Android TV Reference Remote
Check in SDK based on Telink 8278 chipset, solution provided
by Telink Semiconductor (Shanghai) Co., Ltd.

This source code drop contains the open source software. The libraries,
compiler toolchain and other binaries dependencies are hosted by Telink.

ATTENTION:

Please read the “readme” file in the root directory after downloading
this SDK for instructions on getting/setting up the tools, libraries,
and binaries necessary for building the SDK, and all the reference design files.

Software version: 1.46

v1.46 Library version

|       lib name        |          origin           |
| :-------------------: | :-----------------------: |
| libfirmware_encrypt.a |      ble SDK V3.4.2       |
|     liblt_827x.a      |      ble SDK V3.4.2       |
|     libapp_ota.a      | google BLE RCU SDK v3.4.2 |
| liblt_general_stack.a |      ble SDK v3.4.2       |

v1.46 Changes

  - Added OTA NEC IR table.
  - Ported new SDK (B85)
  - Added ZB flash support.
  - A new lib file liblt_general_stack.a starts being used
    with v1.46. Please download the lib file following
    instructions in the readme file.

BYPASS_INCLUSIVE_LANGUAGE_REASON=tech_terms.
No-Typo-Check: name in lib.

Change-Id: I52a4f2a4a4609bf87d606c38918e2ec6c00cf112
diff --git a/8271_ble_remote/application/app/subdir.mk b/8271_ble_remote/application/app/subdir.mk
index 4e192b4..fb11858 100644
--- a/8271_ble_remote/application/app/subdir.mk
+++ b/8271_ble_remote/application/app/subdir.mk
@@ -20,7 +20,7 @@
 application/app/%.o: ../application/app/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/application/audio/subdir.mk b/8271_ble_remote/application/audio/subdir.mk
index f216c14..092ac42 100644
--- a/8271_ble_remote/application/audio/subdir.mk
+++ b/8271_ble_remote/application/audio/subdir.mk
@@ -18,7 +18,7 @@
 application/audio/%.o: ../application/audio/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/application/keyboard/subdir.mk b/8271_ble_remote/application/keyboard/subdir.mk
index da22852..1d5d459 100644
--- a/8271_ble_remote/application/keyboard/subdir.mk
+++ b/8271_ble_remote/application/keyboard/subdir.mk
@@ -14,7 +14,7 @@
 application/keyboard/%.o: ../application/keyboard/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/application/print/subdir.mk b/8271_ble_remote/application/print/subdir.mk
index 6690669..6304829 100644
--- a/8271_ble_remote/application/print/subdir.mk
+++ b/8271_ble_remote/application/print/subdir.mk
@@ -16,7 +16,7 @@
 application/print/%.o: ../application/print/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/application/usbstd/subdir.mk b/8271_ble_remote/application/usbstd/subdir.mk
index ffd1404..53a92d3 100644
--- a/8271_ble_remote/application/usbstd/subdir.mk
+++ b/8271_ble_remote/application/usbstd/subdir.mk
@@ -18,7 +18,7 @@
 application/usbstd/%.o: ../application/usbstd/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/common/subdir.mk b/8271_ble_remote/common/subdir.mk
index 62f7af6..8f0c4d7 100644
--- a/8271_ble_remote/common/subdir.mk
+++ b/8271_ble_remote/common/subdir.mk
@@ -22,7 +22,7 @@
 common/%.o: ../common/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/drivers/8278/flash/subdir.mk b/8271_ble_remote/drivers/8278/flash/subdir.mk
new file mode 100644
index 0000000..f20ff57
--- /dev/null
+++ b/8271_ble_remote/drivers/8278/flash/subdir.mk
@@ -0,0 +1,35 @@
+################################################################################
+# Automatically-generated file. Do not edit!
+################################################################################
+
+# Add inputs and outputs from these tool invocations to the build variables
+C_SRCS += \
+../drivers/8278/flash/flash_mid11325e.c \
+../drivers/8278/flash/flash_mid1160c8.c \
+../drivers/8278/flash/flash_mid13325e.c \
+../drivers/8278/flash/flash_mid136085.c \
+../drivers/8278/flash/flash_mid1360c8.c \
+../drivers/8278/flash/flash_mid1360eb.c \
+../drivers/8278/flash/flash_mid14325e.c \
+../drivers/8278/flash/flash_mid1460c8.c
+
+OBJS += \
+./drivers/8278/flash/flash_mid11325e.o \
+./drivers/8278/flash/flash_mid1160c8.o \
+./drivers/8278/flash/flash_mid13325e.o \
+./drivers/8278/flash/flash_mid136085.o \
+./drivers/8278/flash/flash_mid1360c8.o \
+./drivers/8278/flash/flash_mid1360eb.o \
+./drivers/8278/flash/flash_mid14325e.o \
+./drivers/8278/flash/flash_mid1460c8.o
+
+
+# Each subdirectory must supply rules for building sources it contributes
+drivers/8278/flash/%.o: ../drivers/8278/flash/%.c
+	@echo 'Building file: $<'
+	@echo 'Invoking: TC32 Compiler'
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	@echo 'Finished building: $<'
+	@echo ' '
+
+
diff --git a/8271_ble_remote/drivers/8278/subdir.mk b/8271_ble_remote/drivers/8278/subdir.mk
index 4eb32cf..61fbc30 100644
--- a/8271_ble_remote/drivers/8278/subdir.mk
+++ b/8271_ble_remote/drivers/8278/subdir.mk
@@ -50,7 +50,7 @@
 drivers/8278/%.o: ../drivers/8278/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/makefile b/8271_ble_remote/makefile
index 405a123..52d5e79 100644
--- a/8271_ble_remote/makefile
+++ b/8271_ble_remote/makefile
@@ -13,6 +13,7 @@
 -include vendor/827x_ble_remote/subdir.mk
 -include vendor/827x_ble_remote/pke_common/subdir.mk
 -include drivers/8278/subdir.mk
+-include drivers/8278/flash/subdir.mk
 -include common/subdir.mk
 -include boot/8271/subdir.mk
 -include application/usbstd/subdir.mk
@@ -35,42 +36,42 @@
 
 
 # All Target
-all: GoogleRCU_8271_v1p34.elf secondary-outputs
+all: GoogleRCU_8271.elf secondary-outputs
 
 # Tool invocations
-GoogleRCU_8271_v1p34.elf: $(OBJS) $(USER_OBJS)
+GoogleRCU_8271.elf: $(OBJS) $(USER_OBJS)
 	@echo 'Building target: $@'
 	@echo 'Invoking: TC32 C Linker'
-	tc32-elf-ld --gc-sections -L"../proj_lib" -L"../application\audio" -T ../boot.link -o"GoogleRCU_8271_v1p34.elf" $(OBJS) $(USER_OBJS) $(LIBS)
+	tc32-elf-ld --gc-sections -L"../proj_lib" -L"../application\audio" -T ../boot.link -o"GoogleRCU_8271.elf" $(OBJS) $(USER_OBJS) $(LIBS)
 	@echo 'Finished building target: $@'
 	@echo ' '
 	$(MAKE) --no-print-directory post-build
 
-8271_ble_remote.lst: GoogleRCU_8271_v1p34.elf
+8271_ble_remote.lst: GoogleRCU_8271.elf
 	@echo 'Invoking: TC32 Create Extended Listing'
-	tc32-elf-objdump -x -D -l -S GoogleRCU_8271_v1p34.elf  >"8271_ble_remote.lst"
+	tc32-elf-objdump -x -D -l -S GoogleRCU_8271.elf  >"8271_ble_remote.lst"
 	@echo 'Finished building: $@'
 	@echo ' '
 
-: GoogleRCU_8271_v1p34.elf
+: GoogleRCU_8271.elf
 	@echo 'Create Flash image (binary format)'
-	tc32-elf-objcopy -O binary GoogleRCU_8271_v1p34.elf
+	tc32-elf-objcopy -O binary GoogleRCU_8271.elf
 	@echo 'Finished building: $@'
 	@echo ' '
 
-sizedummy: GoogleRCU_8271_v1p34.elf
+sizedummy: GoogleRCU_8271.elf
 	@echo 'Invoking: Print Size'
-	tc32-elf-size -t GoogleRCU_8271_v1p34.elf
+	tc32-elf-size -t GoogleRCU_8271.elf
 	@echo 'Finished building: $@'
 	@echo ' '
 
 # Other Targets
 clean:
-	-$(RM) $(FLASH_IMAGE)$(ELFS)$(OBJS)$(LST)$(SIZEDUMMY) GoogleRCU_8271_v1p34.elf
+	-$(RM) $(FLASH_IMAGE)$(ELFS)$(OBJS)$(LST)$(SIZEDUMMY) GoogleRCU_8271.elf
 	-@echo ' '
 
 post-build:
-	-"../tl_check_fw.sh"   8271_ble_remote   GoogleRCU_8271_v1p34
+	-"../tl_check_fw.sh"   8271_ble_remote   GoogleRCU_8271
 	-@echo ' '
 
 secondary-outputs: $(LST) $(FLASH_IMAGE) $(SIZEDUMMY)
diff --git a/8271_ble_remote/objects.mk b/8271_ble_remote/objects.mk
index 920ee88..be4c8eb 100644
--- a/8271_ble_remote/objects.mk
+++ b/8271_ble_remote/objects.mk
@@ -4,5 +4,5 @@
 
 USER_OBJS :=
 
-LIBS := -llt_8278 -lapp_ota -lfirmware_encrypt
+LIBS := -llt_827x -lapp_ota -llt_general_stack -lfirmware_encrypt
 
diff --git a/8271_ble_remote/sources.mk b/8271_ble_remote/sources.mk
index e79103b..ddd8bbf 100644
--- a/8271_ble_remote/sources.mk
+++ b/8271_ble_remote/sources.mk
@@ -20,6 +20,7 @@
 vendor/827x_ble_remote \
 vendor/827x_ble_remote/pke_common \
 drivers/8278 \
+drivers/8278/flash \
 . \
 common \
 boot/8271 \
diff --git a/8271_ble_remote/vendor/827x_ble_remote/pke_common/subdir.mk b/8271_ble_remote/vendor/827x_ble_remote/pke_common/subdir.mk
index 60bfade..636919d 100644
--- a/8271_ble_remote/vendor/827x_ble_remote/pke_common/subdir.mk
+++ b/8271_ble_remote/vendor/827x_ble_remote/pke_common/subdir.mk
@@ -14,7 +14,7 @@
 vendor/827x_ble_remote/pke_common/%.o: ../vendor/827x_ble_remote/pke_common/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/vendor/827x_ble_remote/subdir.mk b/8271_ble_remote/vendor/827x_ble_remote/subdir.mk
index 1424767..d47b086 100644
--- a/8271_ble_remote/vendor/827x_ble_remote/subdir.mk
+++ b/8271_ble_remote/vendor/827x_ble_remote/subdir.mk
@@ -40,7 +40,7 @@
 vendor/827x_ble_remote/%.o: ../vendor/827x_ble_remote/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/8271_ble_remote/vendor/common/subdir.mk b/8271_ble_remote/vendor/common/subdir.mk
index 82e78bc..132fba7 100644
--- a/8271_ble_remote/vendor/common/subdir.mk
+++ b/8271_ble_remote/vendor/common/subdir.mk
@@ -22,7 +22,7 @@
 vendor/common/%.o: ../vendor/common/%.c
 	@echo 'Building file: $<'
 	@echo 'Invoking: TC32 Compiler'
-	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_8278 -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
+	tc32-elf-gcc -ffunction-sections -fdata-sections -I"../" -I"../\drivers\8278" -D__PROJECT_8278_BLE_REMOTE__=1 -DCHIP_TYPE=CHIP_TYPE_827x -Wall -O2 -fpack-struct -fshort-enums -finline-small-functions -std=gnu99 -fshort-wchar -fms-extensions -c -o"$@" "$<"
 	@echo 'Finished building: $<'
 	@echo ' '
 
diff --git a/algorithm/aes_ccm/aes_ccm.h b/algorithm/aes_ccm/aes_ccm.h
new file mode 100644
index 0000000..06bc9f1
--- /dev/null
+++ b/algorithm/aes_ccm/aes_ccm.h
@@ -0,0 +1,179 @@
+/******************************************************************************
+ * @file     aes_ccm.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#pragma  once
+
+#include "stack/ble/ble_format.h"
+
+#define AES_BLOCK_SIZE     16
+
+
+//#define        SUCCESS            0
+enum {
+    AES_SUCC = SUCCESS,
+    AES_NO_BUF,
+    AES_FAIL,
+};
+
+
+typedef struct {
+    u32        pkt;
+    u8        dir;
+    u8        iv[8];
+} ble_cyrpt_nonce_t;
+
+
+typedef struct {
+    u32                    enc_pno;
+    u32                    dec_pno;
+    u8                    sk[16];            //session key
+    ble_cyrpt_nonce_t    nonce;
+    u8                    st;
+    u8                    enable;            //1: slave enable; 2: master enable
+    u8                    mic_fail;
+} ble_crypt_para_t;
+
+
+struct CCM_FLAGS_TAG {
+    union {
+        struct {
+            u8 L : 3;
+            u8 M : 3;
+            u8 aData :1;
+            u8 reserved :1;
+        } bf;
+        u8 val;
+    };
+};
+
+typedef struct CCM_FLAGS_TAG ccm_flags_t;
+
+
+typedef struct {
+    union {
+        u8 A[AES_BLOCK_SIZE];
+        u8 B[AES_BLOCK_SIZE];
+    } bf;
+
+    u8 tmpResult[AES_BLOCK_SIZE];
+    u8 newAstr[AES_BLOCK_SIZE];
+} aes_enc_t;
+
+
+enum{
+    CRYPT_NONCE_TYPE_ACL = 0,
+    CRYPT_NONCE_TYPE_CIS = 1,
+    CRYPT_NONCE_TYPE_BIS = 2,
+};
+
+typedef union {
+    struct{
+        u8 enEncFlg:1; //enable encryption
+        u8 noneType:2; //ACL, CIS, BIS
+        u8 decMicFail:1;//Decryption status
+        u8 role:1;     //ll_ccm_enc: Master role must use 1, Slave role must use 0;
+                       //ll_ccm_dec: Master role must use 0, Slave role must use 1;
+        u8 rsvd:3;     //Rsvd
+    };
+    u8 cryptBitsInfo;
+}cryptBitsInfo_t;
+
+typedef struct {
+    u64                    txPayloadCnt; //Packet counter for Tx
+    u64                    rxPayloadCnt; //Packet counter for Rx
+    u8                    sk[16];         //Session key
+    ble_cyrpt_nonce_t    ccmNonce;     //CCM nonce format
+    cryptBitsInfo_t     cryptBitsInfo;//To save Ram
+    u16                 rsvd;         //For align
+    llPhysChnPdu_t*     pllPhysChnPdu;//LL physical channel PDU
+} leCryptCtrl_t;
+
+
+/**
+ * @brief       this function is used to encrypt the plaintext
+ * @param[in]    *key - aes key: 128 bit key for the encryption of the data, little--endian.
+ * @param[in]    *plaintext - 128 bit data block that is requested to be encrypted, little--endian.
+ * @param[out]    *result - 128 bit encrypted data block, little--endian.
+ * @return      none.
+ * @Note        Input data requires strict Word alignment
+ */
+void aes_ll_encryption(u8* key, u8* plaintext, u8 *encrypted_data);
+
+
+/**
+ * @brief       this function is used to initialize the aes_ccm initial value
+ * @param[in]   ltk - encryption key, LTK
+ * @param[in]   skdm -
+ * @param[in]   skds -
+ * @param[in]   ivm -
+ * @param[in]   ivs -
+ * @param[in]   pd - Reference structure ble_crypt_para_t
+ * @return      none
+ */
+void aes_ll_ccm_encryption_init (u8 *ltk, u8 *skdm, u8 *skds, u8 *ivm, u8 *ivs, ble_crypt_para_t *pd);
+
+
+/**
+ * @brief       this function is used to encrypt the aes_ccm value
+ * @param[in]   pkt - plaint_text
+ * @param[in]   master - ll_ccm_enc: Master role must use 1, Slave role must use 0;
+                         ll_ccm_dec: Master role must use 0, Slave role must use 1;
+ * @param[in]   pd - Reference structure ble_crypt_para_t
+ * @return      none
+ */
+void aes_ll_ccm_encryption(u8 *pkt, int master, ble_crypt_para_t *pd);
+
+
+/**
+ * @brief       this function is used to encrypt the aes_ccm value, version2
+ * @param[in]   pd - Reference structure leCryptCtrl_t
+ * @return      none
+ */
+void aes_ll_ccm_encryption_v2(leCryptCtrl_t *pd);
+
+
+/**
+ * @brief       this function is used to decrypt the aes_ccm value
+ * @param[in]   pkt - plaint_text
+ * @param[in]   master - ll_ccm_enc: Master role must use 1, Slave role must use 0;
+                         ll_ccm_dec: Master role must use 0, Slave role must use 1;
+ * @param[in]   pd - Reference structure ble_crypt_para_t
+ * @return      0: decryption succeeded; 1: decryption failed
+ */
+int  aes_ll_ccm_decryption(u8 *pkt, int master, ble_crypt_para_t *pd);
+
+
+/**
+ * @brief       this function is used to decrypt the aes_ccm value, version2
+ * @param[in]   pd - Reference structure leCryptCtrl_t
+ * @return      0: decryption succeeded; 1: decryption failed
+ */
+int  aes_ll_ccm_decryption_v2(leCryptCtrl_t *pd);
+
+
+
+
+
+
diff --git a/algorithm/ecc/ecc_ll.h b/algorithm/ecc/ecc_ll.h
new file mode 100644
index 0000000..227086f
--- /dev/null
+++ b/algorithm/ecc/ecc_ll.h
@@ -0,0 +1,68 @@
+/******************************************************************************
+ * @file     ecc_ll.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef ECC_LL_H_
+#define ECC_LL_H_
+
+
+extern const u8 blt_ecc_dbg_priv_key[32];
+extern const u8 blt_ecc_dbg_pub_key[64];
+
+
+/**
+* @brief        This function is used to register the random number function needed for ECC calculation
+* @param        none
+* @return        none
+*/
+void             blt_ecc_init(void);
+
+/**
+* @brief        This function is used to generate an ECDH public-private key pairs
+* @param[out]  pub[64]:  output ecdh public key
+* @param[out]  priv[64]: output ecdh private key
+* @param[in]   use_dbg_key: 0: Non-debug key , others: debug key
+* @return        1:  success
+*              0: failure
+*/
+int             blt_ecc_gen_key_pair(unsigned char pub[64], unsigned char priv[32], bool use_dbg_key);
+
+/**
+* @brief        This function is used to calculate DHKEY based on the peer public key and own private key
+* @param[in]   peer_pub_key[64]: peer public key
+* @param[in]   own_priv_key[32]: own private key
+* @param[out]  out_dhkey[32]: dhkey key
+* @return        1:  success
+*              0: failure
+*/
+int             blt_ecc_gen_dhkey(const unsigned char peer_pub[64], const unsigned char own_priv[32], unsigned char out_dhkey[32]);
+
+
+
+
+#endif /* ECC_LL_H_ */
+
+
+
+
diff --git a/algorithm/ecc/hw_ecc.h b/algorithm/ecc/hw_ecc.h
new file mode 100644
index 0000000..fc7212b
--- /dev/null
+++ b/algorithm/ecc/hw_ecc.h
@@ -0,0 +1,82 @@
+/******************************************************************************
+ * @file     hw_ecc.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef HW_ECC_H_
+#define HW_ECC_H_
+
+#include "algorithm/ecc/hw_ecc.h"
+
+
+#define            hECC_BYTES            32
+
+
+
+
+/* hECC_RNG_Function type
+The RNG function should fill 'size' random bytes into 'dest'. It should return 1 if
+'dest' was filled with random data, or 0 if the random data could not be generated.
+The filled-in values should be either truly random, or from a cryptographically-secure PRNG.
+A correctly functioning RNG function must be set (using hECC_set_rng()) before calling
+hECC_make_key(). */
+
+typedef int (*hECC_rng_func)(unsigned char *dest, unsigned size);
+
+
+/**
+ * @brief        The function that will be used to generate random bytes.
+ * @param[in]    resister predefined TRNG function
+ * @return        none
+ */
+void            hwECC_set_rng(hECC_rng_func rng_func);
+
+
+/**
+ * @brief        get ECCP key pair(the key pair could be used in ECDH).
+ * @param[out]    public_key    - public key, big--endian.
+ * @param[out]    private_key    - private key, big--endian.
+ * @return        PKE_SUCCESS(success), other(error).
+ */
+unsigned char     hwECC_make_key(unsigned char public_key[hECC_BYTES*2], unsigned char private_key[hECC_BYTES]);
+
+
+/**
+ * @brief        ECDH compute key.
+ * @param[in]    local_prikey    - local private key, big--endian.
+ * @param[in]    public_key        - peer public key, big--endian.
+ * @param[out]    dhkey            - output dhkey, big--endian.
+ * @Return        0(success); other(error).
+ */
+unsigned char hwECC_shared_secret(const unsigned char public_key[hECC_BYTES*2],
+                                  const unsigned char private_key[hECC_BYTES],
+                                  unsigned char secret[hECC_BYTES]);
+
+
+
+
+#endif /* HW_ECC_H_ */
+
+
+
+
diff --git a/algorithm/ecc/sw_ecc.h b/algorithm/ecc/sw_ecc.h
new file mode 100644
index 0000000..9f314e5
--- /dev/null
+++ b/algorithm/ecc/sw_ecc.h
@@ -0,0 +1,325 @@
+/******************************************************************************
+ * @file     sw_ecc.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef SW_ECC_H_
+#define SW_ECC_H_
+
+
+
+
+/* Platform selection options.
+If uECC_PLATFORM is not defined, the code will try to guess it based on compiler macros.
+Possible values for uECC_PLATFORM are defined below: */
+#define uECC_arch_other 0
+#define uECC_x86        1
+#define uECC_x86_64     2
+#define uECC_arm        3
+#define uECC_arm_thumb  4
+#define uECC_avr        5
+#define uECC_arm_thumb2 6
+
+/* If desired, you can define uECC_WORD_SIZE as appropriate for your platform (1, 4, or 8 bytes).
+If uECC_WORD_SIZE is not explicitly defined then it will be automatically set based on your
+platform. */
+
+/* Inline assembly options.
+uECC_asm_none  - Use standard C99 only.
+uECC_asm_small - Use GCC inline assembly for the target platform (if available), optimized for
+                 minimum size.
+uECC_asm_fast  - Use GCC inline assembly optimized for maximum speed. */
+#define uECC_asm_none  0
+#define uECC_asm_small 1
+#define uECC_asm_fast  2
+#ifndef uECC_ASM
+    #define uECC_ASM uECC_asm_none
+#endif
+
+/* Curve selection options. */
+#define uECC_secp160r1 1
+#define uECC_secp192r1 2
+#define uECC_secp256r1 3
+#define uECC_secp256k1 4
+#define uECC_secp224r1 5
+#ifndef uECC_CURVE
+    #define uECC_CURVE uECC_secp256r1
+#endif
+
+/* uECC_SQUARE_FUNC - If enabled (defined as nonzero), this will cause a specific function to be
+used for (scalar) squaring instead of the generic multiplication function. This will make things
+faster by about 8% but increases the code size. */
+#ifndef uECC_SQUARE_FUNC
+    #define uECC_SQUARE_FUNC 0
+#endif
+
+#define uECC_CONCAT1(a, b) a##b
+#define uECC_CONCAT(a, b) uECC_CONCAT1(a, b)
+
+#define uECC_size_1 20 /* secp160r1 */
+#define uECC_size_2 24 /* secp192r1 */
+#define uECC_size_3 32 /* secp256r1 */
+#define uECC_size_4 32 /* secp256k1 */
+#define uECC_size_5 28 /* secp224r1 */
+
+#define uECC_BYTES uECC_CONCAT(uECC_size_, uECC_CURVE)
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/* uECC_RNG_Function type
+The RNG function should fill 'size' random bytes into 'dest'. It should return 1 if
+'dest' was filled with random data, or 0 if the random data could not be generated.
+The filled-in values should be either truly random, or from a cryptographically-secure PRNG.
+
+A correctly functioning RNG function must be set (using swECC_set_rng()) before calling
+swECC_make_key() or uECC_sign().
+
+Setting a correctly functioning RNG function improves the resistance to side-channel attacks
+for swECC_shared_secret() and uECC_sign_deterministic().
+
+A correct RNG function is set by default when building for Windows, Linux, or OS X.
+If you are building on another POSIX-compliant system that supports /dev/random or /dev/urandom,
+you can define uECC_POSIX to use the predefined RNG. For embedded platforms there is no predefined
+RNG function; you must provide your own.
+*/
+typedef int (*uECC_RNG_Function)(unsigned char *dest, unsigned size);
+
+/* swECC_set_rng() function.
+Set the function that will be used to generate random bytes. The RNG function should
+return 1 if the random data was generated, or 0 if the random data could not be generated.
+
+On platforms where there is no predefined RNG function (eg embedded platforms), this must
+be called before swECC_make_key() or uECC_sign() are used.
+
+Inputs:
+    rng_function - The function that will be used to generate random bytes.
+*/
+void swECC_set_rng(uECC_RNG_Function rng_function);
+
+/* swECC_make_key() function.
+Create a public/private key pair.
+
+Outputs:
+    public_key  - Will be filled in with the public key.
+    private_key - Will be filled in with the private key.
+
+Returns 1 if the key pair was generated successfully, 0 if an error occurred.
+*/
+int swECC_make_key(unsigned char public_key[uECC_BYTES*2], unsigned char private_key[uECC_BYTES]);
+
+/* swECC_shared_secret() function.
+Compute a shared secret given your secret key and someone else's public key.
+Note: It is recommended that you hash the result of swECC_shared_secret() before using it for
+symmetric encryption or HMAC.
+
+Inputs:
+    public_key  - The public key of the remote party.
+    private_key - Your private key.
+
+Outputs:
+    secret - Will be filled in with the shared secret value.
+
+Returns 1 if the shared secret was generated successfully, 0 if an error occurred.
+*/
+int swECC_shared_secret(const unsigned char public_key[uECC_BYTES*2],
+                       const unsigned char private_key[uECC_BYTES],
+                       unsigned char secret[uECC_BYTES]);
+
+/* uECC_sign() function.
+Generate an ECDSA signature for a given hash value.
+
+Usage: Compute a hash of the data you wish to sign (SHA-2 is recommended) and pass it in to
+this function along with your private key.
+
+Inputs:
+    private_key  - Your private key.
+    message_hash - The hash of the message to sign.
+
+Outputs:
+    signature - Will be filled in with the signature value.
+
+Returns 1 if the signature generated successfully, 0 if an error occurred.
+*/
+int uECC_sign(const unsigned char private_key[uECC_BYTES],
+              const unsigned char message_hash[uECC_BYTES],
+              unsigned char signature[uECC_BYTES*2]);
+
+/* uECC_HashContext structure.
+This is used to pass in an arbitrary hash function to uECC_sign_deterministic().
+The structure will be used for multiple hash computations; each time a new hash
+is computed, init_hash() will be called, followed by one or more calls to
+update_hash(), and finally a call to finish_hash() to produce the resulting hash.
+
+The intention is that you will create a structure that includes uECC_HashContext
+followed by any hash-specific data. For example:
+
+typedef struct SHA256_HashContext {
+    uECC_HashContext uECC;
+    SHA256_CTX ctx;
+} SHA256_HashContext;
+
+void init_SHA256(uECC_HashContext *base) {
+    SHA256_HashContext *context = (SHA256_HashContext *)base;
+    SHA256_Init(&context->ctx);
+}
+
+void update_SHA256(uECC_HashContext *base,
+                   const unsigned char *message,
+                   unsigned message_size) {
+    SHA256_HashContext *context = (SHA256_HashContext *)base;
+    SHA256_Update(&context->ctx, message, message_size);
+}
+
+void finish_SHA256(uECC_HashContext *base, unsigned char *hash_result) {
+    SHA256_HashContext *context = (SHA256_HashContext *)base;
+    SHA256_Final(hash_result, &context->ctx);
+}
+
+... when signing ...
+{
+    unsigned char tmp[32 + 32 + 64];
+    SHA256_HashContext ctx = {{&init_SHA256, &update_SHA256, &finish_SHA256, 64, 32, tmp}};
+    uECC_sign_deterministic(key, message_hash, &ctx.uECC, signature);
+}
+*/
+typedef struct uECC_HashContext {
+    void (*init_hash)(struct uECC_HashContext *context);
+    void (*update_hash)(struct uECC_HashContext *context,
+                        const unsigned char *message,
+                        unsigned message_size);
+    void (*finish_hash)(struct uECC_HashContext *context, unsigned char *hash_result);
+    unsigned block_size; /* Hash function block size in bytes, eg 64 for SHA-256. */
+    unsigned result_size; /* Hash function result size in bytes, eg 32 for SHA-256. */
+    unsigned char *tmp; /* Must point to a buffer of at least (2 * result_size + block_size) bytes. */
+} uECC_HashContext;
+
+/* uECC_sign_deterministic() function.
+Generate an ECDSA signature for a given hash value, using a deterministic algorithm
+(see RFC 6979). You do not need to set the RNG using swECC_set_rng() before calling
+this function; however, if the RNG is defined it will improve resistance to side-channel
+attacks.
+
+Usage: Compute a hash of the data you wish to sign (SHA-2 is recommended) and pass it in to
+this function along with your private key and a hash context.
+
+Inputs:
+    private_key  - Your private key.
+    message_hash - The hash of the message to sign.
+    hash_context - A hash context to use.
+
+Outputs:
+    signature - Will be filled in with the signature value.
+
+Returns 1 if the signature generated successfully, 0 if an error occurred.
+*/
+int uECC_sign_deterministic(const unsigned char private_key[uECC_BYTES],
+                            const unsigned char message_hash[uECC_BYTES],
+                            uECC_HashContext *hash_context,
+                            unsigned char signature[uECC_BYTES*2]);
+
+/* uECC_verify() function.
+Verify an ECDSA signature.
+
+Usage: Compute the hash of the signed data using the same hash as the signer and
+pass it to this function along with the signer's public key and the signature values (r and s).
+
+Inputs:
+    public_key - The signer's public key
+    hash       - The hash of the signed data.
+    signature  - The signature value.
+
+Returns 1 if the signature is valid, 0 if it is invalid.
+*/
+int uECC_verify(const unsigned char public_key[uECC_BYTES*2],
+                const unsigned char hash[uECC_BYTES],
+                const unsigned char signature[uECC_BYTES*2]);
+
+/* uECC_compress() function.
+Compress a public key.
+
+Inputs:
+    public_key - The public key to compress.
+
+Outputs:
+    compressed - Will be filled in with the compressed public key.
+*/
+void uECC_compress(const unsigned char public_key[uECC_BYTES*2], unsigned char compressed[uECC_BYTES+1]);
+
+/* uECC_decompress() function.
+Decompress a compressed public key.
+
+Inputs:
+    compressed - The compressed public key.
+
+Outputs:
+    public_key - Will be filled in with the decompressed public key.
+*/
+void uECC_decompress(const unsigned char compressed[uECC_BYTES+1], unsigned char public_key[uECC_BYTES*2]);
+
+/* uECC_valid_public_key() function.
+Check to see if a public key is valid.
+
+Note that you are not required to check for a valid public key before using any other uECC
+functions. However, you may wish to avoid spending CPU time computing a shared secret or
+verifying a signature using an invalid public key.
+
+Inputs:
+    public_key - The public key to check.
+
+Returns 1 if the public key is valid, 0 if it is invalid.
+*/
+int uECC_valid_public_key(const unsigned char public_key[uECC_BYTES*2]);
+
+/* uECC_compute_public_key() function.
+Compute the corresponding public key for a private key.
+
+Inputs:
+    private_key - The private key to compute the public key for
+
+Outputs:
+    public_key - Will be filled in with the corresponding public key
+
+Returns 1 if the key was computed successfully, 0 if an error occurred.
+*/
+int uECC_compute_public_key(const unsigned char private_key[uECC_BYTES],
+                            unsigned char public_key[uECC_BYTES * 2]);
+
+
+/* uECC_bytes() function.
+Returns the value of uECC_BYTES. Helpful for foreign-interfaces to higher-level languages.
+*/
+int uECC_bytes(void);
+
+/* uECC_curve() function.
+Returns the value of uECC_CURVE. Helpful for foreign-interfaces to higher-level languages.
+*/
+int uECC_curve(void);
+
+#ifdef __cplusplus
+} /* end of extern "C" */
+#endif
+
+#endif /* SW_ECC_H_ */
diff --git a/application/app/usbkb.c b/application/app/usbkb.c
index bd7c1cf..f4a0355 100644
--- a/application/app/usbkb.c
+++ b/application/app/usbkb.c
@@ -89,7 +89,7 @@
 //static
 u8  usbkb_wptr, usbkb_rptr;
 static u32 usbkb_not_released;
-static u32 usbkb_data_report_time;
+volatile static u32 usbkb_data_report_time;
 
 
 void usbkb_add_frame (rf_packet_keyboard_t *packet_kb)
@@ -99,7 +99,7 @@
     {
             memcpy4((int*)(&kb_dat_buff[usbkb_wptr]), (int*)(&packet_kb->data[i*sizeof(kb_data_t)]), sizeof(kb_data_t));
             BOUND_INC_POW2(usbkb_wptr,USBKB_BUFF_DATA_NUM);
-            if(usbkb_wptr == usbkb_wptr)
+            if(usbkb_wptr == usbkb_rptr)
             {
                     break;
             }
@@ -382,11 +382,15 @@
         }
         else{
 
-            usbkb_hid_report_normal(pData[1], pData + 2);
-
-            usb_ff_rptr ++;
-
-            return 1;
+            if(usbkb_hid_report_normal(pData[1], pData + 2))
+            {
+                usb_ff_rptr ++;
+                return 1;
+            }
+            else
+            {
+                return 0;
+            }
         }
     }
     else if(pData[0] == DAT_TYPE_MOUSE){
@@ -395,11 +399,15 @@
         }
         else{
 
-            usbmouse_hid_report(pData[1], pData + 4, pData[2]);
-
-            usb_ff_rptr ++;
-
-            return 1;
+            if(usbmouse_hid_report(pData[1], pData + 4, pData[2]))
+            {
+                usb_ff_rptr ++;
+                return 1;
+            }
+            else
+            {
+                return 0;
+            }
         }
     }
 
diff --git a/application/app/usbmouse.c b/application/app/usbmouse.c
index 41ffb40..b06ee34 100644
--- a/application/app/usbmouse.c
+++ b/application/app/usbmouse.c
@@ -44,7 +44,7 @@
 
 static u8  usbmouse_wptr, usbmouse_rptr;
 static u32 usbmouse_not_released;
-static u32 usbmouse_data_report_time;
+volatile static u32 usbmouse_data_report_time;
 
 
 
diff --git a/application/audio/tl_audio.c b/application/audio/tl_audio.c
index 9d2b1d1..be1c92b 100644
--- a/application/audio/tl_audio.c
+++ b/application/audio/tl_audio.c
@@ -30,7 +30,11 @@
 #include    "audio_config.h"
 #include    "adpcm.h"
 #include    "gl_audio.h"
+#include    "../../common/log.h"
 
+//temp wangxin
+#define TR_T_adpcm                   26
+#define TR_T_adpcm_enc_overflow      27
 
 
 #if (TL_AUDIO_MODE & RCU_PROJECT)                //RCU
diff --git a/application/print/putchar.c b/application/print/putchar.c
index bf4dff7..f2ea9a4 100644
--- a/application/print/putchar.c
+++ b/application/print/putchar.c
@@ -166,6 +166,8 @@
     }else{
         return swire_putc((char)c);
     }
+#else
+    return c;
 #endif
 }
 
diff --git a/application/usbstd/usb.c b/application/usbstd/usb.c
index cb63492..320a7b3 100644
--- a/application/usbstd/usb.c
+++ b/application/usbstd/usb.c
@@ -874,7 +874,7 @@
 #endif
 
     usb_init_interrupt();
-#if 1 //FLOW_NO_OS
+#if FLOW_NO_OS
 #else
     usb_handle_irq();
 #endif
diff --git a/application/usbstd/usb.h b/application/usbstd/usb.h
index 0bb8094..e11942d 100644
--- a/application/usbstd/usb.h
+++ b/application/usbstd/usb.h
@@ -63,6 +63,7 @@
 
 void usb_init();
 
+void usb_handle_irq(void);
 #ifndef        USB_SOFTWARE_CRC_CHECK
 #define        USB_SOFTWARE_CRC_CHECK        0
 #endif
diff --git a/boot.link b/boot.link
index 86e524b..f941fba 100644
--- a/boot.link
+++ b/boot.link
@@ -102,6 +102,13 @@
         *(.bss.*)

         }

     PROVIDE(_end_bss_ = .);

+    /* data in ram but no need to clean in .s*/

+        .data_no_init (NOLOAD) :

+        {

+    . = (((. + 3) / 4)*4);

+            *(.data_no_init)

+            *(.data_no_init.*)

+        }

     PROVIDE(_bin_size_ = _code_size_ + _end_data_ - _start_data_);

     PROVIDE(_ictag_start_ = 0x840000 + (_retention_data_size_div_256_) * 0x100);

     PROVIDE(_ictag_end_ = 0x840000 + (_retention_data_size_div_256_ + 1) * 0x100);

diff --git a/boot/8271/cstartup_8271_RET_32K.S b/boot/8271/cstartup_8271_RET_32K.S
index 23305cd..a227ab0 100644
--- a/boot/8271/cstartup_8271_RET_32K.S
+++ b/boot/8271/cstartup_8271_RET_32K.S
@@ -23,197 +23,196 @@
 #ifdef MCU_STARTUP_8271_RET_32K

 

 #ifndef __LOAD_RAM_SIZE__

-#define	__LOAD_RAM_SIZE__		0xc

+#define __LOAD_RAM_SIZE__        0xc

 #endif

 

-	.code	16

+    .code    16

 @********************************************************************************************************

 @                                           MACROS AND DEFINIITIONS

 @********************************************************************************************************

 @.include "version.in"

-#include "../../version.h"     /* modified by tuyf */

-					@ Mode, correspords to bits 0-5 in CPSR

-	.equ MODE_BITS,		0x1F	@ Bit mask for mode bits in CPSR

-	.equ IRQ_MODE, 		0x12	@ Interrupt Request mode

-	.equ SVC_MODE, 		0x13	@ Supervisor mode 

+#include "../../version.h"     

+                    @ Mode, correspords to bits 0-5 in CPSR

+    .equ MODE_BITS,        0x1F    @ Bit mask for mode bits in CPSR

+    .equ IRQ_MODE,         0x12    @ Interrupt Request mode

+    .equ SVC_MODE,         0x13    @ Supervisor mode 

 

-	.equ IRQ_STK_SIZE,	0x180

-	.equ __LOAD_RAM, 	__LOAD_RAM_SIZE__

-	

+    .equ IRQ_STK_SIZE,    0x180

+    .equ __LOAD_RAM,     __LOAD_RAM_SIZE__

+

 @********************************************************************************************************

 @                                            TC32 EXCEPTION VECTORS

 @********************************************************************************************************

 

-	.section	.vectors,"ax"

-	.global		__reset

-	.global	 	__irq

-	.global 	__start

-	.global		__LOAD_RAM

+    .section    .vectors,"ax"

+    .global        __reset

+    .global         __irq

+    .global     __start

+    .global        __LOAD_RAM

 

-__start:					@ MUST,  referenced by boot.link

+__start:                    @ MUST,  referenced by boot.link

 

-	.extern irq_handler

+    .extern irq_handler

 

-	.extern  _ramcode_size_div_16_

-	.extern  _ramcode_size_div_256_

-	.extern  _ramcode_size_div_16_align_256_

-	.extern  _ramcode_size_align_256_

-	.extern  _ictag_start_

-	.extern  _ictag_end_

-	.extern  _ram_use_size_align_256__

-	.org 0x0

-	tj	__reset

+    .extern  _ramcode_size_div_16_

+    .extern  _ramcode_size_div_256_

+    .extern  _ramcode_size_div_16_align_256_

+    .extern  _ramcode_size_align_256_

+    .extern  _ictag_start_

+    .extern  _ictag_end_

+    .extern  _ram_use_size_align_256__

+    .org 0x0

+    tj    __reset

+    .org 0x2

+    .word (FW_VERSION)

+    .org 0x8

+    .word    (0x544c4e4b)

+    .word    (0x00880000 + 13) @208 byte: load vector part before START_SECTIONS

 

-	.org 0x2

-	.word	(FW_VERSION)

-	.org 0x8

-	.word	(0x544c4e4b)

-	.word	(0x00880000 + 13) @208 byte: load vector part before START_SECTIONS

-

-	.org 0x10

-	tj		__irq

-	.org 0x18

-	.word	(_bin_size_)

+    .org 0x10

+    tj        __irq

+    .org 0x18

+    .word    (_bin_size_)

 @********************************************************************************************************

 @                                   LOW-LEVEL INITIALIZATION

 @********************************************************************************************************

-	.extern  main

+    .extern  main

 

 

 

-	.org 0x20

-	.align 4

+    .org 0x20

+    .align 4

 

 

 

 __reset:

 

 #if 0

-	@ add debug, PB4 output 1

-	tloadr     	r1, DEBUG_GPIO    @0x80058a  PB oen

-	tmov		r0, #139      @0b 11101111

-	tstorerb	r0, [r1, #0]

+    @ add debug, PB4 output 1

+    tloadr         r1, DEBUG_GPIO    @0x80058a  PB oen

+    tmov        r0, #139      @0b 11101111

+    tstorerb    r0, [r1, #0]

 

-	tmov		r0, #16			@0b 00010000

-	tstorerb	r0, [r1, #1]	@0x800583  PB output

+    tmov        r0, #16            @0b 00010000

+    tstorerb    r0, [r1, #1]    @0x800583  PB output

 #endif

 @ efuse load need delay about 18us

-	tmov		r2,#0

-	tmov        r3,#110

+    tmov        r2,#0

+    tmov        r3,#110

 EFUSE_DELAY:

-	tadd        r2,#1

-	tcmp        r2,r3

-	tjle        EFUSE_DELAY

+    tadd        r2,#1

+    tcmp        r2,r3

+    tjle        EFUSE_DELAY

 EFUSE_DELAY_END:

 

 RANA_REG_BEGIN:

 @ 1.system on for read anag_reg module

-	tloadr      r0,ADATA_I+8               @0x00800060

-	tloadr      r1,ADATA_I+12               @0xff000000

+    tloadr      r0,ADATA_I+8               @0x00800060

+    tloadr      r1,ADATA_I+12               @0xff000000

 

-	tstorer     r1,[r0,#0]                  @*(unsigned int*)0x800060=0xff000000

-	tshftr      r1,r1,#24					@0x000000ff

-	tstorerb    r1,[r0,#4]

-	tstorerb    r1,[r0,#5]

+    tstorer     r1,[r0,#0]                  @*(unsigned int*)0x800060=0xff000000

+    tshftr      r1,r1,#24                    @0x000000ff

+    tstorerb    r1,[r0,#4]

+    tstorerb    r1,[r0,#5]

 

 @ 2.read ana_reg_0x7f

-	tloadr		r0,ADATA_I+0				@0x7f

+    tloadr        r0,ADATA_I+0                @0x7f

 @ read anag_reg(0x7f):

-	tloadr		r1,ADATA_I+4			    @0x008000b8

-	tmov		r2,r0						@ana_reg_adr:0x7f

-	tstorerb	r2,[r1,#0]					@*(unsigned int*)0x8000b8=0x7f;

-	tmov   	    r2,#64						@ana_reg_dat:0x40=64

-	tstorerb	r2,[r1,#2]					@*(unsigned int*)0x8000ba=0x40;

+    tloadr        r1,ADATA_I+4                @0x008000b8

+    tmov        r2,r0                        @ana_reg_adr:0x7f

+    tstorerb    r2,[r1,#0]                    @*(unsigned int*)0x8000b8=0x7f;

+    tmov           r2,#64                        @ana_reg_dat:0x40=64

+    tstorerb    r2,[r1,#2]                    @*(unsigned int*)0x8000ba=0x40;

 

 RWAIT_REG_FINISH:

-	tloadrb	    r2,[r1,#2]

-	tshftl		r2,r2,#31

-	tshftr		r2,r2,#31

-	tcmp		r2,#1

-	tjeq		RWAIT_REG_FINISH

-	tloadrb	    r2,[r1,#1]

+    tloadrb        r2,[r1,#2]

+    tshftl        r2,r2,#31

+    tshftr        r2,r2,#31

+    tcmp        r2,#1

+    tjeq        RWAIT_REG_FINISH

+    tloadrb        r2,[r1,#1]

 @ read anag_reg end

 

 @ 3.check: if(!(analog_read(0x7f) & 0x01)){ //deepretention mode }

 

 @ copy flash ram code part to SRAM

 CPY_FLASH_RAM_PART_TO_SRAM:

-    tmov	    r3, #1

-	tand        r3, r2

+    tmov        r3, #1

+    tand        r3, r2

 

-	tcmp        r3, #1

-	tjne        START_SECTIONS              // 0->deepreten

-	tloadr		r0, IC_IA             		@r0 = 0x800608

-	tloadr		r1, CODE_CPY				@r1 = 0x000060  -> 0x000070

-	tloadr		r2, CODE_CPY+4				@r2 = virtual_ram_code_size=vector_size+ram_code_size

-	tmov        r4, #1						@r4 = 1

-	tshftl      r4, r4, #24					@r4 = r4<<24

+    tcmp        r3, #1

+    tjne        START_SECTIONS              // 0->deepreten

+    tloadr        r0, IC_IA                     @r0 = 0x800608

+    tloadr        r1, CODE_CPY                @r1 = 0x000060  -> 0x000070

+    tloadr        r2, CODE_CPY+4                @r2 = virtual_ram_code_size=vector_size+ram_code_size

+    tmov        r4, #1                        @r4 = 1

+    tshftl      r4, r4, #24                    @r4 = r4<<24

 

 

 PWR_ON_CPY:

-	tcmp		r1, r2						@

-	tjge		START_SECTIONS				@r1>=r2 jump to START_SECTIONS

+    tcmp        r1, r2                        @

+    tjge        START_SECTIONS                @r1>=r2 jump to START_SECTIONS

 

-	tmov        r5, r4						@r5=r4

-	tadd        r5, r1						@r5=r5+r1

-	tstorer 	r5, [r0, #0]           		@*(unsigned int*)0x800608 = r5;

+    tmov        r5, r4                        @r5=r4

+    tadd        r5, r1                        @r5=r5+r1

+    tstorer     r5, [r0, #0]                   @*(unsigned int*)0x800608 = r5;

 

 LOOP_WHILE:

-	tloadr		r3, [r0, #0]           		@r3 = *(unsigned int*)0x800608;

-	tasr        r3, r3, #24					@r3 = r3>>24

-	tcmp        r3, #0

-    tjne        LOOP_WHILE					@r3!=0 jump to loop_wait

+    tloadr        r3, [r0, #0]                   @r3 = *(unsigned int*)0x800608;

+    tasr        r3, r3, #24                    @r3 = r3>>24

+    tcmp        r3, #0

+    tjne        LOOP_WHILE                    @r3!=0 jump to loop_wait

 

-    tadd    	r1, #16						@r1=r1+16

-    tj          PWR_ON_CPY					@jump to PWR_ON_CPY

+    tadd        r1, #16                        @r1=r1+16

+    tj          PWR_ON_CPY                    @jump to PWR_ON_CPY

 PWR_ON_CPY_END:

 

 

     .balign 4

 IC_IA:

-    .word 	0x00800608

+    .word     0x00800608

 

 CODE_CPY:

-    .word   (0x000000d0)               		@0  208 byte:

-	.word   (_ram_use_size_align_256__) 	@4

+    .word   (0x000000d0)                       @0  208 byte:

+    .word   (_ram_use_size_align_256__)     @4

 

 ADATA_I:

-    .word	(0x0000007f)                	@0

-	.word	(0x008000b8)                	@4

-	.word	(0x00800060)                	@8

-    .word	(0xff000000)                	@12

+    .word    (0x0000007f)                    @0

+    .word    (0x008000b8)                    @4

+    .word    (0x00800060)                    @8

+    .word    (0xff000000)                    @12

 

 DEBUG_GPIO:

-	.word	(0x80058a)                  	@  PBx oen

+    .word    (0x80058a)                      @  PBx oen

 

 

 

-	.org 0xd0

+    .org 0xd0

 START_SECTIONS:

 

 SET_BOOT:

-	tmov        r2, #20

-	tloadrb     r1, [r2]		@read form core_840014

+    tmov        r2, #20

+    tloadrb     r1, [r2]        @read form core_840014

 

-	tmov     	r0, #90    @5A

-	tcmp        r0, r1

-	tjne		SET_BOOT_END

+    tmov         r0, #90    @5A

+    tcmp        r0, r1

+    tjne        SET_BOOT_END

 

-	tmov        r2, #21

-	tloadrb     r1, [r2]		@read form core_840015

+    tmov        r2, #21

+    tloadrb     r1, [r2]        @read form core_840015

 

-	tmov     	r0, #165    @A5

-	tcmp        r0, r1

-	tjne		SET_BOOT_END

+    tmov         r0, #165    @A5

+    tcmp        r0, r1

+    tjne        SET_BOOT_END

 

-	tmov        r2, #22

-	tloadrb     r1, [r2]		@read form core_840016

-	tloadrb		r0,	BOOT_SEL_D

-	tstorerb	r1, [r0, #0]

+    tmov        r2, #22

+    tloadrb     r1, [r2]        @read form core_840016

+    tloadrb        r0,    BOOT_SEL_D

+    tstorerb    r1, [r0, #0]

 

-	tmov        r2, #23

-	tloadrb     r1, [r2]		@read form core_840017

-	tstorerb	r1, [r0, #1]

+    tmov        r2, #23

+    tloadrb     r1, [r2]        @read form core_840017

+    tstorerb    r1, [r0, #1]

 

 SET_BOOT_END:

 

@@ -221,170 +220,170 @@
 

 @send flash cmd 0xab to wakeup flash;

 FLASH_WAKEUP_BEGIN:

-	tloadr      r0,FLASH_RECOVER + 0

-	tmov		r1,#0

-	tstorerb    r1,[r0,#1]

-	tmov        r1,#171						@Flash deep cmd: 0xAB

-	tstorerb    r1,[r0,#0]

-	tmov		r2,#0

-	tmov        r3,#6

+    tloadr      r0,FLASH_RECOVER + 0

+    tmov        r1,#0

+    tstorerb    r1,[r0,#1]

+    tmov        r1,#171                        @Flash deep cmd: 0xAB

+    tstorerb    r1,[r0,#0]

+    tmov        r2,#0

+    tmov        r3,#6

 TNOP:

-	tadd        r2,#1

-	tcmp        r2,r3

-	tjle        TNOP

-	tmov		r1,#1

-	tstorerb    r1,[r0,#1]

+    tadd        r2,#1

+    tcmp        r2,r3

+    tjle        TNOP

+    tmov        r1,#1

+    tstorerb    r1,[r0,#1]

 FLASH_WAKEUP_END:

 

 

 

 

-	tloadr	r0, FLL_D

-	tloadr	r1, FLL_D+4

-	tloadr	r2, FLL_D+8

+    tloadr    r0, FLL_D

+    tloadr    r1, FLL_D+4

+    tloadr    r2, FLL_D+8

 

 FLL_STK:

-	tcmp	r1, r2

-	tjge	FLL_STK_END

-	tstorer r0, [r1, #0]

-	tadd    r1, #4

-	tj		FLL_STK

+    tcmp    r1, r2

+    tjge    FLL_STK_END

+    tstorer r0, [r1, #0]

+    tadd    r1, #4

+    tj        FLL_STK

 FLL_STK_END:

 

-	tloadr	r0, DAT0

-	tmcsr	r0			

-	tloadr	r0, DAT0 + 8

-	tmov	r13, r0  

+    tloadr    r0, DAT0

+    tmcsr    r0            

+    tloadr    r0, DAT0 + 8

+    tmov    r13, r0  

 

-	tloadr	r0, DAT0 + 4

-	tmcsr	r0	

-	tloadr	r0, DAT0 + 12

-	tmov	r13, r0  

+    tloadr    r0, DAT0 + 4

+    tmcsr    r0    

+    tloadr    r0, DAT0 + 12

+    tmov    r13, r0  

 

-	tmov	r0, #0

-	tloadr	r1, DAT0 + 16

-	tloadr	r2, DAT0 + 20

+    tmov    r0, #0

+    tloadr    r1, DAT0 + 16

+    tloadr    r2, DAT0 + 20

 

 ZERO:

-	tcmp	r1, r2

-	tjge	ZERO_END

-	tstorer	r0, [r1, #0]

-	tadd    r1, #4

-	tj		ZERO

+    tcmp    r1, r2

+    tjge    ZERO_END

+    tstorer    r0, [r1, #0]

+    tadd    r1, #4

+    tj        ZERO

 ZERO_END:

 

-	tloadr	r1, DAT0 + 28

-	tloadr	r2, DAT0 + 32

+    tloadr    r1, DAT0 + 28

+    tloadr    r2, DAT0 + 32

 

 ZERO_TAG:

-	tcmp	r1, r2

-	tjge	ZERO_TAG_END

-	tstorer	r0, [r1, #0]

-	tadd    r1, #4

-	tj		ZERO_TAG

+    tcmp    r1, r2

+    tjge    ZERO_TAG_END

+    tstorer    r0, [r1, #0]

+    tadd    r1, #4

+    tj        ZERO_TAG

 ZERO_TAG_END:

 

 SETIC:

-	tloadr     	r1, DAT0 + 24

-	tloadr      r0, DAT0 + 36					@ IC tag start

-	tstorerb	r0, [r1, #0]

-	tadd    	r0, #1							@ IC tag end

-	tstorerb	r0, [r1, #1]

-	@tmov		r0, #0;

-	@tstorerb	r0, [r1, #2]

+    tloadr         r1, DAT0 + 24

+    tloadr      r0, DAT0 + 36                    @ IC tag start

+    tstorerb    r0, [r1, #0]

+    tadd        r0, #1                            @ IC tag end

+    tstorerb    r0, [r1, #1]

+    @tmov        r0, #0;

+    @tstorerb    r0, [r1, #2]

 

 

-	tloadr		r1, DATA_I

-	tloadr		r2, DATA_I+4

-	tloadr		r3, DATA_I+8

+    tloadr        r1, DATA_I

+    tloadr        r2, DATA_I+4

+    tloadr        r3, DATA_I+8

 COPY_DATA:

-	tcmp		r2, r3

-	tjge		COPY_DATA_END

-	tloadr		r0, [r1, #0]

-	tstorer 	r0, [r2, #0]

-	tadd    	r1, #4

-	tadd		r2, #4

-	tj			COPY_DATA

+    tcmp        r2, r3

+    tjge        COPY_DATA_END

+    tloadr        r0, [r1, #0]

+    tstorer     r0, [r2, #0]

+    tadd        r1, #4

+    tadd        r2, #4

+    tj            COPY_DATA

 COPY_DATA_END:

 

 #if 0

 SETSPISPEED:

-	tloadr     	r1, DAT0 + 36

-	tmov		r0, #0xbb		@0x0b for fast read; 0xbb for dual dat/adr

-	tstorerb	r0, [r1, #0]

-	tmov		r0, #3			@3 for dual dat/adr

-	tstorerb	r0, [r1, #1]

+    tloadr         r1, DAT0 + 36

+    tmov        r0, #0xbb        @0x0b for fast read; 0xbb for dual dat/adr

+    tstorerb    r0, [r1, #0]

+    tmov        r0, #3            @3 for dual dat/adr

+    tstorerb    r0, [r1, #1]

 #endif

 

-	tjl	main

-END:	tj	END

+    tjl    main

+END:    tj    END

 

-	.balign	4

+    .balign    4

 DAT0:

-	.word	0x12			    @IRQ    @0

-	.word	0x13			    @SVC    @4

-	.word	(irq_stk + IRQ_STK_SIZE)

-	.word	(0x848000)		    @12  stack end

-	.word	(_start_bss_)               @16

-	.word	(_end_bss_)                 @20

-	.word	(0x80060c)                  @24

-	.word	_ictag_start_               @28		@ IC tag start

-	.word	_ictag_end_	            	@32		@ IC tag end

-	.word	_retention_data_size_div_256_		@36

-DATA_I:	

-	.word	_dstored_					@0

-	.word	_start_data_				@4

-	.word	_end_data_					@8

+    .word    0x12                @IRQ    @0

+    .word    0x13                @SVC    @4

+    .word    (irq_stk + IRQ_STK_SIZE)

+    .word    (0x848000)            @12  stack end

+    .word    (_start_bss_)               @16

+    .word    (_end_bss_)                 @20

+    .word    (0x80060c)                  @24

+    .word    _ictag_start_               @28        @ IC tag start

+    .word    _ictag_end_                    @32        @ IC tag end

+    .word    _retention_data_size_div_256_        @36

+DATA_I:    

+    .word    _dstored_                    @0

+    .word    _start_data_                @4

+    .word    _end_data_                    @8

 

 FLL_D:

-	.word	0xffffffff

-	.word	(_start_data_)

-	.word	(_start_data_ + 32)

-	.word   (_retention_data_start_)    @16

+    .word    0xffffffff

+    .word    (_start_data_)

+    .word    (_start_data_ + 32)

+    .word   (_retention_data_start_)    @16

     .word   (_retention_data_end_)      @20

     .word   (_rstored_)                 @24

-    .word	(_ram_use_size_div_16_)

+    .word    (_ram_use_size_div_16_)

     @.word   (0x544c4e4b)

 

 

 

 BOOT_SEL_D:

-	.word	(0x80063e)

+    .word    (0x80063e)

 

 FLASH_RECOVER:

-	.word	(0x80000c)                  @0

+    .word    (0x80000c)                  @0

 

-	.align 4

+    .align 4

 __irq:

-	tpush    	{r14}

-	tpush    	{r0-r7}

-	tmrss    	r0

-	

-	tmov		r1, r8

-	tmov		r2, r9

-	tmov		r3, r10

-	tmov		r4, r11

-	tmov		r5, r12

-	tpush		{r0-r5}

-	

-	tjl      	irq_handler

+    tpush        {r14}

+    tpush        {r0-r7}

+    tmrss        r0

 

-	tpop		{r0-r5}

-	tmov		r8, r1

-	tmov		r9, r2

-	tmov		r10,r3

-	tmov		r11,r4

-	tmov		r12,r5

+    tmov        r1, r8

+    tmov        r2, r9

+    tmov        r3, r10

+    tmov        r4, r11

+    tmov        r5, r12

+    tpush        {r0-r5}

 

-	tmssr    	r0

-	tpop		{r0-r7}

-	treti    	{r15}

+    tjl          irq_handler

+

+    tpop        {r0-r5}

+    tmov        r8, r1

+    tmov        r9, r2

+    tmov        r10,r3

+    tmov        r11,r4

+    tmov        r12,r5

+

+    tmssr        r0

+    tpop        {r0-r7}

+    treti        {r15}

 

 ASMEND:

 

-	.section .bss

-	.align 4

-	.lcomm irq_stk, IRQ_STK_SIZE

-	.end

+    .section .bss

+    .align 4

+    .lcomm irq_stk, IRQ_STK_SIZE

+    .end

 

 #endif

diff --git a/common/string.h b/common/string.h
index 93ceb49..cb4639f 100644
--- a/common/string.h
+++ b/common/string.h
@@ -23,8 +23,10 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+#ifndef COMMON_STRING_H_
+#define COMMON_STRING_H_
 
-#pragma once
+
 
 void *  memmove(void * dest, const void * src, unsigned int n);
 void *  memset(void * d, int c, unsigned int  n);
@@ -59,4 +61,4 @@
 void * memset4(void * dest, int val, unsigned int len);
 void zeromem4(void *data, unsigned int len);
 
-
+#endif /* COMMON_STRING_H_ */
diff --git a/common/usb_dbg/myudb.h b/common/usb_dbg/myudb.h
new file mode 100644
index 0000000..ad7af06
--- /dev/null
+++ b/common/usb_dbg/myudb.h
@@ -0,0 +1,90 @@
+/********************************************************************************************************
+ * @file    myudb.h
+ *
+ * @brief    This is the header file for B85
+ *
+ * @author    BLE GROUP
+ * @date    06,2020
+ *
+ * @par        Copyright (c) 2020, Telink Semiconductor (Shanghai) Co., Ltd.
+ *            All rights reserved.
+ *
+ *          The information contained herein is confidential property of Telink
+ *          Semiconductor (Shanghai) Co., Ltd. and is available under the terms
+ *          of Commercial License Agreement between Telink Semiconductor (Shanghai)
+ *          Co., Ltd. and the licensee or the terms described here-in. This heading
+ *          MUST NOT be removed from this file.
+ *
+ *          Licensee shall not delete, modify or alter (or permit any third party to delete, modify, or
+ *          alter) any information contained herein in whole or in part except as expressly authorized
+ *          by Telink semiconductor (shanghai) Co., Ltd. Otherwise, licensee shall be solely responsible
+ *          for any claim to the extent arising out of or relating to such deletion(s), modification(s)
+ *          or alteration(s).
+ *
+ *          Licensees are granted free, non-transferable use of the information in this
+ *          file under Mutual Non-Disclosure Agreement. NO WARRENTY of ANY KIND is provided.
+ *
+ *******************************************************************************************************/
+#ifndef        __MYUDB_H__
+#define        __MYUDB_H__
+#pragma once
+
+
+#define my_usb_init(id, p_print)
+#define    usb_send_str(s)
+#define    usb_send_data(p,n)
+#define my_dump_str_data(en,s,p,n)
+#define my_dump_str_u32s(en,s,d0,d1,d2,d3)
+#define my_uart_send_str_data
+#define    my_uart_send_str_int
+#define    myudb_usb_handle_irq()
+
+
+
+#define    log_hw_ref()
+
+// 4-byte sync word: 00 00 00 00
+#define    log_sync(en)
+//4-byte (001_id-5bits) id0: timestamp align with hardware gpio output; id1-31: user define
+#define    log_tick(en,id)
+
+//1-byte (000_id-5bits)
+//#define    log_event(en,id)
+
+//1-byte (01x_id-5bits) 1-bit data: id0 & id1 reserved for hardware
+#define    log_task(en,id,b)
+
+//2-byte (10-id-6bits) 8-bit data
+#define    log_b8(en,id,d)
+
+//3-byte (11-id-6bits) 16-bit data
+#define    log_b16(en,id,d)
+
+
+
+
+#define    log_tick_irq(en,id)
+#define    log_tick_irq_2(en,id,t)
+
+
+#define    log_event_irq(en,id)
+
+
+#define    log_task_irq(en,id,b)
+
+#define    log_task_begin_irq(en,id)
+#define    log_task_end_irq(en,id)
+
+#define    log_task_begin_irq_2(en,id,t)
+#define    log_task_end_irq_2(en,id,t)
+
+
+
+#define    log_b8_irq(en,id,d)
+
+#define    log_b16_irq(en,id,d)
+
+
+
+
+#endif
diff --git a/common/utility.h b/common/utility.h
index 9662979..b236dbc 100644
--- a/common/utility.h
+++ b/common/utility.h
@@ -156,5 +156,28 @@
 void my_fifo_pop (my_fifo_t *f);
 u8 * my_fifo_get (my_fifo_t *f);
 
+static inline u64 mul64_32x32(u32 u, u32 v)
+{
+#if 1
+    u32  u0,   v0,   w0;
+    u32  u1,   v1,   w1,   w2,   t;
+    u32  x, y;
+    u0   =   u & 0xFFFF;
+    u1   =   u >> 16;
+    v0   =   v & 0xFFFF;
+    v1   =   v >> 16;
+    w0   =   u0 * v0;
+    t    =   u1 * v0 + (w0 >> 16);
+    w1   =   t & 0xFFFF;
+    w2   =   t >> 16;
+    w1   =   u0 * v1 + w1;
+    x = u1 * v1 + w2 + (w1 >> 16);
+    y = u * v;
+    return(((u64)x << 32) | y);
+#else //Eagle HW support this process
+    return (u64)u*v;
+#endif
+}
 #define        MYFIFO_INIT(name,size,n)        u8 name##_b[size * n]={0};my_fifo_t name = {size,n,0,0, name##_b}
+#define        ATT_ALIGN4_DMA_BUFF(n)            (((n + 10) + 3) / 4 * 4)
 
diff --git a/config.h b/config.h
index 4a4d606..a5d7d8b 100644
--- a/config.h
+++ b/config.h
@@ -24,35 +24,33 @@
  *
  *****************************************************************************/
 
+
 #pragma once
 
 
-#define    CHIP_TYPE_8255      1
-#define    CHIP_TYPE_8258      2
-#define    CHIP_TYPE_8278      3
-
+#define	CHIP_TYPE_825x  	1
+#define CHIP_TYPE_827x      2
+#define	CHIP_TYPE_9518		5
 
 #ifndef CHIP_TYPE
-#define    CHIP_TYPE             1000
+#define	CHIP_TYPE 			CHIP_TYPE_825x
 #endif
 
 
+#define	MCU_CORE_825x 		1
+#define	MCU_CORE_8258 		1
+#define MCU_CORE_827x       2
+#define MCU_CORE_8278       2
 
+#define	MCU_CORE_9518 		5
 
-
-
-#define    MCU_CORE_8255         1
-#define    MCU_CORE_8258         2
-#define    MCU_CORE_8278         3
-
-#if(CHIP_TYPE == CHIP_TYPE_8255)
-    #define MCU_CORE_TYPE    MCU_CORE_8255
-#elif(CHIP_TYPE == CHIP_TYPE_8258)
-    #define MCU_CORE_TYPE    MCU_CORE_8258
-#elif(CHIP_TYPE == CHIP_TYPE_8278)
-    #define MCU_CORE_TYPE    MCU_CORE_8278
+#if(CHIP_TYPE == CHIP_TYPE_825x)
+	#define MCU_CORE_TYPE	MCU_CORE_825x
+#elif(CHIP_TYPE == CHIP_TYPE_827x)
+	#define MCU_CORE_TYPE	MCU_CORE_827x
 #else
-    #define MCU_CORE_TYPE    1000
+	#define MCU_CORE_TYPE	1000
 #endif
 
 
+
diff --git a/drivers.h b/drivers.h
index 463dca5..8196e09 100644
--- a/drivers.h
+++ b/drivers.h
@@ -28,12 +28,16 @@
 
 #include "config.h"
 
-#if(__TL_LIB_8255__ || (MCU_CORE_TYPE == MCU_CORE_8255))
-#include "drivers/8255/driver_8255.h"
-#elif(__TL_LIB_8258__ || (MCU_CORE_TYPE == MCU_CORE_8258))
-#include "drivers/8258/driver_8258.h"
-#elif(__TL_LIB_8278__ || (MCU_CORE_TYPE == MCU_CORE_8278))
-#include "drivers/8278/driver_8278.h"
+#if(MCU_CORE_TYPE == MCU_CORE_825x)
+	#include "drivers/8258/driver_8258.h"
+	#include "drivers/8258/driver_ext/ext_rf.h"
+	#include "drivers/8258/driver_ext/ext_pm.h"
+	#include "drivers/8258/driver_ext/ext_misc.h"
+#elif(MCU_CORE_TYPE == MCU_CORE_827x)
+	#include "drivers/8278/driver_8278.h"
+	#include "drivers/8278/driver_ext/ext_rf.h"
+	#include "drivers/8278/driver_ext/ext_pm.h"
+	#include "drivers/8278/driver_ext/ext_misc.h"
 #else
-#include "drivers/8258/driver_8258.h"
+	#error MCU core typr error !
 #endif
diff --git a/drivers/8278/adc.c b/drivers/8278/adc.c
index e4fb8e4..969fec3 100644
--- a/drivers/8278/adc.c
+++ b/drivers/8278/adc.c
@@ -194,7 +194,6 @@
 }
 
 
-const unsigned char  VBAT_Scale_tab[4] = {1,4,3,2};
 
 /**
  * @brief This function is used for ADC configuration of ADC IO voltage sampling.
diff --git a/drivers/8278/adc.h b/drivers/8278/adc.h
index c571cb4..be7474d 100644
--- a/drivers/8278/adc.h
+++ b/drivers/8278/adc.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #pragma once
 #include "bsp.h"
 #include "analog.h"
diff --git a/drivers/8278/analog.c b/drivers/8278/analog.c
index 7de88d9..ecd78d4 100644
--- a/drivers/8278/analog.c
+++ b/drivers/8278/analog.c
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 
-
 #include "analog.h"
 
 #include "compiler.h"
@@ -45,7 +44,7 @@
  * @param[in]  addr - address need to be read.
  * @return     the result of read.
  */
-_attribute_ram_code_ unsigned char analog_read(unsigned char addr){
+_attribute_ram_code_sec_noinline_ unsigned char analog_read(unsigned char addr){
     unsigned char r = irq_disable();
 
     reg_ana_addr = addr;
@@ -63,7 +62,7 @@
  * @param[in]  v - the value need to be write.
  * @return     none.
  */
-_attribute_ram_code_ void analog_write(unsigned char addr, unsigned char v){
+_attribute_ram_code_sec_noinline_ void analog_write(unsigned char addr, unsigned char v){
     unsigned char r = irq_disable();
 
     reg_ana_addr = addr;
diff --git a/drivers/8278/audio.c b/drivers/8278/audio.c
index b9508cf..f2f6900 100644
--- a/drivers/8278/audio.c
+++ b/drivers/8278/audio.c
@@ -482,6 +482,8 @@
  */
 void audio_set_i2s_output(AudioInput_Typedef InType,AudioRate_Typedef Audio_Rate)
 {
+
+    //volatile unsigned int i;
     //if system clock=24M_Crystal. PWM0 2 frequency division output, for 12Mhz to offer the MCLK of CORDEC. select pd5 as PWM0 output.
     sub_wr(0x5af, 0x0, 3, 2); //PD5=0
     sub_wr(0x59e, 0x0, 5, 5); //PD5=0
diff --git a/drivers/8278/audio.h b/drivers/8278/audio.h
index cd3646c..6688d67 100644
--- a/drivers/8278/audio.h
+++ b/drivers/8278/audio.h
@@ -200,6 +200,7 @@
 
 void audio_set_codec(I2C_GPIO_SdaTypeDef sda_pin,I2C_GPIO_SclTypeDef scl_pin, CodecMode_Typedef CodecMode,unsigned sysclk);
 
+
 /**
  *     @brief     This function serves to set MUTE PGA.
  *     @param[in] ebable - enable or disable MUTE PGA
@@ -217,4 +218,5 @@
         analog_write(codec_ana_cfg2,analog_read(codec_ana_cfg2) & ~BIT(5));//0a//2a
     }
 }
+
 #endif
diff --git a/drivers/8278/bsp.h b/drivers/8278/bsp.h
index 071ddf5..260268a 100644
--- a/drivers/8278/bsp.h
+++ b/drivers/8278/bsp.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #ifndef BSP_H_
 #define BSP_H_
 
diff --git a/drivers/8278/clock.c b/drivers/8278/clock.c
index 371939a..293157e 100644
--- a/drivers/8278/clock.c
+++ b/drivers/8278/clock.c
@@ -67,7 +67,7 @@
  * @return      none
  */
 #if (BLC_PM_DEEP_RETENTION_MODE_EN)
-_attribute_ram_code_
+_attribute_ram_code_sec_noinline_
 #endif
 void clock_init(SYS_CLK_TypeDef SYS_CLK)
 {
@@ -77,7 +77,7 @@
 #if 0 //vulture is normal
     if(SYS_CLK == SYS_CLK_48M_Crystal)
     {
-        /*default c4: dcdc 1.8V  -> GD flash£º 48M clock may error £¬ need higher DCDC voltage
+        /*default c4: dcdc 1.8V  -> GD flash 48M clock may error  need higher DCDC voltage
                   c6: dcdc 1.9V
         */
         analog_write(0x0c, 0xc6);
diff --git a/drivers/8278/compiler.h b/drivers/8278/compiler.h
index b5e923b..d17c626 100644
--- a/drivers/8278/compiler.h
+++ b/drivers/8278/compiler.h
@@ -36,10 +36,8 @@
 #define _attribute_no_inline_           __attribute__((noinline))
 #define _inline_                         inline
 
-
-#ifndef    BLC_PM_EN
-#define    BLC_PM_EN                            1
-#endif
+#define _attribute_ram_code_sec_              __attribute__((section(".ram_code")))
+#define _attribute_ram_code_sec_noinline_    __attribute__((section(".ram_code"))) __attribute__((noinline))
 
 #ifndef    BLC_PM_DEEP_RETENTION_MODE_EN
 #define    BLC_PM_DEEP_RETENTION_MODE_EN        1
@@ -47,8 +45,10 @@
 
 #if (BLC_PM_DEEP_RETENTION_MODE_EN)
     #define _attribute_data_retention_       _attribute_session_(".retention_data")
+    #define _attribute_data_no_init_           _attribute_session_(".data_no_init")    //save retention ram size
 #else
     #define _attribute_data_retention_
+    #define _attribute_data_no_init_
 #endif
 
 
diff --git a/drivers/8278/dfifo.h b/drivers/8278/dfifo.h
index 536eff7..6b607a4 100644
--- a/drivers/8278/dfifo.h
+++ b/drivers/8278/dfifo.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #ifndef     DFIFO_H
 #define     DFIFO_H
 
diff --git a/drivers/8278/driver_8278.h b/drivers/8278/driver_8278.h
index 613cd7d..e6414ce 100644
--- a/drivers/8278/driver_8278.h
+++ b/drivers/8278/driver_8278.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #pragma once
 
 
@@ -57,7 +58,8 @@
 #include "drivers/8278/qdec.h"
 #include "drivers/8278/lpc.h"
 
+#include "drivers/8278/pke.h"
 
 #include "drivers/8278/rf_pa.h"
 
-#include "drivers/8278/pke.h"
+#include "drivers/8278/flash/flash_type.h"
diff --git a/drivers/8278/driver_ext/ext_misc.h b/drivers/8278/driver_ext/ext_misc.h
new file mode 100644
index 0000000..2af137a
--- /dev/null
+++ b/drivers/8278/driver_ext/ext_misc.h
@@ -0,0 +1,128 @@
+/******************************************************************************
+ * @file     ext_misc.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef DRIVERS_8278_EXT_MISC_H_
+#define DRIVERS_8278_EXT_MISC_H_
+#include "../register_8278.h"
+
+/******************************* stimer_start ******************************************************************/
+//#define reg_system_tick_irq         REG_ADDR32(0x744)//reg_system_tick_irq_level
+enum {
+    FLD_SYSTEM_TICK_IRQ_EN  =         BIT(2),
+};
+
+
+enum{
+    FLD_DMA_RPTR_MASK =            0x0F, // max 15
+};
+
+
+/**
+ * @brief    This function serves to set system timer capture tick.
+ * @return  none
+ */
+void systimer_set_irq_capture(unsigned int sys_timer_tick);
+
+/**
+ * @brief    This function serves to get system timer capture tick.
+ * @return  none
+ */
+static inline unsigned int systimer_get_irq_capture(void)
+{
+    return reg_system_tick_irq;
+}
+
+/**
+ * @brief    This function serves to set system timer interrupt mask.
+ * @return  none
+ */
+static inline void systimer_set_irq_mask(void)
+{
+    reg_system_irq_mask |= FLD_SYSTEM_TICK_IRQ_EN;
+}
+
+/**
+ * @brief    This function serves to enable system timer interrupt.
+ * @return  none
+ */
+static inline void systimer_irq_enable(void)
+{
+    reg_irq_mask |= FLD_IRQ_SYSTEM_TIMER;
+}
+
+/**
+ * @brief    This function serves to disable system timer interrupt.
+ * @return  none
+ */
+static inline void systimer_irq_disable(void)
+{
+    reg_irq_mask &= ~FLD_IRQ_SYSTEM_TIMER;
+}
+
+/**
+ * @brief    This function serves to clear system timer interrupt status.
+ * @return  none
+ */
+static inline void systimer_clr_irq_status(void)
+{
+    reg_irq_src = FLD_IRQ_SYSTEM_TIMER;
+}
+
+/**
+ * @brief    This function serves to get system timer interrupt status.
+ * @return  none
+ */
+static inline unsigned int systimer_get_irq_status(void)
+{
+    return reg_irq_src & FLD_IRQ_SYSTEM_TIMER;
+}
+
+static inline int tick1_exceed_tick2(unsigned int tick1, unsigned int tick2)
+{
+    return (unsigned int)(tick1 - tick2) < BIT(30);
+}
+
+/*
+ * @brief     This function performs to get system timer tick.
+ * @param[in] none.
+ * @return    system timer tick value.
+**/
+static inline unsigned int sys_get_stimer_tick(void)
+{
+    return reg_system_tick; //same as API: clock_time()
+}
+
+/******************************* stimer_end ********************************************************************/
+
+
+#include "../analog.h"
+#define  analog_write_reg8  analog_write
+#define  analog_read_reg8   analog_read
+
+#endif
+
+
+
+
diff --git a/drivers/8278/driver_ext/ext_pm.h b/drivers/8278/driver_ext/ext_pm.h
new file mode 100644
index 0000000..71d01ab
--- /dev/null
+++ b/drivers/8278/driver_ext/ext_pm.h
@@ -0,0 +1,32 @@
+/******************************************************************************
+ * @file     ext_pm.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef DRIVERS_8278_EXT_PM_H_
+#define DRIVERS_8278_EXT_PM_H_
+
+
+
+#endif
+
diff --git a/drivers/8278/driver_ext/ext_rf.h b/drivers/8278/driver_ext/ext_rf.h
new file mode 100644
index 0000000..2bfb640
--- /dev/null
+++ b/drivers/8278/driver_ext/ext_rf.h
@@ -0,0 +1,69 @@
+/******************************************************************************
+ * @file     ext_rf.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef DRIVERS_8278_EXT_RF_H_
+#define DRIVERS_8278_EXT_RF_H_
+
+
+enum{
+    FLD_RF_R_CMD                 =    BIT_RNG(0,3),
+    FLD_RF_R_STOP                =    0,
+    FLD_RF_R_BTX                 =    1,
+    FLD_RF_R_BRX                 =    2,
+    FLD_RF_R_PTX                 =    3,
+    FLD_RF_R_PRX                 =    4,
+    FLD_RF_R_STX                 =    5,
+    FLD_RF_R_SRX                 =    6,
+    FLD_RF_R_STR                 =    7,
+    FLD_RF_R_SRT                 =    8,
+    FLD_RF_R_CMD_TRIG            =  BIT(7),
+};
+
+
+/**
+ * @brief   This function serves to triggle accesscode in coded Phy mode.
+ * @param   none.
+ * @return  none.
+ */
+static inline void rf_trigle_codedPhy_accesscode(void)
+{
+    WRITE_REG8(0x405, REG_ADDR8(0x405) | BIT(7)); //reg_rf_acc_len |= FLD_RF_LR_ACC_TRIG;
+}
+
+
+
+#define        rf_receiving_flag                is_rf_receiving_pkt ///static inline
+#define        rf_tx_settle_adjust                tx_settle_adjust    ///static inline
+
+#define     RF_TX_PAKET_DMA_LEN(len)        (len)
+
+#define     RF_BLE_RF_PAYLOAD_LENGTH_OK        RF_BLE_PACKET_LENGTH_OK
+#define     RF_BLE_RF_PACKET_CRC_OK            RF_BLE_PACKET_CRC_OK
+
+#define     reg_rf_ll_cmd_schedule             REG_ADDR32(0xf18)
+#define     reg_rf_ll_cmd                    REG_ADDR8(0xf00)
+
+#endif
+
diff --git a/drivers/8278/emi.c b/drivers/8278/emi.c
index 340905c..fa5b157 100644
--- a/drivers/8278/emi.c
+++ b/drivers/8278/emi.c
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #include "emi.h"
 #include "clock.h"
 #include "timer.h"
diff --git a/drivers/8278/emi.h b/drivers/8278/emi.h
index 4516783..f887748 100644
--- a/drivers/8278/emi.h
+++ b/drivers/8278/emi.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #ifndef EMI_H_
 #define EMI_H_
 
diff --git a/drivers/8278/flash.c b/drivers/8278/flash.c
index 408449c..4c95880 100644
--- a/drivers/8278/flash.c
+++ b/drivers/8278/flash.c
@@ -24,18 +24,45 @@
  *
  *****************************************************************************/
 
-
 #include "flash.h"
 #include "spi_i.h"
 #include "irq.h"
 #include "timer.h"
+#include "../../common/string.h"
 #include "watchdog.h"
+/*
+ *    If add flash type, need pay attention to the read uid command and the bit number of status register
+    Flash Type    uid CMD            MID        Company        Sector Erase Time(MAX)
+    GD25LD10C    0x4b(AN)    0x1160C8    GD            500ms
+    GD25LD40C    0x4b        0x1360C8    GD            500ms
+    GD25LD80C    0x4b(AN)    0x1460C8    GD            500ms
+    P25D40L        0x4b        0x136085    PUYA        20ms
+    TH25D40LA    0x4b        0x1360EB    UT            12ms
+    ZB25WD10A    0x4b        0x11325E    ZB            500ms
+    ZB25WD40B    0x4b        0x13325E    ZB            500ms
+    ZB25WD80B    0x4b        0x14325E    ZB            500ms
+    ZB25WD20A    0x4b        0x12325E    ZB            500ms    The actual capacity is 256K, but the nominal value is 128KB.
+                                            The software cannot do capacity adaptation and requires special customer special processing.
 
+    The uid of the early ZB25WD40B (mid is 0x13325E) is 8 bytes. If you read 16 bytes of uid,
+    the next 8 bytes will be read as 0xff. Later, the uid of ZB25WD40B has been switched to 16 bytes.
+ */
+unsigned int flash_support_mid[] = {0x1160C8, 0x1360C8, 0x1460C8, 0x11325E, 0x12325E, 0x13325E, 0x14325E, 0x136085, 0x1360EB};
+const unsigned int FLASH_CNT = sizeof(flash_support_mid)/sizeof(*flash_support_mid);
 
+flash_hander_t flash_read_page = flash_read_data;
+flash_hander_t flash_write_page = flash_page_program;
+
+_attribute_data_retention_      unsigned int  flash_type = 0;
+_attribute_data_retention_      unsigned int  get_flash_mid = FLASH_ETOX_GD;
 _attribute_data_retention_   _attribute_aligned_(4)    Flash_CapacityDef    flash_capacity;
 
-_attribute_ram_code_ static inline int flash_is_busy(){
-    return mspi_read() & 0x01;                //  the busy bit, pls check flash spec
+/**
+ * @brief        This function to determine whether the flash is busy..
+ * @return        1:Indicates that the flash is busy. 0:Indicates that the flash is free
+ */
+_attribute_ram_code_sec_ static inline int flash_is_busy(){
+    return mspi_read() & 0x01;        //the busy bit, pls check flash spec
 }
 
 /**
@@ -43,7 +70,7 @@
  * @param[in] cmd - set command.
  * @return    none
  */
-_attribute_ram_code_ static void flash_send_cmd(unsigned char cmd){
+_attribute_ram_code_sec_noinline_ static void flash_send_cmd(unsigned char cmd){
     mspi_high();
     sleep_us(1);
     mspi_low();
@@ -56,7 +83,7 @@
  * @param[in] addr - the flash address.
  * @return    none
  */
-_attribute_ram_code_ static void flash_send_addr(unsigned int addr){
+_attribute_ram_code_sec_noinline_ static void flash_send_addr(unsigned int addr){
     mspi_write((unsigned char)(addr>>16));
     mspi_wait();
     mspi_write((unsigned char)(addr>>8));
@@ -66,15 +93,14 @@
 }
 
 /**
- * @brief     This function serves to wait flash done.
- *            (make this a asynchronous version).
+ * @brief     This function serves to wait flash done.(make this a asynchronous version).
  * @param[in] none.
  * @return    none.
  */
-_attribute_ram_code_ static void flash_wait_done(void)
+_attribute_ram_code_sec_noinline_ static void flash_wait_done(void)
 {
     sleep_us(100);
-    flash_send_cmd(FLASH_READ_STATUS_CMD);
+    flash_send_cmd(FLASH_READ_STATUS_CMD_LOWBYTE);
 
     int i;
     for(i = 0; i < 10000000; ++i){
@@ -85,416 +111,336 @@
     mspi_high();
 }
 
-
 /**
- * @brief This function serves to erase a sector.
- * @param[in]   addr the start address of the sector needs to erase.
- * @return none
+ * @brief         This function is used to read data from flash or read the status of flash.
+ * @param[in]   cmd            - the read command.
+ * @param[in]   addr        - starting address.
+ * @param[in]   addr_en        - whether need to send an address.
+ * @param[in]   dummy_cnt    - the length(in byte) of dummy.
+ * @param[out]  data        - the start address of the data buffer.
+ * @param[in]   data_len    - the length(in byte) of content needs to read out.
+ * @return         none.
  */
-_attribute_ram_code_ void flash_erase_sector(unsigned long addr){
-    unsigned char r = irq_disable();
-
-    wd_clear();
-
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_SECT_ERASE_CMD);
-    flash_send_addr(addr);
-    mspi_high();
-    flash_wait_done();
-
-    irq_restore(r);
-}
-
-
-/**
- * @brief This function writes the buffer's content to a page.
- * @param[in]   addr the start address of the page
- * @param[in]   len the length(in byte) of content needs to write into the page
- * @param[in]   buf the start address of the content needs to write into
- * @return none
- */
-_attribute_ram_code_ void flash_write_page(unsigned long addr, unsigned long len, unsigned char *buf){
-    unsigned char r = irq_disable();
-
-    // important:  buf must not reside at flash, such as constant string.  If that case, pls copy to memory first before write
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_WRITE_CMD);
-    flash_send_addr(addr);
-
-    unsigned int i;
-    for(i = 0; i < len; ++i){
-        mspi_write(buf[i]);        /* write data */
-        mspi_wait();
-    }
-    mspi_high();
-    flash_wait_done();
-
-    irq_restore(r);
-}
-
-/**
- * @brief This function reads the content from a page to the buf.
- * @param[in]   addr the start address of the page
- * @param[in]   len the length(in byte) of content needs to read out from the page
- * @param[out]  buf the start address of the buffer
- * @return none
- */
-_attribute_ram_code_ void flash_read_page(unsigned long addr, unsigned long len, unsigned char *buf){
-    unsigned char r = irq_disable();
-
-
-    flash_send_cmd(FLASH_READ_CMD);
-    flash_send_addr(addr);
-
-    mspi_write(0x00);        /* dummy,  to issue clock */
-    mspi_wait();
-    mspi_ctrl_write(0x0a);    /* auto mode */
-    mspi_wait();
-    /* get data */
-    for(int i = 0; i < len; ++i){
-        *buf++ = mspi_get();
-        mspi_wait();
-    }
-    mspi_high();
-
-    irq_restore(r);
-}
-
-
-
-/**
- * @brief      MAC id. Before reading UID of flash, you must read MID of flash. and then you can
- *            look up the related table to select the idcmd and read UID of flash
- * @param[in] buf - store MID of flash
- * @return    none.
- */
-_attribute_ram_code_ void flash_read_mid(unsigned char *buf){
-    unsigned char j = 0;
-    unsigned char r = irq_disable();
-    flash_send_cmd(FLASH_GET_JEDEC_ID);
-    mspi_write(0x00);        /* dummy,  to issue clock */
-    mspi_wait();
-    mspi_ctrl_write(0x0a);    /* auto mode */
-    mspi_wait();
-
-    for(j = 0; j < 3; ++j){
-        *buf++ = mspi_get();
-        mspi_wait();
-    }
-    mspi_high();
-
-    irq_restore(r);
-}
-
-
-/* according to your appliaction */
-#if 0
-
-/**
- * @brief This function serves to erase a page(256 bytes).
- * @param[in]   addr the start address of the page needs to erase.
- * @return none
- */
-_attribute_ram_code_ void flash_erase_page(unsigned int addr)
+_attribute_ram_code_sec_noinline_ void flash_mspi_read_ram(unsigned char cmd, unsigned long addr, unsigned char addr_en, unsigned char dummy_cnt, unsigned char *data, unsigned long data_len)
 {
     unsigned char r = irq_disable();
 
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_PAGE_ERASE_CMD);
-    flash_send_addr(addr);
-    mspi_high();
-    flash_wait_done();
-
-    irq_restore(r);
-}
-
-/**
- * @brief This function serves to erase a block(32k).
- * @param[in]   addr the start address of the block needs to erase.
- * @return none
- */
-_attribute_ram_code_ void flash_erase_32kblock(unsigned int addr)
-{
-    unsigned char r = irq_disable();
-
-    wd_clear();
-
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_32KBLK_ERASE_CMD);
-    flash_send_addr(addr);
-    mspi_high();
-    flash_wait_done();
-
-    irq_restore(r);
-}
-
-/**
- * @brief This function serves to erase a block(64k).
- * @param[in]   addr the start address of the block needs to erase.
- * @return none
- */
-_attribute_ram_code_ void flash_erase_64kblock(unsigned int addr)
-{
-    unsigned char r = irq_disable();
-
-    wd_clear();
-
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_64KBLK_ERASE_CMD);
-    flash_send_addr(addr);
-    mspi_high();
-    flash_wait_done();
-
-    irq_restore(r);
-}
-
-/**
- * @brief This function serves to erase a page(256 bytes).
- * @param[in]   addr the start address of the page needs to erase.
- * @return none
- */
-_attribute_ram_code_ void flash_erase_chip(void)
-{
-    unsigned char r = irq_disable();
-
-    wd_clear();
-
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_CHIP_ERASE_CMD);
-    mspi_high();
-    flash_wait_done();
-
-    irq_restore(r);
-}
-
-/**
- * @brief This function write the status of flash.
- * @param[in]  the value of status
- * @return status
- */
-_attribute_ram_code_ unsigned char flash_write_status(unsigned char data)
-{
-    unsigned char r = irq_disable();
-    unsigned char result;
-    //int i;
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_WRITE_STATUS_CMD);
-    mspi_write(data);
-    mspi_wait();
-    mspi_high();
-    flash_wait_done();
-
-    sleep_us(100);
-    flash_send_cmd(FLASH_READ_STATUS_CMD);
-
-    result = mspi_read();
-    mspi_high();
-
-    irq_restore(r);
-    return  result;
-}
-
-/**
- * @brief This function reads the status of flash.
- * @param[in]  none
- * @return none
- */
-_attribute_ram_code_ unsigned char flash_read_status(void){
-    unsigned char r = irq_disable();
-    unsigned char status =0;
-    flash_send_cmd(FLASH_READ_STATUS_CMD);
-    /* get low 8 bit status */
-    status = mspi_read();
-    mspi_high();
-    irq_restore(r);
-    return status;
-}
-
-
-
-
-/**
- * @brief      Deep Power Down mode to put the device in the lowest consumption mode
- *             it can be used as an extra software protection mechanism,while the device
- *             is not in active use,since in the mode,  all write,Program and Erase commands
- *             are ignored,except the Release from Deep Power-Down and Read Device ID(RDI)
- *             command.This release the device from this mode
- * @param[in] none
- * @return none.
- */
-_attribute_ram_code_ void flash_deep_powerdown(void)
-{
-    unsigned char r = irq_disable();
-
-    flash_send_cmd(FLASH_POWER_DOWN);
-    mspi_high();
-    sleep_us(1);
-
-    irq_restore(r);
-}
-
-/**
- * @brief        The Release from Power-Down or High Performance Mode/Device ID command is a
- *                 Multi-purpose command.it can be used to release the device from the power-Down
- *                 State or High Performance Mode or obtain the devices electronic identification
- *                 (ID)number.Release from Power-Down will take the time duration of tRES1 before
- *                 the device will resume normal operation and other command are accepted.The CS#
- *                 pin must remain high during the tRES1(8us) time duration.
- * @param[in] none
- * @return none.
- */
-_attribute_ram_code_ void flash_release_deep_powerdown(void)
-{
-    unsigned char r = irq_disable();
-
-    flash_send_cmd(FLASH_POWER_DOWN_RELEASE);
-    mspi_high();
-    flash_wait_done();
-    mspi_high();
-
-    irq_restore(r);
-}
-
-/**
- * @brief      UID. Before reading UID of flash, you must read MID of flash. and then you can
- *            look up the related table to select the idcmd and read UID of flash
- * @param[in] idcmd - get this value to look up the table based on MID of flash
- * @param[in] buf   - store UID of flash
- * @return    none.
- */
-_attribute_ram_code_ void flash_read_uid(unsigned char idcmd,unsigned char *buf)
-{
-    unsigned char j = 0;
-    unsigned char r = irq_disable();
-    flash_send_cmd(idcmd);
-    if(idcmd==FLASH_GD_PUYA_READ_UID_CMD)                //< GD/puya
+    flash_send_cmd(cmd);
+    if(addr_en)
     {
-        flash_send_addr(0x00);
-        mspi_write(0x00);        /* dummy,  to issue clock */
-        mspi_wait();
+        flash_send_addr(addr);
     }
-    else if (idcmd==FLASH_XTX_READ_UID_CMD)        //< XTX
+    for(int i = 0; i < dummy_cnt; ++i)
     {
-        flash_send_addr(0x80);
-        mspi_write(0x00);        /* dummy,  to issue clock */
+        mspi_write(0x00);        /* dummy */
         mspi_wait();
-
     }
-    mspi_write(0x00);            /* dummy,  to issue clock */
+    mspi_write(0x00);            /* to issue clock */
     mspi_wait();
     mspi_ctrl_write(0x0a);        /* auto mode */
     mspi_wait();
-
-    for(j = 0; j < 16; ++j){
-        *buf++ = mspi_get();
+    for(int i = 0; i < data_len; ++i)
+    {
+        *data++ = mspi_get();
         mspi_wait();
     }
     mspi_high();
+
     irq_restore(r);
 }
-/**
- * @brief          This function serves to read flash mid and uid,and check the correctness of mid and uid.
- * @param[out]   flash_mid - Flash Manufacturer ID
- * @param[out]   flash_uid - Flash Unique ID
- * @return       0:error 1:ok
 
