Index: format/app_module.format
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/format/app_module.format	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/format/app_module.format	(working copy)
@@ -1,116 +1,116 @@
 
 
 bmemalloc(
-	0 mem_module_prepare_write_request_packet
-	2 mem_module_prepare_write_request_PDU_length
-	2 mem_module_prepare_write_request_Channel_ID
-	1 mem_module_prepare_write_request_opcode
-	2 mem_module_prepare_write_request_handle
-	600 mem_temp_prepare_write_request_Data
+0 mem_module_prepare_write_request_packet
+2 mem_module_prepare_write_request_PDU_length
+2 mem_module_prepare_write_request_Channel_ID
+1 mem_module_prepare_write_request_opcode
+2 mem_module_prepare_write_request_handle
+600 mem_temp_prepare_write_request_Data
 )
+
+
 omemalloc(	
-	2 mem_soft_version_num
+2 mem_soft_version_num
+
+2 mem_current_packet_length
+1 mem_module_state
+
+1 mem_module_spp_lpm_mult
+1 mem_module_le_lpm_mult	
+1 mem_module_bluetooth_stauts_by_command
+
+//ble
+1 mem_module_le_rx_data_len
+2 mem_module_le_rx_data_address
+2 mem_module_le_rx_data_handle
+//ble write handle
+2 mem_module_data_write_handle
+2 mem_module_data_write_handle2
+//flag
+1 mem_module_flag
+
+1 mem_module_hci_notify_len
+2 mem_module_hci_notify_handle
+2 mem_module_hci_nofiy_addr
+
+4 mem_last_transmite_clock
+
+300 mem_module_uuid_list
+0 mem_module_uuid_list_end
+630 mem_module_le_att_list
+0 mem_module_le_att_list_end
+
+0 mem_module_nv_data
+6 mem_local_hci_plap
+16 mem_local_link_key
+12 mem_module_nv_data0
+34 mem_module_nv_data1
+34 mem_module_nv_data2
+34 mem_module_nv_data3
+34 mem_module_nv_data4
+1 mem_rfcomm_lmp_dis_flag
+1 mem_module_rfcomm_disconnect_count
+
+2 mem_le_buff_len
+2 mem_le_buff_len_all
+2 mem_module_prepare_write_request_contw
+2 mem_module_prepare_write_request_contr
+
+2 mem_module_master_rx_max
+
+1 mem_le_txheader_temp
+1 mem_le_txlen_temp
+2 mem_le_txpayload_temp
+2 mem_le_txcid_temp
+1 mem_le_l2cap_temp
+1 mem_le_l2cap_response_temp
+251 mem_le_txbdy_temp
+15 mem_rf_init
+1 mem_ble_dle_enable
+1 mem_wakeup_gpio
+1 mem_wake_by_m0
+
+4 mem_mcu_set_bt_wake_timer
+6 mem_gpio_wakeup_backup
+
+// Be aware of memory boundaries
+//ble
+6 mem_le_peer_addr
+
+160 mem_context_new
+
+//hfp start
+0 mem_xmem_hf_state_start
+1 mem_hf_state
+1 mem_hf_call_state
+1 mem_hf_command
+2 mem_agoption
+7 mem_ag_indicator_map
+7 mem_ag_indicator
+0 mem_xmem_hf_state_end
+
+2 mem_at_payload_ptr
+2 mem_at_command_ptr
+2 mem_at_rfcomm_data_ptr
+30 mem_at_command_data
+
+3 mem_ui_hf_brsf_feature
+
+1 mem_telephone_dialing_state
+1 mem_phone_num_len
+25 mem_phone_number
+//hfp end
+
+1 mem_bt_reconnect_timer
+1 mem_l2cap_receive_signal_conn_req_flag
 
-	2 mem_current_packet_length
-	1 mem_module_state
-	
-	1 mem_module_spp_lpm_mult
-	1 mem_module_le_lpm_mult	
-	1 mem_module_bluetooth_stauts_by_command
-
-	//ble
-	1 mem_module_le_rx_data_len
-	2 mem_module_le_rx_data_address
-	2 mem_module_le_rx_data_handle
-	//ble write handle
-	2 mem_module_data_write_handle
-	2 mem_module_data_write_handle2
-	//flag
-	1 mem_module_flag
-
-	1 mem_module_hci_notify_len
-	2 mem_module_hci_notify_handle
-	2 mem_module_hci_nofiy_addr
-
-	4 mem_last_transmite_clock
-	
-	300 mem_module_uuid_list
-	0 mem_module_uuid_list_end
-	630 mem_module_le_att_list
-	0 mem_module_le_att_list_end
-	0 mem_module_nv_data
-	34 mem_module_nv_data0
-	34 mem_module_nv_data1
-	34 mem_module_nv_data2
-	34 mem_module_nv_data3
-	34 mem_module_nv_data4
-	1 mem_rfcomm_lmp_dis_flag
-	1 mem_module_rfcomm_disconnect_count
-
-	2 mem_le_buff_len
-	2 mem_le_buff_len_all
-	2 mem_module_prepare_write_request_contw
-	2 mem_module_prepare_write_request_contr
-
-	2 mem_module_master_rx_max
-	
-	1 mem_le_txheader_temp
-	1 mem_le_txlen_temp
-	2 mem_le_txpayload_temp
-	2 mem_le_txcid_temp
-	1 mem_le_l2cap_temp
-	1 mem_le_l2cap_response_temp
-	251 mem_le_txbdy_temp
-	15 mem_rf_init
-	1 mem_ble_dle_enable
-//	1 mem_wakeup_gpio
-//	1 mem_wake_by_m0
-
-	4 mem_mcu_set_bt_wake_timer
-	6 mem_gpio_wakeup_backup
-	
-	// Be aware of memory boundaries
-
-	160 mem_context_new
-
-
-	//hfp start
-	0 mem_xmem_hf_state_start
-	1 mem_hf_state
-	1 mem_hf_call_state
-	1 mem_hf_command
-	2 mem_agoption
-	7 mem_AG_indicator_map
-	7 mem_AG_indicator
-	0 mem_xmem_hf_state_end
-
-	//hfp volume ctr
-	1 mem_hf_vlm_speaker
-	1 mem_music_vlm_speaker
-	1 mem_hf_vlm_mic
-
-	2 mem_at_payload_ptr
-	2 mem_at_command_ptr
-	2 mem_at_rfcomm_data_ptr
-
-	//init this value in user.dat
-	3 mem_UI_HF_brsf_feature
-	
-	1 mem_codec_type
-
-	//hfp callback
-	2 mem_cb_hfp_result_code
-
-	1 mem_telephone_dialing_state
-	1 mem_phone_num_len
-	25 mem_phone_number
-	30 mem_at_command_data
-	//hfp end
-
-	1 mem_module_rfcomm_reconnect_count
-	
-	0 mem_module_params_end
+1 mem_au_fail_timer
+1 mem_rx_iocap_req
+
+0 mem_module_params_end
 )
+
 (//mem_ble_dle_enable
 0x00 DLE_ENABLE
 0x01 DLE_DISABLE
@@ -215,7 +215,10 @@
 0x49 HCI_CMD_REJECT_JUSTWORK
 0x51 HCI_CMD_RESET_CHIP_REQ
 0x61 HCI_CMD_LE_SET_FIXED_PASSKEY
+0x62 HCI_CMD_LE_SEND_ENC_RSP
 
+
+0x75 HCI_CMD_ADD_SERVICE_CHARAC_UUID
 0x76 HCI_CMD_DELETE_CUSTOMIZE_SERVICE
 0x77 HCI_CMD_ADD_SERVICE_UUID
 0x78 HCI_CMD_ADD_CHARACTERISTIC_UUID
@@ -223,7 +226,10 @@
 
 
 
-0xb1 HCI_CMD_CREAT_BT_RECONNECT
+0xb1 HCI_CMD_CREATE_BT_RECONNECT
+0xb2 HCI_CMD_CANCEL_BT_RECONNECT
+0xb3 HCI_CMD_LE_SET_VISIBILITY_REQ
+0xb4 HCI_CMD_BT_SET_VISIBILITY_REQ
 
 
 0xee HCI_TEST_CMD_REBACK
@@ -262,8 +268,11 @@
 0xb2 HCI_EVENT_HFP_CONNECTED
 0xb3 HCI_EVENT_HFP_START_DIALING
 0xb4 HCI_EVENT_HFP_STOP_DIALING
+0xb5 HCI_EVENT_BT_PIN_OR_KEY_MISSING
 
