+#endif /* CLASSIC_BT_GATT_INCLUDED */
+
 #ifndef CONFIG_GATTC_CACHE_NVS_FLASH
 #define CONFIG_GATTC_CACHE_NVS_FLASH         FALSE
 #endif /* CONFIG_GATTC_CACHE_NVS_FLASH */
@@ -130,11 +134,45 @@
 #define BLE_PRIVACY_SPT           FALSE
 #endif  /* CONFIG_SMP_ENABLE */
 
+#ifdef CONFIG_SMP_SLAVE_CON_PARAMS_UPD_ENABLE
+#if(CONFIG_SMP_SLAVE_CON_PARAMS_UPD_ENABLE)
+#define SMP_SLAVE_CON_PARAMS_UPD_ENABLE  TRUE
+#else
+#define SMP_SLAVE_CON_PARAMS_UPD_ENABLE  FALSE
+#endif
+#else
+#define SMP_SLAVE_CON_PARAMS_UPD_ENABLE  FALSE
+#endif
+
+#ifndef CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED
+#define BLE_ADV_REPORT_FLOW_CONTROL  FALSE
+#else
+#define BLE_ADV_REPORT_FLOW_CONTROL  CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED
+#endif /* CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_SUPPORTED */
+
+#ifndef CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_NUM
+#define BLE_ADV_REPORT_FLOW_CONTROL_NUM   100
+#else
+#define BLE_ADV_REPORT_FLOW_CONTROL_NUM     CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_NUM
+#endif /* CONFIG_BLE_ADV_REPORT_FLOW_CONTROL_NUM */
+
+#ifndef CONFIG_BLE_ADV_REPORT_DISCARD_THRSHOLD
+#define BLE_ADV_REPORT_DISCARD_THRSHOLD  20
+#else
+#define BLE_ADV_REPORT_DISCARD_THRSHOLD  CONFIG_BLE_ADV_REPORT_DISCARD_THRSHOLD
+#endif /* CONFIG_BLE_ADV_REPORT_DISCARD_THRSHOLD */
+
 #if (CONFIG_BT_ACL_CONNECTIONS)
 #define MAX_ACL_CONNECTIONS  CONFIG_BT_ACL_CONNECTIONS
 #define GATT_MAX_PHY_CHANNEL CONFIG_BT_ACL_CONNECTIONS
 #endif  /* CONFIG_BT_ACL_CONNECTIONS */
 
+#if(CONFIG_BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT)
+#define BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT CONFIG_BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT
+#else
+#define BLE_ESTABLISH_LINK_CONNECTION_TIMEOUT 30
+#endif
+
 //------------------Added from bdroid_buildcfg.h---------------------
 #ifndef L2CAP_EXTFEA_SUPPORTED_MASK
 #define L2CAP_EXTFEA_SUPPORTED_MASK (L2CAP_EXTFEA_ENH_RETRANS | L2CAP_EXTFEA_STREAM_MODE | L2CAP_EXTFEA_NO_CRC | L2CAP_EXTFEA_FIXED_CHNLS)
@@ -324,6 +362,12 @@
 #define GATTS_SEND_SERVICE_CHANGE_MODE CONFIG_GATTS_SEND_SERVICE_CHANGE_MODE
 #endif
 
+#ifndef CONFIG_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+#define BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY    FALSE
+#else
+#define BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY    CONFIG_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+#endif
+
 /* This feature is used to eanble interleaved scan*/
 #ifndef BTA_HOST_INTERLEAVE_SEARCH
 #define BTA_HOST_INTERLEAVE_SEARCH FALSE//FALSE

components/bt/bluedroid/common/include/common/bte_appl.h

@@ -31,6 +31,7 @@ typedef struct {
     UINT8   ble_init_key;
     UINT8   ble_resp_key;
     UINT8   ble_max_key_size;
+    UINT8   ble_min_key_size;
     UINT8   ble_accept_auth_enable;
 #endif
 
@@ -47,4 +48,4 @@ typedef struct {
 #endif
 } tBTE_BT_APPL_CFG;
 