+/**
+ * @brief         This function is used to write data or status to flash.
+ * @param[in]   cmd            - the write command.
+ * @param[in]   addr        - starting address.
+ * @param[in]   addr_en        - whether need to send an address.
+ * @param[out]  data        - the start address of the data buffer.
+ * @param[in]   data_len    - the length(in byte) of content needs to read out.
+ * @return         none.
+ * @note        important:  "data" must not reside at flash, such as constant string.If that case, pls copy to memory first before write.
  */
-_attribute_ram_code_ int flash_read_mid_uid_with_check( unsigned int *flash_mid ,unsigned char *flash_uid)
+_attribute_ram_code_sec_noinline_ void flash_mspi_write_ram(unsigned char cmd, unsigned long addr, unsigned char addr_en, unsigned char *data, unsigned long data_len)
 {
-      unsigned char no_uid[16]={0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01};
-      int i,f_cnt=0;
-      unsigned int mid;
-      flash_read_mid((unsigned char*)&mid);
-      mid = mid&0xffff;
-      *flash_mid  = mid;
-      /*
-       Flash Type    CMD        MID      Company
-       GD25LD40C      0x4b     0x60C8     GD
-       GD25LD05C       0x4b       0x60C8     GD
-       P25Q40L        0x4b     0x6085     PUYA
-       MD25D40DGIG     0x4b     0x4051     GD
-       GD25D10C      0x4b     0x40C8     GD
-       PN25F04C      0x5a     0x311C     XTX
-      */
-      if( (mid == 0x60C8) || (mid == 0x6085) ||(mid == 0x4051)){
-          flash_read_uid(FLASH_GD_PUYA_READ_UID_CMD,(unsigned char *)flash_uid);
-      }
-      else if(mid==0x311C){
-          flash_read_uid(FLASH_XTX_READ_UID_CMD    ,(unsigned char *)flash_uid);
-      }
-      else{
-          return 0;
-      }
-      for(i=0;i<16;i++){
-        if(flash_uid[i]==no_uid[i]){
+    unsigned char r = irq_disable();
+
+    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
+    flash_send_cmd(cmd);
+    if(addr_en)
+    {
+        flash_send_addr(addr);
+    }
+    for(int i = 0; i < data_len; ++i)
+    {
+        mspi_write(data[i]);
+        mspi_wait();
+    }
+    mspi_high();
+    flash_wait_done();
+
+    irq_restore(r);
+}
+
+/**
+ * @brief         This function serves to erase a sector.
+ * @param[in]   addr    - the start address of the sector needs to erase.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_sector(unsigned long addr)
+{
+    wd_clear(); // add by BLE Team
+
+    flash_mspi_write_ram(FLASH_SECT_ERASE_CMD, addr, 1, 0, 0);
+}
+
+/**
+ * @brief         This function reads the content from a page to the buf.
+ * @param[in]   addr    - the start address of the page.
+ * @param[in]   len        - the length(in byte) of content needs to read out from the page.
+ * @param[out]  buf        - the start address of the buffer.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_data(unsigned long addr, unsigned long len, unsigned char *buf)
+{
+    flash_mspi_read_ram(FLASH_READ_CMD, addr, 1, 0, buf, len);
+}
+
+/**
+ * @brief         This function writes the buffer's content to the flash.
+ * @param[in]   addr    - the start address of the area.
+ * @param[in]   len        - the length(in byte) of content needs to write into the flash.
+ * @param[in]   buf        - the start address of the content needs to write into.
+ * @return         none.
+ * @note        the function support cross-page writing,which means the len of buf can bigger than 256.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_page_program(unsigned long addr, unsigned long len, unsigned char *buf)
+{
+    unsigned int ns = PAGE_SIZE - (addr&(PAGE_SIZE - 1));
+    int nw = 0;
+
+    do{
+        nw = len > ns ? ns :len;
+        flash_mspi_write_ram(FLASH_WRITE_CMD, addr, 1, buf, nw);
+        ns = PAGE_SIZE;
+        addr += nw;
+        buf += nw;
+        len -= nw;
+    }while(len > 0);
+}
+
+/**
+ * @brief        This function reads the status of flash.
+ * @param[in]     cmd    - the cmd of read status.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status(unsigned char cmd)
+{
+    unsigned char status = 0;
+    flash_mspi_read_ram(cmd, 0, 0, 0, &status, 1);
+    return status;
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      type    - the type of status.8 bit or 16 bit.
+ * @param[in]      data    - the value of status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status(flash_status_typedef_e type , unsigned short data)
+{
+    unsigned char buf[2];
+
+    buf[0] = data;
+    buf[1] = data>>8;
+    if(type == FLASH_TYPE_8BIT_STATUS){
+        flash_mspi_write_ram(FLASH_WRITE_STATUS_CMD_LOWBYTE, 0, 0, buf, 1);
+    }else if(type == FLASH_TYPE_16BIT_STATUS_ONE_CMD){
+        flash_mspi_write_ram(FLASH_WRITE_STATUS_CMD_LOWBYTE, 0, 0, buf, 2);
+    }
+}
+
+/**
+ * @brief          This function serves to read MID of flash(MAC id). Before reading UID of flash,
+ *                 you must read MID of flash. and then you can look up the related table to select
+ *                 the idcmd and read UID of flash.
+ * @return        MID of the flash(4 bytes).
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned int flash_read_mid(void)
+{
+    unsigned int flash_mid = 0;
+    flash_mspi_read_ram(FLASH_GET_JEDEC_ID, 0, 0, 0, (unsigned char*)(&flash_mid), 3);
+    return flash_mid;
+}
+
+/**
+ * @brief          This function serves to read UID of flash.Before reading UID of flash, you must read MID of flash.
+ *                 and then you can look up the related table to select the idcmd and read UID of flash.
+ * @param[in]     idcmd    - different flash vendor have different read-uid command. E.g: GD/PUYA:0x4B; XTX: 0x5A.
+ * @param[in]     buf        - store UID of flash.
+ * @return        none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_uid(unsigned char idcmd, unsigned char *buf)
+{
+    if(idcmd == FLASH_READ_UID_CMD_GD_PUYA_ZB_UT)    //< GD/PUYA/ZB/UT
+    {
+        flash_mspi_read_ram(idcmd, 0x00, 1, 1, buf, 16);
+    }
+    else if (idcmd == FLASH_XTX_READ_UID_CMD)        //< XTX
+    {
+        flash_mspi_read_ram(idcmd, 0x80, 1, 1, buf, 16);
+    }
+}
+
+/*******************************************************************************************************************
+ *                                                Secondary interface
+ ******************************************************************************************************************/
+
+/**
+ * @brief        This function serves to read flash mid and uid,and check the correctness of mid and uid.
+ * @param[out]    flash_mid    - Flash Manufacturer ID.
+ * @param[out]    flash_uid    - Flash Unique ID.
+ * @return        0: flash no uid or not a known flash model      1:the flash model is known and the uid is read.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+int flash_read_mid_uid_with_check(unsigned int *flash_mid, unsigned char *flash_uid)
+{
+    unsigned char no_uid[16]={0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01,0x51,0x01};
+    int i,f_cnt=0;
+    *flash_mid  = flash_read_mid();
+
+
+    for(i=0; i<FLASH_CNT; i++){
+        if(flash_support_mid[i] == *flash_mid){
+            flash_read_uid(FLASH_READ_UID_CMD_GD_PUYA_ZB_UT, (unsigned char *)flash_uid);
+            break;
+        }
+    }
+    if(i == FLASH_CNT){
+        return 0;
+    }
+
+    for(i=0;i<16;i++){
+        if(flash_uid[i] == no_uid[i]){
             f_cnt++;
         }
-      }
-      if(f_cnt==16){//no uid flash
-              return 0;
-
-      }else{
-          return  1;
-      }
-}
-/**
- * @brief This function serves to protect data for flash.
- * @param[in]   type - flash type include GD,Puya and XTX
- * @param[in]   data - refer to Driver API Doc.
- * @return none
- */
-_attribute_ram_code_ void flash_lock(Flash_TypeDef type , unsigned short data)
-{
-    unsigned char r = irq_disable();
-
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_WRITE_STATUS_CMD);
-    if ((type == FLASH_TYPE_GD)||(type == FLASH_TYPE_XTX)){
-        mspi_write((unsigned char)data);   //8 bit status
-    }else if(type == FLASH_TYPE_PUYA){
-
-        mspi_write((unsigned char)data);
-        mspi_wait();
-        mspi_write((unsigned char)(data>>8));//16bit status
-
     }
-    mspi_wait();
-    mspi_high();
-    flash_wait_done();
-    sleep_us(100);
-    mspi_high();
-    irq_restore(r);
+
+    if(f_cnt == 16){    //no uid flash
+        return 0;
+    }else{
+        return 1;
+    }
 }
 
 /**
- * @brief This function serves to protect data for flash.
- * @param[in]   type - flash type include GD,Puya and XTX
- * @return none
+ * @brief        This function serves to find whether it is zb flash.
+ * @param[in]    none.
+ * @return        1 - is zb flash;   0 - is not zb flash.
  */
-_attribute_ram_code_ void flash_unlock(Flash_TypeDef type)
+unsigned char flash_is_zb(void)
 {
-    unsigned char r = irq_disable();
-
-    flash_send_cmd(FLASH_WRITE_ENABLE_CMD);
-    flash_send_cmd(FLASH_WRITE_STATUS_CMD);
-    if ((type == FLASH_TYPE_GD)||(type == FLASH_TYPE_XTX)){
-        mspi_write(0);   //8 bit status
-    }else if(type == FLASH_TYPE_PUYA){
-
-        mspi_write(0);
-        mspi_wait();
-        mspi_write(0);//16bit status
-
+    unsigned int flash_mid  = flash_read_mid();
+    if((flash_mid == 0x13325E)||(flash_mid == 0x14325E)||(flash_mid == 0x11325E)||(flash_mid == 0x12325E))
+    {
+        return 1;
     }
-    mspi_wait();
-    mspi_high();
-    flash_wait_done();
-    sleep_us(100);
-    mspi_high();
-    irq_restore(r);
+    return 0;
 }
 
-#endif
+/**
+ * @brief        This function serves to calibration the flash voltage(VDD_F),if the flash has the calib_value,we will use it,either will
+ *                 trim vdd_f to 1.95V(2b'111 the max) if the flash is zb.
+ * @param[in]    vol - the voltage which you want to set.
+ * @return        none.
+ */
+void flash_vdd_f_calib(void)
+{
+    unsigned short calib_value = flash_get_vdd_f_calib_value();
+    if((0xffff == calib_value) || (0 != (calib_value & 0xf8f8)))
+    {
+        if(flash_is_zb())
+        {
+            analog_write(0x09, ((analog_read(0x09) & 0x8f) | (FLASH_VOLTAGE_1V95 << 4)));            //ldo mode flash ldo trim 1.95V
+            analog_write(0x0c, ((analog_read(0x0c) & 0xf8) | FLASH_VOLTAGE_1V9));                    //dcdc mode flash ldo trim 1.90V
+        }
+    }
+    else
+    {
+        analog_write(0x09, ((analog_read(0x09) & 0x8f)  | ((calib_value & 0xff00) >> 4) ));
+        analog_write(0x0c, ((analog_read(0x0c) & 0xf8)  | (calib_value & 0xff)));
+    }
+}
 
 
 void flash_set_capacity(Flash_CapacityDef flash_cap)
@@ -506,3 +452,29 @@
 {
     return flash_capacity;
 }
+
+/**
+ * @brief        This function serves to get flash vendor.
+ * @param[in]    none.
+ * @return        0 - err, other - flash vendor.
+ */
+unsigned int flash_get_vendor(unsigned int flash_mid)
+{
+    switch(flash_mid&0x0000ffff)
+    {
+    case 0x0000325E:
+        return FLASH_ETOX_ZB;
+    case 0x000060C8:
+        return FLASH_ETOX_GD;
+    case 0x00004051:
+        return FLASH_ETOX_GD;
+    case 0x00006085:
+        return FLASH_SONOS_PUYA;
+    case 0x000060EB:
+        return FLASH_SONOS_UT;
+    case 0x000060CD:
+        return FLASH_SONOS_UT;
+    default:
+        return 0;
+    }
+}
diff --git a/drivers/8278/flash.h b/drivers/8278/flash.h
index c142d27..289631b 100644
--- a/drivers/8278/flash.h
+++ b/drivers/8278/flash.h
@@ -28,46 +28,72 @@
 
 #include "compiler.h"
 
+#define PAGE_SIZE        256
+#define PAGE_SIZE_OTP    256
+
 /**
  * @brief     flash command definition
  */
 enum{
-    FLASH_WRITE_STATUS_CMD        =    0x01,
-    FLASH_WRITE_CMD                =    0x02,
-    FLASH_READ_CMD                =    0x03,
-    FLASH_WRITE_DISABLE_CMD     =     0x04,
-    FLASH_READ_STATUS_CMD        =    0x05,
-    FLASH_WRITE_ENABLE_CMD         =     0x06,
-    FLASH_SECT_ERASE_CMD        =    0x20,
-    FLASH_GD_PUYA_READ_UID_CMD    =    0x4B,    //Flash Type = GD/PUYA
-    FLASH_32KBLK_ERASE_CMD        =    0x52,
-    FLASH_XTX_READ_UID_CMD        =    0x5A,    //Flash Type = XTX
-    FLASH_CHIP_ERASE_CMD        =    0x60,   //or 0xc7
-    FLASH_PAGE_ERASE_CMD        =    0x81,   //caution: only P25Q40L support this function
-    FLASH_64KBLK_ERASE_CMD        =    0xD8,
-    FLASH_POWER_DOWN            =    0xB9,
-    FLASH_POWER_DOWN_RELEASE    =    0xAB,
-    FLASH_GET_JEDEC_ID            =    0x9F,
+    //common cmd
+    FLASH_WRITE_CMD                        =    0x02,
+    FLASH_READ_CMD                        =    0x03,
+    FLASH_WRITE_SECURITY_REGISTERS_CMD    =    0x42,
+    FLASH_READ_SECURITY_REGISTERS_CMD    =    0x48,
+
+    FLASH_SECT_ERASE_CMD                =    0x20,
+    FLASH_ERASE_SECURITY_REGISTERS_CMD    =    0x44,
+
+    FLASH_READ_UID_CMD_GD_PUYA_ZB_UT    =    0x4B,    //Flash Type = GD/PUYA/ZB/UT
+    FLASH_READ_UID_CMD_XTX                =    0x5A,    //Flash Type = XTX
+
+    FLASH_GET_JEDEC_ID                    =    0x9F,
+
+    //special cmd
+    FLASH_WRITE_STATUS_CMD_LOWBYTE        =    0x01,
+    FLASH_WRITE_STATUS_CMD_HIGHBYTE        =    0x31,
+
+    FLASH_READ_STATUS_CMD_LOWBYTE        =    0x05,
+    FLASH_READ_STATUS_CMD_HIGHBYTE        =    0x35,
+
+    FLASH_WRITE_DISABLE_CMD             =     0x04,
+    FLASH_WRITE_ENABLE_CMD                 =     0x06,
 
 };
 
 /**
- * @brief     flash type definition
+ * @brief     flash status type definition
  */
-
 typedef enum{
-    FLASH_TYPE_GD = 0 ,
-    FLASH_TYPE_XTX,
-    FLASH_TYPE_PUYA
-}Flash_TypeDef;
+    FLASH_TYPE_8BIT_STATUS               = 0,
+    FLASH_TYPE_16BIT_STATUS_ONE_CMD      = 1,
+    FLASH_TYPE_16BIT_STATUS_TWO_CMD      = 2,
+}flash_status_typedef_e;
 
 /**
- * @brief     flash capacity definition
- * Call flash_read_mid function to get the size of flash capacity.
- * Example is as follows:
- * unsigned char temp_buf[4];
- * flash_read_mid(temp_buf);
- * The value of temp_buf[2] reflects flash capacity.
+ * @brief     flash uid cmd definition
+ */
+typedef enum{
+    FLASH_UID_CMD_GD_PUYA   = 0x4b,
+    FLASH_XTX_READ_UID_CMD    = 0x5A,
+}flash_uid_cmddef_e;
+
+/**
+ * @brief     flash vendor and technology definition
+ */
+typedef enum{
+    FLASH_ETOX_ZB          = 0x0100325E,    // 325E
+    FLASH_ETOX_GD       = 0x010060C8,    // 60C8/4051
+    FLASH_SONOS_PUYA      = 0x02006085,    // 6085
+    FLASH_SONOS_UT      = 0x020060EB,    // 60EB/60CD
+}flash_vendor_e;
+
+/**
+ * @brief    flash capacity definition
+ *            Call flash_read_mid function to get the size of flash capacity.
+ *            Example is as follows:
+ *            unsigned int mid = flash_read_mid();
+ *            The value of (mid&0x00ff0000)>>16 reflects flash capacity.
  */
 typedef enum {
     FLASH_SIZE_64K     = 0x10,
@@ -81,139 +107,199 @@
 } Flash_CapacityDef;
 
 /**
- * @brief This function serves to erase a sector.
- * @param[in]   addr the start address of the sector needs to erase.
- * @return none
+ * @brief    flash voltage definition
  */
-_attribute_ram_code_ void flash_erase_sector(unsigned long addr);
+typedef enum {
+    FLASH_VOLTAGE_1V95     = 0x07,
+    FLASH_VOLTAGE_1V9      = 0x06,
+    FLASH_VOLTAGE_1V85     = 0x05,
+    FLASH_VOLTAGE_1V8      = 0x04,
+    FLASH_VOLTAGE_1V75     = 0x03,
+    FLASH_VOLTAGE_1V7      = 0x02,
+    FLASH_VOLTAGE_1V65     = 0x01,
+    FLASH_VOLTAGE_1V6      = 0x00,
+} Flash_VoltageDef;
+
+typedef void (*flash_hander_t)(unsigned long, unsigned long, unsigned char*);
+extern flash_hander_t flash_read_page;
+extern flash_hander_t flash_write_page;
+
+/*******************************************************************************************************************
+ *                                                Primary interface
+ ******************************************************************************************************************/
+
+extern unsigned int flash_type,get_flash_mid;
 
 /**
- * @brief This function writes the buffer's content to a page.
- * @param[in]   addr the start address of the page
- * @param[in]   len the length(in byte) of content needs to write into the page
- * @param[in]   buf the start address of the content needs to write into
- * @return none
+ * @brief         This function serve to change the read function and write function.
+ * @param[in]   read    - the read function.
+ * @param[in]   write    - the write function.
+ * @none
  */
-_attribute_ram_code_ void flash_write_page(unsigned long addr, unsigned long len, unsigned char *buf);
+static inline void flash_change_rw_func(flash_hander_t read, flash_hander_t write)
+{
+    flash_read_page = read;
+    flash_write_page = write;
+}
+/**
+ * @brief         This function serves to erase a sector.
+ * @param[in]   addr    - the start address of the sector needs to erase.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_sector(unsigned long addr);
 
 /**
- * @brief This function reads the content from a page to the buf.
- * @param[in]   addr the start address of the page
- * @param[in]   len the length(in byte) of content needs to read out from the page
- * @param[out]  buf the start address of the buffer
- * @return none
+ * @brief         This function reads the content from a page to the buf.
+ * @param[in]   addr    - the start address of the page.
+ * @param[in]   len        - the length(in byte) of content needs to read out from the page.
+ * @param[out]  buf        - the start address of the buffer.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
  */
-_attribute_ram_code_ void flash_read_page(unsigned long addr, unsigned long len, unsigned char *buf);
-/**
- * @brief This function write the status of flash.
- * @param[in]  the value of status
- * @return status
- */
-void flash_read_mid(unsigned char *buf);
-
-
-/* according to your appliaction */
-#if 0
-/**
- * @brief     This function serves to erase a page(256 bytes).
- * @param[in] addr - the start address of the page needs to erase.
- * @return    none
- * @note      only 8359 support
- */
-void flash_erase_page(unsigned int addr);
+void flash_read_data(unsigned long addr, unsigned long len, unsigned char *buf);
 
 /**
- * @brief This function serves to erase a block(32k).
- * @param[in]   addr the start address of the block needs to erase.
- * @return none
+ * @brief         This function writes the buffer's content to the flash.
+ * @param[in]   addr    - the start address of the area.
+ * @param[in]   len        - the length(in byte) of content needs to write into the flash.
+ * @param[in]   buf        - the start address of the content needs to write into.
+ * @return         none.
+ * @note        the function support cross-page writing,which means the len of buf can bigger than 256.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
  */
-void flash_erase_32kblock(unsigned int addr);
+void flash_page_program(unsigned long addr, unsigned long len, unsigned char *buf);
 
 /**
- * @brief This function serves to erase a block(64k).
- * @param[in]   addr the start address of the block needs to erase.
- * @return none
+ * @brief          This function serves to read MID of flash(MAC id). Before reading UID of flash,
+ *                 you must read MID of flash. and then you can look up the related table to select
+ *                 the idcmd and read UID of flash
+ * @return        MID of the flash.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
  */
-void flash_erase_64kblock(unsigned int addr);
+unsigned int flash_read_mid(void);
 
 /**
- * @brief     This function serves to erase a page(256 bytes).
- * @param[in] addr - the start address of the page needs to erase.
- * @return    none
+ * @brief          This function serves to read UID of flash.Before reading UID of flash, you must read MID of flash.
+ *                 and then you can look up the related table to select the idcmd and read UID of flash.
+ * @param[in]     idcmd    - different flash vendor have different read-uid command. E.g: GD/PUYA:0x4B; XTX: 0x5A
+ * @param[in]     buf        - store UID of flash.
+ * @return        none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
  */
-void flash_erase_chip(void);
+void flash_read_uid(unsigned char idcmd, unsigned char *buf);
 
+/*******************************************************************************************************************
+ *                                                Primary interface
+ ******************************************************************************************************************/
 
 /**
- * @brief This function write the status of flash.
- * @param[in]  the value of status
- * @return status
- */
-unsigned char flash_write_status(unsigned char data);
-
-/**
- * @brief This function reads the status of flash.
- * @param[in]  none
- * @return none
- */
-unsigned char flash_read_status(void);
-
-/**
- * @brief      Deep Power Down mode to put the device in the lowest consumption mode
- *             it can be used as an extra software protection mechanism,while the device
- *             is not in active use,since in the mode,  all write,Program and Erase commands
- *             are ignored,except the Release from Deep Power-Down and Read Device ID(RDI)
- *             command.This release the device from this mode
- * @param[in] none
- * @return none.
- */
-void flash_deep_powerdown(void);
-
-/**
- * @brief        The Release from Power-Down or High Performance Mode/Device ID command is a
- *                 Multi-purpose command.it can be used to release the device from the power-Down
- *                 State or High Performance Mode or obtain the devices electronic identification
- *                 (ID)number.Release from Power-Down will take the time duration of tRES1 before
- *                 the device will resume normal operation and other command are accepted.The CS#
- *                 pin must remain high during the tRES1(8us) time duration.
- * @param[in]   none
- * @return      none.
- */
-void flash_release_deep_powerdown(void);
-
-
-
-/**
- * @brief      This function serves to read UID of flash
- * @param[in] idcmd - different flash vendor have different read-uid command
- *                    GD/PUYA:0x4B; XTX: 0x5A
- * @param[in] buf   - store UID of flash
- * @return    none.
- */
-void flash_read_uid(unsigned char idcmd,unsigned char *buf);
-/**
  * @brief        This function serves to read flash mid and uid,and check the correctness of mid and uid.
- * @param[out]   flash_mid - Flash Manufacturer ID
- * @param[out]   flash_uid - Flash Unique ID
- * @return       0:error 1:ok
-
+ * @param[out]    flash_mid    - Flash Manufacturer ID.
+ * @param[out]    flash_uid    - Flash Unique ID.
+ * @return        0: flash no uid or not a known flash model      1:the flash model is known and the uid is read.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
  */
-int flash_read_mid_uid_with_check( unsigned int *flash_mid ,unsigned char *flash_uid);
-/**
- * @brief This function serves to protect data for flash.
- * @param[in]   type - flash type include GD,Puya and XTX
- * @param[in]   data - refer to Driver API Doc.
- * @return none
- */
-void flash_lock(Flash_TypeDef type , unsigned short data);
+int flash_read_mid_uid_with_check( unsigned int *flash_mid, unsigned char *flash_uid);
 
 /**
- * @brief This function serves to protect data for flash.
- * @param[in]   type - flash type include GD,Puya and XTX
- * @return none
+ * @brief        This function serves to find whether it is zb flash.
+ * @param[in]    none.
+ * @return        1 - is zb flash;   0 - is not zb flash.
  */
-void flash_unlock(Flash_TypeDef type);
-#endif
+unsigned char flash_is_zb(void);
+
+/**
+ * @brief        This function serves to calibration the flash voltage(VDD_F),if the flash has the calib_value,we will use it,either will
+ *                 trim vdd_f to 1.95V(2b'111 the max) if the flash is zb.
+ * @param[in]    vol - the voltage which you want to set.
+ * @return        none.
+ */
+void flash_vdd_f_calib(void);
+
+
+/**
+ * @brief        This function serves to get the vdd_f calibration value.
+ * @param[in]    none.
+ * @return        none.
+ */
+static inline unsigned short flash_get_vdd_f_calib_value(void)
+{
+    unsigned int mid = flash_read_mid();
+    unsigned short flash_volatage = 0;
+    switch((mid & 0xff0000) >> 16)
+    {
+    case(FLASH_SIZE_64K):
+        flash_read_page(0xe1c0, 2, (unsigned char*)&flash_volatage);
+        break;
+    case(FLASH_SIZE_128K):
+        flash_read_page(0x1e1c0, 2, (unsigned char*)&flash_volatage);
+        break;
+    case(FLASH_SIZE_512K):
+        flash_read_page(0x771c0, 2, (unsigned char*)&flash_volatage);
+        break;
+    case(FLASH_SIZE_1M):
+        flash_read_page(0xfe1c0, 2, (unsigned char*)&flash_volatage);
+        break;
+    case(FLASH_SIZE_2M):
+        flash_read_page(0x1fe1c0, 2, (unsigned char*)&flash_volatage);
+        break;
+    default:
+        flash_volatage = 0xff;
+        break;
+    }
+    return flash_volatage;
+}
+
 
 
 
diff --git a/drivers/8278/flash/flash_mid11325e.c b/drivers/8278/flash/flash_mid11325e.c
new file mode 100644
index 0000000..4b5b0f8
--- /dev/null
+++ b/drivers/8278/flash/flash_mid11325e.c
@@ -0,0 +1,105 @@
+/******************************************************************************
+ * @file     flash_mid11325e.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid11325e(void)
+{
+    return flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid11325e(unsigned char data, mid11325e_write_status_bit_e bit)
+{
+    unsigned char status = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_8BIT_STATUS, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid11325e(mid11325e_lock_block_e data)
+{
+    flash_write_status_mid11325e(data, FLASH_WRITE_STATUS_BP_MID11325E);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid11325e(void)
+{
+    flash_write_status_mid11325e(FLASH_LOCK_NONE_MID11325E, FLASH_WRITE_STATUS_BP_MID11325E);
+}
+
diff --git a/drivers/8278/flash/flash_mid11325e.h b/drivers/8278/flash/flash_mid11325e.h
new file mode 100644
index 0000000..df7aaab
--- /dev/null
+++ b/drivers/8278/flash/flash_mid11325e.h
@@ -0,0 +1,119 @@
+/******************************************************************************
+ * @file     flash_mid11325e.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef __MID11325E_H__
+#define __MID11325E_H__
+
+/*
+ * @brief     MID = 0x11325e Flash include ZB25WD10A.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID11325E        =    0x00,
+    FLASH_LOCK_LOW_120K_MID11325E    =    0x04,    //000000h-01DFFFh
+    FLASH_LOCK_LOW_112K_MID11325E    =    0x08,    //000000h-01BFFFh
+    FLASH_LOCK_LOW_96K_MID11325E    =    0x0c,    //000000h-017FFFh
+    FLASH_LOCK_LOW_64K_MID11325E    =    0x10,    //000000h-00FFFFh
+    FLASH_LOCK_ALL_128K_MID11325E    =    0x1c,    //000000h-01FFFFh
+}mid11325e_lock_block_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID11325E    =    0x1c,
+}mid11325e_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid11325e(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid11325e(unsigned char data, mid11325e_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid11325e(mid11325e_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid11325e(void);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid1160c8.c b/drivers/8278/flash/flash_mid1160c8.c
new file mode 100644
index 0000000..b2fe7c6
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1160c8.c
@@ -0,0 +1,105 @@
+/******************************************************************************
+ * @file     flash_mid1160c8.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid1160c8(void)
+{
+    return flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1160c8(unsigned char data, mid1160c8_write_status_bit_e bit)
+{
+    unsigned char status = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_8BIT_STATUS, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1160c8(mid1160c8_lock_block_e data)
+{
+    flash_write_status_mid1160c8(data, FLASH_WRITE_STATUS_BP_MID1160C8);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1160c8(void)
+{
+    flash_write_status_mid1160c8(FLASH_LOCK_NONE_MID1160C8, FLASH_WRITE_STATUS_BP_MID1160C8);
+}
+
diff --git a/drivers/8278/flash/flash_mid1160c8.h b/drivers/8278/flash/flash_mid1160c8.h
new file mode 100644
index 0000000..7eaa0da
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1160c8.h
@@ -0,0 +1,120 @@
+/******************************************************************************
+ * @file     flash_mid1160c8.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef __MID1160C8_H__
+#define __MID1160C8_H__
+
+/*
+ * @brief     MID = 0x1160c8 Flash include GD25LD10C.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID1160C8        =    0x00,
+    FLASH_LOCK_LOW_120K_MID1160C8    =    0x04,    //000000h-01DFFFh
+    FLASH_LOCK_LOW_112K_MID1160C8    =    0x08,    //000000h-01BFFFh
+    FLASH_LOCK_LOW_96K_MID1160C8    =    0x0c,    //000000h-017FFFh
+    FLASH_LOCK_LOW_64K_MID1160C8    =    0x10,    //000000h-00FFFFh
+    FLASH_LOCK_ALL_128K_MID1160C8    =    0x1c,    //000000h-01FFFFh
+}mid1160c8_lock_block_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID1160C8    =    0x1c,
+}mid1160c8_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid1160c8(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1160c8(unsigned char data, mid1160c8_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1160c8(mid1160c8_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1160c8(void);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid13325e.c b/drivers/8278/flash/flash_mid13325e.c
new file mode 100644
index 0000000..ca11003
--- /dev/null
+++ b/drivers/8278/flash/flash_mid13325e.c
@@ -0,0 +1,106 @@
+/******************************************************************************
+ * @file     flash_mid13325e.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid13325e(void)
+{
+    return flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid13325e(unsigned char data, mid13325e_write_status_bit_e bit)
+{
+    unsigned char status = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_8BIT_STATUS, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid13325e(mid13325e_lock_block_e data)
+{
+    flash_write_status_mid13325e(data, FLASH_WRITE_STATUS_BP_MID13325E);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid13325e(void)
+{
+    flash_write_status_mid13325e(FLASH_LOCK_NONE_MID13325E, FLASH_WRITE_STATUS_BP_MID13325E);
+}
+
diff --git a/drivers/8278/flash/flash_mid13325e.h b/drivers/8278/flash/flash_mid13325e.h
new file mode 100644
index 0000000..0df7f2f
--- /dev/null
+++ b/drivers/8278/flash/flash_mid13325e.h
@@ -0,0 +1,122 @@
+/******************************************************************************
+ * @file     flash_mid13325e.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef __MID13325E_H__
+#define __MID13325E_H__
+
+/*
+ * @brief     MID = 0x13325e Flash include ZB25WD40B.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID13325E        =    0x00,
+    FLASH_LOCK_LOW_504K_MID13325E    =    0x04,    //000000h-07DFFFh
+    FLASH_LOCK_LOW_496K_MID13325E    =    0x08,    //000000h-07BFFFh
+    FLASH_LOCK_LOW_480K_MID13325E    =    0x0c,    //000000h-077FFFh
+    FLASH_LOCK_LOW_448K_MID13325E    =    0x10,    //000000h-06FFFFh
+    FLASH_LOCK_LOW_384K_MID13325E    =    0x14,    //000000h-05FFFFh
+    FLASH_LOCK_LOW_256K_MID13325E    =    0x18,    //000000h-03FFFFh
+    FLASH_LOCK_ALL_512K_MID13325E    =    0x1c,    //000000h-07FFFFh
+}mid13325e_lock_block_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID13325E    =    0x1c,
+}mid13325e_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid13325e(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid13325e(unsigned char data, mid13325e_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid13325e(mid13325e_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid13325e(void);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid136085.c b/drivers/8278/flash/flash_mid136085.c
new file mode 100644
index 0000000..95a8af3
--- /dev/null
+++ b/drivers/8278/flash/flash_mid136085.c
@@ -0,0 +1,201 @@
+/******************************************************************************
+ * @file     flash_mid136085.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+ #include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned short flash_read_status_mid136085(void)
+{
+    unsigned char status_low = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    unsigned char status_high = flash_read_status(FLASH_READ_STATUS_CMD_HIGHBYTE);
+    return (status_low | (status_high << 8));
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid136085(unsigned short data, mid136085_write_status_bit_e bit)
+{
+    unsigned short status = flash_read_status_mid136085();
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_16BIT_STATUS_ONE_CMD, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid136085(mid136085_lock_block_e data)
+{
+    flash_write_status_mid136085(data, FLASH_WRITE_STATUS_BP_MID136085);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid136085(void)
+{
+    flash_write_status_mid136085(FLASH_LOCK_NONE_MID136085, FLASH_WRITE_STATUS_BP_MID136085);
+}
+
+/**
+ * @brief         This function serves to read data from the Security Registers of the flash.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of the content to be read.
+ * @param[out]  buf        - the starting address of the content to be read.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_otp_mid136085(unsigned long addr, unsigned long len, unsigned char* buf)
+{
+    flash_read_otp(addr, len, buf);
+}
+
+/**
+ * @brief         This function serves to write data to the Security Registers of the flash you choose.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of content to be written.
+ * @param[in]   buf        - the starting address of the content to be written.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_otp_mid136085(unsigned long addr, unsigned long len, unsigned char *buf)
+{
+    flash_write_otp(addr, len, buf);
+}
+
+/**
+ * @brief         This function serves to erase the data of the Security Registers that you choose.
+ *                 You can erase 512-byte one time.
+ * @param[in]   addr    - the address that you want to erase.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @return         none.
+ * @note        Even you choose the middle area of the Security Registers,it will erase the whole area.
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_otp_mid136085(mid136085_otp_block_e addr)
+{
+    flash_erase_otp(addr);
+}
+
+/**
+ * @brief         This function serves to provide the write protect control to the Security Registers.
+ * @param[in]   data    - the lock area of the Security Registers.
+ * @return         none.
+ * @note        once they are set to 1, the Security Registers will become read-only permanently,
+ *                 you can't write or erase the area anymore.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_otp_mid136085(mid136085_lock_otp_e data)
+{
+    flash_write_status_mid136085(data, FLASH_WRITE_STATUS_OTP_MID136085);
+}
+
diff --git a/drivers/8278/flash/flash_mid136085.h b/drivers/8278/flash/flash_mid136085.h
new file mode 100644
index 0000000..1cea18d
--- /dev/null
+++ b/drivers/8278/flash/flash_mid136085.h
@@ -0,0 +1,242 @@
+/******************************************************************************
+ * @file     flash_mid136085.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef __MID136085_H__
+#define __MID136085_H__
+
+/*
+ * @brief    MID = 0x136085 Flash include P25D40L.
+ */
+
+
+/**
+ * @brief    define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID136085        =    0x0000,    //000000h-000000h    //0x0020 0x407c 0x4030...
+    FLASH_LOCK_UP_64K_MID136085        =    0x0004,    //070000h-07FFFFh
+    FLASH_LOCK_UP_128K_MID136085    =    0x0008,    //060000h-07FFFFh
+    FLASH_LOCK_UP_256K_MID136085    =    0x000c,    //040000h-07FFFFh    //0x402c
+    FLASH_LOCK_LOW_64K_MID136085    =    0x0024,    //000000h-00FFFFh
+    FLASH_LOCK_LOW_128K_MID136085    =    0x0028,    //000000h-01FFFFh
+    FLASH_LOCK_LOW_256K_MID136085    =    0x002c,    //000000h-03FFFFh    //0x400c
+    FLASH_LOCK_UP_4K_MID136085        =    0x0044,    //07F000h-07FFFFh
+    FLASH_LOCK_UP_8K_MID136085        =    0x0048,    //07E000h-07FFFFh
+    FLASH_LOCK_UP_16K_MID136085        =    0x004c,    //07C000h-07FFFFh
+    FLASH_LOCK_UP_32K_MID136085        =    0x0050,    //078000h-07FFFFh    //0x0054 0x0058
+    FLASH_LOCK_LOW_4K_MID136085        =    0x0064,    //000000h-000FFFh
+    FLASH_LOCK_LOW_8K_MID136085        =    0x0068,    //000000h-001FFFh
+    FLASH_LOCK_LOW_16K_MID136085    =    0x006c,    //000000h-003FFFh
+    FLASH_LOCK_LOW_32K_MID136085    =    0x0070,    //000000h-007FFFh    //0x0074 0x0078
+    FLASH_LOCK_LOW_448K_MID136085    =    0x4004,    //000000h-06FFFFh
+    FLASH_LOCK_LOW_384K_MID136085    =    0x4008,    //000000h-05FFFFh
+    FLASH_LOCK_UP_448K_MID136085    =    0x4024,    //010000h-07FFFFh
+    FLASH_LOCK_UP_384K_MID136085    =    0x4028,    //020000h-07FFFFh
+    FLASH_LOCK_LOW_508K_MID136085    =    0x4044,    //000000h-07EFFFh
+    FLASH_LOCK_LOW_504K_MID136085    =    0x4048,    //000000h-07DFFFh
+    FLASH_LOCK_LOW_496K_MID136085    =    0x404c,    //000000h-07BFFFh
+    FLASH_LOCK_LOW_480K_MID136085    =    0x4050,    //000000h-077FFFh    //0x4054 0x4058
+    FLASH_LOCK_UP_508K_MID136085    =    0x4064,    //001000h-07FFFFh
+    FLASH_LOCK_UP_504K_MID136085    =    0x4068,    //002000h-07FFFFh
+    FLASH_LOCK_UP_496K_MID136085    =    0x406c,    //004000h-07FFFFh
+    FLASH_LOCK_UP_480K_MID136085    =    0x4070,    //008000h-07FFFFh    //0x4074 0x4078
+    FLASH_LOCK_ALL_512K_MID136085    =    0x007c,    //000000h-07FFFFh    //0x4000 0x4040 0x4020 0x4060...
+}mid136085_lock_block_e;
+
+/**
+ * @brief     The starting address of the Security Registers.
+ */
+typedef enum{
+    FLASH_OTP_0x001000_512K_MID136085    =    0x001000,    //001000h-0011FFh
+    FLASH_OTP_0x002000_512K_MID136085    =    0x002000,    //002000h-0021FFh
+    FLASH_OTP_0x003000_512K_MID136085    =    0x003000,    //003000h-0031FFh
+}mid136085_otp_block_e;
+
+/**
+ * @brief     the lock area of the Security Registers.
+ */
+typedef enum{
+    FLASH_LOCK_OTP_0x001000_512K_MID136085    =    0x0800,    //001000h-0011FFh
+    FLASH_LOCK_OTP_0x002000_512K_MID136085    =    0x1000,    //002000h-0021FFh
+    FLASH_LOCK_OTP_0x003000_512K_MID136085    =    0x2000,    //003000h-0031FFh
+}mid136085_lock_otp_e;
+
+/**
+ * @brief    the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID136085        =    0x407c,
+    FLASH_WRITE_STATUS_OTP_MID136085    =    0x3800,
+}mid136085_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned short flash_read_status_mid136085(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return        none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid136085(unsigned short data, mid136085_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid136085(mid136085_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid136085(void);
+
+/**
+ * @brief         This function serves to read data from the Security Registers of the flash.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of the content to be read.
+ * @param[out]  buf        - the starting address of the content to be read.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_otp_mid136085(unsigned long addr, unsigned long len, unsigned char* buf);
+
+/**
+ * @brief         This function serves to write data to the Security Registers of the flash you choose.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of content to be written.
+ * @param[in]   buf        - the starting address of the content to be written.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_otp_mid136085(unsigned long addr, unsigned long len, unsigned char *buf);
+
+/**
+ * @brief         This function serves to erase the data of the Security Registers that you choose.
+ *                 You can erase 512-byte one time.
+ * @param[in]   addr    - the address that you want to erase.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @return         none.
+ * @note        Even you choose the middle area of the Security Registers,it will erase the whole area.
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_otp_mid136085(mid136085_otp_block_e addr);
+
+/**
+ * @brief         This function serves to provide the write protect control to the Security Registers.
+ * @param[in]   data    - the lock area of the Security Registers.
+ * @return         none.
+ * @note        once they are set to 1, the Security Registers will become read-only permanently,
+ *                 you can't write or erase the area anymore.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_otp_mid136085(mid136085_lock_otp_e data);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid1360c8.c b/drivers/8278/flash/flash_mid1360c8.c
new file mode 100644
index 0000000..b19e049
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1360c8.c
@@ -0,0 +1,106 @@
+/******************************************************************************
+ * @file     flash_mid1360c8.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid1360c8(void)
+{
+    return flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1360c8(unsigned char data, mid1360c8_write_status_bit_e bit)
+{
+    unsigned char status = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_8BIT_STATUS, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1360c8(mid1360c8_lock_block_e data)
+{
+    flash_write_status_mid1360c8(data, FLASH_WRITE_STATUS_BP_MID1360C8);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1360c8(void)
+{
+    flash_write_status_mid1360c8(FLASH_LOCK_NONE_MID1360C8, FLASH_WRITE_STATUS_BP_MID1360C8);
+}
+
diff --git a/drivers/8278/flash/flash_mid1360c8.h b/drivers/8278/flash/flash_mid1360c8.h
new file mode 100644
index 0000000..178adf7
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1360c8.h
@@ -0,0 +1,122 @@
+/******************************************************************************
+ * @file     flash_mid1360c8.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef __MID1360C8_H__
+#define __MID1360C8_H__
+
+/*
+ * @brief     MID = 0x1360c8 Flash include GD25LD40C.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID1360C8        =    0x00,
+    FLASH_LOCK_LOW_504K_MID1360C8    =    0x04,    //000000h-07DFFFh
+    FLASH_LOCK_LOW_496K_MID1360C8    =    0x08,    //000000h-07BFFFh
+    FLASH_LOCK_LOW_480K_MID1360C8    =    0x0c,    //000000h-077FFFh
+    FLASH_LOCK_LOW_448K_MID1360C8    =    0x10,    //000000h-06FFFFh
+    FLASH_LOCK_LOW_384K_MID1360C8    =    0x14,    //000000h-05FFFFh
+    FLASH_LOCK_LOW_256K_MID1360C8    =    0x18,    //000000h-03FFFFh
+    FLASH_LOCK_ALL_512K_MID1360C8    =    0x1c,    //000000h-07FFFFh
+}mid1360c8_lock_block_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID1360C8    =    0x1c,
+}mid1360c8_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid1360c8(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1360c8(unsigned char data, mid1360c8_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1360c8(mid1360c8_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1360c8(void);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid1360eb.c b/drivers/8278/flash/flash_mid1360eb.c
new file mode 100644
index 0000000..d7c0227
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1360eb.c
@@ -0,0 +1,202 @@
+/******************************************************************************
+ * @file     flash_mid1360eb.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+ #include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned short flash_read_status_mid1360eb(void)
+{
+    unsigned char status_low = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    unsigned char status_high = flash_read_status(FLASH_READ_STATUS_CMD_HIGHBYTE);
+    return (status_low | (status_high << 8));
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1360eb(unsigned short data, mid1360eb_write_status_bit_e bit)
+{
+    unsigned short status = flash_read_status_mid1360eb();
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_16BIT_STATUS_ONE_CMD, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1360eb(mid1360eb_lock_block_e data)
+{
+    flash_write_status_mid1360eb(data, FLASH_WRITE_STATUS_BP_MID1360EB);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1360eb(void)
+{
+    flash_write_status_mid1360eb(FLASH_LOCK_NONE_MID1360EB, FLASH_WRITE_STATUS_BP_MID1360EB);
+}
+
+/**
+ * @brief         This function serves to read data from the Security Registers of the flash.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of the content to be read.
+ * @param[out]  buf        - the starting address of the content to be read.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_otp_mid1360eb(unsigned long addr, unsigned long len, unsigned char* buf)
+{
+    flash_read_otp(addr, len, buf);
+}
+
+/**
+ * @brief         This function serves to write data to the Security Registers of the flash you choose.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of content to be written.
+ * @param[in]   buf        - the starting address of the content to be written.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_otp_mid1360eb(unsigned long addr, unsigned long len, unsigned char *buf)
+{
+    flash_write_otp(addr, len, buf);
+}
+
+/**
+ * @brief         This function serves to erase the data of the Security Registers that you choose.
+ *                 You can erase 512-byte one time.
+ * @param[in]   addr    - the address that you want to erase.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @return         none.
+ * @note        Even you choose the middle area of the Security Registers,it will erase the whole area.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_otp_mid1360eb(mid1360eb_otp_block_e addr)
+{
+    flash_erase_otp(addr);
+}
+
+/**
+ * @brief         This function serves to provide the write protect control to the Security Registers.
+ * @param[in]   data    - the lock area of the Security Registers.
+ * @return         none.
+ * @note        once they are set to 1, the Security Registers will become read-only permanently,
+ *                 you can't write or erase the area anymore.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_otp_mid1360eb(mid1360eb_lock_otp_e data)
+{
+    flash_write_status_mid1360eb(data, FLASH_WRITE_STATUS_OTP_MID1360EB);
+}
+
diff --git a/drivers/8278/flash/flash_mid1360eb.h b/drivers/8278/flash/flash_mid1360eb.h
new file mode 100644
index 0000000..832ebbb
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1360eb.h
@@ -0,0 +1,243 @@
+/******************************************************************************
+ * @file     flash_mid1360eb.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef __MID1360EB_H__
+#define __MID1360EB_H__
+
+/*
+ * @brief     MID = 0x1360eb Flash include TH25D40LA.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID1360EB        =    0x0000,    //000000h-000000h    //0x0020 0x407c 0x4030...
+    FLASH_LOCK_UP_64K_MID1360EB        =    0x0004,    //070000h-07FFFFh
+    FLASH_LOCK_UP_128K_MID1360EB    =    0x0008,    //060000h-07FFFFh
+    FLASH_LOCK_UP_256K_MID1360EB    =    0x000c,    //040000h-07FFFFh    //0x402c
+    FLASH_LOCK_LOW_64K_MID1360EB    =    0x0024,    //000000h-00FFFFh
+    FLASH_LOCK_LOW_128K_MID1360EB    =    0x0028,    //000000h-01FFFFh
+    FLASH_LOCK_LOW_256K_MID1360EB    =    0x002c,    //000000h-03FFFFh    //0x400c
+    FLASH_LOCK_UP_4K_MID1360EB        =    0x0044,    //07F000h-07FFFFh
+    FLASH_LOCK_UP_8K_MID1360EB        =    0x0048,    //07E000h-07FFFFh
+    FLASH_LOCK_UP_16K_MID1360EB        =    0x004c,    //07C000h-07FFFFh
+    FLASH_LOCK_UP_32K_MID1360EB        =    0x0050,    //078000h-07FFFFh    //0x0054 0x0058
+    FLASH_LOCK_LOW_4K_MID1360EB        =    0x0064,    //000000h-000FFFh
+    FLASH_LOCK_LOW_8K_MID1360EB        =    0x0068,    //000000h-001FFFh
+    FLASH_LOCK_LOW_16K_MID1360EB    =    0x006c,    //000000h-003FFFh
+    FLASH_LOCK_LOW_32K_MID1360EB    =    0x0070,    //000000h-007FFFh    //0x0074 0x0078
+    FLASH_LOCK_LOW_448K_MID1360EB    =    0x4004,    //000000h-06FFFFh
+    FLASH_LOCK_LOW_384K_MID1360EB    =    0x4008,    //000000h-05FFFFh
+    FLASH_LOCK_UP_448K_MID1360EB    =    0x4024,    //010000h-07FFFFh
+    FLASH_LOCK_UP_384K_MID1360EB    =    0x4028,    //020000h-07FFFFh
+    FLASH_LOCK_LOW_508K_MID1360EB    =    0x4044,    //000000h-07EFFFh
+    FLASH_LOCK_LOW_504K_MID1360EB    =    0x4048,    //000000h-07DFFFh
+    FLASH_LOCK_LOW_496K_MID1360EB    =    0x404c,    //000000h-07BFFFh
+    FLASH_LOCK_LOW_480K_MID1360EB    =    0x4050,    //000000h-077FFFh    //0x4054 0x4058
+    FLASH_LOCK_UP_508K_MID1360EB    =    0x4064,    //001000h-07FFFFh
+    FLASH_LOCK_UP_504K_MID1360EB    =    0x4068,    //002000h-07FFFFh
+    FLASH_LOCK_UP_496K_MID1360EB    =    0x406c,    //004000h-07FFFFh
+    FLASH_LOCK_UP_480K_MID1360EB    =    0x4070,    //008000h-07FFFFh    //0x4074 0x4078
+    FLASH_LOCK_ALL_512K_MID1360EB    =    0x007c,    //000000h-07FFFFh    //0x4000 0x4040 0x4020 0x4060...
+}mid1360eb_lock_block_e;
+
+/**
+ * @brief     The starting address of the Security Registers.
+ */
+typedef enum{
+    FLASH_OTP_0x001000_512K_MID1360EB    =    0x001000,    //001000h-0011FFh
+    FLASH_OTP_0x002000_512K_MID1360EB    =    0x002000,    //002000h-0021FFh
+    FLASH_OTP_0x003000_512K_MID1360EB    =    0x003000,    //003000h-0031FFh
+}mid1360eb_otp_block_e;
+
+/**
+ * @brief     the lock area of the Security Registers.
+ */
+typedef enum{
+    FLASH_LOCK_OTP_0x001000_512K_MID1360EB    =    0x0800,    //001000h-0011FFh
+    FLASH_LOCK_OTP_0x002000_512K_MID1360EB    =    0x1000,    //002000h-0021FFh
+    FLASH_LOCK_OTP_0x003000_512K_MID1360EB    =    0x2000,    //003000h-0031FFh
+}mid1360eb_lock_otp_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID1360EB        =    0x407c,
+    FLASH_WRITE_STATUS_OTP_MID1360EB    =    0x3800,
+}mid1360eb_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned short flash_read_status_mid1360eb(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1360eb(unsigned short data, mid1360eb_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1360eb(mid1360eb_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1360eb(void);
+
+/**
+ * @brief         This function serves to read data from the Security Registers of the flash.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of the content to be read.
+ * @param[out]  buf        - the starting address of the content to be read.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_otp_mid1360eb(unsigned long addr, unsigned long len, unsigned char* buf);
+
+/**
+ * @brief         This function serves to write data to the Security Registers of the flash you choose.
+ * @param[in]   addr    - the start address of the Security Registers.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @param[in]   len        - the length of content to be written.
+ * @param[in]   buf        - the starting address of the content to be written.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_otp_mid1360eb(unsigned long addr, unsigned long len, unsigned char *buf);
+
+/**
+ * @brief         This function serves to erase the data of the Security Registers that you choose.
+ *                 You can erase 512-byte one time.
+ * @param[in]   addr    - the address that you want to erase.
+ *                        the address of the  Security Registers #1 0x001000-0x0011ff
+ *                        the address of the  Security Registers #2 0x002000-0x0021ff
+ *                        the address of the  Security Registers #3 0x003000-0x0031ff
+ * @return         none.
+ * @note        Even you choose the middle area of the Security Registers,it will erase the whole area.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_otp_mid1360eb(mid1360eb_otp_block_e addr);
+
+/**
+ * @brief         This function serves to provide the write protect control to the Security Registers.
+ * @param[in]   data    - the lock area of the Security Registers.
+ * @return         none.
+ * @note        once they are set to 1, the Security Registers will become read-only permanently,
+ *                 you can't write or erase the area anymore.
+ *
+ *              Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_otp_mid1360eb(mid1360eb_lock_otp_e data);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid14325e.c b/drivers/8278/flash/flash_mid14325e.c
new file mode 100644
index 0000000..589587a
--- /dev/null
+++ b/drivers/8278/flash/flash_mid14325e.c
@@ -0,0 +1,106 @@
+/******************************************************************************
+ * @file     flash_mid14325e.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid14325e(void)
+{
+    return flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid14325e(unsigned char data, mid14325e_write_status_bit_e bit)
+{
+    unsigned char status = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_8BIT_STATUS, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid14325e(mid14325e_lock_block_e data)
+{
+    flash_write_status_mid14325e(data, FLASH_WRITE_STATUS_BP_MID14325E);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid14325e(void)
+{
+    flash_write_status_mid14325e(FLASH_LOCK_NONE_MID14325E, FLASH_WRITE_STATUS_BP_MID14325E);
+}
+
diff --git a/drivers/8278/flash/flash_mid14325e.h b/drivers/8278/flash/flash_mid14325e.h
new file mode 100644
index 0000000..446e69b
--- /dev/null
+++ b/drivers/8278/flash/flash_mid14325e.h
@@ -0,0 +1,122 @@
+/******************************************************************************
+ * @file     flash_mid14325e.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef __MID14325E_H__
+#define __MID14325E_H__
+
+/*
+ * @brief     MID = 0x1140c8 Flash include ZB25WD80B.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID14325E        =    0x00,
+    FLASH_LOCK_LOW_1016K_MID14325E    =    0x04,    //000000h-0FDFFFh
+    FLASH_LOCK_LOW_1008K_MID14325E    =    0x08,    //000000h-0FBFFFh
+    FLASH_LOCK_LOW_992K_MID14325E    =    0x0c,    //000000h-0F7FFFh
+    FLASH_LOCK_LOW_960K_MID14325E    =    0x10,    //000000h-0EFFFFh
+    FLASH_LOCK_LOW_896K_MID14325E    =    0x14,    //000000h-0DFFFFh
+    FLASH_LOCK_LOW_768K_MID14325E    =    0x18,    //000000h-0BFFFFh
+    FLASH_LOCK_ALL_1M_MID14325E        =    0x1c,    //000000h-0FFFFFh
+}mid14325e_lock_block_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID14325E    =    0x1c,
+}mid14325e_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid14325e(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid14325e(unsigned char data, mid14325e_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid14325e(mid14325e_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid14325e(void);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_mid1460c8.c b/drivers/8278/flash/flash_mid1460c8.c
new file mode 100644
index 0000000..88c96bd
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1460c8.c
@@ -0,0 +1,106 @@
+/******************************************************************************
+ * @file     flash_mid1460c8.c
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#include "flash_type.h"
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid1460c8(void)
+{
+    return flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+}
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1460c8(unsigned char data, mid1460c8_write_status_bit_e bit)
+{
+    unsigned char status = flash_read_status(FLASH_READ_STATUS_CMD_LOWBYTE);
+    data |= (status & ~(bit));
+    flash_write_status(FLASH_TYPE_8BIT_STATUS, data);
+}
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1460c8(mid1460c8_lock_block_e data)
+{
+    flash_write_status_mid1460c8(data, FLASH_WRITE_STATUS_BP_MID1460C8);
+}
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1460c8(void)
+{
+    flash_write_status_mid1460c8(FLASH_LOCK_NONE_MID1460C8, FLASH_WRITE_STATUS_BP_MID1460C8);
+}
+
diff --git a/drivers/8278/flash/flash_mid1460c8.h b/drivers/8278/flash/flash_mid1460c8.h
new file mode 100644
index 0000000..7a3fc77
--- /dev/null
+++ b/drivers/8278/flash/flash_mid1460c8.h
@@ -0,0 +1,122 @@
+/******************************************************************************
+ * @file     flash_mid1460c8.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef __MID1460C8_H__
+#define __MID1460C8_H__
+
+/*
+ * @brief     MID = 0x1460c8 Flash include GD25LD80C.
+ */
+
+
+/**
+ * @brief     define the section of the protected memory area which is read-only and unalterable.
+ */
+typedef enum{
+    FLASH_LOCK_NONE_MID1460C8        =    0x00,
+    FLASH_LOCK_LOW_1016K_MID1460C8    =    0x04,    //000000h-0FDFFFh
+    FLASH_LOCK_LOW_1008K_MID1460C8    =    0x08,    //000000h-0FBFFFh
+    FLASH_LOCK_LOW_992K_MID1460C8    =    0x0c,    //000000h-0F7FFFh
+    FLASH_LOCK_LOW_960K_MID1460C8    =    0x10,    //000000h-0EFFFFh
+    FLASH_LOCK_LOW_896K_MID1460C8    =    0x14,    //000000h-0DFFFFh
+    FLASH_LOCK_LOW_768K_MID1460C8    =    0x18,    //000000h-0BFFFFh
+    FLASH_LOCK_ALL_1M_MID1460C8        =    0x1c,    //000000h-0FFFFFh
+}mid1460c8_lock_block_e;
+
+/**
+ * @brief     the range of bits to be modified when writing status.
+ */
+typedef enum{
+    FLASH_WRITE_STATUS_BP_MID1460C8    =    0x1c,
+}mid1460c8_write_status_bit_e;
+
+
+/**
+ * @brief         This function reads the status of flash.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status_mid1460c8(void);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      data    - the value of status.
+ * @param[in]      bit        - the range of bits to be modified when writing status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status_mid1460c8(unsigned char data, mid1460c8_write_status_bit_e bit);
+
+/**
+ * @brief         This function serves to set the protection area of the flash.
+ * @param[in]   data    - refer to the protection area definition in the .h file.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_lock_mid1460c8(mid1460c8_lock_block_e data);
+
+/**
+ * @brief         This function serves to flash release protection.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_unlock_mid1460c8(void);
+
+
+#endif
+
diff --git a/drivers/8278/flash/flash_type.h b/drivers/8278/flash/flash_type.h
new file mode 100644
index 0000000..6f7a65d
--- /dev/null
+++ b/drivers/8278/flash/flash_type.h
@@ -0,0 +1,129 @@
+/******************************************************************************
+ * @file     flash_type.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef __FLASH_TYPE_H__
+#define __FLASH_TYPE_H__
+
+#include "../flash.h"
+#include "flash_mid1160c8.h"    // GD25LD10C
+#include "flash_mid1360c8.h"    // GD25LD40C
+#include "flash_mid1460c8.h"    // GD25LD80C
+#include "flash_mid11325e.h"    // ZB25WD10A
+#include "flash_mid13325e.h"    // ZB25WD40B
+#include "flash_mid14325e.h"    // ZB25WD80B
+#include "flash_mid136085.h"    // P25D40L
+#include "flash_mid1360eb.h"    // TH25D40LA
+
+
+/**
+ * @brief        This function reads the status of flash.
+ * @param[in]     cmd    - the cmd of read status.
+ * @return         the value of status.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+unsigned char flash_read_status(unsigned char cmd);
+
+/**
+ * @brief         This function write the status of flash.
+ * @param[in]      type    - the type of status.8 bit or 16 bit.
+ * @param[in]      data    - the value of status.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_status(flash_status_typedef_e type , unsigned short data);
+
+/**
+ * @brief         This function serves to read data from the Security Registers of the flash.
+ * @param[in]   addr    - the start address of the Security Registers.
+ * @param[in]   len        - the length of the content to be read.
+ * @param[out]  buf        - the starting address of the content to be read.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_read_otp(unsigned long addr, unsigned long len, unsigned char* buf);
+
+/**
+ * @brief         This function serves to write data to the Security Registers of the flash you choose.
+ * @param[in]   addr    - the start address of the Security Registers.
+ * @param[in]   len        - the length of content to be written.
+ * @param[in]   buf        - the starting address of the content to be written.
+ * @return         none.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_write_otp(unsigned long addr, unsigned long len, unsigned char *buf);
+
+/**
+ * @brief         This function serves to erase the data of the Security Registers that you choose.
+ * @param[in]   addr    - the address that you want to erase.
+ * @return         none.
+ * @Attention    Even you choose the middle area of the Security Registers,it will erase the whole area.
+ * @note        Attention: Before calling the FLASH function, please check the power supply voltage of the chip.
+ *              Only if the detected voltage is greater than the safe voltage value, the FLASH function can be called.
+ *              Taking into account the factors such as power supply fluctuations, the safe voltage value needs to be greater
+ *              than the minimum chip operating voltage. For the specific value, please make a reasonable setting according
+ *              to the specific application and hardware circuit.
+ *
+ *              Risk description: When the chip power supply voltage is relatively low, due to the unstable power supply,
+ *              there may be a risk of error in the operation of the flash (especially for the write and erase operations.
+ *              If an abnormality occurs, the firmware and user data may be rewritten, resulting in the final Product failure)
+ */
+void flash_erase_otp(unsigned long addr);
+
+
+#endif
+
diff --git a/drivers/8278/gpio_8278.c b/drivers/8278/gpio_8278.c
index 9ef1b3c..31c99b5 100644
--- a/drivers/8278/gpio_8278.c
+++ b/drivers/8278/gpio_8278.c
@@ -94,7 +94,7 @@
  * do not use pull-up or pull-down resistance on the board in the process of practical
  * application because it may have the risk of electric leakage .
  */
-_attribute_ram_code_ void gpio_init(int anaRes_init_en)
+_attribute_ram_code_sec_noinline_ void gpio_init(int anaRes_init_en)
 {
 
     reg_gpio_pa_setting1 =
@@ -671,7 +671,7 @@
             //0x5ae[7:6]
             //0. PWM1_N
             //1. I2S_SDI
-            //2. UART_TX£¨7816£©
+            //2. UART_TX7816
             mask = (unsigned char)~(BIT(7)|BIT(6));
             if(func == AS_PWM1_N){
 
diff --git a/drivers/8278/gpio_8278.h b/drivers/8278/gpio_8278.h
index 4a14d14..f2dc421 100644
--- a/drivers/8278/gpio_8278.h
+++ b/drivers/8278/gpio_8278.h
@@ -338,7 +338,7 @@
         BM_CLR(reg_gpio_pol(pin), bit);
     }
 /*clear gpio interrupt sorce (after setting gpio polarity,before enable interrupt)to avoid unexpected interrupt. confirm by minghai*/
-    reg_irq_src |= FLD_IRQ_GPIO_EN|FLD_IRQ_GPIO_RISC0_EN|FLD_IRQ_GPIO_RISC1_EN;
+    reg_irq_src |= FLD_IRQ_GPIO_EN;
     reg_irq_mask |= FLD_IRQ_GPIO_EN;
 }
 
@@ -374,7 +374,7 @@
         BM_CLR(reg_gpio_pol(pin), bit);
     }
 /*clear gpio interrupt sorce (after setting gpio polarity,before enable interrupt)to avoid unexpected interrupt. confirm by minghai*/
-    reg_irq_src |= FLD_IRQ_GPIO_EN|FLD_IRQ_GPIO_RISC0_EN|FLD_IRQ_GPIO_RISC1_EN;
+    reg_irq_src |= FLD_IRQ_GPIO_RISC0_EN;
     reg_irq_mask |= FLD_IRQ_GPIO_RISC0_EN;
 }
 
@@ -414,7 +414,7 @@
         BM_CLR(reg_gpio_pol(pin), bit);
     }
 /*clear gpio interrupt sorce (after setting gpio polarity,before enable interrupt)to avoid unexpected interrupt. confirm by minghai*/
-    reg_irq_src |= FLD_IRQ_GPIO_EN|FLD_IRQ_GPIO_RISC0_EN|FLD_IRQ_GPIO_RISC1_EN;
+    reg_irq_src |= FLD_IRQ_GPIO_RISC1_EN;
     reg_irq_mask |= FLD_IRQ_GPIO_RISC1_EN;
 }
 
diff --git a/drivers/8278/i2c.c b/drivers/8278/i2c.c
index 3298a71..d64bfdc 100644
--- a/drivers/8278/i2c.c
+++ b/drivers/8278/i2c.c
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #include "clock.h"
 #include "i2c.h"
 #include "gpio.h"
@@ -61,12 +62,13 @@
         reg_pin_i2c_spi_en &= ~(FLD_PIN_PD7_SPI_EN);
     }
 
+    gpio_set_input_en(sda_pin, 1);//enable sda input
+    gpio_set_input_en(scl_pin, 1);//enable scl input
     gpio_setup_up_down_resistor(sda_pin, PM_PIN_PULLUP_10K);
     gpio_setup_up_down_resistor(scl_pin, PM_PIN_PULLUP_10K);
     gpio_set_func(sda_pin, AS_I2C);
     gpio_set_func(scl_pin, AS_I2C);
-    gpio_set_input_en(sda_pin, 1);//enable sda input
-    gpio_set_input_en(scl_pin, 1);//enable scl input
+
 
 }
 
diff --git a/drivers/8278/irq.h b/drivers/8278/irq.h
index 12e8ebd..6e0f048 100644
--- a/drivers/8278/irq.h
+++ b/drivers/8278/irq.h
@@ -165,6 +165,6 @@
  */
 static inline void rf_irq_clr_src(unsigned short msk)
 {
-    reg_rf_irq_status |= msk;
+    reg_rf_irq_status = msk;
 }
 
diff --git a/drivers/8278/pga.h b/drivers/8278/pga.h
index 2552022..2f7c8e8 100644
--- a/drivers/8278/pga.h
+++ b/drivers/8278/pga.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #ifndef        pga_H
 #define        pga_H
 
diff --git a/drivers/8278/pke.c b/drivers/8278/pke.c
index c17de11..367e9f8 100644
--- a/drivers/8278/pke.c
+++ b/drivers/8278/pke.c
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 
-
 #include "pke.h"
 #include "../../common/string.h"
 
diff --git a/drivers/8278/pwm.h b/drivers/8278/pwm.h
index d204e45..a946436 100644
--- a/drivers/8278/pwm.h
+++ b/drivers/8278/pwm.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #ifndef PWM_H_
 #define PWM_H_
 
diff --git a/drivers/8278/qdec.c b/drivers/8278/qdec.c
index c559136..fb4918f 100644
--- a/drivers/8278/qdec.c
+++ b/drivers/8278/qdec.c
@@ -1,5 +1,5 @@
 /******************************************************************************
- * @file     qdec.c
+ * @file     qdec.h
  *
  * @brief    for TLSR chips
  *
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #include "qdec.h"
 
 /**
diff --git a/drivers/8278/qdec.h b/drivers/8278/qdec.h
index 655aace..53d0b2d 100644
--- a/drivers/8278/qdec.h
+++ b/drivers/8278/qdec.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #pragma once
 
 #include "clock.h"
@@ -66,7 +67,7 @@
 #define reg_qdec_channel_a 0xd2
 #define reg_qdec_channel_b 0xd3
 
-#define reg_qdec_mode      0xd7
+#define reg_qdec_mode 0xd7
 
 /**
  * qedc mode
diff --git a/drivers/8278/register.h b/drivers/8278/register.h
index 0aee948..e4312cf 100644
--- a/drivers/8278/register.h
+++ b/drivers/8278/register.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #pragma once
 
 
diff --git a/drivers/8278/register_8278.h b/drivers/8278/register_8278.h
index 6f39229..392571f 100644
--- a/drivers/8278/register_8278.h
+++ b/drivers/8278/register_8278.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #pragma once
 
 #include "bsp.h"
diff --git a/drivers/8278/rf_drv.h b/drivers/8278/rf_drv.h
index 144b28b..4ea54f1 100644
--- a/drivers/8278/rf_drv.h
+++ b/drivers/8278/rf_drv.h
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #ifndef _RF_DRV_H_
 #define _RF_DRV_H_
 
@@ -115,7 +116,7 @@
      /*VANT*/
      RF_POWER_P3p50dBm  = BIT(7) | 63,   //   3.50 dbm
      RF_POWER_P3p33dBm  = BIT(7) | 61,   //   3.33 dbm
-     RF_POWER_P3p13dBm  = BIT(7) | 59,   //   3.13 dbm
+     RF_POWER_P3p13dBm  = BIT(7) | 59,   /*   3.13 dbm */    RF_POWER_P3dBm = RF_POWER_P3p13dBm,
      RF_POWER_P2p93dBm  = BIT(7) | 57,   //   2.93 dbm
      RF_POWER_P2p60dBm  = BIT(7) | 54,   //   2.60 dbm
      RF_POWER_P2p36dBm  = BIT(7) | 52,   //   2.36 dbm
@@ -125,7 +126,7 @@
      RF_POWER_P1p25dBm  = BIT(7) | 44,   //   1.25 dbm
      RF_POWER_P0p71dBm  = BIT(7) | 41,   //   0.71 dbm
      RF_POWER_P0p52dBm  = BIT(7) | 40,   //   0.52 dbm
-     RF_POWER_N0p28dBm  = BIT(7) | 36,   //  -0.28 dbm
+     RF_POWER_N0p28dBm  = BIT(7) | 36,   /*  -0.28 dbm */    RF_POWER_P0dBm = RF_POWER_N0p28dBm,
      RF_POWER_N0p51dBm  = BIT(7) | 35,   //  -0.51 dbm
      RF_POWER_N0p74dBm  = BIT(7) | 34,   //  -0.74 dbm
      RF_POWER_N1p21dBm  = BIT(7) | 32,   //  -1.21 dbm
@@ -378,8 +379,8 @@
 *    @brief        this function is to enable/disable each access_code channel for
 *                RF Rx terminal.
 *    @param[in]    pipe      Bit0~bit5 correspond to channel 0~5, respectively.
-*                        0£ºDisable 1£ºEnable
-*                        If ¡°enable¡± is set as 0x3f (i.e. 00111111),
+*                        0Disable 1Enable
+*                        If enable is set as 0x3f (i.e. 00111111),
 *                        all access_code channels (0~5) are enabled.
 *    @return         none
 */
@@ -391,8 +392,8 @@
 /**
 *    @brief        this function is to select access_code channel for RF Rx terminal.
 *    @param[in]    pipe      Bit0~bit5 correspond to channel 0~5, respectively.
-*                        0£ºDisable 1£ºEnable
-*                        If ¡°enable¡± is set as 0x3f (i.e. 00111111),
+*                        0Disable 1Enable
+*                        If enable is set as 0x3f (i.e. 00111111),
 *                        all access_code channels (0~5) are enabled.
 *    @return         none
 */
@@ -497,7 +498,7 @@
 *    @brief          This function serves to clear the Tx finish flag bit.
 *                After all packet data are sent, corresponding Tx finish flag bit
 *                will be set as 1.By reading this flag bit, it can check whether
-*                packet transmission is finished. After the check, it¡¯s needed to
+*                packet transmission is finished. After the check, its needed to
 *                manually clear this flag bit so as to avoid misjudgment.
 *   @param      none
 *    @return         none
@@ -523,17 +524,17 @@
 /**
 *    @brief          This function is to set rx buffer
 *
-*    @param[out]    RF_RxAddr      Pointer for Rx buffer in RAM(Generally it¡¯s starting
+*    @param[out]    RF_RxAddr      Pointer for Rx buffer in RAM(Generally its starting
 *                            address of an array.Should be 4-byte aligned)
-*    @param[in]    size           Rx buffer size (It¡¯s an integral multiple of 16)
-*    @param[in]    PingpongEn     Enable/Disable Ping-Pong buffer 1£ºEnable 0£ºDisable
+*    @param[in]    size           Rx buffer size (It's an integral multiple of 16)
+*    @param[in]    PingpongEn     Enable/Disable Ping-Pong buffer 1Enable 0Disable
 *                            Note:
-*                            When ¡°PingpongEn¡± is set as 0, received RF data will
-*                            be stored in RAM pointed by ¡° RF_RxAddr¡±.
-*                            When ¡°PingpongEn¡± is set as 1, received RF data will
+*                            When PingpongEn is set as 0, received RF data will
+*                            be stored in RAM pointed by  RF_RxAddr.
+*                            When PingpongEn is set as 1, received RF data will
 *                            be stored in buffer0 and buffer1 successively.
 *                            The RAM size reserved for received RF data should be
-*                            double of ¡°Size¡±.
+*                            double of Size.
 *
 *    @return         none
 */
@@ -542,7 +543,7 @@
 
 /**
 *    @brief          This function serves to  reconfigure the buffer
-*    @param[out]    RF_RxAddr      Pointer for Rx buffer in RAM(Generally it¡¯s starting
+*    @param[out]    RF_RxAddr      Pointer for Rx buffer in RAM(Generally its starting
 *                            address of an array.Should be 4-byte aligned)
 *    @return         Yes: 1, NO: 0.
 */
@@ -566,7 +567,7 @@
 *    @brief          This function serves to clear the Rx finish flag bit.
 *                After all packet data are resive, corresponding Rx finish flag bit
 *                will be set as 1.By reading this flag bit, it can check whether
-*                packet transmission is finished. After the check, it¡¯s needed to
+*                packet transmission is finished. After the check, its needed to
 *                manually clear this flag bit so as to avoid misjudgment.
 *   @param      none
 *    @return         none
@@ -604,7 +605,7 @@
 *    @brief          This function serves to start Rx of auto mode. In this mode,
 *                RF module stays in Rx status until a packet is received or it fails to receive packet when timeout expires.
 *                Timeout duration is set by the parameter "tick".
-*                The address to store received data is set by the function ¡°addr¡±.
+*                The address to store received data is set by the function addr.
 *    @param[in]    addr - The address to store received data.
 *    @param[in]    tick - Unit is us. It indicates timeout duration in Rx status.Max value: 0xffffff (16777215)
 *    @return         none
@@ -633,8 +634,8 @@
 *                In this mode, a packet is sent first,RF module waits for 10us,
 *                stays in Rx status until data is received or timeout expires,
 *                then exits this mode.Timeout duration is set by the parameter
-*                ¡°timeout_us¡±.The address to store received data is set by the
-*                function ¡°RF_RxBufferSet¡±.
+*                timeout_us.The address to store received data is set by the
+*                function RF_RxBufferSet.
 *
 *    @param[in]    addr  Tx packet address in RAM. Should be 4-byte aligned.
 *    @param[in]    tick       Tick value of system timer. It determines when
@@ -659,7 +660,7 @@
 *                If it fails to receive packet when timeout expires, RF module
 *                will directly exit this mode.Timeout duration is set by the
 *                parameter "timeout_us".    The address to store received data is set
-*                by the function ¡°RF_RxBufferSet¡±.
+*                by the function RF_RxBufferSet.
 *
 *    @param[in]    addr     Tx packet address in RAM. Should be 4-byte aligned.
 *    @param[in]    tick   Tick value of system timer. It determines when to
@@ -910,7 +911,7 @@
 
 /**
  * @brief      This function process the received packet in 1mbps shockburst mode only for hanshow for the
- *             compatiblity with third-party chips. The process includes data-whitening
+ *             compatibility with third-party chips. The process includes data-whitening
                transformation and crc check.
  * @param[in]  rx_buf - the rf rx buffer containing the received packet(dma length+payload+3 byte crc)
  * @param[in]  len - the expected rx length of shockburst mode, containing payload and 3byte crc
@@ -920,7 +921,7 @@
 unsigned char rx_packet_process_1mbps(unsigned char *rx_buf, unsigned int len);
 /**
  * @brief      This function process the tx packet in 1mbps shockburst mode only for hanshow for the
- *             compatiblity with third-party chips. The process includes data-whitening
+ *             compatibility with third-party chips. The process includes data-whitening
                transformation and crc padding.
  * @param[in]  tx_buf - the rf tx buffer containing the tx packet(dma length+payload+3 byte crc)
  * @param[in]  len - the expected tx length of shockburst mode, containing payload and 3byte crc
diff --git a/drivers/8278/s7816.c b/drivers/8278/s7816.c
index c7c8f26..2bcd7e4 100644
--- a/drivers/8278/s7816.c
+++ b/drivers/8278/s7816.c
@@ -23,10 +23,12 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #include "s7816.h"
 #include "uart.h"
 #include "irq.h"
 #include "dma.h"
+#include "timer.h"
 
 /**
  * @brief          This function is used to initiate 7816 module of MCU
diff --git a/drivers/8278/s7816.h b/drivers/8278/s7816.h
index 7a58819..ec063e5 100644
--- a/drivers/8278/s7816.h
+++ b/drivers/8278/s7816.h
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 
-
 #ifndef S7816_H_
 #define S7816_H_
 
diff --git a/drivers/8278/spi_i.h b/drivers/8278/spi_i.h
index eb42a13..b855723 100644
--- a/drivers/8278/spi_i.h
+++ b/drivers/8278/spi_i.h
@@ -31,7 +31,7 @@
   * @param[in] none
   * @return    none
   */
-_attribute_ram_code_ static inline void mspi_wait(void){
+_attribute_ram_code_sec_ static inline void mspi_wait(void){
     while(reg_mspi_ctrl & FLD_MSPI_BUSY)
         ;
 }
@@ -41,7 +41,7 @@
  * @param[in] none
  * @return    none
  */
-_attribute_ram_code_ static inline void mspi_high(void){
+_attribute_ram_code_sec_ static inline void mspi_high(void){
     reg_mspi_ctrl = FLD_MSPI_CS;
 }
 
@@ -50,7 +50,7 @@
  * @param[in] none
  * @return    none
  */
-_attribute_ram_code_ static inline void mspi_low(void){
+_attribute_ram_code_sec_ static inline void mspi_low(void){
     reg_mspi_ctrl = 0;
 }
 
@@ -59,7 +59,7 @@
  * @param[in] none.
  * @return    the spi data.
  */
-_attribute_ram_code_ static inline unsigned char mspi_get(void){
+_attribute_ram_code_sec_ static inline unsigned char mspi_get(void){
     return reg_mspi_data;
 }
 
@@ -68,7 +68,7 @@
  * @param[in] c - the char need to be write.
  * @return    none
  */
-_attribute_ram_code_ static inline void mspi_write(unsigned char c){
+_attribute_ram_code_sec_ static inline void mspi_write(unsigned char c){
     reg_mspi_data = c;
 }
 
@@ -77,7 +77,7 @@
  * @param[in] c - need to be write.
  * @return    none
  */
-_attribute_ram_code_ static inline void mspi_ctrl_write(unsigned char c){
+_attribute_ram_code_sec_ static inline void mspi_ctrl_write(unsigned char c){
     reg_mspi_ctrl = c;
 }
 
@@ -86,7 +86,7 @@
  * @param[in] none.
  * @return    read reault.
  */
-_attribute_ram_code_ static inline unsigned char mspi_read(void){
+_attribute_ram_code_sec_ static inline unsigned char mspi_read(void){
     mspi_write(0);        // dummy, issue clock
     mspi_wait();
     return mspi_get();
diff --git a/drivers/8278/timer.c b/drivers/8278/timer.c
index f457cc4..ebb8fa8 100644
--- a/drivers/8278/timer.c
+++ b/drivers/8278/timer.c
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #include "timer.h"
 
 /**
@@ -31,7 +32,7 @@
  * @return    none
  */
 
-_attribute_ram_code_ void sleep_us(unsigned long us)
+_attribute_ram_code_sec_noinline_ void sleep_us(unsigned long us)
 {
     unsigned long t = clock_time();
     while(!clock_time_exceed(t, us)){
diff --git a/drivers/8278/timer.h b/drivers/8278/timer.h
index 40fa65e..e95cb2b 100644
--- a/drivers/8278/timer.h
+++ b/drivers/8278/timer.h
@@ -50,14 +50,21 @@
     TIMER_MODE_TICK          = 3,
 }TIMER_ModeTypeDef;
 
-#define        sys_tick_per_us                   16
-#define        CLOCK_SYS_CLOCK_1250US            (1250 * sys_tick_per_us)
 
 /**
  * @brief   system Timer : 16Mhz, Constant
  */
 enum{
-    CLOCK_16M_SYS_TIMER_CLK_1S  = 16*1000*1000,
+    SYSTEM_TIMER_TICK_1US         = 16,
+    SYSTEM_TIMER_TICK_1MS         = 16000,
+    SYSTEM_TIMER_TICK_1S         = 16000000,
+
+    SYSTEM_TIMER_TICK_625US      = 10000,  //625*16
+    SYSTEM_TIMER_TICK_1250US     = 20000,  //1250*16
+};
+
+enum{
+    CLOCK_16M_SYS_TIMER_CLK_1S  =  16*1000*1000,
     CLOCK_16M_SYS_TIMER_CLK_1MS = 16*1000,
     CLOCK_16M_SYS_TIMER_CLK_1US = 16,
 };
diff --git a/drivers/8278/uart.c b/drivers/8278/uart.c
index 3981032..756f185 100644
--- a/drivers/8278/uart.c
+++ b/drivers/8278/uart.c
@@ -23,6 +23,7 @@
  *  limitations under the License.
  *
  *****************************************************************************/
+
 #include "uart.h"
 #include "gpio.h"
 #include "compiler.h"
@@ -322,6 +323,28 @@
 }
 
 /**
+ * @brief     uart send data function, this  function tell the DMA to get data from the RAM and start the DMA transmission
+ * @param[in] Addr - pointer to the buffer containing data need to send
+ * @return    none
+ * @note      If you want to use uart DMA mode to send data, it is recommended to use this function.
+ *            This function just triggers the sending action, you can use interrupt or polling with the FLD_UART_TX_DONE flag to judge whether the sending is complete.
+ *            After the current packet has been sent, this FLD_UART_TX_DONE will be set to 1, and FLD_UART_TX_DONE interrupt can be generated.
+ *              If you use interrupt mode, you need to call uart_clr_tx_done() in the interrupt processing function, uart_clr_tx_done() will set FLD_UART_TX_DONE to 0.
+ *            DMA can only send 2047-bytes one time at most.
+ */
+void uart_send_dma(unsigned char* Addr)
+{
+    /*when the state of tx is not busy, tx_done status (0x9e bit[0])=1(default),
+     * if tx_done irq is enable,first we must clear tx_done status to 0 - "uart_clr_tx_done()",otherwise it always be stuck in the interrupt,
+     * when tx is truly complete , tx_done status is set to 1,then entry tx_done irq.
+     */
+    uart_clr_tx_done();
+    reg_dma1_addr = (unsigned short)((unsigned int)Addr); //packet data, start address is sendBuff+1
+    reg_dma1_size = 0xff;
+    reg_dma_tx_rdy0     |= FLD_DMA_CHN_UART_TX;
+}
+
+/**
  * @brief     uart send data function, this  function tell the DMA to get data from the RAM and start
  *            the DMA transmission
  * @param[in] Addr - pointer to the buffer containing data need to send
@@ -433,8 +456,7 @@
     if (Enable)
     {
         gpio_set_func(pin,AS_UART);//enable rts pin
-        gpio_set_input_en(pin, 1);//enable input
-        gpio_set_output_en(pin, 1);//enable output
+
         reg_uart_ctrl2 |= FLD_UART_CTRL2_RTS_EN; //enable RTS function
     }
     else
@@ -489,8 +511,10 @@
 {
     if (Enable)
     {
-        gpio_set_func(pin,AS_UART);//enable cts pin
+        //When the pad is configured with mux input and a pull-up resistor is required, gpio_input_en needs to be placed before gpio_function_dis,
+        //otherwise first set gpio_input_disable and then call the mux function interface,the mux pad will may misread the short low-level timing.confirmed by minghai.20210709.
         gpio_set_input_en(pin, 1);//enable input
+        gpio_set_func(pin,AS_UART);//enable cts pin
         reg_uart_ctrl1|= FLD_UART_CTRL1_CTS_EN; //enable CTS function
     }
     else
@@ -519,6 +543,10 @@
 */
 void uart_gpio_set(UART_TxPinDef tx_pin,UART_RxPinDef rx_pin)
 {
+    //When the pad is configured with mux input and a pull-up resistor is required, gpio_input_en needs to be placed before gpio_function_dis,
+    //otherwise first set gpio_input_disable and then call the mux function interface,the mux pad will may misread the short low-level timing.confirmed by minghai.20210709.
+    gpio_set_input_en(tx_pin, 1);
+    gpio_set_input_en(rx_pin, 1);
     //note: pullup setting must before uart gpio config, cause it will lead to ERR data to uart RX buffer(confirmed by sihui&sunpeng)
     //PM_PIN_PULLUP_1M   PM_PIN_PULLUP_10K
     gpio_setup_up_down_resistor(tx_pin, PM_PIN_PULLUP_10K);  //must, for stability and prevent from current leakage
@@ -529,9 +557,6 @@
     gpio_set_func(rx_pin,AS_UART); // set rx pin
 
 
-    gpio_set_input_en(tx_pin, 1);  //experiment shows that tx_pin should open input en(confirmed by qiuwei)
-    gpio_set_input_en(rx_pin, 1);  //
-
 }
 /**
  * @brief   This function enables the irq when UART module receives error data.
diff --git a/drivers/8278/uart.h b/drivers/8278/uart.h
index c0e3ae8..930fac1 100644
--- a/drivers/8278/uart.h
+++ b/drivers/8278/uart.h
@@ -30,7 +30,7 @@
 
 #ifndef     uart_H
 #define     uart_H
-
+#define uart_rtx_pin_tx_trig() uart_clr_tx_done()
 
 /**
  *  @brief  Define mul bits
@@ -95,6 +95,16 @@
 }UART_RxPinDef;
 
 /**
+ *  @brief  Define UART RTX pin: C2 D0 D3 D7
+ */
+typedef enum{
+    UART_RTX_PC2 = GPIO_PC2,
+    UART_RTX_PD0 = GPIO_PD0,
+    UART_RTX_PD3 = GPIO_PD3,
+    UART_RTX_PD7 = GPIO_PD7,
+}UART_RTxPinDef;
+
+/**
  *  @brief  Define UART CTS pin : A3 B2 C4 D1
  */
 
@@ -140,6 +150,24 @@
     reg_rst0 &= (~FLD_RST0_UART);
 }
 
+/**
+ * @brief     This function serves to clear tx down.
+ * @param[in] none
+ * @return    none
+ */
+static inline void uart_clr_tx_done(void)
+{
+    reg_uart_state = BIT(7);
+}
+
+/**
+ * @brief          This function is used to enable the rtx function of .
+ * @return         none.
+ */
+static inline void uart_rtx_en()
+{
+    reg_uart_rx_timeout1 |=FLD_UART_P7816_EN;
+}
 
 /**
  * @brief          This function initializes the UART module.
@@ -237,6 +265,17 @@
  */
 
 extern unsigned char uart_ndmairq_get(void);
+/**
+ * @brief     uart send data function, this  function tell the DMA to get data from the RAM and start the DMA transmission
+ * @param[in] Addr - pointer to the buffer containing data need to send
+ * @return    none
+ * @note      If you want to use uart DMA mode to send data, it is recommended to use this function.
+ *            This function just triggers the sending action, you can use interrupt or polling with the FLD_UART_TX_DONE flag to judge whether the sending is complete.
+ *            After the current packet has been sent, this FLD_UART_TX_DONE will be set to 1, and FLD_UART_TX_DONE interrupt can be generated.
+ *              If you use interrupt mode, you need to call uart_clr_tx_done() in the interrupt processing function, uart_clr_tx_done() will set FLD_UART_TX_DONE to 0.
+ *            DMA can only send 2047-bytes one time at most.
+ */
+extern void uart_send_dma(unsigned char* Addr);
 
 /**
  * @brief     uart send data function, this  function tell the DMA to get data from the RAM and start
diff --git a/sdk_version.txt b/sdk_version.txt
index f355aa8..e52b0d3 100644
--- a/sdk_version.txt
+++ b/sdk_version.txt
@@ -1,3 +1,2 @@
 Telink BLE SDK_VERSION = 