-
+0xc0 HCI_EVENT_LE_ENC_INFO
+0xc1 HCI_EVENT_LE_START_ENC
+0xc2 HCI_EVENT_LE_RCV_ENC_REQ
 )
 
 
Index: format/lmp.format
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/format/lmp.format	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/format/lmp.format	(working copy)
@@ -142,6 +142,7 @@
 	152 LMP_RESUME_ENCRYPTION_REQ
 	153 LMP_IO_CAP_REQ
 	154 LMP_IO_CAP_RES
+	155 LMP_NUMBERIC_COMPARISON_FAILED
 	)
 	/* LMP reason codes */
 	(
Index: format/ui.format
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/format/ui.format	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/format/ui.format	(working copy)
@@ -203,6 +203,7 @@
 0x2c BT_EVT_BUTTON_DOWN
 0x2d BT_EVT_BUTTON_UP
 0x2e BT_EVT_REMOTE_UNSNIFF
+0x2f BT_EVT_LE_RCV_ENC_REQ
 0x30 BT_EVT_LE_PAIRING_FAIL
 0x31 BT_EVT_LE_PAIRING_SUCCESS
 0x32 BT_EVT_LE_START_ENC
@@ -221,6 +222,7 @@
 0x3F BT_EVT_LE_RECONNECT_COMPLETE
 0x40 BT_EVT_LE_PARSE_CONN_PAPA_UPDATE_RSP
 0x41 BT_EVT_LE_LTK_LOST
+0x42 BT_EVT_LE_IDENTITY_ADDR_INFO
 
 0x58 BT_EVT_HFP_STOP_DIALING
 0x59 BT_EVT_HFP_START_DIALING
Index: program/patch.prog
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/program/patch.prog	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/program/patch.prog	(working copy)
@@ -1,3 +1,4 @@
+define HFP
 
 
 /******************************************/
@@ -8,11 +9,16 @@
 	bbit1 8,pf_patch_ext
 	beq patch00_0,p_soft_reset0
 	//page patch
-	beq patch02_1,p_master_page_no_interval
+	beq patch00_7,p_idle_start_page
+	beq patch02_3,p_page_start
+	beq patch02_7,p_page_check_train
+	beq patch1b_1,p_ml2cap_proc_signal_disconn_req
 	//lpm exen patch
 	beq patch00_1,p_soft_reset
 	beq patch10_5,p_shutdown_radio
 	beq patch11_1,p_set_freq_tx
+	//enc patch
+	beq patch06_4,p_send_eir
 	//lpm patch
 	beq patch12_4,p_ahead_window
 	beq patch14_2,p_init_param
@@ -24,19 +30,19 @@
 	beq patch1d_3,p_le_init_conn
 	//context patch
 	beq patch00_5,p_connection_incontext
-	beq patch05_4,p_context_new
 	beq patch05_6,p_context_search
 	beq patch0d_7,p_sniff_check_window
 	beq patch14_6,p_lpm_recover_clk
 	beq patch14_7,p_lpm_dispatch
 	beq patch15_3,p_lpm_dispatch_unconn
-	//
-	beq patch07_3,p_sconn_successful
+//	beq patch07_3,p_sconn_successful
+ifdef HFP	
 	//hfp patch
 	beq patch17_7,p_l2cap_init_wake
+endif	
 	//role switch patch
 	beq patch04_6,p_role_switch_master
-	beq patch05_0,p_roles_replyto_fhs	
+	beq patch05_0,p_roles_replyto_fhs
 	branch assert
 
 
@@ -52,10 +58,12 @@
 	beq patch23_4,p_le_prepare_tx
 	beq patch23_6,p_le_send_packet
 	beq patch23_7,p_le_parse
-	beq patch24_1,p_le_parse_l2cap
+	beq patch24_2,p_le_parse_l2cap
 	beq patch26_0,p_le_modified_name
 	beq patch26_2,p_le_lpm_set_mult
 	beq patch27_2,p_parse_lmp
+	beq patch27_3,p_parse_lmp_escape
+	beq patch27_5,p_parse_lmp_not_accepted
 	beq patch27_6,p_send_lmp
 	beq patch28_1,p_ssp_disable
 	beq patch29_1,p_uartd_send
@@ -66,13 +74,14 @@
 	//sdp patch
 	beq patch2d_2,p_process_upper_sm_reconn
 	beq patch2f_2,p_sdp_process
-	//esco patch
-//	beq patch27_3,p_parse_lmp_escape
+ifdef HFP
 	//hfp patch
 	beq patch2a_1,p_rfcomm_rx_process
 	beq patch2a_4,p_parse_uih_rp_spp
 	beq patch2b_0,p_rfcomm_send_param_neg_cmd
 	beq patch2c_3,p_scheduler_process
+endif	
+	beq patch28_4,p_process_conn_sm
 	branch assert
 	
 
@@ -132,7 +141,11 @@
 	
 
 
-
+p_send_eir:
+	fetch 1,mem_state_map
+	set0 smap_encryption,pdata
+	store 1,mem_state_map
+	branch send_eir+1
 
 
 /*
@@ -276,88 +289,91 @@
 	setarg p_module_bt_conn_process
 	store 2,mem_cb_bt_process
 
+ifdef HFP
+	call p_hfp_clear_parms
+endif
+
 	call module_lpm_uart_init
 	call module_gpio_init
 	call check_module_disabled
-	call module_hci_event_enter_standby_mode
-
-	branch p_hfp_clear_parms
+	branch module_hci_event_enter_standby_mode
 
 
 p_module_process_bb_event:
 	copy regc,pdata
+	rtneq BT_EVT_STORE_NVRAM
+	/***************classic event****************/
 	beq BT_EVT_BB_CONNECTED,p_module_process_bb_conn	
 	beq BT_EVT_SPP_DISCONNECTED,p_module_process_spp_disconnected
 	beq BT_EVT_BB_DISCONNECTED,p_module_process_bb_event_disconned
 	beq BT_EVT_SETUP_COMPLETE,p_module_process_setup_complete
 	beq BT_EVT_RECONN_FAILED,p_module_process_reconn_fail
 	beq BT_EVT_RECONN_PAGE_TIMEOUT,p_module_process_page_time_out
+	beq BT_EVT_SWITCH_FAIL_MASTER,app_bt_disconnect
 	beq BT_EVT_LINKKEY_GENERATE,p_module_process_linkkey_generate
+ifdef HFP
 	beq BT_EVT_HFP_CONNECTED,p_module_process_hfp_connected
 	beq BT_EVT_HFP_START_DIALING,p_module_process_hfp_start_dialing
 	beq BT_EVT_HFP_STOP_DIALING,p_module_process_hfp_stop_dialing
-
+endif
+	/***************ble event****************/
 	beq BT_EVT_LE_CONNECTED,p_module_process_le_conn
 	beq BT_EVT_LE_DISCONNECTED,p_module_process_bb_even_le_disconn
-
-	beq BT_EVT_STORE_NVRAM,p_module_hci_event_store_device
+	beq BT_EVT_LE_IDENTITY_ADDR_INFO,p_module_process_le_enc_info
+	beq BT_EVT_LE_START_ENC,p_module_process_le_start_enc
+	beq BT_EVT_LE_RCV_ENC_REQ,p_module_process_le_rcv_enc_req
 	branch module_process_bb_event+1
 
 p_module_process_bb_conn:
-	jam 0,mem_module_rfcomm_reconnect_count
+	jam 0,mem_bt_reconnect_timer
 	call app_bt_stop_discovery
 	call app_bt_reconnect_cancel
 	branch module_process_bb_conn
 
 
 p_module_process_bb_event_disconned:
+ifdef HFP
 	call p_hfp_clear_parms
-	jam 0,mem_module_rfcomm_disconnect_count
+endif
+	jam 0,mem_au_fail_timer
+	jam 0,mem_rx_iocap_req
 	call module_spp_clear_last_transmite_clock
 	fetch 1,mem_flag_pairing_state
 	ncall module_hci_event_bt_pairing_fail,blank
-	call p_module_start_discovery
-//	fetch 2,mem_ui_state_map
-//	rtnbit0 UI_STATE_BT_SPP_CONN
-//	branch module_spp_disconnected	
-	fetch 2,mem_ui_state_map
-	bbit0 UI_STATE_BT_SPP_CONN,p_set_rfcomm_reconnect_count
-//	rtnbit0 UI_STATE_BT_SPP_CONN
-	set0 UI_STATE_BT_SPP_CONN ,pdata
-	store 2,mem_ui_state_map
+	call app_bt_start_discovery
 	branch module_hci_event_spp_disconnect
 