-extern tBTE_BT_APPL_CFG bte_bt_appl_cfg;
+extern tBTE_BT_APPL_CFG bte_bt_appl_cfg;

components/bt/bluedroid/device/controller.c

@@ -100,7 +100,11 @@ static void start_up(void)
     response = AWAIT_COMMAND(packet_factory->make_set_c2h_flow_control(HCI_HOST_FLOW_CTRL_ACL_ON));
     packet_parser->parse_generic_command_complete(response);
 #endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
-
+#if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
+    // Enable adv flow control
+    response = AWAIT_COMMAND(packet_factory->make_set_adv_report_flow_control(HCI_HOST_FLOW_CTRL_ADV_REPORT_ON, (uint16_t)BLE_ADV_REPORT_FLOW_CONTROL_NUM, (uint16_t)BLE_ADV_REPORT_DISCARD_THRSHOLD));
+    packet_parser->parse_generic_command_complete(response);
+#endif
     // Tell the controller about our buffer sizes and buffer counts next
     // TODO(zachoverflow): factor this out. eww l2cap contamination. And why just a hardcoded 10?
     response = AWAIT_COMMAND(
@@ -250,10 +254,10 @@ static void start_up(void)
     }
 #endif
 
-    if (simple_pairing_supported) {
-        response = AWAIT_COMMAND(packet_factory->make_set_event_mask(&CLASSIC_EVENT_MASK));
-        packet_parser->parse_generic_command_complete(response);
-    }
+
+    response = AWAIT_COMMAND(packet_factory->make_set_event_mask(&CLASSIC_EVENT_MASK));
+    packet_parser->parse_generic_command_complete(response);
+
 
 #if (BTM_SCO_HCI_INCLUDED == TRUE)
     response = AWAIT_COMMAND(packet_factory->make_write_sync_flow_control_enable(1));

components/bt/bluedroid/device/interop.c

@@ -27,6 +27,7 @@
 #define CASE_RETURN_STR(const) case const: return #const;
 
 #if (SMP_INCLUDED == TRUE)
+#if (!CONFIG_BT_STACK_NO_LOG)
 static const char *interop_feature_string(const interop_feature_t feature)
 {
     switch (feature) {
@@ -36,7 +37,7 @@ static const char *interop_feature_string(const interop_feature_t feature)
 
     return "UNKNOWN";
 }
-
+#endif // (!CONFIG_BT_STACK_NO_LOG)
 // Interface functions
 bool interop_match(const interop_feature_t feature, const bt_bdaddr_t *addr)
 {
@@ -47,7 +48,9 @@ bool interop_match(const interop_feature_t feature, const bt_bdaddr_t *addr)
     for (size_t i = 0; i != db_size; ++i) {
         if (feature == interop_database[i].feature &&
                 memcmp(addr, &interop_database[i].addr, interop_database[i].len) == 0) {
+#if (!CONFIG_BT_STACK_NO_LOG)
             char bdstr[20] = {0};
+#endif
             LOG_WARN("%s() Device %s is a match for interop workaround %s", __func__,
                      bdaddr_to_string(addr, bdstr, sizeof(bdstr)), interop_feature_string(feature));
             return true;

components/bt/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c

@@ -145,9 +145,10 @@ void sbc_enc_bit_alloc_mono(SBC_ENC_PARAMS *pstrCodecParams)
         for (s32Sb = 0; s32Sb < s32NumOfSubBands; s32Sb++) {
             if (*(ps16GenBufPtr) < s32BitSlice + 2) {
                 *(ps16GenArrPtr) = 0;
-            } else
+            } else {
                 *(ps16GenArrPtr) = ((*(ps16GenBufPtr) - s32BitSlice) < 16) ?
                                    (SINT16)(*(ps16GenBufPtr) - s32BitSlice) : 16;
+            }
 
             ps16GenBufPtr++;
             ps16GenArrPtr++;