-

-telink_vulture_ble_sdk_Beta_v1.0.0

+B85m_BLE_Single_Connection_SDK_v3.4.2_engineering  

diff --git a/stack/ble/attr/att.h b/stack/ble/attr/att.h
deleted file mode 100644
index 7750ec5..0000000
--- a/stack/ble/attr/att.h
+++ /dev/null
@@ -1,570 +0,0 @@
-/******************************************************************************
- * @file     att.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#pragma once
-#include "tl_common.h"
-#include "stack/ble/blt_config.h"
-#include "stack/ble/ble_common.h"
-#include "stack/ble/l2cap/l2cap.h"
-#include "gatt.h"
-
-
-#define ATT_MTU_SIZE                        23  //!< Minimum ATT MTU size
-#define ATT_MAX_ATTR_HANDLE                 0xFFFF
-#define ATT_16BIT_UUID_LEN                  2
-#define ATT_128BIT_UUID_LEN                 16
-#define L2CAP_RESERVED_LEN                  14
-#define OPCODE_SIZE                         1
-#define L2CAP_PAYLOAD_OFFSET                (L2CAP_RESERVED_LEN + OPCODE_SIZE)
-#define ATT_HANDLE_START                    0x0001
-#define ATT_HANDLE_END                      0xFFFF
-
-#define ATT_OP_ERROR_RSP                    0x01 //!< Error Response op code
-#define ATT_OP_EXCHANGE_MTU_REQ             0x02 //!< Exchange MTU Request op code
-#define ATT_OP_EXCHANGE_MTU_RSP             0x03 //!< Exchange MTU Response op code
-#define ATT_OP_FIND_INFO_REQ                0x04 //!< Find Information Request op code
-#define ATT_OP_FIND_INFO_RSP                0x05 //!< Find Information Response op code        ----Information Data 4 to (ATT_MTU-2)
-#define ATT_OP_FIND_BY_TYPE_VALUE_REQ       0x06 //!< Find By Type Value Request op code            Attribute Value 0 to (ATT_MTU-7)
-#define ATT_OP_FIND_BY_TYPE_VALUE_RSP       0x07 //!< Find By Type Value Response op code    ----Handles Information List 4 to (ATT_MTU-1)
-#define ATT_OP_READ_BY_TYPE_REQ             0x08 //!< Read By Type Request op code
-#define ATT_OP_READ_BY_TYPE_RSP             0x09 //!< Read By Type Response op code            ----Attribute Data List 2 to (ATT_MTU- 2)
-#define ATT_OP_READ_REQ                     0x0a //!< Read Request op code
-#define ATT_OP_READ_RSP                     0x0b //!< Read Response op code                    @@--Attribute Value 0 to (ATT_MTU-1)
-#define ATT_OP_READ_BLOB_REQ                0x0c //!< Read Blob Request op code
-#define ATT_OP_READ_BLOB_RSP                0x0d //!< Read Blob Response op code            @@--Part Attribute Value 0 to (ATT_MTU-1)
-#define ATT_OP_READ_MULTI_REQ               0x0e //!< Read Multiple Request op code                Set Of Handles 4 to (ATT_MTU-1)
-#define ATT_OP_READ_MULTI_RSP               0x0f //!< Read Multiple Response op code        ----Set Of Values 0 to (ATT_MTU-1)
-#define ATT_OP_READ_BY_GROUP_TYPE_REQ       0x10 //!< Read By Group Type Request op code
-#define ATT_OP_READ_BY_GROUP_TYPE_RSP       0x11 //!< Read By Group Type Response op code    ----Attribute Data List 4 to (ATT_MTU- 2)
-#define ATT_OP_WRITE_REQ                    0x12 //!< Write Request op code                        Attribute Value 0 to (ATT_MTU-3)
-#define ATT_OP_WRITE_RSP                    0x13 //!< Write Response op code
-#define ATT_OP_PREPARE_WRITE_REQ            0x16 //!< Prepare Write Request op code                Part Attribute Value 0 to (ATT_MTU-5)
-#define ATT_OP_PREPARE_WRITE_RSP            0x17 //!< Prepare Write Response op code        ----Part Attribute Value 0 to (ATT_MTU-5)
-#define ATT_OP_EXECUTE_WRITE_REQ            0x18 //!< Execute Write Request op code
-#define ATT_OP_EXECUTE_WRITE_RSP            0x19 //!< Execute Write Response op code
-#define ATT_OP_HANDLE_VALUE_NOTI            0x1b //!< Handle Value Notification op code            Attribute Value 0 to (ATT_MTU-3)
-#define ATT_OP_HANDLE_VALUE_IND             0x1d //!< Handle Value Indication op code            Attribute Value 0 to (ATT_MTU-3)
-#define ATT_OP_HANDLE_VALUE_CFM             0x1e //!< Handle Value Confirmation op code
-#define ATT_OP_WRITE_CMD                    0x52 //!< ATT Write Command                            Attribute Value 0 to (ATT_MTU-3)
-#define ATT_OP_SIGNED_WRITE_CMD                0xd2 //!< ATT Signed Write Command                    Attribute Value 0 to (ATT_MTU - 15)
-
-
-
-
-/** @defgroup ATT_PERMISSIONS_BITMAPS GAP ATT Attribute Access Permissions Bit Fields
- * @{
- * (See the Core_v5.0(Vol 3/Part C/10.3.1/Table 10.2) for more information)
- */
-#define ATT_PERMISSIONS_AUTHOR                 0x10 //Attribute access(Read & Write) requires Authorization
-#define ATT_PERMISSIONS_ENCRYPT                 0x20 //Attribute access(Read & Write) requires Encryption
-#define ATT_PERMISSIONS_AUTHEN                 0x40 //Attribute access(Read & Write) requires Authentication(MITM protection)
-#define ATT_PERMISSIONS_SECURE_CONN             0x80 //Attribute access(Read & Write) requires Secure_Connection
-#define ATT_PERMISSIONS_SECURITY             (ATT_PERMISSIONS_AUTHOR | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN | ATT_PERMISSIONS_SECURE_CONN)
-
-//user can choose permission below
-#define ATT_PERMISSIONS_READ                 0x01 //!< Attribute is Readable
-#define ATT_PERMISSIONS_WRITE                0x02 //!< Attribute is Writable
-#define ATT_PERMISSIONS_RDWR                 (ATT_PERMISSIONS_READ | ATT_PERMISSIONS_WRITE)   //!< Attribute is Readable & Writable
-
-
-#define ATT_PERMISSIONS_ENCRYPT_READ         (ATT_PERMISSIONS_READ  | ATT_PERMISSIONS_ENCRYPT)         //!< Read requires Encryption
-#define ATT_PERMISSIONS_ENCRYPT_WRITE        (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_ENCRYPT)         //!< Write requires Encryption
-#define ATT_PERMISSIONS_ENCRYPT_RDWR         (ATT_PERMISSIONS_RDWR  | ATT_PERMISSIONS_ENCRYPT)         //!< Read & Write requires Encryption
-
-
-#define ATT_PERMISSIONS_AUTHEN_READ          (ATT_PERMISSIONS_READ  | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)         //!< Read requires Authentication
-#define ATT_PERMISSIONS_AUTHEN_WRITE         (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)         //!< Write requires Authentication
-#define ATT_PERMISSIONS_AUTHEN_RDWR          (ATT_PERMISSIONS_RDWR  | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)         //!< Read & Write requires Authentication
-
-
-#define ATT_PERMISSIONS_SECURE_CONN_READ     (ATT_PERMISSIONS_READ  | ATT_PERMISSIONS_SECURE_CONN | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)   //!< Read requires Secure_Connection
-#define ATT_PERMISSIONS_SECURE_CONN_WRITE    (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_SECURE_CONN | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)  //!< Write requires Secure_Connection
-#define ATT_PERMISSIONS_SECURE_CONN_RDWR     (ATT_PERMISSIONS_RDWR  | ATT_PERMISSIONS_SECURE_CONN | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)   //!< Read & Write requires Secure_Connection
-
-
-#define ATT_PERMISSIONS_AUTHOR_READ          (ATT_PERMISSIONS_READ | ATT_PERMISSIONS_AUTHOR)         //!< Read requires Authorization
-#define ATT_PERMISSIONS_AUTHOR_WRITE         (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_AUTHEN)         //!< Write requires Authorization
-#define ATT_PERMISSIONS_AUTHOR_RDWR          (ATT_PERMISSIONS_RDWR | ATT_PERMISSIONS_AUTHOR)         //!< Read & Write requires Authorization
-
-
-/** @} End GAP_ATT_PERMISSIONS_BITMAPS */
-
-
-
-//See the Core_v5.0(Vol 3/Part F/3.4.1.1, "Error Response") for more information.
-typedef enum {
-
-    ATT_SUCCESS = 0,
-
-    ATT_ERR_INVALID_HANDLE,                              //!< The attribute handle given was not valid on this server
-    ATT_ERR_READ_NOT_PERMITTED,                          //!< The attribute cannot be read
-    ATT_ERR_WRITE_NOT_PERMITTED,                         //!< The attribute cannot be written
-    ATT_ERR_INVALID_PDU,                                 //!< The attribute PDU was invalid
-    ATT_ERR_INSUFFICIENT_AUTH,                           //!< The attribute requires authentication before it can be read or written
-    ATT_ERR_REQ_NOT_SUPPORTED,                           //!< Attribute server does not support the request received from the client
-    ATT_ERR_INVALID_OFFSET,                              //!< Offset specified was past the end of the attribute
-    ATT_ERR_INSUFFICIENT_AUTHOR,                         //!< The attribute requires authorization before it can be read or written
-    ATT_ERR_PREPARE_QUEUE_FULL,                          //!< Too many prepare writes have been queued
-    ATT_ERR_ATTR_NOT_FOUND,                              //!< No attribute found within the given attribute handle range
-    ATT_ERR_ATTR_NOT_LONG,                               //!< The attribute cannot be read or written using the Read Blob Request
-    ATT_ERR_INSUFFICIENT_KEY_SIZE,                       //!< The Encryption Key Size used for encrypting this link is insufficient
-    ATT_ERR_INVALID_ATTR_VALUE_LEN,                      //!< The attribute value length is invalid for the operation
-    ATT_ERR_UNLIKELY_ERR,                                //!< The attribute request that was requested has encountered an error that was unlikely, and therefore could not be completed as requested
-    ATT_ERR_INSUFFICIENT_ENCRYPT,                        //!< The attribute requires encryption before it can be read or written
-    ATT_ERR_UNSUPPORTED_GRP_TYPE,                        //!< The attribute type is not a supported grouping attribute as defined by a higher layer specification
-    ATT_ERR_INSUFFICIENT_RESOURCES,                      //!< Insufficient Resources to complete the request
-
-
-
-}att_err_t;
-
-
-
-
-//TELINK MTU no longer than 256, so 1 byte is enough
-typedef struct{
-    u8 init_MTU;
-    u8 effective_MTU;
-    u8 Data_pending_time;    //10ms unit
-    u8 Data_permission_check;
-}att_para_t;
-extern att_para_t bltAtt;
-
-
-
-
-typedef struct
-{
-  u8 len;                    //!< Length of UUID
-  u8 uuid[16];               //!< UUID
-} uuid_t;
-
-/**
- * Error Response
- */
-typedef struct
-{
-    u8 reqOpcodeInErr; //!< The request that generated this error response
-    u8 errCode;   //!< The reason why the request has generated an error response
-    u16 attHandleInErr;   //!< The attribute handle that generated this error response
-} errorRsp_t;
-
-/**
- * Exchange MTU Request
- */
-typedef struct
-{
-    u16 clientRxMTU; //!< Attribute client receive MTU size
-} exchangeMTUReq_t;
-
-/**
- * Exchange MTU Response
- */
-typedef struct
-{
-    u16 serverRxMTU; //!< Attribute server receive MTU size
-} exchangeMTURsp_t;
-
-/**
- * Find Information Request
- */
-typedef struct
-{
-    u16 startingHandle;       //!< First requested handle number
-    u16 endingHandle;         //!< Last requested handle number
-} findInformationReq_t;
-
-/**
- * Handle(s) and 16-bit Bluetooth UUID(s)
- */
-typedef struct
-{
-    u16 handle;                //!< Handle
-    u8 uuid[ATT_16BIT_UUID_LEN]; //!< 16 bit UUID
-} handleBtUUID_t;
-
-/**
- * Handle(s) and 128-bit UUID(s)
- */
-typedef struct
-{
-    u16 handle;             //!< Handle
-    u8 uuid[ATT_128BIT_UUID_LEN]; //!< 128 bit UUID
-} handleUUID_t;
-
-/**
- * Find Information Response
- */
-typedef struct
-{
-    u8 format;       //!< Format of information
-    u8 infoNum;      //!< information num
-    u8 info[1];      //!< information
-} findInformationRsp_t;
-
-/**
- * Find By Type Value Request
- */
-typedef struct
-{
-  u16  startingHandle;          //!< First requested handle number
-  u16  endingHandle;            //!< Last requested handle number
-  u16  uuid;                    //!< UUID to find
-  u8   len;                     //!< Length of value
-  u8   value[1];   //!< Attribute value to find
-} findByTypeValueReq_t;
-
-/**
- * Handles Information list element
- */
-typedef struct
-{
-  u8 handle;         //!< Found attribute handle
-  u8 groupEndHandle; //!< Group end handle
-} handleInfo_t;
-
-/**
- * Find By Type Value Response
- */
-typedef struct
-{
-  u8 handleInfoNum;                                       //!< Number of handles information below
-  handleInfo_t handleInfo[1] ; //!< A list of 1 or more Handle Informations
-} findByTypeValueRsp_t;
-
-/**
- * Read By Type Request
- */
-typedef struct
-{
-  u16 startingHandle; //!< First requested handle number
-  u16 endingHandle;   //!< Last requested handle number
-  uuid_t attrType;    //!< 2 or 16 octet UUID
-} readByTypeReq_t;
-
-/**
- * Read By Type Response
- */
-typedef struct
-{
-  u8 numData;                  //!< Number of attribute data list item
-  u8 len;                      //!< The size of each attribute handle-value pair
-  u8 data[1];     //!< Attribute Data List
-} readByTypeRsp_t;
-
-/**
- * Read Request
- */
-typedef struct
-{
-  u16 handle;               //!< The handle of the attribute to be read
-} readReq_t;
-
-/**
- * Read Response
- */
-typedef struct
-{
-  u8 len;                   //!< Length of value
-  u8 attrValue[1];          //!< Value of the attribute with the handle given
-} readRsp_t;
-
-/**
- * Read Blob Req
- */
-typedef struct
-{
-  u16 handle; //!< The handle of the attribute to be read
-  u16 offset; //!< The offset of the first octet to be read
-} readBlobReq_t;
-
-/**
- * Read Blob Response
- */
-typedef struct
-{
-  u8 len;      //!< Length of value
-  u8 attrValue[1]; //!< Part of the value of the attribute with the handle given
-} readBlobRsp_t;
-
-/**
- * Read Multiple Request
- */
-typedef struct
-{
-  u8  numHandles; //!< Number of attribute handles
-  u16 handle[1];  //!< A set of two or more attribute handles
-} readMultipleReq_t;
-
-/**
- * Read Multiple Response
- */
-typedef struct
-{
-  u8 len;       //!< Length of values
-  u8 values[1]; //!< A set of two or more values
-} readMultiRsp_t;
-
-/**
- * Read By Group Type Request
- */
-typedef struct
-{
-  u16 startingHandle; //!< First requested handle number (must be first field)
-  u16 endingHandle;   //!< Last requested handle number
-  uuid_t attrType;     //!< 2 or 16 octet UUID
-} readByGroupTypeReq_t;
-
-/**
- * Read By Group Type Response
- */
-typedef struct
-{
-  u8 grpNum;                  //!< The number of attributes in this group
-  u8 len;                      //!< Length of each attribute handle
-  u8 data[1];                 //!< Attribute Data
-} readByGroupTypeRsp_t;
-
-/**
- * Write Request
- */
-typedef struct
-{
-  u16 handle;                            //!< The handle of the attribute to be written (must be first field)
-  u8 len;                                //!< Length of value
-  u8 value[1];            //!< The value to be written to the attribute
-} writeReq_t;
-
-/**
- * Write Command
- */
-typedef struct
-{
-  u16 handle;                         //!< The handle of the attribute to be written (must be first field)
-  u8 len;                             //!< Length of value
-  u8 value[1];         //!< The value to be written to the attribute
-  u8 sig;                             //!< the sig flag
-} writeCmd_t;
-
-/**
- * Prepare Write Request
- */
-typedef struct
-{
-  u16 handle;                 //!< Handle of the attribute to be written (must be first field)
-  u16 offset;                 //!< Offset of the first octet to be written
-  u8 len;                     //!< Length of value
-  u8 value[1]; //!< Part of the value of the attribute to be written
-} prepareWriteReq_t;
-
-/**
- * Prepare Write Response
- */
-typedef struct
-{
-  u16 handle;                       //!< The handle of the attribute to be written
-  u16 offset;                       //!< The offset of the first octet to be written
-  u8 len;                           //!< Length of value
-  u8 value[1];              //!< The value of the attribute to be written
-} prepareWriteRsp_t;
-
-/**
- * Execute Write Request
- */
-typedef struct
-{
-  u8 flags;   //!< 0x00 - cancel all prepared writes 0x01 - immediately write all pending prepared values
-} executeWriteReq_t;
-
-/**
- * Handle Value Notification
- */
-typedef struct
-{
-  u16 handle;               //!< The handle of the attribute
-  u8 len;                   //!< Length of value
-  u8 value[1];              //!< The current value of the attribute
-} handleValueNoti_t;
-
-/**
- * Handle Value Indication
- */
-typedef struct
-{
-  u16 handle;               //!< The handle of the attribute
-  u8 len;                   //!< Length of value
-  u8 value[1];              //!< The current value of the attribute
-} handleValueInd_t;
-
-typedef union attOpCode{
-    struct{
-        u8 method:6;
-        u8 cmdFlag:1;
-        u8 authSigFlag:1;
-    }bitField;
-    u8 byte;
-}attOpCode_t;
-
-
-
-
-/////////////////////////////
-// gatt.h
-/////////////////////////////
-/** @addtogroup GATT_Characteristic_Property GATT characteristic properties
- * @{
- */
-#define CHAR_PROP_BROADCAST              0x01 //!< permit broadcasts of the Characteristic Value
-#define CHAR_PROP_READ                   0x02 //!< permit reads of the Characteristic Value
-#define CHAR_PROP_WRITE_WITHOUT_RSP      0x04 //!< Permit writes of the Characteristic Value without response
-#define CHAR_PROP_WRITE                  0x08 //!< Permit writes of the Characteristic Value with response
-#define CHAR_PROP_NOTIFY                 0x10 //!< Permit notifications of a Characteristic Value without acknowledgement
-#define CHAR_PROP_INDICATE               0x20 //!< Permit indications of a Characteristic Value with acknowledgement
-#define CHAR_PROP_AUTHEN                 0x40 //!< permit signed writes to the Characteristic Value
-#define CHAR_PROP_EXTENDED               0x80 //!< additional characteristic properties are defined
-/** @} end of group GATT_Characteristic_Property */
-
-
-/** @addtogroup GATT_CCCC_Bits Client CharacteristicConfiguration bits
- * @{
- */
-#define CLIENT_CHAR_CFG_NOTI              0x0001 //!< permit broadcasts of the Characteristic Value
-#define CLIENT_CHAR_CFG_IND               0x0002 //!< permit reads of the Characteristic Value
-/** @} end of group GATT_CCCC_Bits */
-
-
-/** @addtogroup GATT_Property_length GATT characteristic property length
- * @{
- */
-#define CHAR_PROP_SIZE                   1
-/** @} end of group GATT_Property_length */
-
-/** @addtogroup GATT_Char_Cfg_Bit_length GATT characteristic configuration Bits length
- * @{
- */
-#define CHAR_CFG_BITS_SIZE               2
-/** @} end of group GATT_Char_Cfg_Bit_length */
-
-
-
-typedef int (*att_mtuSizeExchange_callback_t)(u16, u16);
-typedef int (*att_handleValueConfirm_callback_t)(void);
-typedef int (*att_readwrite_callback_t)(void* p);
-
-typedef struct attribute
-{
-  u16  attNum;
-  u8   perm;
-  u8   uuidLen;
-  u32  attrLen;    //4 bytes aligned
-  u8* uuid;
-  u8* pAttrValue;
-  att_readwrite_callback_t w;
-  att_readwrite_callback_t r;
-} attribute_t;
-
-
-
-
-
-
-extern u16    blt_indicate_handle;
-
-
-
-
-/******************************* User Interface  ************************************/
-ble_sts_t  bls_att_pushNotifyData (u16 attHandle, u8 *p, int len);
-ble_sts_t     bls_att_pushIndicateData (u16 attHandle, u8 *p, int len);
-void         bls_att_setAttributeTable (u8 *p);
-
-
-
-//mtu size
-ble_sts_t  blc_att_setRxMtuSize(u16 mtu_size);
-
-ble_sts_t     blc_att_requestMtuSizeExchange (u16 connHandle, u16 mtu_size);
-ble_sts_t     blc_att_responseMtuSizeExchange (u16 connHandle, u16 mtu_size);
-
-
-        // 0x04: ATT_OP_FIND_INFO_REQ
-void     att_req_find_info(u8 *dat, u16 start_attHandle, u16 end_attHandle);
-        // 0x06: ATT_OP_FIND_BY_TYPE_VALUE_REQ
-void     att_req_find_by_type (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, u8* attr_value, int len);
-        // 0x08: ATT_OP_READ_BY_TYPE_REQ
-void     att_req_read_by_type (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
-        // 0x0a: ATT_OP_READ_REQ
-void     att_req_read (u8 *dat, u16 attHandle);
-        // 0x0c: ATT_OP_READ_BLOB_REQ
-void     att_req_read_blob (u8 *dat, u16 attHandle, u16 offset);
-        // 0x10: ATT_OP_READ_BY_GROUP_TYPE_REQ
-void     att_req_read_by_group_type (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
-        // 0x12: ATT_OP_WRITE_REQ
-void     att_req_write (u8 *dat, u16 attHandle, u8 *buf, int len);
-        // 0x52: ATT_OP_WRITE_CMD
-void     att_req_write_cmd (u8 *dat, u16 attHandle, u8 *buf, int len);
-
-
-
-
-ble_sts_t     bls_att_setDeviceName(u8* pName,u8 len);  //only module/mesh/hci use
-
-
-int         att_register_idle_func (void *p);
-int         l2cap_att_client_handler (u16 conn, u8 *p);
-
-
-
-
-ble_sts_t    blc_att_requestMtuSizeExchange (u16 connHandle, u16 mtu_size);
-ble_sts_t    blc_att_responseMtuSizeExchange (u16 connHandle, u16 mtu_size);
-
-
-
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-extern u32 att_service_discover_tick;
-
-u8 * l2cap_att_handler(u16 connHandle, u8 * p);
-
-static inline u16  blc_att_getEffectiveMtuSize(u16 connHandle)
-{
-    return bltAtt.effective_MTU;
-}
-
-static inline void  blt_att_setEffectiveMtuSize(u16 connHandle, u8 effective_mtu)
-{
-    bltAtt.effective_MTU = effective_mtu;
-}
-
-static inline void  blt_att_resetEffectiveMtuSize(u16 connHandle)
-{
-    bltAtt.effective_MTU = ATT_MTU_SIZE;
-}
-
-void blt_att_procHoldAttributeCommand(void);
diff --git a/stack/ble/attr/gatt.h b/stack/ble/attr/gatt.h
deleted file mode 100644
index 19f4afb..0000000
--- a/stack/ble/attr/gatt.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/******************************************************************************
- * @file     gatt.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef GATT_H_
-#define GATT_H_
-
-
-
-
-/************************************ User Interface  *****************************************/
-
-ble_sts_t    blc_gatt_pushHandleValueNotify  (u16 connHandle, u16 attHandle, u8 *p, int len);
-
-ble_sts_t    blc_gatt_pushHandleValueIndicate(u16 connHandle, u16 attHandle, u8 *p, int len);
-
-
-ble_sts_t     blc_gatt_pushWriteComand (u16 connHandle, u16 attHandle, u8 *p, int len);
-
-ble_sts_t     blc_gatt_pushWriteRequest (u16 connHandle, u16 attHandle, u8 *p, int len);
-
-
-
-
-#if 0  //not available now
-
-ble_sts_t     blc_gatt_pushFindInformationRequest(u8 *dat, u16 start_attHandle, u16 end_attHandle);
-
-ble_sts_t     blc_gatt_pushFindByTypeValueRequest (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, u8* attr_value, int len);
-
-ble_sts_t     blc_gatt_pushReadByTypeRequest (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
-
-ble_sts_t     blc_gatt_pushReadRequest (u8 *dat, u16 attHandle);
-
-ble_sts_t     blc_gatt_pushReadBlobRequest (u8 *dat, u16 attHandle, u16 offset);
-
-ble_sts_t     blc_gatt_pushReadByGroupTypeRequest (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
-
-
-#endif
-
-
-
-
-
-
-/****************************** Stack Interface, user can not use!!! ***************************/
-u8 blc_gatt_requestServiceAccess(u16 connHandle, int gatt_perm);
-
-
-
-
-
-
-#endif /* GATT_H_ */
diff --git a/stack/ble/attr/gatt_uuid.h b/stack/ble/attr/gatt_uuid.h
deleted file mode 100644
index ca5beec..0000000
--- a/stack/ble/attr/gatt_uuid.h
+++ /dev/null
@@ -1,148 +0,0 @@
-/******************************************************************************
- * @file     gatt_uuid.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#ifndef GATT_UUID_H_
-#define GATT_UUID_H_
-
-/** @addtogroup  GATT_Common_Module GATT UUID
- *  @{
- */
-
-
-/** @addtogroup GATT_UUID GATT 16 bit UUID definition
- * @{
- */
-#define GATT_UUID_PRIMARY_SERVICE        0x2800     //!< Primary Service
-#define GATT_UUID_SECONDARY_SERVICE      0x2801     //!< Secondary Service
-#define GATT_UUID_INCLUDE                0x2802     //!< Include
-#define GATT_UUID_CHARACTER              0x2803     //!< Characteristic
-#define GATT_UUID_CHAR_EXT_PROPS         0x2900     //!< Characteristic Extended Properties
-#define GATT_UUID_CHAR_USER_DESC         0x2901     //!< Characteristic User Description
-#define GATT_UUID_CLIENT_CHAR_CFG        0x2902     //!< Client Characteristic Configuration
-#define GATT_UUID_SERVER_CHAR_CFG        0x2903     //!< Server Characteristic Configuration
-#define GATT_UUID_CHAR_PRESENT_FORMAT    0x2904     //!< Characteristic Present Format
-#define GATT_UUID_CHAR_AGG_FORMAT        0x2905     //!< Characteristic Aggregate Format
-#define GATT_UUID_VALID_RANGE            0x2906     //!< Valid Range
-#define GATT_UUID_EXT_REPORT_REF         0x2907     //!< External Report Reference
-#define GATT_UUID_REPORT_REF             0x2908     //!< Report Reference
-
-#define GATT_UUID_DEVICE_NAME            0x2a00     //!< Report Reference
-#define GATT_UUID_APPEARANCE             0x2a01
-#define GATT_UUID_PERI_CONN_PARAM        0x2a04
-#define GATT_UUID_SERVICE_CHANGE         0x2a05
-#define GATT_UUID_BATTERY_LEVEL          0x2A19
-#define GATT_UUID_FIRMWARE_VER           0x2a26     //!<Firmware Version
-/** @} end of group GATT_UUID */
-
-
-///////////////////////////
-// Service UUID
-///////////////////////////
-/**
- *  @brief  Definition for Services UUID
- */
-#define SERVICE_UUID_ALERT_NOTIFICATION                           0x1811
-#define SERVICE_UUID_BATTERY                                      0x180F
-#define SERVICE_UUID_BLOOD_PRESSURE                               0x1810
-#define SERVICE_UUID_CURRENT_TIME                                 0x1805
-#define SERVICE_UUID_CYCLING_POWER                                0x1818
-#define SERVICE_UUID_CYCLING_SPEED_AND_CADENCE                    0x1816
-#define SERVICE_UUID_DEVICE_INFORMATION                           0x180A
-#define SERVICE_UUID_GENERIC_ACCESS                               0x1800
-#define SERVICE_UUID_GENERIC_ATTRIBUTE                            0x1801
-#define SERVICE_UUID_GLUCOSE                                      0x1808
-#define SERVICE_UUID_HEALTH_THERMOMETER                           0x1809
-#define SERVICE_UUID_HEART_RATE                                   0x180D
-#define SERVICE_UUID_HUMAN_INTERFACE_DEVICE                       0x1812
-#define SERVICE_UUID_IMMEDIATE_ALERT                              0x1802
-#define SERVICE_UUID_LINK_LOSS                                    0x1803
-#define SERVICE_UUID_LOCATION_AND_NAVIGATION                      0x1819
-#define SERVICE_UUID_NEXT_DST_CHANGE                              0x1807
-#define SERVICE_UUID_PHONE_ALERT_STATUS                           0x180E
-#define SERVICE_UUID_REFERENCE_TIME_UPDATE                        0x1806
-#define SERVICE_UUID_RUNNING_SPEED_AND_CADENCE                    0x1814
-#define SERVICE_UUID_SCAN_PARAMETER                               0x1813
-#define SERVICE_UUID_TX_POWER                                     0x1804
-#define SERVICE_UUID_USER_DATA                                    0x181C
-#define SERVICE_UUID_CONTINUOUS_GLUCOSE_MONITORING                0x181F
-#define SERVICE_UUID_WEIGHT_SCALE                                 0x181D
-
-////////////////////////////////////
-// Telink Service
-////////////////////////////////////
-#define TELINK_SPP_UUID_SERVICE               {0x10,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
-#define TELINK_AUDIO_UUID_SERVICE             {0x11,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
-#define TELINK_OTA_UUID_SERVICE               {0x12,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_OTA service
-#define TELINK_MESH_UUID_SERVICE              {0x20,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
-#define TELINK_MESH_LT_UUID_SERVICE           {0x21,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
-
-#define TELINK_SPP_DATA_SERVER2CLIENT         {0x10,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from server to client
-#define TELINK_SPP_DATA_CLIENT2SERVER         {0x11,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from client to server
-#define TELINK_SPP_DATA_OTA                    0x12,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00         //!< TELINK_SPP data for ota
-#define TELINK_SPP_DATA_PAIR                  {0x13,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data for ota
-#define TELINK_SPP_DATA_DEFINE                {0x14,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data for userdefine data
-
-
-#define TELINK_MIC_DATA                       {0x18,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from server to client
-#define TELINK_SPEAKER_DATA                   {0x19,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from client to server
-
-
-#define AUDIO_GOOGLE_SERVICE_UUID              0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x01,0x00,0x5E,0xAB
-#define AUDIO_GOOGL_TX_CHAR_UUID               0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x02,0x00,0x5E,0xAB
-#define AUDIO_GOOGL_RX_CHAR_UUID               0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x03,0x00,0x5E,0xAB
-#define AUDIO_GOOGL_CTL_CHAR_UUID              0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x04,0x00,0x5E,0xAB
-
-#define TELINK_IR_UUID_SERVICE                 0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc0,0xbf,0x43,0xd3
-#define TELINK_IR_PROG_CONTROL_UUID_SERVICE    0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc1,0xbf,0x43,0xd3
-#define TELINK_IR_KEY_ID_UUID_SERVICE          0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc2,0xbf,0x43,0xd3
-#define TELINK_IR_CODE_UUID_SERVICE            0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc3,0xbf,0x43,0xd3
-#define TELINK_IR_SUPPRESS_UUID_SERVICE        0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc4,0xbf,0x43,0xd3
-#define TELINK_IR_KEY_EVENT_UUID_SERVICE       0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc5,0xbf,0x43,0xd3
-
-#if (MP_TEST_MODE)
-#define TEST_MODE_SERVICE_UUID                 0x10,0x30,0x0D,0x0C,0x0B,0x0A,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00
-#define TEST_MODE_TEST_DATA_UUID               0x11,0x30,0x0D,0x0C,0x0B,0x0A,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00
-#endif
-
-
-/** @addtogroup  GATT_UUID_Variables GATT UUID variables
- *  @{
- */
-/**
- *  @brief  External variable for GATT UUID which can be used in service definition
- */
-/** @} end of group GATT_UUID_Variables */
-
-/** @} end of group GATT_Common_Module */
-
-
-#define CHARACTERISTIC_UUID_BATTERY_LEVEL                    0x2A19
-#define CHARACTERISTIC_UUID_ALERT_LEVEL                      0x2A06
-
-//#include <stack/ble/service/hids.h>
-#include "att.h"
-#include <stack/ble/service/device_information.h>
-
-#endif
diff --git a/stack/ble/ble.h b/stack/ble/ble.h
index 6943052..cdcd347 100644
--- a/stack/ble/ble.h
+++ b/stack/ble/ble.h
@@ -23,74 +23,34 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-
 #ifndef BLE_H_
 #define BLE_H_
 
 
-#include "blt_config.h"
 #include "ble_common.h"
 #include "ble_format.h"
 
-#include "l2cap/l2cap.h"
-#include "phy/phy.h"
-#include "phy/phy_test.h"
-
-
-#include "attr/att.h"
-#include "attr/gatt.h"
-#include "attr/gatt_uuid.h"
-
-
-#include "smp/smp.h"
-#include "smp/smp_const.h"
-#include "smp/smp_central.h"
-#include "smp/smp_peripheral.h"
-#include "smp/smp_storage.h"
-
-#include "gap/gap.h"
-#include "gap/gap_event.h"
-
-#include "crypt/aes_ccm.h"
-#include "crypt/le_crypto.h"
-#include "crypt/aes/aes_att.h"
+#include "controller/ble_controller.h"
+#include "host/ble_host.h"
 
 #include "hci/hci.h"
 #include "hci/hci_const.h"
+#include "hci/hci_cmd.h"
 #include "hci/hci_event.h"
-#include "hci/usb_desc.h"
 
-#include "service/ble_ll_ota.h"
+#include "service/ota/ota.h"
+#include "service/ota/ota_server.h"
 #include "service/device_information.h"
 #include "service/hids.h"
-
-#include "ll/ll.h"
-#include "ll/ll_adv.h"
-#include "ll/ll_encrypt.h"
-#include "ll/ll_init.h"
-#include "ll/ll_pm.h"
-#include "ll/ll_scan.h"
-#include "ll/ll_whitelist.h"
-#include "ll/ll_conn/ll_conn.h"
-#include "ll/ll_conn/ll_slave.h"
-#include "ll/ll_conn/ll_master.h"
-#include "ll/ll_conn/ll_conn_phy.h"
-#include "ll/ll_conn/ll_conn_csa.h"
-
-#include "ll/ll_ext.h"
-#include "ll/ll_ext_adv.h"
-#include "ll/ll_ext_scan.h"
+#include "service/uuid.h"
 
 
-#include "bqb/bqb_ll.h"
+/*********************************************************/
+//Remove when file merge to SDK //
 
+/*********************************************************/
 
 
 
 
-volatile void  smemset(register char * dest,register int val,register unsigned int len);
-volatile void * smemcpy(register char * out, register char * in, register unsigned int len);
-
-
-
 #endif /* BLE_H_ */
diff --git a/stack/ble/ble_common.h b/stack/ble/ble_common.h
index 242c8aa..6fc2168 100644
--- a/stack/ble/ble_common.h
+++ b/stack/ble/ble_common.h
@@ -26,237 +26,8 @@
 #ifndef BLE_COMMON_H
 #define BLE_COMMON_H
 
-#include "blt_config.h"
+#include "ble_config.h"
 #include "tl_common.h"
-/*********************************************************************
- * CONSTANTS
- */
-
-
-/**
- *  @brief  Definition for Link Layer Feature Support
- */
-#define LL_FEATURE_SIZE                                      8
-#define LL_FEATURE_MASK_LL_ENCRYPTION                        (0x00000001)   //core_4.0
-#define LL_FEATURE_MASK_CONNECTION_PARA_REQUEST_PROCEDURE    (0x00000002)    //core_4.1
-#define LL_FEATURE_MASK_EXTENDED_REJECT_INDICATION           (0x00000004)    //core_4.1
-#define LL_FEATURE_MASK_SLAVE_INITIATED_FEATURES_EXCHANGE    (0x00000008)    //core_4.1
-#define LL_FEATURE_MASK_LE_PING                              (0x00000010)   //core_4.1
-#define LL_FEATURE_MASK_LE_DATA_LENGTH_EXTENSION             (0x00000020)    //core_4.2
-#define LL_FEATURE_MASK_LL_PRIVACY                           (0x00000040)    //core_4.2
-#define LL_FEATURE_MASK_EXTENDED_SCANNER_FILTER_POLICIES     (0x00000080)   //core_4.2
-#define LL_FEATURE_MASK_LE_2M_PHY                            (0x00000100)    //core_5.0
-#define LL_FEATURE_MASK_STABLE_MODULATION_INDEX_TX           (0x00000200)    //core_5.0
-#define LL_FEATURE_MASK_STABLE_MODULATION_INDEX_RX           (0x00000400)    //core_5.0
-#define LL_FEATURE_MASK_LE_CODED_PHY                         (0x00000800)    //core_5.0
-#define LL_FEATURE_MASK_LE_EXTENDED_ADVERTISING              (0x00001000)    //core_5.0
-#define LL_FEATURE_MASK_LE_PERIODIC_ADVERTISING              (0x00002000)    //core_5.0
-#define LL_FEATURE_MASK_CHANNEL_SELECTION_ALGORITHM2         (0x00004000)    //core_5.0
-#define LL_FEATURE_MASK_LE_POWER_CLASS_1                     (0x00008000)    //core_5.0
-#define LL_FEATURE_MASK_MIN_USED_OF_USED_CHANNELS            (0x00010000)    //core_5.0
-
-/////////////////////////////////////////////////////////////////////////////
-
-#define         VENDOR_ID                       0x0211
-#define         VENDOR_ID_HI_B                  U16_HI(VENDOR_ID)
-#define         VENDOR_ID_LO_B                  U16_LO(VENDOR_ID)
-
-#define            BLUETOOTH_VER_4_0                6
-#define            BLUETOOTH_VER_4_1                7
-#define            BLUETOOTH_VER_4_2                8
-#define            BLUETOOTH_VER_5_0                9
-
-#ifndef         BLUETOOTH_VER
-#define            BLUETOOTH_VER                    BLUETOOTH_VER_5_0
-#endif
-
-
-#if (BLUETOOTH_VER == BLUETOOTH_VER_4_2)
-    #define            BLUETOOTH_VER_SUBVER            0x22BB
-#elif (BLUETOOTH_VER == BLUETOOTH_VER_5_0)
-    #define            BLUETOOTH_VER_SUBVER            0x1C1C
-#else
-    #define            BLUETOOTH_VER_SUBVER            0x4103
-#endif
-
-
-
-
-#if (BLUETOOTH_VER == BLUETOOTH_VER_4_0)
-    #define LL_FEATURE_ENABLE_LE_ENCRYPTION                                1
-    #define LL_CMD_MAX                                                     LL_REJECT_IND
-
-#elif (BLUETOOTH_VER == BLUETOOTH_VER_4_1)
-    #define LL_FEATURE_ENABLE_LE_ENCRYPTION                             1
-    #define LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION                1
-    #define LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE         1
-    #define LL_FEATURE_ENABLE_LE_PING                                   1
-
-    #define LL_CMD_MAX                                                  LL_PING_RSP
-
-#elif (BLUETOOTH_VER == BLUETOOTH_VER_4_2)
-
-    #define LL_FEATURE_ENABLE_LE_ENCRYPTION                             1
-    #define LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION                1
-    #define LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE         1
-    #define LL_FEATURE_ENABLE_LE_PING                                   1
-    #define LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION                  BLE_CORE42_DATA_LENGTH_EXTENSION_ENABLE
-
-    #define LL_CMD_MAX                                                  LL_LENGTH_RSP
-
-#elif (BLUETOOTH_VER == BLUETOOTH_VER_5_0)
-
-    #define LL_FEATURE_ENABLE_LE_ENCRYPTION                             1
-    #define LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION                1
-    #define LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE         1
-    #define LL_FEATURE_ENABLE_LE_PING                                   1
-    #define LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION                  BLE_CORE42_DATA_LENGTH_EXTENSION_ENABLE
-
-    #define LL_FEATURE_ENABLE_LE_2M_PHY                                 LL_FEATURE_SUPPORT_LE_2M_PHY
-    #define LL_FEATURE_ENABLE_LE_CODED_PHY                              LL_FEATURE_SUPPORT_LE_CODED_PHY
-    #define LL_FEATURE_ENABLE_LE_EXTENDED_ADVERTISING                   LL_FEATURE_SUPPORT_LE_EXTENDED_ADVERTISING
-    #define LL_FEATURE_ENABLE_LE_PERIODIC_ADVERTISING                   LL_FEATURE_SUPPORT_LE_PERIODIC_ADVERTISING
-    #define LL_FEATURE_ENABLE_CHANNEL_SELECTION_ALGORITHM2              LL_FEATURE_SUPPORT_CHANNEL_SELECTION_ALGORITHM2
-
-    #define LL_CMD_MAX                                                  LL_MIN_USED_CHN_IND
-#else
-
-
-#endif
-
-
-#ifndef         LL_FEATURE_ENABLE_LE_ENCRYPTION
-#define         LL_FEATURE_ENABLE_LE_ENCRYPTION                            0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_CONNECTION_PARA_REQUEST_PROCEDURE
-#define         LL_FEATURE_ENABLE_CONNECTION_PARA_REQUEST_PROCEDURE        0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION
-#define         LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION               0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE
-#define         LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE        0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_PING
-#define         LL_FEATURE_ENABLE_LE_PING                                  0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION
-#define         LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION                 0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LL_PRIVACY
-#define         LL_FEATURE_ENABLE_LL_PRIVACY                               0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_EXTENDED_SCANNER_FILTER_POLICIES
-#define         LL_FEATURE_ENABLE_EXTENDED_SCANNER_FILTER_POLICIES         0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_2M_PHY
-#define         LL_FEATURE_ENABLE_LE_2M_PHY                                0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_TX
-#define         LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_TX               0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_RX
-#define         LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_RX               0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_CODED_PHY
-#define         LL_FEATURE_ENABLE_LE_CODED_PHY                             0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_EXTENDED_ADVERTISING
-#define         LL_FEATURE_ENABLE_LE_EXTENDED_ADVERTISING                  0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_PERIODIC_ADVERTISING
-#define         LL_FEATURE_ENABLE_LE_PERIODIC_ADVERTISING                  0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_CHANNEL_SELECTION_ALGORITHM2
-#define         LL_FEATURE_ENABLE_CHANNEL_SELECTION_ALGORITHM2             0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_LE_POWER_CLASS_1
-#define         LL_FEATURE_ENABLE_LE_POWER_CLASS_1                         0
-#endif
-
-#ifndef         LL_FEATURE_ENABLE_MIN_USED_OF_USED_CHANNELS
-#define         LL_FEATURE_ENABLE_MIN_USED_OF_USED_CHANNELS                0
-#endif
-
-
-
-
-//BIT<0:31>
-#if 1
-
-// feature below is conFiged by application layer
-// LL_FEATURE_ENABLE_LE_2M_PHY
-// LL_FEATURE_ENABLE_LE_CODED_PHY
-// LL_FEATURE_ENABLE_LE_EXTENDED_ADVERTISING
-// LL_FEATURE_ENABLE_CHANNEL_SELECTION_ALGORITHM2
-
-#define LL_FEATURE_MASK_BASE0                                            (    LL_FEATURE_ENABLE_LE_ENCRYPTION                     <<0        |  \
-                                                                                                                        LL_FEATURE_ENABLE_CONNECTION_PARA_REQUEST_PROCEDURE <<1        |  \
-                                                                                                                        LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION            <<2        |  \
-                                                                                                                        LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE <<3        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_PING                                <<4        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION                <<5        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LL_PRIVACY                            <<6        |  \
-                                                                                                                        LL_FEATURE_ENABLE_EXTENDED_SCANNER_FILTER_POLICIES  <<7        |  \
-                                                                                                                        LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_TX            <<9        |  \
-                                                                                                                        LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_RX             <<10    |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_PERIODIC_ADVERTISING                <<13    |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_POWER_CLASS_1                        <<15    |  \
-                                                                                                                        LL_FEATURE_ENABLE_MIN_USED_OF_USED_CHANNELS         <<16     )
-#else
-#define LL_FEATURE_MASK_0                                                (    LL_FEATURE_ENABLE_LE_ENCRYPTION                     <<0        |  \
-                                                                                                                        LL_FEATURE_ENABLE_CONNECTION_PARA_REQUEST_PROCEDURE <<1        |  \
-                                                                                                                        LL_FEATURE_ENABLE_EXTENDED_REJECT_INDICATION            <<2        |  \
-                                                                                                                        LL_FEATURE_ENABLE_SLAVE_INITIATED_FEATURES_EXCHANGE <<3        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_PING                                <<4        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION                <<5        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LL_PRIVACY                            <<6        |  \
-                                                                                                                        LL_FEATURE_ENABLE_EXTENDED_SCANNER_FILTER_POLICIES  <<7        |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_2M_PHY                         <<8        |  \
-                                                                                                                        LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_TX            <<9        |  \
-                                                                                                                        LL_FEATURE_ENABLE_STABLE_MODULATION_INDEX_RX             <<10    |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_CODED_PHY                            <<11    |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_EXTENDED_ADVERTISING                 <<12    |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_PERIODIC_ADVERTISING                <<13    |  \
-                                                                                                                        LL_FEATURE_ENABLE_CHANNEL_SELECTION_ALGORITHM2            <<14    |  \
-                                                                                                                        LL_FEATURE_ENABLE_LE_POWER_CLASS_1                        <<15    |  \
-                                                                                                                        LL_FEATURE_ENABLE_MIN_USED_OF_USED_CHANNELS         <<16     )
-
-#endif
-
-
-extern u32 LL_FEATURE_MASK_0;
-
-//BIT<32:63>
-#define LL_FEATURE_MASK_1                                                0
-
-
-#define LL_FEATURE_BYTE_0                                                U32_BYTE0(LL_FEATURE_MASK_0)
-#define LL_FEATURE_BYTE_1                                                U32_BYTE1(LL_FEATURE_MASK_0)
-#define LL_FEATURE_BYTE_2                                                U32_BYTE2(LL_FEATURE_MASK_0)
-#define LL_FEATURE_BYTE_3                                                U32_BYTE3(LL_FEATURE_MASK_0)
-#define LL_FEATURE_BYTE_4                                                U32_BYTE0(LL_FEATURE_MASK_1)
-#define LL_FEATURE_BYTE_5                                                U32_BYTE1(LL_FEATURE_MASK_1)
-#define LL_FEATURE_BYTE_6                                                U32_BYTE2(LL_FEATURE_MASK_1)
-#define LL_FEATURE_BYTE_7                                                U32_BYTE3(LL_FEATURE_MASK_1)
-
-
-
 
 
 
@@ -332,6 +103,7 @@
     HCI_ERR_UNKNOWN_ADV_IDENTIFIER                                 = 0x42,
     HCI_ERR_LIMIT_REACHED                                          = 0x43,
     HCI_ERR_OP_CANCELLED_BY_HOST                                   = 0x44,
+    HCI_ERR_PACKET_TOO_LONG                                        = 0x45,
 
 
 
@@ -344,9 +116,20 @@
     LL_ERR_TX_FIFO_NOT_ENOUGH,
     LL_ERR_ENCRYPTION_BUSY,
     LL_ERR_CURRENT_STATE_NOT_SUPPORTED_THIS_CMD,
+    LL_ERR_INVALID_PARAMETER,
+    LL_ERR_UNKNOWN_OPCODE,
+
+    LL_ERR_CIS_SYNC_FAIL,
+    LL_ERR_CIS_DISCONNECT,
+
 
     //L2CAP status
     L2CAP_ERR_INVALID_PARAMETER                                    = 0x90,
+    L2CAP_ERR_INVALID_HANDLE,
+    L2CAP_ERR_INSUFFICIENT_RESOURCES,
+    L2CAP_ERR_PSM_NOT_REGISTER,
+    L2CAP_ERR_CONTROL_NOT_READY,
+    L2CAP_ERR_PSM_HAVE_ESTABLISH,
 
     //SMP status
     SMP_ERR_INVALID_PARAMETER                                      = 0xA0,
@@ -361,8 +144,24 @@
     GATT_ERR_DATA_LENGTH_EXCEED_MTU_SIZE,
 
     //GAP status
-    GAP_ERR_INVALID_PARAMETER                                       = 0xC0,
+    GAP_ERR_INVALID_PARAMETER                                      = 0xC0,
+    //IAL
+    IAL_ERR_SDU_LEN_EXCEED_SDU_MAX,
+    IAL_ERR_LOSS_SDU_INTRVEL,
+    IAL_ERR_ISO_TX_FIFO_NOT_ENOUGH,
+    IAL_ERR_SDU_BUFF_INVALID,
 
+    //Service status
+    SERVICE_ERR_INVALID_PARAMETER                                    = 0xD0,
+
+    //Application buffer check error code
+    LL_ACL_RX_BUF_NO_INIT                                                 = 0xE0,
+    LL_ACL_RX_BUF_PARAM_INVALID,
+    LL_ACL_RX_BUF_SIZE_NOT_MEET_MAX_RX_OCT,
+    LL_ACL_TX_BUF_NO_INIT,
+    LL_ACL_TX_BUF_PARAM_INVALID,
+    LL_ACL_TX_BUF_SIZE_MUL_NUM_EXCEED_4K,
+    LL_ACL_TX_BUF_SIZE_NOT_MEET_MAX_TX_OCT,
 
 } ble_sts_t;
 
@@ -376,11 +175,6 @@
 
 
 
-
-
-/******************************************** Link Layer **************************************************************/
-
-
 /////////////////////////////// BLE  MAC ADDRESS //////////////////////////////////////////////
 #define BLE_ADDR_PUBLIC                  0
 #define BLE_ADDR_RANDOM                  1
@@ -415,96 +209,108 @@
 #define IS_RESOLVABLE_PRIVATE_ADDR(Type, Addr)          ( (Type)==BLE_ADDR_RANDOM && (Addr[5] & 0xC0) == 0x40 )
 
 
-
-
-
-
-
-
-///////////////// ADV Interval/Scan Interval/Scan Window/Connection Interval  /////////////////
-#define         ADV_INTERVAL_3_125MS                        5
-#define         ADV_INTERVAL_3_75MS                         6
-#define         ADV_INTERVAL_10MS                           16
-#define         ADV_INTERVAL_15MS                           24
-#define         ADV_INTERVAL_20MS                           32
-#define         ADV_INTERVAL_25MS                           40
-#define         ADV_INTERVAL_30MS                           48
-#define         ADV_INTERVAL_35MS                           56
-#define         ADV_INTERVAL_40MS                           64
-#define         ADV_INTERVAL_45MS                           72
-#define         ADV_INTERVAL_50MS                           80
-#define         ADV_INTERVAL_55MS                           88
-#define         ADV_INTERVAL_60MS                           96
-#define         ADV_INTERVAL_70MS                           112
-#define         ADV_INTERVAL_80MS                           128
-#define         ADV_INTERVAL_90MS                           144
-#define         ADV_INTERVAL_100MS                          160
-#define         ADV_INTERVAL_105MS                          168
-#define         ADV_INTERVAL_200MS                          320
-#define         ADV_INTERVAL_205MS                          328
-#define         ADV_INTERVAL_300MS                          480
-#define         ADV_INTERVAL_305MS                          488
-#define         ADV_INTERVAL_400MS                          640
-#define         ADV_INTERVAL_405MS                          648
-#define         ADV_INTERVAL_500MS                          800
-#define         ADV_INTERVAL_505MS                          808
-
-#define         ADV_INTERVAL_1S                             1600
-#define         ADV_INTERVAL_1S5                            2400
-#define         ADV_INTERVAL_2S                             3200
-#define         ADV_INTERVAL_1_28_S                         0x0800
-#define         ADV_INTERVAL_10_24S                         16384
-
-
-
-#define         SCAN_INTERVAL_10MS                          16
-#define         SCAN_INTERVAL_30MS                          48
-#define         SCAN_INTERVAL_50MS                          80
-#define         SCAN_INTERVAL_60MS                          96
-#define         SCAN_INTERVAL_90MS                          144
-#define         SCAN_INTERVAL_100MS                         160
-#define         SCAN_INTERVAL_200MS                         320
-#define         SCAN_INTERVAL_300MS                         480
-#define         SCAN_INTERVAL_400MS                         640
-#define         SCAN_INTERVAL_500MS                         800
-
-
-#define         CONN_INTERVAL_7P5MS                          6
-#define         CONN_INTERVAL_10MS                           8
-#define         CONN_INTERVAL_11P25MS                        9
-#define         CONN_INTERVAL_15MS                           12
-#define         CONN_INTERVAL_16P25MS                        13
-#define         CONN_INTERVAL_18P75MS                        15
-#define         CONN_INTERVAL_20MS                           16
-#define         CONN_INTERVAL_30MS                           24
-#define         CONN_INTERVAL_31P25MS                        25
-#define         CONN_INTERVAL_38P75MS                        31
-#define         CONN_INTERVAL_40MS                           32
-#define         CONN_INTERVAL_48P75MS                        39
-#define         CONN_INTERVAL_50MS                           40
-#define         CONN_INTERVAL_100MS                          80
-
-
-#define         CONN_TIMEOUT_500MS                           50
-#define         CONN_TIMEOUT_1S                              100
-#define         CONN_TIMEOUT_4S                              400
-#define         CONN_TIMEOUT_10S                             1000
-#define         CONN_TIMEOUT_20S                             2000
-
-
-
+#define        MAC_MATCH8(md,ms)    (md[0]==ms[0] && md[1]==ms[1] && md[2]==ms[2] && md[3]==ms[3] && md[4]==ms[4] && md[5]==ms[5])
+#define        MAC_MATCH16(md,ms)    (md[0]==ms[0] && md[1]==ms[1] && md[2]==ms[2])
+#define        MAC_MATCH32(md,ms)    (md[0]==ms[0] && md[1]==ms[1])
 /////////////////////////////////////////////////////////////////////////////
 
-#define                 LLID_RESERVED                0x00
-#define                 LLID_DATA_CONTINUE           0x01
-#define                 LLID_DATA_START              0x02
-#define                 LLID_CONTROL                 0x03
+/******************************************** ATT ***************************************************************/
 
-/////////////////////////////////////////////////////////////////////////////
-                                                                                // rf_len without MIC
-#define                 LL_CONNECTION_UPDATE_REQ     0x00                            //    12
-#define                 LL_CHANNEL_MAP_REQ           0x01                            //    8
-#define                 LL_TERMINATE_IND             0x02                            //    2
+/**
+ *  @brief  Definition for Attribute protocol PDUs
+ */
+typedef enum{
+    ATT_OP_ERROR_RSP                    = 0x01,
+    ATT_OP_EXCHANGE_MTU_REQ                = 0x02,
+    ATT_OP_EXCHANGE_MTU_RSP                = 0x03,
+    ATT_OP_FIND_INFORMATION_REQ            = 0x04,        ATT_OP_FIND_INFO_REQ = 0x04,
+    ATT_OP_FIND_INFORMATION_RSP            = 0x05,        ATT_OP_FIND_INFO_RSP = 0x05,
+    ATT_OP_FIND_BY_TYPE_VALUE_REQ        = 0x06,
+    ATT_OP_FIND_BY_TYPE_VALUE_RSP        = 0x07,
+    ATT_OP_READ_BY_TYPE_REQ                = 0x08,
+    ATT_OP_READ_BY_TYPE_RSP                = 0x09,
+    ATT_OP_READ_REQ                        = 0x0A,
+    ATT_OP_READ_RSP                        = 0x0B,
+    ATT_OP_READ_BLOB_REQ                = 0x0C,
+    ATT_OP_READ_BLOB_RSP                = 0x0D,
+    ATT_OP_READ_MULTIPLE_REQ            = 0x0E,        ATT_OP_READ_MULTI_REQ = 0x0E,
+    ATT_OP_READ_MULTIPLE_RSP            = 0x0F,
+    ATT_OP_READ_BY_GROUP_TYPE_REQ        = 0x10,
+    ATT_OP_READ_BY_GROUP_TYPE_RSP        = 0x11,
+    ATT_OP_WRITE_REQ                    = 0x12,
+    ATT_OP_WRITE_RSP                    = 0x13,
+    ATT_OP_PREPARE_WRITE_REQ            = 0x16,
+    ATT_OP_PREPARE_WRITE_RSP            = 0x17,
+    ATT_OP_EXECUTE_WRITE_REQ            = 0x18,
+    ATT_OP_EXECUTE_WRITE_RSP            = 0x19,
+
+    ATT_OP_HANDLE_VALUE_NTF                = 0x1B,        ATT_OP_HANDLE_VALUE_NOTI = 0x1B,
+    ATT_OP_HANDLE_VALUE_IND                = 0x1D,
+    ATT_OP_HANDLE_VALUE_CFM                = 0x1E,
+
+    ATT_OP_READ_MULTIPLE_VARIABLE_REQ    = 0x20,    //core_5.2
+    ATT_OP_READ_MULTIPLE_VARIABLE_RSP    = 0x21, //core_5.2
+    ATT_OP_MULTIPLE_HANDLE_VALUE_NTF    = 0x23, //core_5.2
+
+    ATT_OP_WRITE_CMD                    = 0x52,
+    ATT_OP_SIGNED_WRITE_CMD                = 0xD2,
+}att_pdu_type;
+
+
+
+
+/******************************************** L2CAP ***************************************************************/
+
+/**
+ *  @brief  Definition for L2CAP CID name space for the LE-U
+ */
+typedef enum{
+    L2CAP_CID_NULL                = 0x0000,
+    L2CAP_CID_ATTR_PROTOCOL        = 0x0004,
+    L2CAP_CID_SIG_CHANNEL        = 0x0005,
+    L2CAP_CID_SMP                = 0x0006,
+}l2cap_cid_type;
+
+/**
+ *  @brief  Definition for L2CAP signal packet formats
+ */
+typedef enum{
+    L2CAP_COMMAND_REJECT_RSP                   = 0x01,
+    L2CAP_CONNECTION_REQ                     = 0x02,
+    L2CAP_CONNECTION_RSP                     = 0x03,
+    L2CAP_CONFIGURATION_REQ                    = 0x04,
+    L2CAP_CONFIGURATION_RSP                   = 0x05,
+    L2CAP_DISCONNECTION_REQ                   = 0x06,
+    L2CAP_DISCONNECTION_RSP                   = 0x07,
+    L2CAP_ECHO_REQ                           = 0x08,
+    L2CAP_ECHO_RSP                           = 0x09,
+    L2CAP_INFORMATION_REQ                   = 0x0A,
+    L2CAP_INFORMATION_RSP                   = 0x0B,
+    L2CAP_CREATE_CHANNEL_REQ                  = 0x0C,
+    L2CAP_CREATE_CHANNEL_RSP                   = 0x0D,
+    L2CAP_MOVE_CHANNEL_REQ                   = 0x0E,
+    L2CAP_MOVE_CHANNEL_RSP                   = 0x0F,
+    L2CAP_MOVE_CHANNEL_CONFIRMATION_REQ        = 0x10,
+    L2CAP_MOVE_CHANNEL_CONFIRMATION_RSP     = 0x11,
+    L2CAP_CONNECTION_PARAMETER_UPDATE_REQ    = 0x12,        L2CAP_CMD_CONN_UPD_PARA_REQ        = 0x12,
+    L2CAP_CONNECTION_PARAMETER_UPDATE_RSP    = 0x13,        L2CAP_CMD_CONN_UPD_PARA_RESP     = 0x13,
+    L2CAP_LE_CREDIT_BASED_CONNECTION_REQ     = 0x14,
+    L2CAP_LE_CREDIT_BASED_CONNECTION_RSP     = 0x15,
+    L2CAP_FLOW_CONTROL_CREDIT_IND             = 0x16,
+    L2CAP_CREDIT_BASED_CONNECTION_REQ         = 0x17,    //core_5.2
+    L2CAP_CREDIT_BASED_CONNECTION_RSP         = 0x18,    //core_5.2
+    L2CAP_CREDIT_BASED_RECONFIGURE_REQ         = 0x19,    //core_5.2
+    L2CAP_CREDIT_BASED_RECONFIGURE_RSP         = 0x1A,    //core_5.2
+}l2cap_sig_pkt_format;
+
+/******************************************** LINKLAYER ***************************************************************/
+
+/**
+ *  @brief  Definition for LL Control PDU Opcode
+ */                                                                        // rf_len without MIC
+#define                    LL_CONNECTION_UPDATE_REQ    0x00                            // 12
+#define                    LL_CHANNEL_MAP_REQ            0x01                            //    8
+#define                    LL_TERMINATE_IND            0x02                            //    2
 
 #define                 LL_ENC_REQ                   0x03    // encryption            //    23
 #define                 LL_ENC_RSP                   0x04    // encryption            //    13
@@ -548,118 +354,6 @@
 #define                 LL_POWER_CONTROL_RSP          0x24    //core_5.2                //    5
 #define                 LL_POWER_CHANGE_IND           0x25    //core_5.2                //    5
 
-/////////////////////////////// Link Layer: ADV //////////////////////////////////////////////
-
-// Advertise channel PDU Type
-typedef enum advChannelPDUType_e {
-    LL_TYPE_ADV_IND           = 0x00,
-    LL_TYPE_ADV_DIRECT_IND    = 0x01,
-    LL_TYPE_ADV_NONCONN_IND   = 0x02,
-    LL_TYPE_SCAN_REQ          = 0x03,        LL_TYPE_AUX_SCAN_REQ      = 0x03,
-    LL_TYPE_SCAN_RSP          = 0x04,
-    LL_TYPE_CONNNECT_REQ      = 0x05,        LL_TYPE_AUX_CONNNECT_REQ = 0x05,
-    LL_TYPE_ADV_SCAN_IND      = 0x06,
-
-    LL_TYPE_ADV_EXT_IND       = 0x07,        LL_TYPE_AUX_ADV_IND      = 0x07,    LL_TYPE_AUX_SCAN_RSP = 0x07,    LL_TYPE_AUX_SYNC_IND = 0x07,    LL_TYPE_AUX_CHAIN_IND = 0x07,
-    LL_TYPE_AUX_CONNNECT_RSP  = 0x08,
-} advChannelPDUType_t;
-
-
-
-
-
-
-
-
-
-
-
-/******************************************** HCI **************************************************************/
-/**
- *  @brief  Definition for HCI request type
- */
-typedef enum hci_type_e {
-    HCI_TYPE_CMD = 0x01,
-    HCI_TYPE_ACL_DATA,
-    HCI_TYPE_SCO_DATA,
-    HCI_TYPE_EVENT,
-} hci_type_t;
-
-
-
-#define         HCI_FIRST_NAF_PACKET                         0x00    //LE Host to Controller
-#define         HCI_CONTINUING_PACKET                        0x01    //LE Host to Controller / Controller to Host
-#define         HCI_FIRST_AF_PACKET                          0x02    //LE                       Controller to Host
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/******************************************** L2CAP **************************************************************/
-
-
-
-// l2cap pb flag type
-#define L2CAP_FRIST_PKT_H2C              0x00
-#define L2CAP_CONTINUING_PKT             0x01
-#define L2CAP_FIRST_PKT_C2H              0x02
-
-
-// define the l2cap CID for BLE
-#define L2CAP_CID_NULL                   0x0000
-#define L2CAP_CID_ATTR_PROTOCOL          0x0004
-#define L2CAP_CID_SIG_CHANNEL            0x0005
-#define L2CAP_CID_SMP                    0x0006
-#define L2CAP_CID_GENERIC                0x0007
-#define L2CAP_CID_DYNAMIC                0x0040
-
-
-//signal packet formats of code define
-#define L2CAP_CMD_REJECT                 0x01
-#define L2CAP_CMD_DISC_CONN_REQ          0x06
-#define L2CAP_CMD_DISC_CONN_RESP         0x07
-#define L2CAP_CMD_CONN_UPD_PARA_REQ      0x12
-#define L2CAP_CMD_CONN_UPD_PARA_RESP     0x13
-#define L2CAP_CMD_CONN_REQ               0x14
-#define L2CAP_CMD_CONN_RESP              0x15
-#define L2CAP_CMD_FLOW_CTRL_CRED         0x16
-
-
-#define L2CAP_SIGNAL_MSG_TYPE            1
-#define L2CAP_DATA_MSG_TYPE              2
-#define L2CAP_REJECT_CMD_NOT_UNDERSTOOD  0
-#define L2CAP_REJECT_SIGNAL_MTU_EXCEED   1
-#define L2CAP_REJECT_INVALID_CID         2
-
-
-
-
-
-
-/******************************************** ATT ***************************************************************/
-
-
-
-
-
-
-
-
-
-/******************************************** GATT **************************************************************/
-
-
-
-
 
 
 /******************************************** GAP ***************************************************************/
diff --git a/stack/ble/ble_config.h b/stack/ble/ble_config.h
new file mode 100644
index 0000000..9a449fb
--- /dev/null
+++ b/stack/ble/ble_config.h
@@ -0,0 +1,321 @@
+/******************************************************************************
+ * @file     ble_config.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#pragma once
+
+
+#include "drivers.h"
+#include "tl_common.h"
+
+#if(MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    #define  MAX_DEV_NAME_LEN                 18
+
+    #ifndef DEV_NAME
+    #define DEV_NAME                        "tModule"
+    #endif
+#endif
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_825x)
+    #define    FIX_HW_CRC24_EN                                    1
+    #define HW_ECDH_EN                                      0
+#elif (MCU_CORE_TYPE == MCU_CORE_827x)
+    #define    FIX_HW_CRC24_EN                                    0
+    #define HW_ECDH_EN                                      1
+#elif (MCU_CORE_TYPE == MCU_CORE_9518)
+    #define    FIX_HW_CRC24_EN                                    0
+    #define HW_ECDH_EN                                      1
+    #define BLT_CONN_MASTER_EN                                0
+    #define BLT_SCAN_EN                                        0
+    #define BLT_ADV_IN_CONN_SLAVE_EN                        0
+    #define BLT_SCAN_IN_CONN_SLAVE_EN                        0
+#else
+    #error "unsupported mcu type !"
+#endif
+
+
+
+///////////////////  Feature ////////////////////////////
+#ifndef            BLT_CONN_MASTER_EN
+#define            BLT_CONN_MASTER_EN                                1
+#endif
+
+#ifndef            BLT_SCAN_EN
+#define            BLT_SCAN_EN                                        1
+#endif
+
+#ifndef            BLT_ADV_IN_CONN_SLAVE_EN
+#define            BLT_ADV_IN_CONN_SLAVE_EN                        1
+#endif
+
+#ifndef            BLT_SCAN_IN_CONN_SLAVE_EN
+#define            BLT_SCAN_IN_CONN_SLAVE_EN                        1
+#endif
+
+
+
+#ifndef            BIS_IN_BIG_NUM_MAX
+#define            BIS_IN_BIG_NUM_MAX                                4
+#endif
+
+
+#ifndef            LL_CIS_IN_CIG_NUM_MAX
+#define         LL_CIS_IN_CIG_NUM_MAX                              4
+#endif
+
+///////////////////  Feature ////////////////////////////
+
+
+#ifndef SECURE_CONNECTION_ENABLE
+#define SECURE_CONNECTION_ENABLE                            1
+#endif
+
+
+
+
+
+
+
+
+
+#ifndef  LL_MASTER_MULTI_CONNECTION
+#define  LL_MASTER_MULTI_CONNECTION                            0
+#endif
+
+
+
+
+#ifndef        BLS_ADV_INTERVAL_CHECK_ENABLE
+#define        BLS_ADV_INTERVAL_CHECK_ENABLE                    0
+#endif
+
+
+
+
+
+//conn param update/map update
+#ifndef    BLS_PROC_MASTER_UPDATE_REQ_IN_IRQ_ENABLE
+#define BLS_PROC_MASTER_UPDATE_REQ_IN_IRQ_ENABLE            1
+#endif
+
+
+#ifndef LE_AUTHENTICATED_PAYLOAD_TIMEOUT_SUPPORT_EN
+#define LE_AUTHENTICATED_PAYLOAD_TIMEOUT_SUPPORT_EN            0
+#endif
+
+
+
+
+
+#ifndef DEEP_RET_ENTRY_CONDITIONS_OPTIMIZATION_EN
+#define    DEEP_RET_ENTRY_CONDITIONS_OPTIMIZATION_EN            0
+#endif
+
+
+#ifndef HOST_CONTROLLER_DATA_FLOW_IMPROVE_EN
+#define    HOST_CONTROLLER_DATA_FLOW_IMPROVE_EN                1
+#endif
+
+
+
+//Link layer feature enable flag default setting
+#ifndef BLE_CORE42_DATA_LENGTH_EXTENSION_ENABLE
+#define BLE_CORE42_DATA_LENGTH_EXTENSION_ENABLE                        1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_LE_2M_PHY
+#define LL_FEATURE_SUPPORT_LE_2M_PHY                                1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_LE_CODED_PHY
+#define LL_FEATURE_SUPPORT_LE_CODED_PHY                                1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_LE_EXTENDED_ADVERTISING
+#define LL_FEATURE_SUPPORT_LE_EXTENDED_ADVERTISING                    1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_LE_PERIODIC_ADVERTISING
+#define LL_FEATURE_SUPPORT_LE_PERIODIC_ADVERTISING                    0
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_CHANNEL_SELECTION_ALGORITHM2
+#define LL_FEATURE_SUPPORT_CHANNEL_SELECTION_ALGORITHM2                1
+#endif
+
+
+
+
+//core_5.2 feature begin
+#ifndef LL_FEATURE_SUPPORT_CONNECTED_ISOCHRONOUS_STREAM_MASTER
+#define LL_FEATURE_SUPPORT_CONNECTED_ISOCHRONOUS_STREAM_MASTER        1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_CONNECTED_ISOCHRONOUS_STREAM_SLAVE
+#define LL_FEATURE_SUPPORT_CONNECTED_ISOCHRONOUS_STREAM_SLAVE        1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_ISOCHRONOUS_BROADCASTER
+#define LL_FEATURE_SUPPORT_ISOCHRONOUS_BROADCASTER                    1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_SYNCHRONIZED_RECEIVER
+#define LL_FEATURE_SUPPORT_SYNCHRONIZED_RECEIVER                    1
+#endif
+
+#ifndef LL_FEATURE_SUPPORT_ISOCHRONOUS_CHANNELS
+#define LL_FEATURE_SUPPORT_ISOCHRONOUS_CHANNELS                        1
+#endif
+//core_5.2 feature end
+
+#ifndef ZBIT_FLASH_WRITE_TIME_LONG_WORKAROUND_EN
+#define ZBIT_FLASH_WRITE_TIME_LONG_WORKAROUND_EN                    1
+#endif
+
+#ifndef ZBIT_FLASH_BRX4B_WRITE__EN
+#define ZBIT_FLASH_BRX4B_WRITE__EN                                    0
+#endif
+
+
+#ifndef RPA_OPTIMIZE_RAM
+#define RPA_OPTIMIZE_RAM                                            1
+#endif
+
+///////////////////////////////////////dbg channels///////////////////////////////////////////
+#ifndef    DBG_CHN0_TOGGLE
+#define DBG_CHN0_TOGGLE
+#endif
+
+#ifndef    DBG_CHN0_HIGH
+#define DBG_CHN0_HIGH
+#endif
+
+#ifndef    DBG_CHN0_LOW
+#define DBG_CHN0_LOW
+#endif
+
+#ifndef    DBG_CHN1_TOGGLE
+#define DBG_CHN1_TOGGLE
+#endif
+
+#ifndef    DBG_CHN1_HIGH
+#define DBG_CHN1_HIGH
+#endif
+
+#ifndef    DBG_CHN1_LOW
+#define DBG_CHN1_LOW
+#endif
+
+#ifndef    DBG_CHN2_TOGGLE
+#define DBG_CHN2_TOGGLE
+#endif
+
+#ifndef    DBG_CHN2_HIGH
+#define DBG_CHN2_HIGH
+#endif
+
+#ifndef    DBG_CHN2_LOW
+#define DBG_CHN2_LOW
+#endif
+
+#ifndef    DBG_CHN3_TOGGLE
+#define DBG_CHN3_TOGGLE
+#endif
+
+#ifndef    DBG_CHN3_HIGH
+#define DBG_CHN3_HIGH
+#endif
+
+#ifndef    DBG_CHN3_LOW
+#define DBG_CHN3_LOW
+#endif
+
+#ifndef    DBG_CHN4_TOGGLE
+#define DBG_CHN4_TOGGLE
+#endif
+
+#ifndef    DBG_CHN4_HIGH
+#define DBG_CHN4_HIGH
+#endif
+
+#ifndef    DBG_CHN4_LOW
+#define DBG_CHN4_LOW
+#endif
+
+#ifndef    DBG_CHN5_TOGGLE
+#define DBG_CHN5_TOGGLE
+#endif
+
+#ifndef    DBG_CHN5_HIGH
+#define DBG_CHN5_HIGH
+#endif
+
+#ifndef    DBG_CHN5_LOW
+#define DBG_CHN5_LOW
+#endif
+
+#ifndef    DBG_CHN6_TOGGLE
+#define DBG_CHN6_TOGGLE
+#endif
+
+#ifndef    DBG_CHN6_HIGH
+#define DBG_CHN6_HIGH
+#endif
+
+#ifndef    DBG_CHN6_LOW
+#define DBG_CHN6_LOW
+#endif
+
+#ifndef    DBG_CHN7_TOGGLE
+#define DBG_CHN7_TOGGLE
+#endif
+
+#ifndef    DBG_CHN7_HIGH
+#define DBG_CHN7_HIGH
+#endif
+
+#ifndef    DBG_CHN7_LOW
+#define DBG_CHN7_LOW
+#endif
+
+
+
+#ifndef    BLE_IRQ_DBG_EN
+#define BLE_IRQ_DBG_EN                    0
+#endif
+
+#ifndef    BLE_ADV_DBG_EN
+#define BLE_ADV_DBG_EN                    0
+#endif
+
+#ifndef    TX_FIFO_DBG_EN
+#define TX_FIFO_DBG_EN                    0
+#endif
+
+
+#ifndef        DEBUG_PAIRING_ENCRYPTION
+#define     DEBUG_PAIRING_ENCRYPTION        0
+#endif
+
diff --git a/stack/ble/ble_controller.h b/stack/ble/ble_controller.h
deleted file mode 100644
index 237cd17..0000000
--- a/stack/ble/ble_controller.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/******************************************************************************
- * @file     ble_controller.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef BLE_CONTROLLER_H_
-#define BLE_CONTROLLER_H_
-
-
-#include "blt_config.h"
-#include "ble_common.h"
-#include "ble_format.h"
-
-#include "phy/phy.h"
-#include "phy/phy_test.h"
-
-
-
-#include "hci/hci.h"
-#include "hci/hci_const.h"
-#include "hci/hci_event.h"
-#include "hci/usb_desc.h"
-
-
-#include "ll/ll.h"
-#include "ll/ll_adv.h"
-#include "ll/ll_encrypt.h"
-#include "ll/ll_init.h"
-#include "ll/ll_pm.h"
-#include "ll/ll_scan.h"
-#include "ll/ll_whitelist.h"
-#include "ll/ll_conn/ll_conn.h"
-#include "ll/ll_conn/ll_slave.h"
-#include "ll/ll_conn/ll_master.h"
-#include "ll/ll_conn/ll_conn_phy.h"
-#include "ll/ll_conn/ll_conn_csa.h"
-
-#include "ll/ll_ext.h"
-#include "ll/ll_ext_adv.h"
-#include "ll/ll_ext_scan.h"
-
-
-
-
-
-#include "bqb/bqb_ll.h"
-
-#endif /* BLE_H_ */
diff --git a/stack/ble/ble_format.h b/stack/ble/ble_format.h
index 5d25d74..d830c14 100644
--- a/stack/ble/ble_format.h
+++ b/stack/ble/ble_format.h
@@ -28,19 +28,14 @@
 
 
 
+#include "stack/ble/ble_common.h"
 
-
-
-#if 1
-
+/******************************************** Link Layer **************************************************************/
 
 typedef struct {
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-}rf_adv_head_t;
+    u8 type;
+    u8 address[6];//BLE_ADDR_LEN];
+} addr_t;
 
 
 
@@ -54,40 +49,89 @@
 
 
 
+typedef struct {
+    u8 llid   :2;
+    u8 nesn   :1;
+    u8 sn     :1;
+    u8 md     :1;
+    u8 rfu1   :3;
+    u8 rf_len;
+}rf_acl_data_head_t;
+
+
+
+typedef struct {
+    u8 llid   :2;
+    u8 nesn   :1;
+    u8 sn     :1;
+    u8 cie    :1;
+    u8 rfu0   :1;
+    u8 npi    :1;
+    u8 rfu1   :1;
+    u8 rf_len;
+}rf_cis_data_hdr_t;
+
+
+
+typedef struct {
+    u8 llid   :2;
+    u8 cssn   :3;
+    u8 cstf   :1;
+    u8 rfu0   :2;
+    u8 rf_len;
+}rf_bis_data_hdr_t;
+
 
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
+    u32 dma_len;
 
-    rf_adv_head_t  header;
+    u8 type   :4;
+    u8 rfu1   :1;
+    u8 chan_sel:1;
+    u8 txAddr :1;
+    u8 rxAddr :1;
+
     u8  rf_len;                //LEN(6)_RFU(2)
 
-    u8 advA[6];            //address
-    u8 data[31];            //0-31 byte
+    u8    advA[6];            //address
+    u8    data[31];
 }rf_packet_adv_t;
 
 
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    rf_adv_head_t  header;    //RA(1)_TA(1)_RFU(2)_TYPE(4)
-    u8 rf_len;                //LEN(6)_RFU(2)
+    u32 dma_len;
 
-    u8 scanA[6];            //
-    u8 advA[6];            //
+    u8  type   :4;
+    u8  rfu1   :1;
+    u8  chan_sel:1;
+    u8  txAddr :1;
+    u8  rxAddr :1;
+
+    u8  rf_len;                //LEN(6)_RFU(2)
+
+    u8    scanA[6];            //
+    u8    advA[6];            //
 }rf_packet_scan_req_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    rf_adv_head_t  header;                //RA(1)_TA(1)_RFU(2)_TYPE(4)
-    u8 rf_len;                //LEN(6)_RFU(2)
+    u32 dma_len;
+
+    u8  type   :4;
+    u8  rfu1   :1;
+    u8  chan_sel:1;
+    u8  txAddr :1;
+    u8  rxAddr :1;
+
+    u8  rf_len;                //LEN(6)_RFU(2)
 
     u8 advA[6];            //address
     u8 data[31];            //0-31 byte
 }rf_packet_scan_rsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
+    u32 dma_len;
 
     u8 type   :4;
     u8 rfu1   :1;
@@ -110,15 +154,21 @@
 }rf_packet_connect_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    rf_adv_head_t  header;                //RA(1)_TA(1)_RFU(2)_TYPE(4): connect request PDU
-    u8 rf_len;                //LEN(6)_RFU(2)
-    u8 scanA[6];            //
-    u8 advA[6];            //
-    u8 aa[4];                // access code
-    u8 crcinit[3];
-    u8 wsize;
-    u16 woffset;
+    u32 dma_len;
+
+    u8  type   :4;
+    u8  rfu1   :1;
+    u8  chan_sel:1;
+    u8  txAddr :1;
+    u8  rxAddr :1;
+
+    u8  rf_len;                //LEN(6)_RFU(2)
+    u8    scanA[6];            //
+    u8    advA[6];            //
+    u8    aa[4];                // access code
+    u8    crcinit[3];
+    u8    wsize;
+    u16    woffset;
     u16 interval;
     u16 latency;
     u16 timeout;
@@ -138,17 +188,212 @@
     u16 instant;
 } rf_packet_ll_updateConnPara_t;
 
+typedef struct {
+    u8     type;
+    u8  rf_len;
+    u8     opcode;
+    u8     winSize;
+    u16 winOffset;
+    u16 interval;
+    u16 latency;
+    u16 timeout;
+    u16 instant;
+}rf_packet_connect_upd_req_t;
+
+typedef struct {
+    u8     type;
+    u8  rf_len;
+    u8     opcode;
+    u8     chm[5];
+    u16 instant;
+} rf_packet_chm_upd_req_t;
+
+typedef struct {
+    u8     type;
+    u8  rf_len;
+    u8     opcode;
+    u8     rand[8];
+    u16 ediv;
+    u8    skdm[8];
+    u8    ivm[4];
+} rf_packet_ll_enc_req_t;
+
+typedef struct {
+    u8     type;
+    u8  rf_len;
+    u8     opcode;
+    u8    skds[8];
+    u8    ivs[4];
+} rf_packet_ll_enc_rsp_t;
+
+typedef struct {
+    u8     type;
+    u8  rf_len;
+    u8     opcode;
+    u8    unknownType;
+} rf_packet_ll_unknown_rsp_t;
+
+typedef struct {
+    u8     type;
+    u8  rf_len;
+    u8     opcode;
+    u8    featureSet[8];
+} rf_packet_ll_feature_exg_t;
 
 typedef struct{
-    u8 llid;
-    u8 rf_len;
-    u8 opcode;
-    u8 CtrData;
-}rf_pkt_ll_unknown_rsp_t;
+    u8    type;
+    u8  rf_len;
+    u8     opcode;
+    u8  versNr;
+    u16 compId;
+    u16 subVersNr;
+}rf_packet_version_ind_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u8     opcode;
+    u8  errCode;
+}rf_packet_ll_reject_ind_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u8     opcode;
+    u8    rejectOpcode;
+    u8  errCode;
+}rf_packet_ll_reject_ext_ind_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u8    opcode;
+    u8    reason;
+}rf_packet_ll_terminate_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u8    opcode;
+    u8    cigId;
+    u8    cisId;
+    u8  phyM2S;
+    u8    phyS2M;
+
+    u32 maxSduM2S :12;
+    u32 rfu0       :3;
+    u32 framed    :1;
+    u32 maxSduS2M :12;
+    u32 rfu1      :4;
+
+    u8 sduIntvlM2S[3]; //SDU_Interval_M_To_S(20 bits) + RFU(4 bits)
+    u8 sduIntvlS2M[3]; //SDU_Interval_S_To_M(20 bits) + RFU(4 bits)
+
+    u16 maxPduM2S;
+    u16 maxPduS2M;
+    u8    nse;
+    u8    subIntvl[3];    //unit: uS
+
+    u8     bnM2S:4;
+    u8     bnS2M:4;
+    u8     ftM2S;
+    u8     ftS2M;
+    u16    isoIntvl;        //unit: 1.25 mS
+
+    u8    cisOffsetMin[3];
+    u8    cisOffsetMax[3];
+    u16    connEventCnt; //similar to instant
+
+}rf_packet_ll_cis_req_t;
+
+typedef struct{
+    u8    type;                //RA(1)_TA(1)_RFU(2)_TYPE(4)
+    u8  rf_len;                //LEN(6)_RFU(2)
+    u8     opcode;
+    u8  cisOffsetMin[3];
+    u8  cisOffsetMax[3];
+    u16    connEventCnt;
+}rf_packet_ll_cis_rsp_t;
+
+typedef struct{
+    u8    type;                //RA(1)_TA(1)_RFU(2)_TYPE(4)
+    u8  rf_len;                //LEN(6)_RFU(2)
+    u8     opcode;
+    u32 cisAccessAddr;      //Access Address of the CIS
+    u8  cisOffset[3];
+    u8  cigSyncDly[3];
+    u8  cisSyncDly[3];
+    u16 connEventCnt;
+}rf_packet_ll_cis_ind_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u8     opcode;
+    u8  cig_id;
+    u8    cis_id;
+    u8    errorCode;
+}rf_packet_ll_cis_terminate_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+
+    u8    opcode;                //
+    u8    dat[1];                //
+}rf_packet_ll_control_t;
+
+typedef struct{
+    union{
+        rf_bis_data_hdr_t  bisPduHdr;
+        rf_cis_data_hdr_t  cisPduHdr;
+        rf_acl_data_head_t aclPduHdr;
+        struct{
+            u8 type;
+            u8 rf_len;
+        }pduHdr;
+    }llPduHdr;        /* LL PDU Header: 2 */
+    u8     llPayload[1]; /* Max LL Payload length: 251 */
+}llPhysChnPdu_t;
+
+typedef struct{
+    u32 dma_len;
+    llPhysChnPdu_t llPhysChnPdu;
+}rf_packet_ll_data_t;
 
 
 
 
+//AuxPrt
+typedef struct{
+    u8  chn_index   :6;
+    u8  ca              :1;
+    u8  offset_unit    :1;
+    u16 aux_offset  :13;
+    u16    aux_phy        :3;
+} aux_ptr_t;
+
+
+typedef struct{
+    u32 dma_len;
+
+    u8 type   :4;
+    u8 rfu1   :1;
+    u8 chan_sel:1;
+    u8 txAddr :1;
+    u8 rxAddr :1;
+
+    u8  rf_len;
+    u8    ext_hdr_len        :6;
+    u8    adv_mode        :2;
+    u8    ext_hdr_flg;
+
+    u8    data[253];   //Extended Header + AdvData
+}rf_pkt_ext_adv_t;
+
+
+/******************************************** L2CAP **************************************************************/
+
 typedef struct{
     rf_data_head_t    header;
     u8 rf_len;
@@ -158,7 +403,17 @@
     u8 data[1];
 }rf_packet_l2cap_t;
 
-
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+typedef struct{
+    rf_data_head_t    header;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u16  handle;
+    u8    dat[20];
+}rf_packet_att_t;
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
 typedef struct{
     rf_data_head_t    header;
     u8  rf_len;
@@ -169,31 +424,81 @@
     u8 handle1;
     u8 dat[20];
 }rf_packet_att_t;
-
+#endif
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 data[1];
 }rf_packet_l2cap_req_t;
 
-
 typedef struct{
-    u32 dma_len;
-    u8 type;
-    u8 rf_len;
-    u16 l2capLen;
-    u16 chanId;
-    u8 code;
-    u8 id;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  code;
+    u8  id;
     u16 dataLen;
     u16 result;
 }rf_pkt_l2cap_sig_connParaUpRsp_t;
 
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  code;
+    u8  id;
+    u16 length;
+    u16 psm;
+    u16 mtu;
+    u16 mps;
+    u16 init_credits;
+    u16 scid[5];
+}rf_pkt_l2cap_credit_based_connection_req_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  code;
+    u8  id;
+    u16 length;
+    u16 mtu;
+    u16 mps;
+    u16 init_credits;
+    u16 result;
+    u16 dcid[5];
+}rf_pkt_l2cap_credit_based_connection_rsp_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  code;
+    u8  id;
+    u16 length;
+    u16 mtu;
+    u16 mps;
+    u16 dcid[5];
+}rf_pkt_l2cap_credit_based_reconfigure_req_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  code;
+    u8  id;
+    u16 length;
+    u16 result;
+}rf_pkt_l2cap_credit_based_reconfigure_rsp_t;
 
 typedef struct{
     u8 type;
@@ -204,14 +509,13 @@
     u8 data[1];
 }rf_pkt_l2cap_req_t;
 
-
 typedef struct{
-    u8 llid;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 id;
+    u8    llid;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8    id;
     u16 data_len;
     u16 min_interval;
     u16 max_interval;
@@ -219,36 +523,59 @@
     u16 timeout;
 }rf_packet_l2cap_connParaUpReq_t;
 
+typedef struct{
+    u8    llid;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8    id;
+    u16 length;
+    u16 spsm;
+    u16 mtu;
+    u16 mps;
+    u16 init_credits;
+    u16 scid[5];
+}rf_packet_l2cap_credit_based_connection_req_t;
 
 typedef struct{
-    u8 llid;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 id;
+    u8    llid;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8    id;
     u16 data_len;
     u16 result;
 }rf_packet_l2cap_connParaUpRsp_t;
 
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u16    l2cap;
+    u16    chanid;
 
+    u8    att;
+    u16 handle;
+
+    u8    dat[20];
+
+}rf_packet_att_data_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 errOpcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8     errOpcode;
     u16 errHandle;
     u8 errReason;
 }rf_packet_att_errRsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
+    u8    type;
+    u8  rf_len;
 
     u16 l2capLen;
     u16 chanId;
@@ -261,9 +588,8 @@
 }rf_packet_att_readByType_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
+    u8    type;
+    u8  rf_len;
 
     u16 l2capLen;
     u16 chanId;
@@ -277,9 +603,8 @@
 }rf_packet_att_findByTypeReq_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
+    u8    type;
+    u8  rf_len;
 
     u16 l2capLen;
     u16 chanId;
@@ -287,25 +612,22 @@
     u16 data[1];
 }rf_packet_att_findByTypeRsp_t;
 
-
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 handle;
     u8 handle1;
 }rf_packet_att_read_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 handle;
     u8 handle1;
     u8 offset0;
@@ -313,299 +635,180 @@
 }rf_packet_att_readBlob_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 value[22];
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8     value[22];
 }rf_packet_att_readRsp_t;
 
-
 typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 datalen;
-    u8 data[1];            // character_handle / property / value_handle / value
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  datalen;
+    u8  data[1];            // character_handle / property / value_handle / value
 }rf_pkt_att_readByTypeRsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 datalen;
-    u8 data[1];            // character_handle / property / value_handle / value
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  datalen;
+    u8  data[1];            // character_handle / property / value_handle / value
 }rf_packet_att_readByTypeRsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 datalen;
-    u8 data[3];
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  datalen;
+    u8  data[1];            // character_handle / property / value_handle / value
+}rf_packet_att_data_readByTypeRsp_t;
+
+typedef struct{
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  datalen;
+    u8  data[3];
 }rf_packet_att_readByGroupTypeRsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 format;
-    u8 data[1];            // character_handle / property / value_handle / value
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  format;
+    u8  data[1];            // character_handle / property / value_handle / value
 }rf_packet_att_findInfoReq_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 flags;
 }rf_packet_att_executeWriteReq_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 handle;
     u8 handle1;
     u8 value;
 }rf_packet_att_write_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 handle[2];
     u8 data;
 }rf_packet_att_notification_t;
 
-
-
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 mtu[2];
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  mtu[2];
 }rf_packet_att_mtu_t;
 
 typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
     u8 mtu[2];
 }rf_packet_att_mtu_exchange_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
 }rf_packet_att_writeRsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RA(1)_TA(1)_RFU(2)_TYPE(4)
-    u8 rf_len;                //LEN(6)_RFU(2)
-    u8 opcode;
-    u8 data[8];
+    u8    type;                //RA(1)_TA(1)_RFU(2)_TYPE(4)
+    u8  rf_len;                //LEN(6)_RFU(2)
+    u8     opcode;
+    u8    data[8];
 }rf_packet_feature_rsp_t;
 
 typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-    u8 type;                //RA(1)_TA(1)_RFU(2)_TYPE(4)
-    u8 rf_len;                //LEN(6)_RFU(2)
-    u8 opcode;
-    u8 mainVer;
-    u16 vendor;
-    u16 subVer;
-}rf_packet_version_ind_t;
-
-
-
-
-typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-
-    u8 opcode;                //
-    u8 reason;                //
-}rf_packet_ll_terminate_t;
-
-
-typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-
-    u8 opcode;                //
-    u8 dat[1];                //
-}rf_packet_ll_control_t;
-
-typedef struct{
-    u32 dma_len;            //won't be a fixed number as previous, should adjust with the mouse package number
-
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2cap;
-    u16 chanid;
-
-    u8 att;
-    u8 hl;                    // assigned by master
-    u8 hh;                    //
-
-    u8 dat[20];
-
-}rf_packet_att_data_t;
-
-
-
-
-
-typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 datalen;
-    u8 data[1];            // character_handle / property / value_handle / value
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  datalen;
+    u8  data[1];            // character_handle / property / value_handle / value
 }att_readByTypeRsp_t;
 
 typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 format;
-    u8 data[1];            // character_handle / property / value_handle / value
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8  format;
+    u8  data[1];            // character_handle / property / value_handle / value
 }att_findInfoRsp_t;
 
 typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 value[22];
+    u8    type;
+    u8  rf_len;
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8     value[22];
 }att_readRsp_t;
 
 typedef struct{
-    u8 type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8 rf_len;                //LEN(5)_RFU(3)
-    u16 l2capLen;
-    u16 chanId;
-    u8 opcode;
-    u8 handle;
-    u8 hh;
-    u8 value[1];
+    u8    type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
+    u8  rf_len;                //LEN(5)_RFU(3)
+    u16    l2capLen;
+    u16    chanId;
+    u8  opcode;
+    u8    handle;
+    u8    hh;
+    u8     value[1];
 }att_notify_t;
 
 typedef struct {
-    u8 type;
-    u8 address[BLE_ADDR_LEN];
-} addr_t;
-
-////////////////////////////////////////////////////////////////////////////
-
-
-
-
-
-
-
-typedef struct {
-    u8 num;
-    u8 property;
-    u16 handle;
-    u16 uuid;
+    u8    num;
+    u8    property;
+    u16    handle;
+    u16    uuid;
     u16 ref;
 } att_db_uuid16_t;            //8-byte
 
