component/bt:move the btdm_rebase_ssp_api branch to this branch

components/bt/bluedroid/api/esp_gap_ble_api.c

@@ -283,3 +283,85 @@ esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_d
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 
 }
+
+
+esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
+        void *value, uint8_t len)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SET_SECURITY_PARAM_EVT;
+    arg.set_security_param.param_type = param_type;
+    arg.set_security_param.len = len;
+    arg.set_security_param.value = value;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_act)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SET_ENCRYPTION_EVT;
+    arg.set_encryption.sec_act = sec_act;
+    memcpy(arg.set_encryption.bd_addr, bd_addr, ESP_BD_ADDR_LEN);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr, bool accept)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_SECURITY_RSP_EVT;
+    arg.sec_rsp.accept = accept;
+    memcpy(arg.sec_rsp.bd_addr, bd_addr, ESP_BD_ADDR_LEN);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+
+}
+
+esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t passkey)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_PASSKEY_REPLY_EVT;
+    arg.enc_passkey_replay.accept = accept;
+    arg.enc_passkey_replay.passkey = passkey;
+    memcpy(arg.enc_passkey_replay.bd_addr, bd_addr, ESP_BD_ADDR_LEN);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept)
+{
+    btc_msg_t msg;
+    btc_ble_gap_args_t arg;
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_CONFIRM_REPLY_EVT;
+    arg.enc_comfirm_replay.accept = accept;
+    memcpy(arg.enc_comfirm_replay.bd_addr, bd_addr, ESP_BD_ADDR_LEN);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+
+

components/bt/bluedroid/api/include/esp_bt_defs.h

@@ -32,6 +32,16 @@ typedef enum {
     ESP_BT_STATUS_WRONG_MODE       =  5,
 } esp_bt_status_t;
 
+
+/*Define the bt octet 16 bit size*/
+#define ESP_BT_OCTET16_LEN    16
+typedef uint8_t esp_bt_octet16_t[ESP_BT_OCTET16_LEN];   /* octet array: size 16 */
+
+#define ESP_BT_OCTET8_LEN    8
+typedef uint8_t esp_bt_octet8_t[ESP_BT_OCTET8_LEN];   /* octet array: size 8 */
+
+typedef uint8_t esp_link_key[ESP_BT_OCTET16_LEN];      /* Link Key */
+
 /// Default GATT interface id
 #define ESP_DEFAULT_GATT_IF             0xff
 
@@ -91,6 +101,15 @@ typedef enum {
     BLE_ADDR_TYPE_RPA_RANDOM    = 0x03,
 } esp_ble_addr_type_t;
 
+/// Used to exchange the encrytyption key in the init key & response key
+#define ESP_BLE_ENC_KEY_MASK    (1 << 0)
+/// Used to exchange the IRK key in the init key & response key
+#define ESP_BLE_ID_KEY_MASK     (1 << 1)
+/// Used to exchange the CSRK key in the init key & response key
+#define ESP_BLE_CSR_KEY_MASK    (1 << 2)
+/// Used to exchange the link key(this key just used in the BLE & BR/EDR coexist mode) in the init key & response key
+#define ESP_BLE_LINK_KEY_MASK   (1 << 3)
+
 /// Minimum of the application id
 #define ESP_APP_ID_MIN  0x0000
 /// Maximum of the application id

components/bt/bluedroid/api/include/esp_gap_ble_api.h

@@ -38,6 +38,34 @@ extern "C" {
  * @}
  */
 
+#define ESP_LE_KEY_NONE                    0
+#define ESP_LE_KEY_PENC                    (1 << 0)                     /*!< encryption key, encryption information of peer device */
+#define ESP_LE_KEY_PID                     (1 << 1)                     /*!< identity key of the peer device */
+#define ESP_LE_KEY_PCSRK                   (1 << 2)                     /*!< peer SRK */
+#define ESP_LE_KEY_PLK                     (1 << 3)                     /*!< Link key*/	
+#define ESP_LE_KEY_LLK                     (ESP_LE_KEY_PLK << 4)
+#define ESP_LE_KEY_LENC                    (ESP_LE_KEY_PENC << 4)                   /*!< master role security information:div */
+#define ESP_LE_KEY_LID                     (ESP_LE_KEY_PID << 4)                    /*!< master device ID key */
+#define ESP_LE_KEY_LCSRK                   (ESP_LE_KEY_PCSRK << 4)                  /*!< local CSRK has been deliver to peer */
+typedef uint8_t	esp_ble_key_type_t;
+
+#define ESP_LE_AUTH_NO_BOND                 0x00                                     /*!< 0*/
+#define ESP_LE_AUTH_BOND                    0x01                                     /*!< 1 << 0 */
+#define ESP_LE_AUTH_REQ_MITM                (1 << 2)                                 /*!< 1 << 2 */
+#define ESP_LE_AUTH_REQ_SC_ONLY             (1 << 3)                                 /*!< 1 << 3 */
+#define ESP_LE_AUTH_REQ_SC_BOND             (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_SC_ONLY)            /*!< 1001 */
+#define ESP_LE_AUTH_REQ_SC_MITM             (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY)        /*!< 1100 */
+#define ESP_LE_AUTH_REQ_SC_MITM_BOND        (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY | ESP_LE_AUTH_BOND)   /*!< 1101 */
+typedef uint8_t   esp_ble_auth_req_t;         /*!< combination of the above bit pattern */
+
+#define ESP_IO_CAP_OUT                      0   /*!< DisplayOnly */
+#define ESP_IO_CAP_IO                       1   /*!< DisplayYesNo */
+#define ESP_IO_CAP_IN                       2   /*!< KeyboardOnly */
+#define ESP_IO_CAP_NONE                     3   /*!< NoInputNoOutput */
+#define ESP_IO_CAP_KBDISP                   4   /*!< Keyboard display */
+typedef uint8_t esp_ble_io_cap_t;               /*!< combination of the io capability */
+
+
 /// GAP BLE callback event type
 typedef enum {
     ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT        = 0,       /*!< When advertising data set complete, the event comes */
@@ -48,6 +76,15 @@ typedef enum {
     ESP_GAP_BLE_SCAN_RSP_DATA_RAW_SET_COMPLETE_EVT,         /*!< When raw advertising data set complete, the event comes */
     ESP_GAP_BLE_ADV_START_COMPLETE_EVT,                     /*!< When start advertising complete, the event comes */
     ESP_GAP_BLE_SCAN_START_COMPLETE_EVT,                    /*!< When start scan complete, the event comes */
+    ESP_GAP_BLE_AUTH_CMPL_EVT,                              /* Authentication complete indication. */
+    ESP_GAP_BLE_KEY_EVT,                                    /* BLE  key event for peer device keys */
+    ESP_GAP_BLE_SEC_REQ_EVT,                                /* BLE  security request */
+    ESP_GAP_BLE_PASSKEY_NOTIF_EVT,                          /* passkey notification event */
+    ESP_GAP_BLE_PASSKEY_REQ_EVT,                            /* passkey request event */
+    ESP_GAP_BLE_OOB_REQ_EVT,                                /* OOB request event */
+    ESP_GAP_BLE_LOCAL_IR_EVT,                               /* BLE local IR event */
+    ESP_GAP_BLE_LOCAL_ER_EVT,                               /* BLE local ER event */
+    ESP_GAP_BLE_NC_REQ_EVT,                                 /* Numeric Comparison request event */
     ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT,                      /*!< When stop adv complete, the event comes */
     ESP_GAP_BLE_SCAN_STOP_COMPLETE_EVT,                     /*!< When stop scan complete, the event comes */
 } esp_gap_ble_cb_event_t;
@@ -115,6 +152,23 @@ typedef enum {
     ///Enumeration end value for advertising filter policy value check
 } esp_ble_adv_filter_t;
 
+
+typedef enum {
+    ESP_BLE_SEC_NONE,                
+    ESP_BLE_SEC_ENCRYPT,             
+    ESP_BLE_SEC_ENCRYPT_NO_MITM,     
+    ESP_BLE_SEC_ENCRYPT_MITM,        
+}esp_ble_sec_act_t;
+
+typedef enum {
+    ESP_BLE_SM_PASSKEY,
+    ESP_BLE_SM_AUTHEN_REQ_MODE,
+    ESP_BLE_SM_IOCAP_MODE,
+    ESP_BLE_SM_SET_INIT_KEY,
+    ESP_BLE_SM_SET_RSP_KEK,
+    ESP_BLE_SM_MAX_KEY_SIZE,
+} esp_ble_sm_param_t;
+
 /// Advertising parameters
 typedef struct {
     uint16_t                adv_int_min;        /*!< Minimum advertising interval for
@@ -217,6 +271,137 @@ typedef struct {
                                                       Time Range: 100 msec to 32 seconds */
 } esp_ble_conn_update_params_t;
 
+/**
+* @brief BLE encryption keys
+*/
+typedef struct
+{
+    esp_bt_octet16_t     ltk;          /*!< The long term key*/
+    esp_bt_octet8_t      rand;         /*!< The random number*/
+    uint16_t             ediv;         /*!< The ediv value*/
+    uint8_t              sec_level;    /*!< The security level of the security link*/
+    uint8_t              key_size;     /*!< The key size(7~16) of the security link*/
+}esp_ble_penc_keys_t;                  /*!< The key type*/
+
+/**
+* @brief  BLE CSRK keys 
+*/
+typedef struct
+{
+    uint32_t            counter;      /*!< The counter */
+    esp_bt_octet16_t    csrk;         /*!< The csrk key */
+    uint8_t             sec_level;    /*!< The security level */
+}esp_ble_pcsrk_keys_t;                /*!< The pcsrk key type */
+
+/**
+* @brief  BLE pid keys 
+*/
+typedef struct
+{
+    esp_bt_octet16_t          irk;           /*!< The irk value */
+    esp_bd_addr_type_t        addr_type;     /*!< The address type */
+    esp_bd_addr_t             static_addr;   /*!< The static address */
+}esp_ble_pid_keys_t;                         /*!< The pid key type */
+
+/**
+* @brief  BLE Encryption reproduction keys
+*/
+typedef struct
+{
+    esp_bt_octet16_t  ltk;                  /*!< The long term key */
+    uint16_t          div;                  /*!< The div value */
+    uint8_t           key_size;             /*!< The key size of the security link */
+    uint8_t           sec_level;            /*!< The security level of the security link */
+}esp_ble_lenc_keys_t;                       /*!< The  key type */
+
+/**
+* @brief  BLE SRK keys
+*/
+typedef struct
+{
+    uint32_t          counter;              /*!< The counter value */
+    uint16_t          div;                  /*!< The div value */
+    uint8_t           sec_level;            /*!< The security level of the security link */
+    esp_bt_octet16_t            csrk;       /*!< The csrk key value */
+}esp_ble_lcsrk_keys;                        /*!< The csrk key type */
+
+/**
+* @brief  Structure associated with ESP_KEY_NOTIF_EVT 
+*/
+typedef struct
+{
+    esp_bd_addr_t  bd_addr;        /*!< peer address */
+    uint32_t       passkey;        /*!< the numeric value for comparison. If just_works, do not show this number to UI */
+} esp_ble_sec_key_notif_t;         /*!< BLE key notify type*/
+
+/**
+* @brief  Structure of the security request
+*/
+typedef struct
+{
+    esp_bd_addr_t  bd_addr;        /*!< peer address */
+}esp_ble_sec_req_t;                /*!< BLE security request type*/
+
+/**
+* @brief  union type of the security key value
+*/
+typedef union
+{
+    esp_ble_penc_keys_t   penc_key;       /*!< received peer encryption key */
+    esp_ble_pcsrk_keys_t  pcsrk_key;      /*!< received peer device SRK */
+    esp_ble_pid_keys_t    pid_key;        /*!< peer device ID key */
+    esp_ble_lenc_keys_t   lenc_key;       /*!< local encryption reproduction keys LTK = = d1(ER,DIV,0)*/
+    esp_ble_lcsrk_keys   lcsrk_key;       /*!< local device CSRK = d1(ER,DIV,1)*/
+}esp_ble_key_value_t;                     /*!< ble key value type*/
+
+
+/**
+* @brief  union type of the security key value
+*/
+typedef struct
+{
+    esp_bd_addr_t               bd_addr;        /*!< peer address */
+    esp_ble_key_type_t          key_type;       /*!< key type of the security link */
+    esp_ble_key_value_t         p_key_value;    /*!< the pointer to the key value */
+}esp_ble_key_t;                                 /*!< the union to the ble key value type*/
+
+/**
+* @brief  structure type of the ble local id keys value
+*/
+typedef struct {
+    esp_bt_octet16_t       ir;                  /*!< the 16 bits of the ir value */
+    esp_bt_octet16_t       irk;                 /*!< the 16 bits of the ir key value */
+    esp_bt_octet16_t       dhk;                 /*!< the 16 bits of the dh key value */
+}esp_ble_local_id_keys_t;                       /*!< the structure of the ble local id keys value type*/
+
+
+/**
+  * @brief Structure associated with ESP_AUTH_CMPL_EVT
+  */
+typedef struct
+{
+    esp_bd_addr_t         bd_addr;               /*!< BD address peer device. */	
+    bool                  key_present;           /*!< Valid link key value in key element */
+    esp_link_key          key;                   /*!< Link key associated with peer device. */
+    uint8_t               key_type;              /*!< The type of Link Key */
+    bool                  success;               /*!< TRUE of authentication succeeded, FALSE if failed. */
+    uint8_t               fail_reason;           /*!< The HCI reason/error code for when success=FALSE */
+    esp_bd_addr_type_t    addr_type;             /*!< Peer device address type */
+    esp_bt_dev_type_t     dev_type;              /*!< Device type */
+}esp_ble_auth_cmpl_t;                            /*!< The ble authentication complite cb type */
+
+/**
+  * @brief union associated with ble security
+  */
+typedef union
+{
+    esp_ble_sec_key_notif_t    key_notif;      /*!< passkey notification */
+    esp_ble_sec_req_t          ble_req;        /*!< BLE SMP related request */
+    esp_ble_key_t              ble_key;        /*!< BLE SMP keys used when pairing */
+    esp_ble_local_id_keys_t    ble_id_keys;    /*!< BLE IR event */
+    esp_ble_auth_cmpl_t        auth_cmpl;      /*!< Authentication complete indication. */
+}esp_ble_sec_t;                                /*!< Ble  secutity type */
+
 /// Sub Event of ESP_GAP_BLE_SCAN_RESULT_EVT
 typedef enum {
     ESP_GAP_SEARCH_INQ_RES_EVT             = 0,      /*!< Inquiry result for a peer device. */
@@ -302,6 +487,8 @@ typedef union {
     struct ble_scan_start_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate scan start operation success status */
     } scan_start_cmpl;                              /*!< Event parameter of ESP_GAP_BLE_SCAN_START_COMPLETE_EVT */
+
+    esp_ble_sec_t ble_security;                     /*!< ble gap security union type */
     /**
      * @brief ESP_GAP_BLE_SCAN_STOP_COMPLETE_EVT
      */
@@ -519,6 +706,76 @@ esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_l
  */
 esp_err_t esp_ble_gap_config_scan_rsp_data_raw(uint8_t *raw_data, uint32_t raw_data_len);
 