components/bt/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c

@@ -132,9 +132,10 @@ void sbc_enc_bit_alloc_ste(SBC_ENC_PARAMS *pstrCodecParams)
         for (s32Sb = 0; s32Sb < s32NumOfSubBands; s32Sb++) {
             if (*ps16GenBufPtr < s32BitSlice + 2) {
                 *ps16GenArrPtr = 0;
-            } else
+            } else {
                 *ps16GenArrPtr = ((*(ps16GenBufPtr) - s32BitSlice) < 16) ?
                                  (SINT16)(*(ps16GenBufPtr) - s32BitSlice) : 16;
+            }
             ps16GenBufPtr++;
             ps16GenArrPtr++;
         }

components/bt/bluedroid/hci/hci_hal_h4.c

@@ -55,6 +55,7 @@ static const uint16_t outbound_event_types[] = {
 typedef struct {
     size_t buffer_size;
     fixed_queue_t *rx_q;
+    uint16_t adv_free_num;
 } hci_hal_env_t;
 
 
@@ -81,6 +82,7 @@ static void hci_hal_env_init(
     assert(max_buffer_count > 0);
 
     hci_hal_env.buffer_size = buffer_size;
+    hci_hal_env.adv_free_num = 0;
 
     hci_hal_env.rx_q = fixed_queue_new(max_buffer_count);
     if (hci_hal_env.rx_q) {
@@ -102,8 +104,11 @@ static bool hal_open(const hci_hal_callbacks_t *upper_callbacks)
 {
     assert(upper_callbacks != NULL);
     callbacks = upper_callbacks;
-
+#if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
+    hci_hal_env_init(HCI_HAL_SERIAL_BUFFER_SIZE, BLE_ADV_REPORT_FLOW_CONTROL_NUM + L2CAP_HOST_FC_ACL_BUFS + QUEUE_SIZE_MAX); // adv flow control num + ACL flow control num + hci cmd numeber
+#else
     hci_hal_env_init(HCI_HAL_SERIAL_BUFFER_SIZE, QUEUE_SIZE_MAX);
+#endif
 
     xHciH4Queue = xQueueCreate(HCI_H4_QUEUE_LEN, sizeof(BtTaskEvt_t));
     xTaskCreatePinnedToCore(hci_hal_h4_rx_handler, HCI_H4_TASK_NAME, HCI_H4_TASK_STACK_SIZE, NULL, HCI_H4_TASK_PRIO, &xHciH4TaskHandle, HCI_H4_TASK_PINNED_TO_CORE);
@@ -184,10 +189,10 @@ task_post_status_t hci_hal_h4_task_post(task_post_t timeout)
     evt.par = 0;
 
     if (xQueueSend(xHciH4Queue, &evt, timeout) != pdTRUE) {
-        return TASK_POST_SUCCESS;
+        return TASK_POST_FAIL;
     }
 
-    return TASK_POST_FAIL;
+    return TASK_POST_SUCCESS;
 }
 
 #if (C2H_FLOW_CONTROL_INCLUDED == TRUE)
@@ -223,12 +228,37 @@ static void hci_packet_complete(BT_HDR *packet){
 bool host_recv_adv_packet(BT_HDR *packet)
 {
     assert(packet);
-    if(packet->data[0] == DATA_TYPE_EVENT && packet->data[1] == HCI_BLE_EVENT && packet->data[3] ==  HCI_BLE_ADV_PKT_RPT_EVT) {
-        return true;
+    if(packet->data[0] == DATA_TYPE_EVENT && packet->data[1] == HCI_BLE_EVENT) {
+        if(packet->data[3] ==  HCI_BLE_ADV_PKT_RPT_EVT 
+#if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
+        || packet->data[3] ==  HCI_BLE_ADV_DISCARD_REPORT_EVT
+#endif
+        ) {
+            return true;
+        }
     }
     return false;
 }
 