 
 typedef struct {
-    u8 num;
-    u8 property;
-    u16 handle;
-    u8 uuid[16];
+    u8    num;
+    u8    property;
+    u16    handle;
+    u8    uuid[16];
 } att_db_uuid128_t;            //20-byte
-
-//-------------   event --------------------------------
-typedef struct {
-    u8 status;
-    u16 connHandle;
-    u8 reason;
-} event_disconnection_t;            //20-byte
-
-typedef struct {
-    u8 subcode;
-    u8 nreport;
-    u8 event_type;
-    u8 adr_type;
-    u8 mac[6];
-    u8 len;
-    u8 data[1];
-} event_adv_report_t;            //20-byte
-
-typedef struct {
-    u8 subcode;
-    u8 status;
-    u16 handle;
-    u8 role;
-    u8 peer_adr_type;
-    u8 mac[6];
-    u16 interval;
-    u16 latency;
-    u16 timeout;
-    u8 accuracy;
-} event_connection_complete_t;            //20-byte
-
-typedef struct {
-    u8 subcode;
-    u8 status;
-    u16 handle;
-    u16 interval;
-    u16 latency;
-    u16 timeout;
-} event_connection_update_t;            //20-byte
-
-typedef struct {
-    u8 status;
-    u16 handle;
-    u8 enc_enable;
-} event_enc_change_t;
-
-typedef struct {
-    u8 status;
-    u16 handle;
-} event_enc_refresh_t;
-#endif
-
-
-#endif
+#endif    /* BLE_FORMAT_H */
diff --git a/stack/ble/blt_config.h b/stack/ble/blt_config.h
deleted file mode 100644
index 8e77bb8..0000000
--- a/stack/ble/blt_config.h
+++ /dev/null
@@ -1,269 +0,0 @@
-/******************************************************************************
- * @file     ble_config.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#pragma once
-
-//////////////////////////////////////////////////////////////////////////////
-/**
- *  @brief  Definition for Device info
- */
-#include "drivers.h"
-#include "tl_common.h"
-
-#define  MAX_DEV_NAME_LEN                 18
-
-#ifndef DEV_NAME
-#define DEV_NAME                        "tModule"
-#endif
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-///////////////////  Feature ////////////////////////////
-
-
-#ifndef SECURE_CONNECTION_ENABLE
-#define SECURE_CONNECTION_ENABLE                            1
-#endif
-
-
-
-
-
-
-
-
-
-#ifndef  LL_MASTER_MULTI_CONNECTION
-#define  LL_MASTER_MULTI_CONNECTION                            0
-#endif
-
-
-
-
-#ifndef        BLS_ADV_INTERVAL_CHECK_ENABLE
-#define        BLS_ADV_INTERVAL_CHECK_ENABLE                    0
-#endif
-
-
-
-
-#define    BLS_BLE_RF_IRQ_TIMING_EXTREMELY_SHORT_EN            0
-
-
-
-//conn param update/map update
-#ifndef    BLS_PROC_MASTER_UPDATE_REQ_IN_IRQ_ENABLE
-#define BLS_PROC_MASTER_UPDATE_REQ_IN_IRQ_ENABLE            1
-#endif
-
-
-#ifndef LE_AUTHENTICATED_PAYLOAD_TIMEOUT_SUPPORT_EN
-#define LE_AUTHENTICATED_PAYLOAD_TIMEOUT_SUPPORT_EN            0
-#endif
-
-
-#ifndef FIX_HW_CRC24_EN
-    #if (MCU_CORE_TYPE != MCU_CORE_8278)
-        #define    FIX_HW_CRC24_EN                                        1
-    #else
-        #define    FIX_HW_CRC24_EN                                        0
-    #endif
-#endif
-
-
-#ifndef DEEP_RET_ENTRY_CONDITIONS_OPTIMIZATION_EN
-#define    DEEP_RET_ENTRY_CONDITIONS_OPTIMIZATION_EN            0
-#endif
-
-
-#ifndef HOST_CONTROLLER_DATA_FLOW_IMPROVE_EN
-#define    HOST_CONTROLLER_DATA_FLOW_IMPROVE_EN                1
-#endif
-
-#if (HOST_CONTROLLER_DATA_FLOW_IMPROVE_EN)
-    #define ATT_RSP_BIG_MTU_PROCESS_EN                        1
-#endif
-
-
-
-
-
-
-//Link layer feature enable flag default setting
-#ifndef BLE_CORE42_DATA_LENGTH_EXTENSION_ENABLE
-#define BLE_CORE42_DATA_LENGTH_EXTENSION_ENABLE                        1
-#endif
-
-#ifndef LL_FEATURE_SUPPORT_LE_2M_PHY
-#define LL_FEATURE_SUPPORT_LE_2M_PHY                                1
-#endif
-
-#ifndef LL_FEATURE_SUPPORT_LE_CODED_PHY
-#define LL_FEATURE_SUPPORT_LE_CODED_PHY                                1
-#endif
-
-#ifndef LL_FEATURE_SUPPORT_LE_EXTENDED_ADVERTISING
-#define LL_FEATURE_SUPPORT_LE_EXTENDED_ADVERTISING                    1
-#endif
-
-#ifndef LL_FEATURE_SUPPORT_LE_PERIODIC_ADVERTISING
-#define LL_FEATURE_SUPPORT_LE_PERIODIC_ADVERTISING                    0
-#endif
-
-#ifndef LL_FEATURE_SUPPORT_CHANNEL_SELECTION_ALGORITHM2
-#define LL_FEATURE_SUPPORT_CHANNEL_SELECTION_ALGORITHM2                1
-#endif
-
-
-
-
-#ifndef BQB_LOWER_TESTER_ENABLE
-#define BQB_LOWER_TESTER_ENABLE                                        0
-#endif
-
-
-
-
-///////////////////////////////////////dbg channels///////////////////////////////////////////
-#ifndef    DBG_CHN0_TOGGLE
-#define DBG_CHN0_TOGGLE
-#endif
-
-#ifndef    DBG_CHN0_HIGH
-#define DBG_CHN0_HIGH
-#endif
-
-#ifndef    DBG_CHN0_LOW
-#define DBG_CHN0_LOW
-#endif
-
-#ifndef    DBG_CHN1_TOGGLE
-#define DBG_CHN1_TOGGLE
-#endif
-
-#ifndef    DBG_CHN1_HIGH
-#define DBG_CHN1_HIGH
-#endif
-
-#ifndef    DBG_CHN1_LOW
-#define DBG_CHN1_LOW
-#endif
-
-#ifndef    DBG_CHN2_TOGGLE
-#define DBG_CHN2_TOGGLE
-#endif
-
-#ifndef    DBG_CHN2_HIGH
-#define DBG_CHN2_HIGH
-#endif
-
-#ifndef    DBG_CHN2_LOW
-#define DBG_CHN2_LOW
-#endif
-
-#ifndef    DBG_CHN3_TOGGLE
-#define DBG_CHN3_TOGGLE
-#endif
-
-#ifndef    DBG_CHN3_HIGH
-#define DBG_CHN3_HIGH
-#endif
-
-#ifndef    DBG_CHN3_LOW
-#define DBG_CHN3_LOW
-#endif
-
-#ifndef    DBG_CHN4_TOGGLE
-#define DBG_CHN4_TOGGLE
-#endif
-
-#ifndef    DBG_CHN4_HIGH
-#define DBG_CHN4_HIGH
-#endif
-
-#ifndef    DBG_CHN4_LOW
-#define DBG_CHN4_LOW
-#endif
-
-#ifndef    DBG_CHN5_TOGGLE
-#define DBG_CHN5_TOGGLE
-#endif
-
-#ifndef    DBG_CHN5_HIGH
-#define DBG_CHN5_HIGH
-#endif
-
-#ifndef    DBG_CHN5_LOW
-#define DBG_CHN5_LOW
-#endif
-
-#ifndef    DBG_CHN6_TOGGLE
-#define DBG_CHN6_TOGGLE
-#endif
-
-#ifndef    DBG_CHN6_HIGH
-#define DBG_CHN6_HIGH
-#endif
-
-#ifndef    DBG_CHN6_LOW
-#define DBG_CHN6_LOW
-#endif
-
-#ifndef    DBG_CHN7_TOGGLE
-#define DBG_CHN7_TOGGLE
-#endif
-
-#ifndef    DBG_CHN7_HIGH
-#define DBG_CHN7_HIGH
-#endif
-
-#ifndef    DBG_CHN7_LOW
-#define DBG_CHN7_LOW
-#endif
-
-
-
-#ifndef    BLC_REGISTER_DBG_GPIO_IN_STACK
-#define BLC_REGISTER_DBG_GPIO_IN_STACK        0
-#endif
diff --git a/stack/ble/bqb/bqb_ll.h b/stack/ble/bqb/bqb_ll.h
deleted file mode 100644
index 682df60..0000000
--- a/stack/ble/bqb/bqb_ll.h
+++ /dev/null
@@ -1,239 +0,0 @@
-/******************************************************************************
- * @file     bqb_ll.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#ifndef BQB_LL_H_
-#define BQB_LL_H_
-
-
-typedef enum {
-    TP_STATUS_CONN_PKT_MAX = 1,
-    TP_STATUS_CONN_UNKNOWN_RSP,
-
-    TP_STATUS_CONNECTION_DATA_SEND,
-//adv
-    TP_STATUS_ADV_PKT_MAX        ,
-    TP_STATUS_CONN_ESTABLISH    ,
-    TP_STATUS_CONN_TERMINATE                ,
-
-    TP_STATUS_CONN_PARA_REQ                    ,
-    TP_STATUS_CONN_PARA_UPDATE                ,
-
-    TP_STATUS_CONNECTION_TIMEOUT            ,
-    TP_STATUS_CONNE_RCVD_L2CAP_DATA            ,
-
-    TP_STATUS_CONN_MAP_REQ                    ,
-    TP_STATUS_CONN_MAP_UPDATE                ,
-    TP_STATUS_CONN_DATA_LENGTH_EXCHANGE        ,
-
-    TP_STATUS_CONN_BRX_MISS_END                ,
-
-    TP_STATUS_L2CAP_DATA_IN_IRQ_RX            ,
-
-
-
-
-    TP_STATUS_TERMINATE_IN_IRQ_RX            ,
-    TP_STATUS_BRX_START                        ,
-    TP_STATUS_RECV_CERT_DATA                ,
-    TP_STATUS_PUSH_DATA_CRC_ERR                ,
-    TP_STATUS_PUSH_DATA_SN_ERR                ,
-    TP_STATUS_CONN_IN_IRQ_RX                ,
-    TP_STATUS_BRX_POST                        ,
-    TP_STATUS_BRX_TX                        ,
-
-
-
-
-    TP_STATUS_SCAN_HIT_MAX                    ,
-    TP_STATUS_SCAN_RCVD_RSP                    ,
-    TP_STATUS_SCAN_REQ_SENT                    ,
-    TP_STATUS_CONN_HIT_MAX                    ,
-
-    TP_STATUS_CONN_RCVD_DAT                    ,
-    TP_STATUS_CONN_REQ_SENT                    ,
-    TP_STATUS_TIMEOUT                        ,
-    TP_STATUS_CONNECTION_LOST                ,
-    TP_STATUS_CONN_PKT_MISSING                ,
-    TP_STATUS_CONNECTION_RETX_MAX            ,
-
-     TP_STATUS_RCVD_NO_EMPTY_PKT            ,
-     TP_STATUS_CHN_MAP_FULL_USED            ,
-
-
-    TP_STATUS_CONN_PHY_UPDATE               ,
-
-    TP_STATUS_CONNECTION_FEATURE_REQ        ,
-
-    TP_STATUS_CONN_BTX_MIDDLE                ,
-
-
-
-    TP_STATUS_INIT = 0x8000,
-} tp_status_t;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-typedef int (*callback_testcase_t)(int);
-extern    callback_testcase_t        p_callback_testcase;
-
-
-
-
-
-typedef struct {
-    u8        En_AdvData_inc;
-    s8        AdvData_inc_step;
-    u8        En_adv_crcERR;
-    u8        En_scanRsp_crcERR;
-
-
-    u32       AdvPkt_max;
-    u32       AdvPkt_no;
-    u32       ConnPkt_max;
-    u32       ConnPkt_no;
-
-    u8        feature_req_skip;
-    u8        version_ind_skip;
-    u8        ver_ind_once;
-    u8        phy_req_col;
-    u8        phy_req_skip;
-
-    u8        phy_req_nochange;
-    u8        Disable_moreData;
-    u8        phy_no_common;
-//    u8        testEn_printRcvdData_onConnect;
-    u8        En_rcvd_l2cap_data_callback;
-//    u8         lenReq_no_support;
-
-    int       testData_pkts;
-    int       testData_no;
-
-
-    u16       brx_miss_en;
-    u16       brx_miss_delay_intervals;
-    u32       brx_miss_startTick;
-    u32       brx_miss_duration;  //us
-
-    u8        conn_pkt_crcERR;
-} st_bqb_ll_t;
-extern st_bqb_ll_t        bqbS;
-
-
-
-
-
-
-
-extern    u8    pkt_test_data[];
-
-extern u8 testData_pkts;
-extern u32 testConnPkt_no;
-extern u32 testConnPkt_max;
-extern u8 testPhyUpdate_Same;
-extern u8 testPhyUpdate_PastIns;
-extern u8 testPhyUpdate_TO;
-extern u8 testDiffProc_ChnMap;
-extern u8 testDiffProc_ConUp;
-extern u8 test_ConRecv_no;
-extern u8 testPhyInd_TO;
-extern u8 testNoPhyReqChan;
-extern u8 testNoPhyRspChan;
-
-
-
-void     tp_set_adv_pkt_max (u16 m);
-void     tp_enable_advData_inrease(u8 en, s8 step);
-
-void     tp_AdvAddress_companyId_exchange(void);
-void     tp_AdvAddress_companyAssignId_exchange(void);
-void     tp_AdvAddress_companyId_companyAssignId_mismatch(void);
-//void     tp_ScanRspAddress_companyId_exchange(void);
-//void         tp_ScanRspAddress_companyAssignId_exchange(void);
-//void tp_ScanRspAddress_companyId_companyAssignId_mismatch(void);
-
-
-void     tp_enable_adv_scanRsp_Bad_CRC (u8 advBadCrc, u8 scanRspBadCrc );
-
-void     tp_set_conn_pkt_max (u32 m);
-
-void    tp_flip_access_address (int n);
-void    tp_set_test_data (u8 type, u8 len, u8 d, int pkts);
-void    tp_set_manual_timeout (u32 timeout);
-void     tp_disable_more_data(u8 disable);
-void     tp_enable_print_rcvd_data_connect(u8 en);
-void     tp_enable_rcvd_l2cap_data_callback(u8 en);
-void     tp_disable_data_len_exchange(u8 en);
-void     tp_set_brx_missing_time(u32 time_ms);
-void     tp_set_brx_missing_delay_intervals(int interval_num);
-void     tp_enable_conn_pkt_Bad_CRC (u8 connBadCrc );
-
-
-
-void     tp_set_adv_pkt_max (u16 m);
-void     tp_disable_more_data(u8 disable);
-void     tp_set_conn_pkt_max(u32 m);
-void     tp_phy_req_col(u8 en);
-void     tp_phy_req_skip(u8 en);
-void     tp_phy_req_nochange(u8 en);
-void     tp_phy_no_common(u8 en);
-void     tp_set_test_data (u8 type, u8 len, u8 d, int pkts);
-void     tp_enable_rcvd_l2cap_data_callback(u8 en);
-
-
-
-
-void     tp_set_test_pkt(u8 num);
-void     tp_SetPhyUpdate_Same(u8 en);
-void     tp_set_PhyUpdate_InsInPast(u8 en);
-void     tp_set_PhyReq_TO(u8 en);
-void     tp_set_DiffProc_ChnMap(u8 en);
-void     tp_set_DiffProc_ConUp(u8 en);
-void     tp_setRecv_no(u8 num);
-void     tp_set_PhyInd_TO(u8 en);
-void     tp_set_NoPhyReqChan(u8 en);
-void     tp_set_NoPhyRspChan(u8 en);
-
-
-
-
-
-#endif /* LL_BQB_H_ */
diff --git a/stack/ble/controller/ble_controller.h b/stack/ble/controller/ble_controller.h
new file mode 100644
index 0000000..4050f76
--- /dev/null
+++ b/stack/ble/controller/ble_controller.h
@@ -0,0 +1,73 @@
+/******************************************************************************
+ * @file     ble_controller.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef BLE_CONTROLLER_H_
+#define BLE_CONTROLLER_H_
+
+
+#include "stack/ble/ble_common.h"
+#include "stack/ble/ble_format.h"
+
+
+#include "stack/ble/hci/hci.h"
+#include "stack/ble/hci/hci_const.h"
+#include "stack/ble/hci/hci_cmd.h"
+#include "stack/ble/hci/hci_event.h"
+
+
+#include "stack/ble/controller/ll/ll.h"
+#include "stack/ble/controller/ll/ll_adv.h"
+#include "stack/ble/controller/ll/ll_pm.h"
+#include "stack/ble/controller/ll/ll_scan.h"
+#include "stack/ble/controller/ll/ll_whitelist.h"
+#include "stack/ble/controller/ll/ll_resolvlist.h"
+#include "stack/ble/controller/ll/ll_conn/ll_conn.h"
+#include "stack/ble/controller/ll/ll_conn/ll_slave.h"
+#include "stack/ble/controller/ll/ll_conn/ll_conn_csa.h"
+
+#if(MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+#include "stack/ble/controller/ll/ll_init.h"
+#include "stack/ble/controller/ll/ll_conn/ll_master.h"
+#endif
+
+#include "stack/ble/controller/ll/ll_ext_adv.h"
+
+
+#include "phy/phy.h"
+#include "phy/phy_test.h"
+
+
+#include "algorithm/ecc/ecc_ll.h"
+#include "algorithm/aes_ccm/aes_ccm.h"
+
+
+/*********************************************************/
+//Remove when file merge to SDK //
+#include "stack/ble/ble_config.h"
+#include "stack/ble/trace.h"
+
+/*********************************************************/
+
+#endif /* BLE_H_ */
diff --git a/stack/ble/controller/ll/ll.h b/stack/ble/controller/ll/ll.h
new file mode 100644
index 0000000..e96059e
--- /dev/null
+++ b/stack/ble/controller/ll/ll.h
@@ -0,0 +1,282 @@
+/******************************************************************************
+ * @file     ll.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL__H_
+#define LL__H_
+
+
+#include "tl_common.h"
+#include "stack/ble/ble_common.h"
+
+/**
+ * @brief    BLE link layer state
+ */
+#define            BLS_LINK_STATE_IDLE                                0
+#define            BLS_LINK_STATE_ADV                                BIT(0)
+#define            BLS_LINK_STATE_SCAN                                BIT(1)
+#define            BLS_LINK_STATE_INIT                                BIT(2)
+#define         BLS_LINK_STATE_CONN                                BIT(3)
+
+
+/**
+ * @brief    Telink defined LinkLayer Event Callback Declaration
+ */
+typedef void (*blt_event_callback_t)(u8 e, u8 *p, int n);
+
+
+/**
+ * @brief    Telink defined LinkLayer Callback Declaration for phyTest
+ */
+typedef int (*blc_main_loop_phyTest_callback_t)(void);
+
+
+/**
+ * @brief    Telink defined LinkLayer Event Type
+ */
+#define         BLT_EV_MAX_NUM                                    20
+
+#define            BLT_EV_FLAG_ADV                                    0
+#define            BLT_EV_FLAG_ADV_DURATION_TIMEOUT                1
+#define            BLT_EV_FLAG_SCAN_RSP                            2
+#define            BLT_EV_FLAG_CONNECT                                3
+#define            BLT_EV_FLAG_TERMINATE                            4
+#define            BLT_EV_FLAG_LL_REJECT_IND                        5
+#define            BLT_EV_FLAG_RX_DATA_ABANDOM                        6
+#define         BLT_EV_FLAG_PHY_UPDATE                            7
+#define            BLT_EV_FLAG_DATA_LENGTH_EXCHANGE                8
+#define            BLT_EV_FLAG_GPIO_EARLY_WAKEUP                    9
+#define            BLT_EV_FLAG_CHN_MAP_REQ                            10
+#define            BLT_EV_FLAG_CONN_PARA_REQ                        11
+#define            BLT_EV_FLAG_CHN_MAP_UPDATE                        12
+#define            BLT_EV_FLAG_CONN_PARA_UPDATE                    13
+#define            BLT_EV_FLAG_SUSPEND_ENTER                        14
+#define            BLT_EV_FLAG_SUSPEND_EXIT                        15
+#define            BLT_EV_FLAG_VERSION_IND_REV                        16
+
+
+/*
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    my_fifo_t            blt_rxfifo;
+    u8                    blt_rxfifo_b[];
+
+    my_fifo_t            blt_txfifo;
+    u8                    blt_txfifo_b[];
+#endif
+*/
+typedef struct {
+    u16        connEffectiveMaxRxOctets;
+    u16        connEffectiveMaxTxOctets;
+    u16     connMaxRxOctets;
+    u16     connMaxTxOctets;
+    u16        connRemoteMaxRxOctets;
+    u16     connRemoteMaxTxOctets;
+    u16        supportedMaxRxOctets;
+    u16        supportedMaxTxOctets;
+
+    u8         connInitialMaxTxOctets;  //u8 is enough
+    u8        connMaxTxRxOctets_req;
+    u8        connRxDiff100;
+    u8        connTxDiff100;
+}ll_data_extension_t;
+
+extern _attribute_aligned_(4) ll_data_extension_t  bltData;
+
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+extern my_fifo_t        hci_tx_fifo;
+#endif
+/**
+ * @brief    This function is used to obtain the effective maximum TX data length
+ * @param    none
+ * @return    bltData.connEffectiveMaxTxOctets
+ */
+static inline u8 blc_ll_get_connEffectiveMaxTxOctets(void)
+{
+    #if (LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION)
+        return bltData.connEffectiveMaxTxOctets;
+    #else
+        return 27;
+    #endif
+}
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+/**
+ * @brief    This function is used to obtain the effective maximum RX data length
+ * @param    none
+ * @return    bltData.connEffectiveMaxRxOctets
+ */
+static inline u8 blc_ll_get_connEffectiveMaxRxOctets(void)
+{
+    #if (LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION)
+        return bltData.connEffectiveMaxRxOctets;
+    #else
+        return 27;
+    #endif
+}
+#endif
+
+/**
+ * @brief    irq_handler for BLE stack, process system tick interrupt and RF interrupt
+ * @param    none
+ * @return    none
+ */
+void        irq_blt_sdk_handler (void);
+
+
+/**
+ * @brief   main_loop for BLE stack, process data and event
+ * @param    none
+ * @return    none
+ */
+int         blt_sdk_main_loop(void);
+
+
+
+
+/**
+ * @brief   LinkLayer initialization after deepSleep retention wake_up
+ * @param    none
+ * @return    none
+ */
+void         blc_ll_recoverDeepRetention(void);
+
+
+
+/**
+ * @brief      for user to initialize MCU
+ * @param       none
+ * @return     none
+ */
+void         blc_ll_initBasicMCU (void);
+
+
+/**
+ * @brief      for user to initialize link layer Standby state
+ * @param[in]  *public_adr -  public address pointer
+ * @return     none
+ */
+void         blc_ll_initStandby_module (u8 *public_adr);
+
+
+
+
+/**
+ * @brief      this function is used to set the LE Random Device Address in the Controller
+ * @param[in]  *randomAddr -  Random Device Address
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t     blc_ll_setRandomAddr(u8 *randomAddr);
+
+
+/**
+ * @brief      this function is used to read MAC address
+ * @param[in]  *addr -  The address where the read value(MAC address) prepare to write.
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t     blc_ll_readBDAddr(u8 *addr);
+
+/**
+ * @brief      this function is used to get LE stack current state
+ * @param[in]  none.
+ * @return     BLE link layer state:
+ *                     BLS_LINK_STATE_IDLE
+ *                     BLS_LINK_STATE_ADV
+ *                     BLS_LINK_STATE_SCAN
+ *                     BLS_LINK_STATE_INIT
+ *                     BLS_LINK_STATE_CONN
+ */
+u8             blc_ll_getCurrentState(void);
+
+/**
+ * @brief      this function is used to get the most recent average RSSI
+ * @param[in]  none.
+ * @return     bltParam.ll_recentAvgRSSI
+ */
+u8             blc_ll_getLatestAvgRSSI(void);
+
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+u16           blc_ll_setInitTxDataLength (u16 maxTxOct);   //core4.2 long data packet
+#endif
+
+/**
+ * @brief      this function is used to pend Controller event
+ * @param[in]  none.
+ * @return     blc_tlkEvent_pending
+ */
+bool        blc_ll_isControllerEventPending(void);
+
+
+/**
+ * @brief      this function is used to get TX FIFO Number of current state
+ * @param[in]  none.
+ * @return     total_fifo_num
+ */
+u8          blc_ll_getTxFifoNumber (void);
+
+ble_sts_t     blt_ll_exchangeDataLength (u8 opcode, u16 maxTxOct);   ///core4.2 data extension
+
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+#define     blc_ll_exchangeDataLength    blt_ll_exchangeDataLength  ///Compatible with previous versions
+#endif
+
+
+/**
+ * @brief        this function is used to register LinkLayer Event Callback function
+ * @param[in]    e -
+ * @param[in]    p -
+ * @return        none
+ */
+void        bls_app_registerEventCallback (u8 e, blt_event_callback_t p);
+
+
+
+
+
+
+
+bool         blc_ll_isBrxBusy (void);
+
+
+
+void  blc_ll_set_CustomedAdvScanAccessCode(u32 accss_code);
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+/**
+ * @brief      this function is used check if any controller buffer initialized by application incorrect.
+ *                attention: this function must be called at the end of BLE LinkLayer Initialization.
+ * @param       none
+ * @return     status, 0x00:  succeed, no buffer error
+ *                        other: buffer error code
+ */
+ble_sts_t    blc_controller_check_appBufferInitialization(void);
+#endif
+
+
+
+
+#endif /* LL__H_ */
diff --git a/stack/ble/controller/ll/ll_adv.h b/stack/ble/controller/ll/ll_adv.h
new file mode 100644
index 0000000..f6a00dd
--- /dev/null
+++ b/stack/ble/controller/ll/ll_adv.h
@@ -0,0 +1,136 @@
+/******************************************************************************
+ * @file     ll_adv.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_ADV_H_
+#define LL_ADV_H_
+
+#include "stack/ble/ble_format.h"
+
+
+
+
+/**
+ * @brief      for user to initialize advertising module
+ * @param[in]  *public_adr -  public address pointer
+ * @return     none
+ */
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+void         blc_ll_initAdvertising_module(void);
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+void         blc_ll_initAdvertising_module(u8 *public_adr);
+#endif
+
+/**
+ * @brief       set the data used in advertising packets that have a data field.
+ * @param[in]  *data -  advertising data buffer
+ * @param[in]  len - The number of significant octets in the Advertising_Data.
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t    bls_ll_setAdvData(u8 *data, u8 len);
+
+
+/**
+ * @brief       This function is used to provide data used in Scanning Packets that have a data field.
+ * @param[in]  *data -  Scan_Response_Data buffer
+ * @param[in]  len - The number of significant octets in the Scan_Response_Data.
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     bls_ll_setScanRspData(u8 *data, u8 len);
+
+
+
+/**
+ * @brief      This function is used to set the advertising parameters.
+ * @param[in]  intervalMin - Minimum advertising interval(Time = N * 0.625 ms, Range: 0x0020 to 0x4000)
+ * @param[in]  intervalMin - Maximum advertising interval(Time = N * 0.625 ms, Range: 0x0020 to 0x4000)
+ * @param[in]  advType - Advertising_Type
+ * @param[in]  ownAddrType - Own_Address_Type
+ * @param[in]  peerAddrType - Peer_Address_Type
+ * @param[in]  *peerAddr - Peer_Address
+ * @param[in]  adv_channelMap - Advertising_Channel_Map
+ * @param[in]  advFilterPolicy - Advertising_Filter_Policy
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t   bls_ll_setAdvParam( u16 intervalMin,  u16 intervalMax,  adv_type_t advType,                 own_addr_type_t ownAddrType,  \
+                                 u8 peerAddrType, u8  *peerAddr,    adv_chn_map_t     adv_channelMap,   adv_fp_type_t   advFilterPolicy);
+
+
+
+
+/**
+ * @brief      This function is used to request the Controller to start or stop advertising.
+ * @param[in]  adv_enable - Advertising_Enable
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t   bls_ll_setAdvEnable(int adv_enable);
+
+
+
+
+
+
+/**
+ * @brief      This function is used to set advertise duration time.
+ * @param[in]  duration_us - the length of duration, the unit is us.
+ * @param[in]  duration_en - Duration_Enable
+ * @return     Status - 0x00: BLE success; 0x01-0xFF: fail
+ */
+ble_sts_t   bls_ll_setAdvDuration (u32 duration_us, u8 duration_en);
+
+
+
+
+
+/**
+ * @brief      This function is used to set some other channel to replace advertising chn37/38/39.
+ * @param[in]  chn0 - channel to replace channel 37
+ * @param[in]  chn1 - channel to replace channel 38
+ * @param[in]  chn2 - channel to replace channel 39
+ * @return     none
+ */
+void         blc_ll_setAdvCustomedChannel (u8 chn0, u8 chn1, u8 chn2);
+
+/**
+ * @brief      this function is used to set whether to continue sending broadcast packets when receiving scan request in the current adv interval.
+ * @param[in]  enable - enable:continue sending broadcast packets when receiving scan request.
+ * @return     none.
+ */
+void bls_ll_continue_adv_after_scan_req(u8 enable);
+
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+u8             blt_set_adv_direct_init_addrtype(u8* cmdPara);
+ble_sts_t   bls_ll_setAdvType(u8 advType);
+ble_sts_t     blt_set_adv_addrtype(u8* cmdPara);
+#endif
+
+#if(BLT_ADV_IN_CONN_SLAVE_EN)
+ble_sts_t   blc_ll_addAdvertisingInConnSlaveRole(void);
+ble_sts_t   blc_ll_removeAdvertisingFromConnSLaveRole(void);
+ble_sts_t     blc_ll_setAdvParamInConnSlaveRole( u8           *adv_data,  u8              advData_len, u8 *scanRsp_data,  u8 scanRspData_len,
+                                               adv_type_t  advType,   own_addr_type_t ownAddrType, u8 adv_channelMap, adv_fp_type_t advFilterPolicy);
+#endif
+
+
+#endif /* LL_ADV_H_ */
diff --git a/stack/ble/controller/ll/ll_conn/ll_conn.h b/stack/ble/controller/ll/ll_conn/ll_conn.h
new file mode 100644
index 0000000..0c8feda
--- /dev/null
+++ b/stack/ble/controller/ll/ll_conn/ll_conn.h
@@ -0,0 +1,84 @@
+/******************************************************************************
+ * @file     ll_conn.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_CONN_H_
+#define LL_CONN_H_
+
+
+/**
+ * @brief    LE connection handle for slave & master role
+ */
+#define            BLM_CONN_HANDLE                                    BIT(7)
+#define            BLS_CONN_HANDLE                                    BIT(6)
+
+
+
+#define         BLE_INVALID_CONNECTION_HANDLE                    0xffff
+#define         IS_CONNECTION_HANDLE_VALID(handle)              ( handle != BLE_INVALID_CONNECTION_HANDLE )
+
+/**
+ * @brief      for user to initialize ACL connection module.
+ *                notice that: user must sue this API for both connection slave and master role.
+ * @param       none
+ * @return     none
+ */
+void        blc_ll_initConnection_module(void);
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+/**
+ * @brief      for user to initialize LinkLayer TX FIFO.
+ *                notice that: size*(number - 1)<= 0xFFF
+ * @param[in]  pTxbuf - TX FIFO buffer address.
+ * @param[in]  size - TX FIFO size,  must 16 Byte aligned
+ * @param[in]  number - TX FIFO number, can only be 9, 17 or 33
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t     blc_ll_initAclConnTxFifo(u8 *pTxbuf, int size, int number);
+
+
+/**
+ * @brief      for user to initialize LinkLayer RX FIFO.
+ * @param[in]  pTxbuf - RX FIFO buffer address.
+ * @param[in]  size - RX FIFO size
+ * @param[in]  number - RX FIFO number, can only be 4, 8, 16 or 32
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t    blc_ll_initAclConnRxFifo(u8 *pRxbuf, int size, int number);
+
+
+
+/**
+ * @brief      for user to set connMaxRxOctets and connMaxTxOctets
+ * @param[in]  maxRxOct - connMaxRxOctets, should be in range of 27 ~ 251
+ * @param[in]  maxTxOct - connMaxTxOctets, should be in range of 27 ~ 251
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t    blc_ll_setAclConnMaxOctetsNumber(u8 maxRxOct, u8 maxTxOct);
+#endif
+
+#endif /* LL_CONN_H_ */
diff --git a/stack/ble/controller/ll/ll_conn/ll_conn_csa.h b/stack/ble/controller/ll/ll_conn/ll_conn_csa.h
new file mode 100644
index 0000000..428b7d3
--- /dev/null
+++ b/stack/ble/controller/ll/ll_conn/ll_conn_csa.h
@@ -0,0 +1,45 @@
+/******************************************************************************
+ * @file     ll_conn_csa.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_CONN_CSA_H_
+#define LL_CONN_CSA_H_
+
+
+
+
+/**
+ * @brief      this function is used to initialize channel selection algorithm #2 feature
+ * @param       none
+ * @return     none
+ */
+void blc_ll_initChannelSelectionAlgorithm_2_feature(void);
+
+
+
+
+
+
+
+#endif /* LL_CONN_CSA_H_ */
diff --git a/stack/ble/controller/ll/ll_conn/ll_master.h b/stack/ble/controller/ll/ll_conn/ll_master.h
new file mode 100644
index 0000000..21c99f8
--- /dev/null
+++ b/stack/ble/controller/ll/ll_conn/ll_master.h
@@ -0,0 +1,46 @@
+/******************************************************************************
+ * @file     ll_master.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_MASTER_H_
+#define LL_MASTER_H_
+
+
+
+/******************************* User Interface  ************************************/
+void        blc_ll_initMasterRoleSingleConn_module(void);
+bool        blm_ll_isRfStateMachineBusy(void);
+
+ble_sts_t    blm_ll_disconnect (u16 handle, u8 reason);
+ble_sts_t    blm_ll_updateConnection (u16 connHandle,
+                              u16 conn_min, u16 conn_max, u16 conn_latency, u16 timeout,
+                              u16 ce_min, u16 ce_max );
+
+ble_sts_t    blm_ll_setHostChannel (u16 handle, u8 * map);
+
+
+rf_packet_l2cap_t *        blm_l2cap_packet_pack (u16 conn, u8 * raw_pkt);
+
+
+#endif /* LL_MASTER_H_ */
diff --git a/stack/ble/controller/ll/ll_conn/ll_slave.h b/stack/ble/controller/ll/ll_conn/ll_slave.h
new file mode 100644
index 0000000..44eb9a7
--- /dev/null
+++ b/stack/ble/controller/ll/ll_conn/ll_slave.h
@@ -0,0 +1,109 @@
+/******************************************************************************
+ * @file     ii_slave.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+
+#ifndef LL_SLAVE_H_
+#define LL_SLAVE_H_
+
+
+
+
+
+
+
+
+/**
+ * @brief      for user to initialize ACL connection slave role.
+ * @param       none
+ * @return     none
+ */
+void         blc_ll_initSlaveRole_module(void);
+
+
+/**
+ * @brief      for user to terminate an existing connection slave role.
+ * @param[in]  reason - indicates the reason for ending the connection
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t      bls_ll_terminateConnection (u8 reason);
+
+
+/**
+ * @brief      for user to read current slave connection  interval
+ * @param       none
+ * @return     0    :  LinkLayer not in connection state
+ *                other:  connection interval, unit: 1.25mS
+ */
+u16            bls_ll_getConnectionInterval(void);
+
+
+/**
+ * @brief      for user to read current slave connection latency
+ * @param       none
+ * @return     0    :  LinkLayer not in connection state
+ *                other:  connection latency
+ */
+u16            bls_ll_getConnectionLatency(void);
+
+
+/**
+ * @brief      for user to read current slave connection supervision timeout
+ * @param       none
+ * @return     0    :  LinkLayer not in connection state
+ *                other:  connection supervision timeout, unit: 10 mS
+ */
+u16            bls_ll_getConnectionTimeout(void);
+
+/**
+ * @brief     for user to send LL_VERSION_IND.
+ * @param     connHandle: BLS_CONN_HANDLE indicate slave role;
+ * @return    status, 0x00 : succeed
+ *                       other: failed
+ */
+ble_sts_t    bls_ll_readRemoteVersion(u16 connHandle);
+
+/**
+ * @brief      used to set telink defined event mask for BLE module only.
+ * @param[in]  evtMask - event mask
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t     bls_hci_mod_setEventMask_cmd(u32 evtMask);
+
+
+#if(MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    unsigned char set_disBrxRequest_thresold(unsigned char thres);
+    int            bls_ll_requestConnBrxEventDisable(void);
+    void        bls_ll_disableConnBrxEvent(void);
+    void        bls_ll_restoreConnBrxEvent(void);
+#endif
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    #define blc_ll_disconnect(conn, reason)         bls_ll_terminateConnection(reason)
+#endif
+
+
+#endif /* LL_SLAVE_H_ */
diff --git a/stack/ble/controller/ll/ll_ext_adv.h b/stack/ble/controller/ll/ll_ext_adv.h
new file mode 100644
index 0000000..09ccd86
--- /dev/null
+++ b/stack/ble/controller/ll/ll_ext_adv.h
@@ -0,0 +1,270 @@
+/******************************************************************************
+ * @file     ll_ext_adv.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_ADV_EXT_H_
+#define LL_ADV_EXT_H_
+
+
+#include "stack/ble/hci/hci_cmd.h"
+
+
+/**
+ * @brief    Primary channel advertising packet data buffer size
+ */
+#define         MAX_LENGTH_PRIMARY_ADV_PKT                        44   //sizeof(rf_pkt_pri_adv_t) = 43
+
+
+/**
+ * @brief    Secondary channel advertising packet data buffer size
+ */
+#define         MAX_LENGTH_SECOND_ADV_PKT                        264   //sizeof(rf_pkt_ext_adv_t) = 261
+
+
+/**
+ * @brief    Primary advertising packet format
+ */
+typedef struct{
+    u32 dma_len;
+
+    u8 type   :4;
+    u8 rfu1   :1;
+    u8 chan_sel:1;
+    u8 txAddr :1;
+    u8 rxAddr :1;
+
+    u8  rf_len;
+    u8    advA[6];            //address
+    u8    data[31];            //0-31 byte
+}rf_pkt_pri_adv_t;
+
+
+//NOTE: this data structure must 4 bytes aligned
+typedef struct
+{
+    u8        adv_handle;
+    u8         extAdv_en;
+    u8         adv_chn_mask;
+    u8        adv_chn_num;
+
+    u8         own_addr_type;
+    u8         peer_addr_type;
+    u8         pri_phy;
+    u8         sec_phy;
+
+
+    u8         max_ext_adv_evt;
+    u8         run_ext_adv_evt;
+    u8        unfinish_advData;
+    u8        unfinish_scanRsp;
+
+
+    u8        adv_filterPolicy;
+    u8         scan_req_noti_en;
+    u8         coding_ind;                    //s2 or s8
+    u8        param_update_flag;
+
+
+    u8        with_aux_adv_ind;   //ADV_EXT_IND  with AUX_ADV_IND
+    u8        with_aux_chain_ind;
+    u8         rand_adr_flg;
+    u8         adv_sid;
+
+
+    u16     adv_did;     // BIT<11:0>
+    u16     evt_props;
+    u16        advInt_use;
+    u16        send_dataLen;
+    u16     maxLen_advData;            //for each ADV sets, this value can be different to save SRAM
+    u16     curLen_advData;
+    u16     maxLen_scanRsp;            //for each ADV sets, this value can be different to save SRAM
+    u16     curLen_scanRsp;
+
+    u16        send_dataLenBackup;
+    u16        rsvd_16_1;
+
+
+    u32     adv_duration_tick;
+    u32     adv_begin_tick;                //24
+    u32        adv_event_tick;
+
+    u8*        dat_extAdv;
+    u8*        dat_scanRsp;                //Scan response data.
+    rf_pkt_pri_adv_t*        primary_adv;
+    rf_pkt_ext_adv_t*        secondary_adv;
+
+    u8         rand_adr[6];
+    u8         peer_addr[6];
+}ll_ext_adv_t;
+
+
+#define ADV_SET_PARAM_LENGTH                (sizeof(ll_ext_adv_t))   //sizeof(ll_ext_adv_t) =  ,  must 4 byte aligned
+
+
+
+
+
+
+
+
+
+/**
+ * @brief      this function is used to initialize extended advertising module
+ * @param[in]  *pAdvCtrl - advertising set control buffer address
+ * @param[in]  *pPriAdv - Primary channel advertising packet data buffer address
+ * @param[in]    num_sets - number of advertising set
+ * @return     none
+ */
+void         blc_ll_initExtendedAdvertising_module(    u8 *pAdvCtrl, u8 *pPriAdv,int num_sets);
+
+
+/**
+ * @brief      this function is used to initialize secondary channel advertising packet buffer
+ * @param[in]  *pSecAdv - secondary channel advertising packet buffer address
+ * @param[in]  sec_adv_buf_len - secondary channel advertising packet buffer length
+ * @return     none
+ */
+void         blc_ll_initExtSecondaryAdvPacketBuffer(u8 *pSecAdv, int sec_adv_buf_len);
+
+
+/**
+ * @brief      initialize Advertising Data buffer for all adv_set
+ * @param[in]  pExtAdvData - extended advertising data buffer address
+ * @param[in]  max_len_advData - extended advertising data buffer maximum length
+ * @return     none
+ */
+void         blc_ll_initExtAdvDataBuffer(u8 *pExtAdvData, int max_len_advData);
+
+
+/**
+ * @brief      initialize Scan Response Data Buffer for all adv_set
+ * @param[in]  pScanRspData - extended scan response data buffer address
+ * @param[in]  max_len_scanRspData - extended scan response data buffer maximum length
+ * @return     none
+ */
+void         blc_ll_initExtScanRspDataBuffer(u8 *pScanRspData, int max_len_scanRspData);
+
+
+
+/**
+ * @brief      This function is used to set the advertising parameters
+ * @param[in]  advHandle - advertising handle
+ * @param[in]  adv_evt_prop - advertising event property
+ * @param[in]  pri_advIntervalMin - primary advertising channel interval maximum value
+ * @param[in]  pri_advInter_max -   primary advertising channel interval minimum value
+ * @param[in]  pri_advChnMap -  primary advertising channel map
+ * @param[in]  ownAddrType - own address type
+ * @param[in]  peerAddrType - peer address type
+ * @param[in]  *peerAddr - peer address
+ * @param[in]  advFilterPolicy - advertising filter policy
+ * @param[in]  adv_tx_pow - advertising TX power
+ * @param[in]  pri_adv_phy - primary advertising channel PHY type
+ * @param[in]  sec_adv_max_skip - secondary advertising minimum skip number
+ * @param[in]  sec_adv_phy - - primary advertising channel PHY type
+ * @param[in]  adv_sid - advertising set id
+ * @param[in]  scan_req_noti_en -scan response notify enable
+ * @return     Status - 0x00: command succeeded;
+                        others: failed
+ */
+ble_sts_t     blc_ll_setExtAdvParam(  adv_handle_t advHandle,         advEvtProp_type_t adv_evt_prop, u32 pri_advIntervalMin,         u32 pri_advIntervalMax,
+                                    u8 pri_advChnMap,                 own_addr_type_t ownAddrType,     u8 peerAddrType,             u8  *peerAddr,
+                                    adv_fp_type_t advFilterPolicy,  tx_power_t adv_tx_pow,            le_phy_type_t pri_adv_phy,     u8 sec_adv_max_skip,
+                                    le_phy_type_t sec_adv_phy,          u8 adv_sid,                     u8 scan_req_noti_en);
+
+
+
+/**
+ * @brief      This function is used to set the data used in advertising PDU that have a data field
+ * @param[in]  advHandle - advertising handle
+ * @param[in]  operation - Operation type
+ * @param[in]  fragment_prefer -Fragment_Preference
+ * @param[in]  advData_len - advertising data length
+ * @param[in]  *advData - advertising data buffer address
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t    blc_ll_setExtAdvData    (u8 advHandle, data_oper_t operation, data_fragm_t fragment_prefer, u8 adv_dataLen,     u8 *advdata);
+
+
+
+
+/**
+ * @brief      This function is used to provide scan response data used in scanning response PDUs.
+ * @param[in]  advHandle - advertising handle
+ * @param[in]  operation - Operation type
+ * @param[in]  fragment_prefer -Fragment_Preference
+ * @param[in]  scanRsp_dataLen - advertising scan response data length
+ * @param[in]  *scanRspData - advertising scan response data buffer address
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_ll_setExtScanRspData(u8 advHandle, data_oper_t operation, data_fragm_t fragment_prefer, u8 scanRsp_dataLen, u8 *scanRspData);
+
+
+/**
+ * @brief      This function is used to request the Controller to enable or disable one or more advertising sets using the
+               advertising sets identified by the adv_handle
+ * @param[in]  extAdv_en -
+ * @param[in]  advHandle - advertising handle
+ * @param[in]  duration -    the duration for which that advertising set is enabled
+ *                             Range: 0x0001 to 0xFFFF, Time = N * 10 ms, Time Range: 10 ms to 655,350 ms
+ * @param[in]  max_extAdvEvt - Maximum number of extended advertising events the Controller shall
+ *                             attempt to send prior to terminating the extended advertising
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_ll_setExtAdvEnable_1(u32 extAdv_en, u8 sets_num, u8 advHandle,      u16 duration,       u8 max_extAdvEvt);
+
+
+
+
+
+/**
+ * @brief      used to set default S2/S8 mode for Extended advertising if Coded PHY is used, this
+ * @param[in]  advHandle - advertising handle
+ * @param[in]  prefer_CI - LE coding indication prefer
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t    blc_ll_setDefaultExtAdvCodingIndication(u8 advHandle, le_ci_prefer_t prefer_CI);
+
+
+
+/**
+ * @brief      this API is used to debug, setting one auxiliary data channel
+ * @param[in]  aux_chn - auxiliary data channel, must be range of 0~36
+ * @return     none
+ */
+void        blc_ll_setAuxAdvChnIdxByCustomers(u8 aux_chn);
+
+
+
+/**
+ * @brief      this API is used to debug, setting maximum advertising random delay
+ * @param[in]  max_delay_ms - maximum advertising random delay, unit :mS, only  8/4/2/1/0  available
+ * @return     none
+ */
+void        blc_ll_setMaxAdvDelay_for_AdvEvent(u8 max_delay_ms);
+
+
+
+
+
+#endif /* LL_ADV_EXT_H_ */
diff --git a/stack/ble/ll/ll_init.h b/stack/ble/controller/ll/ll_init.h
similarity index 61%
rename from stack/ble/ll/ll_init.h
rename to stack/ble/controller/ll/ll_init.h
index ac4d1f0..3af4ad3 100644
--- a/stack/ble/ll/ll_init.h
+++ b/stack/ble/controller/ll/ll_init.h
@@ -23,71 +23,11 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-/*
- * ll_init.h
- *
- *  Created on: 2017-3-9
- *      Author: Administrator
- */
-
 #ifndef LL_INIT_H_
 #define LL_INIT_H_
 
 
-
-typedef struct {
-    u8        init_en;
-    u8        conn_policy;
-    u8        conn_advType;
-    u8        conn_established;
-
-    u32        create_conn_startTick;
-
-    u16     rsvd;
-    u8        conn_mac[6];
-
-}st_ll_init_t;
-
-//st_ll_init_t  blti;
-
-extern u32 blm_timeout_connectDevice;
-
-
-
-extern rf_packet_ll_init_t    pkt_init;
-
-
-
-
-typedef int  (*ll_module_init_callback_t)(u8 *, u32);
-
-
-
-
-
-static inline u32 rf_get_ble_access_code_16to32 (u16 code)
-{
-    u32 r = 0;
-    int i;
-    for (i=0; i<4; i++) {
-        r = r << 2;
-        r |= code & BIT(i) ? 1 : 2;
-    }
-
-    for (i=4; i<8; i++) {  //no more 24 transitions
-        r = r << 4;
-        r |= code & BIT(i) ? 0x0c : 0x03;
-    }
-
-    for (i=12; i<16; i++) {
-        r = r << 2;
-        r |= code & BIT(i) ? 1 : 2;
-    }
-
-    return r;
-}
-
-
+extern int blm_create_connection;
 
 
 /******************************* User Interface  ************************************/
@@ -105,8 +45,5 @@
 ble_sts_t   blc_ll_setCreateConnectionTimeout (u32 timeout_ms);
 
 
-/************************* Stack Interface, user can not use!!! ***************************/
-ble_sts_t     blc_ll_setInitEnable (u8 en);
-
 
 #endif /* LL_INIT_H_ */
diff --git a/stack/ble/controller/ll/ll_pm.h b/stack/ble/controller/ll/ll_pm.h
new file mode 100644
index 0000000..59f8476
--- /dev/null
+++ b/stack/ble/controller/ll/ll_pm.h
@@ -0,0 +1,154 @@
+/******************************************************************************
+ * @file     ll_pm.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_PM_H_
+#define LL_PM_H_
+
+
+
+
+////////////////// Power Management ///////////////////////
+/**
+ * @brief    Telink defined Low power state Type
+ */
+#define            SUSPEND_DISABLE                0
+#define            SUSPEND_ADV                    BIT(0)
+#define            SUSPEND_CONN                BIT(1)
+#define            DEEPSLEEP_RETENTION_ADV        BIT(2)
+#define            DEEPSLEEP_RETENTION_CONN    BIT(3)
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+#define            MCU_STALL                    BIT(6)
+#endif
+
+
+
+
+/**
+ * @brief    Telink defined ble stack low power mode process callback function
+ */
+typedef     void (*ll_module_pm_callback_t)(void);
+
+/**
+ * @brief    Telink defined application wake up low power mode process callback function
+ */
+typedef     void (*pm_appWakeupLowPower_callback_t)(int);
+
+
+
+
+
+/**
+ * @brief    for user to initialize low power mode
+ * @param    none
+ * @return    none
+ */
+void         blc_ll_initPowerManagement_module(void);
+
+/**
+ * @brief    for user to set low power mode mask
+ * @param    mask - low power mode mask
+ * @return    none
+ */
+void        bls_pm_setSuspendMask (u8 mask);
+
+/**
+ * @brief    for user to get low power mode mask
+ * @param    none
+ * @return    bltPm.suspend_mask
+ */
+u8             bls_pm_getSuspendMask (void);
+
+/**
+ * @brief    for user to set low power mode wake up source
+ * @param    source - low power mode wake up source
+ * @return    none
+ */
+void         bls_pm_setWakeupSource(u8 source);
+
+/**
+ * @brief    for user to get low power mode wake up time
+ * @param    none
+ * @return    bltPm.current_wakeup_tick
+ */
+u32         bls_pm_getSystemWakeupTick(void);
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+/**
+ * @brief    for user to get low power mode next connect event wake up time
+ * @param    none
+ * @return    blt_next_event_tick
+ */
+u32         bls_pm_getNexteventWakeupTick(void);
+#endif
+/**
+ * @brief    for user to set latency manually for save power
+ * @param    latency - bltPm.user_latency
+ * @return    none
+ */
+void         bls_pm_setManualLatency(u16 latency); //manual set latency to save power
+
+/**
+ * @brief    for user to set application wake up low power mode
+ * @param    wakeup_tick - low power mode wake up time
+ * @param    enable - low power mode application wake up enable
+ * @return    none
+ */
+void         bls_pm_setAppWakeupLowPower(u32 wakeup_tick, u8 enable);
+
+/**
+ * @brief    for user to register the callback for application wake up low power mode process
+ * @param    cb - the pointer of callback function
+ * @return  none.
+ */
+void         bls_pm_registerAppWakeupLowPowerCb(pm_appWakeupLowPower_callback_t cb);
+
+/**
+ * @brief    for user to set the threshold of sleep tick for entering deep retention mode
+ * @param    adv_thres_ms - the threshold of sleep tick for advertisement state
+ * @param    conn_thres_ms - the threshold of sleep tick for connection state
+ * @return  none.
+ */
+void         blc_pm_setDeepsleepRetentionThreshold(u32 adv_thres_ms, u32 conn_thres_ms);
+
+/**
+ * @brief    for user to set early wake up tick for deep retention mode
+ * @param    earlyWakeup_us - early wake up tick for deep retention mode
+ * @return  none.
+ */
+void         blc_pm_setDeepsleepRetentionEarlyWakeupTiming(u32 earlyWakeup_us);
+
+/**
+ * @brief    for user to set the type of deep retention mode
+ * @param    sleep_type - the type of deep retention mode
+ * @return  none.
+ */
+void         blc_pm_setDeepsleepRetentionType(SleepMode_TypeDef sleep_type);
+
+
+
+
+
+
+#endif /* LL_PM_H_ */
diff --git a/stack/ble/controller/ll/ll_resolvlist.h b/stack/ble/controller/ll/ll_resolvlist.h
new file mode 100644
index 0000000..04e01bb
--- /dev/null
+++ b/stack/ble/controller/ll/ll_resolvlist.h
@@ -0,0 +1,150 @@
+/******************************************************************************
+ * @file     ll_resolvlist.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_RESOLVLIST_H_
+#define LL_RESOLVLIST_H_
+
+
+#include <stack/ble/ble_common.h>
+
+
+
+/******************************* Macro & Enumeration & Structure Definition for Stack Begin, user can not use!!!!  *****/
+
+#define                MAX_RESOLVING_LIST_SIZE                2
+#define             PRIVACY_NETWORK_MODE                 (0)
+#define             PRIVACY_DEVICE_MODE                  (1)
+
+#define                MAX_WHITE_LIST_SIZE                    4
+#define             MAX_WHITE_IRK_LIST_SIZE              2
+
+
+typedef struct {
+    u8 rlPrivMode;                 //Privacy network(0) or privacy device(1)
+    u8 rlIdAddrType;             //Public address (0) or random address (1)
+    u8 rlIdAddr[BLE_ADDR_LEN];     //The Identity Address is stored in little endian format
+
+    u8 rlHasLocalRpa;
+    u8 rsvd0;
+    u8 rlLocalRpa[BLE_ADDR_LEN];//The local rpa is stored in little endian format
+
+    u8 rlHasPeerRpa;
+    u8 rsvd1;
+    u8 rlPeerRpa[BLE_ADDR_LEN]; //The local rpa is stored in little endian format.
+
+    u8 rlPeerIrk[16];             //The IRKs are stored in big endian format
+    u8 rlLocalIrk[16];          //The IRKs are stored in big endian format
+}ll_resolv_list_t;
+
+typedef struct {
+    u8  rpaTmrEn;        //1: rpa tmr start; 0: rpa tmr stop
+    u8  rsvd[3];         //used align
+
+    u16 rpaTimeoutXs;    //belong to [0x0001, 0x0E10], unit: 1s
+    u16 rpaTmrCnt1sUnit; //design a 1s timer, accumulator unit 1s, 2^32/16us => 268.435456s
+
+    u32 rpaTmr1sChkTick; //accumulate judgment ticks per second
+}ll_rpaTmrCtrl_t;
+
+#if (LL_FEATURE_ENABLE_LL_PRIVACY)
+
+typedef struct {
+    u8     rlSize;
+    u8     rlCnt;
+    u16 addrRlEn;    //addr res enabled
+
+    u16 rpaTmrEn;   //1: rpa tmr start; 0: rpa tmr stop
+    u16 rpaTmo;        //0x0001 to 0x0E10, unit: 1s
+
+    ll_rpaTmrCtrl_t  rpaTmoCtrl;
+
+    ll_resolv_list_t rlList[MAX_RESOLVING_LIST_SIZE];
+
+}ll_ResolvingListTbl_t;
+
+#else
+
+typedef struct {
+    u8 type;
+    u8 address[BLE_ADDR_LEN];
+    u8 reserved;
+    u8 irk[16];
+} rl_addr_t;
+
+typedef struct {
+    rl_addr_t    tbl[MAX_WHITE_IRK_LIST_SIZE];
+    u8             idx;
+    u8            en;
+} ll_ResolvingListTbl_t;
+
+#endif
+
+extern    ll_ResolvingListTbl_t    ll_resolvingList_tbl;
+
+/******************************* Macro & Enumeration & Structure Definition for Stack End ******************************/
+
+
+
+
+
+
+/******************************* Macro & Enumeration variables for User Begin ******************************************/
+
+
+/******************************* Macro & Enumeration variables for User End ********************************************/
+
+
+
+
+
+
+
+/******************************* User Interface  Begin *****************************************************************/
+ble_sts_t          ll_resolvingList_add(u8 peerIdAddrType, u8 *peerIdAddr, u8 *peer_irk, u8 *local_irk);
+ble_sts_t          ll_resolvingList_delete(u8 peerIdAddrType, u8 *peerIdAddr);
+ble_sts_t          ll_resolvingList_reset(void);
+ble_sts_t          ll_resolvingList_getSize(u8 *Size);
+ble_sts_t          ll_resolvingList_getPeerResolvableAddr (u8 peerIdAddrType, u8* peerIdAddr, u8* peerResolvableAddr); //not available now
+ble_sts_t          ll_resolvingList_getLocalResolvableAddr(u8 peerIdAddrType, u8* peerIdAddr, u8* LocalResolvableAddr); //not available now
+ble_sts_t          ll_resolvingList_setAddrResolutionEnable (u8 resolutionEn);
+ble_sts_t          ll_resolvingList_setResolvablePrivateAddrTimer (u16 timeout_s);   //not available now
+ble_sts_t          ll_resolvingList_setPrivcyMode(u8 peerIdAddrType, u8* peerIdAddr, u8 privMode);
+
+u16                blc_ll_resolvGetRpaTmo(void);
+int                blc_ll_resolvPeerRpaResolvedAny(const u8* rpa);
+void            blc_ll_resolvGetRpaByRlEntry(ll_resolv_list_t* rl, u8* addr, u8 local);
+void            blc_ll_resolvSetPeerRpaByIdx(u8 idx, u8 *rpa);
+void            blc_ll_resolvSetLocalRpaByIdx(u8 idx, u8 *rpa);
+bool            blc_ll_resolvGetRpaByAddr(u8* peerIdAddr, u8 peerIdAddrType, u8* rpa, u8 local);
+bool            blc_ll_resolvIsAddrResolved(const u8* irk, const u8* rpa);
+bool            blc_ll_resolvIsAddrRlEnabled(void);
+void            blc_ll_resolvListInit(void);
+/******************************* User Interface  End  ******************************************************************/
+
+
+
+
+
+#endif /* LL_RESOLVLIST_H_ */
diff --git a/stack/ble/controller/ll/ll_scan.h b/stack/ble/controller/ll/ll_scan.h
new file mode 100644
index 0000000..7da6036
--- /dev/null
+++ b/stack/ble/controller/ll/ll_scan.h
@@ -0,0 +1,103 @@
+/******************************************************************************
+ * @file     ll_scan.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_SCAN_H_
+#define LL_SCAN_H_
+
+
+
+
+
+/**
+ * @brief      for user to initialize scanning module
+ * @param       none
+ * @return     none
+ */
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+void         blc_ll_initScanning_module(void);
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+void         blc_ll_initScanning_module(u8 *public_adr);
+#endif
+
+
+/**
+ * @brief      This function is used to set the scan parameters
+ * @param[in]  scan_type - passive Scanning or active scanning.
+ * @param[in]  scan_interval - time interval from when the Controller started its last LE scan until it begins the subsequent LE scan
+ * @param[in]  scan_window - The duration of the LE scan.
+ * @param[in]  ownAddrType - Own_Address_Type
+ * @param[in]  scanFilterPolicy
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_ll_setScanParameter (scan_type_t scan_type, u16 scan_interval, u16 scan_window, own_addr_type_t  ownAddrType, scan_fp_type_t scanFilter_policy);
+
+
+/**
+ * @brief       enable or disable legacy scanning.
+ * @param[in]  scan_enable
+ * @param[in]  filter_duplicate - controls whether the Link Layer should filter out
+ *                                   duplicate advertising reports (Filtering_Enabled) to the Host,
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_ll_setScanEnable (scan_en_t scan_enable, dupFilter_en_t filter_duplicate);
+
+
+/**
+ * @brief      This function is used to add scan state in advertise state of slave role.
+ * @param[in]  none.
+ * @return     Status - 0x00: BLE success; 0x01-0xFF: fail
+ */
+ble_sts_t    blc_ll_addScanningInAdvState(void);
+
+
+/**
+ * @brief      This function is used to remove scan state in advertise state of slave role.
+ * @param[in]  none.
+ * @return      Status - 0x00: BLE success; 0x01-0xFF: fail
+ */
+ble_sts_t    blc_ll_removeScanningFromAdvState(void);
+
+
+/**
+ * @brief      This function is used to add scan state in connect state of slave role.
+ * @param[in]  none.
+ * @return     Status - 0x00: BLE success; 0x01-0xFF: fail
+ */
+ble_sts_t    blc_ll_addScanningInConnSlaveRole(void);
+
+
+/**
+ * @brief      This function is used to remove scan state in connect state of slave role.
+ * @param[in]  none.
+ * @return      Status - 0x00: BLE success; 0x01-0xFF: fail
+ */
+ble_sts_t    blc_ll_removeScanningFromConnSLaveRole(void);
+
+
+
+
+
+
+#endif /* LL_SCAN_H_ */
diff --git a/stack/ble/controller/ll/ll_whitelist.h b/stack/ble/controller/ll/ll_whitelist.h
new file mode 100644
index 0000000..ea37b5d
--- /dev/null
+++ b/stack/ble/controller/ll/ll_whitelist.h
@@ -0,0 +1,70 @@
+/******************************************************************************
+ * @file     ll_whitelist.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef LL_WHITELIST_H_
+#define LL_WHITELIST_H_
+
+#include "stack/ble/ble_common.h"
+
+
+/**
+ * @brief      reset whitelist
+ * @param[in]  none
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t ll_whiteList_reset(void);
+
+
+/**
+ * @brief      add a device form whitelist
+ * @param[in]  type - device mac address type
+ * @param[in]  addr - device mac address
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t ll_whiteList_add(u8 type, u8 *addr);
+
+
+/**
+ * @brief      delete a device from whitelist
+ * @param[in]  type - device mac address type
+ * @param[in]  addr - device mac address
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t ll_whiteList_delete(u8 type, u8 *addr);
+
+
+
+
+/**
+ * @brief      get whitelist size
+ * @param[out] pointer to size
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t ll_whiteList_getSize(u8 *returnPublicAddrListSize) ;
+
+
+
+
+#endif /* LL_WHITELIST_H_ */
diff --git a/stack/ble/controller/phy/phy.h b/stack/ble/controller/phy/phy.h
new file mode 100644
index 0000000..3037f21
--- /dev/null
+++ b/stack/ble/controller/phy/phy.h
@@ -0,0 +1,64 @@
+/******************************************************************************
+ * @file     phy.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef PHY_H_
+#define PHY_H_
+
+#include "stack/ble/hci/hci_cmd.h"
+
+
+/**
+ * @brief      this function is used to initialize 2M/Coded PHY  feature
+ * @param       none
+ * @return     none
+ */
+void        blc_ll_init2MPhyCodedPhy_feature(void);
+
+
+/**
+ * @brief       this function is used to set PHY type for connection
+ * @param[in]    connHandle -
+ * @param[in]    all_phys - preference PHY for TX & RX
+ * @param[in]    tx_phys - preference PHY for TX
+ * @param[in]    rx_phys - preference PHY for RX
+ * @param[in]    phy_options - LE coding indication prefer
+ * @return     status, 0x00:  succeed
+ *                        other: failed
+ */
+ble_sts_t      blc_ll_setPhy(    u16 connHandle,                    le_phy_prefer_mask_t all_phys,
+                            le_phy_prefer_type_t tx_phys,     le_phy_prefer_type_t rx_phys,
+                            le_ci_prefer_t phy_options);
+
+
+/**
+ * @brief       This function is used to set LE Coded PHY preference, S2 or S8, or no specific preference.
+ * @param[in]    prefer_CI - Reference structure: hci_le_readPhyCmd_retParam_t.
+ * @return      status, 0x00:  succeed
+ *                         other: failed
+ */
+ble_sts_t    blc_ll_setDefaultConnCodingIndication(le_ci_prefer_t prefer_CI);
+
+
+#endif /* PHY_H_ */
diff --git a/stack/ble/controller/phy/phy_test.h b/stack/ble/controller/phy/phy_test.h
new file mode 100644
index 0000000..18a142a
--- /dev/null
+++ b/stack/ble/controller/phy/phy_test.h
@@ -0,0 +1,136 @@
+/******************************************************************************
+ * @file     phy_test.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef PHY_TEST_H_
+#define PHY_TEST_H_
+
+#include "tl_common.h"
+
+
+
+/**
+ * @brief    PHY test mode
+ */
+#ifndef            PHYTEST_MODE_DISABLE
+#define            PHYTEST_MODE_DISABLE                    0
+#endif
+
+#ifndef            PHYTEST_MODE_THROUGH_2_WIRE_UART
+#define         PHYTEST_MODE_THROUGH_2_WIRE_UART        1   //Direct Test Mode through a 2-wire UART interface
+#endif
+
+#ifndef            PHYTEST_MODE_OVER_HCI_WITH_USB
+#define         PHYTEST_MODE_OVER_HCI_WITH_USB            2   //Direct Test Mode over HCI(UART hardware interface)
+#endif
+
+#ifndef            PHYTEST_MODE_OVER_HCI_WITH_UART
+#define         PHYTEST_MODE_OVER_HCI_WITH_UART            3   //Direct Test Mode over HCI(USB  hardware interface)
+#endif
+
+
+
+
+/**
+ * @brief    PHY test mode enableor disable
+ */
+#define         BLC_PHYTEST_DISABLE                        0
+#define         BLC_PHYTEST_ENABLE                        1
+
+
+
+
+
+
+
+
+
+/**
+ * @brief      for user to initialize PHY test module
+ * @param      none
+ * @return     none
+ */
+void       blc_phy_initPhyTest_module(void);
+
+
+/**
+ * @brief      for user to set PHY test enable or disable
+ * @param[in]  en - 1: enable; 0:disable
+ * @return     status: 0x00 command OK, no other rvalue
+ */
+ble_sts_t blc_phy_setPhyTestEnable (u8 en);
+
+
+/**
+ * @brief      for user to get PHY test status: enable or disable
+ * @param      none
+ * @return     1: PHY test is enable; 0: PHY test is disable
+ */
+bool       blc_phy_isPhyTestEnable(void);
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    /**
+     * @brief      uart RX data process for PHY test 2 wire UART mode
+     * @param      none
+     * @return     always 0
+     */
+    int      blc_phyTest_2wire_rxUartCb (void);
+
+
+    /**
+     * @brief      uart TX data process for PHY test 2 wire UART mode
+     * @param      none
+     * @return     always 0
+     */
+    int      blc_phyTest_2wire_txUartCb (void);
+
+
+    /**
+     * @brief      uart RX data process for PHY test hci UART mode
+     * @param      none
+     * @return     always 0
+     */
+    int blc_phyTest_hci_rxUartCb (void);
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    /**
+     * @brief      uart RX data process for PHY test 2 wire UART mode
+     * @param      none
+     * @return     always 0
+     */
+    int      phy_test_2_wire_rx_from_uart (void);
+
+
+    /**
+     * @brief      uart TX data process for PHY test 2 wire UART mode
+     * @param      none
+     * @return     always 0
+     */
+    int      phy_test_2_wire_tx_to_uart (void);
+#endif
+
+
+
+
+#endif /* PHY_TEST_H_ */
diff --git a/stack/ble/crypt/aes/aes_att.h b/stack/ble/crypt/aes/aes_att.h
deleted file mode 100644
index 54357f4..0000000
--- a/stack/ble/crypt/aes/aes_att.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/******************************************************************************
- * @file     aes_att.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#ifndef _AES_H_
-#define _AES_H_
-
-typedef unsigned char           word8;
-typedef unsigned short          word16;
-typedef unsigned long           word32;
-
-static const word8 aes_sw_S[256] =
-{
-/*   0 -- */0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
-/*  16 -- */0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
-/*  32 -- */0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
-/*  48 -- */0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
-/*  64 -- */0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
-/*  80 -- */0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
-/*  96 -- */0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
-/* 112 -- */0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
-/* 128 -- */0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
-/* 144 -- */0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
-/* 160 -- */0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
-/* 176 -- */0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
-/* 192 -- */0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
-/* 208 -- */0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
-/* 224 -- */0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
-/* 240 -- */0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16,
-};
-
-
-static const word8 aes_sw_Si[256] =
-{
-/*   0 -- */0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
-/*  16 -- */0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
-/*  32 -- */0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
-/*  48 -- */0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
-/*  64 -- */0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
-/*  80 -- */0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
-/*  96 -- */0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
-/* 112 -- */0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
-/* 128 -- */0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
-/* 144 -- */0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
-/* 160 -- */0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
-/* 176 -- */0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
-/* 192 -- */0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
-/* 208 -- */0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
-/* 224 -- */0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
-/* 240 -- */0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D,
-};
-
-static const word8 aes_sw_rcon[30] = {
-  0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
-  0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f,
-  0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4,
-  0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91
-};
-
-void _rijndaelSetKey (unsigned char *k);
-void _rijndaelEncrypt(unsigned char *a);
-void _rijndaelDecrypt (unsigned char *a);
-
-
-
-void tn_aes_128(unsigned char *key, unsigned char *plaintext, unsigned char *result);
-
-
-#endif
diff --git a/stack/ble/crypt/aes_ccm.h b/stack/ble/crypt/aes_ccm.h
deleted file mode 100644
index ce5fb3a..0000000
--- a/stack/ble/crypt/aes_ccm.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/******************************************************************************
- * @file     aes_ccm.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#pragma  once
-
-#include <stack/ble/ll/ll.h>
-
-#define AES_BLOCK_SIZE     16
-
-
-//#define        SUCCESS            0
-enum {
-    AES_SUCC = SUCCESS,
-    AES_NO_BUF,
-    AES_FAIL,
-};
-
-
-struct CCM_FLAGS_TAG {
-    union {
-        struct {
-            u8 L : 3;
-            u8 M : 3;
-            u8 aData :1;
-            u8 reserved :1;
-        } bf;
-        u8 val;
-    };
-};
-
-typedef struct CCM_FLAGS_TAG ccm_flags_t;
-
-
-typedef struct {
-    union {
-        u8 A[AES_BLOCK_SIZE];
-        u8 B[AES_BLOCK_SIZE];
-    } bf;
-
-    u8 tmpResult[AES_BLOCK_SIZE];
-    u8 newAstr[AES_BLOCK_SIZE];
-} aes_enc_t;
-
-u8 aes_ccmAuthTran(u8 micLen, u8 *key, u8 *iv, u8 *mStr, u16 mStrLen, u8 *aStr, u16 aStrLen, u8 *result);
-u8 aes_ccmDecAuthTran(u8 micLen, u8 *key, u8 *iv, u8 *mStr, u16 mStrLen, u8 *aStr, u8 aStrLen, u8 *mic);
-u8 aes_initKey(u8 *key);
-u8 tl_aes_encrypt(u8 *key, u8 *data, u8 *result);
-
-u8 aes_ccm_encryption(u8 *key, u8 *iv, u8 *aStr, u8 *mic, u8 mStrLen, u8 *mStr, u8 *result);
-u8 aes_ccm_decryption(u8 *key, u8 *iv, u8 *aStr, u8 *mic, u8 mStrLen, u8 *mStr, u8 *result);
-void aes_ecb_encryption(u8 *key, u8 *plaintext, u8 *encrypted_data);
-void aes_ecb_decryption(u8 *key, u8 *encrypted_data, u8 *decrypted_data);
-void aes_ll_encryption(u8 *key, u8 *plaintext, u8 *result);
-void aes_ll_decryption(u8 *key, u8 *plaintext, u8 *result);
-void aes_ll_ccm_encryption_init (u8 *ltk, u8 *skdm, u8 *skds, u8 *ivm, u8 *ivs, ble_crypt_para_t *pd);
-void aes_ll_ccm_encryption(u8 *pkt, int master, ble_crypt_para_t *pd);
-int aes_ll_ccm_decryption(u8 *pkt, int master, ble_crypt_para_t *pd);        //OK return 0
-u8 aes_att_encryption_packet(u8 *key, u8 *iv, u8 *mic, u8 mic_len, u8 *ps, u8 len);
-u8 aes_att_decryption_packet(u8 *key, u8 *iv, u8 *mic, u8 mic_len, u8 *ps, u8 len);
-
-void aes_ll_c1(u8 * key, u8 * r, u8 *p1, u8 *p2, u8 * result);
-void aes_ll_s1(u8 * key, u8 * r1, u8 * r2, u8 * result);
-
diff --git a/stack/ble/crypt/le_crypto.h b/stack/ble/crypt/le_crypto.h
deleted file mode 100644
index 756efd5..0000000
--- a/stack/ble/crypt/le_crypto.h
+++ /dev/null
@@ -1,138 +0,0 @@
-/******************************************************************************
- * @file     le_crypto.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef TN_DTLS_H
-#define TN_DTLS_H
-
-#define        biL            32
-
-#define BITS_TO_LIMBS(i)  ( (i) / 32 + ( (i) % 32 != 0 ) )
-
-
-
-#define TNDTLS_ERR_MPI_BAD_INPUT_DATA                    -0x0004  // Bad input parameters to function.
-#define TNDTLS_ERR_MPI_INVALID_CHARACTER                 -0x0006  // There is an invalid character in the digit string.
-#define TNDTLS_ERR_MPI_BUFFER_TOO_SMALL                  -0x0008  // The buffer is too small to write to.
-#define TNDTLS_ERR_MPI_NEGATIVE_VALUE                    -0x000A  // The input arguments are negative or result in illegal output.
-#define TNDTLS_ERR_MPI_DIVISION_BY_ZERO                  -0x000C  // The input argument for division is zero, which is not allowed.
-#define TNDTLS_ERR_MPI_NOT_ACCEPTABLE                    -0x000E  // The input arguments are not acceptable.
-
-
-typedef struct {
-    int    s;
-    int n;
-    unsigned int p[8];
-} tn_mpi;
-
-typedef struct {
-    int    s;
-    int n;
-    unsigned int p[16];
-} tn_mpi16;
-
-typedef struct
-{
-    tn_mpi X;
-    tn_mpi Y;
-    tn_mpi Z;
-} tn_ecp_point;
-
-typedef struct
-{
-    tn_ecp_point    X1X3;            // XsXc
-    tn_ecp_point    X2X4;            //
-    tn_ecp_point    GaGb;            // Peer's G
-    tn_mpi            m2m4;            // private key
-    tn_mpi            xcxs;            // key exchange
-    tn_mpi            s;                // passphrase
-} tn_ecjpake_context;
-
-extern const unsigned int tn_p256_nq[9];
-
-extern const unsigned int tn_p256_n[10];
-
-extern const unsigned int tn_p256_pq[9];
-
-extern const unsigned int tn_p256_pr[8];
-
-extern const unsigned int tn_p256_p[10];
-
-extern const tn_ecp_point    tn_t[16];
-
-extern const tn_ecp_point tn_p256_ecp_g;
-
-void tn_mpi_init( tn_mpi *X, int n);
-void tn_mpi_free( tn_mpi *X );
-int tn_mpi_copy( tn_mpi *X, const tn_mpi *Y );
-int tn_mpi_cmp_mpi( const tn_mpi *X, const tn_mpi *Y );
-void tn_mpi_modn_add (tn_mpi * px);
-void tn_mpi_modp_add (tn_mpi * px);
-void tn_mpi_modp_sub (tn_mpi * px);
-int tn_mpi_mul_mpi_modp( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_mul_int_modp( tn_mpi *X, const tn_mpi *A,  int n );
-int tn_mpi_add_mpi_modp( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_sub_mpi_modp( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_sub_mpi_modn( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_shift_l_modp( tn_mpi *X, int count );
-int tn_mpi_add_mpi( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_sub_mpi( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_cmp_int( tn_mpi *X, int z );
-int tn_mpi_lset( tn_mpi *X, int z );
-int tn_mpi_bitlen( const tn_mpi *X );
-int tn_mpi_get_bit( const tn_mpi *X, int pos );
-int tn_mpi_modp( tn_mpi *R, const tn_mpi *A);
-int tn_mpi_safe_cond_assign( tn_mpi *X, const tn_mpi *Y, unsigned char assign );
-int tn_mpi_inv_mod( tn_mpi *X, const tn_mpi *A );
-int tn_mpi_mul_mpi_modn( tn_mpi *X, const tn_mpi *A, const tn_mpi *B );
-int tn_mpi_neg_modn( tn_mpi *X );
-
-//////////////////////////////////////////////////////////////////////////////////
-int tn_ecp_copy( tn_ecp_point *P, const tn_ecp_point *Q );
-int tn_ecp_double_jac( tn_ecp_point *R, const tn_ecp_point *P );
-int tn_ecp_add_mixed( tn_ecp_point *R, const tn_ecp_point *P, const tn_ecp_point *Q );
-int tn_ecp_normalize_jac( tn_ecp_point *pt );
-int tn_ecp_mul(tn_ecp_point *R, const tn_mpi *m, const tn_ecp_point *P);
-int tn_ecp_muladd( tn_ecp_point *R, const tn_mpi *m, const tn_ecp_point *P, const tn_mpi *n, const tn_ecp_point *Q );
-
-extern void tn_ecp_gen_keypair (tn_mpi *d, tn_ecp_point *Q);
-extern void tn_p256_keypair (unsigned char *s, unsigned char *x, unsigned char *y);
-extern void tn_p256_dhkey (unsigned char *r, unsigned char *s, unsigned char * x, unsigned char *y);
-
-extern void tn_aes_128(unsigned char *key, unsigned char *plaintext, unsigned char *result);
-extern void tn_aes_cmac ( unsigned char *key, unsigned char *input, int length,
-                  unsigned char *mac );
-extern int tn_crypto_f4 (unsigned char *r, unsigned char u[32], unsigned char v[32], unsigned char x[16], unsigned char z);
-extern unsigned int tn_crypto_g2 (unsigned char u[32], unsigned char v[32], unsigned char x[16], unsigned char y[16]);
-extern int tn_crypto_f5 (unsigned char *mac, unsigned char *ltk, unsigned char w[32], unsigned char n1[16], unsigned char n2[16],
-                  unsigned char a1[7], unsigned char a2[7]);
-extern int tn_crypto_f6 (unsigned char *e, unsigned char w[16], unsigned char n1[16], unsigned char n2[16],
-                  unsigned char r[16], unsigned char iocap[3], unsigned char a1[7], unsigned char a2[7]);
-extern int tn_crypto_h6 (unsigned char *r, unsigned char key[16], unsigned char id[4]);
-
-extern int test_crypto_func ();
-extern int test_dhkey ();
-
-#endif
diff --git a/stack/ble/gap/gap_event.h b/stack/ble/gap/gap_event.h
deleted file mode 100644
index 766bb36..0000000
--- a/stack/ble/gap/gap_event.h
+++ /dev/null
@@ -1,259 +0,0 @@
-/******************************************************************************
- * @file     gap_event.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * gap_event.h
- *
- *  Created on: 2018-12-5
- *      Author: Administrator
- */
-
-#ifndef GAP_EVENT_H_
-#define GAP_EVENT_H_
-
-
-
-
-
-
-
-
-
-
-/*****************************************  SMP message sequence and event chart  *******************************************************
-
-                                                                                              GAP_SMP EVENT
-Situation 1:   SMP Standard Pair                                                                    |
-    Phase 1: Paring Feature Exchange                                                                |
-    Phase 2: Encryption( STK/LTK Generation )                                                       |
-    Phase 3: Key Distribution                                                                       |
-                                                                                                    |
-         Master                                                       Slave                         |
-            |                                                           |                           |
-            |                                                           |                           |
-    ________|___________________________________________________________|_______                    |
-    |                                                                           |                   |
-    |                           Establish LL connection                         |                   |
-    |___________________________________________________________________________|                   |
-            |                                                           |                           |
-            |                                                           |                           |
-            |              Phase 1: Paring Feature Exchange             |                           |
-     _______|___________________________________________________________|_______                    |
-    |       |                                                           |       |                   |
-    |       |                    (Optional)Security_Request             |       |                   |
-    |       |<----------------------------------------------------------|       |                   |
-    |       |                        Paring_Req                         |       |
-    |       |---------------------------------------------------------->|=======|=====>>>  GAP_EVT_SMP_PARING_BEAGIN
-    |       |                        Paring_Rsp                         |       |
-    |       |<----------------------------------------------------------|       |                   |
-    |       |                        .......                            |       |                   |
-    |_______|___________________________________________________________|_______|                   |
-            |                                                           |                           |
-            |                                                           |                           |
-            |                  Phase 2: Encryption                      |                           |
-     _______|___________________________________________________________|_______                    |
-    |       |                                                           |       |                   |
-    |       |                        LL_ENC_REQ                         |       |                   |
-    |       |---------------------------------------------------------->|       |                   |
-    |       |                        LL_ENC_RSP                         |       |                   |
-    |       |<----------------------------------------------------------|       |                   |
-    |       |                     LL_START_ENC_REQ                      |       |                   |
-    |       |<----------------------------------------------------------|       |                   |
-    |       |                     LL_START_ENC_RSP                      |       |                   |
-    |       |---------------------------------------------------------->|       |                   |
-    |       |                     LL_START_ENC_RSP                      |       |
-    |       |<----------------------------------------------------------|=======|=====>>>  GAP_EVT_SMP_CONN_ENCRYPTION_DONE(re_connect = SMP_STANDARD_PAIR)
-    |_______|___________________________________________________________|_______|
-            |                                                           |                           |
-            |                                                           |                           |
-            |              Phase 3: Key Distribution                    |                           |
-     _______|___________________________________________________________|_______                    |
-    |       |                                                           |       |                   |
-    |       |                      Key Distribution                     |       |                   |
-    |       |<----------------------------------------------------------|       |                   |
-    |       |                      Key Distribution                     |       |                   |
-    |       |<----------------------------------------------------------|       |                   |
-    |       |                           .......                         |       |                   |
-    |       |                                                           |       |                   |
-    |       |                      Key Distribution                     |       |                   |
-    |       |---------------------------------------------------------->|       |                   |
-    |       |                      Key Distribution                     |       |                   |
-    |       |---------------------------------------------------------->|       |                   |
-    |       |                           .......                         |       |                   |
-    |       |                                                           |       |
-    |       |                 All Key Distribution Finish               |=======|=====>>>  GAP_EVT_SMP_PARING_SUCCESS
-    |       |                                                           |=======|=====>>>  GAP_EVT_SMP_SECURITY_PROCESS_DONE(re_connect = SMP_STANDARD_PAIR)
-    |_______|___________________________________________________________|_______|
-                                                                                                    |
-                                                                                                    |
-                                                                                                    |
-                                                                                                    |
-Situation 2:   SMP Fast Connect                                                                     |
-    Only 1 Phase: Encryption                                                                        |
-                                                                                                    |
-          Master                                                      Slave                         |
-            |                                                           |                           |
-            |                                                           |                           |
-    ________|___________________________________________________________|_______                    |
-    |                                                                           |                   |
-    |                          Establish LL connection                          |                   |
-    |___________________________________________________________________________|                   |
-            |                                                           |                           |
-            |                                                           |                           |
-            |                  Phase 2: Encryption                      |                           |
-     _______|___________________________________________________________|_______                    |
-     |      |                                                           |       |                   |
-     |      |                        LL_ENC_REQ                         |       |                   |
-     |      |---------------------------------------------------------->|       |                   |
-     |      |                        LL_ENC_RSP                         |       |                   |
-     |      |<----------------------------------------------------------|       |                   |
-     |      |                     LL_START_ENC_REQ                      |       |                   |
-     |      |<----------------------------------------------------------|       |                   |
-     |      |                     LL_START_ENC_RSP                      |       |                   |
-     |      |---------------------------------------------------------->|       |                   |
-     |      |                     LL_START_ENC_RSP                      |       |                   |
-     |      |<----------------------------------------------------------|=======|=====>>>  GAP_EVT_SMP_CONN_ENCRYPTION_DONE (re_connect = SMP_FAST_CONNECT)
-     |      |                                                           |=======|=====>>>  GAP_EVT_SMP_SECURITY_PROCESS_DONE(re_connect = SMP_FAST_CONNECT)
-     |______|___________________________________________________________|_______|
-
-
- ***************************************************************************************************/
-
-
-
-#define GAP_EVT_SMP_PARING_BEAGIN                                     0    // Refer to SMP message sequence and event chart above
-#define GAP_EVT_SMP_PARING_SUCCESS                                    1    // Refer to SMP message sequence and event chart above
-#define GAP_EVT_SMP_PARING_FAIL                                       2
-#define GAP_EVT_SMP_CONN_ENCRYPTION_DONE                              3    // Refer to SMP message sequence and event chart above
-#define GAP_EVT_SMP_SECURITY_PROCESS_DONE                             4    // Refer to SMP message sequence and event chart above
-
-#define GAP_EVT_SMP_TK_DISPALY                                        8
-#define GAP_EVT_SMP_TK_REQUEST_PASSKEY                                9
-#define GAP_EVT_SMP_TK_REQUEST_OOB                                    10
-#define GAP_EVT_SMP_TK_NUMERIC_COMPARE                                11
-
-
-#define GAP_EVT_ATT_EXCHANGE_MTU                                      16
-#define GAP_EVT_GATT_HANDLE_VLAUE_CONFIRM                             17
-
-
-
-
-#define GAP_EVT_MASK_NONE                                             0x00000000
-#define GAP_EVT_MASK_SMP_PARING_BEAGIN                                (1<<GAP_EVT_SMP_PARING_BEAGIN)
-#define GAP_EVT_MASK_SMP_PARING_SUCCESS                               (1<<GAP_EVT_SMP_PARING_SUCCESS)
-#define GAP_EVT_MASK_SMP_PARING_FAIL                                  (1<<GAP_EVT_SMP_PARING_FAIL)
-#define GAP_EVT_MASK_SMP_CONN_ENCRYPTION_DONE                         (1<<GAP_EVT_SMP_CONN_ENCRYPTION_DONE)
-#define GAP_EVT_MASK_SMP_SECURITY_PROCESS_DONE                        (1<<GAP_EVT_SMP_SECURITY_PROCESS_DONE)
-
-#define GAP_EVT_MASK_SMP_TK_DISPALY                                   (1<<GAP_EVT_SMP_TK_DISPALY)
-#define GAP_EVT_MASK_SMP_TK_REQUEST_PASSKEY                           (1<<GAP_EVT_SMP_TK_REQUEST_PASSKEY)
-#define GAP_EVT_MASK_SMP_TK_REQUEST_OOB                               (1<<GAP_EVT_SMP_TK_REQUEST_OOB)
-#define GAP_EVT_MASK_SMP_TK_NUMERIC_COMPARE                           (1<<GAP_EVT_SMP_TK_NUMERIC_COMPARE)
-
-#define GAP_EVT_MASK_ATT_EXCHANGE_MTU                                 (1<<GAP_EVT_ATT_EXCHANGE_MTU)
-#define GAP_EVT_MASK_GATT_HANDLE_VLAUE_CONFIRM                        (1<<GAP_EVT_GATT_HANDLE_VLAUE_CONFIRM)
-
-
-#define GAP_EVT_MASK_DEFAULT                                        ( GAP_EVT_MASK_SMP_TK_DISPALY            | \
-                                                                      GAP_EVT_MASK_SMP_TK_REQUEST_PASSKEY    | \
-                                                                      GAP_EVT_MASK_SMP_TK_REQUEST_OOB        | \
-                                                                      GAP_EVT_MASK_ATT_EXCHANGE_MTU )
-
-
-
-
-
-typedef struct {
-    u16    connHandle;
-    u8    secure_conn;
-    u8    tk_method;
-} gap_smp_paringBeginEvt_t;
-
-
-typedef struct {
-    u16    connHandle;
-    u8    bonding;
-    u8    bonding_result;
-} gap_smp_paringSuccessEvt_t;
-
-typedef struct {
-    u16    connHandle;
-    u8    reason;
-} gap_smp_paringFailEvt_t;
-
-typedef struct {
-    u16    connHandle;
-    u8    re_connect;   //1: re_connect, encrypt with previous distributed LTK;   0: paring , encrypt with STK
-} gap_smp_connEncDoneEvt_t;
-
-typedef struct {
-    u16    connHandle;
-    u8    re_connect;   //1: re_connect, encrypt with previous distributed LTK;   0: paring , encrypt with STK
-} gap_smp_securityProcessDoneEvt_t;
-
-
-
-typedef struct {
-    u16    connHandle;
-    u32    tk_pincode;
-} gap_smp_TkDisplayEvt_t;
-
-typedef struct {
-    u16    connHandle;
-} gap_smp_TkReqPassKeyEvt_t;
-
-typedef struct {
-    u16    connHandle;
-    u16    peer_MTU;
-    u16    effective_MTU;
-} gap_gatt_mtuSizeExchangeEvt_t;
-
-
-
-
-extern u32        gap_eventMask;
-
-
-
-typedef int (*gap_event_handler_t) (u32 h, u8 *para, int n);
-
-
-/******************************* User Interface  ******************************************/
-void     blc_gap_setEventMask(u32 evtMask);
-
-void     blc_gap_registerHostEventHandler (gap_event_handler_t  handler);
-
-
-
-
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-int blc_gap_send_event (u32 h, u8 *para, int n);
-
-
-#endif /* GAP_EVENT_H_ */
diff --git a/stack/ble/hci/hci.h b/stack/ble/hci/hci.h
index 08fd8a0..ff6e23a 100644
--- a/stack/ble/hci/hci.h
+++ b/stack/ble/hci/hci.h
@@ -33,7 +33,6 @@
 typedef int (*blc_hci_handler_t) (unsigned char *p, int n);
 typedef int (*blc_hci_app_handler_t) (unsigned char *p);
 
-extern blc_hci_handler_t            blc_master_handler;
 
 
 #define            HCI_FLAG_EVENT_PHYTEST_2_WIRE_UART           (1<<23)
@@ -58,39 +57,221 @@
 
 
 
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    extern  my_fifo_t    hci_tx_iso_fifo;
+
+    typedef    struct {
+        u32        size;
+        u8        num;
+        u8        mask;
+        u8        wptr;
+        u8        rptr;
+        u8*        p;
+    }hci_fifo_t;
+
+    u8*  hci_fifo_wptr (hci_fifo_t *f);
+    u8*  hci_fifo_wptr_v2 (hci_fifo_t *f);
+    u8*  hci_fifo_get (hci_fifo_t *f);
+    void hci_fifo_pop (hci_fifo_t *f);
+    void hci_fifo_next (hci_fifo_t *f);
+#endif
+
+/**
+ *  @brief  Definition for HCI packet type & HCI packet indicator
+ */
+typedef enum{
+    HCI_TYPE_CMD         = 0x01,
+    HCI_TYPE_ACL_DATA    = 0x02,
+    HCI_TYPE_SCO_DATA    = 0x03,
+    HCI_TYPE_EVENT      = 0x04,
+    HCI_TYPE_ISO_DATA     = 0x05,  //core_5.2
+} hci_type_t;
+
+
+/**
+ *  @brief  Definition for HCI ACL Data packets Packet_Boundary_Flag
+ */
+typedef enum{
+    HCI_FIRST_NAF_PACKET          =        0x00,    //LE Host to Controller
+    HCI_CONTINUING_PACKET         =        0x01,    //LE Host to Controller / Controller to Host
+    HCI_FIRST_AF_PACKET           =        0x02,    //LE                       Controller to Host
+} acl_pb_flag_t;
+
+
+
+
+/**
+ *  @brief  Definition for HCI ISO Data packets PB_Flag
+ */
+typedef enum{
+    HCI_ISO_SDU_FIRST_FRAG        =    0x00,    //The ISO_Data_Load field contains the first fragment of a fragmented SDU
+    HCI_ISO_SDU_CONTINUE_FRAG    =    0x01,    //The ISO_Data_Load field contains a continuation fragment of an SDU
+    HCI_ISO_SDU_COMPLETE        =    0x02,    //The ISO_Data_Load field contains a complete SDU
+    HCI_ISO_SDU_LAST_FRAG        =    0x03,    //The ISO_Data_Load field contains the last fragment of an SDU.
+} iso_pb_flag_t;
+
+
+
+/**
+ *  @brief  Definition for HCI ISO Data packets Packet_Status_Flag
+ */
+typedef enum{
+    HCI_ISO_VALID_DATA                =    0x00, //Valid data. The complete ISO_SDU was received correctly
+    HCI_ISO_POSSIBLE_VALID_DATA        =    0x01, //Possibly invalid data
+    HCI_ISO_LOST_DATA                =    0x02, //Part(s) of the ISO_SDU were not received correctly. This is reported as "lost data"
+} iso_ps_flag_t;
+
+
+
+
+
+
+
 
 // hci event
 extern u32        hci_eventMask;
 extern u32        hci_le_eventMask;
-ble_sts_t         blc_hci_setEventMask_cmd(u32 evtMask);      //eventMask: BT/EDR
-ble_sts_t         blc_hci_le_setEventMask_cmd(u32 evtMask);       //eventMask: LE event  0~31
-ble_sts_t         blc_hci_le_setEventMask_2_cmd(u32 evtMask_2);   //eventMask: LE event 32~63
+extern u32        hci_le_eventMask_2;
+
+
 
 // Controller event handler
+/**
+ * @brief    this function is used to register HCI Event handler Callback function
+ */
 typedef int (*hci_event_handler_t) (u32 h, u8 *para, int n);
 extern hci_event_handler_t        blc_hci_event_handler;
-void     blc_hci_registerControllerEventHandler (hci_event_handler_t  handler);
 
 
-int         blc_hci_sendACLData2Host (u16 handle, u8 *p);
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    int     blc_acl_from_btusb ();
+    int     blc_hci_tx_to_btusb (void);
+#endif
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    /**
+     * @brief      for user to initialize HCI TX FIFO.
+     * @param[in]  pRxbuf - TX FIFO buffer address.
+     * @param[in]  fifo_size - RX FIFO size
+     * @param[in]  fifo_number - RX FIFO number, can only be 4, 8, 16 or 32
+     * @return     status, 0x00:  succeed
+     *                        other: failed
+     */
+    ble_sts_t     blc_ll_initHciTxFifo(u8 *pTxbuf, int fifo_size, int fifo_number);
+
+    /**
+     * @brief      for user to initialize HCI RX FIFO.
+     * @param[in]  pRxbuf - RX FIFO buffer address.
+     * @param[in]  fifo_size - RX FIFO size
+     * @param[in]  fifo_number - RX FIFO number, can only be 4, 8, 16 or 32
+     * @return     status, 0x00:  succeed
+     *                        other: failed
+     */
+    ble_sts_t     blc_ll_initHciRxFifo(u8 *pRxbuf, int fifo_size, int fifo_number);
+#endif
 
 
 
-int blc_hci_send_data (u32 h, u8 *para, int n);
-void blc_enable_hci_master_handler ();
+/******************************* Stack Interface Begin, user can not use!!! ********************************************/
 
-
-
-
-int blc_acl_from_btusb ();
-
-void blc_register_hci_handler (void *prx, void *ptx);
+/**
+ * @brief      this function is used to get data by USB in RX mode for HCI Layer
+ * @param[in]  none.
+ * @return     0
+ */
 int blc_hci_rx_from_usb (void);
-int blc_hci_tx_to_usb (void);
-int blc_hci_tx_to_btusb (void);
 
+/**
+ * @brief      this function is used to send data by USB in TX mode for HCI Layer
+ * @param[in]  none.
+ * @return     0
+ */
+int blc_hci_tx_to_usb (void);
+
+
+/**
+ * @brief      this function is used to process HCI data
+ * @param[in]  *p - the pointer of HCI data
+ * @param[in]  n - the length of HCI data
+ * @return     0
+ */
 int blc_hci_handler (u8 *p, int n);
-int blm_hci_handler (u8 *p, int n);
+
+/**
+ * @brief      this function is used to report HCI events
+ * @param[in]  h - HCI Event type
+ * @param[in]  *para - data pointer of event
+ * @param[in]  n - data length of event
+ * @return     none
+ */
 int blc_hci_send_event (u32 h, u8 *para, int n);
 
+/**
+ * @brief      this function is used to process HCI events
+ * @param[in]  none.
+ * @return     0
+ */
 int blc_hci_proc (void);
+
+/******************************* Stack Interface End *******************************************************************/
+
+
+
+
+
+
+
+/******************************* User Interface  Begin *****************************************************************/
+/**
+ * @brief      this function is used to set HCI EVENT mask
+ * @param[in]  evtMask  -  HCI EVENT mask
+ * @return     0
+ */
+ble_sts_t    blc_hci_setEventMask_cmd(u32 evtMask);      //eventMask: BT/EDR
+
+/**
+ * @brief      this function is used to set HCI LE EVENT mask
+ * @param[in]  evtMask  -  HCI LE EVENT mask(BIT<0-31>)
+ * @return     0
+ */
+ble_sts_t    blc_hci_le_setEventMask_cmd(u32 evtMask);   //eventMask: LE event  0~31
+
+/**
+ * @brief      this function is used to set HCI LE EVENT mask
+ * @param[in]  evtMask  -  HCI LE EVENT mask(BIT<32-63>)
+ * @return     0
+ */
+ble_sts_t     blc_hci_le_setEventMask_2_cmd(u32 evtMask_2);   //eventMask: LE event 32~63
+
+/**
+ * @brief      this function is used to register HCI event handler callback function
+ * @param[in]  handler - hci_event_handler_t
+ * @return     none.
+ */
+void         blc_hci_registerControllerEventHandler (hci_event_handler_t  handler);
+
+/**
+ * @brief      this function is used to register HCI TX or RX handler callback function
+ * @param[in]  *prx - blc_hci_rx_handler
+ * @param[in]  *ptx - blc_hci_tx_handler
+ * @return     none.
+ */
+void         blc_register_hci_handler (void *prx, void *ptx);
+
+/**
+ * @brief      this function is used to send ACL data to HOST
+ * @param[in]  handle - connect handle
+ * @param[in]  *p - the pointer of l2cap data
+ * @return     0
+ */
+int         blc_hci_sendACLData2Host (u16 handle, u8 *p);
+
+/**
+ * @brief      this function is used to send data
+ * @param[in]  h - HCI Event type
+ * @param[in]  *para - data pointer of event
+ * @param[in]  n - data length of event
+ * @return     0,-1
+ */
+int         blc_hci_send_data (u32 h, u8 *para, int n);
+/******************************* User Interface  End  ******************************************************************/
diff --git a/stack/ble/hci/hci_cmd.h b/stack/ble/hci/hci_cmd.h
index 5e9c7ae..2a0f346 100644
--- a/stack/ble/hci/hci_cmd.h
+++ b/stack/ble/hci/hci_cmd.h
@@ -23,30 +23,134 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-
 #ifndef HCI_CMD_H_
 #define HCI_CMD_H_
 
 
-
+#include "stack/ble/ble_format.h"
 
 
 /**
- *  @brief  Command Parameters for "HCI LE Set Advertising Parameters Command"
+ *  @brief  Command Parameters for "7.8.5 LE Set Advertising Parameters command"
  */
-// Advertising Parameters structure
+/* Advertising Parameters structure */
 typedef struct {
     u16 intervalMin;      // Minimum advertising interval for non-directed advertising, time = N * 0.625ms
     u16 intervalMax;      // Maximum advertising interval for non-directed advertising, time = N * 0.625ms
     u8  advType;          // Advertising
     u8  ownAddrType;
     u8  peerAddrType;
-    u8  peerAddr[BLE_ADDR_LEN];
+    u8  peerAddr[6];//BLE_ADDR_LEN];
     u8  advChannelMap;
     u8  advFilterPolicy;
 } adv_para_t;
 
 
+/* Advertising_Interval, Time = N * 0.625 ms,
+ * Notice that these are just part of but not all Advertising_Interval value */
+typedef enum{
+    ADV_INTERVAL_3_125MS     =                   5,
+    ADV_INTERVAL_3_75MS      =                   6,
+    ADV_INTERVAL_10MS        =                   16,
+    ADV_INTERVAL_15MS        =                   24,
+    ADV_INTERVAL_20MS        =                   32,
+    ADV_INTERVAL_25MS        =                   40,
+    ADV_INTERVAL_30MS        =                   48,
+    ADV_INTERVAL_35MS        =                   56,
+    ADV_INTERVAL_40MS        =                   64,
+    ADV_INTERVAL_45MS        =                   72,
+    ADV_INTERVAL_50MS        =                   80,
+    ADV_INTERVAL_55MS         =                   88,
+    ADV_INTERVAL_60MS        =                   96,
+    ADV_INTERVAL_70MS        =                   112,
+    ADV_INTERVAL_80MS        =                   128,
+    ADV_INTERVAL_90MS         =                     144,
+    ADV_INTERVAL_100MS       =                   160,
+    ADV_INTERVAL_150MS       =                   240,
+    ADV_INTERVAL_105MS          =                   168,
+    ADV_INTERVAL_200MS       =                   320,
+    ADV_INTERVAL_205MS         =                   328,
+    ADV_INTERVAL_250MS       =                   400,
+    ADV_INTERVAL_300MS       =                   480,
+    ADV_INTERVAL_305MS       =                   488,
+    ADV_INTERVAL_350MS       =                   560,
+    ADV_INTERVAL_400MS       =                   640,
+    ADV_INTERVAL_405MS       =                   648,
+    ADV_INTERVAL_450MS       =                   720,
+    ADV_INTERVAL_500MS       =                   800,
+    ADV_INTERVAL_505MS       =                   808,
+    ADV_INTERVAL_600MS       =                   960,
+    ADV_INTERVAL_700MS       =                  1120,
+    ADV_INTERVAL_800MS       =                  1280,
+    ADV_INTERVAL_900MS       =                  1440,
+    ADV_INTERVAL_1S          =                    1600,
+    ADV_INTERVAL_1S5         =                     2400,
+    ADV_INTERVAL_2S          =                    3200,
+    ADV_INTERVAL_1_28_S      =                  2048,
+    ADV_INTERVAL_10_24S      =                 16384,
+}adv_inter_t;
+
+/* Periodic_adv_Interval, Time = N * 1.25 ms,
+ * Notice that these are just part of but not all Periodic_adv_Interval value */
+typedef enum{
+    PERADV_INTERVAL_7P5MS              =            6,
+    PERADV_INTERVAL_8P75MS             =            7,
+    PERADV_INTERVAL_10MS               =            8,
+    PERADV_INTERVAL_11P25MS            =            9,
+    PERADV_INTERVAL_12P5MS             =            10,
+    PERADV_INTERVAL_13P75MS            =            11,
+    PERADV_INTERVAL_15MS               =            12,
+    PERADV_INTERVAL_16P25MS            =            13,
+    PERADV_INTERVAL_17P5MS             =            14,
+    PERADV_INTERVAL_18P75MS            =            15,
+    PERADV_INTERVAL_20MS               =            16,
+    PERADV_INTERVAL_21P25MS            =            17,
+    PERADV_INTERVAL_22P5MS             =            18,
+    PERADV_INTERVAL_23P75MS            =            19,
+    PERADV_INTERVAL_25MS               =            20,
+    PERADV_INTERVAL_26P25MS            =            21,
+    PERADV_INTERVAL_27P5MS             =            22,
+    PERADV_INTERVAL_28P75MS            =            23,
+    PERADV_INTERVAL_30MS               =            24,
+    PERADV_INTERVAL_31P25MS            =            25,
+    PERADV_INTERVAL_32P5MS             =            26,
+    PERADV_INTERVAL_33P75MS            =            27,
+    PERADV_INTERVAL_35MS                  =            28,
+    PERADV_INTERVAL_36P25MS            =            29,
+    PERADV_INTERVAL_37P5MS             =            30,
+    PERADV_INTERVAL_38P75MS            =            31,
+    PERADV_INTERVAL_40MS               =            32,
+    PERADV_INTERVAL_41P25MS            =            33,
+    PERADV_INTERVAL_42P5MS             =            34,
+    PERADV_INTERVAL_43P75MS            =            35,
+    PERADV_INTERVAL_45MS               =            36,
+    PERADV_INTERVAL_46P25MS            =            37,
+    PERADV_INTERVAL_47P5MS             =            38,
+    PERADV_INTERVAL_48P75MS            =            39,
+    PERADV_INTERVAL_50MS               =            40,
+    PERADV_INTERVAL_55MS               =            44,
+    PERADV_INTERVAL_60MS               =            48,
+    PERADV_INTERVAL_62P5MS             =            50,
+    PERADV_INTERVAL_65MS               =            52,
+    PERADV_INTERVAL_70MS               =            56,
+    PERADV_INTERVAL_75MS               =            60,
+    PERADV_INTERVAL_80MS               =            64,
+    PERADV_INTERVAL_85MS               =            68,
+    PERADV_INTERVAL_90MS               =            72,
+    PERADV_INTERVAL_95MS               =            78,
+    PERADV_INTERVAL_100MS              =            80,
+    PERADV_INTERVAL_110MS              =            88,
+    PERADV_INTERVAL_120MS              =            96,
+    PERADV_INTERVAL_130MS              =            104,
+    PERADV_INTERVAL_140MS              =            112,
+    PERADV_INTERVAL_150MS              =            120,
+    PERADV_INTERVAL_180MS              =            144,
+    PERADV_INTERVAL_200MS              =            160,
+    PERADV_INTERVAL_250MS              =            200,
+    PERADV_INTERVAL_300MS              =            240,
+    PERADV_INTERVAL_320MS              =            256,
+}periodic_adv_inter_t;
+
 /* Advertisement Type */
 typedef enum{
   ADV_TYPE_CONNECTABLE_UNDIRECTED             = 0x00,  // ADV_IND
@@ -64,45 +168,128 @@
     OWN_ADDRESS_RESOLVE_PRIVATE_RANDOM = 3,
 }own_addr_type_t;
 
-
+/* Advertising_Channel_Map */
 typedef enum{
     BLT_ENABLE_ADV_37    =        BIT(0),
     BLT_ENABLE_ADV_38    =        BIT(1),
     BLT_ENABLE_ADV_39    =        BIT(2),
-    BLT_ENABLE_ADV_ALL   =        (BLT_ENABLE_ADV_37 | BLT_ENABLE_ADV_38 | BLT_ENABLE_ADV_39),
+    BLT_ENABLE_ADV_ALL    =        (BLT_ENABLE_ADV_37 | BLT_ENABLE_ADV_38 | BLT_ENABLE_ADV_39),
 }adv_chn_map_t;
 
+/* Advertising_Filter_Policy */
+typedef enum {
+    ADV_FP_ALLOW_SCAN_ANY_ALLOW_CONN_ANY        =        0x00,  // Process scan and connection requests from all devices
+    ADV_FP_ALLOW_SCAN_WL_ALLOW_CONN_ANY         =        0x01,  // Process connection requests from all devices and only scan requests from devices that are in the White List.
+    ADV_FP_ALLOW_SCAN_ANY_ALLOW_CONN_WL         =        0x02,  // Process scan requests from all devices and only connection requests from devices that are in the White List..
+    ADV_FP_ALLOW_SCAN_WL_ALLOW_CONN_WL          =        0x03,  // Process scan and connection requests only from devices in the White List.
+
+    ADV_FP_NONE                                    =        ADV_FP_ALLOW_SCAN_ANY_ALLOW_CONN_ANY, //adv filter policy set to zero, not use whitelist
+} adv_fp_type_t;  //adv_filterPolicy_type_t
+
+
+#define     ALLOW_SCAN_WL                                BIT(0)
+#define     ALLOW_CONN_WL                                BIT(1)
+
 
 
 
 /**
- *  @brief  Command Parameters for "HCI LE Set Advertise Enable Command"
+ *  @brief  Command Parameters for "7.8.9 LE Set Advertising Enable command"
  */
 typedef enum {
     BLC_ADV_DISABLE = 0x00,
     BLC_ADV_ENABLE  = 0x01,
-} adv_en_t;
+} ll_adv_en_t;
+
+
 
 
 /**
- *  @brief  Command Parameters for "HCI LE Set Scan Parameters Command"
+ *  @brief  Command Parameters for "7.8.10 LE Set Scan Parameters command"
  */
 typedef enum {
     SCAN_TYPE_PASSIVE = 0x00,
     SCAN_TYPE_ACTIVE  = 0x01,
 } scan_type_t;
 
+
+/* Scannning_Interval, Time = N * 0.625 ms,
+ * Notice that these are just part of but not all Scannning_Interval value */
+typedef enum{
+    SCAN_INTERVAL_10MS              =            16,
+    SCAN_INTERVAL_20MS              =            32,
+    SCAN_INTERVAL_30MS              =            48,
+    SCAN_INTERVAL_40MS              =            64,
+    SCAN_INTERVAL_50MS              =            80,
+    SCAN_INTERVAL_60MS              =            96,
+    SCAN_INTERVAL_70MS              =            112,
+    SCAN_INTERVAL_80MS              =            128,
+    SCAN_INTERVAL_90MS              =            144,
+    SCAN_INTERVAL_100MS             =            160,
+    SCAN_INTERVAL_150MS             =            240,
+    SCAN_INTERVAL_200MS             =            320,
+    SCAN_INTERVAL_250MS             =            400,
+    SCAN_INTERVAL_300MS             =            480,
+    SCAN_INTERVAL_350MS             =            560,
+    SCAN_INTERVAL_400MS             =            640,
+    SCAN_INTERVAL_450MS             =            720,
+    SCAN_INTERVAL_500MS             =            800,
+    SCAN_INTERVAL_600MS             =            960,
+    SCAN_INTERVAL_700MS             =            1120,
+    SCAN_INTERVAL_800MS             =            1280,
+    SCAN_INTERVAL_900MS             =            1440,
+    SCAN_INTERVAL_1000MS            =            1600,
+}scan_inter_t;
+
+/* Scannning_Window, Time = N * 0.625 ms,
+ * Notice that these are just part of but not all Scannning_Window value */
+typedef enum{
+    SCAN_WINDOW_10MS                =            16,
+    SCAN_WINDOW_20MS                =            32,
+    SCAN_WINDOW_30MS                =            48,
+    SCAN_WINDOW_40MS                =            64,
+    SCAN_WINDOW_50MS                =            80,
+    SCAN_WINDOW_60MS                =            96,
+    SCAN_WINDOW_70MS                =            112,
+    SCAN_WINDOW_80MS                =            128,
+    SCAN_WINDOW_90MS                =            144,
+    SCAN_WINDOW_100MS               =            160,
+    SCAN_WINDOW_150MS               =            240,
+    SCAN_WINDOW_200MS               =            320,
+    SCAN_WINDOW_250MS               =            400,
+    SCAN_WINDOW_300MS               =            480,
+    SCAN_WINDOW_350MS               =            560,
+    SCAN_WINDOW_400MS               =            640,
+    SCAN_WINDOW_450MS               =            720,
+    SCAN_WINDOW_500MS               =            800,
+    SCAN_WINDOW_600MS               =            960,
+    SCAN_WINDOW_700MS               =            1120,
+    SCAN_WINDOW_800MS               =            1280,
+    SCAN_WINDOW_900MS               =            1440,
+    SCAN_WINDOW_1000MS              =            1600,
+}scan_wind_t;
+
+/* Scanning_Filter_Policy */
+typedef enum {
+    SCAN_FP_ALLOW_ADV_ANY                        =        0x00,  //except direct adv address not match
+    SCAN_FP_ALLOW_ADV_WL                        =        0x01,  //except direct adv address not match
+    SCAN_FP_ALLOW_UNDIRECT_ADV                  =        0x02,  //and direct adv address match initiator's resolvable private MAC
+    SCAN_FP_ALLOW_ADV_WL_DIRECT_ADV_MACTH        =        0x03,  //and direct adv address match initiator's resolvable private MAC
+
+} scan_fp_type_t;
+
+
+
 /**
- *  @brief  Command Parameters for "HCI LE Set Scan Enable Command"
+ *  @brief  Command Parameters for "7.8.11 LE Set Scan Enable command"
  */
-//scan_enable_t
+/* LE_Scan_Enable */
 typedef enum {
     BLC_SCAN_DISABLE = 0x00,
     BLC_SCAN_ENABLE  = 0x01,
 } scan_en_t;
 
-
-//duplicate_filter_enable_t
+/* Filter_Duplicates */
 typedef enum {
     DUP_FILTER_DISABLE = 0x00,
     DUP_FILTER_ENABLE  = 0x01,
@@ -111,8 +298,260 @@
 
 
 
+/**
+ *  @brief  Command Parameters for "7.8.12 LE Create Connection command"
+ */
+
+/* Initiator_Filter_Policy */
+typedef enum {
+    INITIATE_FP_ADV_SPECIFY                        =        0x00,  //connect ADV specified by host
+    INITIATE_FP_ADV_WL                             =        0x01,  //connect ADV in whiteList
+
+} init_fp_type_t;   //init_filterPolicy_type_t
+
+/* Connection_Interval, Time = N * 1.25 ms,
+ * Notice that these are just part of but not all Connection_Interval value */
+typedef enum{
+    CONN_INTERVAL_7P5MS              =            6,
+    CONN_INTERVAL_8P75MS             =            7,
+    CONN_INTERVAL_10MS               =            8,
+    CONN_INTERVAL_11P25MS            =            9,
+    CONN_INTERVAL_12P5MS             =            10,
+    CONN_INTERVAL_13P75MS            =            11,
+    CONN_INTERVAL_15MS               =            12,
+    CONN_INTERVAL_16P25MS            =            13,
+    CONN_INTERVAL_17P5MS             =            14,
+    CONN_INTERVAL_18P75MS            =            15,
+    CONN_INTERVAL_20MS               =            16,
+    CONN_INTERVAL_21P25MS            =            17,
+    CONN_INTERVAL_22P5MS             =            18,
+    CONN_INTERVAL_23P75MS            =            19,
+    CONN_INTERVAL_25MS               =            20,
+    CONN_INTERVAL_26P25MS            =            21,
+    CONN_INTERVAL_27P5MS             =            22,
+    CONN_INTERVAL_28P75MS            =            23,
+    CONN_INTERVAL_30MS               =            24,
+    CONN_INTERVAL_31P25MS            =            25,
+    CONN_INTERVAL_32P5MS             =            26,
+    CONN_INTERVAL_33P75MS            =            27,
+    CONN_INTERVAL_35MS                  =            28,
+    CONN_INTERVAL_36P25MS            =            29,
+    CONN_INTERVAL_37P5MS             =            30,
+    CONN_INTERVAL_38P75MS            =            31,
+    CONN_INTERVAL_40MS               =            32,
+    CONN_INTERVAL_41P25MS            =            33,
+    CONN_INTERVAL_42P5MS             =            34,
+    CONN_INTERVAL_43P75MS            =            35,
+    CONN_INTERVAL_45MS               =            36,
+    CONN_INTERVAL_46P25MS            =            37,
+    CONN_INTERVAL_47P5MS             =            38,
+    CONN_INTERVAL_48P75MS            =            39,
+    CONN_INTERVAL_50MS               =            40,
+    CONN_INTERVAL_55MS               =            44,
+    CONN_INTERVAL_60MS               =            48,
+    CONN_INTERVAL_62P5MS             =            50,
+    CONN_INTERVAL_65MS               =            52,
+    CONN_INTERVAL_70MS               =            56,
+    CONN_INTERVAL_75MS               =            60,
+    CONN_INTERVAL_80MS               =            64,
+    CONN_INTERVAL_85MS               =            68,
+    CONN_INTERVAL_90MS               =            72,
+    CONN_INTERVAL_95MS               =            78,
+    CONN_INTERVAL_100MS              =            80,
+    CONN_INTERVAL_110MS              =            88,
+    CONN_INTERVAL_120MS              =            96,
+    CONN_INTERVAL_130MS              =            104,
+    CONN_INTERVAL_140MS              =            112,
+    CONN_INTERVAL_150MS              =            120,
+    CONN_INTERVAL_180MS              =            144,
+    CONN_INTERVAL_200MS              =            160,
+    CONN_INTERVAL_250MS              =            200,
+    CONN_INTERVAL_300MS              =            240,
+    CONN_INTERVAL_320MS              =            256,
+}conn_inter_t;
 