+
+/**
+* @brief             Set a GAP security parameter value. Overrides the default value.
+*
+* @param[in]       param_type :L the type of the param which to be set
+* @param[in]       value  : the param value
+* @param[out]     len : the length of the param value
+*
+* @return            - ESP_OK : success
+*                  		- other  : failed
+*
+*/
+esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
+                                         void *value, uint8_t len);
+
+/**
+* @brief             Grant security request access.
+*
+* @param[in]       bd_addr : BD address of the peer
+* @param[in]       accept  :  accept the security request or not
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_security_rsp(esp_bd_addr_t bd_addr,  bool accept);
+
+
+/**
+* @brief             Set a gap parameter value. Use this function to change
+*                    the default GAP parameter values.
+*
+* @param[in]       bd_addr : the address of the peer device need to encryption
+* @param[in]       sec_act  : This is the security action to indicate
+*                                  	what kind of BLE security level is required for
+*                                  	the BLE link if the BLE is supported
+*
+* @return            - ESP_OK : success
+*                       - other  : failed
+*
+*/
+esp_err_t esp_ble_set_encryption(esp_bd_addr_t bd_addr, esp_ble_sec_act_t sec_act);
+
+/**
+* @brief          Reply the key value to the peer device in the lagecy connection stage.
+*
+* @param[in]      bd_addr : BD address of the peer
+* @param[in]      accept : passkey entry sucessful or declined.
+* @param[in]      passkey : passkey value, must be a 6 digit number,
+*                                     can be lead by 0.
+*
+* @return            - ESP_OK : success
+*                  - other  : failed
+*
+*/
+esp_err_t esp_ble_passkey_reply(esp_bd_addr_t bd_addr, bool accept, uint32_t passkey);
+
+
+/**
+* @brief           Reply the comfirm value to the peer device in the lagecy connection stage.
+*
+* @param[in]       bd_addr : BD address of the peer device
+* @param[in]       accept : numbers to compare are the same or different.
+*
+* @return            - ESP_OK : success
+*                       - other  : failed
+*
+*/
+esp_err_t esp_ble_confirm_reply(esp_bd_addr_t bd_addr, bool accept);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/bluedroid/bta/dm/bta_dm_act.c

@@ -4200,7 +4200,7 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         } else {
             sec_event.auth_cmpl.success = TRUE;
             if (!p_data->complt.smp_over_br) {
-                GATT_ConfigServiceChangeCCC(bda, TRUE, BT_TRANSPORT_LE);
+                
             }
         }
 
@@ -4472,11 +4472,6 @@ void bta_dm_ble_update_conn_params (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_ble_set_rand_address(tBTA_DM_MSG *p_data)
 {
-    UINT8 len = sizeof(p_data->set_addr);
-    if (len != BD_ADDR_LEN) {
-        APPL_TRACE_ERROR("Invalid random adress");
-        return;
-    }
     if (p_data->set_addr.addr_type != BLE_ADDR_RANDOM) {
         APPL_TRACE_ERROR("Invalid random adress type = %d\n", p_data->set_addr.addr_type);
         return;

components/bt/bluedroid/bta/include/bta_dm_co.h

@@ -270,4 +270,13 @@ extern void bta_dm_co_ble_io_req(BD_ADDR bd_addr,  tBTA_IO_CAP *p_io_cap,
                                  tBTA_LE_KEY_TYPE  *p_resp_key );
 // btla-specific --
 
+extern void bta_dm_co_ble_set_io_cap(UINT8 ble_io_cap);
+
+extern void bta_dm_co_ble_set_auth_req(UINT8 ble_auth_req);
+
+extern void bta_dm_co_ble_set_init_key_req(UINT8 init_key);
+
+extern void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key);
+
+extern void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size);
 #endif