+#if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
+static void hci_update_adv_report_flow_control(BT_HDR *packet)
+{
+    // this is adv packet
+    if(host_recv_adv_packet(packet)) {
+        // update adv free number
+        hci_hal_env.adv_free_num ++;
+        if (esp_vhci_host_check_send_available()){
+            // send hci cmd
+            btsnd_hcic_ble_update_adv_report_flow_control(hci_hal_env.adv_free_num);
+            hci_hal_env.adv_free_num = 0;
+        } else {
+            //do nothing
+        }
+    }
+
+}
+#endif
+
 static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
 {
     uint8_t type, hdr_size;
@@ -247,8 +277,10 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
     packet->offset++;
     packet->len--;
     if (type == HCI_BLE_EVENT) {
+#if (!CONFIG_BT_STACK_NO_LOG)
         uint8_t len = 0;
         STREAM_TO_UINT8(len, stream);
+#endif
         HCI_TRACE_ERROR("Workround stream corrupted during LE SCAN: pkt_len=%d ble_event_len=%d\n",
                   packet->len, len);
         osi_free(packet);
@@ -282,6 +314,11 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
         osi_free(packet);
         return;
     }
+
+#if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
+    hci_update_adv_report_flow_control(packet);
+#endif
+
 #if SCAN_QUEUE_CONGEST_CHECK
     if(BTU_check_queue_is_congest() && host_recv_adv_packet(packet)) {
         HCI_TRACE_ERROR("BtuQueue is congested");
@@ -289,7 +326,6 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
         return;
     }
 #endif
-
     packet->event = outbound_event_types[PACKET_TYPE_TO_INDEX(type)];
     callbacks->packet_ready(packet);
 }

components/bt/bluedroid/hci/hci_layer.c

@@ -317,7 +317,11 @@ static void event_command_ready(fixed_queue_t *queue)
 
     wait_entry = fixed_queue_dequeue(queue);
 
-    if(wait_entry->opcode == HCI_HOST_NUM_PACKETS_DONE){
+    if(wait_entry->opcode == HCI_HOST_NUM_PACKETS_DONE 
+#if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
+    || wait_entry->opcode == HCI_VENDOR_BLE_ADV_REPORT_FLOW_CONTROL
+#endif
+    ){
         packet_fragmenter->fragment_and_dispatch(wait_entry->command);
         osi_free(wait_entry->command);
         osi_free(wait_entry);

components/bt/bluedroid/hci/hci_packet_factory.c

@@ -53,6 +53,18 @@ static BT_HDR *make_set_c2h_flow_control(uint8_t enable)
     return packet;
 }
 
+static BT_HDR *make_set_adv_report_flow_control(uint8_t enable, uint16_t num, uint16_t lost_threshold)
+{
+    uint8_t *stream;
+    const uint8_t parameter_size = 1 + 2 + 2;
+    BT_HDR *packet = make_command(HCI_VENDOR_BLE_SET_ADV_FLOW_CONTROL, parameter_size, &stream);
+
+    UINT8_TO_STREAM(stream, enable);
+    UINT16_TO_STREAM(stream, num);
+    UINT16_TO_STREAM(stream, lost_threshold);
+    return packet;
+}
+
 static BT_HDR *make_host_buffer_size(uint16_t acl_size, uint8_t sco_size, uint16_t acl_count, uint16_t sco_count)
 {
     uint8_t *stream;
@@ -239,6 +251,7 @@ static const hci_packet_factory_t interface = {
     make_reset,
     make_read_buffer_size,
     make_set_c2h_flow_control,
+    make_set_adv_report_flow_control,
     make_host_buffer_size,
     make_read_local_version_info,
     make_read_bd_addr,

components/bt/bluedroid/hci/include/hci/hci_packet_factory.h

@@ -26,6 +26,7 @@ typedef struct {
     BT_HDR *(*make_reset)(void);
     BT_HDR *(*make_read_buffer_size)(void);
     BT_HDR *(*make_set_c2h_flow_control)(uint8_t enable);
+    BT_HDR *(*make_set_adv_report_flow_control)(uint8_t enable, uint16_t num, uint16_t lost_threshold);
     BT_HDR *(*make_host_buffer_size)(uint16_t acl_size, uint8_t sco_size, uint16_t acl_count, uint16_t sco_count);
     BT_HDR *(*make_read_local_version_info)(void);
     BT_HDR *(*make_read_bd_addr)(void);

components/bt/bluedroid/hci/packet_fragmenter.c

@@ -88,6 +88,13 @@ static void fragment_and_dispatch(BT_HDR *packet)
         controller->get_acl_data_size_ble();
 