 
+/* Supervision_Timeout, Time = N * 10 ms,
+ * Notice that these are just part of but not all Supervision_Timeout value */
+typedef enum{
+    CONN_TIMEOUT_500MS                 =              50,
+    CONN_TIMEOUT_1S                     =               100,
+    CONN_TIMEOUT_1S5                 =               150,
+    CONN_TIMEOUT_2S                     =               200,
+    CONN_TIMEOUT_2S5                 =               250,
+    CONN_TIMEOUT_3S                     =               300,
+    CONN_TIMEOUT_3S5                 =               350,
+    CONN_TIMEOUT_4S                     =               400,
+    CONN_TIMEOUT_4S5                 =               450,
+    CONN_TIMEOUT_5S                     =               500,
+    CONN_TIMEOUT_6S                     =               600,
+    CONN_TIMEOUT_7S                     =               700,
+    CONN_TIMEOUT_8S                     =               800,
+    CONN_TIMEOUT_9S                     =               900,
+    CONN_TIMEOUT_10S                 =              1000,
+    CONN_TIMEOUT_15S                 =              1500,
+    CONN_TIMEOUT_20S                 =              2000,
+}conn_tm_t;
+
+
+
+
+
+
+
+/**
+ *  @brief  Return Parameters for "7.8.46 LE Read Maximum Data Length command"
+ */
+typedef struct {
+    u8         status;
+    u16        support_max_tx_oct;
+    u16        support_max_tx_time;
+    u16        support_max_rx_oct;
+    u16        support_max_rx_time;
+} hci_le_readMaxDataLengthCmd_retParam_t;
+
+
+
+
+
+/**
+ *  @brief  Return Parameters for "7.8.47 LE Read PHY command"
+ */
+typedef struct {
+    u8         status;
+    u8         handle[2];
+    u8         tx_phy;
+    u8         rx_phy;
+} hci_le_readPhyCmd_retParam_t;
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.48 LE Set Default PHY command"
+ */
+
+
+/**
+ *  @brief  Command Parameters for "7.8.49 LE Set PHY command"
+ */
+
+typedef struct {
+    u16 connHandle;
+    u8     all_phys;
+    u8     tx_phys;
+    u8     rx_phys;
+    u16 phy_options;
+} hci_le_setPhyCmd_param_t;
+
+
+
+
+typedef enum {
+    BLE_PHY_1M             = 0x01,
+    BLE_PHY_2M             = 0x02,
+    BLE_PHY_CODED         = 0x03,
+} le_phy_type_t;
+
+typedef enum {
+    PHY_PREFER_1M         = BIT(0),
+    PHY_PREFER_2M        = BIT(1),
+    PHY_PREFER_CODED     = BIT(2),
+} le_phy_prefer_type_t;
+
+typedef enum {
+    PHY_TRX_PREFER        = 0,                    //has      preference among TX & RX PHYs
+    PHY_TX_NO_PREFER     = BIT(0),               //has no preference among TX PHYs
+    PHY_RX_NO_PREFER     = BIT(1),                //has no preference among RX PHYs
+    PHY_TRX_NO_PREFER     = (BIT(0) | BIT(1)),    //has no preference among TX & RX PHYs
+} le_phy_prefer_mask_t;
+
+typedef enum {
+    CODED_PHY_PREFER_NONE     = 0,
+    CODED_PHY_PREFER_S2        = 1,
+    CODED_PHY_PREFER_S8     = 2,
+} le_ci_prefer_t;   //LE coding indication prefer
+
+
+
+
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.53 LE Set Extended Advertising Parameters command"
+ */
+typedef struct {
+    u8        adv_handle;
+    u16        advEvt_props;
+    u8         pri_advIntMin[3];
+    u8        pri_advIntMax[3];
+    u8         pri_advChnMap;
+    u8        ownAddrType;
+    u8         peerAddrType;
+    u8      peerAddr[6];
+    u8        advFilterPolicy;
+    u8         adv_tx_pow;
+    u8        pri_adv_phy;
+    u8        sec_adv_max_skip;
+    u8        sec_adv_phy;
+    u8        adv_sid;
+    u8        scan_req_noti_en;
+}hci_le_setExtAdvParam_cmdParam_t;
+
+/* Advertising_Handle */
+typedef enum{
+    ADV_HANDLE0        = 0x00,
+    ADV_HANDLE1        = 0x01,
+    ADV_HANDLE2        = 0x02,
+}adv_handle_t;
+
+
+
+/* Advertising Event Properties mask*/
+typedef enum{
+    ADVEVT_PROP_MASK_CONNECTABLE                        =    BIT(0),
+    ADVEVT_PROP_MASK_SCANNABLE                             =    BIT(1),
+    ADVEVT_PROP_MASK_DIRECTED                              =   BIT(2),
+    ADVEVT_PROP_MASK_HD_DIRECTED                         =    BIT(3),
+    ADVEVT_PROP_MASK_LEGACY                              =    BIT(4),
+    ADVEVT_PROP_MASK_ANON_ADV                            =    BIT(5),
+    ADVEVT_PROP_MASK_INC_TX_PWR                          =    BIT(6),
+}advEvtProp_mask_t;
+
+
+#define ADVEVT_PROP_MASK_CONNECTABLE_SCANNABLE                    (0x0003)  // ADVEVT_PROP_MASK_CONNECTABLE | ADVEVT_PROP_MASK_SCANNABLE
+#define ADVEVT_PROP_MASK_LEGACY_SCANNABLE                        (0x0012)  // ADVEVT_PROP_MASK_LEGACY | ADVEVT_PROP_MASK_SCANNABLE
+#define    ADVEVT_PROP_MASK_LEGACY_DIRECTED                        (0x0014)  // ADVEVT_PROP_MASK_LEGACY | ADVEVT_PROP_MASK_DIRECTED
+#define    ADVEVT_PROP_MASK_LEGACY_HD_DIRECTED                        (0x0018)  // ADVEVT_PROP_MASK_LEGACY | ADVEVT_PROP_MASK_HD_DIRECTED
+#define ADVEVT_PROP_MASK_LEGACY_CONNECTABLE_SCANNABLE            (0x0013)  // ADVEVT_PROP_MASK_LEGACY | ADVEVT_PROP_MASK_CONNECTABLE | ADVEVT_PROP_MASK_SCANNABLE
+
+/* Advertising Event Properties
+ * See the Core_v5.0(Vol 2/Part E/7.8.53 & Vol 6/Part B/4.4.2/Table 4.1) for more information
+*/
+typedef enum{
+  ADV_EVT_PROP_LEGACY_CONNECTABLE_SCANNABLE_UNDIRECTED                            = 0x0013,        //  0001 0011'b     ADV_IND
+  ADV_EVT_PROP_LEGACY_CONNECTABLE_DIRECTED_LOW_DUTY                            = 0x0015,        //  0001 0101'b        ADV_DIRECT_IND(low duty cycle)
+  ADV_EVT_PROP_LEGACY_CONNECTABLE_DIRECTED_HIGH_DUTY                          = 0x001D,        //  0001 1101'b        ADV_DIRECT_IND(high duty cycle)
+  ADV_EVT_PROP_LEGACY_SCANNABLE_UNDIRECTED                                        = 0x0012,        //  0001 0010'b        ADV_SCAN_IND
+  ADV_EVT_PROP_LEGACY_NON_CONNECTABLE_NON_SCANNABLE_UNDIRECTED                = 0x0010,        //  0001 0000'b        ADV_NONCONN_IND
+
+
+  ADV_EVT_PROP_EXTENDED_NON_CONNECTABLE_NON_SCANNABLE_UNDIRECTED            = 0x0000,        //  0000 0000'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+  ADV_EVT_PROP_EXTENDED_CONNECTABLE_UNDIRECTED                                  = 0x0001,        //  0000 0001'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+  ADV_EVT_PROP_EXTENDED_SCANNABLE_UNDIRECTED                                = 0x0002,        //  0000 0010'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+  ADV_EVT_PROP_EXTENDED_NON_CONNECTABLE_NON_SCANNABLE_DIRECTED                = 0x0004,        //  0000 0100'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+  ADV_EVT_PROP_EXTENDED_CONNECTABLE_DIRECTED                                   = 0x0005,        //  0000 0101'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+  ADV_EVT_PROP_EXTENDED_SCANNABLE_DIRECTED                                    = 0x0006,        //  0000 0110'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+
+
+  ADV_EVT_PROP_EXTENDED_MASK_ANONYMOUS_ADV         = 0x0020,  //if this mask on(only extended ADV event can mask it), anonymous advertising
+  ADV_EVT_PROP_EXTENDED_MASK_TX_POWER_INCLUDE    = 0x0040,  //if this mask on(only extended ADV event can mask it), TX power include
+
+}advEvtProp_type_t;
+
+
+
+/* Advertising_TX_Power */
 typedef enum {
      TX_POWER_0dBm  = 0,
      TX_POWER_1dBm  = 1,
@@ -128,9 +567,23 @@
 } tx_power_t;
 
 
+
+/* Advertising_SID */
+typedef enum{
+    ADV_SID_0        = 0x00,
+    ADV_SID_1        = 0x01,
+    ADV_SID_2        = 0x02,
+    ADV_SID_3        = 0x03,
+}adv_sid_t;
+
+
+
+
 /**
- *  @brief   "Operation" in "LE Set Extended Advertising Data Command" and "LE Set Extended Scan Response Data Command"
+ *  @brief  Command Parameters for "7.8.54 LE Set Extended Advertising Data command"
  */
+
+/* Operation */
 typedef enum {
     DATA_OPER_INTER          =    0x00,
     DATA_OPER_FIRST          =    0x01,
@@ -140,13 +593,9 @@
 } data_oper_t;
 
 
-
-
-/**
- *  @brief   "Fragment_Preference" in "LE Set Extended Advertising Data Command" and "LE Set Extended Scan Response Data Command"
- */
+/* Fragment_Preference */
 typedef enum {
-    DATA_FRAGM_ALLOWED                   =    0x00,
+    DATA_FRAGM_ALLOWED                      =    0x00,
     DATA_FRAGM_NONE_OR_MINIMIZE          =    0x01,
 } data_fragm_t;
 
@@ -154,67 +603,187 @@
 
 
 
-
-
-
-
-
-
-
-
-
-
 /**
- *  @brief  Return Parameters for "HCI LE Read PHY Command"
- */
-typedef struct {
-    u8         status;
-    u8         handle[2];
-    u8         tx_phy;
-    u8         rx_phy;
-} hci_le_readPhyCmd_retParam_t;
-
-
-
-
-/**
- *  @brief  Command Parameters for "HCI LE Set PHY Command"
+ *  @brief  Command Parameters for "7.8.56 LE Set Extended Advertising Enable command"
  */
 
-typedef struct {
-    u16    connHandle;
-    u8     all_phys;
-    u8     tx_phys;
-    u8     rx_phys;
-    u16    phy_options;
-} hci_le_setPhyCmd_param_t;
-
-
-
-
-
-
-
-/**
- *  @brief  Command Parameters Definition for "HCI LE Set Extended Advertising Parameters Command"
- */
-typedef struct {
+typedef struct{
     u8        adv_handle;
-    u16       adv_evt_props;
-    u8        pri_advIntMin[3];
-    u8        pri_advIntMax[3];
-    u8        pri_advChnMap;
-    u8        ownAddrType;
-    u8        peerAddrType;
-    u8        peerAddr[6];
-    u8        advFilterPolicy;
-    u8        adv_tx_pow;
-    u8        pri_adv_phy;
-    u8        sec_adv_max_skip;
-    u8        sec_adv_phy;
-    u8        adv_sid;
-    u8        scan_req_noti_en;
-}hci_le_setExtAdvParam_cmdParam_t;
+    u16        duration;
+    u8      max_ext_adv_evts;
+} extAdvEn_Cfg_t;
+
+typedef struct{
+    u8        enable;
+    u8        num_sets;
+    extAdvEn_Cfg_t        cisCfg[3];  // ADV_SETS_NUMBER_MAX
+} hci_le_setExtAdvEn_cmdParam_t;
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.61 LE Set Periodic Advertising Parameters command"
+ */
+typedef enum{
+
+    PERD_ADV_PROP_MASK_NONE    = 0,
+
+    PERD_ADV_PROP_MASK_TX_POWER_INCLUDE    = BIT(6),
+
+}perd_adv_prop_t;
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.64 LE Set Extended Scan Parameters command"
+ */
+typedef struct{
+    u8        scan_type;
+    u16        scan_interval;
+      u16        scan_window;
+} ext_scan_cfg_t;
+
+typedef struct{
+    u8        ownAddress_type;
+    u8        scan_filter_policy;
+      u8        scan_PHYs;
+      ext_scan_cfg_t        scanCfg[2];  //at most 2 kind of PHY: 1M and Coded
+} hci_le_setExtScan_cmdParam_t;
+
+
+/* Scanning_PHYs */
+typedef enum {
+    SCAN_PHY_1M         = BIT(0),
+    SCAN_PHY_CODED        = BIT(2),
+    SCAN_PHY_1M_CODED     = (SCAN_PHY_1M | SCAN_PHY_CODED),
+} scan_phy_t;
+
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.65 LE Set Extended Scan Enable command"
+ */
+
+/* Filter_Duplicates for Extended Scan*/
+typedef enum {
+    DUPE_FLTR_DISABLE                 = 0x00,
+    DUPE_FLTR_ENABLE                = 0x01,
+    DUPE_FLTR_ENABLE_RST_PERIOD        = 0x02,
+} dupe_fltr_en_t;
+
+
+/* Scan duration, Range: 0x0001 to 0xFFFF, Time = N * 10 ms, Time Range: 10 ms to 655.35 s,
+ * Notice that these are just part of but not all Scan duration value */
+typedef enum{
+    SCAN_DURATION_CONTINUOUS         =             0,
+    SCAN_DURATION_50MS                 =               5,
+    SCAN_DURATION_100MS                 =              10,
+    SCAN_DURATION_150MS                 =              15,
+    SCAN_DURATION_200MS                 =              20,
+    SCAN_DURATION_250MS                 =              25,
+    SCAN_DURATION_300MS                 =              30,
+    SCAN_DURATION_350MS                 =              35,
+    SCAN_DURATION_400MS                 =              40,
+    SCAN_DURATION_450MS                 =              45,
+    SCAN_DURATION_500MS                 =              50,
+    SCAN_DURATION_550MS                 =              55,
+    SCAN_DURATION_600MS                 =              60,
+    SCAN_DURATION_650MS                 =              65,
+    SCAN_DURATION_700MS                 =              70,
+    SCAN_DURATION_750MS                 =              75,
+    SCAN_DURATION_800MS                 =              80,
+    SCAN_DURATION_850MS                 =              85,
+    SCAN_DURATION_900MS                 =              90,
+    SCAN_DURATION_950MS                 =              96,
+    SCAN_DURATION_1S                 =               100,
+    SCAN_DURATION_1S2                  =               120,
+    SCAN_DURATION_1S5                 =               150,
+    SCAN_DURATION_1S6                 =               160,
+    SCAN_DURATION_1S8                 =               180,
+    SCAN_DURATION_2S                 =               200,
+    SCAN_DURATION_3S                 =               300,
+    SCAN_DURATION_4S                 =               400,
+    SCAN_DURATION_5S                 =               500,
+    SCAN_DURATION_6S                 =               600,
+    SCAN_DURATION_7S                 =               700,
+    SCAN_DURATION_8S                 =               800,
+    SCAN_DURATION_9S                 =               900,
+    SCAN_DURATION_10S                 =               1000,
+}scan_durn_t;
+
+/* Scan period, Range: 0x0001 to 0xFFFF, Time = N * 1.28 sec, Time Range: 1.28 s to 83,884.8 s
+ * Notice that these are just part of but not all Scan period value */
+typedef enum{
+    SCAN_WINDOW_CONTINUOUS           =             0,
+    SCAN_WINDOW_1S28                 =               1,
+    SCAN_WINDOW_2S56                 =               2,
+    SCAN_WINDOW_3S84                 =               3,
+    SCAN_WINDOW_5S12                 =               4,
+    SCAN_WINDOW_6S4                  =               5,
+    SCAN_WINDOW_7S68                 =               6,
+    SCAN_WINDOW_8S92                 =               7,
+    SCAN_WINDOW_10S24                 =               8,
+    SCAN_WINDOW_11S52                 =               9,
+    SCAN_WINDOW_12S8                 =              10,
+}scan_period_t;
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.66 LE Extended Create Connection command"
+ */
+typedef struct{
+    u16        scan_interval;
+    u16        scan_window;
+      u16        connInter_min;
+      u16        connInter_max;
+      u16     connLatency;
+      u16        connTimeout;
+      u16        ceLen_min;
+      u16        ceLen_max;
+} ext_init_cfg_t;
+
+typedef struct{
+    u8        init_filter_policy;
+    u8        ownAddr_type;
+      u8        peerAddr_type;
+    u8        peer_addr[6];
+    u8        init_PHYs;
+      ext_init_cfg_t        initCfg[3];
+} hci_le_ext_createConn_cmdParam_t;
+
+#define EXT_CREATE_CONN_CMD_PARAM_MAX_LENGTH        (10 + 16 * 3)   //10 + sizeof(ext_init_cfg_t) * 3
+
+/* Initiating_PHYs */
+typedef enum {
+    INIT_PHY_1M             = BIT(0),
+    INIT_PHY_2M             = BIT(1),
+    INIT_PHY_CODED            = BIT(2),
+    INIT_PHY_1M_2M             = (INIT_PHY_1M | INIT_PHY_2M),
+    INIT_PHY_1M_CODED         = (INIT_PHY_1M | INIT_PHY_CODED),
+    INIT_PHY_2M_CODED         = (INIT_PHY_2M | INIT_PHY_CODED),
+    INIT_PHY_1M_2M_CODED     = (INIT_PHY_1M | INIT_PHY_2M | INIT_PHY_1M_CODED),
+} init_phy_t;
+
+
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.67 LE Periodic Advertising Create Sync command"
+ */
+/* Options */
+typedef enum {
+
+    /* BIT(0)
+     * 0: Use the adv_sid, adv_addr_type, and adv_address parameters to determine which advertiser to listen to.
+     * 1: Use the Periodic Advertiser List to determine which advertiser to listen to. */
+    SYNC_ADV_SPECIFY     = 0,
+    SYNC_ADV_FROM_LIST     = BIT(0),
+
+    /* BIT(1) ~ BIT(7) reserved */
+} option_msk_t;
 
 
 
@@ -222,7 +791,245 @@
 
 
 
-ble_sts_t blc_hci_le_setPhy(hci_le_setPhyCmd_param_t* para);
+
+/**
+ *  @brief  Command Parameters for "7.8.97 LE Set CIG Parameters command"
+ */
+typedef struct {
+    u8      cig_id;
+    u8        sdu_int_m2s[3];
+    u8        sdu_int_s2m[3];
+    u8        sca;
+    u8        packing;
+    u8        framing;
+    u16     max_trans_lat_m2s;
+    u16     max_trans_lat_s2m;
+    u8        cis_count;
+    u8*        restparam;
+} hci_le_setCigParam_cmdParam_t;
+
+typedef struct{
+    u8        cis_id;
+    u8        nse;
+    u16        max_sdu_m2s;
+    u16        max_sdu_s2m;
+    u16        max_pdu_m2s;
+    u16        max_pdu_s2m;
+      u8      phy_m2s;
+      u8        phy_s2m;
+      u8        bn_m2s;
+      u8        bn_s2m;
+} cigParamTest_cisCfg_t;
+
+/* Slaves_Clock_Accuracy */
+typedef enum {
+    PPM_251_500     =    0x00,
+    PPM_151_250     =    0x01,
+    PPM_101_150     =    0x02,
+    PPM_76_100      =    0x03,
+    PPM_51_75          =    0x04,
+    PPM_31_50          =    0x05,
+    PPM_21_30          =    0x06,
+    PPM_0_20          =    0x07,
+} slv_clk_accuracy_t;
+
+
+/* Packing */
+typedef enum {
+    PACK_SEQUENTIAL     =    0x00,
+    PACK_INTERLEAVED     =    0x01,
+} packing_type_t;
+
+/* Framing */
+typedef enum {
+    UNFRAMED   =    0x00,
+    FRAMED     =    0x01,
+} framing_t;
+
+
+
+/**
+ *  @brief  Command Parameters for "7.8.98 LE Set CIG Parameters Test command"
+ */
+typedef struct{
+    u8        cig_id;
+    u8        sdu_int_m2s[3];
+      u8        sdu_int_s2m[3];
+    u8        ft_m2s;
+    u8        ft_s2m;
+    u16     iso_intvl;
+    u8        sca;
+    u8        packing;
+    u8        framing;
+      u8        cis_count;   //15 B above
+      cigParamTest_cisCfg_t        cisCfg[1];  //14 B for one CIS configuration
+} hci_le_setCigParamTest_cmdParam_t;
+
+
+
+/**
+ *  @brief  Return Parameters for "LE Set CIG Parameters command" and "LE Set CIG Parameters Test command"
+ */
+typedef struct {
+    u8      status;
+    u8        cig_id;
+    u8        cis_count;
+    u16        cis_connHandle[1];  //not 4 byte aligned, but no problem
+} hci_le_setCigParam_retParam_t;
+
+
+/* ISO_Interval, Time = N * 1.25 ms,
+ * Notice that these are just part of but not all ISO_Interval value */
+typedef enum{
+    ISO_INTERVAL_5MS                  =             4,
+    ISO_INTERVAL_6P75MS               =          5,
+    ISO_INTERVAL_7P5MS                =          6,
+    ISO_INTERVAL_8P75MS               =          7,
+    ISO_INTERVAL_10MS                 =          8,
+    ISO_INTERVAL_11P25MS              =          9,
+    ISO_INTERVAL_12P5MS               =          10,
+    ISO_INTERVAL_15MS                 =          12,
+    ISO_INTERVAL_18P75MS              =          15,
+    ISO_INTERVAL_20MS                 =          16,
+    ISO_INTERVAL_25MS                 =          20,
+    ISO_INTERVAL_27P5MS               =          22,
+    ISO_INTERVAL_30MS                 =          24,
+    ISO_INTERVAL_31P25MS              =          25,
+    ISO_INTERVAL_38P75MS              =          31,
+    ISO_INTERVAL_40MS                 =          32,
+    ISO_INTERVAL_48P75MS              =          39,
+    ISO_INTERVAL_50MS                 =          40,
+    ISO_INTERVAL_100MS                =          80,
+}iso_inter_t;
+
+
+
+
+/**
+ *    @brief  Command Parameters for "7.8.99 LE Create CIS command"
+ */
+typedef struct
+{
+    u16        cis_handle;
+    u16        acl_handle;
+} cisConnParams_t;
+
+typedef struct
+{
+    u8        cis_count;
+    cisConnParams_t    cisConn[1];
+}hci_le_CreateCisParams_t;
+
+
+
+#if 0
+/**
+ *    @brief  Command Parameters for "7.8.102 LE Reject CIS Request command"
+ */
+typedef struct
+{
+    u16        cis_handle;
+    u8        reason;
+} hci_le_rejectCisReqParams_t;
+#endif
+
+
+
+/**
+ *    @brief  Command Parameters for "7.8.103 LE Create BIG command"
+ */
+typedef struct
+{
+      u8      big_handle;            /* Used to identify the BIG */
+    u8        adv_handle;            /* Used to identify the periodic advertising train */
+    u8        num_bis;            /* Total number of BISes in the BIG */
+      u8      sdu_intvl[3];        /* The interval, in microseconds, of periodic SDUs */
+      u16        max_sdu;            /* Maximum size of an SDU, in octets */
+      u16        max_trans_lat;         /* Maximum time, in milliseconds, for transmitting an SDU */
+      u8      rtn;                 /* The maximum number of times that every BIS Data PDU should be retransmitted */
+      u8        phy;                /* The transmitter PHY of packets */
+    packing_type_t        packing;//type same as u8
+    framing_t            framing;//type same as u8
+    u8        enc;                /* Encryption flag */
+    u8      broadcast_code[16]; /* The code used to derive the session key that is used to encrypt and decrypt BIS payloads */
+} hci_le_createBigParams_t;
+
+
+
+
+/**
+ *    @brief  Command Parameters for "7.8.104 LE Create BIG Test command"
+ */
+typedef struct
+{
+      u8      big_handle;            /* Used to identify the BIG */
+    u8        adv_handle;            /* Used to identify the periodic advertising train */
+    u8        num_bis;            /* Total number of BISes in the BIG */
+      u8      sdu_intvl[3];        /* The interval, in microseconds, of periodic SDUs */
+      u16     iso_intvl;            /* The time between consecutive BIG anchor points */
+      u8        nse;                /* The total number of subevents in each interval of each BIS in the BIG */
+      u16        max_sdu;            /* Maximum size of an SDU, in octets */
+      u16        max_pdu;             /* Maximum size, in octets, of payload */
+      u8        phy;                /* The transmitter PHY of packets */
+    packing_type_t packing : 8; //type same as u8
+    framing_t      framing : 8; //type same as u8
+    u8        bn;                    /* The number of new payloads in each interval for each BIS */
+    u8        irc;                /* The number of times the scheduled payload(s) are transmitted in a given event*/
+    u8        pto;                /* Offset used for pre-transmissions */
+    u8        enc;                /* Encryption flag */
+    u8      broadcast_code[16]; /* The code used to derive the session key that is used to encrypt and decrypt BIS payloads */
+} hci_le_createBigParamsTest_t;
+
+
+
+
+/**
+ *    @brief  Command Parameters for "7.8.105 LE Terminate BIG command"
+ */
+typedef struct
+{
+    u8        big_handle;
+    u8        reason;
+} hci_le_terminateBigParams_t;
+
+
+
+
+typedef struct
+{
+      u8      big_handle;            /* Used to identify the BIG */
+    u16        sync_handle;        /* Identifier of the periodic advertising train */
+    u8        enc;                /* Encryption flag */
+    u8      broadcast_code[16]; /* The code used to derive the session key that is used to encrypt and decrypt BIS payloads */
+    u8        mse;                /* The Controller can schedule reception of any number of subevents up to NSE */
+      u16        big_sync_timeout;    /* Synchronization timeout for the BIG */
+      u16        max_trans_lat;         /* Maximum time, in milliseconds, for transmitting an SDU */
+      u8      num_bis;             /* Total number of BISes to synchronize */
+      u8*     bis;                /* List of indices of BISes */
+} hci_le_bigCreateSyncParams_t;
+
+
+
+
+/**
+ *    @brief  Command Parameters for "7.8.109 LE Setup ISO Data Path command"
+ */
+typedef struct
+{
+    u16 conn_handle;
+    u8  data_path_direction;
+    u8  data_path_id;
+    u8  codec_id[5];
+
+    u32 controller_delay           :24;
+    u32 codec_configration_length :8;
+
+    u8    codec_config[1];
+
+}hci_le_setupIsoDataPathCmdParams_t;
+
+
+
 
 
 #endif /* HCI_CMD_H_ */
diff --git a/stack/ble/hci/hci_const.h b/stack/ble/hci/hci_const.h
index 4417f3f..100ca8d 100644
--- a/stack/ble/hci/hci_const.h
+++ b/stack/ble/hci/hci_const.h
@@ -23,13 +23,6 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-/*
- * hci_const.h
- *
- *  Created on: 2016-9-20
- *      Author: Administrator
- */
-
 #ifndef HCI_CONST_H_
 #define HCI_CONST_H_
 
@@ -84,7 +77,27 @@
 #define HCI_SUB_EVT_LE_SCAN_REQUEST_RECEIVED                         0x13   //core_5.0 - LE Scan Request Received Event - [5]7.7.65.19
 #define HCI_SUB_EVT_LE_CHANNEL_SELECTION_ALGORITHM                   0x14   //core_5.0 - LE Channel Selection Algorithm Event - [5]7.7.65.20
 
-#define HCI_SUB_EVT_LE_CONNECTION_ESTABLISH                          0x20   //telink private
+
+#define HCI_SUB_EVT_LE_CONNECTIONLESS_IQ_REPORT                        0x15    //core_5.1    7.7.65.21 LE Connectionless IQ Report event
+#define HCI_SUB_EVT_LE_CONNECTION_IQ_REPORT                             0x16    //core_5.1    7.7.65.22 LE Connection IQ Report event
+#define HCI_SUB_EVT_LE_CTE_REQUEST_FAILED                             0x17    //core_5.1    7.7.65.23 LE CTE Request Failed event
+#define HCI_SUB_EVT_LE_PERIODIC_ADVERTISING_SYNC_TRANSFOR_RECEIVED   0x18    //core_5.1    7.7.65.24 LE Periodic Advertising Sync Transfer Received event
+
+
+#define HCI_SUB_EVT_LE_CIS_ESTABLISHED                                 0x19    //core_5.2    7.7.65.25 LE CIS Established event
+#define HCI_SUB_EVT_LE_CIS_REQUESTED                                 0x1A    //core_5.2    7.7.65.26 LE CIS Request event
+#define HCI_SUB_EVT_LE_CREATE_BIG_COMPLETE                             0x1B    //core_5.2    7.7.65.27 LE Create BIG Complete event
+#define HCI_SUB_EVT_LE_TERMINATE_BIG_COMPLETE                         0x1C    //core_5.2    7.7.65.28 LE Terminate BIG Complete event
+#define HCI_SUB_EVT_LE_BIG_SYNC_ESTABLILSHED                         0x1D    //core_5.2    7.7.65.29 LE BIG Sync Established event
+#define HCI_SUB_EVT_LE_BIG_SYNC_LOST                                 0x1E    //core_5.2    7.7.65.30 LE BIG Sync Lost event
+#define HCI_SUB_EVT_LE_REQUEST_PEER_SCA_COMPLETE                     0x1F    //core_5.2    7.7.65.31 LE Request Peer SCA Complete event
+#define HCI_SUB_EVT_LE_PATH_LOSS_THRESHOLD                             0x20    //core_5.2    7.7.65.32 LE Path Loss Threshold event
+#define HCI_SUB_EVT_LE_TRANSMIT_POWER_REPORTING                         0x21    //core_5.2    7.7.65.33 LE Transmit Power Reporting event
+#define HCI_SUB_EVT_LE_BIGINFO_ADVERTISING_REPORT                     0x22    //core_5.2    7.7.65.34 LE BIGInfo Advertising Report event
+
+
+
+#define HCI_SUB_EVT_LE_CONNECTION_ESTABLISH                             0xFF   //Telink private
 
 
 
@@ -99,8 +112,8 @@
 #define HCI_EVT_MASK_AUTHENTICATION_COMPLETE                          0x0000000020
 #define HCI_EVT_MASK_REMOTE_NAME_REQUEST_COMPLETE                     0x0000000040
 #define HCI_EVT_MASK_ENCRYPTION_CHANGE                                0x0000000080
-#define HCI_EVT_MASK_CHANGE_CONECTION_LINK_KEY_COMPLETE               0x0000000100
-#define HCI_EVT_MASK_MASTER_LINK_KEY_COMPLETE                         0x0000000200
+#define HCI_EVT_MASK_CHANGE_CONNECTION_LINK_KEY_COMPLETE             0x0000000100
+#define HCI_EVT_MASK_MASTER_LINK_KEY_COMPLETE                        0x0000000200
 #define HCI_EVT_MASK_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE          0x0000000400
 #define HCI_EVT_MASK_READ_REMOTE_VERSION_INFORMATION_COMPLETE         0x0000000800     //
 
@@ -130,8 +143,29 @@
 #define HCI_LE_EVT_MASK_SCAN_REQUEST_RECEIVED                        0x00040000 // core5.0
 #define HCI_LE_EVT_MASK_CHANNEL_SELECTION_ALGORITHM                  0x00080000 // core5.0 - bit19
 
+#define HCI_LE_EVT_MASK_CONNECTIONLESS_IQ_REPORT                     0x00100000 // core5.1 - bit20
+#define HCI_LE_EVT_MASK_CONNECTION_IQ_REPORTD                           0x00200000 // core5.1 - bit21
+#define HCI_LE_EVT_MASK_CTE_REQUEST_FAILED                           0x00400000 // core5.1 - bit22
+#define HCI_LE_EVT_MASK_PERIODIC_ADVERTISING_SYNC_TRANSFOR_RECEIVED  0x00800000 // core5.1 - bit23
 
-#define HCI_LE_EVT_MASK_CONNECTION_ESTABLISH                         0x80000000  //telink private
+#define HCI_LE_EVT_MASK_CIS_ESTABLISHED                                 0x01000000 // core5.2 - bit24
+#define HCI_LE_EVT_MASK_CIS_REQUESTED                                 0x02000000 // core5.2 - bit25
+#define HCI_LE_EVT_MASK_CREATE_BIG_COMPLETE                             0x04000000 // core5.2 - bit26
+#define HCI_LE_EVT_MASK_TERMINATE_BIG_COMPLETE                         0x08000000 // core5.2 - bit27
+#define HCI_LE_EVT_MASK_BIG_SYNC_ESTABLILSHED                         0x10000000 // core5.2 - bit28
+#define HCI_LE_EVT_MASK_BIG_SYNC_LOST                                 0x20000000 // core5.2 - bit29
+#define HCI_LE_EVT_MASK_REQUEST_PEER_SCA_COMPLETE                     0x40000000 // core5.2 - bit30
+#define HCI_LE_EVT_MASK_PATH_LOSS_THRESHOLD                             0x80000000 // core5.2 - bit31
+
+#define HCI_LE_EVT_MASK_2_TRANSMIT_POWER_REPORTING                     0x00000001 // core5.2 - bit32
+#define HCI_LE_EVT_MASK_2_BIGINFO_ADVERTISING_REPORT                 0x00000002 // core5.2 - bit33
+
+
+
+#define HCI_LE_EVT_MASK_CONNECTION_ESTABLISH                         0x80000000  //TODO
+
+
+
 
 
 #define HCI_LE_EVT_MASK_DEFAULT                                      HCI_LE_EVT_MASK_NONE
@@ -247,7 +281,7 @@
 #define HCI_CMD_LE_TRANSMITTER_TEST                                  0x1E
 #define HCI_CMD_LE_TEST_END                                          0x1F
 //core_4.0 end
-//core_4.2 begin
+//core_4.1 begin
 #define HCI_CMD_LE_REMOTE_CONNECTION_PARAM_REQ_REPLY                  0x20
 #define HCI_CMD_LE_REMOTE_CONNECTION_PARAM_REQ_NEGATIVE_REPLY         0x21
 //core_4.1 end
@@ -301,6 +335,56 @@
 #define HCI_CMD_LE_SET_PRIVACY_MODE                                  0x4E//LE Set Privacy Mode Command - [5] 7.8.77
 //core_5.0 end
 
+//core_5.1 begin
+#define HCI_CMD_LE_RECEIVER_TEST_V3                                  0x4F //7.8.78 LE Receiver Test command [v3]
+#define HCI_CMD_LE_TRANSMITTER_TEST_V3                               0x50 //7.8.79 LE Transmitter Test command [v3]
+#define HCI_CMD_LE_SET_CONNECTIONLESS_CTE_TRANSMIT_PARAMETERS         0x51 //7.8.80 LE Set Connectionless CTE Transmit Parameters command
+#define HCI_CMD_LE_SET_CONNECTIONLESS_CTE_TRANSMIT_ENABLE             0x52 //7.8.81 LE Set Connectionless CTE Transmit Enable command
+#define HCI_CMD_LE_SET_CONNECTIONLESS_IQ_SAMPLING_ENABLE             0x53 //7.8.82 LE Set Connectionless IQ Sampling Enable command
+#define HCI_CMD_LE_SET_CONNECTION_CTE_RECEIVE_PARAMETERS             0x54 //7.8.83 LE Set Connection CTE Receive Parameters command
+#define HCI_CMD_LE_SET_CONNECTION_CTE_TRANSMIT_PARAMETERS             0x55 //7.8.84 LE Set Connection CTE Transmit Parameters command
+#define HCI_CMD_LE_CONNECTION_REQUEST_ENABLE                          0x56 //7.8.85 LE Connection CTE Request Enable command
+#define HCI_CMD_LE_CONNECTION_RESPONSE_ENABLE                          0x57 //7.8.86 LE Connection CTE Response Enable command
+#define HCI_CMD_LE_READ_ANTENNA_INFORMATION                              0x58 //7.8.87 LE Read Antenna Information command
+#define HCI_CMD_LE_SET_PERIODIC_ADVERTISING_RECEIVE_ENABLE             0x59 //7.8.88 LE Set Periodic Advertising Receive Enable command
+#define HCI_CMD_LE_PERIODIC_ADVERTISING_SYNC_TRANSFOR                 0x5A //7.8.89 LE Periodic Advertising Sync Transfer command
+#define HCI_CMD_LE_PERIODIC_ADVERTISING_SET_INFO_TRANSFOR             0x5B //7.8.90 LE Periodic Advertising Set Info Transfer command
+#define HCI_CMD_LE_SET_PERIODIC_ADV_SYNC_TRANSFOR_PARAMETERS          0x5C //7.8.91 LE Set Periodic Advertising Sync Transfer Parameters command
+#define HCI_CMD_LE_SET_DEFAULT_PERIODIC_ADV_SYNC_TRANSFOR_PARAMS      0x5D //7.8.92 LE Set Default Periodic Advertising Sync Transfer Parameters command
+#define HCI_CMD_LE_GENERATE_DHKEY_V2                                 0x5E //7.8.93 LE Generate DHKey command [v2]
+#define HCI_CMD_LE_MODIFY_SLEEP_CLOCK_ACCURACY                         0x5F //7.8.94 LE Modify Sleep Clock Accuracy command
+//core_5.1 end
+
+//core_5.2 begin
+#define HCI_CMD_LE_READ_BUFFER_SIZE_V2                                 0x60 //7.8.2 LE Read Buffer Size command
+#define HCI_CMD_LE_READ_ISO_TX_SYNC                                     0x61 //7.8.96 LE Read ISO TX Sync command
+#define HCI_CMD_LE_SET_CIG_PARAMETERS                                 0x62 //7.8.97 LE Set CIG Parameters command
+#define HCI_CMD_LE_SET_CIG_PARAMETERS_TEST                             0x63 //7.8.98 LE Set CIG Parameters Test command
+#define HCI_CMD_LE_CREATE_CIS                                         0x64 //7.8.99 LE Create CIS command
+#define HCI_CMD_LE_REMOVE_CIG                                          0x65 //7.8.100 LE Remove CIG command
+#define HCI_CMD_LE_ACCEPT_CIS_REQUEST                                 0x66 //7.8.101 LE Accept CIS Request command
+#define HCI_CMD_LE_REJECT_CIS_REQUEST                                 0x67 //7.8.102 LE Reject CIS Request command
+#define HCI_CMD_LE_CREATE_BIG                                         0x68 //7.8.103 LE Create BIG command
+#define HCI_CMD_LE_CREATE_BIG_TEST                                     0x69 //7.8.104 LE Create BIG Test command
+#define HCI_CMD_LE_TERMINATE_BIG                                     0x6A //7.8.105 LE Terminate BIG command
+#define HCI_CMD_LE_BIG_CREATE_SYNC                                     0x6B //7.8.106 LE BIG Create Sync command
+#define HCI_CMD_LE_BIG_TERMINATE_SYNC                                 0x6C //7.8.107 LE BIG Terminate Sync command
+#define HCI_CMD_LE_REQUEST_PEER_SCA                                     0x6D //7.8.108 LE Request Peer SCA command
+#define HCI_CMD_LE_SETUP_ISO_DATA_PATH                                 0x6E //7.8.109 LE Setup ISO Data Path command
+#define HCI_CMD_LE_REMOVE_ISO_DARA_PATH                                 0x6F //7.8.110 LE Remove ISO Data Path command
+#define HCI_CMD_LE_ISO_TRTANSMIT_TEST                                 0x70 //7.8.111 LE ISO Transmit Test command
+#define HCI_CMD_LE_ISO_RECEIVE_TEST                                     0x71 //7.8.112 LE ISO Receive Test command
+#define HCI_CMD_LE_ISO_READ_TEST_COUNTERS                             0x72 //7.8.113 LE ISO Read Test Counters command
+#define HCI_CMD_LE_ISO_TEST_END                                         0x73 //7.8.114 LE ISO Test End command
+#define HCI_CMD_LE_SET_HOST_FEATURE                                     0x74 //7.8.115 LE Set Host Feature Command
+#define HCI_CMD_LE_READ_ISO_LINK_QUALITY                             0x75 //7.8.116 LE Read ISO Link Quality command
+#define HCI_CMD_LE_ENHANCED_READ_TRANSMIT_POWER_LEVEL                 0x76 //7.8.117 LE Enhanced Read Transmit Power Level command
+#define HCI_CMD_LE_READ_REMOTE_TRANSMIT_POWER_LEVEL                      0x77 //7.8.118 LE Read Remote Transmit Power Level command
+#define HCI_CMD_LE_SET_PATH_LOSS_REPORTING_PARAMETERS                 0x78 //7.8.119 LE Set Path Loss Reporting Parameters command
+#define HCI_CMD_LE_SET_PATH_LOSS_REPORTING_ENABLE                     0x79 //7.8.120 LE Set Path Loss Reporting Enable command
+#define HCI_CMD_LE_SET_TRANSMIT_POWER_REPORTING_ENABLE                 0x7A //7.8.121 LE Set Transmit Power Reporting Enable command
+//core_5.2 end
+
 
 #define HCI_CMD_LINK_POLICY_OPCODE_OGF                               0x08 //0x02<<2 = 0x08
 #define HCI_CMD_TEST_OPCODE_OGF                                      0x18 //0x06<<2 = 0x18
@@ -311,7 +395,7 @@
 //-- OCF --
 #define HCI_TELINK_READ_REG                                          0x01
 #define HCI_TELINK_WRITE_REG                                         0x02
-#define HCI_TELINK_SET_TX_PWR                                        0x03
-
+#define HCI_TELINK_SET_TX_PWR                                         0x03
+#define HCI_TELINK_REBOOT_MCU                                         0x04
 #define HCI_TELINK_SET_RXTX_DATA_LEN                                 0x40
 #endif /* HCI_CONST_H_ */
diff --git a/stack/ble/hci/hci_event.h b/stack/ble/hci/hci_event.h
index ca70989..f7a8880 100644
--- a/stack/ble/hci/hci_event.h
+++ b/stack/ble/hci/hci_event.h
@@ -22,19 +22,12 @@
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  *
- *****************************************************************************/
-/*
- * hci_event.h
- *
- *  Created on: 2016-9-21
- *      Author: Administrator
- */
-
-#ifndef HCI_EVENT_H_
+ *****************************************************************************/#ifndef HCI_EVENT_H_
 #define HCI_EVENT_H_
 
-#include <stack/ble/hci/hci.h>
-#include <stack/ble/ble_common.h>
+
+#include "stack/ble/ble_common.h"
+
 
 /**
  *  @brief  Definition for general HCI event packet
@@ -62,7 +55,23 @@
     u8         opCode_OGF;
 } hci_cmdStatusEvt_t;
 
+typedef struct{
+    u16         connHandle;
+    u16         numOfCmpPkts;
+}numCmpPktParamRet_t;
 
+typedef struct {
+    u8         numHandles;
+    numCmpPktParamRet_t retParams[1];//TODO
+} hci_numOfCmpPktEvt_t;
+
+typedef struct{
+    u8  status;
+    u16 connHandle;
+    u8  verNr;
+    u16 compId;
+    u16 subVerNr;
+}hci_readRemVerInfoCmplEvt_t;
 
 typedef struct {
     hci_type_t type;
@@ -74,29 +83,36 @@
 
 
 
-
-
-
+/**
+ *  @brief  Event Parameters for "7.7.5 Disconnection Complete event"
+ */
+typedef struct {
+    u8    status;
+    u16    connHandle;
+    u8    reason;
+} event_disconnection_t;
 
 
 
 
 
 /**
- *  @brief  Event Parameters for "HCI LE Meta Event: LE Advertising Report Event"
+ *  @brief  Event Parameters for "7.7.8 Encryption Change event"
  */
-// Advertise report event type
-typedef enum {
-    ADV_REPORT_EVENT_TYPE_ADV_IND        = 0x00,
-    ADV_REPORT_EVENT_TYPE_DIRECT_IND     = 0x01,
-    ADV_REPORT_EVENT_TYPE_SCAN_IND       = 0x02,
-    ADV_REPORT_EVENT_TYPE_NONCONN_IND    = 0x03,
-    ADV_REPORT_EVENT_TYPE_SCAN_RSP       = 0x04,
-} advReportEventType_t;
+typedef struct {
+    u8    status;
+    u16    handle;
+    u8  enc_enable;
+} event_enc_change_t;
 
 
-
-
+/**
+ *  @brief  Event Parameters for "7.7.39 Encryption Key Refresh Complete event"
+ */
+typedef struct {
+    u8    status;
+    u16    handle;
+} event_enc_refresh_t;
 
 typedef struct {
     u8         status;
@@ -104,88 +120,34 @@
     u8         reason;
 } hci_disconnectionCompleteEvt_t;
 
-
-typedef struct {
-    u8         subEventCode;
-    u8         status;
-    u16        connHandle;
-    u8         role;
-    u8         peerAddrType;
-    u8         peerAddr[BLE_ADDR_LEN];
-    u16        connInterval;
-    u16        slaveLatency;
-    u16        supervisionTimeout;
-    u8         masterClkAccuracy;
-} hci_le_connectionCompleteEvt_t;
-
-
-typedef struct {
-    u8         subEventCode;
-    u8         status;
-    u16        connHandle;
-    u16        connInterval;
-    u16        connLatency;
-    u16        supervisionTimeout;
-} hci_le_connectionUpdateCompleteEvt_t;
-
-
-typedef struct {
-    u8         subEventCode;
-    u8         status;
-    u16        connHandle;
-    u8         feature[LL_FEATURE_SIZE];
-} hci_le_readRemoteFeaturesCompleteEvt_t;
-
-
-typedef struct {
-    u8         subEventCode;
-    u16        connHandle;  //no aligned, can not be used as pointer
-    u16        maxTxOct;
-    u16        maxTxtime;
-    u16        maxRxOct;
-    u16        maxRxtime;
-} hci_le_dataLengthChangeEvt_t;
-
-
-/**
- *  @brief  Definition for HCI LE Read Local P-256 Public Key Complete event
- */
-typedef struct {
-    u8         subEventCode;
-    u8         status;
-    u8         localP256Key[64];
-} hci_le_readLocalP256KeyCompleteEvt_t;
-
-/**
- *  @brief  Definition for HCI LE generate DHKey Complete event
- */
-typedef struct {
-    u8         subEventCode;
-    u8         status;
-    u8         DHKey[32];
-} hci_le_generateDHKeyCompleteEvt_t;
-
-
-/**
- *  @brief  Definition for HCI long term key request event
- */
-typedef struct {
-    u8         subEventCode;
-    u16        connHandle;
-    u8         random[8];
-    u16        ediv;
-} hci_le_longTermKeyRequestEvt_t;
-
-
-/**
- *  @brief  Definition for HCI Encryption Change event
- */
 typedef struct {
     u8         status;
     u16        connHandle;
     u8         encryption_enable;
 } hci_le_encryptEnableEvt_t;
 
+typedef struct {
+    u8    subcode;
+    u8    status;
+    u16    handle;
+    u8    role;
+    u8    peer_adr_type;
+    u8    mac[6];
+    u16    interval;
+    u16    latency;
+    u16    timeout;
+    u8    accuracy;
+} event_connection_complete_t;            //20-byte
+
+typedef struct {
+    u8    subcode;
+    u8    status;
+    u16    handle;
+    u16    interval;
+    u16    latency;
+    u16    timeout;
+} event_connection_update_t;            //20-byte
+
 /**
  *  @brief  Definition for HCI Encryption Key Refresh Complete event
  */
@@ -196,12 +158,179 @@
 
 
 
+/**
+ *  @brief  Event Parameters for "7.7.65.1 LE Connection Complete event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u16        connHandle;
+    u8         role;
+    u8         peerAddrType;
+    u8         peerAddr[6];
+    u16        connInterval;
+    u16        slaveLatency;
+    u16        supervisionTimeout;
+    u8         masterClkAccuracy;
+} hci_le_connectionCompleteEvt_t;
 
 
+/* ACL Connection Role */
+typedef enum {
+    LL_ROLE_MASTER     = 0,
+    LL_ROLE_SLAVE     = 1,
+} acl_connection_role_t;
+
+/**
+ *  @brief  Event Parameters for "7.7.65.2 LE Advertising Report event"
+ */
+typedef struct {
+    u8    subcode;
+    u8    nreport;
+    u8    event_type;
+    u8    adr_type;
+    u8    mac[6];
+    u8    len;
+    u8    data[1];
+} event_adv_report_t;
+
+/* Advertise report event type */
+typedef enum {
+    ADV_REPORT_EVENT_TYPE_ADV_IND         = 0x00,
+    ADV_REPORT_EVENT_TYPE_DIRECT_IND     = 0x01,
+    ADV_REPORT_EVENT_TYPE_SCAN_IND         = 0x02,
+    ADV_REPORT_EVENT_TYPE_NONCONN_IND     = 0x03,
+    ADV_REPORT_EVENT_TYPE_SCAN_RSP         = 0x04,
+} advReportEventType_t;
+
 
 
 /**
- *  @brief  Definition for HCI LE PHY Update Complete event
+ *  @brief  Event Parameters for "7.7.65.3 LE Connection Update Complete event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u16        connHandle;
+    u16        connInterval;
+    u16        connLatency;
+    u16        supervisionTimeout;
+} hci_le_connectionUpdateCompleteEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.4 LE Read Remote Features Complete event"
+ */
+#define LL_FEATURE_SIZE                                                  8
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u16        connHandle;
+    u8         feature[LL_FEATURE_SIZE];
+} hci_le_readRemoteFeaturesCompleteEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.5 LE Long Term Key Request event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u16        connHandle;
+    u8         random[8];
+    u16        ediv;
+} hci_le_longTermKeyRequestEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.6 LE Remote Connection Parameter Request event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u16        connHandle;
+    u16        IntervalMin;
+    u16        IntervalMax;
+    u16           latency;
+    u16           timeout;
+} hci_le_remoteConnParamReqEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.7 LE Data Length Change event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u16        connHandle;  //no aligned, can not be used as pointer
+    u16        maxTxOct;
+    u16        maxTxtime;
+    u16        maxRxOct;
+    u16        maxRxtime;
+} hci_le_dataLengthChangeEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.8 LE Read Local P-256 Public Key Complete event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u8         localP256Key[64];
+} hci_le_readLocalP256KeyCompleteEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.9 LE Generate DHKey Complete event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u8         DHKey[32];
+} hci_le_generateDHKeyCompleteEvt_t;
+
+#if (LL_FEATURE_ENABLE_LL_PRIVACY)
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u16        connHandle;
+    u8         role;
+    u8         peerAddrType;
+    u8         peerAddr[BLE_ADDR_LEN];
+    u8           localRpa[BLE_ADDR_LEN];
+    u8           peerRpa[BLE_ADDR_LEN];
+    u16        connInterval;
+    u16        connLatency;
+    u16        supervisionTimeout;
+    u8         masterClkAccuracy;
+} hci_le_enhancedConnectionCompleteEvt_t;
+#endif
+
+/**
+ *  @brief  Event Parameters for "7.7.65.10 LE Enhanced Connection Complete event"
+ */
+typedef struct {
+    u8         subEventCode;
+    u8         status;
+    u16           connHandle;
+    u8           role;
+    u8           PeerAddrType;
+    u8         PeerAddr[6];
+    u8         localRslvPrivAddr[6];
+    u8         Peer_RslvPrivAddr[6];
+    u16        connInterval;
+    u16        conneLatency;
+    u16        superTimeout;
+    u8         mca;
+} hci_le_enhancedConnCompleteEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.12 LE PHY Update Complete event"
  */
 typedef struct {
     u8         subEventCode;
@@ -212,24 +341,91 @@
 } hci_le_phyUpdateCompleteEvt_t;
 
 
+
 /**
- *  @brief  Definition for HCI LE Extended Advertising Report event
+ *  @brief  Event Parameters for "7.7.65.13 LE Extended Advertising Report event"
  */
-typedef struct {
-    //TODO
+typedef struct{
+    u16        event_type;
+    u8        address_type;
+    u8        address[6];
+    u8        primary_phy;
+    u8        secondary_phy;
+    u8        advertising_sid;
+    u8        tx_power;
+    u8        rssi;
+    u16        perd_adv_inter;    // Periodic_Advertising_Interval
+    u8        direct_address_type;
+    u8        direct_address[6];
+    u8        data_length;  //24
+    u8        data[1];
+} extAdvEvt_info_t;
+
+typedef struct{
+    u8        subEventCode;
+    u8        num_reports;
+    u8        advEvtInfo[1];
 } hci_le_extAdvReportEvt_t;
 
 
+/* Extended Advertising Report Event Event_Type mask*/
+typedef enum{
+    EXT_ADV_RPT_EVT_MASK_CONNECTABLE                =    BIT(0),
+    EXT_ADV_RPT_EVT_MASK_SCANNABLE                     =    BIT(1),
+    EXT_ADV_RPT_EVT_MASK_DIRECTED                      =   BIT(2),
+    EXT_ADV_RPT_EVT_MASK_SCAN_RESPONSE                 =    BIT(3),
+    EXT_ADV_RPT_EVT_MASK_LEGACY                      =    BIT(4),
+    //EXT_ADV_RPT_EVT_MASK_DATA_STATUS                  =    (BIT(5) | BIT(6)),
+}extAdvRptEvtMask_t;
+
+
+/* Extended Advertising Report Event_Type */
+typedef enum{
+    EXT_ADV_RPT_EVT_TYPE_LEGACY_ADV_IND                            = 0x0013,        //  0001 0011'b
+    EXT_ADV_RPT_EVT_TYPE_LEGACY_ADV_DIRECT_IND                       = 0x0015,        //  0001 0101'b
+    EXT_ADV_RPT_EVT_TYPE_LEGACY_ADV_SCAN_IND                     = 0x0012,        //  0001 0010'b
+    EXT_ADV_RPT_EVT_TYPE_LEGACY_ADV_NONCONN_IND                    = 0x0010,        //  0001 0000'b
+    EXT_ADV_RPT_EVT_TYPE_LEGACY_SCAN_RSP_2_ADV_IND                = 0x001B,        //  0001 1011'b
+    EXT_ADV_RPT_EVT_TYPE_LEGACY_SCAN_RSP_2_ADV_SCAN_IND            = 0x001A,        //  0001 1010'b
+
+
+    //TODO
+//    EXT_ADV_RPT_EVT_TYPE_EXTENDED_NON_CONNECTABLE_NON_SCANNABLE_UNDIRECTED            = 0x0000,        //  0000 0000'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+//    EXT_ADV_RPT_EVT_TYPE_EXTENDED_CONNECTABLE_UNDIRECTED                                  = 0x0001,        //  0000 0001'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+//    EXT_ADV_RPT_EVT_TYPE_SCANNABLE_UNDIRECTED                                = 0x0002,        //  0000 0010'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+//    EXT_ADV_RPT_EVT_TYPE_NON_CONNECTABLE_NON_SCANNABLE_DIRECTED                = 0x0004,        //  0000 0100'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+//    EXT_ADV_RPT_EVT_TYPE_CONNECTABLE_DIRECTED                                   = 0x0005,        //  0000 0101'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+//    EXT_ADV_RPT_EVT_TYPE_SCANNABLE_DIRECTED                                    = 0x0006,        //  0000 0110'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
+}extAdvRptEvtType_t;  //extended advertising report event type
+
+
+/* Address type */
+typedef enum{
+    EXTADV_RPT_PUBLIC_DEVICE_ADDRESS                =    0x00,
+    EXTADV_RPT_RANDOM_DEVICE_ADDRESS                 =    0x01,
+    EXTADV_RPT_PUBLIC_IDENTITY_ADDRESS              =   0x02,
+    EXTADV_RPT_RANDOM_IDENTITY_ADDRESS                 =    0x03,
+}ext_adv_adr_type_t;
+
+
 /**
- *  @brief  Definition for HCI LE Periodic Advertising Sync Established Event
+ *  @brief  Event Parameters for "7.7.65.14 LE Periodic Advertising Sync Established event"
  */
 typedef struct {
     //TODO
 } hci_le_PeriodicAdvSyncEstablishedEvt_t;
 
 
+
+
+
 /**
- *  @brief  Definition for HCI LE Periodic Advertising Report Event
+ *  @brief  Event Parameters for "7.7.65.14 LE Periodic Advertising Sync Established event"
+ */
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.15 LE Periodic Advertising Report event"
  */
 typedef struct {
     //TODO
@@ -237,23 +433,23 @@
 
 
 /**
- *  @brief  Definition for HCI LE Periodic Advertising Sync Lost Event
+ *  @brief  Event Parameters for "7.7.65.16 LE Periodic Advertising Sync Lost event"
  */
 typedef struct {
     //TODO
 } hci_le_periodicAdvSyncLostEvt_t;
 
 
-/**
- *  @brief  Definition for HCI LE Scan Timeout Event
- */
+
 typedef struct {
     //TODO
 } hci_le_scanTimeoutEvt_t;
 
 
+
+
 /**
- *  @brief  Definition for HCI LE Advertising Set Terminated Event
+ *  @brief  Event Parameters for "7.7.65.18 LE Advertising Set Terminated event"
  */
 typedef struct {
     u8         subEventCode;
@@ -265,7 +461,7 @@
 
 
 /**
- *  @brief  Definition for HCI LE Scan Request Received Event
+ *  @brief  Event Parameters for "7.7.65.19 LE Scan Request Received event"
  */
 typedef struct {
     //TODO
@@ -273,7 +469,7 @@
 
 
 /**
- *  @brief  Definition for HCI LE Channel Selection Algorithm Event
+ *  @brief  Event Parameters for "7.7.65.20 LE Channel Selection Algorithm event"
  */
 typedef struct {
     u8         subEventCode;
@@ -286,8 +482,121 @@
 
 
 
+/**
+ *  @brief  Event Parameters for "7.7.65.25 LE CIS Established event"
+ */
+typedef struct {
+    u8            subEventCode;
+    u8            status;
+    u16            cisHandle;
+    u8          cigSyncDly[3];
+    u8          cisSyncDly[3];
+    u8          transLaty_m2s[3];
+    u8          transLaty_s2m[3];
+    u8            phy_m2s;
+    u8            phy_s2m;
+    u8            nse;
+    u8            bn_m2s;
+    u8            bn_s2m;
+    u8            ft_m2s;
+    u8            ft_s2m;
+    u16            maxPDU_m2s;
+    u16            maxPDU_s2m;
+    u16            isoIntvl;
+} hci_le_cisEstablishedEvt_t;
 
 
+/**
+ *  @brief  Event Parameters for "7.7.65.26 LE CIS Request event"
+ */
+typedef struct {
+    u8            subEventCode;
+    u16            aclHandle;
+    u16            cisHandle;
+    u8            cigId;
+    u8            cisId;
+} hci_le_cisReqEvt_t;
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.27 LE Create BIG Complete event"
+ */
+typedef struct {
+    u8            subEventCode;
+    u8            status;
+    u8            bigHandle;
+    u8            bigSyncDly[3];
+    u8          transLatyBig[3];
+    u8            phy;
+    u8            nse;
+    u8            bn;
+    u8            pto;
+    u8            irc;
+    u16            maxPDU;
+    u16            isoIntvl;
+    u8            numBis;
+    u16            bisHandles[1];//BIS_IN_BIG_NUM_MAX];
+} hci_le_createBigCompleteEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.28 LE Terminate BIG Complete event"
+ */
+typedef struct {
+    u8            subEventCode;
+    u8            bigHandle;
+    u8            reason;
+} hci_le_terminateBigCompleteEvt_t;
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.20 LE Channel Selection Algorithm event"
+ */
+typedef struct {
+    u8            subEventCode;
+    u8            status;
+    u8            bigHandle;
+    u8          transLatyBig[3];
+    u8            nse;
+    u8            bn;
+    u8            pto;
+    u8            irc;
+    u16            maxPDU;
+    u16            isoIntvl;
+    u8            numBis;
+    u16         bisHandles[1];//BIS_IN_BIG_NUM_MAX];
+} hci_le_bigSyncEstablishedEvt_t;
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.29 LE BIG Sync Established event"
+ */
+typedef struct {
+    u8            subEventCode;
+    u8            bigHandle;
+    u8            reason;
+} hci_le_bigSyncLostEvt_t;
+
+
+
+/**
+ *  @brief  Event Parameters for "7.7.65.30 LE BIG Sync Lost event"
+ */
+
+
+
+
+int     hci_le_cisEstablished_evt(u8 status, u16 cisHandle, u8 cigSyncDly[3], u8 cisSyncDly[3], u8 transLaty_m2s[3], u8 transLaty_s2m[3], u8 phy_m2s,
+                              u8 phy_s2m, u8 nse, u8 bn_m2s, u8 bn_s2m, u8 ft_m2s, u8 ft_s2m, u16 maxPDU_m2s, u16 maxPDU_s2m, u16 isoIntvl );
+int  hci_le_cisReq_evt(u16 aclHandle, u16 cisHandle, u8 cigId, u8 cisId);
+
+int  hci_le_craeteBigComplete_evt(u8 status, u8 bigHandle, u8 bigSyncDly[3], u8 transLatyBig[3], u8 phy, u8 nse,
+                                  u8 bn, u8 pto, u8 irc, u16 maxPDU, u16 isoIntvl, u8 numBis, u16* bisHandles);
+int  hci_le_terminateBigComplete_evt(u8 bigHandle, u8 reason);
+int  hci_le_bigSyncEstablished_evt(u8 status, u8 bigHandle, u8 transLatyBig[3], u8 nse, u8 bn, u8 pto, u8 irc,
+                                  u16 maxPDU, u16 isoIntvl,  u8 numBis, u16* bisHandles);
+int  hci_le_bigSyncLost_evt(u8 bigHandle, u8 reason);
 
 void hci_disconnectionComplete_evt(u8 status, u16 connHandle, u8 reason);
 int  hci_cmdComplete_evt(u8 numHciCmds, u8 opCode_ocf, u8 opCode_ogf, u8 paraLen, u8 *para, u8 *result);
@@ -307,8 +616,13 @@
 
 
 int hci_le_longTermKeyRequest_evt(u16 connHandle, u8* random, u16 ediv, u8* result);
-int hci_le_readLocalP256KeyComplete_evt(u8* localP256Key, u8* result);
-int hci_le_generateDHKeyComplete_evt(u8* DHkey,  u8* result);
+int hci_le_readLocalP256KeyComplete_evt(u8* localP256Key, u8 status);
+int hci_le_generateDHKeyComplete_evt(u8* DHkey, u8 status);
+
+#if (LL_FEATURE_ENABLE_LL_PRIVACY)
+void hci_le_enhancedConnectionComplete_evt(u8 status, u16 connHandle, u8 role, u8 peerAddrType, u8 *peerAddr, u8 *loaclRpa, u8 *peerRpa,
+                                           u16 connInterval, u16 connLatency, u16 supervisionTimeout, u8 masterClkAccuracy);
+#endif
 int hci_le_encryptChange_evt(u16 connhandle,  u8 encrypt_en);
 int hci_le_encryptKeyRefresh_evt(u16 connhandle);
 
diff --git a/stack/ble/hci/usb_desc.h b/stack/ble/hci/usb_desc.h
deleted file mode 100644
index 9ce6f3c..0000000
--- a/stack/ble/hci/usb_desc.h
+++ /dev/null
@@ -1,154 +0,0 @@
-/******************************************************************************
- * @file     usb_desc.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#pragma once
-
-#include <application/usbstd/CDCClassCommon.h>
-
-enum {
-    BTUSB_USB_STRING_LANGUAGE = 0,
-    BTUSB_USB_STRING_VENDOR,
-    BTUSB_USB_STRING_PRODUCT,
-    BTUSB_USB_STRING_SERIAL,
-};
-
-typedef struct {
-    USB_Descriptor_Configuration_Hdr_t Config;
-    USB_Descriptor_Interface_Association_t intfa;
-
-    USB_Descriptor_Interface_t intf0;
-    USB_Descriptor_Endpoint_t irq_in;
-    USB_Descriptor_Endpoint_t bulk_in;
-    USB_Descriptor_Endpoint_t bulk_out;
-
-    USB_Descriptor_Interface_t intf1_0;
-    USB_Descriptor_Endpoint_t iso_in;
-    USB_Descriptor_Endpoint_t iso_out;
-
-    USB_Descriptor_Interface_t intf1_1;
-    USB_Descriptor_Endpoint_t iso_in1;
-    USB_Descriptor_Endpoint_t iso_out1;
-
-    USB_Descriptor_Interface_t intf_prn;
-    USB_Descriptor_Endpoint_t endp0;
-    USB_Descriptor_Endpoint_t endp1;
-} BTUSB_Descriptor_Configuration_with_Printer_t;
-
-typedef struct {
-    USB_Descriptor_Configuration_Hdr_t Config;
-    USB_Descriptor_Interface_Association_t intfa;
-
-    USB_Descriptor_Interface_t intf0;
-    USB_Descriptor_Endpoint_t irq_in;
-    USB_Descriptor_Endpoint_t bulk_in;
-    USB_Descriptor_Endpoint_t bulk_out;
-
-    USB_Descriptor_Interface_t intf1_0;
-    USB_Descriptor_Endpoint_t iso_in;
-    USB_Descriptor_Endpoint_t iso_out;
-
-    USB_Descriptor_Interface_t intf1_1;
-    USB_Descriptor_Endpoint_t iso_in1;
-    USB_Descriptor_Endpoint_t iso_out1;
-} BTUSB_Descriptor_Configuration_t;
-
-u8* btusb_usbdesc_get_language(void);
-u8* btusb_usbdesc_get_vendor(void);
-u8* btusb_usbdesc_get_product(void);
-u8* btusb_usbdesc_get_serial(void);
-u8* btusb_usbdesc_get_device(void);
-u8* btusb_usbdesc_get_configuration(void);
-int btusb_usbdesc_get_configuration_size(void);
-
-void btusb_select_cdc_device (int en);
-
-///////////////////////////////////////////////////////////////////////////////
-//typedef void (*usb_bulk_out_callback_t)(u8 *p, int n, int offset);
-
-void myusb_bulk_drv_init (void *p);    //initialization
-int myusb_bulk_in (u8 *p, int n);        //send status
-int myusb_bulk_proc ();                //called in main loop
-void myusb_bulk_out_command (u8 *p, int n, int offset);
-
-#define CMD_GET_VERSION                 0 //0x00
-#define CMD_SELECT_DPIMPL               16//0x10
-#define CMD_SET_TCK_FREQUENCY           17//0x11
-#define CMD_GET_TCK_FREQUENCY           18//0x12
-#define CMD_MEASURE_MAX_TCK_FREQ        21//0x15
-#define CMD_MEASURE_RTCK_RESPONSE       22//0x16
-#define CMD_TAP_SHIFT                   23//0x17
-#define CMD_SET_TAPHW_STATE             32//0x20
-#define CMD_GET_TAPHW_STATE             33//0x21
-#define CMD_TGPWR_SETUP                 34//0x22
-
-
-
-//---------------  CDC ----------------------------------
-
-/** Endpoint number of the CDC device-to-host notification IN endpoint. */
-#define CDC_NOTIFICATION_EPNUM         2
-/** Endpoint number of the CDC device-to-host data IN endpoint. */
-#define CDC_TX_EPNUM                   4
-/** Endpoint number of the CDC host-to-device data OUT endpoint. */
-#define CDC_RX_EPNUM                   5
-/** Size in bytes of the CDC device-to-host notification IN endpoint. */
-#define CDC_NOTIFICATION_EPSIZE        8
-/** Size in bytes of the CDC data IN and OUT endpoints. */
-#define CDC_TXRX_EPSIZE                64
-
-enum {
-    USB_STRING_LANGUAGE = 0,
-    USB_STRING_VENDOR,
-    USB_STRING_PRODUCT,
-    USB_STRING_SERIAL,
-};
-
-// interface id
-typedef enum {
-    USB_INTF_CDC_CCI,
-    USB_INTF_CDC_DCI,
-    USB_INTF_MAX,
-} USB_INTF_ID_E;
-
-typedef struct {
-    // CDC Control Interface
-    USB_CDC_Descriptor_FunctionalHeader_t    CDC_Functional_Header;
-    USB_CDC_Descriptor_FunctionalACM_t       CDC_Functional_ACM;
-    USB_CDC_Descriptor_FunctionalUnion_t     CDC_Functional_Union;
-    USB_CDC_Descriptor_FunctionalUnion_t     CDC_Functional_CallManagement;
-    USB_Descriptor_Endpoint_t                CDC_NotificationEndpoint;
-
-    // CDC Data Interface
-    USB_Descriptor_Interface_t               CDC_DCI_Interface;
-    USB_Descriptor_Endpoint_t                CDC_DataOutEndpoint;
-    USB_Descriptor_Endpoint_t                CDC_DataInEndpoint;
-} USB_CDC_Descriptor_t;
-
-typedef struct {
-    USB_Descriptor_Configuration_Hdr_t Config;
-    USB_Descriptor_Interface_Association_t cdc_iad;
-    USB_Descriptor_Interface_t cdc_interface;
-    USB_CDC_Descriptor_t cdc_descriptor;
-} USB_Descriptor_Configuration_t;
diff --git a/stack/ble/host/attr/att.h b/stack/ble/host/attr/att.h
new file mode 100644
index 0000000..a3a1dc8
--- /dev/null
+++ b/stack/ble/host/attr/att.h
@@ -0,0 +1,222 @@
+/******************************************************************************
+ * @file     att.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#pragma once
+
+#include "tl_common.h"
+
+
+/** @defgroup ATT_PERMISSIONS_BITMAPS GAP ATT Attribute Access Permissions Bit Fields
+ * @{
+ * (See the Core_v5.0(Vol 3/Part C/10.3.1/Table 10.2) for more information)
+ */
+#define ATT_PERMISSIONS_AUTHOR                 0x10 //Attribute access(Read & Write) requires Authorization
+#define ATT_PERMISSIONS_ENCRYPT                 0x20 //Attribute access(Read & Write) requires Encryption
+#define ATT_PERMISSIONS_AUTHEN                 0x40 //Attribute access(Read & Write) requires Authentication(MITM protection)
+#define ATT_PERMISSIONS_SECURE_CONN             0x80 //Attribute access(Read & Write) requires Secure_Connection
+#define ATT_PERMISSIONS_SECURITY             (ATT_PERMISSIONS_AUTHOR | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN | ATT_PERMISSIONS_SECURE_CONN)
+
+//user can choose permission below
+#define ATT_PERMISSIONS_READ                 0x01 //!< Attribute is Readable
+#define ATT_PERMISSIONS_WRITE                0x02 //!< Attribute is Writable
+#define ATT_PERMISSIONS_RDWR                 (ATT_PERMISSIONS_READ | ATT_PERMISSIONS_WRITE)   //!< Attribute is Readable & Writable
+
+
+#define ATT_PERMISSIONS_ENCRYPT_READ         (ATT_PERMISSIONS_READ  | ATT_PERMISSIONS_ENCRYPT)         //!< Read requires Encryption
+#define ATT_PERMISSIONS_ENCRYPT_WRITE        (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_ENCRYPT)         //!< Write requires Encryption
+#define ATT_PERMISSIONS_ENCRYPT_RDWR         (ATT_PERMISSIONS_RDWR  | ATT_PERMISSIONS_ENCRYPT)         //!< Read & Write requires Encryption
+
+
+#define ATT_PERMISSIONS_AUTHEN_READ          (ATT_PERMISSIONS_READ  | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)         //!< Read requires Authentication
+#define ATT_PERMISSIONS_AUTHEN_WRITE         (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)         //!< Write requires Authentication
+#define ATT_PERMISSIONS_AUTHEN_RDWR          (ATT_PERMISSIONS_RDWR  | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)         //!< Read & Write requires Authentication
+
+
+#define ATT_PERMISSIONS_SECURE_CONN_READ     (ATT_PERMISSIONS_READ  | ATT_PERMISSIONS_SECURE_CONN | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)   //!< Read requires Secure_Connection
+#define ATT_PERMISSIONS_SECURE_CONN_WRITE    (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_SECURE_CONN | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)  //!< Write requires Secure_Connection
+#define ATT_PERMISSIONS_SECURE_CONN_RDWR     (ATT_PERMISSIONS_RDWR  | ATT_PERMISSIONS_SECURE_CONN | ATT_PERMISSIONS_ENCRYPT | ATT_PERMISSIONS_AUTHEN)   //!< Read & Write requires Secure_Connection
+
+
+#define ATT_PERMISSIONS_AUTHOR_READ          (ATT_PERMISSIONS_READ | ATT_PERMISSIONS_AUTHOR)         //!< Read requires Authorization
+#define ATT_PERMISSIONS_AUTHOR_WRITE         (ATT_PERMISSIONS_WRITE | ATT_PERMISSIONS_AUTHEN)         //!< Write requires Authorization
+#define ATT_PERMISSIONS_AUTHOR_RDWR          (ATT_PERMISSIONS_RDWR | ATT_PERMISSIONS_AUTHOR)         //!< Read & Write requires Authorization
+
+
+/** @} End GAP_ATT_PERMISSIONS_BITMAPS */
+
+
+/** @ add to group GATT_Characteristic_Property GATT characteristic properties
+ * @{
+ */
+#define CHAR_PROP_BROADCAST              0x01 //!< permit broadcasts of the Characteristic Value
+#define CHAR_PROP_READ                   0x02 //!< permit reads of the Characteristic Value
+#define CHAR_PROP_WRITE_WITHOUT_RSP      0x04 //!< Permit writes of the Characteristic Value without response
+#define CHAR_PROP_WRITE                  0x08 //!< Permit writes of the Characteristic Value with response
+#define CHAR_PROP_NOTIFY                 0x10 //!< Permit notifications of a Characteristic Value without acknowledgement
+#define CHAR_PROP_INDICATE               0x20 //!< Permit indications of a Characteristic Value with acknowledgement
+#define CHAR_PROP_AUTHEN                 0x40 //!< permit signed writes to the Characteristic Value
+#define CHAR_PROP_EXTENDED               0x80 //!< additional characteristic properties are defined
+/** @} end of group GATT_Characteristic_Property */
+
+
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    typedef int (*att_readwrite_callback_t)(u16 connHandle, void* p);
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    typedef int (*att_readwrite_callback_t)(void* p);
+#endif
+
+typedef struct attribute
+{
+  u16  attNum;
+  u8   perm;
+  u8   uuidLen;
+  u32  attrLen;    //4 bytes aligned
+  u8* uuid;
+  u8* pAttrValue;
+  att_readwrite_callback_t w;
+  att_readwrite_callback_t r;
+} attribute_t;
+
+
+
+
+/**
+ * @brief    This function is used to define ATT MTU size exchange callback
+ */
+typedef int (*att_mtuSizeExchange_callback_t)(u16, u16);
+
+/**
+ * @brief    This function is used to define ATT Handle value confirm callback
+ */
+typedef int (*att_handleValueConfirm_callback_t)(void);
+
+
+
+
+/**
+ * @brief    This function is used to set ATT table
+ * @param    *p - the pointer of attribute table
+ * @return    none.
+ */
+void        bls_att_setAttributeTable (u8 *p);
+
+
+//mtu size
+/**
+ * @brief    This function is used to set RX MTU size
+ * @param    mtu_size - ATT MTU size
+ * @return    0: success
+ *             other: fail
+ */
+ble_sts_t    blc_att_setRxMtuSize(u16 mtu_size);
+
+
+
+/**
+ * @brief    This function is used to set prepare write buffer
+ * @param    *p - the pointer of buffer
+ * @param    len - the length of buffer
+ * @return    none.
+ */
+void          blc_att_setPrepareWriteBuffer(u8 *p, u16 len);
+
+/**
+ * @brief    This function is used to request MTU size exchange
+ * @param    connHandle - connect handle
+ * @param    mtu_size - ATT MTU size
+ * @return    0: success
+ *             other: fail
+ */
+//Attention: this API hide in stack, user no need use !!!
+ble_sts_t     blc_att_requestMtuSizeExchange (u16 connHandle, u16 mtu_size);
+
+/**
+ * @brief    This function is used to set effective ATT MTU size
+ * @param    connHandle - connect handle
+ * @param    effective_mtu - bltAtt.effective_MTU
+ * @return    none.
+ */
+void          blt_att_setEffectiveMtuSize(u16 connHandle, u8 effective_mtu);
+
+/**
+ * @brief    This function is used to reset effective ATT MTU size
+ * @param    connHandle - connect handle
+ * @return    none.
+ */
+void          blt_att_resetEffectiveMtuSize(u16 connHandle);
+
+/**
+ * @brief    This function is used to reset RX MTU size
+ * @param    mtu_size - ATT MTU size
+ * @return    0: success
+ *             other: fail
+ */
+void          blt_att_resetRxMtuSize(u16 connHandle);
+
+/**
+ * @brief   This function is used to get effective MTU size.
+ * @param    connHandle - connect handle
+ * @return  effective MTU value.
+ */
+u16  blc_att_getEffectiveMtuSize(u16 connHandle);
+
+
+#if(MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+/**
+ * @brief      set device name
+ * @param[in]  p - the point of name
+ * @param[in]  len - the length of name
+ * @return     BLE_SUCCESS
+ */
+ble_sts_t     bls_att_setDeviceName(u8* pName,u8 len);  //only module/mesh/hci use
+
+ble_sts_t    blc_att_responseMtuSizeExchange (u16 connHandle, u16 mtu_size);
+ble_sts_t    bls_att_pushNotifyData (u16 attHandle, u8 *p, int len);
+ble_sts_t    bls_att_pushIndicateData (u16 attHandle, u8 *p, int len);
+
+        // 0x04: ATT_OP_FIND_INFO_REQ
+void     att_req_find_info(u8 *dat, u16 start_attHandle, u16 end_attHandle);
+        // 0x06: ATT_OP_FIND_BY_TYPE_VALUE_REQ
+void     att_req_find_by_type (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, u8* attr_value, int len);
+        // 0x08: ATT_OP_READ_BY_TYPE_REQ
+void     att_req_read_by_type (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
+        // 0x0a: ATT_OP_READ_REQ
+void     att_req_read (u8 *dat, u16 attHandle);
+        // 0x0c: ATT_OP_READ_BLOB_REQ
+void     att_req_read_blob (u8 *dat, u16 attHandle, u16 offset);
+        // 0x10: ATT_OP_READ_BY_GROUP_TYPE_REQ
+void     att_req_read_by_group_type (u8 *dat, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
+        // 0x12: ATT_OP_WRITE_REQ
+void     att_req_write (u8 *dat, u16 attHandle, u8 *buf, int len);
+        // 0x52: ATT_OP_WRITE_CMD
+void     att_req_write_cmd (u8 *dat, u16 attHandle, u8 *buf, int len);
+
+#endif
+
+
+
+
diff --git a/stack/ble/host/attr/gatt.h b/stack/ble/host/attr/gatt.h
new file mode 100644
index 0000000..1d9125b
--- /dev/null
+++ b/stack/ble/host/attr/gatt.h
@@ -0,0 +1,147 @@
+/******************************************************************************
+ * @file     gatt.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef GATT_H_
+#define GATT_H_
+
+
+
+
+
+
+/**
+ * @brief       This function is used to notify a client of the value of a Characteristic Value from a server.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  attHandle  -  attribute handle.
+ * @param[in]  *p -  data buffer pointer
+ * @param[in]  len - data byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t    blc_gatt_pushHandleValueNotify  (u16 connHandle, u16 attHandle, u8 *p, int len);
+
+
+/**
+ * @brief       This function is used to indicate the Characteristic Value from a server to a client.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  attHandle - attribute handle.
+ * @param[in]  *p -  data buffer pointer
+ * @param[in]  len - data byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t    blc_gatt_pushHandleValueIndicate(u16 connHandle, u16 attHandle, u8 *p, int len);
+
+
+/**
+ * @brief       This function is used to This function is used to request the server to write the value of an attribute without response.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  attHandle - attribute handle.
+ * @param[in]  *p -  data buffer pointer
+ * @param[in]  len - data byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushWriteComand (u16 connHandle, u16 attHandle, u8 *p, int len);
+
+
+/**
+ * @brief       This function is used to request the server to write the value of an attribute.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  attHandle - attribute handle.
+ * @param[in]  *p -  data buffer pointer
+ * @param[in]  len - data byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushWriteRequest (u16 connHandle, u16 attHandle, u8 *p, int len);
+
+
+
+
+/**
+ * @brief       This function is used to obtain the mapping of attribute handles with their associated types
+ *                and allows a client to discover the list of attributes and their types on a server.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  start_attHandle - start attribute handle.
+ * @param[in]  end_attHandle -  end attribute handle.
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushFindInformationRequest(u16 connHandle, u16 start_attHandle, u16 end_attHandle);
+
+
+/**
+ * @brief       This function is used to obtain the handles of attributes that have a 16bit uuid attribute type and attribute value.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  start_attHandle - start attribute handle.
+ * @param[in]  end_attHandle   - end attribute handle.
+ * @param[in]  uuid
+ * @param[in]  attr_value - attribute value
+ * @param[in]  len - data byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushFindByTypeValueRequest (u16 connHandle, u16 start_attHandle, u16 end_attHandle, u16 uuid, u8* attr_value, int len);
+
+
+/**
+ * @brief       This function is used to obtain the values of attributes where the attribute type is known but handle is not known.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  start_attHandle - start attribute handle.
+ * @param[in]  end_attHandle   - end attribute handle.
+ * @param[in]  uuid
+ * @param[in]  uuid_len -uuid byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushReadByTypeRequest (u16 connHandle, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
+
+
+/**
+ * @brief       This function is used to request the server to read the value of an attribute.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  attHandle -   attribute handle.
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushReadRequest (u16 connHandle, u16 attHandle);
+
+
+/**
+ * @brief       This function is used to request the server to read part of the value of an attribute at a given offset
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  attHandle - attribute handle.
+ * @param[in]  offset
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushReadBlobRequest (u16 connHandle, u16 attHandle, u16 offset);
+
+
+/**
+ * @brief       This function is used to obtain the values of attributes according to the uuid.
+ * @param[in]  connHandle -  connection handle
+ * @param[in]  start_attHandle - start attribute handle.
+ * @param[in]  end_attHandle   - end attribute handle.
+ * @param[in]  uuid -
+ * @param[in]  uuid_len - uuid byte number
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t     blc_gatt_pushReadByGroupTypeRequest (u16 connHandle, u16 start_attHandle, u16 end_attHandle, u8 *uuid, int uuid_len);
+
+
+#endif /* GATT_H_ */
diff --git a/stack/ble/host/ble_host.h b/stack/ble/host/ble_host.h
new file mode 100644
index 0000000..e2f3d87
--- /dev/null
+++ b/stack/ble/host/ble_host.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ * @file     ble_host.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef STACK_BLE_HOST_BLE_HOST_H_
+#define STACK_BLE_HOST_BLE_HOST_H_
+
+#include "stack/ble/ble_common.h"
+#include "stack/ble/ble_format.h"
+
+#include "stack/ble/host/l2cap/l2cap.h"
+
+
+#include "stack/ble/host/attr/att.h"
+#include "stack/ble/host/attr/gatt.h"
+
+
+#include "stack/ble/host/smp/smp.h"
+#include "stack/ble/host/smp/smp_alg.h"
+#include "stack/ble/host/smp/smp_peripheral.h"
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+#include "stack/ble/host/smp/smp_central.h"
+#endif
+#include "stack/ble/host/smp/smp_storage.h"
+
+
+#include "stack/ble/host/gap/gap.h"
+#include "stack/ble/host/gap/gap_event.h"
+
+
+/*********************************************************/
+//Remove when file merge to SDK //
+#include "stack/ble/ble_config.h"
+#include "stack/ble/trace.h"
+
+/*********************************************************/
+
+
+#endif /* STACK_BLE_HOST_BLE_HOST_H_ */
diff --git a/stack/ble/gap/gap.h b/stack/ble/host/gap/gap.h
similarity index 91%
rename from stack/ble/gap/gap.h
rename to stack/ble/host/gap/gap.h
index 499bc3d..ed70ce7 100644
--- a/stack/ble/gap/gap.h
+++ b/stack/ble/host/gap/gap.h
@@ -25,9 +25,6 @@
  *****************************************************************************/
 #pragma once
 
-#include "tl_common.h"
-
-
 
 
 #define GAP_ADTYPE_FLAGS                        0x01 //!< Discovery Mode: @ref GAP_ADTYPE_FLAGS_MODES
@@ -79,26 +76,13 @@
 
 
 
-
-typedef enum {
-    Gap_Role_Broadcaster  = 0,
-    Gap_Role_Observer     = 1,
-    Gap_Role_Peripheral   = 2,
-    Gap_Role_Central      = 3,
-}gap_role_t;
-
-
-
-
-
-
-
-
-
-/******************************* User Interface  *****************************************/
+/**
+ * @brief      this  function is used to initialize GAP Peripheral
+ * @param       none
+ * @return     none
+ */
 void         blc_gap_peripheral_init(void);
 
-void         blc_gap_central_init(void);
 
 
 
@@ -108,7 +92,5 @@
 
 
 