components/bt/bluedroid/btc/core/btc_ble_storage.c

@@ -0,0 +1,489 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <string.h>
+
+#include "bta_api.h"
+#include "btc_config.h"
+#include "bdaddr.h"
+#include "btc_ble_storage.h"
+#include "bta_gatts_co.h"
+
+btc_dm_pairing_cb_t pairing_cb;
+btc_dm_local_key_cb_t ble_local_key_cb;
+
+/*******************************************************************************
+**
+** Function         btc_storage_load_bonded_devices
+**
+** Description      btc storage API - Loads all the bonded devices from NVRAM
+**                  and adds to the BTA.
+**                  Additionally, this API also invokes the adaper_properties_cb
+**                  and remote_device_properties_cb for each of the bonded devices.
+**
+** Returns          BT_STATUS_SUCCESS if successful, BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_load_bonded_ble_devices(void)
+{
+    bt_status_t status;
+    status = btc_in_fetch_bonded_ble_devices(1);
+    LOG_DEBUG("Storage load rslt %d\n", status);
+    return status;
+}
+
+bt_status_t btc_in_fetch_bonded_ble_devices(int add)
+{
+    btc_bonded_devices_t bonded_devices;
+    for (const btc_config_section_iter_t *iter = btc_config_section_begin(); iter != btc_config_section_end();
+            iter = btc_config_section_next(iter)) {
+        const char *name = btc_config_section_name(iter);
+        if (!string_is_bdaddr(name)) {
+            continue;
+        }
+
+        if (!(btc_in_fetch_bonded_ble_device(name, add, &bonded_devices)) ) {
+            LOG_DEBUG("Remote device:%s, no link key or ble key found", name);
+            return BT_STATUS_FAIL;
+        }
+    }
+
+    return BT_STATUS_SUCCESS;
+}
+
+void btc_dm_remove_ble_bonding_keys(void)
+{
+    bt_bdaddr_t bd_addr;
+    LOG_DEBUG("%s\n",__func__);
+
+    bdcpy(bd_addr.address, pairing_cb.bd_addr);
+    btc_storage_remove_ble_bonding_keys(&bd_addr);
+}
+
+void btc_save_ble_bonding_keys(void)
+{
+    bt_bdaddr_t bd_addr;
+
+    LOG_DEBUG("%s\n",__func__ );
+
+    bdcpy(bd_addr.address, pairing_cb.bd_addr);
+    if (pairing_cb.ble.is_penc_key_rcvd) {
+        btc_storage_add_ble_bonding_key(&bd_addr,
+                                        (char *) &pairing_cb.ble.penc_key,
+                                        BTM_LE_KEY_PENC,
+                                        sizeof(tBTM_LE_PENC_KEYS));
+    }
+
+    if (pairing_cb.ble.is_pid_key_rcvd) {
+        btc_storage_add_ble_bonding_key(&bd_addr,
+                                        (char *) &pairing_cb.ble.pid_key,
+                                        BTM_LE_KEY_PID,
+                                        sizeof(tBTM_LE_PID_KEYS));
+    }
+
+
+    if (pairing_cb.ble.is_pcsrk_key_rcvd) {
+        btc_storage_add_ble_bonding_key(&bd_addr,
+                                        (char *) &pairing_cb.ble.pcsrk_key,
+                                        BTM_LE_KEY_PCSRK,
+                                        sizeof(tBTM_LE_PCSRK_KEYS));
+    }
+
+
+    if (pairing_cb.ble.is_lenc_key_rcvd) {
+        btc_storage_add_ble_bonding_key(&bd_addr,
+                                        (char *) &pairing_cb.ble.lenc_key,
+                                        BTM_LE_KEY_LENC,
+                                        sizeof(tBTM_LE_LENC_KEYS));
+    }
+
+    if (pairing_cb.ble.is_lcsrk_key_rcvd) {
+        btc_storage_add_ble_bonding_key(&bd_addr,
+                                        (char *) &pairing_cb.ble.lcsrk_key,
+                                        BTM_LE_KEY_LCSRK,
+                                        sizeof(tBTM_LE_LCSRK_KEYS));
+    }
+
+    if (pairing_cb.ble.is_lidk_key_rcvd) {
+        btc_storage_add_ble_bonding_key(&bd_addr,
+                                        NULL,
+                                        BTM_LE_KEY_LID,
+                                        0);
+    }
+}
+
+static void btc_read_le_key(const uint8_t key_type, const size_t key_len, bt_bdaddr_t bd_addr,
+                 const uint8_t addr_type, const bool add_key, bool *device_added, bool *key_found)
+{
+    assert(device_added);
+    assert(key_found);
+
+    char buffer[100];
+    memset(buffer, 0, sizeof(buffer));
+
+    if (btc_storage_get_ble_bonding_key(&bd_addr, key_type, buffer, key_len) == BT_STATUS_SUCCESS) {
+        if (add_key) {
+            BD_ADDR bta_bd_addr;
+            bdcpy(bta_bd_addr, bd_addr.address);
+
+            if (!*device_added) {
+                BTA_DmAddBleDevice(bta_bd_addr, addr_type, BT_DEVICE_TYPE_BLE);
+                *device_added = true;
+            }
+
+            char bd_str[20] = {0};
+            LOG_DEBUG("%s() Adding key type %d for %s", __func__,
+                key_type, bdaddr_to_string(&bd_addr, bd_str, sizeof(bd_str)));
+            BTA_DmAddBleKey(bta_bd_addr, (tBTA_LE_KEY_VALUE *)buffer, key_type);
+        }
+
+        *key_found = true;
+    }
+}
+
+
+bt_status_t btc_storage_add_ble_bonding_key(bt_bdaddr_t *remote_bd_addr,
+                                                                                     char *key,
+                                                                                     uint8_t key_type,
+                                                                                     uint8_t key_length)
+{
+    char bdstr[6] = {0};
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    const char* name;
+    switch (key_type) {
+    case BTM_LE_KEY_PENC:
+        name = "LE_KEY_PENC";
+        break;
+    case BTM_LE_KEY_PID:
+        name = "LE_KEY_PID";
+        break;
+    case BTM_LE_KEY_PCSRK:
+        name = "LE_KEY_PCSRK";
+        break;
+    case BTM_LE_KEY_LENC:
+        name = "LE_KEY_LENC";
+        break;
+    case BTM_LE_KEY_LCSRK:
+        name = "LE_KEY_LCSRK";
+        break;
+    case BTM_LE_KEY_LID:
+        name = "LE_KEY_LID";
+        break;
+    default:
+        return BT_STATUS_FAIL;
+    }
+
+    int ret = btc_config_set_bin(bdstr, name, (const uint8_t *)key, key_length);
+    btc_config_save();
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+
+/*******************************************************************************
+**
+** Function         btc_storage_get_ble_bonding_key
+**
+** Description
+**
+** Returns       BT_STATUS_SUCCESS if the fetch was successful,
+**                  BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_get_ble_bonding_key(bt_bdaddr_t *remote_bd_addr,
+                                                                                    uint8_t key_type,
+                                                                                    char *key_value,
+                                                                                    int key_length)
+{
+    char bdstr[6] = {0};
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    const char* name;
+    switch (key_type) {
+    case BTM_LE_KEY_PENC:
+        name = "LE_KEY_PENC";
+        break;
+    case BTM_LE_KEY_PID:
+        name = "LE_KEY_PID";
+        break;
+    case BTM_LE_KEY_PCSRK:
+        name = "LE_KEY_PCSRK";
+        break;
+    case BTM_LE_KEY_LENC:
+        name = "LE_KEY_LENC";
+        break;
+    case BTM_LE_KEY_LCSRK:
+        name = "LE_KEY_LCSRK";
+        break;
+    case BTM_LE_KEY_LID:
+        name =  "LE_KEY_LID";
+    default:
+        return BT_STATUS_FAIL;
+    }
+    size_t length = key_length;
+    int ret = btc_config_get_bin(bdstr, name, (uint8_t *)key_value, &length);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+
+}
+
+/*******************************************************************************
+**
+** Function         btc_storage_remove_ble_bonding_keys
+**
+** Description      btc storage API - Deletes the bonded device from NVRAM
+**
+** Returns          BT_STATUS_SUCCESS if the deletion was successful,
+**                  BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_remove_ble_bonding_keys(bt_bdaddr_t *remote_bd_addr)
+{
+    char bdstr[6] = {0};
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    BTIF_TRACE_DEBUG(" %s in bd addr:%s",__FUNCTION__, bdstr);
+    int ret = 1;
+    if (btc_config_exist(bdstr, "LE_KEY_PENC")) {
+        ret &= btc_config_remove(bdstr, "LE_KEY_PENC");
+    }
+    if (btc_config_exist(bdstr, "LE_KEY_PID")) {
+        ret &= btc_config_remove(bdstr, "LE_KEY_PID");
+    }
+    if (btc_config_exist(bdstr, "LE_KEY_PCSRK")) {
+        ret &= btc_config_remove(bdstr, "LE_KEY_PCSRK");
+    }
+    if (btc_config_exist(bdstr, "LE_KEY_LENC")) {
+        ret &= btc_config_remove(bdstr, "LE_KEY_LENC");
+    }
+    if (btc_config_exist(bdstr, "LE_KEY_LCSRK")) {
+        ret &= btc_config_remove(bdstr, "LE_KEY_LCSRK");
+    }
+    btc_config_save();
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+/*******************************************************************************
+**
+** Function         btc_storage_add_ble_local_key
+**
+** Description      BTIF storage API - Adds the ble key to NVRAM
+**
+** Returns          BT_STATUS_SUCCESS if the store was successful,
+**                  BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_add_ble_local_key(char *key,
+                                                                              uint8_t key_type,
+                                                                              uint8_t key_length)
+{
+    const char* name;
+    switch (key_type) {
+    case BTC_LE_LOCAL_KEY_IR:
+        name = "LE_LOCAL_KEY_IR";
+        break;
+    case BTC_LE_LOCAL_KEY_IRK:
+        name = "LE_LOCAL_KEY_IRK";
+        break;
+    case BTC_LE_LOCAL_KEY_DHK:
+        name = "LE_LOCAL_KEY_DHK";
+        break;
+    case BTC_LE_LOCAL_KEY_ER:
+        name = "LE_LOCAL_KEY_ER";
+        break;
+    default:
+        return BT_STATUS_FAIL;
+    }
+    int ret = btc_config_set_bin("Adapter", name, (const uint8_t *)key, key_length);
+    btc_config_save();
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+/*******************************************************************************
+**
+** Function         btc_storage_get_ble_local_key
+**
+** Description
+**
+** Returns          BT_STATUS_SUCCESS if the fetch was successful,
+**                  BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_get_ble_local_key(uint8_t key_type,
+                                                                             char *key_value,
+                                                                             int key_length)
+{
+    const char* name;
+    switch (key_type) {
+    case BTC_LE_LOCAL_KEY_IR:
+        name = "LE_LOCAL_KEY_IR";
+        break;
+    case BTC_LE_LOCAL_KEY_IRK:
+        name = "LE_LOCAL_KEY_IRK";
+        break;
+    case BTC_LE_LOCAL_KEY_DHK:
+        name = "LE_LOCAL_KEY_DHK";
+        break;
+    case BTC_LE_LOCAL_KEY_ER:
+        name = "LE_LOCAL_KEY_ER";
+        break;
+    default:
+        return BT_STATUS_FAIL;
+    }
+    size_t length = key_length;
+    int ret = btc_config_get_bin("Adapter", name, (uint8_t *)key_value, &length);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+/*******************************************************************************
+**
+** Function         btc_storage_remove_ble_local_keys
+**
+** Description      BTC storage API - Deletes the bonded device from NVRAM
+**
+** Returns          BT_STATUS_SUCCESS if the deletion was successful,
+**                  BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_remove_ble_local_keys(void)
+{
+    int ret = 1;
+    if (btc_config_exist("Adapter", "LE_LOCAL_KEY_IR")) {
+        ret &= btc_config_remove("Adapter", "LE_LOCAL_KEY_IR");
+    }
+    if (btc_config_exist("Adapter", "LE_LOCAL_KEY_IRK")) {
+        ret &= btc_config_remove("Adapter", "LE_LOCAL_KEY_IRK");
+    }
+    if (btc_config_exist("Adapter", "LE_LOCAL_KEY_DHK")) {
+        ret &= btc_config_remove("Adapter", "LE_LOCAL_KEY_DHK");
+    }
+    if (btc_config_exist("Adapter", "LE_LOCAL_KEY_ER")) {
+        ret &= btc_config_remove("Adapter", "LE_LOCAL_KEY_ER");
+    }
+    btc_config_save();
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+
+bt_status_t btc_in_fetch_bonded_ble_device(const char *remote_bd_addr, int add, 
+                                                                                 btc_bonded_devices_t *p_bonded_devices)
+{
+    int device_type;
+    int addr_type;
+    bt_bdaddr_t bd_addr;
+    BD_ADDR bta_bd_addr;
+    bool device_added = false;
+    bool key_found = false;
+
+    if (!btc_config_get_int(remote_bd_addr, "AddrType", &device_type)) {
+        LOG_ERROR("%s, device_type = %x", __func__, device_type);
+        return BT_STATUS_FAIL;
+    }
+   
+        string_to_bdaddr(remote_bd_addr, &bd_addr);
+        bdcpy(bta_bd_addr, bd_addr.address);
+
+        if (btc_storage_get_remote_addr_type(&bd_addr, &addr_type) != BT_STATUS_SUCCESS) {
+            addr_type = BLE_ADDR_PUBLIC;
+            btc_storage_set_remote_addr_type(&bd_addr, BLE_ADDR_PUBLIC);
+        }
+
+        btc_read_le_key(BTM_LE_KEY_PENC, sizeof(tBTM_LE_PENC_KEYS),
+                        bd_addr, addr_type, add, &device_added, &key_found);
+
+        btc_read_le_key(BTM_LE_KEY_PID, sizeof(tBTM_LE_PID_KEYS),
+                        bd_addr, addr_type, add, &device_added, &key_found);
+
+        btc_read_le_key(BTM_LE_KEY_LID, sizeof(tBTM_LE_PID_KEYS),
+                        bd_addr, addr_type, add, &device_added, &key_found);
+
+        btc_read_le_key(BTM_LE_KEY_PCSRK, sizeof(tBTM_LE_PCSRK_KEYS),
+                        bd_addr, addr_type, add, &device_added, &key_found);
+
+        btc_read_le_key(BTM_LE_KEY_LENC, sizeof(tBTM_LE_LENC_KEYS),
+                        bd_addr, addr_type, add, &device_added, &key_found);
+
+        btc_read_le_key(BTM_LE_KEY_LCSRK, sizeof(tBTM_LE_LCSRK_KEYS),
+                        bd_addr, addr_type, add, &device_added, &key_found);
+
+        if (key_found) {
+            return BT_STATUS_SUCCESS;
+    }
+    return BT_STATUS_FAIL;
+}
+
+bt_status_t btc_storage_set_remote_addr_type(bt_bdaddr_t *remote_bd_addr,
+        uint8_t addr_type)
+{
+    char bdstr[6] = {0};
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bt_bdaddr_t));
+    int ret = btc_config_set_int(bdstr, "AddrType", (int)addr_type);
+    btc_config_save();
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+/*******************************************************************************
+**
+** Function         btc_storage_get_remote_addr_type
+**
+** Description      btc storage API - Fetches the remote addr type
+**
+** Returns          BT_STATUS_SUCCESS if the fetch was successful,
+**                      BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btc_storage_get_remote_addr_type(bt_bdaddr_t *remote_bd_addr,
+                                              int*addr_type)
+{
+    char bdstr[6] = {0};
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    int ret = btc_config_get_int(bdstr, "AddrType", addr_type);
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
+
+
+void btc_dm_load_ble_local_keys(void)
+{
+    memset(&ble_local_key_cb, 0, sizeof(btc_dm_local_key_cb_t));
+
+    if (btc_storage_get_ble_local_key(BTC_LE_LOCAL_KEY_ER,(char*)&ble_local_key_cb.er[0],
+                                      BT_OCTET16_LEN)== BT_STATUS_SUCCESS) {
+        ble_local_key_cb.is_er_rcvd = TRUE;
+        LOG_DEBUG("%s BLE ER key loaded",__func__ );
+    }
+
+    if ((btc_storage_get_ble_local_key(BTC_LE_LOCAL_KEY_IR,(char*)&ble_local_key_cb.id_keys.ir[0],
+                                       BT_OCTET16_LEN)== BT_STATUS_SUCCESS )&&
+            (btc_storage_get_ble_local_key(BTC_LE_LOCAL_KEY_IRK, (char*)&ble_local_key_cb.id_keys.irk[0],
+                                           BT_OCTET16_LEN)== BT_STATUS_SUCCESS)&&
+            (btc_storage_get_ble_local_key(BTC_LE_LOCAL_KEY_DHK,(char*)&ble_local_key_cb.id_keys.dhk[0],
+                                           BT_OCTET16_LEN)== BT_STATUS_SUCCESS)) {
+        ble_local_key_cb.is_id_keys_rcvd = TRUE;
+        LOG_DEBUG("%s BLE ID keys loaded", __func__);
+    }
+
+}
+void btc_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK *p_key_mask, BT_OCTET16 er,
+                                                            tBTA_BLE_LOCAL_ID_KEYS *p_id_keys)
+{
+    if (ble_local_key_cb.is_er_rcvd ) {
+        memcpy(&er[0], &ble_local_key_cb.er[0], sizeof(BT_OCTET16));
+        *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ER;
+    }
+
+    if (ble_local_key_cb.is_id_keys_rcvd) {
+        memcpy(&p_id_keys->ir[0], &ble_local_key_cb.id_keys.ir[0], sizeof(BT_OCTET16));
+        memcpy(&p_id_keys->irk[0],  &ble_local_key_cb.id_keys.irk[0], sizeof(BT_OCTET16));
+        memcpy(&p_id_keys->dhk[0],  &ble_local_key_cb.id_keys.dhk[0], sizeof(BT_OCTET16));
+        *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ID;
+    }
+    LOG_DEBUG("%s  *p_key_mask=0x%02x",__func__,   *p_key_mask);
+}
+                                       

components/bt/bluedroid/btc/core/btc_dm.c

@@ -21,6 +21,8 @@
 #include "bt_trace.h"
 #include "bt_target.h"
 #include "btc_storage.h"
+#include "btc_ble_storage.h"
+#include "esp_gap_ble_api.h"
 #include "bta_api.h"
 