-p_set_rfcomm_reconnect_count:
-	jam 20,mem_module_rfcomm_reconnect_count
-	rtn
-
 	
 p_module_process_spp_disconnected:
-	fetch 1,mem_rfcomm_lmp_dis_flag
-	ncall p_set_rfcomm_disconnect_count,blank
-//	jam 6,mem_module_rfcomm_disconnect_count
-//	branch module_process_spp_disconnected
-	rtn
-p_set_rfcomm_disconnect_count:
-	jam 6,mem_module_rfcomm_disconnect_count
+	fetch 2,mem_ui_state_map
+	set0 UI_STATE_BT_SPP_CONN ,pdata
+	store 2,mem_ui_state_map
 	rtn
 
 p_module_process_setup_complete:
 	call module_spp_clear_last_transmite_clock
-	branch p_module_stop_discovery
+	branch app_bt_stop_discovery
 
 p_module_process_page_time_out:
 p_module_process_reconn_fail:
-	call p_module_start_discovery
-	branch p_module_hci_event_bt_reconn_fail
+	jam 10,mem_bt_reconnect_timer
+	rtn
+//	branch p_module_hci_event_bt_reconn_fail
 
 
 //event opcode 0xb1
-p_module_hci_event_bt_reconn_fail:
-	jam HCI_EVENT_BT_RECONNECT_FAIL,mem_module_uart_opcode
+//p_module_hci_event_bt_reconn_fail:
+//	jam HCI_EVENT_BT_RECONNECT_FAIL,mem_module_uart_opcode
+//	branch module_hci_event_enter_standby_mode_len0
+
+
+//event opcode 0xb1
+p_module_hci_event_bt_pin_or_key_missing:
+	jam HCI_EVENT_BT_PIN_OR_KEY_MISSING,mem_module_uart_opcode
 	branch module_hci_event_enter_standby_mode_len0
 
 
+ifdef HFP
 p_module_process_hfp_connected:
 	jam HCI_EVENT_HFP_CONNECTED,mem_module_uart_opcode
 	branch module_hci_event_enter_standby_mode_len0
@@ -374,43 +390,49 @@
 p_module_process_hfp_stop_dialing:
 	jam HCI_EVENT_HFP_STOP_DIALING,mem_module_uart_opcode
 	branch module_hci_event_enter_standby_mode_len0
+endif
+
 
-	
 p_module_process_le_conn:
 	call module_clear_recv_confirm_flag
-	call p_module_stop_adv
+	call app_ble_stop_adv
 	fetch 1,mem_module_le_lpm_mult
 	store 1,mem_lpm_mult
 	branch module_hci_event_le_connect
 
-p_module_stop_adv:
-	fetch 1,mem_module_state
-	isolate1 MOUDLE_STATE_BLE_BIT,pdata
-	call app_ble_stop_adv,true
-	rtn
-
-p_module_stop_discovery:
-	fetch 1,mem_module_state
-	isolate1 MOUDLE_STATE_BT_BIT,pdata
-	call app_bt_stop_discovery,true
-	rtn
-
-p_module_start_discovery:
-	fetch 1,mem_module_state
-	isolate1 MOUDLE_STATE_BT_BIT,pdata
-	call app_bt_start_discovery,true
-	rtn	
 
 p_module_process_bb_even_le_disconn:
 	call le_clr_config_more_data
 	call moudle_start_adv_by_command
 	branch module_hci_event_le_disconnect
 
-	
 
-//event opcode 0x0d
-p_module_hci_event_store_device:
-	rtn
+p_module_process_le_start_enc:
+	jam HCI_EVENT_LE_START_ENC,mem_module_uart_opcode
+	branch module_hci_event_enter_standby_mode_len0
+
+p_module_process_le_rcv_enc_req:
+	jam HCI_EVENT_LE_RCV_ENC_REQ,mem_module_uart_opcode
+	branch module_hci_event_enter_standby_mode_len0
+
+p_module_process_le_enc_info:
+	jam HCI_EVENT_LE_ENC_INFO,mem_module_uart_opcode
+	setarg 46
+	call module_hci_prepare_tx
+	fetch 6,mem_le_lap
+	istore 6,contwu	
+	fetch 6,mem_le_peer_addr
+	istore 6,contwu
+	fetch 2,mem_le_ediv
+	istore 2,contwu
+	arg mem_le_irk,contr
+	arg 16,loopcnt
+	call uart_copy_tx_bytes	
+	arg mem_le_ltk,contr
+	arg 16,loopcnt
+	call uart_copy_tx_bytes
+	branch uartd_send
+
 
 p_module_process_linkkey_generate:
 p_module_hci_event_linkkey_generate:
@@ -427,29 +449,40 @@
 	branch uartd_send
 
 
+p_module_bb_event_timer:
+	call p_module_au_fail_timer
+	call p_module_bt_reconnect_timer
+	branch p_module_mcu_set_bt_wake_timer
 
 
+p_module_bt_reconnect_timer:
+	arg mem_bt_reconnect_timer ,regc
+	arg p_module_bt_start_reconn_using_last_info,regb
+	branch timer_single_step	
 
-p_module_bb_event_timer:
-	call p_module_mcu_set_bt_wake_timer
-	call p_module_rfcomm_disconnect_timer
-	call p_module_rfcomm_reconnect_timer
-	branch module_bb_event_timer
-
-p_module_rfcomm_reconnect_timer:
-	arg mem_module_rfcomm_reconnect_count,regc
-	arg app_bt_start_reconnect,regb
-	branch timer_single_step
+p_module_bt_start_reconn_using_last_info:
+	fetch 6,mem_local_hci_plap
+	store 6,mem_hci_plap
+	arg mem_local_link_key,contr
+	arg mem_link_key,contw
+	call memcpy16
+	call check_link_key_load
+	call app_bt_stop_discovery
+	branch app_bt_start_reconnect
 
-p_module_rfcomm_disconnect_timer:
-	fetch 1,mem_module_rfcomm_disconnect_count
-	rtn blank
-	increase -1,pdata
-	store 1,mem_module_rfcomm_disconnect_count
+
+p_module_au_fail_timer:
+	arg mem_au_fail_timer ,regc
+	arg p_module_au_fail_timeout,regb
+	branch timer_single_step	
+	
+p_module_au_fail_timeout:
+	fetch 1,mem_rx_iocap_req
 	nrtn blank
 	fetch 2,mem_ui_state_map
+	rtnbit1 UI_STATE_BT_SPP_CONN
 	bbit1 UI_STATE_BT_CONNECTED,app_bt_disconnect
-	rtn
+	rtn 
 
 p_module_mcu_set_bt_wake_timer:
 	fetch 4,mem_mcu_set_bt_wake_timer
@@ -457,7 +490,6 @@
 	increase -1,pdata
 	store 4,mem_mcu_set_bt_wake_timer
 	nrtn blank
-//	jam 0x05,0x4fec
 	branch p_wake_m0
 	