-/************************* Stack Interface, user can not use!!! ***************************/
-
 
 
diff --git a/stack/ble/host/gap/gap_event.h b/stack/ble/host/gap/gap_event.h
new file mode 100644
index 0000000..901fa08
--- /dev/null
+++ b/stack/ble/host/gap/gap_event.h
@@ -0,0 +1,272 @@
+/******************************************************************************
+ * @file     gap_event.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef GAP_EVENT_H_
+#define GAP_EVENT_H_
+
+
+
+
+/*****************************************  SMP message sequence and event chart  *******************************************************
+
+                                                                                              GAP_SMP EVENT
+Situation 1:   SMP Standard Pair                                                                    |
+    Phase 1: Paring Feature Exchange                                                                |
+    Phase 2: Encryption( STK/LTK Generation )                                                        |
+    Phase 3: Key Distribution                                                                        |
+                                                                                                    |
+           Master                                                          Slave                            |
+            |                                                            |                            |
+            |                                                            |                            |
+    ________|___________________________________________________________|_______                    |
+    |                                                                             |                    |
+    |                           Establish LL connection                            |                    |
+    |___________________________________________________________________________|                    |
+            |                                                            |                            |
+            |                                                            |                            |
+            |              Phase 1: Paring Feature Exchange                |                            |
+     _______|___________________________________________________________|_______                    |
+    |        |                                                            |        |                    |
+    |        |                    (Optional)Security_Request                |        |                    |
+    |        |<----------------------------------------------------------|        |                    |
+    |        |                        Paring_Req                            |        |
+    |         |---------------------------------------------------------->|=======|=====>>>  GAP_EVT_SMP_PAIRING_BEGIN
+    |        |                        Paring_Rsp                            |        |
+    |          |<----------------------------------------------------------|       |                    |
+    |        |                        .......                             |        |                    |
+    |_______|___________________________________________________________|_______|                    |
+            |                                                            |                            |
+            |                                                            |                            |
+            |                  Phase 2: Encryption                        |                            |
+     _______|___________________________________________________________|_______                    |
+    |        |                                                            |        |                    |
+    |        |                        LL_ENC_REQ                            |        |                    |
+    |        |---------------------------------------------------------->|        |                    |
+    |        |                        LL_ENC_RSP                            |        |                    |
+    |         |<----------------------------------------------------------|        |                    |
+    |        |                     LL_START_ENC_REQ                        |        |                    |
+    |          |<----------------------------------------------------------|       |                    |
+    |        |                     LL_START_ENC_RSP                        |        |                    |
+    |        |---------------------------------------------------------->|        |                    |
+    |       |                     LL_START_ENC_RSP                         |        |
+    |        |<----------------------------------------------------------|=======|=====>>>  GAP_EVT_SMP_CONN_ENCRYPTION_DONE(re_connect = SMP_STANDARD_PAIR)
+    |_______|___________________________________________________________|_______|
+            |                                                            |                            |
+            |                                                            |                            |
+            |              Phase 3: Key Distribution                    |                            |
+     _______|___________________________________________________________|_______                    |
+    |        |                                                            |        |                    |
+    |        |                      Key Distribution                         |        |                    |
+    |        |<----------------------------------------------------------|        |                    |
+    |        |                      Key Distribution                        |        |                    |
+    |         |<----------------------------------------------------------|        |                    |
+    |        |                           .......                             |        |                    |
+    |          |                                                            |       |                    |
+    |        |                      Key Distribution                        |        |                    |
+    |        |---------------------------------------------------------->|        |                    |
+    |        |                      Key Distribution                        |        |                    |
+    |         |---------------------------------------------------------->|        |                    |
+    |        |                           .......                             |        |                    |
+    |          |                                                            |       |
+    |        |                 All Key Distribution Finish                |=======|=====>>>  GAP_EVT_SMP_PAIRING_SUCCESS
+    |        |                                                             |=======|=====>>>  GAP_EVT_SMP_SECURITY_PROCESS_DONE(re_connect = SMP_STANDARD_PAIR)
+    |_______|___________________________________________________________|_______|
+                                                                                                    |
+                                                                                                    |
+                                                                                                    |
+                                                                                                    |
+Situation 2:   SMP Fast Connect                                                                        |
+    Only 1 Phase: Encryption                                                                        |
+                                                                                                    |
+           Master                                                          Slave                            |
+            |                                                            |                            |
+            |                                                            |                            |
+    ________|___________________________________________________________|_______                    |
+    |                                                                             |                    |
+    |                          Establish LL connection                            |                    |
+    |___________________________________________________________________________|                    |
+            |                                                            |                            |
+            |                                                            |                            |
+            |                  Phase 2: Encryption                        |                            |
+     _______|___________________________________________________________|_______                    |
+    |        |                                                            |        |                    |
+    |        |                        LL_ENC_REQ                            |        |                    |
+    |        |---------------------------------------------------------->|        |                    |
+    |        |                        LL_ENC_RSP                            |        |                    |
+    |         |<----------------------------------------------------------|        |                    |
+    |        |                     LL_START_ENC_REQ                        |        |                    |
+    |          |<----------------------------------------------------------|       |                    |
+    |        |                     LL_START_ENC_RSP                        |        |                    |
+    |        |---------------------------------------------------------->|        |                    |
+    |       |                     LL_START_ENC_RSP                         |        |                    |
+    |        |<----------------------------------------------------------|=======|=====>>>  GAP_EVT_SMP_CONN_ENCRYPTION_DONE (re_connect = SMP_FAST_CONNECT)
+    |        |                                                             |=======|=====>>>  GAP_EVT_SMP_SECURITY_PROCESS_DONE(re_connect = SMP_FAST_CONNECT)
+    |_______|___________________________________________________________|_______|
+
+
+ *****************************************************************************************************************************/
+
+
+/**
+ * @brief      GAP event type
+ */
+#define GAP_EVT_SMP_PAIRING_BEGIN                                     0    // Refer to SMP message sequence and event chart above
+#define GAP_EVT_SMP_PAIRING_SUCCESS                                     1    // Refer to SMP message sequence and event chart above
+#define GAP_EVT_SMP_PAIRING_FAIL                                     2
+#define GAP_EVT_SMP_CONN_ENCRYPTION_DONE                             3    // Refer to SMP message sequence and event chart above
+#define GAP_EVT_SMP_SECURITY_PROCESS_DONE                             4    // Refer to SMP message sequence and event chart above
+
+#define GAP_EVT_SMP_TK_DISPlAY                                         8
+#define GAP_EVT_SMP_TK_REQUEST_PASSKEY                                 9
+#define GAP_EVT_SMP_TK_REQUEST_OOB                                     10
+#define GAP_EVT_SMP_TK_NUMERIC_COMPARE                                 11
+
+
+#define GAP_EVT_ATT_EXCHANGE_MTU                                     16
+#define GAP_EVT_GATT_HANDLE_VALUE_CONFIRM                             17
+
+#if(MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    ///Correct spelling errors, but need to be compatible with the previous version
+    #define GAP_EVT_SMP_PARING_BEAGIN                                     GAP_EVT_SMP_PAIRING_BEGIN    // Refer to SMP message sequence and event chart above
+    #define GAP_EVT_SMP_PARING_SUCCESS                                     GAP_EVT_SMP_PAIRING_SUCCESS    // Refer to SMP message sequence and event chart above
+    #define GAP_EVT_SMP_PARING_FAIL                                         GAP_EVT_SMP_PAIRING_FAIL
+#endif
+
+/**
+ * @brief      GAP event mask
+ */
+#define GAP_EVT_MASK_NONE                                             0x00000000
+#define GAP_EVT_MASK_SMP_PAIRING_BEGIN                               (1<<GAP_EVT_SMP_PAIRING_BEGIN)
+#define GAP_EVT_MASK_SMP_PAIRING_SUCCESS                                (1<<GAP_EVT_SMP_PAIRING_SUCCESS)
+#define GAP_EVT_MASK_SMP_PAIRING_FAIL                                (1<<GAP_EVT_SMP_PAIRING_FAIL)
+
+#define GAP_EVT_MASK_SMP_CONN_ENCRYPTION_DONE                          (1<<GAP_EVT_SMP_CONN_ENCRYPTION_DONE)
+#define GAP_EVT_MASK_SMP_SECURITY_PROCESS_DONE                          (1<<GAP_EVT_SMP_SECURITY_PROCESS_DONE)
+
+#define GAP_EVT_MASK_SMP_TK_DISPLAY                                   (1<<GAP_EVT_SMP_TK_DISPLAY)
+#define GAP_EVT_MASK_SMP_TK_REQUEST_PASSKEY                           (1<<GAP_EVT_SMP_TK_REQUEST_PASSKEY)
+#define GAP_EVT_MASK_SMP_TK_REQUEST_OOB                                  (1<<GAP_EVT_SMP_TK_REQUEST_OOB)
+#define GAP_EVT_MASK_SMP_TK_NUMERIC_COMPARE                          (1<<GAP_EVT_SMP_TK_NUMERIC_COMPARE)
+
+#define GAP_EVT_MASK_ATT_EXCHANGE_MTU                                   (1<<GAP_EVT_ATT_EXCHANGE_MTU)
+#define GAP_EVT_MASK_GATT_HANDLE_VALUE_CONFIRM                          (1<<GAP_EVT_GATT_HANDLE_VALUE_CONFIRM)
+
+
+#define GAP_EVT_MASK_DEFAULT                                        ( GAP_EVT_MASK_SMP_TK_DISPLAY             | \
+                                                                      GAP_EVT_MASK_SMP_TK_REQUEST_PASSKEY   | \
+                                                                      GAP_EVT_MASK_SMP_TK_REQUEST_OOB        | \
+                                                                      GAP_EVT_MASK_ATT_EXCHANGE_MTU )
+
+
+#if(MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    ///Correct spelling errors, but need to be compatible with the previous version
+    #define GAP_EVT_MASK_SMP_PARING_BEAGIN                               GAP_EVT_MASK_SMP_PAIRING_BEGIN
+    #define GAP_EVT_MASK_SMP_PARING_SUCCESS                              GAP_EVT_MASK_SMP_PAIRING_SUCCESS
+    #define GAP_EVT_MASK_SMP_PARING_FAIL                                 GAP_EVT_MASK_SMP_PAIRING_FAIL
+#endif
+
+/**
+ * @brief      data structure of GAP event callback data
+ */
+typedef struct {
+    u16    connHandle;
+    u8    secure_conn;
+    u8    tk_method;
+} gap_smp_paringBeginEvt_t;
+
+
+typedef struct {
+    u16    connHandle;
+    u8    bonding;
+    u8    bonding_result;
+} gap_smp_paringSuccessEvt_t;
+
+typedef struct {
+    u16    connHandle;
+    u8  reason;
+} gap_smp_paringFailEvt_t;
+
+typedef struct {
+    u16    connHandle;
+    u8    re_connect;   //1: re_connect, encrypt with previous distributed LTK;   0: paring , encrypt with STK
+} gap_smp_connEncDoneEvt_t;
+
+typedef struct {
+    u16    connHandle;
+    u8    re_connect;   //1: re_connect, encrypt with previous distributed LTK;   0: paring , encrypt with STK
+} gap_smp_securityProcessDoneEvt_t;
+
+
+
+typedef struct {
+    u16    connHandle;
+    u32    tk_pincode;
+} gap_smp_TkDisplayEvt_t;
+
+typedef struct {
+    u16    connHandle;
+} gap_smp_TkReqPassKeyEvt_t;
+
+typedef struct {
+    u16    connHandle;
+    u16    peer_MTU;
+    u16    effective_MTU;
+} gap_gatt_mtuSizeExchangeEvt_t;
+
+
+
+
+
+
+/**
+ * @brief     GAP event callback function declaration
+ */
+typedef int (*gap_event_handler_t) (u32 h, u8 *para, int n);
+
+
+
+
+
+
+/**
+ * @brief      set event mask for specific gap event
+ * @param[in]  evtMask - event mask
+ * @return     none
+ */
+void     blc_gap_setEventMask(u32 evtMask);
+
+
+/**
+ * @brief      register public enter for all gap event callback
+ * @param[in]  handler - public enter function
+ * @return     none
+ */
+void     blc_gap_registerHostEventHandler (gap_event_handler_t  handler);
+
+
+
+
+
+#endif /* GAP_EVENT_H_ */
diff --git a/stack/ble/host/l2cap/l2cap.h b/stack/ble/host/l2cap/l2cap.h
new file mode 100644
index 0000000..933c9d5
--- /dev/null
+++ b/stack/ble/host/l2cap/l2cap.h
@@ -0,0 +1,141 @@
+/******************************************************************************
+ * @file     l2cap.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef STACK_BLE_L2CAP_L2CAP_H_
+#define STACK_BLE_L2CAP_L2CAP_H_
+
+
+
+
+#define    L2CAP_RX_BUFF_LEN_MAX              (256)
+//header(2)+l2cap_len(2)+cid(2)+Attribute_data[ATT_MTU]
+#define    ATT_RX_MTU_SIZE_MAX                    (250) //dft ATT_MTU_MAX: 250
+//l2cap buffer max: header(2)+l2cap_len(2)+cid(2)+ATT_MTU_MAX(250).
+
+
+
+
+/**
+ * @brief    Telink defined L2CAP connect update response callback
+ */
+typedef int (*l2cap_conn_update_rsp_callback_t) (u8 id, u16 result);
+
+
+
+
+typedef enum{
+    CONN_PARAM_UPDATE_ACCEPT = 0x0000,
+    CONN_PARAM_UPDATE_REJECT = 0x0001,
+}conn_para_up_rsp;
+
+
+
+
+/**
+ * @brief    This function is used to set connect request parameter for updating connect parameter
+ * @param    min_interval - connect interval minimum
+ * @param    max_interval - connect interval maximum
+ * @param    latency - connect latency
+ * @param    timeout - connect timeout
+ * @return    none.
+ */
+void        bls_l2cap_requestConnParamUpdate (u16 min_interval, u16 max_interval, u16 latency, u16 timeout);  //Slave
+
+
+/**
+ * @brief    This function is used to set the minimal time for send connect parameter update request after connect created
+ * @param    time_ms - the unit is millisecond
+ * @return    none.
+ */
+void        bls_l2cap_setMinimalUpdateReqSendingTime_after_connCreate(int time_ms);
+
+
+/**
+ * @brief    This function is used to register the function for handler L2CAP data
+ * @param    *p - the pointer direct to blc_l2cap_handler
+ * @return    none.
+ */
+void        blc_l2cap_register_handler (void *p);
+
+
+/**
+ * @brief    This function is used to handler L2CAP data
+ * @param    connHandle - connection handle
+ * @param    *p - the pointer of l2cap data
+ * @return    0
+ */
+int         blc_l2cap_packet_receive (u16 connHandle, u8 * p);
+
+
+/**
+ * @brief    This function is used to register the function to process L2CAP SIG CHANNEL packet
+ * @param    *p - the pointer of l2cap data
+ * @return    none.
+ */
+void         blc_l2cap_reg_att_sig_hander(void *p);//signaling pkt proc
+
+
+/**
+ * @brief    This function is used to register the function to process L2CAP ATTRIBUTE PROCTOCOL packet
+ * @param    *p - the pointer of l2cap data
+ * @return    none.
+ */
+void         blc_l2cap_reg_att_cli_hander(void *p);
+
+/**
+ * @brief    This function is used to send connect parameter update response
+ * @param    connHandle - connection handle
+ * @param    req_id - Request packet identifier
+ * @param    result - connect parameter update result
+ * @return    none.
+ */
+void          blc_l2cap_SendConnParamUpdateResponse(u16 connHandle, u8 req_id, conn_para_up_rsp result);
+
+
+/**
+ * @brief    This function is used to register the callback function for response connect parameter update
+ * @param    cb - the pointer of callback function
+ * @return    none.
+ */
+void         blc_l2cap_registerConnUpdateRspCb(l2cap_conn_update_rsp_callback_t cb);
+
+
+/**
+ * @brief        This function is used to initialize l2cap buffer to reassembly link lay PDU to SDU
+ * @param[in]    *pMTU_m_rx_buff - the pointer of rx buffer
+ * @param[in]    mtu_m_rx_size   - the size of rx buffer
+ * @param[in]    *pMTU_m_tx_buff - the pointer of tx buffer
+ * @param[in]    mtu_m_tx_size   - the size of tx buffer
+ * @return        none.
+ */
+void         blc_l2cap_initMtuBuffer(u8 *pMTU_rx_buff, u16 mtu_rx_size, u8 *pMTU_tx_buff, u16 mtu_tx_size);
+
+
+
+
+
+
+
+#endif /* STACK_BLE_L2CAP_L2CAP_H_ */
diff --git a/stack/ble/host/smp/smp.h b/stack/ble/host/smp/smp.h
new file mode 100644
index 0000000..cdaf020
--- /dev/null
+++ b/stack/ble/host/smp/smp.h
@@ -0,0 +1,293 @@
+/******************************************************************************
+ * @file     smp.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/#ifndef BLE_SMP_H_
+#define BLE_SMP_H_
+
+#include "stack/ble/ble_common.h"
+
+
+
+
+/** @addtogroup SMP first pairing or connecting back definition
+ * @{
+ */
+#define SMP_STANDARD_PAIR                               0
+#define SMP_FAST_CONNECT                                   1
+/** @} end of group SMP first pairing or connecting back */
+
+
+/** @addtogroup SMP pairing fail reason definition
+ * @{
+ */
+#define PAIRING_FAIL_REASON_PASSKEY_ENTRY            0x01
+#define PAIRING_FAIL_REASON_OOB_NOT_AVAILABLE        0x02
+#define PAIRING_FAIL_REASON_AUTH_REQUIRE            0x03
+#define PAIRING_FAIL_REASON_CONFIRM_FAILED            0x04
+#define PAIRING_FAIL_REASON_PAIRING_NOT_SUPPORTED    0x05
+#define PAIRING_FAIL_REASON_ENCRYPT_KEY_SIZE        0x06
+#define PAIRING_FAIL_REASON_CMD_NOT_SUPPORT            0x07 //-- core 4.2
+#define PAIRING_FAIL_REASON_UNSPECIFIED_REASON        0x08
+#define PAIRING_FAIL_REASON_REPEATED_ATTEMPT        0x09
+#define PAIRING_FAIL_REASON_INVALID_PARAMETER        0x0A
+#define PAIRING_FAIL_REASON_DHKEY_CHECK_FAIL        0x0B
+#define PAIRING_FAIL_REASON_NUMUERIC_FAILED            0x0C
+#define PAIRING_FAIL_REASON_BREDR_PAIRING            0x0D
+#define PAIRING_FAIL_REASON_CROSS_TRANSKEY_NOT_ALLOW    0x0E
+#define PAIRING_FAIL_REASON_PAIRING_TIEMOUT            0x80 //TLK defined
+#define PAIRING_FAIL_REASON_CONN_DISCONNECT            0x81 //TLK defined
+#define PAIRING_FAIL_REASON_SUPPORT_NC_ONLY         0x82 //TLK defined
+
+
+/** @} end of group SMP pairing fail reason */
+
+
+// "SecReq" refer to "security request"
+typedef enum {
+    SecReq_NOT_SEND = 0,   // do not send "security request" after link layer connection established
+    SecReq_IMM_SEND = BIT(0),   //"IMM" refer to immediate, send "security request" immediately after link layer connection established
+    SecReq_PEND_SEND = BIT(1),  //"PEND" refer to pending,  pending "security request" for some time after link layer connection established, when pending time arrived. send it
+}secReq_cfg;
+
+
+//See the Core_v5.0(Vol 3/Part C/10.2, Page 2067) for more information.
+typedef enum {
+    LE_Security_Mode_1_Level_1 = BIT(0),  No_Authentication_No_Encryption            = BIT(0), No_Security = BIT(0),
+    LE_Security_Mode_1_Level_2 = BIT(1),  Unauthenticated_Paring_with_Encryption     = BIT(1),
+    LE_Security_Mode_1_Level_3 = BIT(2),  Authenticated_Paring_with_Encryption         = BIT(2),
+    LE_Security_Mode_1_Level_4 = BIT(3),  Authenticated_LE_Secure_Connection_Paring_with_Encryption = BIT(3),
+
+    LE_Security_Mode_2_Level_1 = BIT(4),  Unauthenticated_Paring_with_Data_Signing     = BIT(4),
+    LE_Security_Mode_2_Level_2 = BIT(5),  Authenticated_Paring_with_Data_Signing    = BIT(5),
+
+    LE_Security_Mode_1 = (LE_Security_Mode_1_Level_1 | LE_Security_Mode_1_Level_2 | LE_Security_Mode_1_Level_3 | LE_Security_Mode_1_Level_4)
+}le_security_mode_level_t;
+
+
+typedef enum {
+    non_debug_mode     = 0,  // ECDH distribute private/public key pairs
+    debug_mode         = 1,  // ECDH use debug mode private/public key pairs
+} ecdh_keys_mode_t;
+
+
+typedef enum {
+    Non_Bondable_Mode = 0,
+    Bondable_Mode     = 1,
+}bonding_mode_t;
+
+
+//Paring Methods select
+//See the Core_v5.0(Vol 3/Part H/2.3) for more information.
+typedef enum {
+    LE_Legacy_Paring     = 0,   // BLE 4.0/4.2
+    LE_Secure_Connection = 1,   // BLE 4.2/5.0/5.1
+}paring_methods_t;
+
+
+
+typedef enum {
+    IO_CAPABILITY_UNKNOWN             = 0xff,
+    IO_CAPABILITY_DISPLAY_ONLY         = 0,
+    IO_CAPABILITY_DISPLAY_YES_NO     = 1,    IO_CAPABILITY_DISPLAY_YESNO = 1,
+    IO_CAPABILITY_KEYBOARD_ONLY     = 2,
+    IO_CAPABILITY_NO_INPUT_NO_OUTPUT= 3,     IO_CAPABILITY_NO_IN_NO_OUT     = 3,
+    IO_CAPABILITY_KEYBOARD_DISPLAY     = 4,
+} io_capability_t;
+
+
+
+/**
+ * @brief      This function is used to set the maximum number of devices that can be bound.
+ * @param[in]  device_num - Set the maximum number of devices that can be bound.
+ * @return     none.
+ */
+void         blc_smp_param_setBondingDeviceMaxNumber ( int device_num);
+
+
+/**
+ * @brief      This function is used to set security level.
+ * @param[in]  mode_level - The security level value can refer to the structure 'le_security_mode_level_t'.
+ * @return     none.
+ */
+void         blc_smp_setSecurityLevel(le_security_mode_level_t  mode_level);
+
+
+/**
+ * @brief      This function is used to enable ECDH to generate public key-private key pairs in advance.
+ * @param[in]  enable - 1: Turn on ECDH to generate public key-private key pairs in advance.
+ *                      0: Disable this mode.
+ * @return     none.
+ */
+void         blc_smp_preMakeEcdhKeysEnable(u8 enable);
+
+
+/**
+ * @brief      This function is used to set paring method.
+ * @param[in]  method - The paring method value can refer to the structure 'paring_methods_t'.
+ *                      0: LE legacy paring;
+ *                      1: LE secure connection
+ * @return     none.
+ */
+void         blc_smp_setParingMethods (paring_methods_t  method);       //select paring methods
+
+
+/**
+ * @brief      This function is used to set whether the device uses the ECDH DEBUG key.
+ * @param[in]  mode - The ECDH key mode value can refer to the structure 'ecdh_keys_mode_t'.
+ *                    0: non debug mode;
+ *                    1: debug mode.
+ * @return     none.
+ */
+void         blc_smp_setEcdhDebugMode(ecdh_keys_mode_t mode);
+
+
+/**
+ * @brief      This function is used to set bonding mode.
+ * @param[in]  mode - The bonding mode value can refer to the structure 'bonding_mode_t'.
+ *                    0: non bondable mode;
+ *                    1: bondable mode.
+ * @return     none.
+ */
+void         blc_smp_setBondingMode(bonding_mode_t mode);               //set bonding_mode
+
+
+/**
+ * @brief      This function is used to set if enable authentication MITM protection.
+ * @param[in]  MITM_en - 0: Disable MITM protection;
+ *                       1: Enable MITM protection.
+ * @return     none.
+ */
+void         blc_smp_enableAuthMITM (int MITM_en);
+
+
+/**
+ * @brief      This function is used to set if enable OOB authentication.
+ * @param[in]  OOB_en - 0: Disable OOB authentication;
+ *                      1: Enable OOB authentication.
+ * @return     none.
+ */
+void         blc_smp_enableOobAuthentication (int OOB_en);               //enable OOB authentication
+
+
+/**
+ * @brief      This function is used to set device's IO capability.
+ * @param[in]  ioCapablility - The IO capability's value can refer to the structure 'io_capability_t'.
+ * @return     none.
+ */
+void         blc_smp_setIoCapability (io_capability_t  ioCapablility);
+
+
+/**
+ * @brief      This function is used to set device's Keypress.
+ * @param[in]  keyPress_en - 0: Disable Keypress;
+ *                           1: Enable Keypress.
+ * @return     none.
+ */
+void         blc_smp_enableKeypress (int keyPress_en);
+
+
+/**
+ * @brief      This function is used to set device's security parameters.
+ * @param[in]  mode - The bonding mode value can refer to the structure 'bonding_mode_t'.
+ * @param[in]  MITM_en - 0: Disable MITM protection;  1: Enable MITM protection.
+ * @param[in]  OOB_en - 0: Disable OOB authentication; 1: Enable OOB authentication.
+ * @param[in]  keyPress_en - 0: Disable Keypress; 1: Enable Keypress.
+ * @param[in]  ioCapablility - The IO capability's value can refer to the structure 'io_capability_t'.
+ * @return     none.
+ */
+void         blc_smp_setSecurityParameters (bonding_mode_t mode, int MITM_en, int OOB_en,
+                                          int keyPress_en, io_capability_t ioCapablility);
+
+
+/**
+ * @brief      This function is used to set TK by OOB method.
+ * @param[in]  oobData - TK's value, size: 16 byte.
+ * @return     none.
+ */
+void         blc_smp_setTK_by_OOB (u8 *oobData);
+
+
+/**
+ * @brief      This function is used to check whether the PinCode needs to be input.
+ * @param[in]  none.
+ * @return     1: Need to enter PinCode
+ *                0: No need to enter PinCode
+ */
+int         blc_smp_isWaitingToSetPasskeyEntry(void);
+
+
+/**
+ * @brief      This function is used to check whether it is needed to confirm NC YES/NO.
+ * @param[in]  none.
+ * @return     1: Need to confirm NC YES/NO
+ *                0: No need to confirm NC YES/NO
+ */
+int         blc_smp_isWaitingToCfmNumericComparison(void);
+
+
+/**
+ * @brief      This function is used to set TK by passkey entry method.
+ * @param[in]  pinCodeInput - TK's value, input range [000000, 999999].
+ * @return     1:Succeed; 0:Failed.
+ */
+int         blc_smp_setTK_by_PasskeyEntry (u32 pinCodeInput);
+
+
+/**
+ * @brief      This function is used to set numeric compare confirm YES or NO.
+ * @param[in]  YES_or_NO - 1: numeric compare confirm YES;
+ *                         0: numeric compare confirm NO.
+ * @return     none.
+ */
+void        blc_smp_setNumericComparisonResult(bool YES_or_NO);
+
+
+//////////////////////////////////////////////////////////////////////////////////////
+#define PARING_FAIL_REASON_PASSKEY_ENTRY            PAIRING_FAIL_REASON_PASSKEY_ENTRY
+#define PARING_FAIL_REASON_OOB_NOT_AVAILABLE        PAIRING_FAIL_REASON_OOB_NOT_AVAILABLE
+#define PARING_FAIL_REASON_AUTH_REQUIRE                PAIRING_FAIL_REASON_AUTH_REQUIRE
+#define PARING_FAIL_REASON_CONFIRM_FAILED            PAIRING_FAIL_REASON_CONFIRM_FAILED
+#define PARING_FAIL_REASON_PARING_NOT_SUPPORTED        PAIRING_FAIL_REASON_PAIRING_NOT_SUPPORTED
+#define PARING_FAIL_REASON_ENCRYPT_KEY_SIZE            PAIRING_FAIL_REASON_ENCRYPT_KEY_SIZE
+#define PARING_FAIL_REASON_CMD_NOT_SUPPORT            PAIRING_FAIL_REASON_CMD_NOT_SUPPORT
+#define PARING_FAIL_REASON_UNSPECIFIED_REASON        PAIRING_FAIL_REASON_UNSPECIFIED_REASON
+#define PARING_FAIL_REASON_REPEATED_ATTEMPT            PAIRING_FAIL_REASON_REPEATED_ATTEMPT
+#define PARING_FAIL_REASON_INVALID_PARAMETER        PAIRING_FAIL_REASON_INVALID_PARAMETER
+#define PARING_FAIL_REASON_DHKEY_CHECK_FAIL            PAIRING_FAIL_REASON_DHKEY_CHECK_FAIL
+#define PARING_FAIL_REASON_NUMUERIC_FAILED            PAIRING_FAIL_REASON_NUMUERIC_FAILED
+#define PARING_FAIL_REASON_BREDR_PARING                PAIRING_FAIL_REASON_BREDR_PAIRING
+#define PARING_FAIL_REASON_CROSS_TRANSKEY_NOT_ALLOW    PAIRING_FAIL_REASON_CROSS_TRANSKEY_NOT_ALLOW
+#define PARING_FAIL_REASON_PARING_TIEMOUT            PAIRING_FAIL_REASON_PAIRING_TIEMOUT
+#define PARING_FAIL_REASON_CONN_DISCONNECT            PAIRING_FAIL_REASON_CONN_DISCONNECT
+#define PARING_FAIL_REASON_SUPPORT_NC_ONLY            PAIRING_FAIL_REASON_SUPPORT_NC_ONLY
+
+#define IO_CAPABLITY_DISPLAY_ONLY                    0x00
+#define IO_CAPABLITY_DISPLAY_YESNO                    0x01
+#define IO_CAPABLITY_KEYBOARD_ONLY                    0x02
+#define IO_CAPABLITY_NO_IN_NO_OUT                    0x03
+#define    IO_CAPABLITY_KEYBOARD_DISPLAY                0x04
+
+#define    blc_smp_setSecurityParameters                blc_smp_setSecurityParameters
+
+#endif /* BLE_SMP_H_ */
diff --git a/stack/ble/host/smp/smp_alg.h b/stack/ble/host/smp/smp_alg.h
new file mode 100644
index 0000000..9e2ba4c
--- /dev/null
+++ b/stack/ble/host/smp/smp_alg.h
@@ -0,0 +1,156 @@
+/******************************************************************************
+ * @file     smp_alg.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef SMP_ALG_H_
+#define SMP_ALG_H_
+
+
+
+
+/**
+ * @brief       This function is used to generate the confirm values
+ * @param[out]  c1: the confirm value,     little--endian.
+ * @param[in]   key: aes key,             little--endian.
+ * @param[in]   r: the plaintext,         little--endian.
+ * @param[in]   pres: packet buffer2,     little--endian.
+ * @param[in]   preq: packet buffer2,     little--endian.
+ * @param[in]   iat: initiate address type
+ * @param[in]   ia: initiate address,     little--endian.
+ * @param[in]   rat: response address type
+ * @param[in]   ra: response address,     little--endian.
+ * @return      none.
+ * @Note        Input data requires strict Word alignment
+ */
+void             blt_smp_alg_c1(unsigned char *c1, unsigned char key[16], unsigned char r[16], unsigned char pres[7], unsigned char preq[7], unsigned char iat, unsigned char ia[6], unsigned char rat, unsigned char ra[6]);
+
+/**
+ * @brief       This function is used to generate the STK during the LE legacy pairing process.
+ * @param[out]  *STK - the result of encrypt, little--endian.
+ * @param[in]   *key - aes key, little--endian.
+ * @param[in]   *r1 - the plaintext1, little--endian.
+ * @param[in]   *r2 - the plaintext2, little--endian.
+ * @return      none.
+ * @Note        Input data requires strict Word alignment
+ */
+void            blt_smp_alg_s1(unsigned char *stk, unsigned char key[16], unsigned char r1[16], unsigned char r2[16]);
+
+/**
+ * @brief        This function is used to compute confirm value by function f4
+ *                 ---  Ca: f4(U, V, X, Z) = AES-CMACX (U || V || Z)  ---
+ * @param[out]  r: the output of the confirm:128-bits, big--endian.
+ * @param[in]   u:     is the 256-bits,     big--endian.
+ * @param[in]   v:     is the 256-bits,    big--endian.
+ * @param[in]   x:  is the 128-bits,     big--endian.
+ * @param[in]   z:  is the 8-bits
+ * @return    none.
+ */
+void            blt_smp_alg_f4 (unsigned char *r, unsigned char u[32], unsigned char v[32], unsigned char x[16], unsigned char z);
+
+/**
+ * @brief    This function is used to generate the numeric comparison values during authentication
+ *             stage 1 of the LE Secure Connections pairing process by function g2
+ * @param[in]   u:     is the 256-bits,     big--endian.
+ * @param[in]   v:     is the 256-bits,     big--endian.
+ * @param[in]   x:  is the 128-bits,     big--endian.
+ * @param[in]   y:  is the 128-bits,     big--endian.
+ * @return    pincode value: 32-bits.
+ */
+unsigned int    blt_smp_alg_g2 (unsigned char u[32], unsigned char v[32], unsigned char x[16], unsigned char y[16]);
+
+/**
+ * @brief    This function is used to generate derived keying material in order to create the LTK
+ *             and keys for the commitment function f6 by function f5
+ * @param[out]  mac: the output of the MAC value:128-bits, big--endian.
+ * @param[out]  ltk: the output of the LTK value:128-bits, big--endian.
+ * @param[in]   w:     is the 256-bits,     big--endian.
+ * @param[in]   n1:    is the 128-bits,     big--endian.
+ * @param[in]   n2:    is the 128-bits,     big--endian.
+ * @param[in]   a1:    is the 56-bits,     big--endian.
+ * @param[in]   a2:    is the 56-bits,     big--endian.
+ * @return    none.
+ */
+void             blt_smp_alg_f5 (unsigned char *mac, unsigned char *ltk, unsigned char w[32], unsigned char n1[16], unsigned char n2[16],
+                                unsigned char a1[7], unsigned char a2[7]);
+
+/**
+ * @brief    This function is used to generate check values during authentication stage 2 of the
+ *             LE Secure Connections pairing process by function f6
+ * @param[out]  *e: the output of Ea or Eb:128-bits, big--endian.
+ * @param[in]   w:     is the 256-bits,     big--endian.
+ * @param[in]   n1:    is the 128-bits,     big--endian.
+ * @param[in]   n2:    is the 128-bits,     big--endian.
+ * @param[in]   a1:    is the 56-bits,     big--endian.
+ * @param[in]   a2:    is the 56-bits,     big--endian.
+ * @return    none.
+ */
+void             blt_smp_alg_f6 (unsigned char *e, unsigned char w[16], unsigned char n1[16], unsigned char n2[16],
+                                unsigned char r[16], unsigned char iocap[3], unsigned char a1[7], unsigned char a2[7]);
+
+/**
+ * @brief    This function is used to convert keys of a given size from one key type to another
+ *             key type with equivalent strength
+ * @param[out]  r: the output of h6:128-bits,     big--endian.
+ * @param[in]   w:     is the 128-bits,             big--endian.
+ * @param[in]   keyid:    is the 32-bits,         big--endian.
+ * @return    none.
+ */
+void             blt_smp_alg_h6 (unsigned char *r, unsigned char w[16], unsigned char keyid[4]);
+
+
+/**
+ * @brief    This function is used to convert keys of a given size from one key type to another
+ *             key type with equivalent strength
+ *             --- h7(SALT, W) = AES-CMACsalt(W) ---
+ * @param[out]  r: the output of h7:128-bits,     big--endian.
+ * @param[in]   salt: is the 128-bits,             big--endian.
+ * @param[in]   w:    is the 128-bits,             big--endian.
+ * @return    none.
+ */
+void             blt_smp_alg_h7 (unsigned char *r, unsigned char salt[16], unsigned char w[16]);
+
+
+/**
+ * @brief    This function is used to generate the Group Session Key (GSK) for encrypting or
+ *             decrypting payloads of an encrypted BIS.
+ *             --- h8(K, S, keyID) = AES-CMACik(keyID) ---
+ * @param[out]  r: the output of h8:128-bits,     big--endian.
+ * @param[in]   k: is the 128-bits,             big--endian.
+ * @param[in]   s: is the 128-bits,             big--endian.
+ * @param[in]   keyid: is the 32-bits,             big--endian.
+ * @return    none.
+ */
+void             blt_smp_alg_h8 (unsigned char *r, unsigned char k[16], unsigned char s[16], unsigned char keyId[4]);
+
+#if (LL_FEATURE_ENABLE_LL_PRIVACY)
+    void            blt_crypto_alg_prand(u8 prand[3]);
+
+    void            blt_crypto_alg_ah(const u8 irk[16], u8 r[3], u8 out[3]);
+#endif
+
+#endif /* SMP_ALG_H_ */
+
+
+
+
diff --git a/stack/ble/smp/smp_central.h b/stack/ble/host/smp/smp_central.h
similarity index 73%
rename from stack/ble/smp/smp_central.h
rename to stack/ble/host/smp/smp_central.h
index 3823ef2..6a81678 100644
--- a/stack/ble/smp/smp_central.h
+++ b/stack/ble/host/smp/smp_central.h
@@ -34,56 +34,27 @@
 #define SMP_CENTRAL_H_
 
 
-typedef struct{
-    u8  trigger_mask;
-    u8  smp_begin_flg;
-    u8  manual_smp_start;
-    u8  rsvd;
-}smp_trigger_t;
-
-
 
 typedef struct {  //82
     u8        flag;
     u8        peer_addr_type;  //address used in link layer connection
     u8        peer_addr[6];
 
-    u8        peer_key_size;
+    u8         peer_key_size;
     u8        peer_id_adrType; //peer identity address information in key distribution, used to identify
     u8        peer_id_addr[6];
 
 
-    u8        peer_ltk[16];      //peer_ltk[16]
+    u8         peer_ltk[16];      //peer_ltk[16]
     u8        random[8];  //8
-    u16       ediv;       //2
-    u8        rsvd[6];    //6
+    u16     ediv;       //2
+    u8         rsvd[6];    //6
 
     u8        peer_irk[16];
     u8        peer_csrk[16];
 
 }smp_m_param_save_t;
 
-
-
-
-//  6 byte slave_MAC   8 byte rand  2 byte ediv
-// 16 byte ltk
-#define PAIR_INFO_SECTOR_SIZE                    64
-
-#define PAIR_OFFSET_SLAVE_MAC                    2
-
-#define PAIR_OFFSET_RAND                         8
-#define PAIR_OFFSET_EDIV                         16
-#define PAIR_OFFSET_ATT                          18   //ATT handle
-#define PAIR_OFFSET_LTK                          32
-#define PAIR_OFFSET_IRK                          48
-
-#if (LL_MASTER_MULTI_CONNECTION)
-    #define    PAIR_SLAVE_MAX_NUM                        8
-#else
-    #define    PAIR_SLAVE_MAX_NUM                        1
-#endif
-
 typedef struct {
     u8 bond_mark;
     u8 adr_type;
@@ -91,8 +62,24 @@
 } mac_adr_t;
 
 
-#define FlAG_BOND               BIT(0)
-#define FLAG_FASTSMP            BIT(4)
+//  6 byte slave_MAC   8 byte rand  2 byte ediv
+// 16 byte ltk
+#define PAIR_INFO_SECTOR_SIZE                     64
+
+#define PAIR_OFFSET_SLAVE_MAC                     2
+
+#define PAIR_OFFSET_RAND                         8
+#define PAIR_OFFSET_EDIV                         16
+#define PAIR_OFFSET_ATT                             18   //ATT handle
+#define PAIR_OFFSET_LTK                             32
+#define PAIR_OFFSET_IRK                             48
+
+#if (LL_MASTER_MULTI_CONNECTION)
+    #define    PAIR_SLAVE_MAX_NUM                        8
+#else
+    #define    PAIR_SLAVE_MAX_NUM                        1
+#endif
+
 
 typedef struct {
     u8 curNum;
@@ -107,11 +94,11 @@
 
 
 
-#define SLAVE_TRIGGER_SMP_FIRST_PAIRING             0       //first pair, slave send security_request to trigger master's pairing&encryption
+#define SLAVE_TRIGGER_SMP_FIRST_PAIRING                0       //first pair, slave send security_request to trigger master's pairing&encryption
 #define MASTER_TRIGGER_SMP_FIRST_PAIRING            BIT(0)
 
-#define SLAVE_TRIGGER_SMP_AUTO_CONNECT              0       //auto connect, slave send security_request to trigger master's encryption
-#define MASTER_TRIGGER_SMP_AUTO_CONNECT             BIT(1)
+#define SLAVE_TRIGGER_SMP_AUTO_CONNECT                0       //auto connect, slave send security_request to trigger master's encryption
+#define MASTER_TRIGGER_SMP_AUTO_CONNECT                BIT(1)
 
 
 
@@ -143,10 +130,9 @@
 
 
 /************************* Stack Interface, user can not use!!! ***************************/
-void     blm_host_smp_procSecurityTrigger(u16 connHandle);
+
 
 int     blc_smp_central_init (void);
-void    bond_slave_flash_clean (void);
 