 
@@ -111,6 +113,42 @@ static void btc_disable_bluetooth_evt(void)
     future_ready(*btc_main_get_future_p(BTC_MAIN_DISABLE_FUTURE), FUTURE_SUCCESS);
 }
 
+static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
+{
+    /* Save link key, if not temporary */
+    bt_status_t status = BT_STATUS_FAIL;
+    if (p_auth_cmpl->success) {
+        status = BT_STATUS_SUCCESS;
+        int addr_type;
+        bdcpy(pairing_cb.bd_addr, p_auth_cmpl->bd_addr);
+        if (btc_storage_get_remote_addr_type((bt_bdaddr_t *)pairing_cb.bd_addr, &addr_type) != BT_STATUS_SUCCESS) {
+            btc_storage_set_remote_addr_type((bt_bdaddr_t *)pairing_cb.bd_addr, p_auth_cmpl->addr_type);
+        }
+
+        btc_save_ble_bonding_keys();
+    } else {
+        /*Map the HCI fail reason  to  bt status  */
+        switch (p_auth_cmpl->fail_reason) {
+        case BTA_DM_AUTH_SMP_PAIR_AUTH_FAIL:
+        case BTA_DM_AUTH_SMP_CONFIRM_VALUE_FAIL:
+            btc_dm_remove_ble_bonding_keys();
+            status = BT_STATUS_AUTH_FAILURE;
+            break;
+        case BTA_DM_AUTH_SMP_PAIR_NOT_SUPPORT:
+            status = BT_STATUS_AUTH_REJECTED;
+            break;
+        default:
+            btc_dm_remove_ble_bonding_keys();
+            status =  BT_STATUS_FAIL;
+            break;
+        }
+
+    }
+
+    LOG_DEBUG("%s, authentication status = %x", __func__, status);
+    return;
+}
+
 static void btc_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 {
     /* Save link key, if not temporary */
@@ -252,6 +290,12 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
 {
     btc_dm_sec_args_t *arg = (btc_dm_sec_args_t *)(msg->arg);
     tBTA_DM_SEC *p_data = &(arg->sec);
+    esp_ble_gap_cb_param_t param = {0};
+    btc_msg_t ble_msg = {0};
+    bool rsp_app = false;
+    bt_status_t ret = BT_STATUS_SUCCESS;
+    ble_msg.sig = BTC_SIG_API_CB;
+    ble_msg.pid = BTC_PID_GAP_BLE;
     // tBTA_SERVICE_MASK service_mask;
     LOG_DEBUG("btc_dm_upstreams_cback  ev: %d\n", msg->act);
 
@@ -259,6 +303,8 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
     case BTA_DM_ENABLE_EVT: {
         btc_clear_services_mask();
         btc_storage_load_bonded_devices();
+        //load the ble local key whitch has been store in the flash
+        btc_dm_load_ble_local_keys();
         btc_enable_bluetooth_evt(p_data->enable.status);
         break;
     }
@@ -289,17 +335,143 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
     case BTA_DM_HW_ERROR_EVT:
 
 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
-    case BTA_DM_BLE_KEY_EVT:
-    case BTA_DM_BLE_SEC_REQ_EVT:
-    case BTA_DM_BLE_PASSKEY_NOTIF_EVT:
-    case BTA_DM_BLE_PASSKEY_REQ_EVT:
-    case BTA_DM_BLE_NC_REQ_EVT:
-    case BTA_DM_BLE_OOB_REQ_EVT:
-    case BTA_DM_BLE_LOCAL_IR_EVT:
-    case BTA_DM_BLE_LOCAL_ER_EVT:
-    case BTA_DM_BLE_AUTH_CMPL_EVT:
-    case BTA_DM_LE_FEATURES_READ:
-    case BTA_DM_ENER_INFO_READ:
+    case BTA_DM_BLE_AUTH_CMPL_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_AUTH_CMPL_EVT;
+        memcpy(&param.ble_security.auth_cmpl, &p_data->auth_cmpl, sizeof(esp_ble_auth_cmpl_t));
+        btc_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
+        break;
+    }
+    case BTA_DM_BLE_KEY_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_KEY_EVT;
+        param.ble_security.ble_key.key_type = p_data->ble_key.key_type;
+        memcpy(param.ble_security.ble_key.bd_addr, p_data->ble_key.bd_addr, BD_ADDR_LEN);
+        switch (p_data->ble_key.key_type) {
+            case BTM_LE_KEY_PENC: {
+                LOG_DEBUG("Rcv BTA_LE_KEY_PENC");
+                pairing_cb.ble.is_penc_key_rcvd = TRUE;
+                pairing_cb.ble.penc_key = p_data->ble_key.p_key_value->penc_key;
+                memcpy(&pairing_cb.ble.penc_key, &p_data->ble_key.p_key_value->penc_key,
+                             sizeof(tBTM_LE_PENC_KEYS));
+                memcpy(&param.ble_security.ble_key.p_key_value.penc_key,
+                             &p_data->ble_key.p_key_value->penc_key, sizeof(tBTM_LE_PENC_KEYS));
+                break;
+            }
+            case BTM_LE_KEY_PID: {
+                LOG_DEBUG("Rcv BTA_LE_KEY_PID");
+                pairing_cb.ble.is_pid_key_rcvd = TRUE;
+                memcpy(&pairing_cb.ble.pid_key, &p_data->ble_key.p_key_value->pid_key,
+                            sizeof(tBTM_LE_PID_KEYS));
+                memcpy(&param.ble_security.ble_key.p_key_value.pid_key,
+                             &p_data->ble_key.p_key_value->pid_key, sizeof(tBTM_LE_PID_KEYS));
+                break;
+            }
+            case BTM_LE_KEY_PCSRK: {
+                LOG_DEBUG("Rcv BTA_LE_KEY_PCSRK");
+                pairing_cb.ble.is_pcsrk_key_rcvd = TRUE;
+                memcpy(&pairing_cb.ble.pcsrk_key, &p_data->ble_key.p_key_value->pcsrk_key,
+                             sizeof(tBTM_LE_PCSRK_KEYS));
+                memcpy(&param.ble_security.ble_key.p_key_value.pcsrk_key,
+                             &p_data->ble_key.p_key_value->pcsrk_key, sizeof(tBTM_LE_PCSRK_KEYS));
+                break;
+            }
+            case BTM_LE_KEY_LENC: {
+                LOG_DEBUG("Rcv BTA_LE_KEY_LENC");
+                pairing_cb.ble.is_lenc_key_rcvd = TRUE;
+                memcpy(&pairing_cb.ble.lenc_key, &p_data->ble_key.p_key_value->lenc_key,
+                            sizeof(tBTM_LE_LENC_KEYS));
+                memcpy(&param.ble_security.ble_key.p_key_value.lenc_key,
+                             &p_data->ble_key.p_key_value->lenc_key, sizeof(tBTM_LE_LENC_KEYS));
+                break;
+            }
+            case BTM_LE_KEY_LCSRK: {
+                LOG_DEBUG("Rcv BTA_LE_KEY_LCSRK");
+                pairing_cb.ble.is_lcsrk_key_rcvd = TRUE;
+                memcpy(&pairing_cb.ble.lcsrk_key, &p_data->ble_key.p_key_value->lcsrk_key,
+                            sizeof(tBTM_LE_LCSRK_KEYS));
+                memcpy(&param.ble_security.ble_key.p_key_value.lcsrk_key,
+                             &p_data->ble_key.p_key_value->lcsrk_key, sizeof(tBTM_LE_LCSRK_KEYS));
+                break;
+            }
+            case BTM_LE_KEY_LID: {
+                LOG_DEBUG("Rcv BTA_LE_KEY_LID");
+                pairing_cb.ble.is_lidk_key_rcvd =  TRUE;
+                break;
+            }
+            default:
+                break;
+        }
+
+        break;
+    }
+    case BTA_DM_BLE_SEC_REQ_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_SEC_REQ_EVT;
+        memcpy(param.ble_security.ble_req.bd_addr, p_data->ble_req.bd_addr, BD_ADDR_LEN);
+        break;
+    }
+    case BTA_DM_BLE_PASSKEY_NOTIF_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_PASSKEY_NOTIF_EVT;
+        param.ble_security.key_notif.passkey = p_data->key_notif.passkey;
+        memcpy(param.ble_security.key_notif.bd_addr, p_data->ble_req.bd_addr, BD_ADDR_LEN);
+        break;
+    }
+    case BTA_DM_BLE_PASSKEY_REQ_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_PASSKEY_REQ_EVT;
+        memcpy(param.ble_security.ble_req.bd_addr, p_data->ble_req.bd_addr, BD_ADDR_LEN);
+        break;
+    }
+    case BTA_DM_BLE_OOB_REQ_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_OOB_REQ_EVT;
+        memcpy(param.ble_security.ble_req.bd_addr, p_data->ble_req.bd_addr, BD_ADDR_LEN);
+        break;
+    }
+    case BTA_DM_BLE_LOCAL_IR_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_LOCAL_IR_EVT;
+        memcpy(&param.ble_security.ble_id_keys, &p_data->ble_id_keys, sizeof(tBTA_BLE_LOCAL_ID_KEYS));
+        LOG_DEBUG("BTA_DM_BLE_LOCAL_IR_EVT. ");
+        ble_local_key_cb.is_id_keys_rcvd = TRUE;
+        memcpy(&ble_local_key_cb.id_keys.irk[0],
+               &p_data->ble_id_keys.irk[0], sizeof(BT_OCTET16));
+        memcpy(&ble_local_key_cb.id_keys.ir[0],
+               &p_data->ble_id_keys.ir[0], sizeof(BT_OCTET16));
+        memcpy(&ble_local_key_cb.id_keys.dhk[0],
+               &p_data->ble_id_keys.dhk[0], sizeof(BT_OCTET16));
+        btc_storage_add_ble_local_key( (char *)&ble_local_key_cb.id_keys.irk[0],
+                                       BTC_LE_LOCAL_KEY_IRK,
+                                       BT_OCTET16_LEN);
+        btc_storage_add_ble_local_key( (char *)&ble_local_key_cb.id_keys.ir[0],
+                                       BTC_LE_LOCAL_KEY_IR,
+                                       BT_OCTET16_LEN);
+        btc_storage_add_ble_local_key( (char *)&ble_local_key_cb.id_keys.dhk[0],
+                                       BTC_LE_LOCAL_KEY_DHK,
+                                       BT_OCTET16_LEN);
+        break;
+    }
+    case BTA_DM_BLE_LOCAL_ER_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_LOCAL_ER_EVT;
+        memcpy(&param.ble_security.ble_id_keys, &p_data->ble_id_keys, sizeof(tBTA_BLE_LOCAL_ID_KEYS));
+        LOG_DEBUG("BTA_DM_BLE_LOCAL_ER_EVT. ");
+        ble_local_key_cb.is_er_rcvd = TRUE;
+        memcpy(&ble_local_key_cb.er[0], &p_data->ble_er[0], sizeof(BT_OCTET16));
+        btc_storage_add_ble_local_key( (char *)&ble_local_key_cb.er[0],
+                                       BTC_LE_LOCAL_KEY_ER,
+                                       BT_OCTET16_LEN);
+        break;
+    }
+    case BTA_DM_BLE_NC_REQ_EVT: {
+        rsp_app = true;
+        ble_msg.act = ESP_GAP_BLE_NC_REQ_EVT;
+        memcpy(param.ble_security.key_notif.bd_addr, p_data->key_notif.bd_addr, BD_ADDR_LEN);
+        param.ble_security.key_notif.passkey = p_data->key_notif.passkey;
+        break;
+    }
 #endif
 
     case BTA_DM_AUTHORIZE_EVT:
@@ -313,5 +485,13 @@ void btc_dm_sec_cb_handler(btc_msg_t *msg)
         break;
     }
 
+    if (rsp_app) {
+        ret = btc_transfer_context(&ble_msg, &param,
+                                   sizeof(esp_ble_gap_cb_param_t), NULL);
+
+        if (ret != BT_STATUS_SUCCESS) {
+            LOG_ERROR("%s btc_transfer_context failed\n", __func__);
+        }
+    }
     btc_dm_sec_arg_deep_free(msg);
 }

components/bt/bluedroid/btc/core/btc_util.c

@@ -27,7 +27,9 @@
 #include <ctype.h>
 
 #include "btc_util.h"
+#if (BTA_AV_INCLUDED == TRUE)
 #include "bta_av_api.h"
+#endif  ///BTA_AV_INCLUDED == TRUE
 #include "bt_defs.h"
 