 
@@ -467,7 +499,6 @@
 	copy rega,pdata
 	store 2,mem_module_le_rx_data_address
 	call p_check_ble_40_or_42
-//	copy loopcnt,pdata
 	store 1,mem_module_le_rx_data_len
 	fetcht 2,mem_le_att_handle
 	storet 2,mem_module_le_rx_data_handle
@@ -476,11 +507,6 @@
 	nbranch assert,blank
 	fetch 1,mem_le_cur_uuid_length	//	uuid length
 	bne 0x02,module_hci_event_receive_le_data
-//	ifetcht 2,contr
-//	setarg CLIENT_CHARACTERTIC_CONFIGURATION
-//	isub temp,null
-//	rtn zero		//filter ccc handle data
-//	branch p_module_hci_event_receive_le_data_notify,zero
 	branch module_hci_event_receive_le_data
 	
 p_check_ble_40_or_42:
@@ -497,16 +523,7 @@
 p_module_lpm_lock:
 	call p_le_check_complete_packet
 	nbranch p_app_get_lpm_wake_lock,user
-	
-//	fetch 1,mem_wakeup_gpio
-//	copy pdata,queue
-//	hfetch 6,core_gpio_in
-//	qisolate1 pdata
-//	branch p_app_get_lpm_wake_lock,true
-	
-//	fetch 1,mem_wake_by_m0
-//	nbranch p_app_get_lpm_wake_lock,blank
-	
+		
 	fetch 1,IPC_HOLD_BT
 	beq 1,p_app_get_lpm_wake_lock
 	fetch 1,mem_le_pairing_state
@@ -517,7 +534,6 @@
 	branch p_app_get_lpm_wake_lock
 
 p_app_get_lpm_wake_lock:
-//	jam 0x00,mem_lpm_mode 
 	call p_enable_chgpump
 	call wake_up_m0
 	branch app_get_lpm_wake_lock
@@ -534,41 +550,74 @@
 	fetch 1,mem_module_uart_opcode
 	beq HCI_CMD_SLEEP,p_module_hci_cmd_enter_sleep
 	beq HCI_CMD_SET_PAIRING_REQ,p_module_hci_cmd_set_pairing_mode
-	beq HCI_CMD_DELETE_CUSTOMIZE_SERVICE,module_hci_cmd_delete_customize_service
-	beq HCI_CMD_ADD_SERVICE_UUID,module_hci_cmd_add_service_uuid
-	beq HCI_CMD_ADD_CHARACTERISTIC_UUID,module_hci_cmd_add_characteristic_uuid
-	beq HCI_CMD_SET_COD,module_hci_cmd_le_set_adv_data_set_cod
-	beq HCI_CMD_SET_WAKE_GPIO,module_hci_cmd_set_wake_gpio
+	beq HCI_CMD_ADD_SERVICE_CHARAC_UUID,p_module_hci_cmd_add_service_charac_uuid
+	beq HCI_CMD_SET_COD,p_module_hci_cmd_le_set_adv_data_set_cod
+	beq HCI_CMD_SET_WAKE_GPIO,p_module_hci_cmd_set_wake_gpio
 	beq HCI_TEST_CMD_CLOSE_LPM,p_module_hci_test_cmde_close_lpm
 	beq HCI_CMD_MCU_SET_BT_WAKE_TIMER,p_module_hci_mcu_set_bt_wake_timer
-
-	beq HCI_CMD_CREAT_BT_RECONNECT,p_moudle_hci_cmd_creat_bt_reconnect
-	beq HCI_CMD_SET_VISIBILITY_REQ,p_module_hci_cmd_set_visibility
+	beq HCI_CMD_CREATE_BT_RECONNECT,p_moudle_hci_cmd_create_bt_reconnect
+	beq HCI_CMD_CANCEL_BT_RECONNECT,p_moudle_hci_cmd_cancel_bt_reconnect
+	beq HCI_CMD_LE_SET_VISIBILITY_REQ,p_module_hci_cmd_le_set_visibility
+	beq HCI_CMD_BT_SET_VISIBILITY_REQ,p_module_hci_cmd_bt_set_visibility
+	beq HCI_CMD_LE_SEND_ENC_RSP,p_module_hci_cmd_le_send_enc_rsp
 	branch module_hci_cmd_control + 2
 
 
+p_module_hci_cmd_add_service_charac_uuid:
+	call p_le_att_get_last_handle
+	increase -2,contr
+	copy contr,contw
+	fetchr loopcnt,1,mem_module_uart_len
+	call uart_copy_rx_bytes
+	setarg 0x0000
+	istore 2,contw
+	branch module_hci_event_receive_valid_cmd
+
+//output:temp:new handle num
+//contr:address write data
+p_le_att_get_last_handle:
+	fetch 2,mem_ui_le_uuid_table
+	iforce contr
+p_le_att_get_last_handle_loop:
+	ifetch 2,contr
+	rtn blank
+	add pdata,1,temp
+	ifetch 1,contr
+	iadd contr,contr	
+	ifetch 1,contr			// length
+	iadd contr,contr
+	copy contr,contw
+	branch p_le_att_get_last_handle_loop
+
 
-p_module_hci_cmd_set_visibility:
+
+p_module_hci_cmd_bt_set_visibility:
 	fetch 1,mem_module_uart_len
 	bne 1,module_hci_event_receive_invalid_cmd
 	copy rega,contru
 	call module_hci_event_receive_valid_cmd
 	ifetcht 1,contru
 	storet 1,mem_module_bluetooth_stauts_by_command
-//	fetch 2,mem_ui_state_map
-//	rtnbit1 UI_STATE_BLE_CONNECTED
-//	rtnbit1 UI_STATE_BT_CONNECTED
-p_module_start_adv_discovery_by_command:
+
 	fetch 1,mem_module_state
 	isolate1 MOUDLE_STATE_BT_BIT,pdata
-	nbranch p_moudle_start_adv_by_command,true
+	nrtn true
 	fetch 2,mem_ui_state_map
-	bbit1 UI_STATE_BT_CONNECTED,p_moudle_start_adv_by_command
-	
+	rtnbit1 UI_STATE_BT_CONNECTED
 	fetcht 1,mem_module_bluetooth_stauts_by_command
 	and temp,0x03,pdata
 	store 1,mem_scan_mode
-p_moudle_start_adv_by_command:
+	rtn
+
+	
+p_module_hci_cmd_le_set_visibility:
+	fetch 1,mem_module_uart_len
+	bne 1,module_hci_event_receive_invalid_cmd
+	copy rega,contru
+	call module_hci_event_receive_valid_cmd
+	ifetcht 1,contru
+	storet 1,mem_module_bluetooth_stauts_by_command
+	
 	fetch 1,mem_module_state
 	isolate1 MOUDLE_STATE_BLE_BIT,pdata
 	nrtn true
@@ -579,138 +628,56 @@
 	branch app_ble_start_adv,true
 	branch app_ble_stop_adv
 
+p_module_hci_cmd_le_send_enc_rsp:
+	call module_hci_event_receive_valid_cmd
+	fetch 1,mem_le_pairing_state
+	beq FLAG_LE_PAIRING_AFTER_AUTH,p_le_parse_enc_req_after_auth
+	fetch 1,mem_le_configuration
+	bbit1 BIT_BLE_PAIRING_FIXED_LTK,le_parse_enc_req_fixed_ltk
+	fetch 1,mem_nv_data_number
+	ncall load_device_list_mode_4,blank
+	fetch 1,mem_ltk_exists
+	beq 0,le_ltk_lost
+p_le_parse_enc_req_after_auth:
+	jam FLAG_LE_RCV_ENC_START,mem_le_enc_state
+	call le_send_enc_rsp
+	call le_send_start_enc_req
+	call generate_sk
+
+	fetch 2,mem_context_ptr	//save mem_le_sk
+	iforce contw
+	force context_size,loopcnt
+	arg mem_le_state,contr
+	branch memcpy_fast
+
 
 p_module_hci_test_cmde_close_lpm:
-//	jam 0,mem_wake_by_m0
 	ifetch 1,contru
 	store 1,mem_lpm_mode
-//	store 1,0x4fed
-//	jam 3,0x4fee
 	rtn
 	
-	
+
 p_module_hci_cmd_set_pairing_mode:
 	copy rega,contru
 	ifetch 1,contru
-	beq PAIRING_PINCODE,module_hci_pairing_pincode_mode
-	beq PAIRING_JUSTWORK,module_hci_pairing_just_work_mode
-	beq PAIRING_PASSKEY,module_hci_pairing_passkey
 	beq PAIRING_CONFIRM,p_module_hci_pairing_numeric_comparison
-	branch module_hci_event_receive_invalid_cmd
+	branch module_hci_cmd_set_pairing_mode+2
 
 p_module_hci_pairing_numeric_comparison:
 	setarg 0x000001
 	branch module_hci_sspairing_mode
 