 
 #endif /* SMP_CENTRAL_H_ */
diff --git a/stack/ble/host/smp/smp_peripheral.h b/stack/ble/host/smp/smp_peripheral.h
new file mode 100644
index 0000000..eaea0eb
--- /dev/null
+++ b/stack/ble/host/smp/smp_peripheral.h
@@ -0,0 +1,62 @@
+/******************************************************************************
+ * @file     smp_peripheral.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef SMP_PERIPHERAL_H_
+#define SMP_PERIPHERAL_H_
+
+
+
+
+/**
+ * @brief      This function is used to initialize each parameter configuration of SMP, including the initialization of the binding area FLASH.
+ * @param[in]  none
+ * @return     0: Initialization failed;
+ *             1: initialization succeeded.
+ */
+int         blc_smp_peripheral_init (void);
+
+
+/**
+ * @brief      This function is used to configure whether the slave sends a Security Request to the master immediately after the connection or after the connection is pending_ms milliseconds, or does not send the Security Request.
+ * @param[in]  newConn_cfg - refer to "security request"
+ * @param[in]  re_conn_cfg - refer to "security request"
+ * @param[in]  pending_ms - Send a Security Request to the master after pending_ms milliseconds
+ * @return     none.
+ */
+void         blc_smp_configSecurityRequestSending( secReq_cfg newConn_cfg,  secReq_cfg re_conn_cfg, u16 pending_ms);
+
+
+/**
+ * @brief      This function is used to send a Security Request to the master.
+ * @param[in]  none
+ * @return     1: Push Security Request packet succeeded;
+ *             0: Push Security Request packet failed.
+ */
+int         blc_smp_sendSecurityRequest (void);
+
+
+
+
+#endif /* SMP_PERIPHERAL_H_ */
diff --git a/stack/ble/host/smp/smp_storage.h b/stack/ble/host/smp/smp_storage.h
new file mode 100644
index 0000000..7b1805a
--- /dev/null
+++ b/stack/ble/host/smp/smp_storage.h
@@ -0,0 +1,130 @@
+/******************************************************************************
+ * @file     smp.h_storage.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef SMP_STORAGE_H_
+#define SMP_STORAGE_H_
+
+
+
+
+#if (LL_FEATURE_ENABLE_LL_PRIVACY)
+/*
+ *  Address resolution is not supported by default. After pairing and binding, we need to obtain the central Address Resolution
+ *  feature value of the opposite end to determine whether the opposite end supports the address resolution function, and write
+ *  the result to smp_bonding_flg. Currently, we leave it to the user to obtain this feature.
+ */
+#define     IS_PEER_ADDR_RES_SUPPORT(peerAddrResSuppFlg)    (!(peerAddrResSuppFlg & BIT(7)))
+
+#endif
+
+
+
+typedef enum {
+    Index_Update_by_Pairing_Order = 0,     //default value
+    Index_Update_by_Connect_Order = 1,
+} index_updateMethod_t;
+
+
+/*
+ * smp parameter need save to flash.
+ */
+typedef struct {  //82
+    u8        flag;
+    u8        peer_addr_type;  //address used in link layer connection
+    u8        peer_addr[6];
+
+    u8         peer_key_size;
+    u8        peer_id_adrType; //peer identity address information in key distribution, used to identify
+    u8        peer_id_addr[6];
+
+
+    u8         own_ltk[16];      //own_ltk[16]
+    u8        peer_irk[16];
+    u8        local_irk[16];
+
+}smp_param_save_t;
+
+
+/**
+ * @brief      This function is used to get the number of currently bound devices.
+ * @param[in]  none.
+ * @return     The number of currently bound devices.
+ */
+u8            blc_smp_param_getCurrentBondingDeviceNumber(void);
+
+
+/**
+ * @brief      This function is used to configure the bonding storage address.
+ * @param[in]  addr - SMP bonding storage start address.
+ * @return     none.
+ */
+void         bls_smp_configParingSecurityInfoStorageAddr (int addr);
+
+
+/**
+ * @brief      This function is used to obtain device binding information based on Index.
+ * @param[in]  index - Device bonding index number.
+ * @param[out] smp_param_load - The value can refer to the structure 'smp_param_save_t'.
+ * @return     0: Failed to load binding information;
+ *             others: FLASH address of the information area.
+ */
+u32         bls_smp_param_loadByIndex(u8 index, smp_param_save_t* smp_param_load);
+
+
+/**
+ * @brief      This function is used to obtain binding information according to the master address and address type.
+ * @param[in]  device_num - Set the maximum number of devices that can be bound.
+ * @param[in]  adr_type - Address type.
+ * @param[in]  addr - Address.
+ * @param[out] smp_param_load - The value can refer to the structure 'smp_param_save_t'.
+ * @return     0: Failed to load binding information;
+ *             others: FLASH address of the information area.
+ */
+u32            bls_smp_param_loadByAddr(u8 addr_type, u8* addr, smp_param_save_t* smp_param_load);
+
+
+/**
+ * @brief      This function is used to configure the storage order of binding information.
+ * @param[in]  method - The storage order of binding info method value can refer to the structure 'index_updateMethod_t'.
+ *                      0: Index update by pairing order;
+ *                      1: Index update by connect order.
+ * @return     none.
+ */
+void        bls_smp_setIndexUpdateMethod(index_updateMethod_t method);
+
+
+/**
+ * @brief      This function is used for the slave device to clear all binding information stored in the local FLASH.
+ * @param[in]  none.
+ * @return     none.
+ */
+void        bls_smp_eraseAllParingInformation(void);
+
+#if (LL_FEATURE_ENABLE_LL_PRIVACY)
+int        blc_smp_setPeerAddrResSupportFlg(u32 flash_addr, u8 support);
+#endif
+
+
+#endif /* SMP_STORAGE_H_ */
diff --git a/stack/ble/l2cap/l2cap.h b/stack/ble/l2cap/l2cap.h
deleted file mode 100644
index 270ecc6..0000000
--- a/stack/ble/l2cap/l2cap.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/******************************************************************************
- * @file     l2cap.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#pragma  once
-
-
-
-// Response Timeout expired
-#define L2CAP_RTX_TIMEOUT_MS             2000
-
-#define NEXT_SIG_ID()                    ( ++l2capId == 0 ? l2capId = 1 : l2capId )
-
-
-#define L2CAP_PKT_HANDLER_SIZE           6
-
-
-// l2cap handler type
-#define L2CAP_CMD_PKT_HANDLER            0
-#define L2CAP_USER_CB_HANDLER            1
-
-
-
-
-
-#define L2CAP_CONNECTION_PARAMETER_ACCEPTED        0x0000
-#define L2CAP_CONNECTION_PARAMETER_REJECTED        0x0001
-
-
-
-//RF_LEN_MAX:255: MIC(4)+LL_MAX_LEN(251) => LL_MAX_LEN:l2cap_len(2)+cid(2)+ATT_MTU_MAX(247).
-//l2cap buffer max: dma(4)+header(2)+l2cap_len(2)+cid(2)+ATT_MTU_MAX(247).
-#define    L2CAP_RX_BUFF_LEN_MAX              300//260//257 = 10+247,align 4, here we use 260
-//dma(4)+header(2)+l2cap_len(2)+cid(2)+Attribute_data[ATT_MTU]
-#define    ATT_RX_MTU_SIZE_MAX                    (L2CAP_RX_BUFF_LEN_MAX - 10)
-
-#define TELINK_MTU_SIZE                      ATT_RX_MTU_SIZE_MAX
-
-#define L2CAP_RX_PDU_OFFSET                  12
-
-
-
-typedef struct{
-    u16     connParaUpReq_minInterval;
-    u16     connParaUpReq_maxInterval;
-    u16     connParaUpReq_latency;
-    u16     connParaUpReq_timeout;
-
-    u8        connParaUpReq_pending;
-    u8      rsvd[3];
-}para_up_req_t;
-
-extern _attribute_aligned_(4) para_up_req_t    para_upReq;
-
-
-
-
-typedef int (*l2cap_conn_update_rsp_callback_t) (u8 id, u16 result);
-
-
-
-
-typedef enum{
-    CONN_PARAM_UPDATE_ACCEPT = 0x0000,
-    CONN_PARAM_UPDATE_REJECT = 0x0001,
-}conn_para_up_rsp;
-
-
-
-
-/******************************* User Interface  ************************************/
-void        bls_l2cap_requestConnParamUpdate (u16 min_interval, u16 max_interval, u16 latency, u16 timeout);  //Slave
-
-void        bls_l2cap_setMinimalUpdateReqSendingTime_after_connCreate(int time_ms);
-
-void        blc_l2cap_register_handler (void *p);
-int         blc_l2cap_packet_receive (u16 connHandle, u8 * p);
-int         blc_l2cap_send_data (u16 cid, u8 *p, int n);
-
-void         blc_l2cap_reg_att_sig_hander(void *p);//signaling pkt proc
-
-void         blc_l2cap_reg_att_cli_hander(void *p);
-
-
-void          blc_l2cap_SendConnParamUpdateResponse(u16 connHandle, u8 req_id, conn_para_up_rsp result);
-void         blc_l2cap_registerConnUpdateRspCb(l2cap_conn_update_rsp_callback_t cb);
-
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-void         blt_update_parameter_request (void);
-ble_sts_t   blc_l2cap_pushData_2_controller (u16 connHandle, u16 cid, u8 *format, int format_len, u8 *pDate, int data_len);
-
-//Master
diff --git a/stack/ble/ll/ll.h b/stack/ble/ll/ll.h
deleted file mode 100644
index 3881b9a..0000000
--- a/stack/ble/ll/ll.h
+++ /dev/null
@@ -1,512 +0,0 @@
-/******************************************************************************
- * @file     ll.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#ifndef LL__H_
-#define LL__H_
-
-
-#include <stack/ble/ble_common.h>
-#include <stack/ble/blt_config.h>
-#include <stack/ble/hci/hci_const.h>
-#include <stack/ble/hci/hci_event.h>
-#include <stack/ble/hci/hci_cmd.h>
-#include <stack/ble/ll/ll_adv.h>
-#include <stack/ble/ll/ll_encrypt.h>
-#include <stack/ble/ll/ll_init.h>
-#include "stack/ble/ll/ll_conn/ll_master.h"
-#include <stack/ble/ll/ll_pm.h>
-#include <stack/ble/ll/ll_scan.h>
-#include "stack/ble/ll/ll_conn/ll_slave.h"
-#include <stack/ble/ll/ll_whitelist.h>
-
-
-#include "tl_common.h"
-#include "drivers.h"
-
-
-
-
-
-
-/////////////////////////////////////////////////////////////////////////////
-
-#if (MCU_CORE_TYPE == MCU_CORE_8278)
-//TX settle time
-
-#define         LL_ADV_TX_SETTLE                 81
-#define         LL_SCAN_TX_SETTLE                62
-#define         LL_SLAVE_TX_SETTLE               82
-#define         LL_MASTER_TX_SETTLE              83
-
-#define         LL_ADV_TX_STL_2M                 87
-#define         LL_ADV_TX_STL_CODED              119
-
-#define         LL_SLAVE_TX_STL_2M               89
-#define         LL_SLAVE_TX_STL_CODED            121
-
-#define         LL_MASTER_TX_STL_2M              90
-#define         LL_MASTER_TX_STL_CODED           122
-
-#else
-//TX settle time
-#define         LL_ADV_TX_SETTLE                 74
-#define         LL_SCAN_TX_SETTLE                56
-#define         LL_SLAVE_TX_SETTLE               75
-#define         LL_MASTER_TX_SETTLE              76
-
-#define         LL_ADV_TX_STL_2M                 84
-#define         LL_ADV_TX_STL_CODED              116
-
-#define         LL_SLAVE_TX_STL_2M               86
-#define         LL_SLAVE_TX_STL_CODED            118
-
-#define         LL_MASTER_TX_STL_2M              86
-#define         LL_MASTER_TX_STL_CODED           119
-#endif
-/////////////////////////////////////////////////////////////////////////////
-
-//ble link layer state
-#define            BLS_LINK_STATE_IDLE                0
-#define            BLS_LINK_STATE_ADV                 BIT(0)
-#define            BLS_LINK_STATE_SCAN                BIT(1)
-#define            BLS_LINK_STATE_INIT                BIT(2)
-#define            BLS_LINK_STATE_CONN                BIT(3)
-
-
-
-#define            BLE_STATE_BTX_S                    4
-#define            BLE_STATE_BTX_E                    5
-#define            BLE_STATE_BRX_S                    6
-#define            BLE_STATE_BRX_E                    7
-
-
-/////////////////////////////////////////////////////////////////////////////
-
-
-////////////////// Telink defined Event Callback  ////////////////////////
-typedef void (*blt_event_callback_t)(u8 e, u8 *p, int n);
-
-#define            BLT_EV_MAX_NUM                        20
-
-#define            BLT_EV_FLAG_ADV                     0
-#define            BLT_EV_FLAG_ADV_DURATION_TIMEOUT    1
-#define            BLT_EV_FLAG_SCAN_RSP                2
-#define            BLT_EV_FLAG_CONNECT                 3
-#define            BLT_EV_FLAG_TERMINATE               4
-#define            BLT_EV_FLAG_LL_REJECT_IND           5
-#define            BLT_EV_FLAG_RX_DATA_ABANDOM         6
-#define         BLT_EV_FLAG_PHY_UPDATE                 7
-#define            BLT_EV_FLAG_DATA_LENGTH_EXCHANGE    8
-#define            BLT_EV_FLAG_GPIO_EARLY_WAKEUP       9
-#define            BLT_EV_FLAG_CHN_MAP_REQ             10
-#define            BLT_EV_FLAG_CONN_PARA_REQ           11
-#define            BLT_EV_FLAG_CHN_MAP_UPDATE          12
-#define            BLT_EV_FLAG_CONN_PARA_UPDATE        13
-#define            BLT_EV_FLAG_SUSPEND_ENTER           14
-#define            BLT_EV_FLAG_SUSPEND_EXIT            15
-
-
-
-
-
-
-
-#define         EVENT_MASK_TERMINATE                 BIT(BLT_EV_FLAG_TERMINATE)
-#define         EVENT_MASK_RX_DATA_ABANDOM           BIT(BLT_EV_FLAG_RX_DATA_ABANDOM)
-#define         EVENT_MASK_CHN_MAP_REQ               BIT(BLT_EV_FLAG_CHN_MAP_REQ)
-#define         EVENT_MASK_CONN_PARA_REQ             BIT(BLT_EV_FLAG_CONN_PARA_REQ)
-#define         EVENT_MASK_CHN_MAP_UPDATE            BIT(BLT_EV_FLAG_CHN_MAP_UPDATE)
-#define         EVENT_MASK_CONN_PARA_UPDATE          BIT(BLT_EV_FLAG_CONN_PARA_UPDATE)
-#define         EVENT_MASK_PHY_UPDATE                BIT(BLT_EV_FLAG_PHY_UPDATE)
-#define         EVENT_MASK_DATA_LEN_UPDATE           BIT(BLT_EV_FLAG_DATA_LENGTH_EXCHANGE)
-
-
-#define         EVENT_MASK_CHN_SELECTION_ALGOTITHM    BIT(31)  //no event, only mask here
-
-//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
-
-
-
-#define            STOP_RF_STATE_MACHINE                    ( REG_ADDR8(0xf00) = 0x80 )
-
-//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
-#define         ADV_LEGACY_MASK                                         BIT(0)
-#define         ADV_EXTENDED_MASK                                       BIT(1)
-#define         SCAN_LEGACY_MASK                                        BIT(0)
-#define         SCAN_EXTENDED_MASK                                      BIT(1)
-
-
-
-
-my_fifo_t            blt_rxfifo;
-//u8                   blt_rxfifo_b[];
-
-my_fifo_t            blt_txfifo;
-//u8                   blt_txfifo_b[];
-//////////////////////////////////////
-
-
-typedef struct {
-    u8        macAddress_public[6];
-    u8        macAddress_random[6];   //host may set this
-}ll_mac_t;
-
-extern ll_mac_t  bltMac;
-
-typedef struct {
-    u8        adv_en;
-    u8        adv_extension_mask;
-    u8        adv_scanReq_connReq;
-    u8        phy_en;
-
-
-    u8        ll_recentAvgRSSI;
-    u8        scan_hci_cmd;
-    u8        tx_irq_proc_en;
-    u8        rsvd;
-
-    u8        md_max_nums;  //supported max md nums, default value: 0
-    u8        drop_rx_data;
-    u8        adv_version;
-    u8        adv_hci_cmd;
-
-    u8        local_chSel;   //default  0x00: CHANNAL_SELECTION_ALGORITHM_1
-    u8        peer_chSel;
-    u8        rsvd1;
-    u8        rsvd2;
-
-    u32     custom_access_code;
-
-#if (LE_AUTHENTICATED_PAYLOAD_TIMEOUT_SUPPORT_EN)
-    u32        tick_LE_Authenticated_Payload;    //timer start tick
-    u32        to_us_LE_Authenticated_Payload;    //timer threshold
-    u8        enable_LE_Authenticated_Payload;
-#endif
-} st_ll_para_t;
-
-extern _attribute_aligned_(4) st_ll_para_t  bltParam;
-
-
-typedef struct {
-    u16        connEffectiveMaxRxOctets;
-    u16        connEffectiveMaxTxOctets;
-    u16        connMaxRxOctets;
-    u16        connMaxTxOctets;
-    u16        connRemoteMaxRxOctets;
-    u16        connRemoteMaxTxOctets;
-    u16        supportedMaxRxOctets;
-    u16        supportedMaxTxOctets;
-
-    u8         connInitialMaxTxOctets;  //u8 is enough
-    u8         connMaxTxRxOctets_req;
-    u8         connRxDiff100;
-    u8         connTxDiff100;
-}ll_data_extension_t;
-
-extern _attribute_aligned_(4) ll_data_extension_t  bltData;
-
-typedef ble_sts_t (*ll_SetExtAdv_Enable_callback_t)(int en);
-extern ll_SetExtAdv_Enable_callback_t pFunc_ll_SetAdv_Enable;
-
-
-
-
-
-
-
-
-
-typedef int (*l2cap_handler_t) (u16 conn, u8 * p);
-extern l2cap_handler_t    blc_l2cap_handler;
-
-
-typedef int (*ll_host_mainloop_callback_t)(void);
-typedef int (*ll_enc_done_callback_t)(u16 connHandle);
-
-typedef void (*ll_irq_tx_callback_t)(void);
-
-typedef int (*ll_irq_rx_data_callback_t)(u8 *, u32);
-typedef int (*ll_irq_rx_post_callback_t)(void);
-
-typedef void (*ll_irq_systemTick_conn_callback_t)(void);
-
-
-typedef int (*blc_main_loop_data_callback_t)(u8 *);
-typedef int (*blc_main_loop_post_callback_t)(void);
-
-
-typedef int (*blc_main_loop_phyTest_callback_t)(void);
-
-
-typedef     int (*ll_conn_complete_handler_t)(u16 conn, u8 *p);
-typedef     int (*ll_conn_terminate_handler_t)(u16 conn, u8 *p);
-void         blc_ll_registerConnectionCompleteHandler(ll_conn_complete_handler_t  handler);
-void         blc_ll_registerConnectionTerminateHandler(ll_conn_terminate_handler_t  handler);
-
-
-
-typedef int (*blt_LTK_req_callback_t)(u16 handle, u8* rand, u16 ediv);
-
-
-
-extern my_fifo_t        hci_tx_fifo;
-
-extern u8             blt_state;
-extern st_ll_scan_t  blts;
-extern u32             blc_tlkEvent_pending;
-
-
-
-
-
-
-
-
-
-
-
-/******************************************************** User Interface  ************************************************************************/
-void        irq_blt_sdk_handler ();;
-int         blt_sdk_main_loop(void);
-
-void         blc_ll_initStandby_module (u8 *public_adr);
-
-ble_sts_t     blc_ll_setRandomAddr(u8 *randomAddr);
-
-
-ble_sts_t     blc_ll_readBDAddr(u8 *addr);
-
-static inline u8 blc_ll_getCurrentState(void)    {return blt_state;}
-
-u8             blc_ll_getLatestAvgRSSI(void);
-
-u16           blc_ll_setInitTxDataLength (u16 maxTxOct);   //core4.2 long data packet
-
-
-bool        blc_ll_isControllerEventPending(void);
-
-u8          blc_ll_getTxFifoNumber (void);
-
-void         blc_ll_initBasicMCU (void);
-
-// application
-void        bls_app_registerEventCallback (u8 e, blt_event_callback_t p);
-
-
-
-
-void         blc_ll_recoverDeepRetention(void);
-
-
-bool         blc_ll_isBrxBusy (void);
-
-void         blc_ll_init_max_md_nums(u8 num);
-
-
-static inline void  blc_ll_set_CustomedAdvScanAccessCode(u32 accss_code)
-{
-    bltParam.custom_access_code = accss_code;
-}
-
-
-
-
-/******************************************** Stack Interface, user can not use!!! *******************************************/
-void             blc_ll_setIdleState(void);
-ble_sts_t         blc_hci_le_getLocalSupportedFeatures(u8 *features);
-
-ble_sts_t         blc_hci_le_readBufferSize_cmd(u8 *pData);
-
-
-int             blc_ll_encrypted_data(u8*key, u8*plaintextData, u8* encrypteTextData);
-
-//core4.2 data extension
-void             blc_ll_initDataLengthExtension (void);
-ble_sts_t        blc_ll_exchangeDataLength (u8 opcode, u16 maxTxOct);
-ble_sts_t        blc_hci_setTxDataLength (u16 connHandle, u16 tx, u16 txtime);
-ble_sts_t        blc_hci_readSuggestedDefaultTxDataLength (u8 *tx, u8 *txtime);
-ble_sts_t        blc_hci_writeSuggestedDefaultTxDataLength (u16 tx, u16 txtime);
-ble_sts_t        blc_hci_receiveHostACLData(u16 connHandle, u8 PB_Flag, u8 BC_Flag, u8 *pData );
-
-
-
-void             blc_ll_registerHostMainloopCallback (ll_host_mainloop_callback_t cb);
-void             blc_ll_registerConnectionEncryptionDoneCallback(ll_enc_done_callback_t  cb);
-
-
-ble_sts_t          blc_hci_reset(void);
-
-int blm_send_acl_to_btusb (u16 conn, u8 *p);
-
-
-
-
-
-static inline void blc_ll_resetInfoRSSI(void)
-{
-    bltParam.ll_recentAvgRSSI = 0;
-}
-
-static inline void blc_ll_recordRSSI(u8 rssi)
-{
-    if(bltParam.ll_recentAvgRSSI == 0) {
-        bltParam.ll_recentAvgRSSI = rssi;
-    }
-    else {
-        bltParam.ll_recentAvgRSSI = (bltParam.ll_recentAvgRSSI + rssi) >> 1;
-    }
-}
-
-static inline u8*     blc_ll_get_macAddrRandom(void)
-{
-    return bltMac.macAddress_random;
-}
-
-static inline u8*     blc_ll_get_macAddrPublic(void)
-{
-    return bltMac.macAddress_public;
-}
-
-extern         volatile u8    ll_encryption_busy;
-static inline void  blc_ll_setEncryptionBusy(u8 enc_busy)
-{
-    ll_encryption_busy = enc_busy;
-}
-
-static inline int  blc_ll_isEncryptionBusy(void)
-{
-    return ll_encryption_busy;
-}
-
-static inline u8 blc_ll_get_connEffectiveMaxTxOctets(void)
-{
-    #if (LL_FEATURE_ENABLE_LE_DATA_LENGTH_EXTENSION)
-        return bltData.connEffectiveMaxTxOctets;
-    #else
-        return 27;
-    #endif
-}
-
-
-static inline void blt_ll_set_ble_access_code_adv(void)
-{
-    write_reg32 (0x800408, bltParam.custom_access_code ? bltParam.custom_access_code : 0xd6be898e);
-}
-
-
-
-
-/****************************** (ble1m,2m,500k,125k)RF RX/TX packet format ********************************************
-RF RX packet format:
-  b0          b3    b4         b5       b6   b(5+w) b(6+w) b(8+w) b(9+w) b(12+w)  b(13+w)    b(14+w)  b(15+w)                      b(16+w)
-*---------------*---------*-----------*------------*------------*---------------*-------------------*----------*--------------------------------------------------*
-|  DMA_len(4B)  | type(1B)| Rf_len(1B)| payload(wB)|   CRC(3B)  | time_stamp(4B)|  Fre_offset(2B)   | Rssi(1B) |           pkt status indicator(1B)               |
-| (b0,b1 valid) |        Header       |   Payload  |            |               |                   | rssi-110 |[0]:crc err;[1]:sfd err;[2]:ll err;[4]:pwr err;   |
-|               |<--           PDU              -->|            |               |                   |          |[4]:long range 125k;[6:5]:N/A;[7]:nordic NACK ind |
-*---------------*----------------------------------*------------*---------------*-------------------*----------*--------------------------------------------------*
-|<--- 4byte --->|<------ 2 byte ----->|<- Rf_len ->|<- 3 byte ->|<----------------------------------- 8 byte ---------------------------------------------------->|
-note:       b4       ->  type(1B): llid(2bit) nesn(1bit) sn(1bit) md(1bit).
-we can see: DMA_len     =   rx[0] = w(Rf_len)+13 = rx[5]+13.
-            CRC_OK      =   DMA_buffer[rx[0]+3] == 0x00 ? True : False.
-
-******
-RF TX packet format:
- b0          b3      b4         b5       b6   b(5+w)
-*---------------*----------*-----------*------------*
-|  DMA_len(4B)  | type(1B) | Rf_len(1B)| payload(wB)|
-| (b0,b1 valid) |         Header       |   Payload  |
-|               |<--               PDU           -->|
-*---------------*-----------------------------------*
-note:       b4      ->  type(1B): llid(2bit) nesn(1bit) sn(1bit) md(1bit).Here type only means that llid, other bit is automatically populated when sent by hardware
-we can see: DMA_len = rx[0]= w(Rf_len) + 2.
-********************************************************************************************/
-
-
-
-/************************************** Link Layer pkt format *********************************************************
-Link Layer pak format(BLE4.2 spec):
-*-------------*-------------------*-------------------------------*-------------------*
-| preamble(1B)| Access Address(4B)|          PDU(2~257B)          |      CRC(3B)      |
-|             |                   |  Header(2B) | payload(0~255B) |                   |
-*-------------*-------------------*-------------------------------*-------------------*
-1.ADV Channel, payload:0~37bytes = 6bytes AdvAdd + [maximum 31bytes adv packet payload]
-2.Data Channel, payload:0~255bytes = 0~251bytes + 4bytes MIC(may include MIC field)[The payload in ble4.2 can reach 251 bytes].
-  Protocol overhead: 10bytes(preamble\Access Address\Header\CRC) + L2CAP header 4bytes = 14bytes, all LL data contains 14 bytes of overhead,
-  For att, opCode is also needed, 1bytes + handle 2bytes = 3bytes, 251-4-3=[final 247-3bytes available to users].
-******
-Link Layer pak format(BLE4.0\4.1 spec):
-*-------------*-------------------*-------------------------------*-------------------*
-| preamble(1B)| Access Address(4B)|          PDU(2~39B)           |      CRC(3B)      |
-|             |                   |  Header(2B) | payload(0~37B)  |                   |
-*-------------*-------------------*-------------------------------*-------------------*
-1.ADV Channel, payload:0~37bytes = 6bytes AdvAdd + [maximum 31bytes adv packet payload]
-2.Data Channel, payload:0~31bytes = 0~27bytes + 4bytes MIC(may include MIC field)[The payload in ble4.0/4.1 is 27 bytes].
-  Protocol overhead: 10bytes(preamble\Access Address\Header\CRC) + L2CAP header 4bytes = 14bytes,all LL data contains 14 bytes of overhead,
-  For att, opCode is also needed, 1bytes + handle 2bytes = 3bytes, 27-4-3=[final 23-3bytes available to users]£¬This is why the default mtu size is 23 in the ble4.0 protocol.
-********************************************************************************************/
-
-
-/*********************************** Advertising channel PDU : Header *************************************************
-Header(2B):[Advertising channel PDU Header](BLE4.0\4.1 spec):
-*--------------*----------*------------*-------------*-------------*----------*
-|PDU Type(4bit)| RFU(2bit)| TxAdd(1bit)| RxAdd(1bit) |Length(6bits)| RFU(2bit)|
-*--------------*----------*------------*-------------*-------------*----------*
-public (TxAdd = 0) or random (TxAdd = 1).
-********************************************************************************************/
-
-
-/******************************************* Data channel PDU : Header ************************************************
-Header(2B):[Data channel PDU Header](BLE4.2 spec):(BLE4.0\4.1 spec):
-*----------*-----------*---------*----------*----------*-------------*----------*
-|LLID(2bit)| NESN(1bit)| SN(1bit)| MD(1bit) | RFU(3bit)|Length(5bits)| RFU(3bit)|
-*----------*-----------*---------*----------*----------*-------------*----------*
-******
-Header(2B):[Data channel PDU Header](BLE4.2 spec):
-*----------*-----------*---------*----------*----------*------------------------*
-|LLID(2bit)| NESN(1bit)| SN(1bit)| MD(1bit) | RFU(3bit)|       Length(8bits)    |
-*----------*-----------*---------*----------*----------*------------------------*
-start    pkt:  llid 2 -> 0x02
-continue pkt:  llid 1 -> 0x01
-control  pkt:  llid 3 -> 0x03
-*********************************************************************************************/
-
-
-/*********************************** DATA channel PDU ******************************************************************
-*------------------------------------- ll data pkt -------------------------------------------*
-|             |llid nesn sn md |  pdu-len   | l2cap_len(2B)| chanId(2B)|  opCode(1B)|data(xB) |
-| DMA_len(4B) |   type(1B)     | rf_len(1B) |       L2CAP header       |       value          |
-|             |          data_headr         |                        payload                  |
-*-------------*-----------------------------*-------------------------------------------------*
-*--------------------------------- ll control pkt ----------------------------*
-| DMA_len(4B) |llid nesn sn md |  pdu-len   | LL Opcode(1B) |  CtrData(0~22B) |
-|             |   type(1B)     | rf_len(1B) |               |      value      |
-|             |          data_headr         |            payload              |
-*-------------*-----------------------------*---------------------------------*
-*********************************************************************************************/
-
-
-
-
-#endif /* LL__H_ */
diff --git a/stack/ble/ll/ll_adv.h b/stack/ble/ll/ll_adv.h
deleted file mode 100644
index 9bb5c4f..0000000
--- a/stack/ble/ll/ll_adv.h
+++ /dev/null
@@ -1,148 +0,0 @@
-/******************************************************************************
- * @file     ll_adv.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ll_adv.h
- *
- *  Created on: 2017-3-7
- *      Author: Administrator
- */
-
-#ifndef LL_ADV_H_
-#define LL_ADV_H_
-
-#include "stack/ble/ble_format.h"
-#include "ll_whitelist.h"
-
-/* Advertising Maximum data length */
-#define         ADV_MAX_DATA_LEN                    31
-
-
-#define         BLS_FLAG_ADV_IN_SLAVE_MODE          BIT(6)
-
-#define         BLC_FLAG_STK_ADV                    BIT(24)
-
-
-
-
-
-
-
-
-
-typedef struct {
-    u8        adv_chn_mask;
-    u8        adv_duration_en;
-    u8        adv_type;
-    u8        adv_filterPolicy;
-
-    u8        T_SCAN_RSP_INTVL;
-    u8        own_addr_type;     //own_addr_type
-    u8        rsvd;
-    u8        advInt_rand;
-
-    u16       advInt_min;
-    u16       advInt_max;
-
-    u32        adv_interval;     // system tick
-    u32        adv_duration_us;
-    u32        adv_begin_tick;
-
-}st_ll_adv_t;
-
-
-
-extern _attribute_aligned_(4) st_ll_adv_t  blta;
-
-
-extern rf_packet_adv_t    pkt_adv;
-
-
-typedef int (*ll_adv2conn_callback_t)(u8 *, bool);   //rcvd conn_req, adv state to conn state
-extern     ll_adv2conn_callback_t ll_adv2conn_cb;
-
-
-typedef int  (*ll_module_adv_callback_t)(void);
-
-
-
-typedef int (*advertise_prepare_handler_t) (rf_packet_adv_t * p);
-
-
-extern u32  blc_rcvd_connReq_tick;
-
-
-
-/******************************* User Interface  ************************************/
-void         blc_ll_initAdvertising_module(u8 *public_adr);;
-
-
-ble_sts_t    bls_ll_setAdvData(u8 *data, u8 len);
-ble_sts_t    bls_ll_setScanRspData(u8 *data, u8 len);
-ble_sts_t    bls_ll_setAdvEnable(int adv_enable);
-
-u8             blt_set_adv_direct_init_addrtype(u8* cmdPara);
-
-ble_sts_t   bls_ll_setAdvParam( u16 intervalMin,  u16 intervalMax,  adv_type_t advType,                 own_addr_type_t ownAddrType,  \
-                                 u8 peerAddrType, u8  *peerAddr,    adv_chn_map_t     adv_channelMap,   adv_fp_type_t   advFilterPolicy);
-
-ble_sts_t     bls_ll_setAdvInterval(u16 intervalMin, u16 intervalMax);
-ble_sts_t     bls_ll_setAdvChannelMap(adv_chn_map_t adv_channelMap);
-ble_sts_t     bls_ll_setAdvFilterPolicy(adv_fp_type_t advFilterPolicy);
-
-ble_sts_t   bls_ll_setAdvDuration (u32 duration_us, u8 duration_en);
-
-
-void         blc_ll_setAdvCustomedChannel (u8 chn0, u8 chn1, u8 chn2);
-
-
-
-
-ble_sts_t   blc_ll_addAdvertisingInConnSlaveRole(void);
-ble_sts_t   blc_ll_removeAdvertisingFromConnSLaveRole(void);
-ble_sts_t   blc_ll_setAdvParamInConnSlaveRole( u8           *adv_data,  u8              advData_len, u8 *scanRsp_data,               u8 scanRspData_len,
-                                               adv_type_t  advType,   own_addr_type_t ownAddrType, adv_chn_map_t adv_channelMap, adv_fp_type_t advFilterPolicy);
-
-
-static inline u32     bls_ll_getConnectionCreateTime(void)
-{
-    return blc_rcvd_connReq_tick;
-}
-
-/************************* Stack Interface, user can not use!!! ***************************/
-ble_sts_t     bls_hci_le_setAdvParam(adv_para_t *para);
-ble_sts_t     bls_hci_le_readChannelMap(u16 connHandle, u8 *returnChannelMap);
-
-
-ble_sts_t     bls_ll_setAdvType(u8 advType);
-ble_sts_t     blt_set_adv_addrtype(u8* cmdPara);
-
-static inline u8     blt_ll_getOwnAddrType(void)
-{
-    return blta.own_addr_type;
-}
-
-
-#endif /* LL_ADV_H_ */
diff --git a/stack/ble/ll/ll_conn/ll_conn.h b/stack/ble/ll/ll_conn/ll_conn.h
deleted file mode 100644
index e427d1c..0000000
--- a/stack/ble/ll/ll_conn/ll_conn.h
+++ /dev/null
@@ -1,173 +0,0 @@
-/******************************************************************************
- * @file     ll_conn.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LL_CONN_H_
-#define LL_CONN_H_
-
-
-
-
-
-/******************************* Macro & Enumeration variables for Stack, user can not use!!!!  ********************************/
-
-/////////////////////////////////////////////////////////////////////////////
-#define        LMP_PROCEDURE_RESPONSE_TIMEOUT                        40000000 //40S LL response timeout
-
-
-/////////////////////////////////////////////////////////////////////////////
-#define         LL_ROLE_MASTER                                  0
-#define         LL_ROLE_SLAVE                                   1
-
-#define         BLM_CONN_HANDLE                                 BIT(7)
-#define         BLS_CONN_HANDLE                                 BIT(6)
-
-#define         HANDLE_STK_FLAG                                 BIT(15)
-
-/////////////////////////////////////////////////////////////////////////////
-#define         MAX_OCTETS_DATA_LEN_27                          27
-#define         MAX_OCTETS_DATA_LEN_EXTENSION                   251
-
-
-#define         LL_PACKET_OCTET_TIME(n)                         ((n) * 8 + 112)
-
-#define         DATA_LENGTH_REQ_PENDING                         1
-#define         DATA_LENGTH_REQ_DONE                            2
-
-/////////////////////////////////////////////////////////////////////////////
-#define         BLE_INVALID_CONNECTION_HANDLE                   0xffff
-#define         IS_CONNECTION_HANDLE_VALID(handle)              ( handle != BLE_INVALID_CONNECTION_HANDLE )
-
-
-/////////////////////////////////////////////////////////////////////////////
-#define         FLG_RF_CONN_DONE                                (FLD_RF_IRQ_CMD_DONE | FLD_RF_IRQ_FSM_TIMEOUT | FLD_RF_IRQ_FIRST_TIMEOUT | FLD_RF_IRQ_RX_TIMEOUT | FLD_RF_IRQ_RX_CRC_2)
-
-
-
-
-
-typedef struct {
-    u8        connState;
-    u8        conn_update;
-    u8        last_rf_len;
-    u8        conn_peer_sn;
-
-    u8        conn_rx_num;                  //RX number (regardless of CRC correct or wrong)
-    u8        conn_receive_packet;        //RX with CRC correct
-    u8        conn_receive_new_packet;    //RX with CRC correct & new SN
-    u8        rsvd1;
-
-    u8        rsvd2;
-    u8        conn_snnesn;
-    u8        conn_chnsel;
-    u8        chn_idx;
-
-    u8        conn_chn;
-    u8        conn_chn_hop;
-    u8        conn_chn_map[5];
-    u8        conn_chn_map_next[5];
-
-
-    u16        connHandle;
-    u16     channel_id;
-
-    u16        conn_inst;
-    u16        conn_inst_next;
-
-    u32        conn_tick;
-
-    u32        conn_access_code;
-    u32        conn_access_code_revert;
-    u32        conn_crc;
-
-    u8        chn_tbl[40];
-
-}st_ll_conn_t ;
-extern _attribute_aligned_(4) st_ll_conn_t        blttcon;
-extern st_ll_conn_t       *blt_pconn;
-
-
-typedef bool (*ll_push_fifo_handler_t) (int, u8 *);
-extern  ll_push_fifo_handler_t                ll_push_tx_fifo_handler;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/********************************  Macro & Enumeration variables for User *****************************************************/
-
-
-
-
-
-
-
-
-
-/********************************  User Interface  ****************************************************************************/
-void        blc_ll_initConnection_module(void);
-
-
-
-
-
-
-
-
-/*******************************  Stack Interface, user can not use!!! *******************************************************/
-
-int         blt_ll_connect_common(st_ll_conn_t *pc, rf_packet_connect_t * pInit);
-int         blt_ll_start_common  (st_ll_conn_t *pc);
-int         blt_ll_post_common   (st_ll_conn_t *pc);
-
-//encryption
-ble_sts_t     blc_hci_ltkRequestNegativeReply (u16 connHandle);
-ble_sts_t      blc_hci_ltkRequestReply (u16 connHandle,  u8*ltk);
-
-void         blc_ll_registerLtkReqEvtCb(blt_LTK_req_callback_t evtCbFunc);
-
-int          blt_ll_conn_main_loop_post(void);
-void        blc_procPendingEvent(void);
-
-
-ble_sts_t    blt_ll_unknown_rsp(u16 connHandle, u8 op_code );
-
-void         blt_ll_channelTable_calc(u8* chm, u8 hop, u8 *ptbl);
-
-
-#endif /* LL_CONN_H_ */
diff --git a/stack/ble/ll/ll_conn/ll_conn_csa.h b/stack/ble/ll/ll_conn/ll_conn_csa.h
deleted file mode 100644
index b191ab7..0000000
--- a/stack/ble/ll/ll_conn/ll_conn_csa.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/******************************************************************************
- * @file     ll_conn_csa.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LL_CONN_CSA_H_
-#define LL_CONN_CSA_H_
-
-
-
-/******************************* Macro & Enumeration variables for Stack, user can not use!!!!  ********************************/
-
-//See the Core_v5.0(Vol 6/Part B/4.5.8, "Data Channel Index Selection") for more information.
-typedef enum {
-    CHANNAL_SELECTION_ALGORITHM_1          =    0x00,
-    CHANNAL_SELECTION_ALGORITHM_2          =    0x01,
-} channel_algorithm_t;
-
-
-
-typedef u8 (*ll_chn_index_calc_callback_t)(u8*, u16, u16);
-extern ll_chn_index_calc_callback_t    ll_chn_index_calc_cb;
-
-
-
-
-
-
-/********************************  Macro & Enumeration variables for User *****************************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-
-/********************************  User Interface  ****************************************************************************/
-void blc_ll_initChannelSelectionAlgorithm_2_feature(void);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/*******************************  Stack Interface, user can not use!!! *******************************************************/
- u8 blc_calc_remapping_table(u8 chm[5]);
-
- u8 blc_ll_channel_index_calc_csa2(u8 chm[5], u16 event_cntr, u16 channel_id);
-
-
-
-
-#endif /* LL_CONN_CSA_H_ */
diff --git a/stack/ble/ll/ll_conn/ll_conn_phy.h b/stack/ble/ll/ll_conn/ll_conn_phy.h
deleted file mode 100644
index ab068fb..0000000
--- a/stack/ble/ll/ll_conn/ll_conn_phy.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/******************************************************************************
- * @file     ll_conn_phy.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LL_CONN_PHY_H_
-#define LL_CONN_PHY_H_
-
-
-#include "stack/ble/phy/phy.h"
-
-
-
-/******************************* Macro & Enumeration variables for Stack, user can not use!!!!  ********************************/
-#if (LL_FEATURE_ENABLE_LE_2M_PHY | LL_FEATURE_ENABLE_LE_CODED_PHY)
-
-ll_conn_phy_t*    blt_ll_get_conn_phy_ptr(u16 connHandle);
-extern _attribute_aligned_(4) ll_conn_phy_t blt_conn_phy;
-
-
-typedef int (*ll_conn_phy_update_callback_t)(void);
-typedef int (*ll_conn_phy_switch_callback_t)(void);
-
-extern     ll_conn_phy_update_callback_t    ll_conn_phy_update_cb;
-extern     ll_conn_phy_switch_callback_t    ll_conn_phy_swicth_cb;
-
-#endif
-
-
-
-
-
-
-
-
-
-
-
-
-
-/********************************  Macro & Enumeration variables for User *****************************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-
-/********************************  User Interface  ****************************************************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-
-/*******************************  Stack Interface, user can not use!!! *******************************************************/
-//2M/Coded PHY
-void         blt_ll_sendPhyReq(void);
-int         blt_ll_updateConnPhy(void);
-int         blt_ll_switchConnPhy(void);
-
-
-
-
-#endif /* LL_CONN_CSA_H_ */
diff --git a/stack/ble/ll/ll_conn/ll_master.h b/stack/ble/ll/ll_conn/ll_master.h
deleted file mode 100644
index 288c607..0000000
--- a/stack/ble/ll/ll_conn/ll_master.h
+++ /dev/null
@@ -1,227 +0,0 @@
-/******************************************************************************
- * @file     ll_master.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ll_master.h
- *
- *  Created on: 2017-3-8
- *      Author: Administrator
- */
-
-#ifndef LL_MASTER_H_
-#define LL_MASTER_H_
-
-
-
-#define            BLE_DATA_CHANNEL_EN              1
-#define            SYS_LINK_ADV_INTERVAL            500000
-#define            BLE_MASTER_CONNECTION_REQ        1
-#define            BLM_CONN_HANDLE_CANCEL           BIT(8)
-#define            BLM_CONN_MASTER_TERMINATE        BIT(4)
-#define            BLM_CONN_SLAVE_TERMINATE         BIT(5)
-#define            BLM_CONN_TERMINATE_SEND          BIT(0)
-
-#define            BLM_CONN_ENC_CHANGE              BIT(9)
-#define            BLM_CONN_ENC_REFRESH             BIT(10)
-#define            BLM_CONN_ENC_REFRESH_T           BIT(11)
-
-
-#define            MASTER_LL_ENC_OFF                0
-#define            MASTER_LL_ENC_REQ                1
-#define            MASTER_LL_ENC_RSP_T              2
-#define            MASTER_LL_ENC_START_REQ_T        3
-#define            MASTER_LL_ENC_START_RSP          4
-#define            MASTER_LL_ENC_START_RSP_T        5
-#define            MASTER_LL_ENC_PAUSE_REQ          6
-#define            MASTER_LL_ENC_PAUSE_RSP_T        7
-#define            MASTER_LL_ENC_PAUSE_RSP          8
-#define            MASTER_LL_REJECT_IND_T           9
-#define            MASTER_LL_ENC_SMP_INFO_S         10
-#define            MASTER_LL_ENC_SMP_INFO_E         11
-
-
-
-#define  BLM_WINSIZE              4
-#define  BLM_WINOFFSET            5
-
-#define  BLM_MID_WINSIZE          2500
-
-
-#define CONN_REQ_WAIT_ACK_NUM                6
-
-
-
-
-#define TX_FIFO_DEFINED_IN_APP                    1
-
-//#define            BLM_TX_FIFO_NUM                8
-#define         STACK_FIFO_NUM                2  //user 6, stack 2
-//#define            BLM_TX_FIFO_SIZE            40
-
-typedef struct {
-    u8        save_flg;
-    u8        sn_nesn;
-    u8        dma_tx_rptr;
-    u8        rsvd;
-}bb_msts_t;
-
-typedef struct {
-#if (!TX_FIFO_DEFINED_IN_APP)
-    u32        tx_fifo[BLM_TX_FIFO_NUM][BLM_TX_FIFO_SIZE>>2];
-    u8        tx_wptr;
-    u8        tx_rptr;
-    u8        rsvd00;
-    u8        rsvd01;
-#endif
-    u8        chn_tbl[40];
-
-    u8        newRx;
-    u8        tx_num;
-    u8        remoteFeatureReq;
-    u8        adv_filterPolicy;
-
-    u8        conn_Req_waitAck_enable;
-    u8        conn_terminate_reason;
-    u8        slave_terminate_conn_flag;
-    u8         master_terminate_conn_flag;
-
-    u8        conn_terminate_pending;   // terminate_pending = master_terminate || slave_terminate
-    u8        remote_version;
-    u8        connParaUpReq_pending;
-    u8        conn_sn; // softwre rcrd sn to filter retry rx data
-
-
-    u8        conn_btx_not_working;;
-    u8        conn_rcvd_slave_pkt;
-    u8        peer_adr_type;
-    u8        rsvdd;
-
-    u16        connHandle;
-    u8        peer_adr[6];
-    u8        macAddress_public[6];
-    u8        macAddress_random[6];   //host may set this
-
-
-    bb_msts_t blm_bb;// hardware rcrd sn nesn ect.
-
-    u32     ll_remoteFeature;      //feature mask <0:31>
-    //u32   ll_remoteFeature_2;  //feature mask <32:63> for future use
-
-    u32        conn_timeout;
-    u32        conn_interval;
-    u32        conn_software_timeout;
-
-    u32        conn_winsize_next;
-    u32        conn_timeout_next;
-    u32        conn_offset_next;
-    u32        conn_interval_next;
-
-    u16        conn_latency;
-    u16        conn_latency_next;
-
-
-    u32        conn_Req_noAck_timeout;
-
-    u16        enc_ediv;
-
-    u32        enc_ivs;
-    u8         enc_random[8];
-    u8         enc_skds[8];
-    ble_crypt_para_t    crypt;
-
-#if(BQB_5P0_TEST_ENABLE)
-    u32        master_terminate_time;
-#endif
-} st_ll_conn_master_t;
-
-
-
-
-
-/******************************* User Interface  ************************************/
-void blc_ll_initMasterRoleSingleConn_module(void);
-
-
-bool blm_ll_isRfStateMachineBusy(void);
-
-
-
-
-
-
-ble_sts_t  blm_hci_reset(void);
-
-ble_sts_t blm_ll_enc_proc_disconnect(u16 handle, u8 reason);
-
-ble_sts_t blm_ll_disconnect (u16 handle, u8 reason);
-
-ble_sts_t blm_ll_updateConnection (u16 connHandle,
-                              u16 conn_min, u16 conn_max, u16 conn_latency, u16 timeout,
-                              u16 ce_min, u16 ce_max );
-
-ble_sts_t blm_ll_setHostChannel (u16 handle, u8 * map);
-
-
-extern     int        blm_create_connection;
-
-
-
-
-rf_packet_l2cap_t * blm_l2cap_packet_pack (u16 conn, u8 * raw_pkt);
-
-
-st_ll_conn_master_t * blm_ll_getConnection (u16 h);
-
-bool blm_ll_deviceIsConnState (u8 addr_type, u8* mac_addr);
-
-//------------- ATT client function -------------------------------
-
-//------------- ATT service discovery function -------------------------------
-int blm_att_discoveryService (u16 connHandle, att_db_uuid16_t *p16, int n16, att_db_uuid128_t *p128, int n128);
-u16 blm_att_findHandleOfUuid16 (att_db_uuid16_t *p, u16 uuid, u16 ref);
-u16 blm_att_findHandleOfUuid128 (att_db_uuid128_t *p, const u8 * uuid);
-u16 blm_att_discoveryHandleOfUUID (u8 *l2cap_data, u8 *uuid128);
-
-
-//------------    master function -----------------------------------
-
-
-
-bool       blm_push_fifo (int connHandle, u8 *dat);
-
-void     blm_main_loop (void);
-
-
-//------------    master security function -------------------
-int  blm_ll_startEncryption (u8 connhandle ,u16 ediv, u8* random, u8* ltk);
-void blm_ll_startDistributeKey (u8 connhandle );
-
-
-int blm_l2cap_packet_receive (u16 conn, u8 * raw_pkt);
-
-ble_sts_t    blm_hci_receiveHostACLData(u16 connHandle, u8 PB_Flag, u8 BC_Flag, u8 *pData );
-
-ble_sts_t blm_ll_readRemoteFeature (u16 handle);
-#endif /* LL_MASTER_H_ */
diff --git a/stack/ble/ll/ll_conn/ll_slave.h b/stack/ble/ll/ll_conn/ll_slave.h
deleted file mode 100644
index 60e350a..0000000
--- a/stack/ble/ll/ll_conn/ll_slave.h
+++ /dev/null
@@ -1,243 +0,0 @@
-/******************************************************************************
- * @file     ll_slave.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ll_slave.h
- *
- *  Created on: 2017-3-9
- *      Author: Administrator
- */
-
-#ifndef LL_SLAVE_H_
-#define LL_SLAVE_H_
-
-
-
-
-#define                    SLAVE_LL_ENC_OFF                        0
-#define                    SLAVE_LL_ENC_REQ                        1
-#define                    SLAVE_LL_ENC_RSP_T                      2
-#define                    SLAVE_LL_ENC_START_REQ_T                3
-#define                    SLAVE_LL_ENC_START_RSP                  4
-#define                    SLAVE_LL_ENC_START_RSP_T                5
-#define                    SLAVE_LL_ENC_PAUSE_REQ                  6
-#define                    SLAVE_LL_ENC_PAUSE_RSP_T                7
-#define                    SLAVE_LL_ENC_PAUSE_RSP                  8
-#define                    SLAVE_LL_REJECT_IND_T                   9
-
-
-#define                 TRY_FIX_ERR_BY_ADD_BRX_WAIT                1
-
-
-
-typedef struct {
-    u8        time_update_st;
-    u8         last_rf_len;
-    u8        remoteFeatureReq;
-    u8         long_suspend;
-
-    u8        interval_level;
-    u8        ll_recentAvgRSSI;
-    u8        conn_sn_master;
-    u8        master_not_ack_slaveAckUpReq;
-
-    u8        conn_rcvd_ack_pkt;
-    u8        conn_new_param;
-    u8        conn_winsize_next;
-    u8        rsvd1;
-
-    u8         conn_master_terminate;
-    u8         conn_terminate_reason;
-    u8         conn_slave_terminate;
-    u8         conn_terminate_pending;   // terminate_pending = master_terminate || slave_terminate
-
-
-    u16        conn_update_inst_diff;
-    u16        connHandle;
-    u16        conn_offset_next;
-    u16        conn_interval_next; //standard value,  not * 1.25ms
-    u16        conn_latency_next;
-    u16        conn_timeout_next;  //standard value,  not *10ms
-
-
-    u32        conn_access_code_revert;
-    u32        connExpectTime;
-    int        conn_interval_adjust;
-    u32        conn_timeout;
-    u32        conn_interval;
-    u32        conn_latency;
-    u32        conn_duration;
-
-    u32     ll_remoteFeature;      //feature mask <0:31>,  not only one for BLE master, use connHandle to identify
-    //u32   ll_remoteFeature_2;  //feature mask <32:63> for future use
-
-    u32        conn_start_tick;
-
-    int        conn_tolerance_time;
-
-    u32        tick_1st_rx;
-    u32        conn_brx_tick;
-
-
-
-    u32     conn_slaveTerminate_time;
-
-
-    u32        conn_pkt_rcvd;
-    u32        conn_pkt_rcvd_no;
-    u8 *       conn_pkt_dec_pending;
-    int        conn_enc_dec_busy;
-    int        conn_stop_brx;
-
-    u32        conn_fsm_timeout;   // unit:  uS
-
-#if    (BQB_5P0_TEST_ENABLE)
-    u32        conn_establish_pending_timeout;;
-    u32        conn_establish_pending_flag;
-#endif
-
-
-} st_ll_conn_slave_t;
-
-
-
-
-typedef struct {
-    u8        save_flg;
-    u8        sn_nesn;
-    u8        rsvd1;
-    u8        rsvd2;
-
-#if (DEEP_RET_ENTRY_CONDITIONS_OPTIMIZATION_EN)
-    u8        dma_tx_rcvry_dat_depth;
-    u8        dma_tx_data_depth;
-
-    u16        dma_tx_ptr[8];//dma tx buffer ptr rcd
-#endif
-
-}bb_sts_t;
-
-extern _attribute_aligned_(4) bb_sts_t    blt_bb;
-extern _attribute_aligned_(4) st_ll_conn_slave_t        bltc;
-#define     IS_LL_CONNECTION_VALID(handle)  ( bltc.connHandle == (handle) && bltc.connHandle != BLE_INVALID_CONNECTION_HANDLE )
-
-
-
-
-
-
-/************************************ User Interface  ******************************************************/
-void         blc_ll_initSlaveRole_module(void);
-
-ble_sts_t      bls_ll_terminateConnection (u8 reason);
-
-bool        bls_ll_isConnectState (void);
-
-u16            bls_ll_getConnectionInterval(void);  // if return 0, means not in connection state
-u16            bls_ll_getConnectionLatency(void);     // if return 0, means not in connection state
-u16            bls_ll_getConnectionTimeout(void);     // if return 0, means not in connection state
-
-
-int         bls_ll_requestConnBrxEventDisable(void);
-void        bls_ll_disableConnBrxEvent(void);
-void        bls_ll_restoreConnBrxEvent(void);
-
-
-
-
-
-//ble module event
-ble_sts_t     bls_hci_mod_setEventMask_cmd(u32 evtMask);  //eventMask: module special
-
-
-
-
-/*********************************** Stack Interface, user can not use!!! ********************************/
-bool        bls_ll_pushTxFifo (int handle, u8 *p);
-ble_sts_t    bls_hci_reset(void);
-
-ble_sts_t    bls_hci_receiveHostACLData(u16 connHandle, u8 PB_Flag, u8 BC_Flag, u8 *pData );
-ble_sts_t    bls_hci_le_getRemoteSupportedFeatures(u16 connHandle);
-
-void        blt_push_fifo_hold (u8 *p);
-
-
-
-
-extern ble_crypt_para_t     blc_cyrpt_para;
-static inline int  bls_ll_isConnectionEncrypted(u16 connHandle)
-{
-    return blc_cyrpt_para.enable;
-}
-
-#if (TRY_FIX_ERR_BY_ADD_BRX_WAIT)
-    extern int CONN_SHORT_TOLERANCE_TIME;
-    static inline void blc_pm_modefy_brx_early_set(int us)
-    {
-        CONN_SHORT_TOLERANCE_TIME = us * sys_tick_per_us;
-    }
-
-    static inline int blc_pm_get_brx_early_time(void)
-    {
-        return CONN_SHORT_TOLERANCE_TIME;
-    }
-#endif
-
-/////////////////////// SN/NESN /////////////////////////////////////////////////////
-static inline void    blt_save_snnesn()
-{
-                                // SN                                    NESN
-    blt_bb.sn_nesn = ((REG_ADDR8(0xf22) & BIT(0)) << 4) | ((REG_ADDR8(0xf23) & BIT(4)) << 1);
-}
-
-static inline void    blt_restore_snnesn()
-{
-    reg_rf_ll_ctrl_1 &= ~(FLD_RF_BRX_SN_INIT | FLD_RF_BRX_NESN_INIT);
-    reg_rf_ll_ctrl_1 |= blt_bb.sn_nesn;
-}
-
-/////////////////////// DMA Tx fifo rptr /////////////////////////////////////////////
-extern     u8 blt_dma_tx_rptr;
-
-static inline void    blt_save_dma_tx_rptr()
-{
-    //TX Fifo: 0xc2a[0:3] means rptr
-    blt_dma_tx_rptr = reg_dma_tx_rptr & 0x0f;
-}
-
-static inline void    blt_restore_dma_tx_rptr()
-{
-    //0xc2a[6] rptr set
-    reg_dma_tx_rptr = (BIT(6) | blt_dma_tx_rptr);//restore tx_rptr
-}
-
-
-extern u8 extended_reject_en;
-static inline void blt_extended_reject_enable(u8 en){
-    extended_reject_en = en;
-}
-
-
-#endif /* LL_SLAVE_H_ */
diff --git a/stack/ble/ll/ll_encrypt.h b/stack/ble/ll/ll_encrypt.h
deleted file mode 100644
index 1db049c..0000000
--- a/stack/ble/ll/ll_encrypt.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/******************************************************************************
- * @file     ll_encrypt.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ble_ll_encrypt.h
- *
- *  Created on: 2016-9-22
- *      Author: Telink
- */
-
-#ifndef BLE_LL_ENCRYPT_H_
-#define BLE_LL_ENCRYPT_H_
-
-
-
-
-
-typedef struct {
-    u32        pkt;
-    u8        dir;
-    u8        iv[8];
-} ble_cyrpt_nonce_t;
-
-
-typedef struct {
-    u32                    enc_pno;
-    u32                    dec_pno;
-    u8                    sk[16];            //session key
-    ble_cyrpt_nonce_t    nonce;
-    u8                    st;
-    u8                    enable;            //1: slave enable; 2: master enable
-    u8                    mic_fail;
-} ble_crypt_para_t;
-
-#endif /* BLE_LL_ENCRYPT_H_ */
diff --git a/stack/ble/ll/ll_ext.h b/stack/ble/ll/ll_ext.h
deleted file mode 100644
index 1f902f9..0000000
--- a/stack/ble/ll/ll_ext.h
+++ /dev/null
@@ -1,563 +0,0 @@
-/******************************************************************************
- * @file     ll_ext.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-#ifndef LL_EXT_H_
-#define LL_EXT_H_
-
-#include "tl_common.h"
-
-#include <stack/ble/ble_common.h>
-#include <stack/ble/blt_config.h>
-#include <stack/ble/hci/hci_const.h>
-#include <stack/ble/hci/hci_event.h>
-#include <stack/ble/hci/hci_cmd.h>
-#include <stack/ble/ll/ll_adv.h>
-#include <stack/ble/ll/ll_encrypt.h>
-#include <stack/ble/ll/ll_init.h>
-#include <stack/ble/ll/ll_pm.h>
-#include <stack/ble/ll/ll_scan.h>
-#include "stack/ble/ll/ll_conn/ll_slave.h"
-#include "stack/ble/ll/ll_conn/ll_master.h"
-
-#include <stack/ble/ll/ll_whitelist.h>
-
-
-
-
-
-
-#define BLE_EXT_ADV_PROP_CONNECTABLE                             (0x0001)
-#define BLE_EXT_ADV_PROP_SCANNABLE                               (0x0002)
-#define BLE_EXT_ADV_PROP_DIRECTED                                (0x0004)
-#define BLE_EXT_ADV_PROP_HD_DIRECTED                             (0x0008)
-#define BLE_EXT_ADV_PROP_LEGACY                                  (0x0010)
-#define BLE_EXT_ADV_PROP_ANON_ADV                                (0x0020)
-#define BLE_EXT_ADV_PROP_INC_TX_PWR                              (0x0040)
-
-#define BLE_EXT_ADV_PROP_CONNECTABLE_SCANNABLE                   (0x0003)  // BLE_EXT_ADV_PROP_CONNECTABLE | BLE_EXT_ADV_PROP_SCANNABLE
-#define BLE_EXT_ADV_PROP_LEGACY_SCANNABLE                        (0x0012)  // BLE_EXT_ADV_PROP_LEGACY | BLE_EXT_ADV_PROP_SCANNABLE
-#define BLE_EXT_ADV_PROP_LEGACY_DIRECTED                         (0x0014)  // BLE_EXT_ADV_PROP_LEGACY | BLE_EXT_ADV_PROP_DIRECTED
-#define BLE_EXT_ADV_PROP_LEGACY_HD_DIRECTED                      (0x0018)  //BLE_EXT_ADV_PROP_LEGACY | BLE_EXT_ADV_PROP_HD_DIRECTED
-#define BLE_EXT_ADV_PROP_LEGACY_CONNECTABLE_SCANNABLE            (0x0013)  // BLE_EXT_ADV_PROP_LEGACY | BLE_EXT_ADV_PROP_CONNECTABLE | BLE_EXT_ADV_PROP_SCANNABLE
-
-
-
-
-
-
-
-
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 advA[6];            //address
-    u8 data[31];            //0-31 byte
-}rf_pkt_pri_scanrsp_t;
-
-
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 data[253];   //Extended Header + AdvData
-}rf_pkt_ext_adv_t;
-#define MAX_LENGTH_SECOND_ADV_PKT                264   //sizeof(rf_pkt_ext_adv_t) = 261
-
-
-
-
-/******************************************************  ADV_EXT_IND ************************************************************
-                                                AdvA  TargetA  ADI      Aux    Sync    Tx   ACAD    AdvData            Structure
-                                                                        Ptr      Info   Power
-Non-Connectable
-Non-Scannable   Undirected without AUX               M         X        X       X     X        X       X     X            rf_pkt_adv_ext_ind_1
-
-Non-Connectable
-Non-Scannable   Undirected with    AUX             X           X        M       M     X        X       X     X            rf_pkt_adv_ext_ind_2
-
-Non-Connectable
-Non-Scannable    Directed   without AUX             M         M        X       X     X        X       X     X            rf_pkt_adv_ext_ind_1
-
-Non-Connectable
-Non-Scannable    Directed   with       AUX             X          X        M       M     X        X       X     X            rf_pkt_adv_ext_ind_2
-
-
-Connectable     Undirected                          X         X        M       M     X        X       X     X            rf_pkt_adv_ext_ind_2
-
-Connectable     Directed                          X         X        M       M     X        X       X     X            rf_pkt_adv_ext_ind_2
-
-Scannable         Undirected                          X         X        M       M     X        X       X     X            rf_pkt_adv_ext_ind_2
-
-Scannable         Directed                          X         X        M       M     X        X       X     X            rf_pkt_adv_ext_ind_2
-*******************************************************************************************************/
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-    u8 targetA[6];
-}rf_pkt_adv_ext_ind_1;
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    //ADI
-    u16 did    :12;
-    u16 sid    : 4;
-
-    //AuxPrt
-    u8 chn_index    :6;
-    u8 ca              :1;
-    u8 offset_unit    :1;
-    u16 aux_offset  :13;
-    u16 aux_phy        :3;
-
-}rf_pkt_adv_ext_ind_2;
-
-
-
-
-/******************************************************  AUX_ADV_IND ************************************************************
-                                                AdvA  TargetA  ADI      Aux    Sync    Tx   ACAD    AdvData
-                                                                        Ptr      Info   Power
-Non-Connectable
-Non-Scannable   Undirected with    AUX             M           X        M       O     X        X       X     O            rf_pkt_aux_adv_ind_1
-
-Non-Connectable
-Non-Scannable    Directed   with       AUX             M          M        M       O     X        X       X     O            rf_pkt_aux_adv_ind_2
-
-Connectable     Undirected                          M         X        M       X     X        X       X     O            rf_pkt_aux_adv_ind_1
-
-Connectable     Directed                          M         M        M       X     X        X       X     O            rf_pkt_aux_adv_ind_2
-
-Scannable         Undirected                          M         X        M       X     X        X       X     X            rf_pkt_aux_adv_ind_1
-
-Scannable         Directed                          M         M        M       X     X        X       X     X            rf_pkt_aux_adv_ind_2
-*******************************************************************************************************/
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-
-    //ADI
-    u16 did    :12;
-    u16 sid    : 4;
-
-    u8 dat[1];   // AuxPtr/AdvData
-}rf_pkt_aux_adv_ind_1;
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-    u8 targetA[6];
-
-    //ADI
-    u16 did    :12;
-    u16 sid    : 4;
-
-    u8 dat[1]; // AuxPtr/AdvData
-}rf_pkt_aux_adv_ind_2;
-
-
-
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-
-    //ADI
-    u16 did    :12;
-    u16 sid    : 4;
-
-    //AuxPrt
-    u8 chn_index    :6;
-    u8 ca              :1;
-    u8 offset_unit    :1;
-    u16 aux_offset  :13;
-    u16 aux_phy        :3;
-
-    u8 dat[1];   // AdvData
-}rf_pkt_aux_adv_ind_3;
-
-
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-    u8 targetA[6];
-
-    //ADI
-    u16 did    :12;
-    u16 sid    : 4;
-
-    //AuxPrt
-    u8  chn_index    :6;
-    u8  ca              :1;
-    u8  offset_unit    :1;
-    u16 aux_offset  :13;
-    u16 aux_phy        :3;
-
-    u8 dat[1]; // AdvData
-}rf_pkt_aux_adv_ind_4;
-
-
-
-/******************************************************  AUX_SCAN_RSP ***********************************************************
-
-                                                AdvA  TargetA  ADI      Aux    Sync    Tx   ACAD    AdvData
-                                                                        Ptr      Info   Power
-
-                                                          M         X        X       O     X        X       X     M
-*******************************************************************************************************/
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-    u8 dat[1];   // AuxPtr/AdvData
-}rf_pkt_aux_scan_rsp_t;
-
-#define MAX_ADVDATA_NUM_AUX_SCANRSP                                    247   // 255 - 8( Extended Header Length(1) + Extended Header Flag(1) + AdvA(6) ) = 247
-
-
-
-
-/******************************************************  AUX_CHAIN_IND ***********************************************************
-
-                                                AdvA  TargetA  ADI      Aux    Sync    Tx   ACAD    AdvData
-                                                                        Ptr      Info   Power
-
-        Chained data:                              X         X        C3       O     X        O       X     O
-
-                                                                        ||
-                                                                        ||
-                                                                                \||/
-                                                                        \/
-
-Chained data after AUX_ADV_IND  :                 X         X        M       O     X        X       X     O            rf_pkt_aux_chain_ind_1
-
-Chained data after AUX_SCAN_RSP :                 X         X        X       O     X        X       X     O            rf_pkt_aux_chain_ind_2
-*******************************************************************************************************/
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-
-    //ADI
-    u16 did    :12;
-    u16 sid    : 4;
-
-    u8 dat[1]; // AuxPrt/AdvData
-}rf_pkt_aux_chain_ind_1;
-
-#define MAX_ADVDATA_NUM_AUX_CHAIN_IND_1                                    251   // 255 - 4( Extended Header Length(1) + Extended Header Flag(1) + ADI(2) ) = 251
-
-
-
-
-
-
-
-
-/******************************************************  AUX_CONNECT_RSP *********************************************************
-
-                                                AdvA  TargetA  ADI      Aux    Sync    Tx   ACAD    AdvData
-                                                                        Ptr      Info   Power
-
-                                                          M         M        X       X     X        X       X     X
-*******************************************************************************************************/
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 ext_hdr_len     :6;
-    u8 adv_mode        :2;
-
-    u8 ext_hdr_flg;
-
-    u8 advA[6];
-    u8 targetA[6];
-}rf_pkt_aux_conn_rsp_t;
-
-
-
-
-/****************************************************  SCAN_REQ / AUX_SCAN_REQ **************************************************
-
-*******************************************************************************************************/
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8 rf_len;
-
-    u8 scanA[6];
-    u8 advA[6];
-}rf_pkt_ext_scan_req_t;
-
-
-typedef struct {
-
-
-
-} st_ll_ext_t;
-
-extern st_ll_ext_t  bltExtPara;
-
-
-
-
-/********************* Macro & Enumeration variables for Stack, user can not use!!!!  **********************/
-#define BLE_LL_EXT_ADV_ADVA_BIT                                 BIT(0)
-#define BLE_LL_EXT_ADV_TARGETA_BIT                              BIT(1)
-#define BLE_LL_EXT_ADV_RFU_BIT                                  BIT(2)
-#define BLE_LL_EXT_ADV_DATA_INFO_BIT                            BIT(3)
-#define BLE_LL_EXT_ADV_AUX_PTR_BIT                              BIT(4)
-#define BLE_LL_EXT_ADV_SYNC_INFO_BIT                            BIT(5)
-#define BLE_LL_EXT_ADV_TX_POWER_BIT                             BIT(6)
-
-
-
-#define BLE_LL_EXT_ADV_MODE_NON_CONN_NON_SCAN                   (0x00)
-#define BLE_LL_EXT_ADV_MODE_CONN                                (0x01)        //connectable, none_scannable
-#define BLE_LL_EXT_ADV_MODE_SCAN                                (0x02)      //scannable,   none_connectable
-
-
-
-
-#define    EXT_ADV_PDU_AUXPTR_OFFSET_UNITS_30_US                    0
-#define    EXT_ADV_PDU_AUXPTR_OFFSET_UNITS_300_US                   1
-
-#define    EXT_ADV_PDU_AUXPTR_CA_51_500_PPM                         0
-#define    EXT_ADV_PDU_AUXPTR_CA_0_50_PPM                           1
-
-
-
-
-#define TLK_T_MAFS                                                    302  // T_MAFS >= 300 uS, add some margin
-#define TLK_T_MAFS_30US_NUM                                           10
-
-#define TX_TX_DELAY_US                                                120 // TX settle(74 uS) + 5  preamble(40uS) + some other baseband cost,   and be 30*N
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/******************************* Macro & Enumeration variables for User ************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/************************************ User Interface  ******************************************************/
-
-
-
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-
-
-
-
-
-
-
-
-
-
-#endif /* LL_EXT_H_ */
diff --git a/stack/ble/ll/ll_ext_adv.h b/stack/ble/ll/ll_ext_adv.h
deleted file mode 100644
index f63d431..0000000
--- a/stack/ble/ll/ll_ext_adv.h
+++ /dev/null
@@ -1,314 +0,0 @@
-/******************************************************************************
- * @file     ll_ext_adv.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LL_ADV_EXT_H_
-#define LL_ADV_EXT_H_
-
-
-#include <stack/ble/ble_common.h>
-#include <stack/ble/blt_config.h>
-#include <stack/ble/hci/hci_const.h>
-#include <stack/ble/hci/hci_event.h>
-#include <stack/ble/hci/hci_cmd.h>
-#include <stack/ble/ll/ll_ext.h>
-#include <stack/ble/ll/ll_adv.h>
-#include <stack/ble/ll/ll_whitelist.h>
-#include <stack/ble/phy/phy.h>
-
-#include "tl_common.h"
-
-
-
-
-#define    INVALID_ADVHD_FLAG                                        0xFF
-
-
-#define AUX_ADV_FEA            BIT(0)
-#define PER_ADV_FEA            BIT(1)
-
-
-
-
-/* Advertising_Handle */
-#define ADV_HANDLE0                                                0x00
-#define ADV_HANDLE1                                                0x01
-#define ADV_HANDLE2                                                0x02
-#define ADV_HANDLE3                                                0x03
-
-
-
-
-/* Advertising_Handle */
-#define ADV_SID_0                                                0x00
-#define ADV_SID_1                                                0x01
-#define ADV_SID_2                                                0x02
-#define ADV_SID_3                                                0x03
-
-
-
-/* Advertising Event Properties
- * See the Core_v5.0(Vol 2/Part E/7.8.53 & Vol 6/Part B/4.4.2/Table 4.1) for more information
-*/
-typedef enum{
-  ADV_EVT_PROP_LEGACY_CONNECTABLE_SCANNABLE_UNDIRECTED                            = 0x0013,        //  0001 0011'b     ADV_IND
-  ADV_EVT_PROP_LEGACY_CONNECTABLE_DIRECTED_LOW_DUTY                            = 0x0015,        //  0001 0101'b        ADV_DIRECT_IND(low duty cycle)
-  ADV_EVT_PROP_LEGACY_CONNECTABLE_DIRECTED_HIGH_DUTY                          = 0x001D,        //  0001 1101'b        ADV_DIRECT_IND(high duty cycle)
-  ADV_EVT_PROP_LEGACY_SCANNABLE_UNDIRECTED                                        = 0x0012,        //  0001 0010'b        ADV_SCAN_IND
-  ADV_EVT_PROP_LEGACY_NON_CONNECTABLE_NON_SCANNABLE_UNDIRECTED                = 0x0010,        //  0001 0000'b        ADV_NONCONN_IND
-
-
-  ADV_EVT_PROP_EXTENDED_NON_CONNECTABLE_NON_SCANNABLE_UNDIRECTED            = 0x0000,        //  0000 0000'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
-  ADV_EVT_PROP_EXTENDED_CONNECTABLE_UNDIRECTED                                  = 0x0001,        //  0000 0001'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
-  ADV_EVT_PROP_EXTENDED_SCANNABLE_UNDIRECTED                                = 0x0002,        //  0000 0010'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
-  ADV_EVT_PROP_EXTENDED_NON_CONNECTABLE_NON_SCANNABLE_DIRECTED                = 0x0004,        //  0000 0100'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
-  ADV_EVT_PROP_EXTENDED_CONNECTABLE_DIRECTED                                   = 0x0005,        //  0000 0101'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
-  ADV_EVT_PROP_EXTENDED_SCANNABLE_DIRECTED                                    = 0x0006,        //  0000 0110'b        ADV_EXT_IND + AUX_ADV_IND/AUX_CHAIN_IND
-
-
-  ADV_EVT_PROP_EXTENDED_MASK_ANONYMOUS_ADV         = 0x0020,  //if this mask on(only extended ADV event can mask it), anonymous advertising
-  ADV_EVT_PROP_EXTENDED_MASK_TX_POWER_INCLUDE    = 0x0040,  //if this mask on(only extended ADV event can mask it), TX power include
-
-}adv_event_prop_t;
-
-
-
-
-
-
-
-
-
-
-typedef struct{
-    u32 dma_len;
-
-    u8 type   :4;
-    u8 rfu1   :1;
-    u8 chan_sel:1;
-    u8 txAddr :1;
-    u8 rxAddr :1;
-
-    u8  rf_len;
-    u8  advA[6];            //address
-    u8  data[31];            //0-31 byte
-}rf_pkt_pri_adv_t;
-#define MAX_LENGTH_PRIMARY_ADV_PKT                44   //sizeof(rf_pkt_pri_adv_t) = 43
-
-
-
-
-
-
-typedef struct{
-    u8 chn_ind        :6;
-    u8 ca            :1;
-    u8 off_unit        :1;
-    u16 aux_off        :13;
-    u16 aux_phy        :3;
-} aux_ptr_t;
-
-
-
-
-
-
-
-//NOTE: this data structure must 4 bytes aligned
-typedef struct
-{
-    u8         adv_handle;
-    u8         extAdv_en;
-    u8         adv_chn_mask;
-    u8         adv_chn_num;
-
-    u8         own_addr_type;
-    u8         peer_addr_type;
-    u8         pri_phy;
-    u8         sec_phy;
-
-
-    u8         max_ext_adv_evt;
-    u8         run_ext_adv_evt;
-    u8         unfinish_advData;
-    u8         unfinish_scanRsp;
-
-
-    u8         adv_filterPolicy;
-    u8         scan_req_noti_en;
-    u8         coding_ind;                    //s2 or s8
-    u8         param_update_flag;
-
-
-    u8         with_aux_adv_ind;   //ADV_EXT_IND  with AUX_ADV_IND
-    u8         with_aux_chain_ind;
-    u8         rand_adr_flg;
-    u8         adv_sid;
-
-
-    // u8         s_adv_max_skip;
-
-
-    u16     adv_did;     // BIT<11:0>
-    u16     evt_props;
-    u16     advInt_use;
-    u16     send_dataLen;
-    u16     maxLen_advData;            //for each ADV sets, this value can be different to save SRAM
-    u16     curLen_advData;
-    u16     maxLen_scanRsp;            //for each ADV sets, this value can be different to save SRAM
-    u16     curLen_scanRsp;
-
-    u16     send_dataLenBackup;
-    u16     rsvd_16_1;
-
-
-    u32     adv_duration_tick;
-    u32     adv_begin_tick;                //24
-    u32     adv_event_tick;
-
-    u8*        dat_extAdv;
-    u8*        dat_scanRsp;                //Scan response data.
-    rf_pkt_pri_adv_t*        primary_adv;
-    rf_pkt_ext_adv_t*        secondary_adv;
-
-    u8         rand_adr[6];
-    u8         peer_addr[6];
-}ll_ext_adv_t;
-
-
-#define ADV_SET_PARAM_LENGTH                (sizeof(ll_ext_adv_t))   //sizeof(ll_ext_adv_t) =  ,  must 4 byte aligned
-
-
-
-
-#if 0
-//    u16     advInt_min;
-//    u16     advInt_max;
-    u8         periodicAdv_en;
-    u16     maxLen_periodicAdv;
-    u16     curLen_periodicAdv;
-    u8*        dat_periodicAdv;
-    u8 adv_secondary_chan;
-    s8 adv_tx_pow;
-#endif
-
-
-
-
-
-
-typedef struct
-{
-    u8        maxNum_advSets;
-    u8        useNum_advSets;
-    u8        last_advSet;
-    u8        last_advHand;
-
-
-    u8         T_SCAN_RSP_INTVL;
-    u8         custom_aux_chn;
-    u8         T_AUX_RSP_INTVL; //settle aux_scan_rsp/aux_conn_rsp's IFS 150s
-    u8         rsvd3;
-
-    u32        rand_delay;
-
-}ll_adv_mng_t;
-
-
-
-
-
-
-
-
-
-
-
-
-/******************************************** User Interface  ********************************************************************/
-//initialization
-void         blc_ll_initExtendedAdvertising_module(    u8 *pAdvCtrl, u8 *pPriAdv,int num_sets);
-
-void         blc_ll_initExtSecondaryAdvPacketBuffer(u8 *pSecAdv, int sec_adv_buf_len);
-
-void         blc_ll_initExtAdvDataBuffer(u8 *pExtAdvData, int max_len_advData);                                //set AdvData buffer for all adv_set
-void         blc_ll_initExtAdvDataBuffer_by_advHandle(u8 *pExtAdvData, u8 advHandle, int max_len_advData);  //set AdvData buffer for specific adv_set
-
-void         blc_ll_initExtScanRspDataBuffer(u8 *pScanRspData, int max_len_scanRspData);
-void         blc_ll_initExtScanRspDataBuffer_by_advHandle(u8 *pScanRspData,  u8 advHandle, int max_len_scanRspData);
-
-
-
-//Set Extended ADV parameters
-ble_sts_t    blc_ll_setAdvRandomAddr(u8 advHandle, u8* rand_addr);
-
-
-ble_sts_t     blc_ll_setExtAdvParam(  u8 advHandle,                      adv_event_prop_t adv_evt_prop, u32 pri_advIntervalMin,         u32 pri_advIntervalMax,
-                                    u8 pri_advChnMap,                 own_addr_type_t ownAddrType,     u8 peerAddrType,             u8  *peerAddr,
-                                    adv_fp_type_t advFilterPolicy,  tx_power_t adv_tx_pow,            le_phy_type_t pri_adv_phy,     u8 sec_adv_max_skip,
-                                    le_phy_type_t sec_adv_phy,          u8 adv_sid,                     u8 scan_req_noti_en);
-ble_sts_t    blc_ll_setExtAdvData    (u8 advHandle, data_oper_t operation, data_fragm_t fragment_prefer, u8 adv_dataLen,     u8 *advdata);
-ble_sts_t    blc_ll_setExtScanRspData(u8 advHandle, data_oper_t operation, data_fragm_t fragment_prefer, u8 scanRsp_dataLen, u8 *scanRspData);
-ble_sts_t    blc_ll_setExtAdvEnable_1(u32 extAdv_en, u8 sets_num, u8 advHandle,      u16 duration,       u8 max_extAdvEvt);
-ble_sts_t    blc_ll_setExtAdvEnable_n(u32 extAdv_en, u8 sets_num, u8 *pData);
-
-
-ble_sts_t    blc_ll_removeAdvSet(u8 advHandle);
-ble_sts_t    blc_ll_clearAdvSets(void);
-
-
-// if Coded PHY is used, this API set default S2/S8 mode for Extended ADV
-void        blc_ll_setDefaultExtAdvCodingIndication(u8 advHandle, le_ci_prefer_t prefer_CI);
-
-
-void        blc_ll_setAuxAdvChnIdxByCustomers(u8 aux_chn);
-void        blc_ll_setMaxAdvDelay_for_AdvEvent(u8 max_delay_ms);    //unit: mS, only 8/4/2/1/0  available
-
-
-/****************************************** Stack Interface, user can not use!!! *************************************************/
-ble_sts_t     blc_hci_le_setExtAdvParam( hci_le_setExtAdvParam_cmdParam_t *para, u8 *pTxPower);
-ble_sts_t     blc_hci_le_setExtAdvEnable(u8 extAdv_en, u8 sets_num, u8 *pData);
-
-u16           blc_ll_readMaxAdvDataLength(void);
-u8            blc_ll_readNumberOfSupportedAdvSets(void);
-
-
-int          blt_ext_adv_proc(void);
-int          blt_send_adv2(void);
-int          blt_send_legacy_adv(void);
-int          blt_send_extend_adv(void);
-void         blt_send_extend_no_aux_adv(void);
-int          blt_send_aux_adv(void);
-ble_sts_t    blt_ll_clearAdvSets(void);
-void         blt_clearAdvSetsParam(ll_ext_adv_t        *pEadv);
-u8           blt_ll_searchExistingAdvSet(u8 advHandle);
-u8           blt_ll_searchAvailableAdvSet(u8 advHandle);
-void         blt_ll_updateAdvState(void);
-ble_sts_t    blt_ll_enableExtAdv(int adv_en);
-void         blt_ll_procAuxConnectReq(u8 * prx);
-int          blt_ll_updateAdvPacket(void);
-void         blt_ll_reset_ext_adv(void);
-
-#endif /* LL_ADV_EXT_H_ */
diff --git a/stack/ble/ll/ll_ext_scan.h b/stack/ble/ll/ll_ext_scan.h
deleted file mode 100644
index cbe8dde..0000000
--- a/stack/ble/ll/ll_ext_scan.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/******************************************************************************
- * @file     ll_ext_scan.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LL_SCAN_EXT_H_
-#define LL_SCAN_EXT_H_
-
-#include <stack/ble/ble_common.h>
-#include <stack/ble/blt_config.h>
-#include <stack/ble/hci/hci_const.h>
-#include <stack/ble/hci/hci_event.h>
-#include <stack/ble/hci/hci_cmd.h>
-#include <stack/ble/ll/ll_adv.h>
-#include <stack/ble/ll/ll_encrypt.h>
-#include <stack/ble/ll/ll_init.h>
-#include <stack/ble/ll/ll_pm.h>
-#include <stack/ble/ll/ll_scan.h>
-#include <stack/ble/ll/ll_whitelist.h>
-#include "stack/ble/ll/ll_conn/ll_slave.h"
-#include "stack/ble/ll/ll_conn/ll_master.h"
-
-
-#include "tl_common.h"
-#include "drivers.h"
-
-
-/******************************************** User Interface  ********************************************************************/
-ble_sts_t blc_ll_setExtScanParam_1_phy (own_addr_type_t  ownAddrType,     scan_fp_type_t scanFilterPolicy,    u8    scan_phys,
-                                        scan_type_t      scanType,        u16            scan_interval,         u16 scan_window);
-
-ble_sts_t blc_hci_le_setExtScanEnable (scan_en_t  extScan_en,     dupFilter_en_t filter_duplicate,    u16 duration,    u16 period);
-
-
-
-/****************************************** Stack Interface, user can not use!!! *************************************************/
-
-ble_sts_t blc_hci_le_setExtScanParam (own_addr_type_t  ownAddrType,     scan_fp_type_t scanFilterPolicy,    u8 scan_phys,    u8 *pData);
-
-
-#endif /* LL_SCAN_EXT_H_ */
diff --git a/stack/ble/ll/ll_pm.h b/stack/ble/ll/ll_pm.h
deleted file mode 100644
index 55583de..0000000
--- a/stack/ble/ll/ll_pm.h
+++ /dev/null
@@ -1,125 +0,0 @@
-/******************************************************************************
- * @file     ll_pm.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ll_pm.h
- *
- *  Created on: 2017-3-7
- *      Author: Administrator
- */
-
-#ifndef LL_PM_H_
-#define LL_PM_H_
-
-#ifndef     BLS_USER_TIMER_WAKEUP_ENABLE
-#define        BLS_USER_TIMER_WAKEUP_ENABLE    1
-#endif
-
-
-////////////////// Power Management ///////////////////////
-#define            SUSPEND_DISABLE                0
-#define            SUSPEND_ADV                    BIT(0)
-#define            SUSPEND_CONN                   BIT(1)
-#define            DEEPSLEEP_RETENTION_ADV        BIT(2)
-#define            DEEPSLEEP_RETENTION_CONN       BIT(3)
-#define            MCU_STALL                      BIT(6)
-
-
-
-
-
-typedef struct {
-    u8      suspend_mask;
-    u8      wakeup_src;
-    u8      conn_no_suspend;
-    u8      timer_wakeup;
-
-    u8      latency_off;
-    u8      no_latency;
-    u16     latency_en;
-
-    u16     sys_latency;
-    u16     user_latency;
-    u16     valid_latency;
-    u16     latency_use;
-
-    u32     deepRet_advThresTick;
-    u32     deepRet_connThresTick;
-    u32     deepRet_earlyWakeupTick;
-
-    u8      deepRt_en;
-    u8      deepRet_type;
-    u8      appWakeup_en;
-    u8      appWakeup_flg;
-
-    u8      appWakeup_loop_noLatency;
-    u8      timing_miss;
-    u8      timing_synced;
-    u8      rsvd;
-
-    u32     appWakeup_tick;
-
-    u32     current_wakeup_tick; //The system wake-up tick of the actual transfer of the cpu_sleep_wakeup function.
-
-    u16     pm_border_flag;
-    u16     rsvd1;
-
-}st_ll_pm_t;
-
-extern _attribute_aligned_(4) st_ll_pm_t  bltPm;
-
-
-typedef     void (*ll_module_pm_callback_t)(void);
-
-
-typedef     void (*pm_appWakeupLowPower_callback_t)(int);
-
-
-
-
-/******************************* User Interface  ************************************/
-void         blc_ll_initPowerManagement_module(void);
-
-
-void         bls_pm_setSuspendMask (u8 mask);
-u8           bls_pm_getSuspendMask (void);
-void         bls_pm_setWakeupSource(u8 source);
-u32          bls_pm_getSystemWakeupTick(void);
-
-void         bls_pm_setManualLatency(u16 latency); //manual set latency to save power
-
-void         bls_pm_setAppWakeupLowPower(u32 wakeup_tick, u8 enable);
-void         bls_pm_registerAppWakeupLowPowerCb(pm_appWakeupLowPower_callback_t cb);
-
-void         blc_pm_setDeepsleepRetentionThreshold(u32 adv_thres_ms, u32 conn_thres_ms);
-void         blc_pm_setDeepsleepRetentionEarlyWakeupTiming(u32 earlyWakeup_us);
-void         blc_pm_setDeepsleepRetentionType(SleepMode_TypeDef sleep_type);
-
-/************************* Stack Interface, user can not use!!! ***************************/
-
-
-
-
-#endif /* LL_PM_H_ */
diff --git a/stack/ble/ll/ll_scan.h b/stack/ble/ll/ll_scan.h
deleted file mode 100644
index f3ebec1..0000000
--- a/stack/ble/ll/ll_scan.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/******************************************************************************
- * @file     ll_scan.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ll_scan.h
- *
- *  Created on: 2017-3-7
- *      Author: Administrator
- */
-
-#ifndef LL_SCAN_H_
-#define LL_SCAN_H_
-
-
-#include "ll_whitelist.h"
-
-
-
-#define            BLS_FLAG_SCAN_ENABLE                     BIT(0)
-
-
-#define            BLS_FLAG_SCAN_IN_ADV_MODE                BIT(5)
-#define            BLS_FLAG_SCAN_IN_SLAVE_MODE              BIT(6)
-
-
-
-
-
-
-
-typedef struct {
-    u8        scan_en;
-    u8        scan_type;
-    u8        scan_filterPolicy;
-    u8        filter_dup;
-
-    u8        scanDevice_num;
-    u8        scanRspDevice_num;
-    u8        scan_extension_mask;
-    u8         rsvd;
-//    s8        T_SCAN_REQ_INTVL;
-
-
-
-    //u32        scan_interval;
-}st_ll_scan_t;
-
-_attribute_aligned_(4) st_ll_scan_t  blts;
-
-u32        blts_scan_interval;
-
-extern             rf_packet_scan_req_t    pkt_scan_req;
-
-
-typedef int (*ll_procScanPkt_callback_t)(u8 *, u8 *, u32);
-typedef int (*ll_procScanDat_callback_t)(u8 *);
-
-extern ll_procScanDat_callback_t  blc_ll_procScanDatCb;
-extern ll_procScanPkt_callback_t  blc_ll_procScanPktCb;
-
-
-
-
-
-/******************************* User Interface  ************************************/
-void         blc_ll_initScanning_module(u8 *public_adr);
-
-
-ble_sts_t     blc_ll_setScanParameter (scan_type_t scan_type, u16 scan_interval, u16 scan_window, own_addr_type_t  ownAddrType, scan_fp_type_t scanFilter_policy);
-ble_sts_t     blc_ll_setScanEnable (scan_en_t scan_enable, dupFilter_en_t filter_duplicate);
-
-
-
-ble_sts_t    blc_ll_addScanningInAdvState(void);
-ble_sts_t    blc_ll_removeScanningFromAdvState(void);
-ble_sts_t    blc_ll_addScanningInConnSlaveRole(void);
-ble_sts_t    blc_ll_removeScanningFromConnSLaveRole(void);
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-int            blc_ll_filterAdvDevice (u8 type, u8 * mac);
-int         blc_ll_addScanRspDevice(u8 type, u8 *mac);
-bool         blc_ll_isScanRspReceived(u8 type, u8 *mac);
-void         blc_ll_clearScanRspDevice(void);
-
-
-int          blc_ll_procScanPkt(u8 *raw_pkt, u8 *new_pkt, u32 tick_now);
-int          blc_ll_procScanData(u8 *raw_pkt);
-
-void         blc_ll_switchScanChannel (int, int);
-
-
-#endif /* LL_SCAN_H_ */
diff --git a/stack/ble/ll/ll_whitelist.h b/stack/ble/ll/ll_whitelist.h
deleted file mode 100644
index ec96519..0000000
--- a/stack/ble/ll/ll_whitelist.h
+++ /dev/null
@@ -1,213 +0,0 @@
-/******************************************************************************
- * @file     ll_whitelist.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ll_whitelist.h
- *
- *  Created on: 2016-9-22
- *      Author: Administrator
- */
-
-#ifndef LL_WHITELIST_H_
-#define LL_WHITELIST_H_
-
-#include <stack/ble/ble_common.h>
-
-
-
-
-
-#define      MAX_WHITE_LIST_SIZE                    4
-
-#if (RAMCODE_OPTIMIZE_CONN_POWER_NEGLECT_ENABLE || BLS_BLE_RF_IRQ_TIMING_EXTREMELY_SHORT_EN)
-    #define     MAX_WHITE_IRK_LIST_SIZE              1   //save ramcode
-#else
-    #define     MAX_WHITE_IRK_LIST_SIZE              2   //save ramcode
-#endif
-
-
-#define     IRK_REVERT_TO_SAVE_AES_TMIE_ENABLE        1
-
-
-#define        MAC_MATCH8(md,ms)     (md[0]==ms[0] && md[1]==ms[1] && md[2]==ms[2] && md[3]==ms[3] && md[4]==ms[4] && md[5]==ms[5])
-#define        MAC_MATCH16(md,ms)    (md[0]==ms[0] && md[1]==ms[1] && md[2]==ms[2])
-#define        MAC_MATCH32(md,ms)    (md[0]==ms[0] && md[1]==ms[1])
-
-
-//adv filter policy
-#define     ALLOW_SCAN_WL                                BIT(0)
-#define     ALLOW_CONN_WL                                BIT(1)
-
-
-typedef enum {
-    ADV_FP_ALLOW_SCAN_ANY_ALLOW_CONN_ANY        =        0x00,  // Process scan and connection requests from all devices
-    ADV_FP_ALLOW_SCAN_WL_ALLOW_CONN_ANY         =        0x01,  // Process connection requests from all devices and only scan requests from devices that are in the White List.
-    ADV_FP_ALLOW_SCAN_ANY_ALLOW_CONN_WL         =        0x02,  // Process scan requests from all devices and only connection requests from devices that are in the White List..
-    ADV_FP_ALLOW_SCAN_WL_ALLOW_CONN_WL          =        0x03,  // Process scan and connection requests only from devices in the White List.
-
-    ADV_FP_NONE                                 =        ADV_FP_ALLOW_SCAN_ANY_ALLOW_CONN_ANY, //adv filter policy set to zero, not use whitelist
-} adv_fp_type_t;  //adv_filterPolicy_type_t
-
-
-typedef enum {
-    SCAN_FP_ALLOW_ADV_ANY                        =        0x00,  //except direct adv address not match
-    SCAN_FP_ALLOW_ADV_WL                         =        0x01,  //except direct adv address not match
-    SCAN_FP_ALLOW_UNDIRECT_ADV                   =        0x02,  //and direct adv address match initiator's resolvable private MAC
-    SCAN_FP_ALLOW_ADV_WL_DIRECT_ADV_MACTH        =        0x03,  //and direct adv address match initiator's resolvable private MAC
-
-} scan_fp_type_t;   //scan_filterPolicy_type_t
-
-
-
-typedef enum {
-    INITIATE_FP_ADV_SPECIFY                        =        0x00,  //connect ADV specified by host
-    INITIATE_FP_ADV_WL                             =        0x01,  //connect ADV in whiteList
-
-} init_fp_type_t;   //init_filterPolicy_type_t
-
-
-
-
-
-typedef u8 irk_key_t[16];
-
-typedef struct {
-    u8 type;
-    u8 address[BLE_ADDR_LEN];
-    u8 reserved;
-} wl_addr_t;
-
-typedef struct {
-    wl_addr_t  wl_addr_tbl[MAX_WHITE_LIST_SIZE];
-    u8     wl_addr_tbl_index;
-    u8     wl_irk_tbl_index;
-} ll_whiteListTbl_t;
-
-
-typedef struct {
-    u8 type;
-    u8 address[BLE_ADDR_LEN];
-    u8 reserved;
-    u8 irk[16];
-} rl_addr_t;
-
-typedef struct {
-    rl_addr_t    tbl[MAX_WHITE_IRK_LIST_SIZE];
-    u8             idx;
-    u8            en;
-} ll_ResolvingListTbl_t;
-
-
-
-
-
-/**************************************** User Interface  **********************************************/
-
-
-/*********************************************************************
- * @fn      ll_whiteList_reset
- *
- * @brief   API to reset the white list table.
- *
- * @param   None
- *
- * @return  LL Status
- */
-ble_sts_t ll_whiteList_reset(void);
-
-/*********************************************************************
- * @fn      ll_whiteList_add
- *
- * @brief   API to add new entry to white list
- *
- * @param   None
- *
- * @return  LL Status
- */
-ble_sts_t ll_whiteList_add(u8 type, u8 *addr);
-
-/*********************************************************************
- * @fn      ll_whiteList_delete
- *
- * @brief   API to delete entry from white list
- *
- * @param   type - The specified type
- *          addr - The specified address to be delete
- *
- * @return  LL Status
- */
-ble_sts_t ll_whiteList_delete(u8 type, u8 *addr);
-
-/*********************************************************************
- * @fn      ll_whiteList_getSize
- *
- * @brief   API to get total number of white list entry size
- *
- * @param   returnSize - The returned entry size
- *
- * @return  LL Status
- */
-ble_sts_t ll_whiteList_getSize(u8 *returnPublicAddrListSize) ;
-
-
-
-
-
-
-ble_sts_t  ll_resolvingList_add(u8 peerIdAddrType, u8 *peerIdAddr, u8 *peer_irk, u8 *local_irk);
-ble_sts_t  ll_resolvingList_delete(u8 peerIdAddrType, u8 *peerIdAddr);
-
-ble_sts_t  ll_resolvingList_reset(void);
-ble_sts_t  ll_resolvingList_getSize(u8 *Size);
-
-ble_sts_t  ll_resolvingList_getPeerResolvableAddr (u8 peerIdAddrType, u8* peerIdAddr, u8* peerResolvableAddr); //not available now
-ble_sts_t  ll_resolvingList_getLocalResolvableAddr(u8 peerIdAddrType, u8* peerIdAddr, u8* LocalResolvableAddr); //not available now
-
-ble_sts_t  ll_resolvingList_setAddrResolutionEnable (u8 resolutionEn);
-
-ble_sts_t  ll_resolvingList_setResolvablePrivateAddrTimer (u16 timeout_s);   //not available now
-
-
-
-
-
-
-/********************************* Stack Interface, user can not use!!! ********************************/
-
-u8 * ll_searchAddrInWhiteListTbl(u8 type, u8 *addr);
-
-u8 * ll_searchAddrInResolvingListTbl(u8 *addr);  //addr must be RPA
-
-u8 * ll_searchAddr_in_WhiteList_and_ResolvingList(u8 type, u8 *addr);
-
-bool smp_quickResolvPrivateAddr(u8 *key, u8 *addr);
-
-
-ll_whiteListTbl_t    ll_whiteList_tbl;
-ll_ResolvingListTbl_t    ll_resolvingList_tbl;
-
-
-
-#endif /* LL_WHITELIST_H_ */
diff --git a/stack/ble/llms/llms.h b/stack/ble/llms/llms.h
deleted file mode 100644
index 2b4894c..0000000
--- a/stack/ble/llms/llms.h
+++ /dev/null
@@ -1,211 +0,0 @@
-/******************************************************************************
- * @file     llms.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_H_
-#define LLMS_H_
-
-#include "llms_slot.h"
-
-
-//TODO:  all debug MACRO should remove at last
-#define         DBG_SLOT_CALCULTE_TIMING_EN                        1
-#define         DBG_DECRYPTION_ERR_EN                              1
-
-
-
-
-#define            CONNECT_COMPLETE_CALLBACK_IN_MAINLOOP            1
-
-/********************* Macro & Enumeration & Structure Definition for Stack, user can not use!!!!  **********************/
-#define            BLMS_STATE_NONE                                 0
-#define            BLMS_STATE_ADV                                  BIT(1)
-#define            BLMS_STATE_SCAN                                 BIT(2)
-#define            BLMS_STATE_SCAN_POST                            BIT(3)
-#define            BLMS_STATE_BTX_S                                BIT(4)
-#define            BLMS_STATE_BTX_E                                BIT(5)
-#define            BLMS_STATE_BRX_S                                BIT(6)
-#define            BLMS_STATE_BRX_E                                BIT(7)
-
-
-
-
-#define         BLMS_FLG_RF_CONN_DONE                              (FLD_RF_IRQ_CMD_DONE  | FLD_RF_IRQ_FIRST_TIMEOUT | FLD_RF_IRQ_RX_TIMEOUT | FLD_RF_IRQ_RX_CRC_2)
-
-//TODO: delete all debug codes after functions are tested OK
-#define         BLMS_ERR_DEBUG(x)                                do{irq_disable();write_reg32(0x40000, (x));while(1);}while(0)
-//#define         BLMS_ERR_DEBUG(x)
-
-
-
-
-
-#define            SYS_IRQ_TRIG_SLOT_TASK                           0         //Scan/ ADV /BRX start /BTX start
-#define            SYS_IRQ_TRIG_BTX_POST                            BIT(0)
-#define            SYS_IRQ_TRIG_BRX_POST                            BIT(1)
-#define            SYS_IRQ_TRIG_SCAN_POST                           BIT(2)
-
-#define            SYS_IRQ_TRIG_BRX_START                           BIT(3)   //only slave high duty mode use
-
-
-
-extern u32                 Crc24Lookup[16];
-
-
-typedef struct {
-    u8        adv_en;
-    u8        scan_en;
-    u8        adv_scanReq_connReq;
-    u8        slot_process_en;
-
-    u8        max_master_num;
-    u8        max_slave_num;
-    u8        cur_master_num;
-    u8        cur_slave_num;
-
-
-    u8        connSync;                //if more than 8 connections, u8 -> u16
-    u8        connUpdate_nearby;        //if more than 8 connections, u8 -> u16
-    u8        connUpdate_cmd;            //if more than 8 connections, u8 -> u16
-    u8        new_conn_forbidden;
-
-    u8        master_connInter;       // "u8" is enough, 320 mS most
-    u8        half_connInter;
-    u8        quarter_connInter;
-    u8        slotNum_whole_inter;
-
-    u8        slotNum_half_inter;
-    u8        slotNum_quarter_inter;
-    u8        drop_rx_data;
-    u8        rsvd;
-
-
-
-    u32        slot_idx_1st_btx_mark;   // slot_type
-    u8        slot_offset_mark[BLMS_MAX_CONN_MASTER_NUM]; //maybe 1 or 2, so need lay it at last
-
-} st_llms_para_t;
-
-extern _attribute_aligned_(4)    st_llms_para_t  blmsParam;
-
-
-extern    volatile    u8    blms_state;
-extern                u8    blms_tx_empty_packet[];
-
-extern    volatile    u32 rx_tick_now;
-
-extern    volatile    int                blms_disconnect;
-extern    volatile    int             blms_encryption_st;
-
-
-
-
-typedef     int (*llms_host_mainloop_callback_t)(void);
-typedef     int (*llms_enc_done_callback_t)(u16 connHandle);
-typedef     int (*llms_conn_complete_handler_t)(u16 conn, u8 *p);
-typedef     int (*llms_conn_terminate_handler_t)(u16 conn, u8 *p);
-
-extern llms_host_mainloop_callback_t     llms_host_main_loop_cb;
-extern llms_enc_done_callback_t          llms_encryption_done_cb;
-extern llms_conn_complete_handler_t     llms_connComplete_handler;
-extern llms_conn_terminate_handler_t     llms_connTerminate_handler;
-
-
-
-
-
-/******************************* Macro & Enumeration variables for User ************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-/*********************************** Stack Interface Begin, user can not use!!! **********************************/
-void         irq_ble_master_slave_handler(void);
-void         blt_llms_channelTable_calc(u8* chm, u8 hop, u8 *ptbl);
-int         blt_llms_procPendingEvent(void);
-
-
-void        smemset4(int * dest, int val, int len);
-
-
-
-void         blt_llms_registerHostMainloopCallback (llms_host_mainloop_callback_t cb);
-void         blt_llms_registerConnectionEncryptionDoneCallback(llms_enc_done_callback_t  cb);
-void         blt_llms_registerConnectionCompleteHandler(llms_conn_complete_handler_t  handler);
-void         blt_llms_registerConnectionTerminateHandler(llms_conn_terminate_handler_t  handler);
-
-
-/*********************************** Stack Interface End *********************************************************/
-
-
-
-
-
-
-
-
-
-
-/************************************ User Interface  Begin  ******************************************************/
-
-void     blc_llms_initBasicMCU (void);
-void     blc_llms_initStandby_module (u8 *public_adr);
-void     blc_llms_initMultiMasterSingleSlave_module(void);
-
-u8 * blms_l2cap_packet_pack(u16 connHandle, u8 * raw_pkt);
-
-ble_sts_t  blms_att_pushNotifyData (u16 connHandle, u16 attHandle, u8 *p, int len);
-void     blms_sdk_main_loop (void);
-
-u8 blms_getCurrConnRole(u16 connHandle);
-u8 blms_fifo_num (u16 connHandle);
-u8  blms_ll_getTxFifoNumber (u16 connHandle);
-bool blms_ll_isTxFifoAvailableForApp(u16 connHandle);
-
-int blms_is_handle_valid (u16 handle);
-
-void  blms_ll_setEncryptionBusy(u16 connHandle, u8 enc_busy);
-int  blms_ll_isEncryptionBusy(u16 connHandle);
-u8 blms_ll_pushTxfifo_hold (u16 connHandle, u8 *p);
-
-
-
-/************************************ User Interface  End  ********************************************************/
-
-
-
-
-
-
-
-#endif /* LLMS_H_ */
diff --git a/stack/ble/llms/llms_adv.h b/stack/ble/llms/llms_adv.h
deleted file mode 100644
index 1a0d88f..0000000
--- a/stack/ble/llms/llms_adv.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/******************************************************************************
- * @file     llms_adv.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_ADV_H_
-#define LLMS_ADV_H_
-
-
-
-/********************* Macro & Enumeration & Structure Definition for Stack, user can not use!!!!  **********************/
-
-typedef struct {
-    u8        adv_chn_mask;
-    u8        adv_duration_en;
-    u8        adv_type;
-    u8         adv_filterPolicy;
-
-
-    u16        advInt_min;
-    u16     advInt_max;
-
-    u32        adv_duration_us;
-    u32        adv_begin_tick;
-
-    u8        T_SCAN_RSP_INTVL;
-    u8      own_addr_type;
-
-
-}st_llms_adv_t;
-
-
-
-extern _attribute_aligned_(4) st_llms_adv_t  blmsAdv;
-
-
-
-
-
-
-
-/************************************ User Interface  ******************************************************/
-void         blc_llms_initAdvertising_module(void);
-
-ble_sts_t      blc_llms_setAdvData(u8 *data, u8 len);
-ble_sts_t     blc_llms_setScanRspData(u8 *data, u8 len);
-ble_sts_t   blc_llms_setAdvEnable(int adv_enable);
-ble_sts_t   blc_llms_setAdvParam( u16 intervalMin,  u16 intervalMax,  adv_type_t advType,           own_addr_type_t ownAddrType,  \
-                                  u8 peerAddrType, u8  *peerAddr,    u8            adv_channelMap,   adv_fp_type_t   advFilterPolicy);
-
-
-
-void         blc_llms_setAdvCustomedChannel (u8 chn0, u8 chn1, u8 chn2);
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-int     blt_llms_send_adv(void);
-
-
-
-
-
-
-
-
-
-#endif /* LLMS_ADV_H_ */
diff --git a/stack/ble/llms/llms_conn.h b/stack/ble/llms/llms_conn.h
deleted file mode 100644
index a66a088..0000000
--- a/stack/ble/llms/llms_conn.h
+++ /dev/null
@@ -1,259 +0,0 @@
-/******************************************************************************
- * @file     llms_conn.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_CONN_H_
-#define LLMS_CONN_H_
-
-
-
-/********************* Macro & Enumeration & Structure Definition for Stack, user can not use!!!!  **********************/
-
-#define            BLMS_EARLY_CAL_MAP_TO_SAVE_TIME_EN                1   //when calculate new channel map in BRX/BTX start, 70uS is used
-
-//////////////////////////////// LL ENC ///////////////////////////////////
-#define            MS_LL_ENC_OFF                                    0
-#define            MS_LL_ENC_REQ                                    1
-#define            MS_LL_ENC_RSP_T                                  2
-#define            MS_LL_ENC_START_REQ_T                            3
-#define            MS_LL_ENC_START_RSP                              4
-#define            MS_LL_ENC_START_RSP_T                            5
-#define            MS_LL_ENC_PAUSE_REQ                              6
-#define            MS_LL_ENC_PAUSE_RSP_T                            7
-#define            MS_LL_ENC_PAUSE_RSP                              8
-#define            MS_LL_REJECT_IND_T                               9
-#define            MS_LL_ENC_SMP_INFO_S                             10
-#define            MS_LL_ENC_SMP_INFO_E                             11
-
-#define            MS_CONN_ENC_CHANGE                               BIT(16) //offset 2byte
-#define            MS_CONN_ENC_REFRESH                              BIT(17)
-#define            MS_CONN_ENC_REFRESH_T                            BIT(18)
-
-
-
-#define            BLMS_CONN_HANDLE                                (BLM_CONN_HANDLE | BLS_CONN_HANDLE)
-
-
-
-#define            CONN_STATUS_DISCONNECT                           0   //disconnect must be "0"
-#define            CONN_STATUS_COMPLETE                             1
-#define            CONN_STATUS_ESTABLISH                            2
-
-
-#define         BLMS_CONN_RX_MAX_TRY_NUM                            4
-#define         BLMS_CONN_UPDATE_RX_MAX_TRY_NUM                     4
-
-
-#define         BLMS_TX_FIFO_NUM                                    8
-#define         BLMS_STACK_USED_TX_FIFO_NUM                         1
-#define         BLMS_TX_FIFO_SIZE                                   40
-
-#define            CONN_UPDATE_CHN_MAP                              BIT(0)
-#define            CONN_UPDATE_CONN_PARAM                           BIT(1)
-#define            CONN_UPDATE_PHY_MODE                             BIT(2)
-
-typedef struct {
-    u8        save_flg;
-    u8        sn_nesn;
-    u8        dma_tx_rptr;
-    u8        reg_core_f03;
-}bb_ms_sts_t;
-
-typedef struct {
-
-    u8        tx_wptr;
-    u8        tx_rptr;
-    u8        tx_num;
-    u8        conn_rx_num;  //rx number in a new interval   //TODO: all connection can share one
-
-    u8        role;
-    u8        ll_enc_busy;
-    u8        connState;             // 0/Conn_Complete/Conn_Establish
-    u8        conn_peer_sn;
-
-    u8        conn_snnesn;
-    u8        rsvd11;
-    u8        rsvd22;
-    u8        rsvd33;
-
-    u8       conn_dma_tx_rptr;
-    u8       smp_empty_pkt_entry; //slave-role empty pkt entry: ble main_loop entry enable flg
-    u8       blt_tx_pkt_hold;
-    u8       last_rf_len;
-
-    u8        chn_idx;
-    u8        conn_chn;
-    u8        conn_para_update;
-    u8        conn_map_update;
-
-    u8        conn_receive_packet;
-    u8        conn_established;
-    u8        peer_adr_type;
-    u8        conn_sca;
-
-    u8         conn_receive_new_packet;
-    u8         conn_peer_terminate;
-    u8         conn_local_terminate;
-    u8         conn_terminate_reason;
-
-
-    u8        conn_chn_hop;
-    u8        conn_winsize_next;        //u8 is enough
-    u8        conn_interval_next;        //pay attention: we do not support too big interval, so u8  enough
-    u8        conn_offset_next;        //pay attention: we do not support too big interval, so winOffset u8  enough
-
-
-
-    u16        conn_inst_next;
-    u16        conn_map_inst_next;        //update conn_param & update_map should separate, update map may delay to process due to BRX slot dropped
-    u16        conn_latency_next;
-    u16        conn_timeout_next;     //Note: unit 10mS
-
-
-
-    //0x20, 32
-
-
-    u16        updateReq_conn_min;
-    u16        updateReq_conn_max;
-    u16        updateReq_conn_latency;
-    u16        updateReq_conn_timeout;
-
-    u16        conn_nesn;//local nesn
-    u16        conn_sn;  //local sn
-
-    u16        connHandle;
-    u16        conn_interval;
-    u16        conn_latency;
-    u16        conn_inst;
-    u16        conn_inst_backup;
-    u16        enc_ediv;       //EDIV
-
-    //0x40, 64
-
-    u32        conn_paraUpt_tick;
-    u32        conn_terminate_tick;
-    u32        conn_interval_tick;
-    u32        conn_timeout;
-    u32        conn_established_tick;
-
-    u32        btxbrx_start_tick;
-    u32        conn_tick;
-    u32        conn_access_code;
-    u32        conn_crc;
-
-    //0x60, 96
-
-    u32     conn_crc_revert; //revert crc24 init value
-    u32     ll_remoteFeature;
-    u32     conn_inst_u32;
-
-    bb_ms_sts_t blms_bb;// BaseBand info: SN/NESN/TX_FIFO_RPTR
-
-    u8        peer_adr[6];
-    u8        conn_chn_map[5];
-    u8        conn_chn_map_next[5];
-
-    //0x80, 128
-
-    u8        enc_random[8];  //RANDOM
-
-    u32        enc_ivm;       //master IVm
-    u8         enc_skdm[8];   //master SKDm
-    u32        enc_ivs;       //slave  IVs
-    u8         enc_skds[8];   //slave  SKDs
-
-    //0xA0, 160
-
-    u8        chn_tbl[40];
-#if (BLMS_EARLY_CAL_MAP_TO_SAVE_TIME_EN)
-    u8        chn_new_tbl[40];
-#endif
-    ble_crypt_para_t    crypt;   //40 Byte
-    u8        rsvd16[16];
-
-
-    //0x100, 256
-
-    u32        tx_fifo[BLMS_TX_FIFO_NUM][BLMS_TX_FIFO_SIZE>>2];  // 320, 0x140
-
-    // 0x240
-
-} st_llms_conn_t;
-
-//extern _attribute_aligned_(4)    st_llms_conn_t    blms[];
-
-extern _attribute_aligned_(4)    st_llms_conn_t    AA_blms[];   // AA_ just for debug
-#define blms    AA_blms
-
-
-extern st_llms_conn_t  *blms_pconn;
-extern int              blms_conn_sel;
-
-
-
-typedef int (*blms_LTK_req_callback_t)(u16 handle, u8* rand, u16 ediv);
-//extern blms_LTK_req_callback_t blt_llms_ltk_request;
-
-
-
-
-/*********************************** Stack Interface Begin, user can not use!!! **********************************/
-int         blms_connect_common(st_llms_conn_t *pc, rf_packet_connect_t * pInit);
-int         blms_start_common  (st_llms_conn_t *pc);
-int         blms_post_common   (st_llms_conn_t *pc);
-
-bool         blms_ll_pushTxfifo (u16 connHandle, u8 *p);
-ble_sts_t    blt_llms_unknown_rsp(u16 connHandle, u8 op_code );
-int          blt_llms_main_loop_data (u16 connHandle, u8 *raw_pkt);
-
-
-void         blt_llms_registerLtkReqEvtCb(blms_LTK_req_callback_t evtCbFunc);
-
-/*********************************** Stack Interface End *********************************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/************************************ User Interface  Begin  ******************************************************/
-ble_sts_t    blc_llms_setMaxConnectionNumber(int max_master_num, int max_slave_num);
-ble_sts_t    blc_llms_setMasterConnectionInterval(u16 conn_interval);   //This API master called after "blc_llms_setMaxConnectionNumber"
-
-
-ble_sts_t    blc_llms_disconnect (u16 connHandle, u8 reason);
-
-/************************************ User Interface  End  ********************************************************/
-
-#endif /* LLMS_CONN_H_ */
diff --git a/stack/ble/llms/llms_init.h b/stack/ble/llms/llms_init.h
deleted file mode 100644
index fc3446f..0000000
--- a/stack/ble/llms/llms_init.h
+++ /dev/null
@@ -1,82 +0,0 @@
-/******************************************************************************
- * @file     llms_init.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_INIT_H_
-#define LLMS_INIT_H_
-
-
-//can not be "1", will conflict with " blms_create_connection & CONN_IDX_MASK"
-#define            BLMS_CONNECTION_REQ                        BIT(15)
-#define            BLMS_CONNECTION_REQ_PENDING                BIT(14)
-
-#define          BLMS_WINSIZE                            7
-
-
-
-
-
-
-
-
-
-
-
-
-
-typedef struct {
-    u8    conn_policy;
-    u8    conn_advType;
-
-    u8    conn_mac[6];
-
-}st_llms_init_t;
-
-extern    _attribute_aligned_(4) st_llms_init_t  blmsInit;
-
-extern    volatile    int blms_create_connection;
-extern    u32 blms_timeout_connectDevice;
-extern    u32    blms_tick_connectDevice;
-
-
-extern    rf_packet_ll_init_t    pkt_llms_init;
-
-
-/************************************ User Interface  ******************************************************/
-ble_sts_t     blc_llms_createConnection( u16 scan_interval, u16 scan_window, init_fp_type_t initiator_filter_policy,
-                                        u8 adr_type,       u8  *mac,        u8               own_adr_type,
-                                       u16 conn_min,       u16 conn_max,    u16               conn_latency,                 u16 timeout,
-                                       u16 ce_min,           u16 ce_max );
-
-ble_sts_t     blc_llms_setCreateConnectionTimeout (u32 timeout_ms);
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-int  blt_llms_procInitPkt(u8 *raw_pkt);
-
-
-
-
-#endif /* LLMS_INIT_H_ */
diff --git a/stack/ble/llms/llms_master.h b/stack/ble/llms/llms_master.h
deleted file mode 100644
index 4128018..0000000
--- a/stack/ble/llms/llms_master.h
+++ /dev/null
@@ -1,76 +0,0 @@
-/******************************************************************************
- * @file     llms_master.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_MASTER_H_
-#define LLMS_MASTER_H_
-
-
-
-/*********************************************************************************
- *   17          19      23     29          31     37         39       41
- * 21.25    23.75    28.75    36.25    38.75    46.25    48.75    51.25
- *                      X                                   X
- *                               V                 V                  V
- *
- *                     23         29         31         37                    41
- *
- *                         25
- *                       31.25 mS
- ********************************************************************************/
-#define         MASTER_CONN_INTER_23                            23
-#define         MASTER_CONN_INTER_25                            25    // 31.25 mS
-#define         MASTER_CONN_INTER_29                            29
-#define         MASTER_CONN_INTER_31                            31
-#define         MASTER_CONN_INTER_37                            37
-#define         MASTER_CONN_INTER_41                            41
-
-
-
-
-
-
-
-typedef struct {
-
-
-} st_llms_m_conn_t;
-
-
-
-
-/************************************ User Interface  ******************************************************/
-
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-int     blms_m_connect (rf_packet_connect_t * pInit);
-int     blms_btx_start (void);
-int     blms_btx_post (void);
-
-
-
-#endif /* LLMS_MASTER_H_ */
diff --git a/stack/ble/llms/llms_scan.h b/stack/ble/llms/llms_scan.h
deleted file mode 100644
index 18afbc6..0000000
--- a/stack/ble/llms/llms_scan.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/******************************************************************************
- * @file     llms_scan.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_SCAN_H_
-#define LLMS_SCAN_H_
-
-
-/********************* Macro & Enumeration & Structure Definition for Stack, user can not use!!!!  **********************/
-
-#define            BLMS_SCAN_SLOT                                      32  //32*0.625 = 20mS
-#define            BLMS_SCAN_INTERVL                                ( BLMS_SCAN_SLOT * CLOCK_16M_SYS_TIMER_CLK_625US)
-
-
-typedef struct {
-    u8        scan_type;
-    u8        scan_filterPolicy;
-    u8        filter_dup;
-
-    u8        scanDevice_num;
-    u8        scanRspDevice_num;
-    u8        scan_extension_mask;
-    u8         rsvd;
-//    s8        T_SCAN_REQ_INTVL;
-
-
-
-    //u32        scan_interval;
-}st_llms_scan_t;
-
-extern    _attribute_aligned_(4) st_llms_scan_t  blmsScn;
-
-
-
-
-
-/************************************ User Interface  ******************************************************/
-void         blc_llms_initScanning_module(void);
-
-ble_sts_t     blc_llms_setScanParameter (scan_type_t scan_type, u16 scan_interval, u16 scan_window, own_addr_type_t  ownAddrType, scan_fp_type_t scanFilter_policy);
-ble_sts_t     blc_llms_setScanEnable (scan_en_t scan_enable, dupFilter_en_t filter_duplicate);
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-
-void     blt_llms_switchScanChannel (int set_chn);
-int      blt_llms_procScanPkt(u8 *raw_pkt, u8 *new_pkt, u32 tick_now);
-int     blt_llms_procScanData(u8 *raw_pkt);
-
-#endif /* LLMS_SCAN_H_ */
diff --git a/stack/ble/llms/llms_slave.h b/stack/ble/llms/llms_slave.h
deleted file mode 100644
index d562af4..0000000
--- a/stack/ble/llms/llms_slave.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/******************************************************************************
- * @file     llms_slave.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_SLAVE_H_
-#define LLMS_SLAVE_H_
-
-
-
-#define            SLAVE_SLOT_FINE_TUNE_EN                            1   // enable:  make sure slave sync master timing
-                                                                    // disable: slave will disconnect for long time; can use this to see BRX early set timing
-
-
-
-#define            SLAVE_SYNC_CONN_CREATE                            BIT(0)
-#define            SLAVE_SYNC_CONN_UPDATE                            BIT(1)
-#define            SLAVE_SYNC_HIGH_DUTY                              BIT(7)
-
-
-#define            SLAVE_SYNC_HIGHDUTY_SUPPORT_EN                    0
-
-
-#define            BRX_EARLY_SET_SYNC                                200
-#define            BRX_EARLY_SET_COMMON                              150
-
-
-
-typedef struct {
-
-    u32        connExpectTime;
-    u32        conn_start_time;
-    u32        conn_duration;
-
-    u32        tick_1st_rx;
-
-    u32        tick_fine_tune;
-
-    u8        sync_timing;
-    u8        rsvd1;
-    u8        rsvd2;
-    u8        rsvd3;
-
-} st_lls_conn_t;
-
-extern    _attribute_aligned_(4)    st_lls_conn_t    blmsSlave[];
-extern    st_lls_conn_t    *bls_pconn;
-extern    int                bls_conn_sel;
-
-
-
-/************************************ User Interface  ******************************************************/
-
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-int     blms_s_connect (rf_packet_connect_t * pInit);
-int     blms_brx_start(void);
-int     blms_brx_post(void);
-
-
-
-
-#endif /* LLMS_SLAVE_H_ */
diff --git a/stack/ble/llms/llms_slot.h b/stack/ble/llms/llms_slot.h
deleted file mode 100644
index 14e86c1..0000000
--- a/stack/ble/llms/llms_slot.h
+++ /dev/null
@@ -1,378 +0,0 @@
-/******************************************************************************
- * @file     llms_slot.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef LLMS_SLOT_H_
-#define LLMS_SLOT_H_
-
-
-
-#include "llms_conn.h"
-
-
-
-
-
-
-
-
-#define            SLOT_MAX_NUM                                    128
-
-
-/*******************************************************************************
- *
- * BIT(7)    BIT(6)    BIT(5)    BIT(4)       (BIT(3) BIT(2)  BIT(1) BIT(0) )
- *   M          S         SCAN     ADV                  conn_handle_idx
- ******************************************************************************/
-#define            SLOT_TASK_ADV                                    BIT(4)
-#define            SLOT_TASK_SCAN                                   BIT(5)
-#define            SLOT_TASK_SLAVE                                  BIT(6)   //TODO, task_mask  SLOT_TASK_SLAVE ERROR
-#define            SLOT_TASK_MASTER                                 BIT(7)
-
-#define         SLOT_TASK_CONN                                    (SLOT_TASK_SLAVE | SLOT_TASK_MASTER)
-
-
-#define            CONN_IDX_MASK                                    15    //15 is very safe. cause total connection number will not exceed 15
-
-
-
-
-
-#define            CONN_MAX_NUM_M1_S1                                    0
-#define            CONN_MAX_NUM_M2_S2                                    1
-#define            CONN_MAX_NUM_M4_S3                                    2
-
-#ifndef            CONN_MAX_NUM_CONFIG
-#define            CONN_MAX_NUM_CONFIG                                    CONN_MAX_NUM_M4_S3
-#endif
-
-
-
-#if (CONN_MAX_NUM_CONFIG == CONN_MAX_NUM_M1_S1)
-    // connHandle:
-    // Master:    0x80  Slave:  0x41
-    #define            BLMS_MAX_CONN_NUM                                2
-    #define            BLMS_MAX_CONN_MASTER_NUM                         1
-    #define            BLMS_MAX_CONN_SLAVE_NUM                          1
-
-
-    #define            CONN_IDX_MASTER0                                 0
-    #define            CONN_IDX_SLAVE0                                  1
-
-#elif (CONN_MAX_NUM_CONFIG == CONN_MAX_NUM_M2_S2)
-    // connHandle:
-    // Master:    0x80/0x81   Slave:  0x42/0x43
-    #define            BLMS_MAX_CONN_NUM                                4
-    #define            BLMS_MAX_CONN_MASTER_NUM                         2
-    #define            BLMS_MAX_CONN_SLAVE_NUM                          2
-
-
-    #define            CONN_IDX_MASTER0                                 0
-    #define            CONN_IDX_SLAVE0                                  2
-
-#elif (CONN_MAX_NUM_CONFIG == CONN_MAX_NUM_M4_S3)
-    // connHandle:
-    // Master:    0x80/0x81/0x82/0x83   Slave:  0x44/0x45/0x46
-    #define            BLMS_MAX_CONN_NUM                                7
-    #define            BLMS_MAX_CONN_MASTER_NUM                         4
-    #define            BLMS_MAX_CONN_SLAVE_NUM                          3
-
-
-    #define            CONN_IDX_MASTER0                                 0
-    #define            CONN_IDX_SLAVE0                                  4
-
-#else
-
-#endif
-
-
-
-
-
-    #define         SLOT_TASK_MSK_CONN_0                             BIT(0)
-
-#if (CONN_MAX_NUM_CONFIG == CONN_MAX_NUM_M1_S1)
-
-    #define         SLOT_TASK_MSK_MASTER0                            BIT(0)
-    #define         SLOT_TASK_MSK_SLAVE0                             BIT(1)
-
-    #define         SLOT_TASK_MSK_MASTER                             SLOT_TASK_MSK_MASTER0                                                              SLOT_TASK_MSK_SLAVE0  | SLOT_TASK_MSK_SLAVE1    )
-    #define         SLOT_TASK_MSK_SLAVE                              SLOT_TASK_MSK_SLAVE0
-
-    #define         SLOT_TASK_MSK_CONN                               ( SLOT_TASK_MSK_MASTER0 | SLOT_TASK_MSK_SLAVE0 )
-
-#elif (CONN_MAX_NUM_CONFIG == CONN_MAX_NUM_M2_S2)
-
-    #define         SLOT_TASK_MSK_MASTER0                            BIT(0)
-    #define         SLOT_TASK_MSK_MASTER1                            BIT(1)
-    #define         SLOT_TASK_MSK_SLAVE0                             BIT(2)
-    #define         SLOT_TASK_MSK_SLAVE1                             BIT(3)
-
-
-    #define         SLOT_TASK_MSK_MASTER                             ( SLOT_TASK_MSK_MASTER0 | SLOT_TASK_MSK_MASTER1 )                                                              SLOT_TASK_MSK_SLAVE0  | SLOT_TASK_MSK_SLAVE1    )
-    #define         SLOT_TASK_MSK_SLAVE                              ( SLOT_TASK_MSK_SLAVE0  | SLOT_TASK_MSK_SLAVE1 )
-
-
-    #define         SLOT_TASK_MSK_CONN                               ( SLOT_TASK_MSK_MASTER0 | SLOT_TASK_MSK_MASTER1 | \
-                                                                      SLOT_TASK_MSK_SLAVE0  | SLOT_TASK_MSK_SLAVE1 )
-#elif (CONN_MAX_NUM_CONFIG == CONN_MAX_NUM_M4_S3)
-
-    #define         SLOT_TASK_MSK_MASTER0                            BIT(0)
-    #define         SLOT_TASK_MSK_MASTER1                            BIT(1)
-    #define         SLOT_TASK_MSK_MASTER2                            BIT(2)
-    #define         SLOT_TASK_MSK_MASTER3                            BIT(3)
-    #define         SLOT_TASK_MSK_SLAVE0                             BIT(4)
-    #define         SLOT_TASK_MSK_SLAVE1                             BIT(5)
-    #define         SLOT_TASK_MSK_SLAVE2                             BIT(6)
-
-
-    #define         SLOT_TASK_MSK_MASTER                            ( SLOT_TASK_MSK_MASTER0 | SLOT_TASK_MSK_MASTER1 |  \
-                                                                      SLOT_TASK_MSK_MASTER2 | SLOT_TASK_MSK_MASTER3 )
-
-    #define         SLOT_TASK_MSK_SLAVE                             ( SLOT_TASK_MSK_SLAVE0  | SLOT_TASK_MSK_SLAVE1    |  SLOT_TASK_MSK_SLAVE2    )
-
-    #define         SLOT_TASK_MSK_CONN                              ( SLOT_TASK_MSK_MASTER0 | SLOT_TASK_MSK_MASTER1 |  \
-                                                                      SLOT_TASK_MSK_MASTER2 | SLOT_TASK_MSK_MASTER3 | \
-                                                                      SLOT_TASK_MSK_SLAVE0  | SLOT_TASK_MSK_SLAVE1    |  SLOT_TASK_MSK_SLAVE2 )
-#endif
-
-
-#define            SLOT_TASK_MSK_ADV                                 BIT(12)
-#define            SLOT_TASK_MSK_SCAN                                BIT(13)
-
-
-
-
-
-
-#define            SLOT_UPDT_SLAVE_SYNC                             BIT(0)
-#define            SLOT_UPDT_SLAVE_SYNC_DONE                        BIT(1)
-#define            SLOT_UPDT_SLAVE_TERMINATE                        BIT(2)
-#define            SLOT_UPDT_ADV_RECOVER                            BIT(3)
-
-#define            SLOT_UPDT_MASTER_CONN                            BIT(4)
-#define            SLOT_UPDT_MASTER_TERMINATE                       BIT(5)
-#define            SLOT_UPDT_SCAN_RECOVER                           BIT(6)
-
-#define            SLOT_UPDT_SLAVE_SLOT_FINE_TUNE                   BIT(7)
-
-
-
-
-
-
-
-#define            SLOT_DURATION_SET_SCAN                            1
-
-/****************************************************************************************************************************************
-ADV data 37 bytes, Scan_Rsp 16 bytes, 32M clock,  all code running in SRAM, no Scan_Req/Conn_Req, cost 2353 uS
-ADV data 37 bytes, Scan_Rsp 16 bytes, 32M clock,  all code running in SRAM, no Scan_Req, Conn_Req on chn39, 2700 uS (2019.09.03 SiHui test data)
-
-ADV data 37 bytes, Scan_Rsp 37 bytes, 32M clock,  all code running in SRAM, no Scan_Req on chn37/38,
-            Scan_Req&Scan_Rsp on chn39, 2940 uS -> 2890 uS (400->375 optimize) (2019.09.17 SiHui test data)
-
-Worst Case:
-PDU 37 bytes, 32M clock,  all code running in SRAM, receive scan_req/conn_req on chn37 failed,
-              receive scan_req/conn_req on chn38 failed, receive scan_req success and send scan_rsp
-                this timing is about: 2890+300*2 = 3490
-
-***************************************************************************************************************************************/
-//TODO, optimize if ADV channel is not 37/38/39, or if ADV data & Scan_Rsp data not longest
-//TODO, if none connecTable ADV or driect_adv, duration can be smaller
-#define            SLOT_DURATION_ADV                                 6   // 625*4 = 2500uS,  625*5= 3125 uS,  625*6= 3750 uS
-
-
-#define            SLOT_DURATION_SLAVE_COMMON                        4
-#define            SLOT_DURATION_MASTER_COMMON                       3
-
-
-
-
-
-// 150us(T_ifs) + 352us(conn_req) = 502 us,  sub some margin 22(RX IRQ delay/irq_handler delay)
-// real test data: 470 uS,  beginning is "u32 tick_now = rx_tick_now = clock_time();" in irq_blms_rx
-//                            ending is    "while( !(reg_rf_irq_status & FLD_RF_IRQ_TX));" in
-//                          "irq_handler" to "u32 tick_now = rx_tick_now = clock_time();" is 4 uS
-#define            PKT_INIT_AFTER_RX_TICK                           ( 480 *CLOCK_16M_SYS_TIMER_CLK_1US)
-
-#define            SLOT_PROCESS_MAX_TICK                            ( 300 *CLOCK_16M_SYS_TIMER_CLK_1US)
-
-#define            BOUNDARY_MARGIN_COMMON_TICK                      ( SLOT_PROCESS_MAX_TICK + 20 *CLOCK_16M_SYS_TIMER_CLK_1US)
-#define            BOUNDARY_MARGIN_INIT_TICK                        ( PKT_INIT_AFTER_RX_TICK + BOUNDARY_MARGIN_COMMON_TICK)      // initiate timing + slot_update_rebuild_allocate running potential biggest time
-
-
-
-
-#define            BOUNDARY_RX_RELOAD_TICK                          ( 30  *CLOCK_16M_SYS_TIMER_CLK_1US)
-
-enum{
-    CLOCK_16M_SYS_TIMER_CLK_312US  = 5000,   //312.5*16
-    CLOCK_16M_SYS_TIMER_CLK_625US  = 10000,  //625*16
-    CLOCK_16M_SYS_TIMER_CLK_1250US = 20000,  //1250*16
-};
-
-
-typedef enum{
-    SLOT_PRIORITY_LOW            =    0,
-
-    SLOT_PRIORITY_MID            =    100,
-
-    SLOT_PRIORITY_HIGH_THRES     =    199,
-
-    SLOT_PRIORITY_HIGH           =    200,
-    SLOT_PRIORITY_SUPER_HIGH     =    240,    //only for slave connection establish or connection update
-}slot_pri_t;
-
-
-
-
-typedef unsigned int slot_type ;
-#define SLOT_TYPE_THRES                  256
-
-typedef struct{
-
-    u8    priority     [BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];
-
-
-    u8     num_cur;
-    u8     update;
-    u8     rebuild;
-    u8     slot_task_irq;                     //only used for insert Scan in slot gap
-
-    u32    task_mask;
-    u32    slot_tick_irq;
-    u32    slot_tick_next;
-
-
-
-    u32    slot_start_adv;
-    u32    slot_start_scan;
-    u32    slot_tick_irq_real;  //used for timing calculate when initiate, see the explanations in blms_m_connect
-    slot_type     slot_idx_irq;
-
-
-
-    slot_type     slot_mark_adv;
-    slot_type     slot_mark_scan;
-    slot_type     slot_idx_next;
-    slot_type     slot_idx_start;   // start of a new slot timing
-
-
-    slot_type     slot_mark_conn[BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];   //slot_idx_mark_conn
-
-
-
-    u8    slot_duration[BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];
-    u8    slot_interval[BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];
-    u8    slot_drop_num[BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];
-
-
-
-    u32    slot_start_conn[BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];
-    u32    slot_tick_conn[BLMS_MAX_CONN_NUM == 7 ? 8 : BLMS_MAX_CONN_NUM];
-
-
-
-    slot_type     slot_idx_irq_real; //used for timing calculate when initiate, see the explanations in blms_m_connect
-}slot_st_t;
-
-extern _attribute_aligned_(4)    slot_st_t    AA_bltSlot;   // AA_ just for debug
-
-#define bltSlot    AA_bltSlot
-
-
-
-extern u8    AA_slot_map[];    // AA_ just for debug
-
-#define slot_map    AA_slot_map
-/************************************ User Interface  ******************************************************/
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-int        blt_llms_slotUpdateRebuildAllocate(void);
-
-int        blt_llms_startSlotTiming(void);
-int     blt_llms_rebuildSlotTimingAdv(void);
-int     blt_llms_rebuildSlotTimingScan(void);
-int     blt_llms_findAdvSlotAvailable(void);
-
-u32     blt_llms_findFirstAvailableStartSlot(slot_type mark, u16 interval);
-
-static inline void blt_slot_setConnSlotPriority(u8 conn_idx, slot_pri_t pri){
-    bltSlot.priority[conn_idx] = pri;
-}
-
-static inline u8 blt_slot_getConnSlotPriority(u8 conn_idx){
-    return bltSlot.priority[conn_idx];
-}
-
-
-static inline void blt_slot_clearConnSlotPriority(u8 conn_idx){
-    bltSlot.priority[conn_idx] = 0;
-}
-
-void blt_slot_increaseConnSlotPriority(u8 conn_idx, u8 inc);
-
-static inline void blt_slot_addTaskMask(u32 task){
-    bltSlot.task_mask |= (task);
-}
-
-static inline void blt_slot_removeTaskMask(u32 task){
-    bltSlot.task_mask &= ~(task);
-}
-
-static inline void blt_slot_clearTaskMask(void){
-    bltSlot.task_mask = 0;
-}
-
-static inline void blt_slot_addUpdate(u8 updt){
-    bltSlot.update |= (updt);
-}
-
-static inline void blt_slot_removeUpdate(u8 updt){
-    bltSlot.update &= ~(updt);
-}
-
-
-
-
-#endif /* LLMS_SLOT_H_ */
diff --git a/stack/ble/llms/trace.h b/stack/ble/llms/trace.h
deleted file mode 100644
index 88060fa..0000000
--- a/stack/ble/llms/trace.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/******************************************************************************
- * @file     trace.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef TRACE_H_
-#define TRACE_H_
-
-#define TR_T_irq                       1
-#define TR_T_irq_rx                    2
-#define TR_T_irq_tx                    3
-#define TR_T_irq_sysTimer              4
-#define TR_T_irq_adv                   5
-
-
-#define TR_T_irq_cmddone               6
-#define TR_T_irq_rxTmt                 7
-#define TR_T_irq_rxFirstTmt            8
-#define TR_T_irq_fsmTmt                9
-
-
-
-#define TR_T_ll_brx_start              10
-#define TR_T_ll_brx_post               11
-
-#define TR_T_ll_btx_start              12
-#define TR_T_ll_btx_post               13
-#define TR_T_ll_1stRx                  14
-
-#define TR_T_ll_terminate              15
-
-#define TR_T_rx_crc                    18
-#define TR_T_rx_conn                   20
-
-
-#define TR_T_slot_update               20
-#define TR_T_slot_runout               22
-#define TR_T_slot_rebuild              23
-#define TR_T_slot_locate               24
-#define TR_T_slot_task                 25
-
-#define TR_T_slot_jump                 26
-
-#define TR_T_slave_sync                30
-#define TR_T_slave_sync_done           31
-
-
-#define TR_24_ll_chn                   0
-#define TR_24_ll_duration              1
-
-
-#endif
diff --git a/stack/ble/phy/phy.h b/stack/ble/phy/phy.h
deleted file mode 100644
index da0b343..0000000
--- a/stack/ble/phy/phy.h
+++ /dev/null
@@ -1,191 +0,0 @@
-/******************************************************************************
- * @file     phys.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-#ifndef PHY_H_
-#define PHY_H_
-
-
-
-#include "stack/ble/hci/hci_cmd.h"
-
-
-
-
-
-
-/********************* Macro & Enumeration variables for Stack, user can not use!!!!  **********************/
-#define PHY_USED_AUXPTR_LE_1M                                    0
-#define PHY_USED_AUXPTR_LE_2M                                    1
-#define PHY_USED_AUXPTR_LE_CODED                                 2
-
-
-
-typedef struct{
-    u8    llid;
-    u8    rf_len;
-    u8    opcode;
-    u8    tx_phys;
-    u8    rx_phys;
-}rf_pkt_ll_phy_req_rsp_t;   //phy_req, phy_rsp
-
-
-typedef struct{
-    u8    llid;
-    u8    rf_len;
-    u8    opcode;
-    u8    m_to_s_phy;
-    u8    s_to_m_phy;
-    u8    instant0;
-    u8    instant1;
-}rf_pkt_ll_phy_update_ind_t;   //phy_req, phy_rsp
-
-
-
-typedef enum{
-    LE_CODED_S2 = 2,
-    LE_CODED_S8 = 8,
-}le_coding_ind_t;
-
-
-
-typedef struct {
-    u8    dft_tx_prefer_phys;
-    u8    dft_rx_prefer_phys;
-    u8    dft_prefer_phy;
-    u8    dft_CI;
-
-    //for Extended ADV
-    u8    cur_llPhy;
-    u8    cur_CI;  //cur_coding_ind
-    u16 rsvd;
-}ll_phy_t;
-extern _attribute_aligned_(4) ll_phy_t        bltPHYs;
-
-
-
-//do not support Asymmetric PHYs, conn_phys = tx_phys & rx_phys
-typedef struct {
-    u8    conn_prefer_phys;  // conn_prefer_phys = tx_prefer_phys & rx_prefer_phys
-    u8    conn_cur_phy;       //
-    u8    conn_next_phy;       //
-    u8    conn_cur_CI;       // CI: coding_ind
-
-    u8    conn_next_CI;
-    u8    phy_req_trigger;  // 1: means current device triggers phy_req, due to API "blc_ll_setPhy" called by Host or Application
-    u8    phy_req_pending;
-    u8    phy_update_pending;
-
-    u32    conn_update_phy;
-
-    #if 0
-        u8    tx_prefer_phys;        //phy set
-        u8    rx_prefer_phys;
-        u8    tx_next_phys;
-        u8    rx_next_phys;
-
-        u8    cur_tx_phy;        //phy using
-        u8    cur_rx_phy;
-        u16   rsvd;
-    #endif
-
-}ll_conn_phy_t;
-
-
-
-
-typedef ll_conn_phy_t* (*ll_get_conn_phy_ptr_callback_t)(u16);
-extern ll_get_conn_phy_ptr_callback_t  ll_get_conn_phy_ptr_cb;
-
-
-extern u8   tx_settle_adv[4];
-extern u8   tx_settle_slave[4];
-extern u8   tx_settle_master[4];
-
-
-/******************************* Macro & Enumeration variables for User ************************************/
-
-typedef enum {
-    BLE_PHY_1M             = 0x01,
-    BLE_PHY_2M             = 0x02,
-    BLE_PHY_CODED          = 0x03,
-} le_phy_type_t;
-
-typedef enum {
-    PHY_PREFER_1M         = BIT(0),
-    PHY_PREFER_2M         = BIT(1),
-    PHY_PREFER_CODED      = BIT(2),
-} le_phy_prefer_type_t;
-
-
-
-typedef enum {
-    PHY_TRX_PREFER        = 0,                    //has      preference among TX & RX PHYs
-    PHY_TX_NO_PREFER      = BIT(0),               //has no preference among TX PHYs
-    PHY_RX_NO_PREFER      = BIT(1),                //has no preference among RX PHYs
-    PHY_TRX_NO_PREFER     = (BIT(0) | BIT(1)),    //has no preference among TX & RX PHYs
-} le_phy_prefer_mask_t;
-
-
-
-
-
-
-typedef enum {
-    CODED_PHY_PREFER_NONE     = 0,
-    CODED_PHY_PREFER_S2       = 1,
-    CODED_PHY_PREFER_S8       = 2,
-} le_ci_prefer_t;   //le coding indication prefer
-
-
-
-/************************************ User Interface  ******************************************************/
-void        blc_ll_init2MPhyCodedPhy_feature(void);
-
-ble_sts_t     blc_ll_setDefaultPhy(le_phy_prefer_mask_t all_phys, le_phy_prefer_type_t tx_phys, le_phy_prefer_type_t rx_phys);
-
-ble_sts_t    blc_ll_readPhy(u16 connHandle, hci_le_readPhyCmd_retParam_t *);
-
-ble_sts_t      blc_ll_setPhy(    u16 connHandle,                    le_phy_prefer_mask_t all_phys,
-                            le_phy_prefer_type_t tx_phys,     le_phy_prefer_type_t rx_phys,
-                            le_ci_prefer_t phy_options);
-
-
-
-ble_sts_t    blc_ll_setDefaultConnCodingIndication(le_ci_prefer_t prefer_CI);
-
-
-
-/*********************************** Stack Interface, user can not use!!! **********************************/
-int     blt_reset_conn_phy_param(ll_conn_phy_t* pconn_phy);
-void     rf_ble_switch_phy(le_phy_type_t phy, le_coding_ind_t coding_ind);
-
-typedef void (*ll_phy_switch_callback_t)(le_phy_type_t, le_coding_ind_t);
-extern ll_phy_switch_callback_t        ll_phy_switch_cb;
-
-
-
-
-#endif /* PHY_H_ */
diff --git a/stack/ble/phy/phy_test.h b/stack/ble/phy/phy_test.h
deleted file mode 100644
index 91392ae..0000000
--- a/stack/ble/phy/phy_test.h
+++ /dev/null
@@ -1,134 +0,0 @@
-/******************************************************************************
- * @file     phy_test.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-
-
-#ifndef PHY_TEST_H_
-#define PHY_TEST_H_
-
-#include "tl_common.h"
-
-#ifndef            PHYTEST_MODE_DISABLE
-#define            PHYTEST_MODE_DISABLE                    0
-#endif
-
-#ifndef            PHYTEST_MODE_THROUGH_2_WIRE_UART
-#define            PHYTEST_MODE_THROUGH_2_WIRE_UART        1   //Direct Test Mode through a 2-wire UART interface
-#endif
-
-#ifndef            PHYTEST_MODE_OVER_HCI_WITH_USB
-#define            PHYTEST_MODE_OVER_HCI_WITH_USB          2   //Direct Test Mode over HCI(UART hardware interface)
-#endif
-
-#ifndef            PHYTEST_MODE_OVER_HCI_WITH_UART
-#define            PHYTEST_MODE_OVER_HCI_WITH_UART         3   //Direct Test Mode over HCI(USB  hardware interface)
-#endif
-
-
-#define            BLC_PHYTEST_DISABLE                     0
-#define            BLC_PHYTEST_ENABLE                      1
-
-
-
-#define            PHY_CMD_SETUP                           0
-#define            PHY_CMD_RX                              1
-#define            PHY_CMD_TX                              2
-#define            PHY_CMD_END                             3
-
-
-#define            PKT_TYPE_PRBS9                          0
-#define            PKT_TYPE_0X0F                           1
-#define            PKT_TYPE_0X55                           2
-#define            PKT_TYPE_0XFF                           3
-
-#define            PKT_TYPE_HCI_PRBS9                      0
-#define            PKT_TYPE_HCI_0X0F                       1
-#define            PKT_TYPE_HCI_0X55                       2
-#define            PKT_TYPE_HCI_PRBS15                     3
-#define            PKT_TYPE_HCI_0XFF                       4
-#define            PKT_TYPE_HCI_0X00                       5
-#define            PKT_TYPE_HCI_0XF0                       6
-#define            PKT_TYPE_HCI_0XAA                       7
-enum{
-    PHY_EVENT_STATUS     = 0,
-    PHY_EVENT_PKT_REPORT = 0x8000,
-};
-
-enum{
-    PHY_STATUS_SUCCESS      = 0,
-    PHY_STATUS_FAIL         = 0x0001,
-};
-
-
-
-
-
-typedef struct {
-    u8 cmd;
-    u8 tx_start;
-    u16 pkts;
-
-    u32 tick_tx;
-}phy_data_t;
-
-
-
-
-
-
-
-
-/******************************* User Interface  ************************************/
-void       blc_phy_initPhyTest_module(void);
-
-ble_sts_t blc_phy_setPhyTestEnable (u8 en);
-bool       blc_phy_isPhyTestEnable(void);
-
-
-//user for phy test 2 wire uart mode
-int      phy_test_2_wire_rx_from_uart (void);
-int      phy_test_2_wire_tx_to_uart (void);
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-
-int       blc_phy_test_main_loop(void);
-
-int       blc_phytest_cmd_handler (u8 *p, int n);
-
-ble_sts_t blc_phy_setReceiverTest (u8 rx_chn);
-ble_sts_t blc_phy_setTransmitterTest (u8 tx_chn, u8 length, u8 pkt_type);
-ble_sts_t blc_phy_setPhyTestEnd(u8 *pkt_num);
-
-ble_sts_t blc_phy_reset(void);
-void blc_phy_preamble_length_set(unsigned char len);
-void phy_test_driver_init(RF_ModeTypeDef rf_mode);
-
-
-
-
-
-#endif /* PHY_TEST_H_ */
diff --git a/stack/ble/service/ble_ll_ota.h b/stack/ble/service/ble_ll_ota.h
deleted file mode 100644
index 059cc48..0000000
--- a/stack/ble/service/ble_ll_ota.h
+++ /dev/null
@@ -1,127 +0,0 @@
-/******************************************************************************
- * @file     ble_ll_ota.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ble_ll_ota.h
- *
- *  Created on: 2015-7-20
- *      Author: Administrator
- */
-
-#ifndef BLE_LL_OTA_H_
-#define BLE_LL_OTA_H_
-
-
-#ifndef BLE_OTA_FW_CHECK_EN
-#define BLE_OTA_FW_CHECK_EN                    1
-#endif
-
-#define FW_MAX_SIZE                            0x40000            //256K
-
-#define CMD_OTA_FW_VERSION                     0xff00
-#define CMD_OTA_START                          0xff01
-#define CMD_OTA_END                            0xff02
-#define CMD_OTA_AUTHENTICATION                 0xff03
-#define CMD_OTA_SCHEDULE                       0xff04
-
-#define FLAG_FW_CHECK                          0x5D
-#define FW_CHECK_AGTHM2                        0x02
-
-
-
-typedef struct{
-    u8  ota_start_flag;
-#if (BLE_OTA_FW_CHECK_EN)
-    u8  fw_check_en;
-    u8  fw_check_match;
-    u8  rsvd;
-
-    u32 fw_crc_init;
-
-    u16 fw_crc_last_index;
-#endif
-}ota_service_t;
-
-extern ota_service_t blcOta;
-
-
-extern int blt_ota_start_flag;
-extern u32 blt_ota_start_tick;
-extern u32 blt_ota_timeout_us;
-
-extern u32 ota_program_offset;
-extern int ota_firmware_size_k;
-extern int ota_program_bootAddr;
-
-
-typedef void (*ota_startCb_t)(void);
-typedef void (*ota_versionCb_t)(void);
-
-typedef void (*ota_resIndicateCb_t)(int result);
-
-extern ota_resIndicateCb_t otaResIndicateCb;
-
-
-enum{
-     OTA_SUCCESS = 0,      //success
-     OTA_PACKET_LOSS,      //lost one or more OTA PDU
-     OTA_DATA_CRC_ERR,     //data CRC err
-     OTA_WRITE_FLASH_ERR,  //write OTA data to flash ERR
-     OTA_DATA_UNCOMPLETE,  //lost last one or more OTA PDU
-     OTA_TIMEOUT,           //
-     OTA_FW_CHECK_ERR,
-     OTA_LOW_VOLTAGE,
-     OTA_START_KEY_ERR,    //8
-
-     //app not
-     OTA_USER_TERMINATE,   //9
-     OTA_SIGNATURE_ERR,   //
-
-};
-
-void bls_ota_procTimeout(void);
-
-//user interface
-void bls_ota_registerStartCmdCb(ota_startCb_t cb);
-void bls_ota_registerVersionReqCb(ota_versionCb_t cb);
-void bls_ota_registerResultIndicateCb(ota_resIndicateCb_t cb);
-
-void bls_ota_setTimeout(u32 timeout_us);
-
-extern int otaWrite(void * p);
-extern int otaRead(void * p);
-extern _attribute_data_retention_    int        ota_program_bootAddr;
-
-
-//firmware_size_k  must be 4k aligned
-void bls_ota_set_fwSize_and_fwBootAddr(int firmware_size_k, int boot_addr);
-
-
-
-void bls_ota_clearNewFwDataArea(void);
-
-unsigned short crc16 (unsigned char *pD, int len);
-
-#endif /* BLE_LL_OTA_H_ */
diff --git a/stack/ble/service/device_information.h b/stack/ble/service/device_information.h
index 97ee88e..6329b56 100644
--- a/stack/ble/service/device_information.h
+++ b/stack/ble/service/device_information.h
@@ -23,39 +23,12 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-
 #pragma once
 
-#include "tl_common.h"
-//#include <stack/ble/att.h>
-#include "../ble_common.h"
-//#include <stack/ble/gap.h>
-
-/** @addtogroup  TELINK_BLE_STACK TELINK BLE Stack
- *  @{
- */
-
-/** @addtogroup  SERVICE_MODULE Service
- *  @{
- */
-
-
-/** @addtogroup  DEVICE_INFO_Module Device Information
- *  @{
- */
-
-/** @addtogroup  DEVICE_INFO_Constant Device Information Constants
- *  @{
- */
 
 /**
- *  @brief  Definition for Characteristics UUID
+ * @brief    device_char_uuid Device Information Characteristic UUID
  */
-
-/** @addtogroup device_char_uuid Device Information Characteristc UUID
- * @{
- */
-
 #define CHARACTERISTIC_UUID_MANU_NAME_STRING                    0x2A29
 #define CHARACTERISTIC_UUID_MODEL_NUM_STRING                    0x2A24
 #define CHARACTERISTIC_UUID_SERIAL_NUM_STRING                   0x2A25
@@ -65,85 +38,3 @@
 #define CHARACTERISTIC_UUID_SYSTEM_ID                           0x2A23
 #define CHARACTERISTIC_UUID_IEEE_11073_CERT_LIST                0x2A2A
 #define CHARACTERISTIC_UUID_PNP_ID                              0x2A50
-
-/** @} end of group device_char_uuid */
-
-
-/** @addtogroup  IEEE_AUTHORITATIVE_BODY_VALUES IEEE Authoritative Body Values
- *  @{
- */
-
-/**
- *  @brief  IEEE 11073 authoritative body values
- */
-#define IEEE_11073_BODY_EMPTY                                   0
-#define IEEE_11073_BODY_IEEE                                    1
-#define IEEE_11073_BODY_CONTINUA                                2
-#define IEEE_11073_BODY_EXP                                     254
-
-/** @} end of group IEEE_AUTHORITATIVE_BODY_VALUES */
-
-
-
-
-/** @addtogroup  SYSTEM_ID_LEN System Id Len
- *  @{
- */
-
-/**
- *  @brief  Definition for System ID length
- */
-#define SYSTEM_ID_LEN                                           8
-
-/** @} end of group SYSTEM_ID_LEN */
-
-
-
-/** @addtogroup  PNP_ID_LEN PnP ID Len
- *  @{
- */
-
-/**
- *  @brief  Definition for PnP ID length
- */
-#define DEVINFO_PNP_ID_LEN                                      7
-
-/** @} end of group PNP_ID_LEN */
-
-/** @} end of group DEVICE_INFO_Constant */
-
-
-
- /** @addtogroup  DEVICE_INFORMATION_Variables Device Information Variables
- *  @{
- */
-
-/**
- *  @brief  External variable for device information Attribute tables
- */
-
-extern  attribute_t devInfo_attrTbl[];
-
-/**
- *  @brief  External variable for device information attribute size
- */
-extern u16         devInfo_attrSize;
-
-/** @} end of group DEVICE_INFORMATION_Variables */
-
-
-
-
- /** @addtogroup  PUBLIC_FUNCTION Device Information APIs
- *  @{
- */
-
-
-
-/** @} end of group PUBLIC_FUNCTION */
-
-/** @} end of group DEVICE_INFO_Module */
-
-/** @} end of group SERVICE_MODULE */
-
-/** @} end of group TELINK_BLE_STACK */
diff --git a/stack/ble/service/hids.h b/stack/ble/service/hids.h
index f74b088..357a94d 100644
--- a/stack/ble/service/hids.h
+++ b/stack/ble/service/hids.h
@@ -23,37 +23,12 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-
 #pragma once
 
-#include "tl_common.h"
-//#include "../att.h"
-
-/** @addtogroup  TELINK_BLE_STACK TELINK BLE Stack
- *  @{
- */
-
-/** @addtogroup  SERVICE_MODULE Service
- *  @{
- */
-
-
-/** @addtogroup  HIDS_Module Hids
- *  @{
- */
-
-/** @addtogroup  Hids_Constant Hids Constants
- *  @{
- */
 
 /**
- *  @brief  Definition for Characteristics UUID
+ * @brief    hids_uuid Hids Characteristic UUID
  */
-
-/** @addtogroup hids_uuid Hids Charactersitc UUID
- * @{
- */
-
 #define CHARACTERISTIC_UUID_HID_BOOT_KEY_INPUT          0x2A22    //!< HID Boot Keyboard Input Report
 #define CHARACTERISTIC_UUID_HID_BOOT_KEY_OUTPUT         0x2A32    //!< HID Boot Keyboard Output Report
 #define CHARACTERISTIC_UUID_HID_BOOT_MOUSE_INPUT        0x2A33    //!< HID Boot Mouse Input Report
@@ -63,17 +38,10 @@
 #define CHARACTERISTIC_UUID_HID_REPORT                  0x2A4D    //!< HID Report
 #define CHARACTERISTIC_UUID_HID_PROTOCOL_MODE           0x2A4E    //!< HID Protocol Mode
 
-/** @} end of group hids_uuid */
-
-
-/** @addtogroup  HID_REPORT_ID Hid Report Id
- *  @{
- */
 
 /**
  *  @brief  HID Report ID
  */
-
 #define HID_REPORT_ID_KEYBOARD_INPUT                    1   //!< Keyboard input report ID
 #define HID_REPORT_ID_CONSUME_CONTROL_INPUT             2   //!< Consumer Control input report ID
 #define HID_REPORT_ID_MOUSE_INPUT                       3   //!< Mouse input report ID
@@ -87,12 +55,10 @@
 #define HID_REPORT_ID_AUDIO_SECND_INPUT                 11//251
 #define HID_REPORT_ID_AUDIO_THIRD_INPUT                 12//247
 
-/** @} end of group HID_REPORT_ID */
 
+#define HID_REPORT_ID_OTA_INPUT                            0x20
+#define HID_REPORT_ID_OTA_OUTPUT                        0x21
 
-/** @addtogroup  HID_REPORT_TYPE Hid Report Type
- *  @{
- */
 
 /**
  *  @brief  HID Report type
@@ -102,13 +68,8 @@
 #define HID_REPORT_TYPE_OUTPUT                          2
 #define HID_REPORT_TYPE_FEATURE                         3
 
-/** @} end of group HID_REPORT_TYPE */
 
 
-/** @addtogroup  HID_PROTOCOL_MODE Hid Protocol Mode
- *  @{
- */
-
 /**
  *  @brief  Definition for HID protocol mode
  */
@@ -116,105 +77,10 @@
 #define HID_PROTOCOL_MODE_REPORT                        1
 #define DFLT_HID_PROTOCOL_MODE                          HID_PROTOCOL_MODE_REPORT
 