 /************************************************************************************
@@ -59,6 +61,7 @@
 /*****************************************************************************
 **   Logging helper functions
 *****************************************************************************/
+#if(BTA_AV_INCLUDED == TRUE)
 const char *dump_rc_event(UINT8 event)
 {
     switch (event) {
@@ -114,6 +117,7 @@ const char  *dump_rc_pdu(UINT8 pdu)
         return "Unknown PDU";
     }
 }
+#endif  ///BTA_AV_INCLUDED == TRUE
 
 UINT32 devclass2uint(DEV_CLASS dev_class)
 {

components/bt/bluedroid/btc/include/btc_ble_storage.h

@@ -0,0 +1,123 @@
+// Copyright (C) 2014 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "bt_types.h"
+#include "bt_target.h"
+
+
+#define BTC_LE_LOCAL_KEY_IR       (1<<0)
+#define BTC_LE_LOCAL_KEY_IRK      (1<<1)
+#define BTC_LE_LOCAL_KEY_DHK      (1<<2)
+#define BTC_LE_LOCAL_KEY_ER       (1<<3)
+
+/************************************************************************************
+**  Local type definitions
+************************************************************************************/
+typedef struct
+{
+    uint32_t num_devices;
+    bt_bdaddr_t devices[BTM_SEC_MAX_DEVICE_RECORDS];
+} btc_bonded_devices_t;
+
+typedef struct
+{
+    bool                   is_penc_key_rcvd;
+    tBTM_LE_PENC_KEYS         penc_key;       /* received peer encryption key */
+    bool                   is_pcsrk_key_rcvd;
+    tBTM_LE_PCSRK_KEYS        pcsrk_key;       /* received peer device SRK */
+    bool                   is_pid_key_rcvd;
+    tBTM_LE_PID_KEYS          pid_key;        /* peer device ID key */
+    bool                   is_lenc_key_rcvd;
+    tBTM_LE_LENC_KEYS         lenc_key;       /* local encryption reproduction keys LTK = = d1(ER,DIV,0)*/
+    bool                   is_lcsrk_key_rcvd;
+    tBTM_LE_LCSRK_KEYS        lcsrk_key;      /* local device CSRK = d1(ER,DIV,1)*/
+    bool                   is_lidk_key_rcvd;   /* local identity key received */
+} btc_dm_ble_cb_t;
+
+typedef struct
+{
+    bt_bdaddr_t static_bdaddr;
+    BD_ADDR bd_addr;
+    btc_dm_ble_cb_t ble;
+} btc_dm_pairing_cb_t;
+
+typedef struct
+{
+    uint8_t       ir[BT_OCTET16_LEN];
+    uint8_t       irk[BT_OCTET16_LEN];
+    uint8_t       dhk[BT_OCTET16_LEN];
+}btc_dm_local_key_id_t;
+
+typedef struct
+{
+    bool                 is_er_rcvd;
+    uint8_t             er[BT_OCTET16_LEN];
+    bool                 is_id_keys_rcvd;
+    btc_dm_local_key_id_t  id_keys;  /* ID kyes */
+}btc_dm_local_key_cb_t;
+
+typedef struct
+{
+    BT_OCTET16 sp_c;
+    BT_OCTET16 sp_r;
+    BD_ADDR  oob_bdaddr;  /* peer bdaddr*/
+} btc_dm_oob_cb_t;
+
+
+extern btc_dm_pairing_cb_t pairing_cb;
+extern btc_dm_local_key_cb_t ble_local_key_cb;
+
+bt_status_t btc_storage_load_bonded_ble_devices(void);
+
+bt_status_t btc_in_fetch_bonded_ble_devices(int add);
+
+void btc_dm_remove_ble_bonding_keys(void);
+
+bt_status_t btc_storage_add_ble_bonding_key( bt_bdaddr_t *remote_bd_addr,
+                                                                                      char *key,
+                                                                                      uint8_t key_type,
+                                                                                      uint8_t key_length);
+
+void btc_save_ble_bonding_keys(void);
+
+bt_status_t btc_in_fetch_bonded_ble_device(const char *remote_bd_addr, int add, 
+                                           btc_bonded_devices_t *p_bonded_devices);
+
+bt_status_t btc_storage_get_ble_bonding_key(bt_bdaddr_t *remote_bd_addr,
+                                                                uint8_t key_type,
+                                                                char *key_value,
+                                                                int key_length);
+
+bt_status_t btc_storage_add_ble_local_key(char *key,
+                                                                              uint8_t key_type,
+                                                                              uint8_t key_length);
+
+bt_status_t btc_storage_remove_ble_bonding_keys(bt_bdaddr_t *remote_bd_addr);
+
+bt_status_t btc_storage_remove_ble_local_keys(void);
+
+bt_status_t btc_storage_get_ble_local_key(uint8_t key_type,
+                                                                             char *key_value,
+                                                                             int key_len);
+
+bt_status_t btc_storage_get_remote_addr_type(bt_bdaddr_t *remote_bd_addr,
+                                                                                     int *addr_type);
+
+bt_status_t btc_storage_set_remote_addr_type(bt_bdaddr_t *remote_bd_addr,
+                                                                                     uint8_t addr_type);
+
+void btc_dm_load_ble_local_keys(void);
+
+void btc_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK *p_key_mask, BT_OCTET16 er,
+                                                            tBTA_BLE_LOCAL_ID_KEYS *p_id_keys);

components/bt/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -15,7 +15,9 @@
 #include <string.h>
 
 #include "bt_types.h"
+#include "bt_defs.h"
 #include "bta_api.h"
+#include "bta_dm_co.h"
 #include "btc_task.h"
 #include "btc_manage.h"
 #include "btc_gap_ble.h"
@@ -566,6 +568,15 @@ static void btc_stop_scan_callback(tBTA_STATUS status)
     }
 }
 
+static void btc_set_encryption_callback(BD_ADDR bd_addr, tBTA_TRANSPORT transport, tBTA_STATUS enc_status)
+{
+    UNUSED(bd_addr);
+    UNUSED(transport);
+    LOG_DEBUG("enc_status = %x\n", enc_status);
+    return;
+}
+
+
 static void btc_ble_start_scanning(uint8_t duration,
                                    tBTA_DM_SEARCH_CBACK *results_cb,
                                    tBTA_START_STOP_SCAN_CMPL_CBACK *start_scan_cb)
@@ -662,6 +673,33 @@ void btc_gap_ble_cb_handler(btc_msg_t *msg)
     case ESP_GAP_BLE_SCAN_START_COMPLETE_EVT:
         btc_gap_ble_cb_to_app(ESP_GAP_BLE_SCAN_START_COMPLETE_EVT, param);
         break;
+    case ESP_GAP_BLE_AUTH_CMPL_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_AUTH_CMPL_EVT, param);
+        break;
+    case ESP_GAP_BLE_KEY_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_KEY_EVT, param);
+        break;
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_KEY_EVT, param);
+    case ESP_GAP_BLE_SEC_REQ_EVT:
+	    btc_gap_ble_cb_to_app(ESP_GAP_BLE_SEC_REQ_EVT, param);
+	    break;
+    case ESP_GAP_BLE_PASSKEY_NOTIF_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_PASSKEY_NOTIF_EVT, param);
+	    break;
+    case ESP_GAP_BLE_PASSKEY_REQ_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_PASSKEY_REQ_EVT, param);
+        break;
+    case ESP_GAP_BLE_OOB_REQ_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_OOB_REQ_EVT, param);
+        break;
+    case ESP_GAP_BLE_LOCAL_IR_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_LOCAL_IR_EVT, param);
+        break;
+    case ESP_GAP_BLE_LOCAL_ER_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_LOCAL_ER_EVT, param);
+        break;
+    case ESP_GAP_BLE_NC_REQ_EVT:
+        btc_gap_ble_cb_to_app(ESP_GAP_BLE_NC_REQ_EVT, param);
     case ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT:
         btc_gap_ble_cb_to_app(ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT, param);
         break;
@@ -720,6 +758,21 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
             if (dst->cfg_scan_rsp_data_raw.raw_scan_rsp) {
                 memcpy(dst->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp, src->cfg_scan_rsp_data_raw.raw_scan_rsp_len);
             }
+        }
+          break;
+       }	
+	case BTC_GAP_BLE_SET_SECURITY_PARAM_EVT: {
+        btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
+        btc_ble_gap_args_t  *dst = (btc_ble_gap_args_t *) p_dest;
+        uint8_t length = 0;
+        if (src->set_security_param.value) {
+            length = dst->set_security_param.len;
+            dst->set_security_param.value = GKI_getbuf(length);
+            if (dst->set_security_param.value != NULL) {
+                memcpy(dst->set_security_param.value, src->set_security_param.value, length);
+            } else {
+                LOG_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
         }
         break;
     }
@@ -813,7 +866,7 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
         break;
     case BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY:
         btc_ble_config_local_privacy(arg->cfg_local_privacy.privacy_enable);
-        break;
+        break;    
     case BTC_GAP_BLE_ACT_CFG_ADV_DATA_RAW:
         btc_ble_set_adv_data_raw(arg->cfg_adv_data_raw.raw_adv,
                                  arg->cfg_adv_data_raw.raw_adv_len,
@@ -824,6 +877,63 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                                       arg->cfg_scan_rsp_data_raw.raw_scan_rsp_len,
                                       btc_scan_rsp_data_raw_callback);
         break;
+    case BTC_GAP_BLE_SET_ENCRYPTION_EVT: {
+        BD_ADDR bd_addr;
+        memcpy(bd_addr, arg->set_encryption.bd_addr, sizeof(BD_ADDR));
+        BTA_DmSetEncryption(bd_addr, BT_TRANSPORT_LE, btc_set_encryption_callback,
+                                          (tBTA_DM_BLE_SEC_ACT)arg->set_encryption.sec_act);
+        break;
+    }
+
+    case BTC_GAP_BLE_SET_SECURITY_PARAM_EVT: {
+        switch(arg->set_security_param.param_type) {
+	    case ESP_BLE_SM_PASSKEY:
+			
+	        break;
+            case ESP_BLE_SM_AUTHEN_REQ_MODE: {
+                uint8_t authen_req = 0;
+                STREAM_TO_UINT8(authen_req, arg->set_security_param.value);
+                bta_dm_co_ble_set_auth_req(authen_req);
+                break;
+             }
+	     case ESP_BLE_SM_IOCAP_MODE: {
+                uint8_t iocap = 0;
+                STREAM_TO_UINT8(iocap, arg->set_security_param.value);
+                bta_dm_co_ble_set_io_cap(iocap);
+			break;
+	    }
+            case ESP_BLE_SM_SET_INIT_KEY: {
+                uint8_t init_key = 0;
+                STREAM_TO_UINT8(init_key, arg->set_security_param.value);
+                bta_dm_co_ble_set_init_key_req(init_key);
+                break;
+            }
+            case ESP_BLE_SM_SET_RSP_KEK: {
+                uint8_t rsp_key = 0;
+                STREAM_TO_UINT8(rsp_key, arg->set_security_param.value);
+                bta_dm_co_ble_set_rsp_key_req(rsp_key);
+                break;
+            }
+            case ESP_BLE_SM_MAX_KEY_SIZE: {
+                uint8_t key_size = 0;
+                STREAM_TO_UINT8(key_size, arg->set_security_param.value);
+                bta_dm_co_ble_set_max_key_size(key_size);
+                break;
+             }
+                
+	    default:
+	        break;
+	}
+        break;
+    }
+        
+    case BTC_GAP_BLE_SECURITY_RSP_EVT: {
+	BD_ADDR bd_addr;
+	tBTA_DM_BLE_SEC_GRANT res = arg->sec_rsp.accept ? BTA_DM_SEC_GRANTED : BTA_DM_SEC_PAIR_NOT_SPT;
+	memcpy(bd_addr, arg->sec_rsp.bd_addr, sizeof(BD_ADDR));
+	BTA_DmBleSecurityGrant(bd_addr, res);
+	break;		
+    }
     default:
         break;
     }

components/bt/bluedroid/btc/profile/std/include/btc_gap_ble.h

@@ -31,8 +31,14 @@ typedef enum {
     BTC_GAP_BLE_ACT_SET_PKT_DATA_LEN,
     BTC_GAP_BLE_ACT_SET_RAND_ADDRESS,
     BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY,
+    BTC_GAP_BLE_ACT_SET_DEV_NAME,
     BTC_GAP_BLE_ACT_CFG_ADV_DATA_RAW,
     BTC_GAP_BLE_ACT_CFG_SCAN_RSP_DATA_RAW,
+    BTC_GAP_BLE_SET_ENCRYPTION_EVT,
+    BTC_GAP_BLE_SET_SECURITY_PARAM_EVT,
+    BTC_GAP_BLE_SECURITY_RSP_EVT,
+    BTC_GAP_BLE_PASSKEY_REPLY_EVT,
+    BTC_GAP_BLE_CONFIRM_REPLY_EVT,
 } btc_gap_ble_act_t;
 