     max_packet_size = max_data_size + HCI_ACL_PREAMBLE_SIZE;
+    if((packet->len > max_packet_size) && (packet->layer_specific == 0) && (event == MSG_STACK_TO_HC_HCI_ACL)) {
+        packet->event = MSG_HC_TO_STACK_L2C_SEG_XMIT;
+         current_fragment_packet = NULL;
+         callbacks->transmit_finished(packet, false);
+         return;
+
+    }
     remaining_length = packet->len;
     STREAM_TO_UINT16(continuation_handle, stream);
     continuation_handle = APPLY_CONTINUATION_FLAG(continuation_handle);

components/bt/bluedroid/main/bte_init.c

@@ -366,4 +366,9 @@ void BTE_DeinitStack(void)
 #if (defined(A2D_INCLUDED) && A2D_INCLUDED == TRUE)
     A2D_Deinit();
 #endif
+
+#if (defined(RFCOMM_INCLUDED) && RFCOMM_INCLUDED == TRUE)
+    RFCOMM_Deinit();
+#endif
+
 }

components/bt/bluedroid/osi/config.c

@@ -389,7 +389,7 @@ bool config_save(const config_t *config, const char *filename)
     const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
     char *keyname = osi_calloc(keyname_bufsz);
     int config_size = get_config_size(config);
-    char *buf = osi_calloc(config_size + 100);
+    char *buf = osi_calloc(config_size);
     if (!line || !buf || !keyname) {
         err_code |= 0x01;
         goto error;
@@ -409,6 +409,16 @@ bool config_save(const config_t *config, const char *filename)
     for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
         const section_t *section = (const section_t *)list_node(node);
         w_cnt = snprintf(line, 1024, "[%s]\n", section->name);
+        if(w_cnt < 0) {
+            OSI_TRACE_ERROR("snprintf error w_cnt %d.",w_cnt);
+            err_code |= 0x10;
+            goto error;
+        }
+        if(w_cnt_total + w_cnt > config_size) {
+            OSI_TRACE_ERROR("%s, memcpy size (w_cnt + w_cnt_total = %d) is larger than buffer size (config_size = %d).", __func__, (w_cnt + w_cnt_total), config_size);
+            err_code |= 0x20;
+            goto error;
+        }
         OSI_TRACE_DEBUG("section name: %s, w_cnt + w_cnt_total = %d\n", section->name, w_cnt + w_cnt_total);
         memcpy(buf + w_cnt_total, line, w_cnt);
         w_cnt_total += w_cnt;
@@ -417,6 +427,16 @@ bool config_save(const config_t *config, const char *filename)
             const entry_t *entry = (const entry_t *)list_node(enode);
             OSI_TRACE_DEBUG("(key, val): (%s, %s)\n", entry->key, entry->value);
             w_cnt = snprintf(line, 1024, "%s = %s\n", entry->key, entry->value);
+            if(w_cnt < 0) {
+                OSI_TRACE_ERROR("snprintf error w_cnt %d.",w_cnt);
+                err_code |= 0x10;
+                goto error;
+            }
+            if(w_cnt_total + w_cnt > config_size) {
+                OSI_TRACE_ERROR("%s, memcpy size (w_cnt + w_cnt_total = %d) is larger than buffer size.(config_size = %d)", __func__, (w_cnt + w_cnt_total), config_size);
+                err_code |= 0x20;
+                goto error;
+            }
             OSI_TRACE_DEBUG("%s, w_cnt + w_cnt_total = %d", __func__, w_cnt + w_cnt_total);
             memcpy(buf + w_cnt_total, line, w_cnt);
             w_cnt_total += w_cnt;
@@ -523,7 +543,10 @@ static void config_parse(nvs_handle fp, config_t *config)
     const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
     char *keyname = osi_calloc(keyname_bufsz);
     int buf_size = get_config_size_from_flash(fp);
-    char *buf = osi_calloc(buf_size + 100);
+    char *buf = osi_calloc(buf_size);
+    if(buf_size == 0) { //First use nvs
+        goto error;
+    }
     if (!line || !section || !buf || !keyname) {
         err_code |= 0x01;
         goto error;