-/** @} end of group HID_PROTOCOL_MODE */
 
 
-/** @addtogroup  HID_INFOR_FLAGS Hid Information Flags
- *  @{
- */
 /**
  *  @brief  Definition for HID information flags
  */
 #define HID_FLAGS_REMOTE_WAKE                           0x01      // RemoteWake
 #define HID_FLAGS_NORMALLY_CONNECTABLE                  0x02      // NormallyConnectable
-
-/** @} end of group HID_INFOR_FLAGS */
-
-#define HID_KEYCODE_CC_RELEASE                          0x00
-#define HID_KEYCODE_CC_VOL_UP                           0x01
-#define HID_KEYCODE_CC_VOL_DN                           0x02
-
-
-/** @} end of group Hids_Constant */
-
-
-
-
-/** @addtogroup  Hids_Callbacks Hids Callbacks
- *  @{
- */
-
-/**
- *  @brief  Definition argutment type of report change callback function
- */
-typedef struct {
-    u8 id;
-    u8 type;
-    u8 len;
-    u8 value[1];
-} reportChange_t;
-
-/**
- *  @brief  Definition argutment type of CCC change callback function
- */
-typedef struct {
-    u8 id;
-    u8 type;
-    u8 value;
-} clientCharCfgChange_t;
-
-/**
- *  @brief  Definition client characterist configuration of report changed callback function type for user application
- */
-typedef void (*hids_clientCharCfgChangeCb_t)(clientCharCfgChange_t* cccVal);
-
-/**
- *  @brief  Definition report value changed callback function type for user application
- */
-typedef void (*hids_reportChangeCb_t)(reportChange_t* reportVal);
-
-/**
- *  @brief  Definition report value changed callback function type for user application
- */
-typedef void (*hids_protoModeChangeCb_t)(u32 protoMode);
-
-/**
- *  @brief  Definition report value changed callback function type for user application
- */
-typedef void (*hids_ctrlPointChangeCb_t)(u32 ctrlPoint);
-
-/**
- *  @brief  Definition for foundation command callbacks.
- */
-typedef struct {
-    hids_reportChangeCb_t         reportChangeCbFunc;     //!< report value changed callback function
-    hids_protoModeChangeCb_t      protoModeChangeCbFunc;  //!< protocol mode value changed callback function
-    hids_ctrlPointChangeCb_t      ctrlPointChangeCbFunc;  //!< control point value changed callback function
-    hids_clientCharCfgChangeCb_t  cccChangedCbFunc;       //!< ccc of report changed callback function
-} hids_callbacks_t;
-
-/** @} end of group Hids_Callbacks */
-
-
- /** @addtogroup  HIDS_Variables  Hids Variables
- *  @{
- */
-
-
-
-/** @} end of group HIDS_Variables */
-
-
-/** @addtogroup  HIDS_Functions Hids APIs
- *  @{
- */
-
-
-
-/** @} end of group HIDS_Functions */
-
-/** @} end of group HIDS_Module */
-
-/** @} end of group SERVICE_MODULE */
-
-/** @} end of group TELINK_BLE_STACK */
diff --git a/stack/ble/service/ota/ota.h b/stack/ble/service/ota/ota.h
new file mode 100644
index 0000000..6579fc9
--- /dev/null
+++ b/stack/ble/service/ota/ota.h
@@ -0,0 +1,180 @@
+/******************************************************************************
+ * @file     ota.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef OTA_H_
+#define OTA_H_
+
+
+
+#define CMD_OTA_VERSION                        0xFF00    //client -> server
+#define CMD_OTA_START                        0xFF01    //client -> server
+#define CMD_OTA_END                            0xFF02    //client -> server
+
+/**
+ * @brief     Extended OTA command
+ */
+#define CMD_OTA_START_EXT                    0xFF03    //client -> server
+#define CMD_OTA_FW_VERSION_REQ                0xFF04    //client -> server
+#define CMD_OTA_FW_VERSION_RSP                0xFF05    //server -> client
+#define CMD_OTA_RESULT                        0xFF06    //server -> client
+#define CMD_OTA_SCHEDULE_PDU_NUM            0xFF08    //server -> client
+#define CMD_OTA_SCHEDULE_FW_SIZE            0xFF09    //server -> client
+
+
+
+/**
+ * @brief     Multiple boot address enumarion
+ */
+typedef enum{
+    MULTI_BOOT_ADDR_0x20000     = 0x20000,    //128 K
+    MULTI_BOOT_ADDR_0x40000        = 0x40000,  //256 K
+    MULTI_BOOT_ADDR_0x80000        = 0x80000,  //512 K
+}multi_boot_addr_e;
+
+
+
+/**
+ * @brief    OTA result
+ */
+enum{
+    //0x00
+    OTA_SUCCESS             = 0,             //success
+    OTA_DATA_PACKET_SEQ_ERR,                 //OTA data packet sequence number error: repeated OTA PDU or lost some OTA PDU
+    OTA_PACKET_INVALID,                      //invalid OTA packet: 1. invalid OTA command; 2. addr_index out of range; 3.not standard OTA PDU length
+    OTA_DATA_CRC_ERR,                        //packet PDU CRC err
+
+    //0x04
+    OTA_WRITE_FLASH_ERR,                     //write OTA data to flash ERR
+    OTA_DATA_UNCOMPLETE,                     //lost last one or more OTA PDU
+    OTA_FLOW_ERR,                            //peer device send OTA command or OTA data not in correct flow
+    OTA_FW_CHECK_ERR,                        //firmware CRC check error
+
+    //0x08
+    OTA_VERSION_COMPARE_ERR,                 //the version number to be update is lower than the current version
+    OTA_PDU_LEN_ERR,                         //PDU length error: not 16*n, or not equal to the value it declare in "CMD_OTA_START_EXT" packet
+    OTA_FIRMWARE_MARK_ERR,                   //firmware mark error: not generated by telink's BLE SDK
+    OTA_FW_SIZE_ERR,                         //firmware size error: no firmware_size; firmware size too small or too big
+
+    //0x0C
+    OTA_DATA_PACKET_TIMEOUT,                 //time interval between two consequent packet exceed a value(user can adjust this value)
+    OTA_TIMEOUT,                             //OTA flow total timeout
+    OTA_FAIL_DUE_TO_CONNECTION_TERMIANTE,    //OTA fail due to current connection terminate(maybe connection timeout or local/peer device terminate connection)
+
+};
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_START"
+ */
+typedef struct {
+    u16      ota_cmd;
+} ota_start_t;
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_END"
+ */
+typedef struct {
+    u16      ota_cmd;
+    u16        adr_index_max;
+    u16        adr_index_max_xor;
+} ota_end_t;
+
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_START_EXT"
+ */
+typedef struct {
+    u16      ota_cmd;
+    u8        pdu_length;            //must be: 16*n(n is in range of 1 ~ 15); pdu_length: 16,32,48,...240
+    u8        version_compare;    //0: no version compare; 1: only higher version can replace lower version
+    u8        rsvd[16];            //reserved for future use
+} ota_startExt_t;
+
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_RESULT"
+ */
+typedef struct {
+    u16      ota_cmd;
+    u8        result;
+} ota_result_t;
+
+
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_FW_VERSION_REQ"
+ */
+typedef struct {
+    u16      ota_cmd;
+    u16        version_num;
+    u8        version_compare;   //1: only higher version can replace lower version
+} ota_versionReq_t;
+
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_FW_VERSION_RSP"
+ */
+typedef struct {
+    u16      ota_cmd;
+    u16        version_num;
+    u8        version_accept;      //1: accept firmware update; 0: reject firmware update(version compare enable, and compare result: fail)
+} ota_versionRsp_t;
+
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_SCHEDULE_PDU_NUM"
+ */
+typedef struct {
+    u16      success_pdu_cnt;    // successful OTA PDU number
+} ota_sche_pdu_num_t;
+
+/**
+ *  @brief data structure of OTA command "CMD_OTA_SCHEDULE_FW_SIZE"
+ */
+typedef struct {
+    u32        success_fw_size;    // successful OTA firmware size (unit: Byte)
+} ota_sche_fw_size_t;
+
+
+
+
+typedef struct{
+    u16 adr_index;
+    u8    data[16];
+    u16 crc_16;
+}ota_pdu16_t;
+
+
+unsigned long crc32_half_cal(unsigned long crc, unsigned char* input, unsigned long* table, int len);
+unsigned long crc32_cal(unsigned long crc, unsigned char* input, unsigned long* table, int len);
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    #define    bls_ota_registerStartCmdCb            blc_ota_registerOtaStartCmdCb
+    #define    bls_ota_registerVersionReqCb        blc_ota_registerOtaFirmwareVersionReqCb
+    #define    bls_ota_registerResultIndicateCb    blc_ota_registerOtaResultIndicationCb
+    #define bls_ota_setTimeout(tm_us)            blc_ota_setOtaProcessTimeout( (tm_us)/1000000 )
+#endif
+
+#endif /* OTA_H_ */
diff --git a/stack/ble/service/ota/ota_server.h b/stack/ble/service/ota/ota_server.h
new file mode 100644
index 0000000..5ae4293
--- /dev/null
+++ b/stack/ble/service/ota/ota_server.h
@@ -0,0 +1,206 @@
+/******************************************************************************
+ * @file     ota_server.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef STACK_BLE_SERVICE_OTA_OTA_SERVER_H_
+#define STACK_BLE_SERVICE_OTA_OTA_SERVER_H_
+
+
+
+
+/**
+ * @brief    OTA start command callback declaration
+ */
+typedef void (*ota_startCb_t)(void);
+
+/**
+ * @brief    OTA version callback declaration
+ */
+typedef void (*ota_versionCb_t)(void);
+
+/**
+ * @brief        OTA result indicate callback declaration
+ * @param[in]   result - OTA result
+ */
+typedef void (*ota_resIndicateCb_t)(int result);
+
+
+
+
+
+/**
+ * @brief      this function is used for user to initialize OTA server module.
+ *                //attention: this API must called before any other OTA relative settings.
+ * @param       none
+ * @return     none
+ */
+void blc_ota_initOtaServer_module(void);
+
+
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    /**
+     * @brief      This function is used to set OTA new firmware storage address on Flash.
+     * @param[in]  new_fw_addr - new firmware storage address, can only choose from multiple boot address
+     *                              supported by MCU
+     * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+     */
+    ble_sts_t blc_ota_setNewFirmwwareStorageAddress(multi_boot_addr_e new_fw_addr);
+
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    /**
+     * @brief      This function is used to set OTA new firmware storage address on Flash.
+     * @param[in]  firmware_size_k - firmware maximum size unit: K Byte; must be 4K aligned
+     * @param[in]  boot_addr - new firmware storage address, can only choose from multiple boot address
+     *                              supported by MCU
+     * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+     */
+    ble_sts_t bls_ota_set_fwSize_and_fwBootAddr(int firmware_size_k, multi_boot_addr_e boot_addr);
+
+#endif
+
+
+
+
+/**
+ * @brief      This function is used to set OTA firmware version number.
+ *                if user use version compare to decide if OTA update, should use this API to set firmware version.
+ * @param[in]  version_number - firmware version number
+ * @return     none
+ */
+void blc_ota_setFirmwareVersionNumber(u16 version_number);
+
+
+
+
+
+
+
+
+
+
+/**
+ * @brief      This function is used to register OTA start command callback.
+ *                when local device receive OTA command  "CMD_OTA_START" and  "CMD_OTA_START_EXT"  form peer device,
+ *                after checking all parameters are correct, local device will enter OTA update and trigger OTA start command callback.
+ * @param[in]  cb - callback function
+ * @return     none
+ */
+void blc_ota_registerOtaStartCmdCb(ota_startCb_t cb);
+
+
+
+
+
+
+/**
+ * @brief      This function is used to register OTA version command callback
+ *                when local device receive OTA command  "CMD_OTA_VERSION", trigger this callback.
+ * @param[in]  cb - callback function
+ * @return     none
+ */
+void blc_ota_registerOtaFirmwareVersionReqCb(ota_versionCb_t cb);
+
+
+
+
+
+/**
+ * @brief      This function is used to register OTA result indication callback
+ * @param[in]  cb - callback function
+ * @return     none
+ */
+void blc_ota_registerOtaResultIndicationCb(ota_resIndicateCb_t cb);
+
+
+
+
+/**
+ * @brief      This function is used to set OTA whole process timeout value
+ *                if not set, default value is 30 S
+ * @param[in]  timeout_second - timeout value, unit: S, should in range of 4 ~ 250
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t blc_ota_setOtaProcessTimeout(int timeout_second);
+
+
+
+/**
+ * @brief      This function is used to set OTA packet interval timeout value
+ *                if not set, default value is 5 S
+ * @param[in]  timeout_ms - timeout value, unit: mS, should in range of 1 ~ 20
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t blc_ota_setOtaDataPacketTimeout(int timeout_second);
+
+
+/**
+ * @brief      This function is used to set resolution of OTA schedule indication by PDU number
+ * @param[in]  pdu_num -
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t blc_ota_setOtaScheduleIndication_by_pduNum(int pdu_num);
+
+
+/**
+ * @brief      This function is used to set resolution of OTA schedule indication by firmware size
+ * @param[in]  fw_size -
+ * @return     Status - 0x00: command succeeded; 0x01-0xFF: command failed
+ */
+ble_sts_t blc_ota_setOtaScheduleIndication_by_FiimwareSize(int fw_size);
+
+
+/**
+ * @brief      This function is used to calculate OTA notify data ATT handle by OTA write data ATT handle
+ * @param[in]  attHandle_offset - offset value from OTA write handle to OTA notify handle.
+ *                If not set, default value is 0 which means OTA write and notify in a same ATT handle.
+ * @return     none
+ */
+void      blc_ota_setAttHandleOffset(s8 attHandle_offset);
+
+
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    extern int otaWrite(u16 connHandle, void * p);
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    extern int otaWrite(void * p);
+#endif
+
+
+
+/**
+ * @brief      This function is used to erase flash area which will store new firmware.
+ * @param      none
+ * @return     none
+ */
+void bls_ota_clearNewFwDataArea(void);
+
+
+
+
+
+
+
+
+#endif /* STACK_BLE_SERVICE_OTA_OTA_SERVER_H_ */
diff --git a/stack/ble/service/uuid.h b/stack/ble/service/uuid.h
new file mode 100644
index 0000000..479becb
--- /dev/null
+++ b/stack/ble/service/uuid.h
@@ -0,0 +1,149 @@
+/******************************************************************************
+ * @file     uuid.h
+ *
+ * @brief    for TLSR chips
+ *
+ * @author   public@telink-semi.com;
+ * @date     Sep. 30, 2010
+ *
+ * @attention
+ *
+ *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *****************************************************************************/
+#ifndef SERVICE_UUID_H_
+#define SERVICE_UUID_H_
+
+
+/**
+ *  @brief  GATT 16 bit UUID definition
+ */
+#define GATT_UUID_PRIMARY_SERVICE        0x2800     //!< Primary Service
+#define GATT_UUID_SECONDARY_SERVICE      0x2801     //!< Secondary Service
+#define GATT_UUID_INCLUDE                0x2802     //!< Include
+#define GATT_UUID_CHARACTER              0x2803     //!< Characteristic
+#define GATT_UUID_CHAR_EXT_PROPS         0x2900     //!< Characteristic Extended Properties
+#define GATT_UUID_CHAR_USER_DESC         0x2901     //!< Characteristic User Description
+#define GATT_UUID_CLIENT_CHAR_CFG        0x2902     //!< Client Characteristic Configuration
+#define GATT_UUID_SERVER_CHAR_CFG        0x2903     //!< Server Characteristic Configuration
+#define GATT_UUID_CHAR_PRESENT_FORMAT    0x2904     //!< Characteristic Present Format
+#define GATT_UUID_CHAR_AGG_FORMAT        0x2905     //!< Characteristic Aggregate Format
+#define GATT_UUID_VALID_RANGE            0x2906     //!< Valid Range
+#define GATT_UUID_EXT_REPORT_REF         0x2907     //!< External Report Reference
+#define GATT_UUID_REPORT_REF             0x2908     //!< Report Reference
+
+#define GATT_UUID_DEVICE_NAME            0x2a00     //!< Report Reference
+#define GATT_UUID_APPEARANCE             0x2a01
+#define GATT_UUID_PERI_CONN_PARAM          0x2a04
+#define GATT_UUID_SERVICE_CHANGE         0x2a05
+#define    GATT_UUID_BATTERY_LEVEL             0x2A19
+#define    GATT_UUID_FIRMWARE_VER             0x2a26        //!<Firmware Version
+
+
+/**
+ *  @brief  Definition for Services UUID
+ */
+#define SERVICE_UUID_ALERT_NOTIFICATION                           0x1811
+#define SERVICE_UUID_BATTERY                                      0x180F
+#define SERVICE_UUID_BLOOD_PRESSURE                               0x1810
+#define SERVICE_UUID_CURRENT_TIME                                 0x1805
+#define SERVICE_UUID_CYCLING_POWER                                0x1818
+#define SERVICE_UUID_CYCLING_SPEED_AND_CADENCE                    0x1816
+#define SERVICE_UUID_DEVICE_INFORMATION                           0x180A
+#define SERVICE_UUID_GENERIC_ACCESS                               0x1800
+#define SERVICE_UUID_GENERIC_ATTRIBUTE                            0x1801
+#define SERVICE_UUID_GLUCOSE                                      0x1808
+#define SERVICE_UUID_HEALTH_THERMOMETER                           0x1809
+#define SERVICE_UUID_HEART_RATE                                   0x180D
+#define SERVICE_UUID_HUMAN_INTERFACE_DEVICE                       0x1812
+#define SERVICE_UUID_IMMEDIATE_ALERT                              0x1802
+#define SERVICE_UUID_LINK_LOSS                                    0x1803
+#define SERVICE_UUID_LOCATION_AND_NAVIGATION                      0x1819
+#define SERVICE_UUID_NEXT_DST_CHANGE                              0x1807
+#define SERVICE_UUID_PHONE_ALERT_STATUS                           0x180E
+#define SERVICE_UUID_REFERENCE_TIME_UPDATE                        0x1806
+#define SERVICE_UUID_RUNNING_SPEED_AND_CADENCE                    0x1814
+#define SERVICE_UUID_SCAN_PARAMETER                               0x1813
+#define SERVICE_UUID_TX_POWER                                     0x1804
+#define SERVICE_UUID_USER_DATA                                    0x181C
+#define SERVICE_UUID_CONTINUOUS_GLUCOSE_MONITORING                0x181F
+#define SERVICE_UUID_WEIGHT_SCALE                                 0x181D
+
+////////////////////////////////////
+// Telink Service
+////////////////////////////////////
+#if (MCU_CORE_TYPE == MCU_CORE_9518)
+    #define WRAPPING_BRACES(__DATAS__)            { __DATAS__ }
+    #define TELINK_SPP_UUID_SERVICE               0x10,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_SPP service
+    #define TELINK_AUDIO_UUID_SERVICE              0x11,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_SPP service
+    #define TELINK_OTA_UUID_SERVICE               0x12,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_OTA service
+    #define TELINK_MESH_UUID_SERVICE              0x20,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_SPP service
+    #define TELINK_MESH_LT_UUID_SERVICE          0x21,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_SPP service
+
+    #define TELINK_SPP_DATA_SERVER2CLIENT         0x10,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00     //!< TELINK_SPP data from server to client
+    #define TELINK_SPP_DATA_CLIENT2SERVER         0x11,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00     //!< TELINK_SPP data from client to server
+    #define TELINK_SPP_DATA_OTA                 0x12,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00     //!< TELINK_SPP data for ota
+    #define TELINK_SPP_DATA_PAIR                 0x13,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00     //!< TELINK_SPP data for ota
+    #define TELINK_SPP_DATA_DEFINE                 0x14,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00     //!< TELINK_SPP data for userdefine data
+
+
+    #define TELINK_MIC_DATA                         0x18,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_SPP data from server to client
+    #define TELINK_SPEAKER_DATA                     0x19,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00     //!< TELINK_SPP data from client to server
+
+
+    #define AUDIO_GOOGLE_SERVICE_UUID           0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x01,0x00,0x5E,0xAB
+    #define AUDIO_GOOGL_TX_CHAR_UUID            0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x02,0x00,0x5E,0xAB
+    #define AUDIO_GOOGL_RX_CHAR_UUID            0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x03,0x00,0x5E,0xAB
+    #define AUDIO_GOOGL_CTL_CHAR_UUID           0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x04,0x00,0x5E,0xAB
+
+#elif (MCU_CORE_TYPE == MCU_CORE_825x || MCU_CORE_TYPE == MCU_CORE_827x)
+    #define TELINK_SPP_UUID_SERVICE               {0x10,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
+    #define TELINK_AUDIO_UUID_SERVICE              {0x11,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
+    #define TELINK_OTA_UUID_SERVICE               {0x12,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_OTA service
+    #define TELINK_MESH_UUID_SERVICE              {0x20,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
+    #define TELINK_MESH_LT_UUID_SERVICE          {0x21,0x19,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}        //!< TELINK_SPP service
+
+    #define TELINK_SPP_DATA_SERVER2CLIENT         {0x10,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from server to client
+    #define TELINK_SPP_DATA_CLIENT2SERVER         {0x11,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from client to server
+    #define TELINK_SPP_DATA_OTA                  0x12,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00        //!< TELINK_SPP data for ota
+    #define TELINK_SPP_DATA_PAIR                 {0x13,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data for ota
+    #define TELINK_SPP_DATA_DEFINE                 {0x14,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data for userdefine data
+
+    #define TELINK_MIC_DATA                         {0x18,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from server to client
+    #define TELINK_SPEAKER_DATA                     {0x19,0x2B,0x0d,0x0c,0x0b,0x0a,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00}         //!< TELINK_SPP data from client to server
+
+
+    #define AUDIO_GOOGLE_SERVICE_UUID           {0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x01,0x00,0x5E,0xAB}
+    #define AUDIO_GOOGL_TX_CHAR_UUID            0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x02,0x00,0x5E,0xAB
+    #define AUDIO_GOOGL_RX_CHAR_UUID            0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x03,0x00,0x5E,0xAB
+    #define AUDIO_GOOGL_CTL_CHAR_UUID           0x64,0xB6,0x17,0xF6,0x01,0xAF,0x7D,0xBC,0x05,0x4F,0x21,0x5A,0x04,0x00,0x5E,0xAB
+    #define TELINK_IR_UUID_SERVICE              0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc0,0xbf,0x43,0xd3
+    #define TELINK_IR_PROG_CONTROL_UUID_SERVICE 0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc1,0xbf,0x43,0xd3
+    #define TELINK_IR_KEY_ID_UUID_SERVICE       0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc2,0xbf,0x43,0xd3
+    #define TELINK_IR_CODE_UUID_SERVICE         0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc3,0xbf,0x43,0xd3
+    #define TELINK_IR_SUPPRESS_UUID_SERVICE     0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc4,0xbf,0x43,0xd3
+    #define TELINK_IR_KEY_EVENT_UUID_SERVICE    0x64,0xb6,0x17,0xf6,0x01,0xaf,0x7d,0xbc,0x05,0x4f,0x21,0x5a,0xc5,0xbf,0x43,0xd3
+#endif
+
+#if (MP_TEST_MODE)
+#define TEST_MODE_SERVICE_UUID                 0x10,0x30,0x0D,0x0C,0x0B,0x0A,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00
+#define TEST_MODE_TEST_DATA_UUID               0x11,0x30,0x0D,0x0C,0x0B,0x0A,0x09,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0x00
+#endif
+
+#define CHARACTERISTIC_UUID_BATTERY_LEVEL                    0x2A19
+#define CHARACTERISTIC_UUID_ALERT_LEVEL                         0x2A06
+
+
+#endif  /* SERVICE_UUID_H_ */
diff --git a/stack/ble/smp/smp.h b/stack/ble/smp/smp.h
deleted file mode 100644
index 3db3178..0000000
--- a/stack/ble/smp/smp.h
+++ /dev/null
@@ -1,352 +0,0 @@
-/******************************************************************************
- * @file     smp.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * ble_smp.h
- *
- *  Created on: 2016-9-27
- *      Author: Telink
- */
-
-#ifndef BLE_SMP_H_
-#define BLE_SMP_H_
-
-#include "stack/ble/ble_common.h"
-#include "smp_const.h"
-
-
-//SMP TODO list:
-//1. SMP timeout process
-
-
-
-#ifndef    SIMPLE_MULTI_MAC_EN
-#define SIMPLE_MULTI_MAC_EN                    0
-#endif
-
-#define SMP_INFO_STORAGE_IN_FLASH             1
-#define SMP_INFO_STORAGE_IN_EEPROM            2
-#define SMP_INFO_STORAGE_OTHER_MCU            3
-
-
-
-//define smp database(keys/peer device informations ...)
-#ifndef SMP_DATABASE_INFO_SOURCE
-#define SMP_DATABASE_INFO_SOURCE                    SMP_INFO_STORAGE_IN_FLASH
-#endif
-
-
-
-
-
-#define SMP_STANDARD_PAIR       0
-#define SMP_FAST_CONNECT        1
-
-
-
-#define  ADDR_NOT_BONDED     0xFF
-#define  ADDR_NEW_BONDED     0xFE
-#define  ADDR_DELETE_BOND    0xFD
-
-#define  KEY_FLAG_IDLE       0xFF
-#define  KEY_FLAG_NEW        0xFE
-#define  KEY_FLAG_FAIL       0xFD
-
-
-#define        LL_CONNECTION_MAX                        1  //controller determine this value
-
-#if (SIMPLE_MULTI_MAC_EN)
-    #define     SMP_BONDING_DEVICE_MAX_NUM                16
-#else
-    #define     SMP_BONDING_DEVICE_MAX_NUM                4
-#endif
-
-typedef enum {
-    non_debug_mode = 0,  // ECDH distribute private/public key pairs
-    debug_mode = 1,      // ECDH use debug mode private/public key pairs
-} ecdh_keys_mode_t;
-
-
-typedef struct {
-
-    u8 paring_status;  //if multiConnection, define as paring_status[connMaxNum]
-    u8 addrIndex;
-    u8 keyIndex;
-    u8 cur_bondNum;
-
-#if (SMP_DATABASE_INFO_SOURCE == SMP_INFO_STORAGE_IN_FLASH)
-    u32 bond_flash_idx[SMP_BONDING_DEVICE_MAX_NUM];  //mark paired slave mac address in flash
-    u8    bond_flag[SMP_BONDING_DEVICE_MAX_NUM];
-    u32 index_update_method;
-#else
-    //may be sram address if use other mcu store smp info
-#endif
-
-} bond_device_t;
-
-extern _attribute_aligned_(4) bond_device_t  tbl_bondDevice;
-
-
-
-
-
-typedef struct {
-    u8 security_level;
-    u8 bonding_maxNum;
-    u8 bonding_mode;
-    u8 IO_capability;
-
-    u32 ecdh_debug_mode;//1:debug_mode,0:ecdh public/private key pairs distribute
-
-
-    u8 MITM_protetion;
-    u8 oob_enable;
-    u8 paring_method;  //paring_method
-    u8 keyPress_en;
-
-
-
-    u8 secure_conn; // final paring method is paring_method or not
-    u8 stk_method;  // final available stk generate method
-    u8 tk_status;
-    u8 peerKey_mask;    //determine which peer key to store   <0>: EncKey  <1>:IdKey   <2>:Sign, NOTE: not used now in code
-
-    u8 bonding_enable;
-    u8 paring_busy;
-    u8 key_distribute;
-    u8 save_key_flag;
-
-} smp_mng_t;
-
-extern _attribute_aligned_(4) smp_mng_t  blc_smpMng;
-
-
-
-
-/*
- * smp parameter about peer device.
- */
-typedef struct{
-    u8        rsvd;
-    u8         peer_addr_type;  //address used in link layer connection
-    u8        peer_addr[6];
-
-    u8        peer_key_size;   // bond and key_size
-    u8        peer_id_address_type;  //peer identity address information in key distribution, used to identify
-    u8        peer_id_address[6];
-
-    u8        paring_peer_rand[16];
-    u8        paring_confirm[16];  // in security connection oob mode to keep peer random
-
-    u8        peer_csrk[16];
-    u8        peer_irk[16];
-}smp_param_peer_t;
-
-extern _attribute_aligned_(4) smp_param_peer_t       smp_param_peer;
-
-
-/*
- * smp parameter about own device.
- */
-typedef struct{
-    u8                        paring_tk[16];   // in security connection to keep own random
-    u8                        own_ltk[16];   //used for generate ediv and random
-
-
-    smp_paring_req_rsp_t      paring_req;
-    smp_paring_req_rsp_t      paring_rsp;
-    smp_authReq_t             auth_req;
-    u8                        own_conn_type;  //current connection peer own type
-
-    u16                        rsvd;
-    u8                        own_conn_addr[6];
-
-
-}smp_param_own_t;
-
-extern _attribute_aligned_(4) smp_param_own_t        smp_param_own;
-
-
-
-
-
-
-typedef struct{
-    u8    type;                //RFU(3)_MD(1)_SN(1)_NESN(1)-LLID(2)
-    u8    rf_len;                //LEN(5)_RFU(3)
-    u16    l2capLen;
-    u16    chanId;
-    u8    opcode;
-    u8    data[21];
-}smp2llcap_type_t;
-
-typedef int (*smp_finish_callback_t)(void);
-void blm_smp_registerSmpFinishCb (smp_finish_callback_t cb);
-
-extern u8 smpPkShftCnt;
-
-extern u32 smp_timeout_start_tick;
-extern u8 smpDistirbuteKeyOrder;
-extern smp_keyDistribution_t smp_DistributeKeyInit ;
-extern smp_keyDistribution_t smp_DistributeKeyResp ;
-
-extern smp_finish_callback_t  blc_smpFinishCb;
-extern smp2llcap_type_t smpResSignalPkt;
-extern u8 smpOwnRand_const[16];
-extern u8 smpParingOwnIRK[16];
-extern u8 smpParingOwnCSRK[16];
-extern u8 smpOwnParingConfirm[16];
-
-typedef void (*smp_check_handler_t)(u32);
-typedef int (*smp_init_handler_t)(u16 conn, u8 *p);
-typedef u8 * (*smp_info_handler_t)(u16 conn);
-typedef void (*smp_bond_clean_handler_t)(void);
-typedef void (*smp_trigger_cb_t)(u16 conn_handle);
-
-
-#if (SECURE_CONNECTION_ENABLE)
-typedef u8 * (*smp_sc_cmd_handler_t)(u16 conn, u8*p);
-typedef void (*smp_sc_pushPkt_handler_t)(int type);
-extern const u8 PublicKey[64];
-extern const u8 PrivateKey[32];
-extern _attribute_aligned_(4) smp_sc_key_t             smp_sc_key;
-extern smp_sc_cmd_handler_t        func_smp_sc_proc;
-extern smp_sc_pushPkt_handler_t func_smp_sc_pushPkt_proc;
-#endif
-
-
-extern smp_check_handler_t        func_smp_check; //HID on android 7.0
-extern smp_init_handler_t        func_smp_init;
-extern smp_info_handler_t        func_smp_info;
-
-
-
-
-
-
-
-/******************************* User Interface  *****************************************/
-void         blc_smp_param_setBondingDeviceMaxNumber ( int device_num);
-
-void         blc_smp_setSecurityLevel(le_security_mode_level_t  mode_level);
-
-
-
-
-
-void         blc_smp_setParingMethods (paring_methods_t  method);    //select paring methods
-
-void         blc_smp_setSecurityParameters (  bonding_mode_t         mode,
-                                            int                 MITM_en,
-                                            int                 OOB_en,
-                                            int                    keyPress_en,
-                                            io_capability_t     ioCapablility);
-
-void         blc_smp_setBondingMode(bonding_mode_t mode);               //set bonding_mode
-void         blc_smp_enableAuthMITM (int MITM_en);                        //enable authentication MITM protection
-void         blc_smp_enableOobAuthentication (int OOB_en);               //enable OOB authentication
-void         blc_smp_setIoCapability (io_capability_t  ioCapablility);  //set IO capability for passKey Entry/Numeric Comparison
-void         blc_smp_enableKeypress (int keyPress_en);
-void         blc_smp_setEcdhDebugMode(ecdh_keys_mode_t mode);
-
-void         blc_smp_setTK_by_OOB (u8 *oobData);  //used for set oob data
-void         blc_smp_setTK_by_PasskeyEntry (u32 pinCodeInput);
-void         blc_smp_setNumericComparisonResult(bool YES_or_NO);   //numeric compare confirm, 1: YES  0: NO
-
-
-
-
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-u8*     blc_smp_pushParingFailed(u8 failReason);
-
-void     blc_smp_generate_initial_keys(void);
-
-int     blc_smp_getGenMethod (int SC_en);    //Return STK generate method.
-
-int     blc_smp_param_init (void);
-
-
-
-static inline int  blc_smp_isParingBusy(void)
-{
-    return blc_smpMng.paring_busy;
-}
-
-static inline  void  blc_smp_setParingBusy(u8 busy)
-{
-    blc_smpMng.paring_busy = busy;
-}
-
-static inline void blc_smp_setCertTimeoutTick (u32 t)
-{
-    smp_timeout_start_tick = t;
-}
-
-smp_keyDistribution_t blc_smp_setInitiatorKey (u8 LTK_distributeEn, u8 IRK_distributeEn, u8 CSRK_DistributeEn);
-smp_keyDistribution_t blc_smp_setResponderKey (u8 LTK_distributeEn, u8 IRK_distributeEn, u8 CSRK_DistributeEn);
-
-
-int         blc_stack_smp_setSecurityParameters (  bonding_mode_t         mode,
-                                            paring_methods_t     method,
-                                            int                 MITM_en,
-                                            int                 OOB_en,
-                                            io_capability_t     ioCapablility,
-                                            int                    keyPress_en);
-
-void         blc_stack_smp_setBondingMode(bonding_mode_t mode);
-void         blc_stack_smp_setParingMethods (paring_methods_t  method);
-void         blc_stack_smp_enableAuthMITM (int MITM_en);
-void         blc_stack_smp_enableOobAuthentication (int OOB_en);
-void         blc_stack_smp_setIoCapability (io_capability_t  ioCapablility);
-void         blc_stack_smp_enableKeypress (int keyPress_en);
-
-u8*         blc_smp_sc_handler(u16 conn, u8*p);
-void         blc_smp_sc_pushPkt_handler(int type);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-#endif /* BLE_SMP_H_ */
diff --git a/stack/ble/smp/smp_const.h b/stack/ble/smp/smp_const.h
deleted file mode 100644
index 216ef6f..0000000
--- a/stack/ble/smp/smp_const.h
+++ /dev/null
@@ -1,343 +0,0 @@
-/******************************************************************************
- * @file     smp_const.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * smp_const.h
- *
- *  Created on: 2018-12-4
- *      Author: Administrator
- */
-
-#ifndef SMP_CONST_H_
-#define SMP_CONST_H_
-
-
-
-///////////////////////////// SMP concerned ///////////////////////////////////
-#define            SMP_OP_PAIRING_REQ                    1
-#define            SMP_OP_PAIRING_RSP                    2
-#define            SMP_OP_PAIRING_CONFIRM                3
-#define            SMP_OP_PAIRING_RANDOM                 4
-#define            SMP_OP_PAIRING_FAIL                   5
-#define            SMP_OP_ENC_INFO                       6
-#define            SMP_OP_ENC_IDX                        7
-#define            SMP_OP_ENC_IINFO                      8
-#define            SMP_OP_ENC_IADR                       9
-#define            SMP_OP_ENC_SIGN                       0x0a
-#define            SMP_OP_SEC_REQ                        0x0b
-#define            SMP_OP_PARING_PUBLIC_KEY              0x0c
-#define            SMP_OP_PARING_DHKEY                   0x0d
-#define            SMP_OP_KEYPRESS_NOTIFICATION          0x0e
-#define            SMP_OP_WAIT                           0x0f
-
-#define            SMP_OP_ENC_END                        0xFF
-
-
-#define         SMP_TRANSPORT_SPECIFIC_KEY_START         0xEF
-#define         SMP_TRANSPORT_SPECIFIC_KEY_END           0
-
-#define IO_CAPABLITY_DISPLAY_ONLY                    0x00
-#define IO_CAPABLITY_DISPLAY_YESNO                   0x01
-#define IO_CAPABLITY_KEYBOARD_ONLY                   0x02
-#define IO_CAPABLITY_NO_IN_NO_OUT                    0x03
-#define IO_CAPABLITY_KEYBOARD_DISPLAY                0x04
-
-#define PASSKEY_TYPE_ENTRY_STARTED                   0x00
-#define PASSKEY_TYPE_DIGIT_ENTERED                   0x01
-#define PASSKEY_TYPE_DIGIT_ERASED                    0x02
-#define PASSKEY_TYPE_CLEARED                         0x03
-#define PASSKEY_TYPE_ENTRY_COMPLETED                 0x04
-
-#define PARING_FAIL_REASON_PASSKEY_ENTRY             0x01
-#define PARING_FAIL_REASON_OOB_NOT_AVAILABLE         0x02
-#define PARING_FAIL_REASON_AUTH_REQUIRE              0x03
-#define PARING_FAIL_REASON_CONFIRM_FAILED            0x04
-#define PARING_FAIL_REASON_PARING_NOT_SUPPORTED      0x05
-#define PARING_FAIL_REASON_ENCRYPT_KEY_SIZE          0x06
-//-- core 4.2
-#define PARING_FAIL_REASON_CMD_NOT_SUPPORT           0x07
-#define PARING_FAIL_REASON_UNSPECIFIED_REASON        0x08
-#define PARING_FAIL_REASON_REPEATED_ATTEMPT          0x09
-#define PARING_FAIL_REASON_INVALID_PARAMETER         0x0A
-#define PARING_FAIL_REASON_DHKEY_CHECK_FAIL          0x0B
-#define PARING_FAIL_REASON_NUMUERIC_FAILED           0x0C
-#define PARING_FAIL_REASON_BREDR_PARING              0x0D
-#define PARING_FAIL_REASON_CROSS_TRANSKEY_NOT_ALLOW  0x0E
-
-//teLink define
-#define PARING_FAIL_REASON_PARING_TIEMOUT            0x80
-#define PARING_FAIL_REASON_CONN_DISCONNECT           0x81
-#define PARING_FAIL_REASON_SUPPORT_NC_ONLY           0x82
-
-#define    ENCRYPRION_KEY_SIZE_MAXINUM               16
-#define    ENCRYPRION_KEY_SIZE_MINIMUM               7
-
-
-
-//define for TK status
-#define TK_ST_REQUEST                                BIT(0)
-#define TK_ST_UPDATE                                 BIT(1)
-#define TK_ST_CONFIRM_PENDING                        BIT(2)
-#define TK_ST_NUMERIC_COMPARE                        BIT(3)
-#define TK_ST_NUMERIC_CHECK_YES                      BIT(4)
-#define TK_ST_NUMERIC_CHECK_NO                       BIT(5)
-#define TK_ST_NUMERIC_DHKEY_FAIL_PENDING             BIT(6)
-#define TK_ST_NUMERIC_DHKEY_SUCC_PENDING             BIT(7)
-
-
-//define for KEY MASK
-#define KEY_MASK_ENC                                 BIT(0)
-#define KEY_MASK_IDENTITY                            BIT(1)
-#define KEY_MASK_SIGN                                BIT(2)
-
-
-typedef enum {
-    Smp_None         = 0,
-    Smp_Peripheral   = BIT(0),
-    Smp_Central      = BIT(1),
-}smp_role_t;
-
-
-
-
-//See the Core_v5.0(Vol 3/Part C/10.2, Page 2067) for more information.
-typedef enum {
-    LE_Security_Mode_1_Level_1 = BIT(0),  No_Authentication_No_Encryption            = BIT(0),         No_Security   = BIT(0),
-    LE_Security_Mode_1_Level_2 = BIT(1),  Unauthenticated_Paring_with_Encryption     = BIT(1),
-    LE_Security_Mode_1_Level_3 = BIT(2),    Authenticated_Paring_with_Encryption     = BIT(2),
-    LE_Security_Mode_1_Level_4 = BIT(3),    Authenticated_LE_Secure_Connection_Paring_with_Encryption = BIT(3),
-
-    LE_Security_Mode_2_Level_1 = BIT(4),  Unauthenticated_Paring_with_Data_Signing     = BIT(4),
-    LE_Security_Mode_2_Level_2 = BIT(5),    Authenticated_Paring_with_Data_Signing  = BIT(5),
-
-    LE_Security_Mode_1 = (LE_Security_Mode_1_Level_1 | LE_Security_Mode_1_Level_2 | LE_Security_Mode_1_Level_3 | LE_Security_Mode_1_Level_4)
-}le_security_mode_level_t;
-
-
-typedef enum {
-    Non_Bondable_Mode = 0,
-    Bondable_Mode     = 1,
-}bonding_mode_t;
-
-
-
-//Paring Methods select
-//See the Core_v5.0(Vol 3/Part H/2.3) for more information.
-typedef enum {
-    LE_Legacy_Paring     = 0,   // BLE 4.0/4.2
-    LE_Secure_Connection = 1,   // BLE 4.2/5.0/5.1
-}paring_methods_t;
-
-
-typedef enum {
-    IO_CAPABILITY_UNKNOWN = 0xff,
-    IO_CAPABILITY_DISPLAY_ONLY = 0,
-    IO_CAPABILITY_DISPLAY_YES_NO = 1,
-    IO_CAPABILITY_KEYBOARD_ONLY = 2,
-    IO_CAPABILITY_NO_INPUT_NO_OUTPUT = 3,
-    IO_CAPABILITY_KEYBOARD_DISPLAY = 4,
-} io_capability_t;
-
-
-
-
-
-typedef enum {
-    JustWorks = 0,
-    PK_Init_Dsply_Resp_Input = 1,
-    PK_Resp_Dsply_Init_Input = 2,
-    PK_BOTH_INPUT = 3,
-    OOB_Authentication = 4,
-    Numric_Comparison = 5,
-} stk_generationMethod_t;
-
-
-// H: Initiator Capabilities
-// V: Responder Capabilities
-// See the Core_v5.0(Vol 3/Part H/2.3.5.1) for more information.
-static const stk_generationMethod_t gen_method_legacy[5 /*Responder*/][5 /*Initiator*/] = {
-    { JustWorks,                  JustWorks,                 PK_Resp_Dsply_Init_Input, JustWorks, PK_Resp_Dsply_Init_Input },
-    { JustWorks,                  JustWorks,                 PK_Resp_Dsply_Init_Input, JustWorks, PK_Resp_Dsply_Init_Input },
-    { PK_Init_Dsply_Resp_Input,   PK_Init_Dsply_Resp_Input,  PK_BOTH_INPUT,            JustWorks, PK_Init_Dsply_Resp_Input },
-    { JustWorks,                  JustWorks,                 JustWorks,                JustWorks, JustWorks                   },
-    { PK_Init_Dsply_Resp_Input,   PK_Init_Dsply_Resp_Input,  PK_Resp_Dsply_Init_Input, JustWorks, PK_Init_Dsply_Resp_Input },
-};
-
-#if SECURE_CONNECTION_ENABLE
-static const stk_generationMethod_t gen_method_sc[5 /*Responder*/][5 /*Initiator*/] = {
-    { JustWorks,                  JustWorks,                 PK_Resp_Dsply_Init_Input, JustWorks, PK_Resp_Dsply_Init_Input },
-    { JustWorks,                  Numric_Comparison,         PK_Resp_Dsply_Init_Input, JustWorks, Numric_Comparison },
-    { PK_Init_Dsply_Resp_Input,   PK_Init_Dsply_Resp_Input,  PK_BOTH_INPUT,            JustWorks, PK_Init_Dsply_Resp_Input },
-    { JustWorks,                  JustWorks,                 JustWorks,                JustWorks, JustWorks                   },
-    { PK_Init_Dsply_Resp_Input,   Numric_Comparison,         PK_Resp_Dsply_Init_Input, JustWorks, Numric_Comparison },
-};
-#endif
-
-
-
-
-//Local Device Paring Status
-//See the Core_v5.0(Vol 3/Part C/10.3.1/Table 10.2) for more information.
-typedef enum {
-    No_Bonded_No_LTK = 0,    //No_LTK
-    Unauthenticated_LTK,
-    Authenticated_LTK_Legacy_Paring,
-    Authenticated_LTK_Secure_Connection,
-} paring_sts_t;
-
-
-
-
-
-
-
-
-
-
-typedef union {
-    struct{
-        u8 bondingFlag : 2;
-        u8 MITM : 1;
-        u8 SC    : 1;
-        u8 keyPress: 1;
-        u8 rsvd: 3;
-    };
-    u8 authType;
-}smp_authReq_t;
-
-typedef union{
-    struct {
-        u8 encKey : 1;
-        u8 idKey : 1;
-        u8 sign  : 1;
-        u8 linkKey : 4;
-    };
-    u8 keyIni;
-}smp_keyDistribution_t;
-
-typedef struct{
-    u8 code;  //req = 0x01; rsp = 0x02;
-    u8 ioCapablity;
-    u8 oobDataFlag;
-    smp_authReq_t authReq;
-    u8 maxEncrySize;
-
-    smp_keyDistribution_t initKeyDistribution;
-    smp_keyDistribution_t rspKeyDistribution;
-}smp_paring_req_rsp_t;
-
-
-
-typedef struct{
-    u8  code; //0x04
-    u16 randomValue[16];
-}smp_paring_random_t;
-
-typedef struct{
-    u8  code; //0x03
-    u16 confirmValue[16];
-}smp_paring_confirm_t;
-
-typedef struct{
-    u8 code; // 0x05
-    u8 reason;
-}smp_paring_failed_t;
-
-typedef struct{
-    u8 code;//0x0b
-
-    smp_authReq_t authReq;
-}smp_secure_req_t;
-
-typedef struct{
-    u8  code;//0xa
-    u8     signalKey[16];
-}smp_signal_info_t;
-
-typedef struct{
-    u8 code;//0x9
-    u8 addrType;
-    u8 bdAddr[6];
-}smp_id_addr_info_t;
-
-typedef struct{
-    u8 code;//0x8
-    u8 idResolveKey[16];
-}smp_id_info_t;
-
-typedef struct{
-    u8  code;//0x7
-    u16 edivPtr[2];
-    u8     masterRand[8];
-}smp_master_id_t;
-
-typedef struct{
-    u8  code;//0x6
-    u8     LTK[16];
-}smp_enc_info_t;
-
-// -------add core 4.2 ------
-typedef struct{
-    u8  code;//0xc
-    u8  publicKeyX[32];
-    u8  publicKeyY[32];
-}smp_paring_public_key_t;
-
-typedef struct{
-    u8  code;//0xd
-    u8  DHKeyCheck[16];
-}smp_DHkey_check_t;
-
-typedef struct{
-    u8  code;//0xe
-    u8  notifyType;
-}smp_key_notify_t;
-
-typedef struct{
-    u8 sc_sk_dhk_own[32];  //  own  private key[32]
-    u8 sc_pk_own[64];      //  own  public  key[64]
-    u8 sc_pk_peer[64];     // peer  public  key[64]
-}smp_sc_key_t;
-
-
-
-
-typedef struct {
-    /* data */
-    u8 csrk[16];
-    u32 signCounter;
-} smp_secSigInfo_t;
-
-
-
-
-
-
-
-
-
-
-
-#endif /* SMP_CONST_H_ */
diff --git a/stack/ble/smp/smp_peripheral.h b/stack/ble/smp/smp_peripheral.h
deleted file mode 100644
index 50ca795..0000000
--- a/stack/ble/smp/smp_peripheral.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/******************************************************************************
- * @file     smp_peripheral.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * smp_peripheral.h
- *
- *  Created on: 2018-12-4
- *      Author: Administrator
- */
-
-#ifndef SMP_PERIPHERAL_H_
-#define SMP_PERIPHERAL_H_
-
-
-
-
-
-
-// "SecReq" refer to "security request"
-typedef enum {
-    SecReq_NOT_SEND  = 0,   // do not send "security request" after link layer connection established
-    SecReq_IMM_SEND  = BIT(0),   //"IMM" refer to immediate, send "security request" immediately after link layer connection established
-    SecReq_PEND_SEND = BIT(1),  //"PEND" refer to pending,  pending "security request" for some time after link layer connection established, when pending time arrived. send it
-}secReq_cfg;
-
-
-
-typedef struct{
-    u8  secReq_conn;    //BIT<7:4> reConn;  BIT<3:0> newConn;
-    u8  secReq_pending;
-    u16 pending_ms;
-}secReq_ctl_t;
-
-extern _attribute_aligned_(4) secReq_ctl_t    blc_SecReq_ctrl;
-
-
-
-
-/******************************* User Interface  *****************************************/
-int         blc_smp_peripheral_init (void);
-
-void         blc_smp_configSecurityRequestSending( secReq_cfg newConn_cfg,  secReq_cfg re_conn_cfg, u16 pending_ms);
-int         blc_smp_sendSecurityRequest (void);
-
-
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-
-int         blc_smp_peripheral_init (void);
-
-
-
-u8 *        bls_smp_pushPkt (int type);
-int         bls_smp_encryption_done(u16 connHandle);
-void         bls_smp_peripheral_paring_loop(void);
-paring_sts_t    bls_smp_get_paring_statas(u16 connHandle);
-
-void         blc_smp_procParingEnd(u8 err_reason);
-
-u8 *         l2cap_smp_handler(u16 connHandle, u8 * p);
-
-
-
-
-#endif /* SMP_PERIPHERAL_H_ */
diff --git a/stack/ble/smp/smp_storage.h b/stack/ble/smp/smp_storage.h
deleted file mode 100644
index b9cdd9b..0000000
--- a/stack/ble/smp/smp_storage.h
+++ /dev/null
@@ -1,168 +0,0 @@
-/******************************************************************************
- * @file     smp_storage.h
- *
- * @brief    for TLSR chips
- *
- * @author   public@telink-semi.com;
- * @date     Sep. 30, 2010
- *
- * @attention
- *
- *  Copyright (C) 2019-2020 Telink Semiconductor (Shanghai) Co., Ltd.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- *****************************************************************************/
-/*
- * smp_storage.h
- *
- *  Created on: 2018-12-4
- *      Author: Administrator
- */
-
-#ifndef SMP_STORAGE_H_
-#define SMP_STORAGE_H_
-
-
-
-#if (SIMPLE_MULTI_MAC_EN)
-    #include "smp.h"
-    extern u8 device_mac_index;
-#endif
-
-
-#define     SMP_PARAM_NV_UNIT                       64
-
-#define     SMP_PARAM_INIT_CLEAR_MAGIN_ADDR         3072  //64 * 48
-#define     SMP_PARAM_LOOP_CLEAR_MAGIN_ADDR         3520  //64 * 55 (56 device most)
-
-
-
-#define        SMP_PARAM_NV_MAX_LEN                 4096
-
-
-extern         int     SMP_PARAM_NV_ADDR_START;
-
-#define        SMP_PARAM_NV_SEC_ADDR_START              (SMP_PARAM_NV_ADDR_START + SMP_PARAM_NV_MAX_LEN)
-#define        SMP_PARAM_NV_SEC_ADDR_END                (SMP_PARAM_NV_SEC_ADDR_START + SMP_PARAM_NV_MAX_LEN - 1)
-
-
-
-
-#define        NEW_FLASH_STORAGE_KEY_ENABLE            0   //be compatible with old flash storage methods
-
-
-#define        FLAG_SMP_PARAM_SAVE_OLD                 0x5A  // 0101 1010  old storage
-
-#if (SIMPLE_MULTI_MAC_EN)
-#define        FLAG_SMP_PARAM_SAVE_BASE               (0x88+(device_mac_index&0x07))//0x8A  // 1000 1010
-#else
-                                                          // 10xx 1010  new storage,  xx: see "paring_sts_t" definition
-#define        FLAG_SMP_PARAM_SAVE_BASE                0x8A  // 1000 1010
-#endif
-#define        FLAG_SMP_PARAM_SAVE_UNANTHEN            0x9A  // 1001 1010  new storage Unauthenticated_LTK
-#define        FLAG_SMP_PARAM_SAVE_AUTHEN              0xAA  // 1010 1010  new storage Authenticated_LTK_Legacy_Paring
-#define        FLAG_SMP_PARAM_SAVE_AUTHEN_SC           0xBA  // 1011 1010  new storage Authenticated_LTK_Secure_Connection
-
-#define        FLAG_SMP_PARAM_SAVE_PENDING             0xBF  // 1011 1111
-#define        FLAG_SMP_PARAM_SAVE_ERASE               0x00  //
-
-#if (SIMPLE_MULTI_MAC_EN)
-#define     FLAG_SMP_PARAM_MASK                        0xC8
-#define     FLAG_SMP_PARAM_VALID                       0x88
-#else
-#define     FLAG_SMP_PARAM_MASK                        0x0F  // 0000 1111
-#define     FLAG_SMP_PARAM_VALID                       0x0A  // 0000 1010
-#endif
-#define     FLAG_SMP_PARING_STATUS_MASK                0x30  // 0011 1000
-
-
-#define        FLAG_SMP_SECTOR_USE                     0x3C
-#define        FLAG_SMP_SECTOR_CLEAR                   0x00
-
-#define     FLASH_SECTOR_OFFSET                        4080  //0xFF0
-
-
-extern int        bond_device_flash_cfg_idx;
-
-
-
-typedef enum {
-    Index_Update_by_Pairing_Order = 0,     //default value
-    Index_Update_by_Connect_Order = 1,
-} index_updateMethod_t;
-
-
-
-/*
- * smp parameter need save to flash.
- */
-typedef struct {  //82
-    u8        flag;
-    u8        peer_addr_type;  //address used in link layer connection
-    u8        peer_addr[6];
-
-    u8        peer_key_size;
-    u8        peer_id_adrType; //peer identity address information in key distribution, used to identify
-    u8        peer_id_addr[6];
-
-
-    u8        own_ltk[16];      //own_ltk[16]
-    u8        peer_irk[16];
-    u8        peer_csrk[16];
-
-}smp_param_save_t;
-
-
-
-
-
-/******************************* User Interface  *****************************************/
-
-
-u8           blc_smp_param_getCurrentBondingDeviceNumber(void);
-
-
-
-void         bls_smp_configParingSecurityInfoStorageAddr (int addr);
-
-
-u32         bls_smp_param_loadByIndex(u8 index, smp_param_save_t* smp_param_load);
-
-u32         bls_smp_param_loadByAddr(u8 addr_type, u8* addr, smp_param_save_t* smp_param_load);
-
-
-void        bls_smp_setIndexUpdateMethod(index_updateMethod_t method);
-
-
-void        bls_smp_eraseAllParingInformation(void);
-
-
-/************************* Stack Interface, user can not use!!! ***************************/
-int     bls_smp_param_saveBondingInfo (smp_param_save_t*);
-void    bls_smp_param_initFromFlash(void);
-void    bls_smp_param_Cleanflash (void);
-u32     bls_smp_loadParamVsRand (u16 ediv, u8* random);
-int     bls_smp_loadParamVsAddr (u16 addr_type, u8* addr);
-u8      bls_smp_param_getIndexByFLashAddr(u32 flash_addr);
-
-
-int       bls_smp_param_deleteByIndex(u8 index);
-u8        bls_smp_param_getBondFlag_by_flashAddress(u32 flash_addr);
-
-u32     bls_smp_searchBondingDevice_in_Flash_by_Address(u8 addr_type, u8* addr );
-u32     blc_smp_param_updateToNearestByIndex(u8 index);
-
-
-
-#endif /* SMP_STORAGE_H_ */
diff --git a/stack/ble/trace.h b/stack/ble/trace.h
index 1dfbdfa..a2f41ef 100644
--- a/stack/ble/trace.h
+++ b/stack/ble/trace.h
@@ -23,76 +23,76 @@
  *  limitations under the License.
  *
  *****************************************************************************/
-
 #ifndef TRACE_H_
 #define TRACE_H_
 
-#define TR_T_irq                     0
-#define TR_T_irq_rx                  1
-#define    TR_T_irq_tx               2
-#define TR_T_irq_sysTimer            3
 
-#define TR_T_irq_cmddone             4
-#define TR_T_irq_rxTmt               5
-#define TR_T_irq_rxFirstTmt          6
-#define TR_T_irq_fsmTmt              7
+//    event: 0 for time stamp; 1 reserved; eid2 - eid31
+#define            SLEV_timestamp                0
+#define            SLEV_reserved                1
 
-#define TR_T_irq_rxCrcErr            8
+#define         SLEV_irq_rf                    2
+#define         SLEV_irq_sysTimer            3
 
-#define TR_T_ll_brx_start            9
-#define TR_T_ll_brx_end              10
+#define         SLEV_irq_rx                    5
+#define         SLEV_irq_rxCrc                6
+#define         SLEV_irq_rxTimStamp            7
+#define         SLEV_irq_rxNew                8
 
-#define TR_T_ll_durationInit         11
-#define TR_T_ll_durationUpdate       12
+#define            SLEV_irq_tx                    10
 
-#define TR_T_ll_1stRx                13
-#define TR_T_ll_chn_map              14
-#define TR_T_ll_chn_timing           15
-#define TR_T_ll_scanRsp              16
-#define TR_T_ll_connReq              17
+#define         SLEV_irq_cmddone            12
+#define         SLEV_irq_rxTmt                13
+#define         SLEV_irq_rxFirstTmt            14
+#define         SLEV_irq_fsmTmt                15
 
-#define TR_T_ll_sync                 18
-#define TR_T_ll_adv                  19
+#define         SLEV_slave_1stRx            16
 
-#define TR_T_ll_stopRf               20
-
-
-#define TR_T_audioTask               24
-#define TR_T_audioData               25
-#define TR_T_adpcm                   26
-#define TR_T_adpcm_enc_overflow      27
-
-
-
-#define TR_T_master_irq              30
-#define TR_T_master_rx               31
-#define TR_T_master_tx               32
-#define TR_T_master_sysTimer         33
-#define TR_T_master_connDone         34
-
-#define TR_T_master_adv_report       35
-
-#define TR_T_master_createConn       40
-#define TR_T_master_init             41
-#define TR_T_master_connnect         42
-#define TR_T_master_terminate        43
-#define TR_T_master_btx              44
-#define TR_T_master_scan             45
-
-#define TR_T_master_update           50
-#define TR_T_master_update_req       51
+#define            SLEV_txFifo_push            17
+#define            SLEV_txFifo_empty            18
 
 
 
 
-#define TR_24_ll_chn                 0
-#define TR_24_ll_duration            1
+#define         SLEV_test_event                31
 
 
 
-#define TR_24_slot_idx               5
-#define TR_24_scan_chn               6
-#define TR_24_master_state           7
+
+
+
+
+
+// 1-bit data: 0/1/2 for hardware signal
+#define            SL01_irq                    1
+#define            SL01_sysTimer                2
+#define            SL01_adv                     3
+#define            SL01_brx                     4
+#define            SL01_btx                     5
+
+// 8-bit data: cid0 - cid63
+#define            SL08_test_1B                0
+
+
+
+// 16-bit data: sid0 - sid63
+#define            SL16_tf_hw_push                1
+#define            SL16_tf_sw_push                2
+#define            SL16_tf_hw_load1            3
+#define            SL16_tf_sw_load1            4
+#define            SL16_tf_hw_load2            5
+#define            SL16_tf_sw_load2            6
+#define            SL16_tf_hw_RX                7
+#define            SL16_tf_sw_RX                8
+#define            SL16_tf_hw_TX                9
+#define            SL16_tf_sw_TX                10
+
+#define            SL16_seq_notify                15
+#define            SL16_seq_write                16
+
+//#define            SL01_test_task                0
+//#define            SL08_test_1B                0
+//#define            SL16_test_2B                0
 
 
 #endif
diff --git a/tl_common.h b/tl_common.h
index 226df5c..000ffa1 100644
--- a/tl_common.h
+++ b/tl_common.h
@@ -33,12 +33,18 @@
 #include "common/static_assert.h"
 #include "common/assert.h"
 
+#include "application/print/u_printf.h"
 
 #include "vendor/common/user_config.h"
 #include "config.h"
-
-#include "common/breakpoint.h"
-#include "common/log.h"
-
 #include "common/string.h"
+#include "stack/ble/ble_common.h"
 
+
+
+#include "common/usb_dbg/myudb.h"
+#include "vendor/common/blt_common.h"
+#include "vendor/common/blt_fw_sign.h"
+#include "vendor/common/blt_led.h"
+#include "vendor/common/blt_soft_timer.h"
+#include "vendor/common/flash_fw_check.h"
diff --git a/vendor/827x_ble_remote/app.c b/vendor/827x_ble_remote/app.c
index 190474b..1eda86f 100644
--- a/vendor/827x_ble_remote/app.c
+++ b/vendor/827x_ble_remote/app.c
@@ -46,7 +46,6 @@
 #include "app_config.h"
 #include "app_flash_write.h"
 
-#include "../../application/audio/gl_audio.h"
 
 
 #if (MP_TEST_MODE)
@@ -183,6 +182,8 @@
 extern void app_connect_led(void);
 extern void ir_flash_set_flag(u8 flag);
 extern u8 init_ir_key_event_notify(void);
+extern int bls_smp_param_deleteByIndex(u8 index);
+
 
 #if (UART_PRINT_ENABLE)
 _attribute_data_retention_    u8 printf_uart_flag=0;
@@ -419,7 +420,6 @@
             bls_l2cap_requestConnParamUpdate (8, 8, 99, 400);
             flag_dle |= 0x80;
         }
-        //app_service_change();
     }
 }
 
@@ -470,7 +470,7 @@
 int app_ota_terminate_timeoutcb(void)
 {
     printf("app_ota_terminate_timeoutcb\r\n");
-    app_ota_terminate(OTA_USER_TERMINATE);
+    app_ota_terminate(GOOGLE_OTA_USER_TERMINATE);
 
     return -1;
 }
@@ -1144,10 +1144,8 @@
     extern void my_att_init ();
     my_att_init (); //gatt initialization
     blc_l2cap_register_handler (blc_l2cap_packet_receive);      //l2cap initialization
-    extern ble_sts_t blc_att_prepareWriteBufferCfg (u8 *pBuf, u16 bufSize);
-    u8 status = blc_att_prepareWriteBufferCfg (prepareWrite_b, sizeof(prepareWrite_b));
-    if(status != BLE_SUCCESS) {   while(1); }  //debug: l2cap buffer setting err
-
+    extern void   blc_att_setPrepareWriteBuffer(u8 *p, u16 len);
+    blc_att_setPrepareWriteBuffer (prepareWrite_b, sizeof(prepareWrite_b));
     blc_att_setRxMtuSize(MTU_SIZE_SETTING);
 
     //Smp Initialization may involve flash write/erase(when one sector stores too much information,
@@ -1379,17 +1377,6 @@
 // main loop flow
 /////////////////////////////////////////////////////////////////////
 
-void ir_flash_erase_loop(void)
-{
-    if((ir_flash_erase_tick) && (ir_send_ctrl.is_sending== 0))
-    {
-        if(ir_flash_erase_timeoutcb() == -1)
-        {
-            ir_flash_erase_tick = 0;
-        }
-    }
-}
-
 #if 0
 _attribute_data_retention_ u32 test_toggle_tick=0;
 _attribute_data_retention_ u8 test_toggle_level=0;
@@ -1594,6 +1581,7 @@
     mtu_exchange_loop();
     ir_flash_erase_loop();
     ir_flash_save_loop();
+    ir_nec_ir_table_erase_loop();
     app_send_wakeup_loop();
     ////////////////////////////////////// UI entry /////////////////////////////////
     #if (BLE_AUDIO_ENABLE)
diff --git a/vendor/827x_ble_remote/app_att.c b/vendor/827x_ble_remote/app_att.c
index 494888a..db3191e 100644
--- a/vendor/827x_ble_remote/app_att.c
+++ b/vendor/827x_ble_remote/app_att.c
@@ -300,8 +300,6 @@
 static const u8 my_OtaUUID[16]           = {TELINK_SPP_DATA_OTA};
 static const u8 my_OtaServiceUUID[16]    = TELINK_OTA_UUID_SERVICE;
 
-
-
 static u8 my_OtaData         = 0x00;
 _attribute_data_retention_ u16 my_Otaccc = 0;
 
@@ -492,11 +490,11 @@
     u8      atv_char_rx_data[1] = {0};
     u8      atv_char_ctl_data[1] = {0};
 
-    static const u8 ATVV_Server_UUID[16]         = {AUDIO_GOOGLE_SERVICE_UUID};
+    static const u8 ATVV_Server_UUID[16]         = AUDIO_GOOGLE_SERVICE_UUID;
 
     static const u8 ATVV_Char_UUID_TX[16]         = {AUDIO_GOOGL_TX_CHAR_UUID};
     static const u8 ATVV_Char_UUID_RX[16]         = {AUDIO_GOOGL_RX_CHAR_UUID};
-    static const u8 ATVV_Char_UUID_CTL[16]         = {AUDIO_GOOGL_CTL_CHAR_UUID};
+    static const u8 ATVV_Char_UUID_CTL[16]        = {AUDIO_GOOGL_CTL_CHAR_UUID};
 
     static const u8 my_MicCharTx[20] = {
         CHAR_PROP_READ | CHAR_PROP_WRITE_WITHOUT_RSP | CHAR_PROP_NOTIFY,
@@ -527,7 +525,7 @@
     u16 i;
 
     rf_packet_att_data_t *pw = (rf_packet_att_data_t *)p;
-    handle = (u16)((pw->hh)<<8) | (u16)(pw->hl);
+    handle = pw->handle;
 
     //printf("handle = %x\r\n",handle);
     //printf("pw->l2cap=%x\r\n",pw->l2cap-3);
@@ -541,12 +539,49 @@
     for(i=0;i<printf_len;i++)
         printf(" %x",pw->dat[i]);
     #endif
+    printf("len=%x\r\n",len);
     app_set_mtusize();
     ir_fallback_process(handle,pw->dat,len);
 
     return 0;
 }
 
+int app_nec_ir_table_callback(void *p)
+{
+    u16 handle,len;
+    u16 printf_len;
+    u16 i;
+
+    rf_packet_att_data_t *pw = (rf_packet_att_data_t *)p;
+    handle = pw->handle;
+
+    //printf("handle = %x\r\n",handle);
+    //printf("pw->l2cap=%x\r\n",pw->l2cap-3);
+    //printf("app_nec_ir_table_callback handle=%x\r\n",handle);
+
+    len = pw->l2cap-3;//pw->rf_len-7;
+    printf_len = len;
+
+    #if 0
+    printf("len=%x\r\n",len);
+    for(i=0;i<printf_len;i++)
+        printf(" %x",pw->dat[i]);
+    #endif
+
+    ir_nec_ir_table_process(pw->dat,len);
+    return 0;
+}
+
+int app_ota_handle(void * p){
+
+    int result=0;
+
+    app_nec_ir_table_callback(p);
+    result = app_ota_write(p);
+
+    return result;
+}
+
 
 
 // TM : to modify
@@ -655,9 +690,9 @@
 
         ////////////////////////////////////// OTA /////////////////////////////////////////////////////
         // 002e - 0031                                                  (52-56)
-        {5,ATT_PERMISSIONS_READ, 2,16,(u8*)(&my_primaryServiceUUID),     (u8*)(&my_OtaServiceUUID), 0},
+        {8,ATT_PERMISSIONS_READ, 2,16,(u8*)(&my_primaryServiceUUID),     (u8*)(&my_OtaServiceUUID), 0},
         {0,ATT_PERMISSIONS_READ, 2, sizeof(my_OtaCharVal),(u8*)(&my_characterUUID), (u8*)(my_OtaCharVal), 0},                //prop
-        {0,ATT_PERMISSIONS_RDWR,16,sizeof(my_OtaData),(u8*)(&my_OtaUUID),    (&my_OtaData), &app_ota_write, &otaRead},            //value
+        {0,ATT_PERMISSIONS_RDWR,16,sizeof(my_OtaData),(u8*)(&my_OtaUUID),    (&my_OtaData), &app_ota_handle, 0},//&otaRead},            //value
         {0,ATT_PERMISSIONS_RDWR,2,sizeof(my_Otaccc),(u8*)(&clientCharacterCfgUUID),(u8*)(&my_Otaccc), &att_ccc_control},
         {0,ATT_PERMISSIONS_READ, 2,sizeof (my_OtaName),(u8*)(&userdesc_UUID), (u8*)(my_OtaName), 0},
 
@@ -808,7 +843,7 @@
         // 0034 - 0038              (52-56)
         {5,ATT_PERMISSIONS_READ, 2,16,(u8*)(&my_primaryServiceUUID),     (u8*)(&my_OtaServiceUUID), 0},
         {0,ATT_PERMISSIONS_READ, 2, sizeof(my_OtaCharVal),(u8*)(&my_characterUUID), (u8*)(my_OtaCharVal), 0},                //prop
-        {0,ATT_PERMISSIONS_RDWR,16,sizeof(my_OtaData),(u8*)(&my_OtaUUID),    (&my_OtaData), &app_ota_write, &otaRead},            //value
+        {0,ATT_PERMISSIONS_RDWR,16,sizeof(my_OtaData),(u8*)(&my_OtaUUID),    (&my_OtaData), &app_ota_write, 0},//&otaRead},            //value
         {0,ATT_PERMISSIONS_RDWR,2,sizeof(my_Otaccc),(u8*)(&clientCharacterCfgUUID),(u8*)(&my_Otaccc), &att_ccc_control},
         {0,ATT_PERMISSIONS_READ, 2,sizeof (my_OtaName),(u8*)(&userdesc_UUID), (u8*)(my_OtaName), 0},
 
diff --git a/vendor/827x_ble_remote/app_ecdsa.c b/vendor/827x_ble_remote/app_ecdsa.c
index 35847be..a9d0c13 100644
--- a/vendor/827x_ble_remote/app_ecdsa.c
+++ b/vendor/827x_ble_remote/app_ecdsa.c
@@ -28,9 +28,8 @@
 #include "app_ecdsa.h"
 #include "./pke_common/app_pke.h"
 
-#if (PKE_TEST_MODE == PKE_ECDSA)
 
-
+/*
 unsigned int secp256r1_p[8]    = {0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0x00000000,0x00000000,0x00000000,0x00000001,0xFFFFFFFF};
 unsigned int secp256r1_p_h[8]  = {0x00000003,0x00000000,0xFFFFFFFF,0xFFFFFFFB,0xFFFFFFFE,0xFFFFFFFF,0xFFFFFFFD,0x00000004};
 unsigned int secp256r1_p_n1[1] = {1};
@@ -56,6 +55,7 @@
     secp256r1_n_h,
     secp256r1_n_n1,}
 };
+*/
 
 /**
  * @brief        Generate ECDSA Signature in U32 little-endian big integer style
@@ -438,7 +438,6 @@
     return ECDSA_SUCCESS;
 }
 
-#endif
 
 
 
diff --git a/vendor/827x_ble_remote/app_ir.c b/vendor/827x_ble_remote/app_ir.c
index 1f8467e..9712068 100644
--- a/vendor/827x_ble_remote/app_ir.c
+++ b/vendor/827x_ble_remote/app_ir.c
@@ -30,9 +30,10 @@
 #include "app_ir.h"
 #include "rc_ir.h"
 #include "app_ir.h"
-#include "../../stack/ble/attr/att.h"
 #include "app_flash_write.h"
 #include "app_ui.h"
+#include "app_custom.h"
+#include "../../stack/ble/host/attr/att.h"
 
 extern void google_reset_rsp_delay(void);
 extern u8 is_mic_enable(void);
@@ -49,6 +50,11 @@
 
 #define KEY_IDX_NULL        0xff
 
+#define APP_IR_CMD_OTA_NEC_IR_TABLE_PREPARE      0xEF00
+#define APP_IR_CMD_OTA_NEC_IR_TABLE_START        0xEF01
+#define APP_IR_CMD_OTA_NEC_IR_TABLE_END          0xEF02
+
+
 typedef struct{
     u16 key_id;                    //Key ID, comes from ATV (host keyid)
     u16 code_size;
@@ -103,6 +109,17 @@
     u8  button;
 }key_button_pair_t;
 
+typedef enum
+{
+    APP_NEC_IR_TABLE_PREPARE=1,
+    APP_NEC_IR_TABLE_PREPARE_END,
+    APP_NEC_IR_TABLE_START,
+    APP_NEC_IR_TABLE_WRITEFAIL,
+    APP_NEC_IR_TABLE_END
+}app_nec_ir_table_sts;
+
+_attribute_data_retention_ app_nec_ir_table_sts nec_ir_table_start = APP_NEC_IR_TABLE_END;
+
 //keyid: receive from the host. button_idx: Corresponding to the key index in the memory ir_table[].button:The actual keyid corresponding to the board
 const key_button_pair_t key_button_map_g10[MAX_KEY_COUNT] = {
     {0x0018, KEY_IDX_VOLUP, 0x10},
@@ -1554,6 +1571,17 @@
     }
 }
 
+void ir_flash_erase_loop(void)
+{
+    if((ir_flash_erase_tick) && (ir_send_ctrl.is_sending== 0))
+    {
+        if(ir_flash_erase_timeoutcb() == -1)
+        {
+            ir_flash_erase_tick = 0;
+        }
+    }
+}
+
 u8 ir_flash_busy(void)
 {
      if(ir_app_parm.ir_save.ir_save_en || ir_flash_erase_tick || ir_app_parm.ir_programming.programming_start)
@@ -1561,3 +1589,113 @@
      else
         return 0;
 }
+
+
+#define APP_IR_CMD_OTA_NEC_IR_TABLE_PREPARE      0xEF00
+#define APP_IR_CMD_OTA_NEC_IR_TABLE_START        0xEF01
+#define APP_IR_CMD_OTA_NEC_IR_TABLE_END          0xEF02
+
+void ir_nec_ir_table_process(u8 *data,u16 len)
+{
+    u8 datasend[3];
+    u16 crc=0;
+    u32 flash_addr=0,pos=0;
+    u8 readdata[16];
+    u8 result=0;
+    u16 cmd = data[0] | (data[1]<<8);
+
+    if(cmd == APP_IR_CMD_OTA_NEC_IR_TABLE_PREPARE)
+    {
+        nec_ir_table_start = APP_NEC_IR_TABLE_PREPARE;
+    }
+    else if(cmd == APP_IR_CMD_OTA_NEC_IR_TABLE_START)
+    {
+        nec_ir_table_start = APP_NEC_IR_TABLE_START;
+    }
+    else if(((data[0] == 2) && (data[1] == 0xEF)))  //IR end
+    {
+        datasend[0] = 0xEE;
+        datasend[1] = 2;
+        datasend[2] = 0;
+        bls_att_pushNotifyData(OTA_CMD_OUT_DP_H, datasend, sizeof(datasend));
+        if(nec_ir_table_start == APP_NEC_IR_TABLE_START)
+        {
+            app_custom_set_new_ir_table();
+        }
+        nec_ir_table_start = APP_NEC_IR_TABLE_END;
+    }
+
+    if(nec_ir_table_start == APP_NEC_IR_TABLE_START)
+    {
+        if(len == 20)
+        {
+            crc = (data[19]<<8) | data[18];
+            pos = (data[0]) | (data[1]<<8);
+            extern unsigned short crc16 (unsigned char *pD, int len);
+            if(crc == crc16(data,18))
+            {
+                printf("recv data index=%x\r\n",data[0]);
+                flash_addr = APP_NEC_IR_CODE_TABLE +  pos*16;
+                flash_write_page(flash_addr,16,&data[2]);
+                flash_read_page(flash_addr,16, readdata);
+                if(memcmp(&data[2],readdata,16) == 1)
+                {
+                    result = 1;
+                }
+            }
+            else
+            {
+                result = 1;
+            }
+            if(result == 1)
+            {
+                datasend[0] = 0xEE;
+                datasend[1] = 2;
+                datasend[2] = 1;
+                bls_att_pushNotifyData(OTA_CMD_OUT_DP_H, datasend, sizeof(datasend));
+                nec_ir_table_start = APP_NEC_IR_TABLE_WRITEFAIL;   //data invalid, must erase
+            }
+        }
+    }
+}
+
+int ir_nec_ir_table_erase_timeoutcb(void)
+{
+    if(is_mic_enable() == 1)
+        return 0;
+    printf("ir_nec_ir_table_erase_timeoutcb\r\n");
+    if(bls_ll_requestConnBrxEventDisable() > 120)
+    {
+        printf("ir_nec_ir_table_erase_timeoutcb_2\r\n");
+        bls_ll_disableConnBrxEvent();
+        flash_erase_sector(APP_NEC_IR_CODE_TABLE);
+        bls_ll_restoreConnBrxEvent();
+        return -1;
+    }
+    return 0;
+}
+
+void ir_nec_ir_table_erase_loop(void)
+{
+    u8 datasend[3];
+    if((nec_ir_table_start == APP_NEC_IR_TABLE_PREPARE) || (nec_ir_table_start == APP_NEC_IR_TABLE_WRITEFAIL))
+    {
+        if(ir_send_ctrl.is_sending == 0)
+        {
+            if(ir_nec_ir_table_erase_timeoutcb() == -1)
+            {
+                if(device_in_connection_state && (nec_ir_table_start == APP_NEC_IR_TABLE_PREPARE))
+                {
+                    printf("ir_nec_ir_table_erase_end\r\n");
+                    datasend[0] = 0XEE;
+                    datasend[1] = 0;
+                    datasend[2] = 0;
+                    bls_att_pushNotifyData(OTA_CMD_OUT_DP_H, datasend, sizeof(datasend));
+                }
+                nec_ir_table_start = APP_NEC_IR_TABLE_PREPARE_END;
+            }
+        }
+    }
+}
+
+
diff --git a/vendor/827x_ble_remote/app_ir.h b/vendor/827x_ble_remote/app_ir.h
index 22ef984..1983291 100644
--- a/vendor/827x_ble_remote/app_ir.h
+++ b/vendor/827x_ble_remote/app_ir.h
@@ -66,4 +66,8 @@
 extern int ir_flash_erase_timeoutcb(void);
 extern void ir_flash_save_loop(void);
 extern u8 ir_flash_busy(void);
+extern void ir_nec_ir_table_process(u8 *data,u16 len);
+extern void ir_nec_ir_table_erase_loop(void);
+extern void ir_flash_erase_loop(void);
+extern void app_custom_set_new_ir_table(void);
 #endif
diff --git a/vendor/827x_ble_remote/app_ota.h b/vendor/827x_ble_remote/app_ota.h
index 95d883c..b36c66f 100644
--- a/vendor/827x_ble_remote/app_ota.h
+++ b/vendor/827x_ble_remote/app_ota.h
@@ -30,13 +30,12 @@
 
 #define CMD_REPORT_VERSION                    0xfe00
 #define CMD_CONTROL                           0xfe01
-#define CMD_OTA_RESULT                        0xfe02
 
 #define OTA_PROTECT_VOLTAGE                   2300    //mv
 
-
 #define CLIENT_REPORT_CMD                     0xfe
 
+
 //report type
 enum{
     TYPE_VERSION = 0,
@@ -58,6 +57,23 @@
     OTA_PROCESS,
 }ota_status_type_t;
 
+enum{
+     GOOGLE_OTA_SUCCESS = 0,      //success
+     GOOGLE_OTA_PACKET_LOSS,      //lost one or more OTA PDU
+     GOOGLE_OTA_DATA_CRC_ERR,     //data CRC err
+     GOOGLE_OTA_WRITE_FLASH_ERR,  //write OTA data to flash ERR
+     GOOGLE_OTA_DATA_UNCOMPLETE,  //lost last one or more OTA PDU
+     GOOGLE_OTA_TIMEOUT,           //
+     GOOGLE_OTA_FW_CHECK_ERR,
+     GOOGLE_OTA_LOW_VOLTAGE,
+     GOOGLE_OTA_START_KEY_ERR,    //8
+
+     //app not
+     GOOGLE_OTA_USER_TERMINATE,   //9
+     GOOGLE_OTA_SIGNATURE_ERR,   //
+
+};
+
 void bls_ota_init_handle(u16 handle);
 
 ota_status_type_t app_get_ota_status();
diff --git a/vendor/827x_ble_remote/app_phytest.c b/vendor/827x_ble_remote/app_phytest.c
index 31c3c48..f35c024 100644
--- a/vendor/827x_ble_remote/app_phytest.c
+++ b/vendor/827x_ble_remote/app_phytest.c
@@ -40,6 +40,7 @@
 MYFIFO_INIT(hci_rx_fifo, 20, 2);
 MYFIFO_INIT(hci_tx_fifo, 20, 2);
 
+extern void blc_phy_preamble_length_set(unsigned char len);
 
 
 
diff --git a/vendor/827x_ble_remote/app_ui.c b/vendor/827x_ble_remote/app_ui.c
index 3f423cd..281fe9a 100644
--- a/vendor/827x_ble_remote/app_ui.c
+++ b/vendor/827x_ble_remote/app_ui.c
@@ -92,6 +92,8 @@
 extern void app_tx_power_wakeup(u8 keyid);
 extern u8  app_custom_is_wakeup_key(u8 keyid);
 extern ble_sts_t app_terminate(u8 reason);
+extern int bls_smp_param_deleteByIndex(u8 index);
+
 static const u16 vk_consumer_map[] = {
     G00GLE_MKEY_NOTIFICATION,
     G00GLE_MKEY_LIVETV,
@@ -178,35 +180,35 @@
 
 
 #if (REMOTE_IR_ENABLE)
-    //ir key
-    #define TYPE_IR_SEND               1
-    #define TYPE_IR_RELEASE            2
+//ir key
+#define TYPE_IR_SEND               1
+#define TYPE_IR_RELEASE            2
 
-    ///////////////////// key mode //////////////////////
-    #define KEY_MODE_BLE               0    //ble key
-    #define KEY_MODE_IR                1    //ir  key
+///////////////////// key mode //////////////////////
+#define KEY_MODE_BLE               0    //ble key
+#define KEY_MODE_IR                1    //ir  key
 
 
-    _attribute_data_retention_ u8 *p_kb_map_ble;
-    _attribute_data_retention_ u8 *p_kb_map_ir;
-    _attribute_data_retention_ u8 *p_kb_map_normal;
+_attribute_data_retention_ u8 *p_kb_map_ble;
+_attribute_data_retention_ u8 *p_kb_map_ir;
+_attribute_data_retention_ u8 *p_kb_map_normal;
 
 
-    void ir_dispatch(u8 type, u8 syscode ,u8 ircode){
+void ir_dispatch(u8 type, u8 syscode ,u8 ircode){
 
-        if(!ir_hw_initialed){
-            ir_hw_initialed = 1;
-            rc_ir_init();
-        }
-        if(type == TYPE_IR_SEND){
-            ir_send_ctrl.is_full_sequence = 0;
-            ir_nec_send(syscode,~(syscode),ircode);
-
-        }
-        else if(type == TYPE_IR_RELEASE){
-            ir_send_release();
-        }
+    if(!ir_hw_initialed){
+        ir_hw_initialed = 1;
+        rc_ir_init();
     }
+    if(type == TYPE_IR_SEND){
+        ir_send_ctrl.is_full_sequence = 0;
+        ir_nec_send(syscode,~(syscode),ircode);
+
+    }
+    else if(type == TYPE_IR_RELEASE){
+        ir_send_release();
+    }
+}
 
 
 
@@ -250,7 +252,7 @@
         else
             data[3] = nec_ir_cmd2_table[keyindex];
 
-        printf("\r\nir_dispatch_ext ir_key_value=%x\r\n",data[2]);
+        printf("\r\nir_dispatch_ext ir_cm1_value=%x,ir_cm2_value=%x,\r\n",data[2],data[3]);
         ir_nec_send_ext(data);
 
     }
@@ -262,8 +264,6 @@
 
 #endif
 
-
-
 #if (BLE_REMOTE_OTA_ENABLE)
 #include "app_ota.h"
 extern u8  mac_public[6];
@@ -277,7 +277,7 @@
 
     if(memcmp(check_data,data,4 )){
 
-        u8 report_data[3] ={CLIENT_REPORT_CMD, TYPE_OTA_RESULT, OTA_START_KEY_ERR};
+        u8 report_data[3] ={CLIENT_REPORT_CMD, TYPE_OTA_RESULT, GOOGLE_OTA_START_KEY_ERR};
 
         bls_att_pushNotifyData(OTA_CMD_OUT_DP_H, report_data, 3);
         printf("OTA_START_KEY_ERR\n");
@@ -292,7 +292,6 @@
     device_led_setup(led_cfg[LED_OTA_START]);
     ota_is_working = 1;
     bls_ota_setTimeout(90 * 1000 * 1000); //set OTA timeout  90 seconds
-
     return 0;
 }
 
@@ -388,7 +387,7 @@
 int app_ota_timeoutcb(void)
 {
     printf("app_ota_timeoutcb\r\n");
-    app_ota_terminate(OTA_TIMEOUT);
+    app_ota_terminate(GOOGLE_OTA_TIMEOUT);
     return -1;
 }
 
@@ -423,7 +422,7 @@
 void app_ota_slave_terminate(void)
 {
     printf("app_ota_slave_terminate\n");
-    u8 report_data[3] = {CLIENT_REPORT_CMD, TYPE_OTA_RESULT, OTA_USER_TERMINATE};
+    u8 report_data[3] = {CLIENT_REPORT_CMD, TYPE_OTA_RESULT, GOOGLE_OTA_USER_TERMINATE};
 
     u16 i = 0;
     while(bls_att_pushNotifyData(OTA_CMD_OUT_DP_H, report_data, 3) &&  i < 2000){
@@ -880,9 +879,12 @@
     blt_soft_timer_delete(app_ir_bugreport_key_delay_timer);
     if(device_in_connection_state == 0)
     {
+        printf("comb_key_stop_ir_1\r\n");
         if(ir_not_released)ir_not_released = 0;
         if( ir_send_ctrl.is_sending)
         {
+             printf("comb_key_stop_ir_2\r\n");
+             programming_key_set(0);
              ir_send_release();
         }
     }
@@ -1654,7 +1656,7 @@
 int att_ccc_control(void* p){
     printf("att_ccc_control\n");
     rf_packet_att_data_t *pw = (rf_packet_att_data_t *)p;
-    u16 handle = (pw->hh << 8) + pw->hl;
+    u16 handle = pw->handle;
 
     u16 data = (pw->dat[1] << 8) + pw->dat[0];
 
diff --git a/vendor/827x_ble_remote/battery_check.c b/vendor/827x_ble_remote/battery_check.c
index f9aff14..bf5aa48 100644
--- a/vendor/827x_ble_remote/battery_check.c
+++ b/vendor/827x_ble_remote/battery_check.c
@@ -27,7 +27,6 @@
 #include "tl_common.h"
 #include "drivers.h"
 #include "stack/ble/ble.h"
-#include "stack/ble/attr/att.h"
 
 #include "battery_check.h"
 
diff --git a/vendor/827x_ble_remote/main.c b/vendor/827x_ble_remote/main.c
index 1f2cf31..f8309de 100644
--- a/vendor/827x_ble_remote/main.c
+++ b/vendor/827x_ble_remote/main.c
@@ -124,6 +124,8 @@
 
     blc_app_loadCustomizedParameters();  //load customized freq_offset cap value
 
+    set_disBrxRequest_thresold(2);
+
     if( deepRetWakeUp ){
         //printf("user_init_deepRetn\n");
         user_init_deepRetn ();
diff --git a/vendor/827x_ble_remote/rc_ir.c b/vendor/827x_ble_remote/rc_ir.c
index 9e9c862..712857d 100644
--- a/vendor/827x_ble_remote/rc_ir.c
+++ b/vendor/827x_ble_remote/rc_ir.c
@@ -31,6 +31,8 @@
 #include "app_ir.h"
 
 extern void         bls_pm_setSuspendMask (u8 mask);
+extern u8      ir_hw_initialed;
+
 #if (REMOTE_IR_ENABLE)
 
 
@@ -424,6 +426,7 @@
     pwm_start_dma_ir_sending();
 
     ir_send_ctrl.is_full_sequence = 0;
+    ir_hw_initialed = 0;
 }
 
 
diff --git a/vendor/common/blt_common.c b/vendor/common/blt_common.c
index 5e22bfe..79e802c 100644
--- a/vendor/common/blt_common.c
+++ b/vendor/common/blt_common.c
@@ -40,20 +40,18 @@
 
 void blc_readFlashSize_autoConfigCustomFlashSector(void)
 {
-    u8 temp_buf[4];
-    flash_read_mid(temp_buf);
-    u8    flash_cap = temp_buf[2];
+
+
+    u8    flash_cap = ((get_flash_mid&0x00ff0000)>>16);
+    unsigned char adc_vref_calib_value_rd[4] = {0};
 
     if(flash_cap == FLASH_SIZE_512K){
         flash_sector_mac_address = CFG_ADR_MAC_512K_FLASH;
         flash_sector_calibration = CFG_ADR_CALIBRATION_512K_FLASH;
     }
     else if(flash_cap == FLASH_SIZE_1M){
-        flash_sector_mac_address = CFG_ADR_MAC_512K_FLASH;
-        flash_sector_calibration = CFG_ADR_CALIBRATION_512K_FLASH;
-
-//        flash_sector_mac_address = CFG_ADR_MAC_1M_FLASH;
-//        flash_sector_calibration = CFG_ADR_CALIBRATION_1M_FLASH;
+        flash_sector_mac_address = CFG_ADR_MAC_1M_FLASH;
+        flash_sector_calibration = CFG_ADR_CALIBRATION_1M_FLASH;
     }
     else{
         //This SDK do not support flash size other than 512K/1M
@@ -61,6 +59,18 @@
         while(1);
     }
 
+    //load adc vref value from flash
+    if(adc_vref_cfg.adc_calib_en)
+    {
+        flash_read_page(flash_sector_calibration+CALIB_OFFSET_ADC_VREF, 4, adc_vref_calib_value_rd);
+        if((adc_vref_calib_value_rd[2] != 0xff) || (adc_vref_calib_value_rd[3]  != 0xff ))
+        {
+            /******Method of calculating calibration Flash_vbat_Vref value: ********/
+            /******Vref = [1175 +First_Byte-255+Second_Byte] mV =  [920 + First_Byte + Second_Byte] mV  ********/
+            adc_vref_cfg.adc_vref = 920 + adc_vref_calib_value_rd[2] + adc_vref_calib_value_rd[3];
+        }
+        //else use the value init in efuse
+    }
 
     flash_set_capacity(flash_cap);
 }
@@ -99,11 +109,11 @@
         mac_public[1] = value_rand[1];
         mac_public[2] = value_rand[2];
 
-        #if(MCU_CORE_TYPE == MCU_CORE_8258)
+        #if(MCU_CORE_TYPE == MCU_CORE_825x)
             mac_public[3] = 0x38;             //company id: 0xA4C138
             mac_public[4] = 0xC1;
             mac_public[5] = 0xA4;
-        #elif(MCU_CORE_TYPE == MCU_CORE_8278)
+        #elif(MCU_CORE_TYPE == MCU_CORE_827x)
             mac_public[3] = 0xD1;             //company id: 0xC119D1
             mac_public[4] = 0x19;
             mac_public[5] = 0xC4;
diff --git a/vendor/common/blt_common.h b/vendor/common/blt_common.h
index 5e77392..c01b848 100644
--- a/vendor/common/blt_common.h
+++ b/vendor/common/blt_common.h
@@ -27,6 +27,8 @@
 #ifndef BLT_COMMON_H_
 #define BLT_COMMON_H_
 
+#include "drivers.h"
+
 
 #define            BLMS_STATE_SCAN                                 BIT(2)
 #define            BLMS_STATE_SCAN_POST                            BIT(3)
@@ -72,8 +74,7 @@
 
 #define        CALIB_OFFSET_FIRMWARE_SIGNKEY                        0x180
 
-
-
+#define     CALIB_OFFSET_FLASH_VREF                                0x1c0
 
 
 
@@ -111,6 +112,37 @@
              }
          }
      }
+#if(MCU_CORE_TYPE == MCU_CORE_827x)
+    u16 calib_value = *(unsigned short*)(flash_sector_calibration+CALIB_OFFSET_FLASH_VREF);
+
+    if((0xffff == calib_value) || (0 != (calib_value & 0xf8f8)))
+    {
+        if(flash_type == FLASH_ETOX_ZB)
+        {
+            analog_write(0x09, ((analog_read(0x09) & 0x8f) | (FLASH_VOLTAGE_1V95 << 4)));            //ldo mode flash ldo trim 1.95V
+            analog_write(0x0c, ((analog_read(0x0c) & 0xf8) | FLASH_VOLTAGE_1V9));                    //dcdc mode flash ldo trim 1.90V
+        }
+    }
+    else
+    {
+        analog_write(0x09, ((analog_read(0x09) & 0x8f)  | ((calib_value & 0xff00) >> 4) ));
+        analog_write(0x0c, ((analog_read(0x0c) & 0xf8)  | (calib_value & 0xff)));
+    }
+#elif(MCU_CORE_TYPE == MCU_CORE_825x)
+    u8 calib_value = *(unsigned char*)(flash_sector_calibration+CALIB_OFFSET_FLASH_VREF);
+
+    if((0xff == calib_value))
+    {
+        if(flash_type == FLASH_ETOX_ZB)
+        {
+            analog_write(0x0c, ((analog_read(0x0c) & 0xf8)  | FLASH_VOLTAGE_1V95));//1.95
+        }
+    }
+    else
+    {
+        analog_write(0x0c, ((analog_read(0x0c) & 0xf8)  | (calib_value&0x7)));
+    }
+#endif
 }
 
 
diff --git a/vendor/common/blt_fw_sign.c b/vendor/common/blt_fw_sign.c
index 97c40c5..2f10bfe 100644
--- a/vendor/common/blt_fw_sign.c
+++ b/vendor/common/blt_fw_sign.c
@@ -28,7 +28,7 @@
 #include "tl_common.h"
 #include "drivers.h"
 #include "blt_fw_sign.h"
-#include "stack/ble/blt_config.h"
+#include "stack/ble/ble_config.h"
 #include "blt_common.h"
 #include "proj_lib/firmware_encrypt.h"
 
diff --git a/vendor/common/blt_soft_timer.c b/vendor/common/blt_soft_timer.c
index 4a55e7c..89cec2e 100644
--- a/vendor/common/blt_soft_timer.c
+++ b/vendor/common/blt_soft_timer.c
@@ -32,10 +32,11 @@
 
 #include "stack/ble/ble.h"
 #include "tl_common.h"
-#include "../common/blt_soft_timer.h"
+#include "blt_soft_timer.h"
 
 
 
+#include "vendor/common/user_config.h"
 
 #if (BLT_SOFTWARE_TIMER_ENABLE)
 
@@ -45,13 +46,20 @@
 _attribute_data_retention_    blt_soft_timer_t    blt_timer;
 
 
+/**
+ * @brief        This function is used to Sort the timers according
+ *                 to the time of the timed task, so as to trigger the
+ *                 timers in turn
+ * @param[in]    none
+ * @return      none
+ */
 int  blt_soft_timer_sort(void)
 {
     if(blt_timer.currentNum < 1 || blt_timer.currentNum > MAX_TIMER_NUM){
-        write_reg32(0x40000, 0x11111120); while(1); //debug ERR
         return 0;
     }
     else{
+        //BubbleSort
         int n = blt_timer.currentNum;
         u8 temp[sizeof(blt_time_event_t)];
 
@@ -75,7 +83,13 @@
 
 
 
-//user add timer
+/**
+ * @brief        This function is used to add new software timer task
+ * @param[in]    func - callback function for software timer task
+ * @param[in]    interval_us - the interval for software timer task
+ * @return      0 - timer task is full, add fail
+ *                 1 - create successfully
+ */
 int blt_soft_timer_add(blt_timer_callback_t func, u32 interval_us)
 {
     u32 now = clock_time();
@@ -85,7 +99,7 @@
     }
     else{
         blt_timer.timer[blt_timer.currentNum].cb = func;
-        blt_timer.timer[blt_timer.currentNum].interval = interval_us * CLOCK_16M_SYS_TIMER_CLK_1US;
+        blt_timer.timer[blt_timer.currentNum].interval = interval_us * SYSTEM_TIMER_TICK_1US;
         blt_timer.timer[blt_timer.currentNum].t = now + blt_timer.timer[blt_timer.currentNum].interval;
         blt_timer.currentNum ++;
 
@@ -98,10 +112,18 @@
 }
 
 
-void  blt_soft_timer_delete_by_index(u8 index)
+/**
+ * @brief        Timer tasks are originally ordered. When deleting, it will
+ *                 be overwritten forward, so the order will not be destroyed
+ *                 and there is no need to reorder
+ * @param[in]    index - the index for some software timer task
+ * @return      0 - delete fail
+ *                 other - delete successfully
+ */
+int  blt_soft_timer_delete_by_index(u8 index)
 {
     if(index >= blt_timer.currentNum){
-        write_reg32(0x40000, 0x11111121); while(1); //debug ERR
+        return 0;
     }
 
 
@@ -110,9 +132,15 @@
     }
 
     blt_timer.currentNum --;
+    return 0;
 }
 
-
+/**
+ * @brief        This function is used to delete timer tasks
+ * @param[in]    func - callback function for software timer task
+ * @return      0 - delete fail
+ *                 1 - delete successfully
+ */
 int     blt_soft_timer_delete(blt_timer_callback_t func)
 {
 
@@ -123,7 +151,7 @@
 
             if(i == 0){
 
-                if( (u32)(blt_timer.timer[0].t - clock_time()) < 3000 *  CLOCK_16M_SYS_TIMER_CLK_1MS){
+                if( (u32)(blt_timer.timer[0].t - clock_time()) < 3000 *  SYSTEM_TIMER_TICK_1MS){
                     bls_pm_setAppWakeupLowPower(blt_timer.timer[0].t,  1);
                 }
                 else{
@@ -140,7 +168,11 @@
 }
 
 
-
+/**
+ * @brief        This function is used to manage software timer tasks
+ * @param[in]    type - the type for trigger
+ * @return      none
+ */
 void      blt_soft_timer_process(int type)
 {
     if(type == CALLBACK_ENTRY){ //callback trigger
@@ -163,7 +195,7 @@
         if(blt_is_timer_expired(blt_timer.timer[i].t ,now) ){ //timer trigger
 
             if(blt_timer.timer[i].cb == NULL){
-                write_reg32(0x40000, 0x11111122); while(1); //debug ERR
+
             }
             else{
                 result = blt_timer.timer[i].cb();
@@ -177,7 +209,7 @@
                 }
                 else{  //set new timer interval
                     change_flg = 1;
-                    blt_timer.timer[i].interval = result * CLOCK_16M_SYS_TIMER_CLK_1US;
+                    blt_timer.timer[i].interval = result * SYSTEM_TIMER_TICK_1US;
                     blt_timer.timer[i].t = now + blt_timer.timer[i].interval;
                 }
             }
@@ -190,7 +222,7 @@
             blt_soft_timer_sort();
         }
 
-        if( (u32)(blt_timer.timer[0].t - now) < 3000 *  CLOCK_16M_SYS_TIMER_CLK_1MS){
+        if( (u32)(blt_timer.timer[0].t - now) < 3000 *  SYSTEM_TIMER_TICK_1MS){
             bls_pm_setAppWakeupLowPower(blt_timer.timer[0].t,  1);
         }
         else{
@@ -204,7 +236,11 @@
 
 }
 
-
+/**
+ * @brief        This function is used to register the call back for pm_appWakeupLowPowerCb
+ * @param[in]    none
+ * @return      none
+ */
 void     blt_soft_timer_init(void)
 {
     bls_pm_registerAppWakeupLowPowerCb(blt_soft_timer_process);
diff --git a/vendor/common/blt_soft_timer.h b/vendor/common/blt_soft_timer.h
index 9135af5..b6b8ae1 100644
--- a/vendor/common/blt_soft_timer.h
+++ b/vendor/common/blt_soft_timer.h
@@ -28,6 +28,9 @@
 #define BLT_SOFT_TIMER_H_
 
 
+
+#include "vendor/common/user_config.h"
+
 //user define
 #ifndef BLT_SOFTWARE_TIMER_ENABLE
 #define BLT_SOFTWARE_TIMER_ENABLE                    0   //enable or disable
@@ -49,8 +52,16 @@
 #define        TIME_COMPARE_BIG(t1,t2)     ( (u32)((t1) - (t2)) < BIT(30)  )
 
 
-#define        BLT_TIMER_SAFE_MARGIN_PRE      (CLOCK_16M_SYS_TIMER_CLK_1US<<7)  //128 us
-#define        BLT_TIMER_SAFE_MARGIN_POST     (CLOCK_16M_SYS_TIMER_CLK_1S<<2)   // 4S
+#define        BLT_TIMER_SAFE_MARGIN_PRE      (SYSTEM_TIMER_TICK_1US<<7)  //128 us
+#define        BLT_TIMER_SAFE_MARGIN_POST      (SYSTEM_TIMER_TICK_1S<<2)   // 4S
+
+/**
+ * @brief        This function is used to check the current time is what the timer expects or not
+ * @param[in]    t - the time is expired for setting
+ * @param[in]   now - Current system clock time
+ * @return        0 - The current time isn't what the timer expects
+ *                 1 - The current time is what the timer expects
+ */
 static int inline blt_is_timer_expired(u32 t, u32 now) {
     return ((u32)(now + BLT_TIMER_SAFE_MARGIN_PRE - t) < BLT_TIMER_SAFE_MARGIN_POST);
 }
@@ -81,18 +92,53 @@
 
 //////////////////////// USER  INTERFACE ///////////////////////////////////
 //return 0 means Fail, others OK
+/**
+ * @brief        This function is used to add new software timer task
+ * @param[in]    func - callback function for software timer task
+ * @param[in]    interval_us - the interval for software timer task
+ * @return      0 - timer task is full, add fail
+ *                 1 - create successfully
+ */
 int     blt_soft_timer_add(blt_timer_callback_t func, u32 interval_us);
+/**
+ * @brief        This function is used to delete timer tasks
+ * @param[in]    func - callback function for software timer task
+ * @return      0 - delete fail
+ *                 1 - delete successfully
+ */
 int     blt_soft_timer_delete(blt_timer_callback_t func);
 
 
 
 
 //////////////////////// SOFT TIMER MANAGEMENT  INTERFACE ///////////////////////////////////
+/**
+ * @brief        This function is used to register the call back for pm_appWakeupLowPowerCb
+ * @param[in]    none
+ * @return      none
+ */
 void     blt_soft_timer_init(void);
+/**
+ * @brief        This function is used to manage software timer tasks
+ * @param[in]    type - the type for trigger
+ * @return      none
+ */
 void     blt_soft_timer_process(int type);
-void      blt_soft_timer_delete_by_index(u8 index);
+/**
+ * @brief        Timer tasks are originally ordered. When deleting, it will
+ *                 be overwritten forward, so the order will not be destroyed
+ *                 and there is no need to reorder
+ * @param[in]    index - the index for some software timer task
+ * @return      0 - delete fail
+ *                 other - delete successfully
+ */
+int     blt_soft_timer_delete_by_index(u8 index);
 
-
+/**
+ * @brief        This function is used to check the current time is what the timer expects or not
+ * @param[in]    e - callback function for software timer task
+ * @return        none
+ */
 int is_timer_expired(blt_timer_callback_t *e);
 
 
diff --git a/vendor/common/default_config.h b/vendor/common/default_config.h
index 8fe7758..166026d 100644
--- a/vendor/common/default_config.h
+++ b/vendor/common/default_config.h
@@ -47,7 +47,7 @@
 #ifndef STRING_PRODUCT
 #define STRING_PRODUCT        L"2.4G Wireless Audio"
 #endif
-#if (MCU_CORE_TYPE == MCU_CORE_8278)
+#if (MCU_CORE_TYPE == MCU_CORE_827x)
     #ifndef STRING_SERIAL
     #define STRING_SERIAL        L"TLSR8278"
     #endif
diff --git a/version.h b/version.h
index c874924..5696e00 100644
--- a/version.h
+++ b/version.h
@@ -27,6 +27,6 @@
 #ifndef VERSION_H_
 #define VERSION_H_
 
-#define FW_VERSION                  0x11110144//FW:v1.1.1  SW:v1.44
+#define FW_VERSION                  0x11110146//FW:v3.4.2  SW:v1.46
 
 #endif /* VERSION_H_ */