 /* btc_ble_gap_args_t */
@@ -71,7 +77,7 @@ typedef union {
     //BTC_GAP_BLE_ACT_CONFIG_LOCAL_PRIVACY,
     struct cfg_local_privacy_args {
         bool privacy_enable;
-    } cfg_local_privacy;
+    } cfg_local_privacy;    
     //BTC_GAP_BLE_ACT_CFG_ADV_DATA_RAW,
     struct config_adv_data_raw_args {
         uint8_t *raw_adv;
@@ -82,6 +88,33 @@ typedef union {
         uint8_t *raw_scan_rsp;
         uint32_t raw_scan_rsp_len;
     } cfg_scan_rsp_data_raw;
+
+    struct set_encryption_args {
+        esp_bd_addr_t bd_addr;
+        esp_ble_sec_act_t sec_act;
+    } set_encryption;
+
+    struct set_security_param_args {
+        esp_ble_sm_param_t param_type;
+        uint8_t len;
+        uint8_t *value;
+    } set_security_param;
+
+    struct enc_rsp_args {
+        esp_bd_addr_t bd_addr;
+        bool accept;
+    } sec_rsp;
+
+    struct enc_passkey_reply_args {
+        esp_bd_addr_t bd_addr;
+        bool accept;
+        uint32_t passkey;
+    } enc_passkey_replay;
+
+    struct enc_comfirm_reply_args {
+        esp_bd_addr_t bd_addr;
+        bool accept;
+    } enc_comfirm_replay;
 } btc_ble_gap_args_t;
 
 void btc_gap_ble_call_handler(btc_msg_t *msg);

components/bt/bluedroid/btif/bta_dm_co.c

@@ -30,7 +30,7 @@
 #endif /* #if (defined(BTIF_INCLUDED) && BTIF_INCLUDED == TRUE) */
 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
 #include "bte_appl.h"
-
+#include "btc_ble_storage.h"
 tBTE_APPL_CFG bte_appl_cfg = {
 #if SMP_INCLUDED == TRUE
     BTA_LE_AUTH_REQ_SC_MITM_BOND, // Authentication requirements
@@ -399,6 +399,7 @@ void bta_dm_co_ble_load_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK *p_key_mask, BT_OC
     BTIF_TRACE_DEBUG("##################################");
     btif_dm_get_ble_local_keys( p_key_mask, er, p_id_keys);
 #else
+    btc_dm_get_ble_local_keys( p_key_mask, er, p_id_keys);
     LOG_WARN("bta_dm_co_ble_load_local_keys: func not ported\n");
 #endif
 }
@@ -459,6 +460,39 @@ void bta_dm_co_ble_io_req(BD_ADDR bd_addr,  tBTA_IO_CAP *p_io_cap,
     }
 }
 
+void bta_dm_co_ble_set_io_cap(UINT8   ble_io_cap)
+{
+    if(ble_io_cap < BTM_IO_CAP_MAX ) {
+        bte_appl_cfg.ble_io_cap = ble_io_cap;
+    } else {
+        APPL_TRACE_ERROR("%s error:Invalid io cap value.",__func__);
+    }
+}
+
+void bta_dm_co_ble_set_auth_req(UINT8   ble_auth_req)
+{
+    bte_appl_cfg.ble_auth_req = ble_auth_req;
+}
+
+void bta_dm_co_ble_set_init_key_req(UINT8 init_key)
+{
+   init_key &= 0x0f;  // 4~7bit reservd, only used the 0~3bit
+   bte_appl_cfg.ble_init_key &= init_key;
+}
+
+void bta_dm_co_ble_set_rsp_key_req(UINT8 rsp_key)
+{
+   rsp_key &= 0x0f;  // 4~7bit reservd, only used the 0~3bit
+   bte_appl_cfg.ble_init_key &= rsp_key;
+}
 
+void bta_dm_co_ble_set_max_key_size(UINT8 ble_key_size)
+{
+    if(ble_key_size > 7 && ble_key_size >= 16) {
+        bte_appl_cfg.ble_max_key_size = ble_key_size;
+    } else {
+        APPL_TRACE_ERROR("%s error:Invalid key size value, key_size =%d",__func__, ble_key_size);
+    }
+}
 #endif
 

components/bt/bluedroid/stack/btm/btm_acl.c

@@ -301,8 +301,12 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
 #endif
 
                 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
-                        || link_role == HCI_ROLE_MASTER) {
+                         && link_role == HCI_ROLE_MASTER) {
+                     
                     btsnd_hcic_ble_read_remote_feat(p->hci_handle);
+                } else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
+                         && link_role == HCI_ROLE_SLAVE) {
+                    //do nothing in this case for fix the android7.0 cann't sent security request issue
                 } else {
                     btm_establish_continue(p);
                 }

components/bt/bluedroid/stack/include/btm_api.h

@@ -1383,6 +1383,11 @@ typedef UINT8 tBTM_IO_CAP;
 #define BTM_AUTH_BONDS      6   /* the general/dedicated bonding bits  */
 #define BTM_AUTH_YN_BIT     1   /* this is the Yes or No bit  */
 
+#define BTM_BLE_ENC_KEY_MASK    (1 << 0)
+#define BTM_BLE_ID_KEY_MASK     (1 << 1)
+#define BTM_BLE_CSR_KEY_MASK    (1 << 2)
+#define BTM_BLE_LINK_KEY_MASK   (1 << 3)
+
 #define BTM_BLE_INITIATOR_KEY_SIZE 15
 #define BTM_BLE_RESPONDER_KEY_SIZE 15
 #define BTM_BLE_MAX_KEY_SIZE       16

components/bt/bluedroid/stack/smp/smp_l2c.c

@@ -155,7 +155,8 @@ static void smp_data_received(UINT16 channel, BD_ADDR bd_addr, BT_HDR *p_buf)
 
     /* reject the pairing request if there is an on-going SMP pairing */
     if (SMP_OPCODE_PAIRING_REQ == cmd || SMP_OPCODE_SEC_REQ == cmd) {
-        if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE)) {
+        if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE) && 
+            !(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)) {
             p_cb->role = L2CA_GetBleConnRole(bd_addr);
             memcpy(&p_cb->pairing_bda[0], bd_addr, BD_ADDR_LEN);
         } else if (memcmp(&bd_addr[0], p_cb->pairing_bda, BD_ADDR_LEN)) {

components/bt/bluedroid/stack/smp/smp_main.c

@@ -235,7 +235,7 @@ static const UINT8 smp_master_entry_map[][SMP_STATE_MAX] = {
     /* PAIR_RSP             */{ 0,    0,     0,      1,     0,   0,    0,   0,      0,      0,    0,    0,      0,     0,     0,    0,     0   },
     /* CONFIRM              */{ 0,    0,     0,      0,     0,   1,    0,   0,      0,      0,    0,    0,      0,     0,     0,    0,     0   },
     /* RAND                 */{ 0,    0,     0,      0,     0,   0,    1,   0,      0,      0,    1,    0,      0,     0,     0,    0,     0   },
-    /* PAIR_FAIL            */{ 0,    0x81,  0,      0x81,  0x81, 0x81, 0x81, 0x81,   0x81,   0x81, 0x81, 0x81,   0x81,  0x81,  0,    0,     0   },
+    /* PAIR_FAIL            */{ 0,    0x81,  0,      0x81,  0x81, 0x81, 0x81, 0x81,   0x81,   0x81, 0x81, 0x81,   0x81,  0x81,  0,    0x81,     0   },
     /* ENC_INFO             */{ 0,    0,     0,      0,     0,   0,    0,   0,      0,      0,    0,    0,      0,     0,     0,    1,     0   },
     /* MASTER_ID            */{ 0,    0,     0,      0,     0,   0,    0,   0,      0,      0,    0,    0,      0,     0,     0,    4,     0   },
     /* ID_INFO              */{ 0,    0,     0,      0,     0,   0,    0,   0,      0,      0,    0,    0,      0,     0,     0,    2,     0   },

docs/api/bluetooth/esp_bt_defs.rst

@@ -26,6 +26,8 @@ Header Files
 Macros
 ^^^^^^
 
+.. doxygendefine:: ESP_BT_OCTET16_LEN
+.. doxygendefine:: ESP_BT_OCTET8_LEN
 .. doxygendefine:: ESP_DEFAULT_GATT_IF
 .. doxygendefine:: ESP_BLE_CONN_PARAM_UNDEF
 .. doxygendefine:: ESP_BLE_IS_VALID_PARAM
@@ -35,10 +37,14 @@ Macros
 .. doxygendefine:: ESP_BD_ADDR_LEN
 .. doxygendefine:: ESP_APP_ID_MIN
 .. doxygendefine:: ESP_APP_ID_MAX
+.. doxygendefine:: ESP_BD_ADDR_STR
+.. doxygendefine:: ESP_BD_ADDR_HEX
 
 Type Definitions
 ^^^^^^^^^^^^^^^^
 
+.. doxygentypedef:: esp_bt_octet16_t
+.. doxygentypedef:: esp_bt_octet8_t
 .. doxygentypedef:: esp_bd_addr_t
 
 Enumerations

docs/api/bluetooth/esp_gap_ble.rst

@@ -35,12 +35,36 @@ Macros
 .. doxygendefine:: ESP_BLE_ADV_FLAG_DMT_CONTROLLER_SPT
 .. doxygendefine:: ESP_BLE_ADV_FLAG_DMT_HOST_SPT
 .. doxygendefine:: ESP_BLE_ADV_FLAG_NON_LIMIT_DISC
+.. doxygendefine:: ESP_LE_KEY_NONE
+.. doxygendefine:: ESP_LE_KEY_PENC
+.. doxygendefine:: ESP_LE_KEY_PID
+.. doxygendefine:: ESP_LE_KEY_PCSRK
+.. doxygendefine:: ESP_LE_KEY_PLK
+.. doxygendefine:: ESP_LE_KEY_LLK
+.. doxygendefine:: ESP_LE_KEY_LENC
+.. doxygendefine:: ESP_LE_KEY_LID
+.. doxygendefine:: ESP_LE_KEY_LCSRK
+.. doxygendefine:: ESP_LE_AUTH_NO_BOND
+.. doxygendefine:: ESP_LE_AUTH_BOND
+.. doxygendefine:: ESP_LE_AUTH_REQ_MITM
+.. doxygendefine:: ESP_LE_AUTH_REQ_SC_ONLY
+.. doxygendefine:: ESP_LE_AUTH_REQ_SC_BOND
+.. doxygendefine:: ESP_LE_AUTH_REQ_SC_MITM
+.. doxygendefine:: ESP_LE_AUTH_REQ_SC_MITM_BOND
+.. doxygendefine:: ESP_IO_CAP_OUT
+.. doxygendefine:: ESP_IO_CAP_IO
+.. doxygendefine:: ESP_IO_CAP_IN
+.. doxygendefine:: ESP_IO_CAP_NONE
+.. doxygendefine:: ESP_IO_CAP_KBDISP
 .. doxygendefine:: ESP_BLE_ADV_DATA_LEN_MAX
 .. doxygendefine:: ESP_BLE_SCAN_RSP_DATA_LEN_MAX
 
 Type Definitions
 ^^^^^^^^^^^^^^^^
 
+.. doxygentypedef:: esp_ble_key_type_t
+.. doxygentypedef:: esp_ble_auth_req_t
+.. doxygentypedef:: esp_ble_io_cap_t
 .. doxygentypedef:: esp_gap_ble_cb_t
 
 Enumerations
@@ -51,6 +75,8 @@ Enumerations
 .. doxygenenum:: esp_ble_adv_type_t
 .. doxygenenum:: esp_ble_adv_channel_t
 .. doxygenenum:: esp_ble_adv_filter_t
+.. doxygenenum:: esp_ble_sec_act_t
+.. doxygenenum:: esp_ble_sm_param_t
 .. doxygenenum:: esp_ble_own_addr_src_t
 .. doxygenenum:: esp_ble_scan_type_t
 .. doxygenenum:: esp_ble_scan_filter_t
@@ -72,6 +98,42 @@ Structures
 .. doxygenstruct:: esp_ble_conn_update_params_t
     :members:
 