-module_hci_cmd_delete_customize_service:
-	arg 0x000C,temp
-	call le_att_get_handle_ptr2
-	add contr,-2,contw
-	setarg 0x0000
-	istore 2,contw
-	branch module_hci_event_receive_valid_cmd
-
-module_hci_cmd_add_service_uuid:
-	call module_hci_cmd_add_service_uuid_set_uuid
-	call uart_copy_rx_bytes_len_data
-	setarg 0x0000
-	istore 2,contw
-	branch module_hci_event_uuid_handle
-
-module_hci_cmd_add_characteristic_uuid:
-	ifetch 1,contru	//Characteristic
-	call module_hci_cmd_add_characteristic_uuid_set_handle
-	call module_hci_cmd_add_characteristic_uuid_set_uuid
-	branch module_hci_event_uuid_handle
-
-module_hci_cmd_add_service_uuid_set_uuid:
-	call le_att_creat_new_handle
-	setarg 0x280002
-	istore 3,contw
-	rtn
 
-module_hci_cmd_add_characteristic_uuid_set_handle:
-	store 1,mem_pdatatemp
-	call le_att_creat_new_handle
-	setarg 0x01280302
-	istore 4,contw
-	fetch 1,mem_pdatatemp
-	istore 3,contw
-	rtn
-
-module_hci_cmd_add_characteristic_uuid_set_uuid:
-	call le_att_creat_new_handle
-	call uart_copy_rx_bytes_len_data		//uuid
-	call uart_copy_rx_bytes_len_data		//data
-	setarg 0
-	istore 2,contw
-	increase -1,temp
-	call le_att_get_handle_ptr2
-	add contr,4,contr
-	ifetch 1,contr		//characteristic data
-	bbit1 BIT_CHARACTERISTIC_NOTIFY,module_hci_cmd_add_characteristic_uuid_set_ccc_uuid
-	bbit1 BIT_CHARACTERISTIC_INDICATE,module_hci_cmd_add_characteristic_uuid_set_ccc_uuid
-	increase 1,temp
-	rtn
-
-module_hci_cmd_add_characteristic_uuid_set_ccc_uuid:
-	call le_att_creat_new_handle
-	setarg 0x02290202
-	istore 8,contw
-	increase -1,temp
-	rtn
-
-
-uart_copy_rx_bytes_len_data:
-	ifetch 1,contru
-	copy pdata,loopcnt
-	istore 1,contw
-	branch uart_copy_rx_bytes
-
-
-le_att_creat_new_handle:
-	call le_att_get_last_handle
-	istoret 2,contw
-	rtn
-
-//output:temp:new handle num
-//contr:address write data
-le_att_get_last_handle:
-	fetch 2,mem_ui_le_uuid_table
-	iforce contr
-le_att_get_last_handle_loop:
-	ifetch 2,contr
-	rtn blank
-	add pdata,1,temp
-	ifetch 1,contr
-	iadd contr,contr	
-	ifetch 1,contr			// length
-	iadd contr,contr
-	copy contr,contw
-	branch le_att_get_last_handle_loop
-
-
-//input:temp uuid number
-module_hci_event_uuid_handle:
-	storet 2,mem_temp
-	jam HCI_EVENT_UUID_HANDLE,mem_module_uart_opcode
-	setarg 2
-	call module_hci_prepare_tx
-	fetcht 2,mem_temp
-	istoret 2,contwu
-	branch uartd_send
-
-module_hci_cmd_le_set_adv_data_set_cod:
+p_module_hci_cmd_le_set_adv_data_set_cod:
 	ifetch 3,contru
 	store 3,mem_class
 	branch module_hci_event_receive_valid_cmd
 
 
 p_module_hci_cmd_enter_sleep:
-//	call module_hci_event_receive_valid_cmd
 	branch app_enter_hibernate
 
-module_hci_cmd_set_wake_gpio:
+p_module_hci_cmd_set_wake_gpio:
 	ifetch 1,contru
 
 	//lpm
@@ -737,20 +704,37 @@
 	branch module_hci_event_receive_valid_cmd
 
 
-p_moudle_hci_cmd_creat_bt_reconnect:
+p_moudle_hci_cmd_create_bt_reconnect:
+	fetch 1,mem_context
+	bbit1 state_inconn,module_hci_event_receive_invalid_cmd
+	bbit1 state_inpage,module_hci_event_receive_invalid_cmd
+	fetch 2,mem_ui_state_map
+	bbit1 UI_STATE_BT_CONNECTED,module_hci_event_receive_invalid_cmd
+	jam 0,mem_bt_reconnect_timer
 	ifetch 6,contru
 	store 6,mem_lap
 	ifetch 6,contru
 	store 6,mem_hci_plap
+	store 6,mem_local_hci_plap
 	arg mem_link_key,contw
 	arg 16,loopcnt
 	call uart_copy_rx_bytes
+	arg mem_link_key,contr
+	arg mem_local_link_key,contw
+	call memcpy16
 	call check_link_key_load
-//	call app_bt_stop_discovery
-//	call app_ble_stop_adv
+	call app_bt_stop_discovery
 	call app_bt_start_reconnect
 	branch module_hci_event_receive_valid_cmd
 
+p_moudle_hci_cmd_cancel_bt_reconnect:
+	fetch 1,mem_context
+	bbit1 state_inconn,module_hci_event_receive_invalid_cmd
+	fetch 2,mem_ui_state_map
+	bbit1 UI_STATE_BT_CONNECTED,module_hci_event_receive_invalid_cmd
+	jam 0,mem_bt_reconnect_timer
+	call app_bt_reconnect_cancel
+	branch module_hci_event_receive_valid_cmd
 
 
 p_module_hci_cmd_transmit_le_notify:
@@ -856,9 +840,7 @@
 	inject mod,8
 	ifetch 1,contr
 	copy pdata,loopcnt
-	inject mod,8
-	branch letr_nopayload,zero
-	branch letr_loop
+	branch le_transmit0+16
 
 p_le_send_adv_ind:
 	fetch 1,mem_ble_dle_enable
@@ -875,10 +857,7 @@
 	store 1,mem_le_txlen_temp
 	fetch 6,mem_le_lap
 	store 6,mem_le_txpayload_temp
-	copy temp,loopcnt
-	arg mem_le_adv_data,contr
-	call memcpy_fast
-	branch le_send_adv_transmit
+	branch le_send_adv_ind+12
 
 
 p_le_send_scan_response:
@@ -894,11 +873,7 @@
 	store 1,mem_le_txlen_temp
 	fetch 6,mem_le_lap
 	store 6,mem_le_txpayload_temp
-	arg mem_le_scan_data,contr
-	copy temp,loopcnt
-	call memcpy_fast
-	call le_transmit_norx
-	branch le_adv_not_match
+	branch le_send_scan_response+10
 
 
 /*
@@ -930,9 +905,6 @@
 
 	fetch 1,mem_ble_dle_enable
 	nrtn blank
-
-	branch p_le_parse_writing_attribute
-
 p_le_parse_writing_attribute:
 	fetch 1,mem_le_rxbuf+1
 	rtn blank		//empty packet
@@ -1084,7 +1056,7 @@
 
 p_le_check_wak:
 	fetch 1,mem_ble_dle_enable
-	nbranch  le_check_wak+1,blank
+	nbranch le_check_wak+1,blank
 	
 	fetcht 1,mem_le_arq
 	isolate0 wak,temp
@@ -1099,10 +1071,7 @@
 	compare 3,temp,3
 	nrtn true
 	fetch 1,mem_le_txpayload_temp
-	beq LL_START_ENC_REQ,le_set_enc
-	fetch 1,mem_le_enc_state
-	beq FLAG_LE_ENC_PAUSE,le_clear_enc
-	rtn
+	branch le_check_wak+14
 
 p_le_prepare_tx:
 	fetch 1,mem_ble_dle_enable
@@ -1138,12 +1107,7 @@
 	copy temp,regb
 	isub regb,pdata
 	call p_le_get_master_rx_max
-	call not_greater_than
-	iadd regb,pdata
-	istore 1,regc
-	isub rega,null
-	nrtn zero
-	branch le_fifo_release_first_node
+	branch le_prepare_tx+30
 
 
 p_le_get_master_rx_max:
@@ -1169,14 +1133,10 @@
 
 	fetch 1,mem_le_txheader_temp
 	compare 1,type,3
-	nbranch p_le_send_no_txlen,true
+	nbranch le_send_no_txlen,true
 	fetch 1,mem_le_txlen_temp
 	rtn blank
-p_le_send_no_txlen:
-	fetch 1,mem_le_state
-	rtnbit0 lestate_encryption
-	call load_sk
-	branch le_encrypt
+	branch le_send_no_txlen
 
 p_le_encrypt:
 	fetch 1,mem_ble_dle_enable
@@ -1185,27 +1145,25 @@
 	arg mem_le_txheader_temp,regc
 	fetcht 5,mem_le_pcnt_tx
 	call generate_mic
-	force regidx_xor,regext_index
-	iforce regext
 	force 0,rega					/* rega is block counter */
 	call first_block_data
 	call aes_init				// 1021s ->  do_aes_ctr
+	force regidx_data,regext_index
+	copy regb,regext
+	call do_aes_cfb
 	arg mem_le_txpayload_temp,regc
 	fetch 1,mem_le_txlen_temp
 	add pdata,-1,regb
 	iadd regc,contw
 	force regidx_result,regext_index
 	deposit regext
-	istore 4,contw	
+	istore 4,contw
+	force 0,rega
 	call aes_crypt_data
 	fetch 1,mem_le_txlen_temp
 	increase 4,pdata
 	store 1,mem_le_txlen_temp
-	fetcht 5,mem_le_pcnt_tx
-	increase 1,temp
-	storet 5,mem_le_pcnt_tx
-	rtn
-
+	branch le_encrypt+21
 
 /*
 	l2cap 组包的问题
@@ -1236,6 +1194,7 @@
 	fetch 1,mem_le_rxbuf+2
 	beq LL_FEATURE_REQ,p_le_parse_feature_req
 	beq LL_LENGTH_REQ,p_le_parse_length_request
+	beq LL_ENC_REQ,p_le_parse_enc_req
 	branch le_parse_ll+1
 	
 p_le_parse_feature_req:
@@ -1282,12 +1241,24 @@
 	rtn
 
 
+p_le_parse_enc_req:
+	ifetch 8,contr
+	store 8,mem_le_rand
+	ifetch 2,contr
+	store 2,mem_le_ediv
+	ifetch 8,contr
+	store 8,mem_le_skdm
+	ifetch 4,contr
+	store 4,mem_le_ivm
+	jam BT_EVT_LE_RCV_ENC_REQ,mem_fifo_temp
+	branch ui_ipc_send_event
+
+
 p_le_parse_l2cap:
 	ifetch 2,contr
 	beq LE_L2CAP_CID_ATT,p_le_parse_att
-	beq LE_L2CAP_CID_SMP,le_parse_smp
-	beq LE_L2CAP_CID_SIGNAL,le_parse_signaling
-	rtn
+	beq LE_L2CAP_CID_SMP,p_le_parse_smp
+	branch le_parse_l2cap+10
 
 p_le_parse_att:
 	ifetch 3,contr
@@ -1311,6 +1282,26 @@
 	store 2,mem_le_local_mtu
 	branch le_send_att_exchange_mtu_response
 
+	
+p_le_parse_smp:
+	ifetch 1,contr
+	beq SMP_IDENTITY_ADDRESS_INFORMATION,p_le_parse_smp_identity_address_information
+	branch le_parse_smp+1
+
+p_le_parse_smp_identity_address_information:
+	call store_contr
+	call le_check_init_key_distribution
+	isolate0 LE_INITATOR_IRK_BIT,pdata
+	branch le_send_pairing_fail_unspecified_reason,true
+	call get_contr
+	ifetch 1,contr	//address type
+	ifetch 6,contr	//bd_addr
+	store 6,mem_le_peer_addr
+	call le_check_master_addr_type
+	nrtn user
+	jam BT_EVT_LE_IDENTITY_ADDR_INFO,mem_fifo_temp
+	branch ui_ipc_send_event
+
 
 p_le_modified_name:
 	call le_modified_name_att_list
@@ -1339,13 +1330,8 @@
 	nbranch lpm_mult_short,blank		// rx not empty, short interval
 	fetch 1,mem_le_txlen_temp
 	nbranch lpm_mult_short,blank		// tx not empty, short interval
-	
-	fetch 1,mem_le_configuration
-	bbit1 BIT_BLE_SHORT_MULT,lpm_mult_short	//check flag,if flag is 1,always short mult
-	
-	fetch 1,mem_le_state
-	bbit1 lestate_update_param,lpm_mult_short
-	branch lpm_mult_wait_timeout
+
+	branch le_lpm_set_mult_attempt+9
 
 
 p_parse_lmp:
@@ -1367,6 +1353,34 @@
 p_parse_lmp_sniff_req:
 	branch parse_lmp_sniff_req+1
 
+
+p_parse_lmp_not_accepted:
+	fetch 1,mem_rxbuf+1
+	store 1,mem_lmi_accepted_opcode
+	beq LMP_AU_RAND,p_parse_lmp_not_accepted_aurand//ok
+	branch parse_lmp_not_accepted+3
+
+p_parse_lmp_not_accepted_aurand:
+	call p_reset_paring_state
+	jam 20,mem_au_fail_timer
+	fetch 1,mem_rxbuf+2
+	beq KEY_MISSING,p_parse_lmp_not_accepted_aurand_key_missing
+	rtn
+
+p_reset_paring_state:
+	jam CONN_SM_STANDBY,mem_conn_sm
+	jam SP_STAT_NULL,mem_sp_state
+	jam 0,mem_connection_options
+	jam 0,memui_reconnect_mode
+	setarg 0
+	store 6,mem_hci_plap
+	rtn	
+
+p_parse_lmp_not_accepted_aurand_key_missing:
+	call parse_lmp_inrand_key_missing
+	branch p_module_hci_event_bt_pin_or_key_missing
+
+
 p_send_lmp:
 	disable user
 	call lmo_fifo_process
@@ -1406,10 +1420,8 @@
 p_uartd_send:
 	copy contwu,pdata
 	store 2,IPC_BT2M0_WRITE_PTR
-//	jam 0xcc,0x4fee
 	jam 0x00,mem_lpm_mode
 	call p_enable_chgpump
-//wake_up_m0:
 	fetch 1,core_config
 	rtnbit1 7
 	set1 7,pdata
@@ -1432,8 +1444,11 @@
 	jam BT_EVT_SPP_CONNECTED,mem_fifo_temp
 	call ui_ipc_send_event
 	call get_rfcomm_param_modem_status
-	branch parse_DLCI0_rp_uih_ms_res_spp
-
+	fetch 1,mem_ms_channel
+	sub pdata,1,null
+	branch parse_DLCI0_rp_uih_MS_RES_spp,zero
+	branch app_bt_disconnect
+	branch assert
 
 p_parse_DLCI0_reconn:
 	fetch 1,mem_current_frame_type
@@ -1444,15 +1459,31 @@
 	copy pdata,contr
 	call get_rfcomm_uih_head_struct
 	fetch 1,mem_uih_cmd_type
+	beq UIH_PARAM_NEG_CMD,p_parse_DLCI0_reconn_uih_pn_cmd
+	beq UIH_PARAM_NEG_RES,p_parse_DLCI0_reconn_uih_pn_cmd
 	beq UIH_MODEM_STATUS_RES,p_parse_DLCI0_reconn_uih_ms_res
 	branch parse_DLCI0_reconn_uih+4
-	
+
+p_parse_DLCI0_reconn_uih_pn_cmd:
+	call parse_DLCI0_rp_uih_pn_res_common
+	fetch 1,mem_pn_dlci
+	rshift pdata,pdata
+	fetcht 1,mem_remote_spp_channel
+	isub temp,null
+	branch parse_DLCI0_reconn_uih_pn_cmd_spp,zero
+	branch app_bt_disconnect
+	branch assert
+
 p_parse_DLCI0_reconn_uih_ms_res:
 	jam BT_EVT_SPP_CONNECTED,mem_fifo_temp
 	call ui_ipc_send_event
 	call get_rfcomm_param_modem_status
-	branch parse_DLCI0_reconn_uih_ms_res_spp
-
+	fetch 1,mem_ms_channel
+	fetcht 1,mem_remote_spp_channel
+	isub temp,null
+	branch parse_DLCI0_reconn_uih_ms_res_spp,zero
+	branch app_bt_disconnect
+	branch assert
 
 
 p_sp_initialize_256:	
@@ -1501,38 +1532,21 @@
 	rtn
 
 
-p_context_new:
-	arg p_context_search_empty,regc
-	branch context_new+2
-p_context_search_empty:
-	bbit1 state_inconn,context_search_next
-//	bbit1 state_inpage,context_search_next
-	force 0,null
-	rtn
-
-
 p_context_search:
 	arg mem_context_new,rega
 	arg context_num_new,loopcnt
 	branch context_search_loop
 