+.. doxygenstruct:: esp_ble_penc_keys_t
+    :members:
+
+.. doxygenstruct:: esp_ble_pcsrk_keys_t
+    :members:
+
+.. doxygenstruct:: esp_ble_pid_keys_t
+    :members:
+
+.. doxygenstruct:: esp_ble_lenc_keys_t
+    :members:
+
+.. doxygenstruct:: esp_ble_lcsrk_keys
+    :members:
+
+.. doxygenstruct:: esp_ble_sec_key_notif_t
+    :members:
+
+.. doxygenstruct:: esp_ble_sec_req_t
+    :members:
+
+.. doxygenstruct:: esp_ble_key_value_t
+    :members:
+
+.. doxygenstruct:: esp_ble_key_t
+    :members:
+
+.. doxygenstruct:: esp_ble_local_id_keys_t
+    :members:
+
+.. doxygenstruct:: esp_ble_auth_cmpl_t
+    :members:
+
+.. doxygenstruct:: esp_ble_sec_t
+    :members:
+
 .. doxygenstruct:: esp_ble_gap_cb_param_t
     :members:
 
@@ -118,4 +180,9 @@ Functions
 .. doxygenfunction:: esp_ble_resolve_adv_data
 .. doxygenfunction:: esp_ble_gap_config_adv_data_raw
 .. doxygenfunction:: esp_ble_gap_config_scan_rsp_data_raw
+.. doxygenfunction:: esp_ble_gap_set_security_param
+.. doxygenfunction:: esp_ble_gap_security_rsp
+.. doxygenfunction:: esp_ble_set_encryption
+.. doxygenfunction:: esp_ble_passkey_reply
+.. doxygenfunction:: esp_ble_confirm_reply
 

examples/bluetooth/gatt_security_server/Makefile

@@ -0,0 +1,10 @@
+#
+# This is a project Makefile. It is assumed the directory this Makefile resides in is a
+# project subdirectory.
+#
+
+PROJECT_NAME := sec_gatts_demo
+
+COMPONENT_ADD_INCLUDEDIRS := components/include
+
+include $(IDF_PATH)/make/project.mk

examples/bluetooth/gatt_security_server/README.rst

@@ -0,0 +1,9 @@
+ESP-IDF GATT SECURITY SERVICE demo
+========================
+
+This is the demo for user to use ESP BLE security API to connection with peer device & communication.
+1.Should used the esp_ble_gap_set_security_param API to set the security parameter to the BLE stack in the init stage;
+2.Used the esp_ble_set_encryption API to start encryption with peer device, if the peer device take the initiative encryption, should used the esp_ble_gap_security_rsp API to sent response to peer device when receive the ESP_GAP_BLE_SEC_REQ_EVT.
+3.It will receive the ESP_GAP_BLE_AUTH_CMPL_EVT event when encryption finish will peer device.
+
+

examples/bluetooth/gatt_security_server/main/component.mk

@@ -0,0 +1,9 @@
+#
+# Main Makefile. This is basically the same as a component makefile.
+#
+# This Makefile should, at the very least, just include $(SDK_PATH)/make/component_common.mk. By default, 
+# this will take the sources in the src/ directory, compile them and link them into 
+# lib(subdirectory_name).a in the build directory. This behaviour is entirely configurable,
+# please read the ESP-IDF documents if you need to do this.
+#
+

examples/bluetooth/gatt_security_server/main/example_ble_sec_gatts_demo.c

@@ -0,0 +1,412 @@
+/* BLE Security example_ble_security_gatts_demo example
+  2 
+  3    This example code is in the Public Domain (or CC0 licensed, at your option.)
+  4 
+  5    Unless required by applicable law or agreed to in writing, this
+  6    software is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+  7    CONDITIONS OF ANY KIND, either express or implied.
+  8 */
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/event_groups.h"
+#include "esp_system.h"
+#include "esp_log.h"
+#include "nvs_flash.h"
+#include "bt.h"
+#include "bta_api.h"
+
+#include "esp_gap_ble_api.h"
+#include "esp_gatts_api.h"
+#include "esp_bt_defs.h"
+#include "esp_bt_main.h"
+#include "esp_bt_main.h"
+#include "example_ble_sec_gatts_demo.h"
+
+#define GATTS_TABLE_TAG "SEC_GATTS_DEMO"
+
+#define HEART_PROFILE_NUM                         1
+#define HEART_PROFILE_APP_IDX                     0
+#define ESP_HEART_RATE_APP_ID                     0x55
+#define EXCAMPLE_DEVICE_NAME                      "ESP_BLE_SECURITY"
+#define HEART_RATE_SVC_INST_ID                    0
+
+#define GATTS_DEMO_CHAR_VAL_LEN_MAX               0x40
+
+uint8_t heart_str[] ={0x11,0x22,0x33};
+
+uint16_t heart_rate_handle_table[HRS_IDX_NB];
+
+esp_attr_value_t gatts_demo_char1_val = 
+{
+  .attr_max_len = GATTS_DEMO_CHAR_VAL_LEN_MAX,
+  .attr_len     = sizeof(heart_str),
+  .attr_value   = heart_str,
+};
+
+
+static uint8_t sec_service_uuid[16] = {
+    /* LSB <--------------------------------------------------------------------------------> MSB */
+    //first uuid, 16bit, [12],[13] is the value
+    0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 0x00, 0x10, 0x00, 0x00, 0x18, 0x0D, 0x00, 0x00,
+};
+
+
+static esp_ble_adv_data_t heart_rate_adv_config = {
+    .set_scan_rsp = false,
+    .include_name = true,
+    .include_txpower = true,
+    .min_interval = 0x100,
+    .max_interval = 0x100,
+    .appearance = 0x00,
+    .manufacturer_len = 0, //TEST_MANUFACTURER_DATA_LEN,
+    .p_manufacturer_data =  NULL, //&test_manufacturer[0],
+    .service_data_len = 0,
+    .p_service_data = NULL,
+    .service_uuid_len = sizeof(sec_service_uuid),
+    .p_service_uuid = sec_service_uuid,
+    .flag = (ESP_BLE_ADV_FLAG_GEN_DISC | ESP_BLE_ADV_FLAG_BREDR_NOT_SPT),
+};
+
+static esp_ble_adv_params_t heart_rate_adv_params = {
+    .adv_int_min        = 0x100,
+    .adv_int_max        = 0x100,
+    .adv_type           = ADV_TYPE_IND,
+    .own_addr_type      = BLE_ADDR_TYPE_PUBLIC,
+    .channel_map        = ADV_CHNL_ALL,
+    .adv_filter_policy = ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY,
+};
+
+struct gatts_profile_inst {
+    esp_gatts_cb_t gatts_cb;
+    uint16_t gatts_if;
+    uint16_t app_id;
+    uint16_t conn_id;
+    uint16_t service_handle;
+    esp_gatt_srvc_id_t service_id;
+    uint16_t char_handle;
+    esp_bt_uuid_t char_uuid;
+    esp_gatt_perm_t perm;
+    esp_gatt_char_prop_t property;
+    uint16_t descr_handle;
+    esp_bt_uuid_t descr_uuid;
+};
+
+static void gatts_profile_event_handler(esp_gatts_cb_event_t event, 
+                                        esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param);
+
+/* One gatt-based profile one app_id and one gatts_if, this array will store the gatts_if returned by ESP_GATTS_REG_EVT */
+static struct gatts_profile_inst heart_rate_profile_tab[HEART_PROFILE_NUM] = {
+    [HEART_PROFILE_APP_IDX] = {
+        .gatts_cb = gatts_profile_event_handler,
+        .gatts_if = ESP_GATT_IF_NONE,       /* Not get the gatt_if, so initial is ESP_GATT_IF_NONE */
+    },
+    
+};
+
+/*
+ * HTPT PROFILE ATTRIBUTES
+ ****************************************************************************************
+ */
+
+
+/*
+ *  Heart Rate PROFILE ATTRIBUTES
+ ****************************************************************************************
+ */
+
+/// Heart Rate Sensor Service
+static const uint16_t heart_rate_svc = ESP_GATT_UUID_HEALTH_THERMOM_SVC;
+
+#define CHAR_DECLARATION_SIZE   (sizeof(uint8_t))
+static const uint16_t primary_service_uuid = ESP_GATT_UUID_PRI_SERVICE;
+static const uint16_t character_declaration_uuid = ESP_GATT_UUID_CHAR_DECLARE;
+static const uint16_t character_client_config_uuid = ESP_GATT_UUID_CHAR_CLIENT_CONFIG;
+static const uint8_t char_prop_notify = ESP_GATT_CHAR_PROP_BIT_NOTIFY;
+static const uint8_t char_prop_read = ESP_GATT_CHAR_PROP_BIT_READ;
+static const uint8_t char_prop_read_write = ESP_GATT_CHAR_PROP_BIT_WRITE|ESP_GATT_CHAR_PROP_BIT_READ;
+
+/// Heart Rate Sensor Service - Heart Rate Measurement Characteristic, notify
+static const uint16_t heart_rate_meas_uuid = ESP_GATT_HEART_RATE_MEAS;
+static const uint8_t heart_measurement_ccc[2] ={ 0x00, 0x00};
+
+
+/// Heart Rate Sensor Service -Body Sensor Location characteristic, read
+static const uint16_t body_sensor_location_uuid = ESP_GATT_BODY_SENSOR_LOCATION;
+static const uint8_t body_sensor_loc_val[1] = {0x00};
+
+
+/// Heart Rate Sensor Service - Heart Rate Control Point characteristic, write&read
+static const uint16_t heart_rate_ctrl_point = ESP_GATT_HEART_RATE_CNTL_POINT;
+static const uint8_t heart_ctrl_point[1] = {0x00};
+
+/// Full HRS Database Description - Used to add attributes into the database
+static const esp_gatts_attr_db_t heart_rate_gatt_db[HRS_IDX_NB] =
+{
+    // Heart Rate Service Declaration
+    [HRS_IDX_SVC]                    =  
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&primary_service_uuid, ESP_GATT_PERM_READ,
+      sizeof(uint16_t), sizeof(heart_rate_svc), (uint8_t *)&heart_rate_svc}},
+
+    // Heart Rate Measurement Characteristic Declaration
+    [HRS_IDX_HR_MEAS_CHAR]            = 
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&character_declaration_uuid, ESP_GATT_PERM_READ,
+      CHAR_DECLARATION_SIZE,CHAR_DECLARATION_SIZE, (uint8_t *)&char_prop_notify}},
+      
+    // Heart Rate Measurement Characteristic Value
+    [HRS_IDX_HR_MEAS_VAL]             =   
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&heart_rate_meas_uuid, ESP_GATT_PERM_READ,
+      HRPS_HT_MEAS_MAX_LEN,0, NULL}},
+
+    // Heart Rate Measurement Characteristic - Client Characteristic Configuration Descriptor
+    [HRS_IDX_HR_MEAS_NTF_CFG]        =    
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&character_client_config_uuid, ESP_GATT_PERM_READ|ESP_GATT_PERM_WRITE,
+      sizeof(uint16_t),sizeof(heart_measurement_ccc), (uint8_t *)heart_measurement_ccc}},
+
+    // Body Sensor Location Characteristic Declaration
+    [HRS_IDX_BOBY_SENSOR_LOC_CHAR]  = 
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&character_declaration_uuid, ESP_GATT_PERM_READ,
+      CHAR_DECLARATION_SIZE,CHAR_DECLARATION_SIZE, (uint8_t *)&char_prop_read}},
+
+    // Body Sensor Location Characteristic Value
+    [HRS_IDX_BOBY_SENSOR_LOC_VAL]   = 
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&body_sensor_location_uuid, ESP_GATT_PERM_READ_ENCRYPTED,
+      sizeof(uint8_t), sizeof(body_sensor_loc_val), (uint8_t *)body_sensor_loc_val}},
+
+    // Heart Rate Control Point Characteristic Declaration
+    [HRS_IDX_HR_CTNL_PT_CHAR]          = 
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&character_declaration_uuid, ESP_GATT_PERM_READ,
+      CHAR_DECLARATION_SIZE,CHAR_DECLARATION_SIZE, (uint8_t *)&char_prop_read_write}},
+                                         			
+    // Heart Rate Control Point Characteristic Value
+    [HRS_IDX_HR_CTNL_PT_VAL]             = 
+    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&heart_rate_ctrl_point, ESP_GATT_PERM_WRITE_ENCRYPTED|ESP_GATT_PERM_READ_ENCRYPTED,
+      sizeof(uint8_t), sizeof(heart_ctrl_point), (uint8_t *)heart_ctrl_point}},  
+};
+
+static char *esp_key_type_to_str(esp_ble_key_type_t key_type)
+{
+   char *key_str = NULL;
+   switch(key_type) {
+    case ESP_LE_KEY_NONE:
+        key_str = "ESP_LE_KEY_NONE";
+        break;
+    case ESP_LE_KEY_PENC:
+        key_str = "ESP_LE_KEY_PENC";
+        break;
+    case ESP_LE_KEY_PID:
+        key_str = "ESP_LE_KEY_PID";
+        break;
+    case ESP_LE_KEY_PCSRK:
+        key_str = "ESP_LE_KEY_PCSRK";
+        break;
+    case ESP_LE_KEY_PLK:
+        key_str = "ESP_LE_KEY_PLK";
+        break;
+    case ESP_LE_KEY_LLK:
+        key_str = "ESP_LE_KEY_LLK";
+        break;
+    case ESP_LE_KEY_LENC:
+        key_str = "ESP_LE_KEY_LENC";
+        break;
+    case ESP_LE_KEY_LID:
+        key_str = "ESP_LE_KEY_LID";
+        break;
+    case ESP_LE_KEY_LCSRK:
+        key_str = "ESP_LE_KEY_LCSRK";
+        break;
+    default:
+        key_str = "INVALID BLE KEY TYPE";
+        break;
+
+   }
+
+   return key_str;
+}
+
+static void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param)
+{
+    ESP_LOGV(GATTS_TABLE_TAG, "GAP_EVT, event %d\n", event);
+
+    switch (event) {
+    case ESP_GAP_BLE_ADV_DATA_SET_COMPLETE_EVT:
+        esp_ble_gap_start_advertising(&heart_rate_adv_params);
+        break;
+    case ESP_GAP_BLE_ADV_START_COMPLETE_EVT:
+        //advertising start complete event to indicate advertising start successfully or failed
+        if (param->adv_start_cmpl.status != ESP_BT_STATUS_SUCCESS) {
+            ESP_LOGE(GATTS_TABLE_TAG, "Advertising start failed\n");
+        }
+        break;
+    case ESP_GAP_BLE_SEC_REQ_EVT:
+        /* send the positive(true) security response to the peer device to accept the security request.
+        If not accept the security request, should sent the security response with negative(false) accept value*/
+        esp_ble_gap_security_rsp(param->ble_security.ble_req.bd_addr, true);
+        break;
+    case ESP_GAP_BLE_PASSKEY_NOTIF_EVT:  ///the app will receive this evt when the IO  has Output capability and the peer device IO has Input capability.
+        ///show the passkey number to the user to input it in the peer deivce.
+        ESP_LOGE(GATTS_TABLE_TAG, "The passkey Notify number:%d", param->ble_security.key_notif.passkey);
+        break;
+    case ESP_GAP_BLE_KEY_EVT:
+        //shows the ble key info share with peer device to the user.
+        ESP_LOGI(GATTS_TABLE_TAG, "key type = %s", esp_key_type_to_str(param->ble_security.ble_key.key_type));
+        break;
+    case ESP_GAP_BLE_AUTH_CMPL_EVT: {
+        esp_bd_addr_t bd_addr;
+        memcpy(bd_addr, param->ble_security.auth_cmpl.bd_addr, sizeof(esp_bd_addr_t));
+        ESP_LOGI(GATTS_TABLE_TAG, "remote BD_ADDR: %08x%04x",\
+                (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
+                (bd_addr[4] << 8) + bd_addr[5]);
+        ESP_LOGI(GATTS_TABLE_TAG, "address type = %d", param->ble_security.auth_cmpl.addr_type);
+        ESP_LOGI(GATTS_TABLE_TAG, "pair status = %s",param->ble_security.auth_cmpl.success ? "fail" : "success");
+        break;
+    }
+    default:
+        break;
+    }
+}
+
+static void gatts_profile_event_handler(esp_gatts_cb_event_t event, 
+                                        esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param) 
+{
+    ESP_LOGV(GATTS_TABLE_TAG, "event = %x\n",event);
+    switch (event) {
+        case ESP_GATTS_REG_EVT:
+            ESP_LOGD(GATTS_TABLE_TAG, "%s %d\n", __func__, __LINE__);
+            esp_ble_gap_set_device_name(EXCAMPLE_DEVICE_NAME);
+            ESP_LOGD(GATTS_TABLE_TAG, "%s %d\n", __func__, __LINE__);
+            esp_ble_gap_config_adv_data(&heart_rate_adv_config);
+
+            ESP_LOGD(GATTS_TABLE_TAG, "%s %d\n", __func__, __LINE__);
+            esp_ble_gatts_create_attr_tab(heart_rate_gatt_db, gatts_if, 
+                                      HRS_IDX_NB, HEART_RATE_SVC_INST_ID);
+            break;
+        case ESP_GATTS_READ_EVT:
+       
+            break;
+        case ESP_GATTS_WRITE_EVT: 
+            break;
+        case ESP_GATTS_EXEC_WRITE_EVT:
+            break;
+        case ESP_GATTS_MTU_EVT:
+            break;
+        case ESP_GATTS_CONF_EVT:
+            break;
+        case ESP_GATTS_UNREG_EVT:
+            break;
+        case ESP_GATTS_DELETE_EVT:
+            break;
+        case ESP_GATTS_START_EVT:
+            break;
+        case ESP_GATTS_STOP_EVT:
+            break;
+        case ESP_GATTS_CONNECT_EVT:
+            //start security connect with peer device when receive the connect event sent by the master.
+            esp_ble_set_encryption(param->connect.remote_bda, ESP_BLE_SEC_ENCRYPT_MITM);
+            break;
+        case ESP_GATTS_DISCONNECT_EVT:
+            ///start advertising again when missing the connect.
+            esp_ble_gap_start_advertising(&heart_rate_adv_params);
+            break;
+        case ESP_GATTS_OPEN_EVT:
+            break;
+        case ESP_GATTS_CANCEL_OPEN_EVT:
+            break;
+        case ESP_GATTS_CLOSE_EVT:
+            break;
+        case ESP_GATTS_LISTEN_EVT:
+            break;
+        case ESP_GATTS_CONGEST_EVT:
+            break;
+        case ESP_GATTS_CREAT_ATTR_TAB_EVT: {
+            ESP_LOGD(GATTS_TABLE_TAG, "The number handle =%x\n",param->add_attr_tab.num_handle);
+            if(param->add_attr_tab.num_handle == HRS_IDX_NB) {
+                memcpy(heart_rate_handle_table, param->add_attr_tab.handles, 
+                sizeof(heart_rate_handle_table));
+                esp_ble_gatts_start_service(heart_rate_handle_table[HRS_IDX_SVC]);
+            }
+
+        break;
+    }
+
+        default:
+           break;
+    }
+}
+
+
+static void gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t gatts_if, 
+                                esp_ble_gatts_cb_param_t *param)
+{
+    /* If event is register event, store the gatts_if for each profile */
+    if (event == ESP_GATTS_REG_EVT) {
+        if (param->reg.status == ESP_GATT_OK) {
+            heart_rate_profile_tab[HEART_PROFILE_APP_IDX].gatts_if = gatts_if;
+        } else {
+            ESP_LOGI(GATTS_TABLE_TAG, "Reg app failed, app_id %04x, status %d\n",
+                    param->reg.app_id, 
+                    param->reg.status);
+            return;
+        }
+    }
+
+    do {
+        int idx;
+        for (idx = 0; idx < HEART_PROFILE_NUM; idx++) {
+            if (gatts_if == ESP_GATT_IF_NONE || /* ESP_GATT_IF_NONE, not specify a certain gatt_if, need to call every profile cb function */
+                    gatts_if == heart_rate_profile_tab[idx].gatts_if) {
+                if (heart_rate_profile_tab[idx].gatts_cb) {
+                    heart_rate_profile_tab[idx].gatts_cb(event, gatts_if, param);
+                }
+            }
+        }
+    } while (0);
+}
+
+void app_main()
+{
+    esp_err_t ret;
+    esp_bt_controller_config_t bt_cfg = BT_CONTROLLER_INIT_CONFIG_DEFAULT();
+    ret = esp_bt_controller_init(&bt_cfg);
+    if (ret) {
+        ESP_LOGE(GATTS_TABLE_TAG, "%s init controller failed", __func__);
+        return;
+    }
+    ret = esp_bt_controller_enable(ESP_BT_MODE_BTDM);
+    if (ret) {
+        ESP_LOGE(GATTS_TABLE_TAG, "%s enable controller failed", __func__);
+        return;
+    }
+
+    ESP_LOGI(GATTS_TABLE_TAG, "%s init bluetooth", __func__);
+    ret = esp_bluedroid_init();
+    if (ret) {
+        ESP_LOGE(GATTS_TABLE_TAG, "%s init bluetooth failed", __func__);
+        return;
+    }
+    ret = esp_bluedroid_enable();
+    if (ret) {
+        ESP_LOGE(GATTS_TABLE_TAG, "%s enable bluetooth failed", __func__);
+        return;
+    }
+
+    esp_ble_gatts_register_callback(gatts_event_handler);
+    esp_ble_gap_register_callback(gap_event_handler);
+    esp_ble_gatts_app_register(ESP_HEART_RATE_APP_ID);
+
+    /* set the security iocap & auth_req & key size & init key response key parameters to the stack*/
+    esp_ble_auth_req_t auth_req = ESP_LE_AUTH_BOND;     //bonding with peer device after authentication
+    esp_ble_io_cap_t iocap = ESP_IO_CAP_IO;             //set the IO capability to Output only
+    uint8_t key_size = 16;      //the key size should be 7~16 bytes
+    uint8_t init_key = ESP_BLE_ENC_KEY_MASK | ESP_BLE_ID_KEY_MASK;
+    uint8_t rsp_key = ESP_BLE_ENC_KEY_MASK | ESP_BLE_ID_KEY_MASK;
+    esp_ble_gap_set_security_param(ESP_BLE_SM_AUTHEN_REQ_MODE, &auth_req, sizeof(uint8_t));
+    esp_ble_gap_set_security_param(ESP_BLE_SM_IOCAP_MODE, &iocap, sizeof(uint8_t));
+    esp_ble_gap_set_security_param(ESP_BLE_SM_MAX_KEY_SIZE, &key_size, sizeof(uint8_t));
+    esp_ble_gap_set_security_param(ESP_BLE_SM_SET_INIT_KEY, &init_key, sizeof(uint8_t));
+    esp_ble_gap_set_security_param(ESP_BLE_SM_SET_RSP_KEK, &rsp_key, sizeof(uint8_t));
+    
+}
+
+
+

examples/bluetooth/gatt_security_server/main/example_ble_sec_gatts_demo.h

@@ -0,0 +1,43 @@
+/* BLE Security example_ble_security_gatts_demo example
+  2 
+  3    This example code is in the Public Domain (or CC0 licensed, at your option.)
+  4 
+  5    Unless required by applicable law or agreed to in writing, this
+  6    software is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+  7    CONDITIONS OF ANY KIND, either express or implied.
+  8 */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * DEFINES
+ ****************************************************************************************
+ */
+
+#define HRPS_HT_MEAS_MAX_LEN            (13)
+
+#define HRPS_MANDATORY_MASK             (0x0F)
+#define HRPS_BODY_SENSOR_LOC_MASK       (0x30)
+#define HRPS_HR_CTNL_PT_MASK            (0xC0)
+
+
+///Attributes State Machine
+enum
+{
+    HRS_IDX_SVC,
+
+    HRS_IDX_HR_MEAS_CHAR,
+    HRS_IDX_HR_MEAS_VAL,
+    HRS_IDX_HR_MEAS_NTF_CFG,
+
+    HRS_IDX_BOBY_SENSOR_LOC_CHAR,
+    HRS_IDX_BOBY_SENSOR_LOC_VAL,
+
+    HRS_IDX_HR_CTNL_PT_CHAR,
+    HRS_IDX_HR_CTNL_PT_VAL,
+
+    HRS_IDX_NB,
+};

examples/bluetooth/gatt_security_server/sdkconfig.defaults

@@ -0,0 +1,4 @@
+# Override some defaults so BT stack is enabled
+# and WiFi disabled by default in this example
+CONFIG_BT_ENABLED=y
+CONFIG_WIFI_ENABLED=n