 
-p_sconn_successful:
-	fetch 1,mem_state
-	set0 state_inpage,pdata
-	store 1,mem_state
-	jam 0,memui_reconnect_mode
-	branch sconn_successful+1
-
-	
-//p_context_check_page:
-//	arg p_context_check_inpage,regc
-//	branch context_search
-
-//p_context_check_inpage:
-//	bbit0 state_inpage,context_search_next
-//	force 0,null 				// found
-//	rtn
+//p_sconn_successful:
+//	fetch 1,mem_state
+//	set0 state_inpage,pdata
+//	store 1,mem_state
+//	call init_lmp_work
+//	jam 0,memui_reconnect_mode
+//	jam CONN_SM_STANDBY,mem_conn_sm
+//	call page_exit
+//	branch sconn_successful+1
 
 
 p_sniff_check_window:
@@ -1649,6 +1663,22 @@
 	branch lpm_dispatch_unconn+2
 
 
+//p_app_process_bb_event:
+//	//return if c51 need to process bb event
+//	arg mem_ipc_fifo_bt2c51,rega
+//	call fifo_out
+//	rtn blank
+//	//reaching here mains c51 cannot get bb event.
+//	copy pdata,regc
+//	call p_app_event_normal_process
+//	branch app_process_bb_event_priority
+
+//p_app_event_normal_process:
+//	beq BT_EVT_SWITCH_FAIL_MASTER,app_bt_disconnect
+//	branch app_event_normal_process
+
+
+
 p_le_check_encrypt_state:
 	call disable_user
 	fetch 1,mem_le_pairing_mode
@@ -1699,39 +1729,25 @@
 
 /**********************************context patch**********************************************/
 
-/**********************************esco patch**********************************************/
-/*
+/**********************************reconn patch**********************************************/
+
 p_parse_lmp_escape:
 	fetch 1,mem_rxbuf+1
 	set1 7,pdata
 	store 1,mem_lmi_opcode2
-	beq LMP_EXT_REMOVE_ESCO_REQ,p_parse_lmpext_remove_esco_req
-	beq LMP_EXT_ESCO_LINK_REQ,p_parse_lmpext_esco_link_req
+	beq LMP_NUMBERIC_COMPARISON_FAILED,check_51cmd_disconnect
+	beq LMP_IO_CAP_REQ,p_parse_lmpext_iocap_req	
 	branch parse_lmp_escape+4
 
-p_parse_lmpext_remove_esco_req:
-	jam LMP_EXT_ACCEPTED,mem_lmo_opcode2
-	rtn
-
-p_parse_lmpext_esco_link_req:
-	jam LMP_EXT_ACCEPTED,mem_lmo_opcode2
-	rtn
-
-p_send_lmpext_accepted:
-	call send_lmpext_accepted
-	fetch 1,mem_lmi_opcode
-	beq LMP_EXT_ESCO_LINK_REQ,p_send_lmpext_accept_esco_link
-	beq LMP_EXT_REMOVE_ESCO_REQ,p_send_remove_esco_link
-	rtn
+p_parse_lmpext_iocap_req:
+	fetch 1,memui_reconnect_mode
+	ncall p_reset_paring_state,blank
+	jam 1,mem_rx_iocap_req
+	branch parse_lmpext_iocap_req
 
-p_send_lmpext_accept_esco_link:
-//	set1 mark_esco,mark
-	rtn
 
-p_send_remove_esco_link:
-	rtn
-*/	
-/**********************************esco patch**********************************************/
+	
+/**********************************reconn patch**********************************************/
 
 
 /**********************************rolw switch patch**********************************************/
@@ -1774,6 +1790,7 @@
 
 
 /**********************************hfp patch**********************************************/
+ifdef HFP
 
 p_l2cap_init_wake:
 	call l2cap_init_wake+1
@@ -1897,12 +1914,7 @@
 	jam HF_STATE_WAITING_RFCOMM_CONN,mem_hf_state
 	jam HFP_NONO,mem_hf_call_state
 	jam HF_CMD_IDLE,mem_hf_command
-	jam HFP_DEFAULT_MIC_VLM,mem_hf_vlm_mic
-	jam HFP_DEFAULT_SPEAKER,mem_hf_vlm_speaker
 	jam HFP_DIALING_STATE_NO,mem_telephone_dialing_state
-//	call HFP_clear_sco_params
-//	setarg 0
-//	store 2,mem_rfc_server_state
 	setarg mem_xmem_hf_state_end
 	arg mem_xmem_hf_state_start,contw
 	isub contw,loopcnt
@@ -1966,7 +1978,7 @@
 	istore 3,contw
 	setarg 0x3D46
 	istore 2,contw
-	fetch 1,mem_UI_HF_brsf_feature
+	fetch 1,mem_ui_hf_brsf_feature
 	istore 1,contw
 	setarg 0x0D
 	istore 1,contw
@@ -2088,22 +2100,21 @@
 	rtn user
 	call p_hfp_is_result_ciev
 	rtn user
-	call p_hfp_is_result_ring
-	rtn user
+//	call p_hfp_is_result_ring
+//	rtn user
 	call p_hfp_is_result_cind
 	rtn user
 	call p_hfp_is_result_chld
 	rtn user
-	call p_hfp_is_result_vgm_vgs
-	rtn user
-	call p_hfp_is_result_clip
-	rtn user
-	call p_hfp_is_result_ccwa
-	rtn user
+//	call p_hfp_is_result_vgm_vgs
+//	rtn user
+//	call p_hfp_is_result_clip
+//	rtn user
+//	call p_hfp_is_result_ccwa
+//	rtn user
 	call p_hfp_is_result_clcc
 	rtn user
-	fetch 2,mem_cb_hfp_result_code
-	branch callback_func
+	rtn
 
 p_hfp_is_result_ok:
 	fetch 2,mem_at_command_ptr
@@ -2185,20 +2196,20 @@
 	enable user
 	branch p_hfp_result_ok_cmd
 
-p_hfp_is_result_ring:
-	//disable user
-	fetch 2,mem_at_command_ptr
-	icopy contr
-	ifetch 1,contr
-	rtnne 0x52
-	ifetch 1,contr
-	rtnne 0x49
-	ifetch 1,contr
-	rtnne 0x4e
-	ifetch 1,contr
-	rtnne 0x47
-	enable user
-	rtn
+//p_hfp_is_result_ring:
+//	//disable user
+//	fetch 2,mem_at_command_ptr
+//	icopy contr
+//	ifetch 1,contr
+//	rtnne 0x52
+//	ifetch 1,contr
+//	rtnne 0x49
+//	ifetch 1,contr
+//	rtnne 0x4e
+//	ifetch 1,contr
+//	rtnne 0x47
+//	enable user
+//	rtn
 
 
 p_hfp_is_result_ciev:
@@ -2218,11 +2229,11 @@
 	enable user
 	call p_hfp_translate_ascii_to_hex
 	increase 2,rega //temp
-	setarg mem_AG_indicator_map
+	setarg mem_ag_indicator_map
 	iadd temp,temp
 	increase -1,temp
 	ifetch 1,temp
-	arg mem_AG_indicator,temp
+	arg mem_ag_indicator,temp
 	iadd temp,pdata
 	store 2,mem_at_command_ptr //temporary store the addr point
 	copy rega,contr
@@ -2242,7 +2253,7 @@
 //output:
 //     pdata value
 p_hfp_get_indicator_value:
-	arg mem_AG_indicator,contr
+	arg mem_ag_indicator,contr
 	iadd contr,contr
 	ifetch 1,contr
 	rtn
@@ -2329,12 +2340,10 @@
 	call p_hfp_evt_callactive
 
 p_hfp_dialing_stop:
-//	jam 0,mem_telephone_dialing_timer
 	jam HFP_DIALING_STATE_STOP,mem_telephone_dialing_state
 	rtn
 
 p_hfp_dialing_clear:
-//	jam 0,mem_telephone_dialing_timer
 	jam HFP_DIALING_STATE_NO,mem_telephone_dialing_state
 	rtn
 
@@ -2342,8 +2351,6 @@
 	jam BT_EVT_HFP_START_DIALING,mem_fifo_temp
 	call ui_ipc_send_event
 	jam HFP_DIALING_STATE_START,mem_telephone_dialing_state
-//	jam 0,mem_phone_num_count
-//	jam 1,mem_telephone_dialing_timer
 	rtn
 
 
@@ -2386,7 +2393,7 @@
 	copy loopcnt,temp
 	sub temp,7,temp
 	call p_hfp_get_indicator_index
-	arg mem_AG_indicator,temp
+	arg mem_ag_indicator,temp
 	iadd temp,temp
 	copy rega,pdata
 	istore 1,temp
@@ -2398,7 +2405,7 @@
 //output:
 //	pdata -- indicator index
 p_hfp_get_indicator_index:
-	setarg mem_AG_indicator_map
+	setarg mem_ag_indicator_map
 	iadd temp,temp
 	ifetch 1,temp
 	rtn
@@ -2494,7 +2501,7 @@
 p_hfp_indicator_store:
 	copy loopcnt,pdata
 	sub pdata,7,pdata
-	arg mem_AG_indicator_map,temp
+	arg mem_ag_indicator_map,temp
 	iadd temp,temp
 	copy rega,pdata
 	istore 1,temp
@@ -2571,68 +2578,68 @@
 	rtn
 
 
-p_hfp_is_result_vgm_vgs:
-	//disable user
-	fetch 2,mem_at_command_ptr
-	icopy contr
-	ifetch 1,contr
-	rtnne 0x2b
-	ifetch 1,contr
-	rtnne 0x56
-	ifetch 1,contr
-	rtnne 0x47
-	ifetch 1,contr
-	enable user
-	beq 0x4d,p_hfp_vgm_changed
-	beq 0x53,p_hfp_vgs_changed
-	rtn
+//p_hfp_is_result_vgm_vgs:
+//	//disable user
+//	fetch 2,mem_at_command_ptr
+//	icopy contr
+//	ifetch 1,contr
+//	rtnne 0x2b
+//	ifetch 1,contr
+//	rtnne 0x56
+//	ifetch 1,contr
+//	rtnne 0x47
+//	ifetch 1,contr
+//	enable user
+//	beq 0x4d,p_hfp_vgm_changed
+//	beq 0x53,p_hfp_vgs_changed
+//	rtn
 
-p_hfp_vgs_changed:
-	call p_hfp_translate_ascii_to_hex
-	storet 1,mem_hf_vlm_speaker
-	rtn
+//p_hfp_vgs_changed:
+//	call p_hfp_translate_ascii_to_hex
+//	storet 1,mem_hf_vlm_speaker
+//	rtn
 
-p_hfp_vgm_changed:
-	call p_hfp_translate_ascii_to_hex
-	storet 1,mem_hf_vlm_mic
-	rtn
+//p_hfp_vgm_changed:
+//	call p_hfp_translate_ascii_to_hex
+//	storet 1,mem_hf_vlm_mic
+//	rtn
 
 
-p_hfp_is_result_ccwa:
-	fetch 2,mem_at_command_ptr
-	icopy contr
-	ifetch 1,contr
-	rtnne 0x2b
-	ifetch 1,contr
-	rtnne 0x43
-	ifetch 1,contr
-	rtnne 0x43
-	ifetch 1,contr
-	rtnne 0x57
-	ifetch 1,contr
-	rtnne 0x41
-	enable user
-	branch p_hfp_is_result_clip_loop
-
-p_hfp_is_result_clip:
-	//disable user
-	fetch 2,mem_at_command_ptr
-	icopy contr
-	ifetch 1,contr
-	rtnne 0x2b
-	ifetch 1,contr
-	rtnne 0x43
-	ifetch 1,contr
-	rtnne 0x4c
-	ifetch 1,contr
-	rtnne 0x49
-	ifetch 1,contr
-	rtnne 0x50
-	enable user
-	call p_hfp_is_result_clip_loop
-	fetch 1,mem_telephone_dialing_state
-	rtnne HFP_DIALING_STATE_NO
-	branch p_hfp_dialing_start
+//p_hfp_is_result_ccwa:
+//	fetch 2,mem_at_command_ptr
+//	icopy contr
+//	ifetch 1,contr
+//	rtnne 0x2b
+//	ifetch 1,contr
+//	rtnne 0x43
+//	ifetch 1,contr
+//	rtnne 0x43
+//	ifetch 1,contr
+//	rtnne 0x57
+//	ifetch 1,contr
+//	rtnne 0x41
+//	enable user
+//	branch p_hfp_is_result_clip_loop
+
+//p_hfp_is_result_clip:
+//	//disable user
+//	fetch 2,mem_at_command_ptr
+//	icopy contr
+//	ifetch 1,contr
+//	rtnne 0x2b
+//	ifetch 1,contr
+//	rtnne 0x43
+//	ifetch 1,contr
+//	rtnne 0x4c
+//	ifetch 1,contr
+//	rtnne 0x49
+//	ifetch 1,contr
+//	rtnne 0x50
+//	enable user
+//	call p_hfp_is_result_clip_loop
+//	fetch 1,mem_telephone_dialing_state
+//	rtnne HFP_DIALING_STATE_NO
+//	branch p_hfp_dialing_start
 
 	
 p_hfp_is_result_clip_loop:	
@@ -2757,6 +2764,8 @@
 	istore 2,contw//cid
 	rtn
 
+endif
+
 /**********************************hfp patch**********************************************/
 
 
@@ -2779,7 +2788,7 @@
 	ifetch 2,contr
 	ifetch 2,contr
 	byteswap pdata,pdata
-	bne 1,assert
+	bne 1,app_bt_disconnect
 	ifetch 4,contr
 	store 4,mem_sdp_record_handle
 	fetch 1,mem_sdp_state
@@ -2914,17 +2923,69 @@
 
 
 /**********************************page patch**********************************************/
-/*
-	YC 3121 page always
-*/
 
-p_master_page_no_interval:
-	fetcht 2,mem_page_window
-	force 40,queue
-	call sniff_check_window
-	branch page_exit,user
-	branch page_start
+p_idle_start_page:
+	call idle_start_page+1
+	jam 7,mem_nfreq_index_page
+	rtn
+
+p_page_start:
+	setarg 0
+	store 4,mem_page_clk
+	branch page_start+1
+
+p_page_check_train:
+	compare 3,bt_clk,3
+	nrtn true
+	fetch 1,mem_nfreq_index_page
+	increase -1,pdata
+	store 1,mem_nfreq_index_page
+	rtn positive
+	jam 7,mem_nfreq_index_page
+	branch page_check_train+6
 	
 /**********************************page patch**********************************************/
 
+p_process_conn_sm:
+	call lmo_fifo_check
+	nrtn blank
+p_process_conn_sm_continue:
+	fetch 1,mem_conn_sm
+	rtn blank
+	beq CONN_SM_DONE,p_host_create_conn_done
+	branch process_conn_sm_continue+2
+
+p_host_create_conn_done:
+	fetch 1,mem_lmp_conn_state
+	rtnbit0 RECEIVED_SETUP_COMPLETE
+	rtnbit0 SENT_SETUP_COMPLETE
+	jam CONN_SM_STANDBY,mem_conn_sm
+	call host_conn_judge_encrypt
+	fetch 1,mem_sdp_state
+	bbit1 L2CAP_CHANNEL_STATE_CONN_REQ,p_l2cap_receive_signal_conn_req
+	bbit1 L2CAP_CHANNEL_STATE_CONN_RES,p_l2cap_receive_signal_conn_req
+	fetch 1,mem_l2cap_pending_item
+	beq L2CAP_SDP_channel,p_l2cap_receive_signal_conn_req
+	branch scheduler_start_upper_sm
+
+p_l2cap_receive_signal_conn_req:
+	jam 1,mem_l2cap_receive_signal_conn_req_flag
+	rtn
+
+
+p_ml2cap_proc_signal_disconn_req:
+	setarg L2CAP_SDP_channel
+	copy regA,temp
+	isub temp,null
+	branch p_ml2cap_proc_signal_disconn_sdp,zero
+	branch ml2cap_proc_signal_disconn_req+16
+
+p_ml2cap_proc_signal_disconn_sdp:
+	call ml2cap_proc_signal_disconn_sdp
+	fetch 1,mem_l2cap_receive_signal_conn_req_flag
+	rtn blank
+	jam 0,mem_l2cap_receive_signal_conn_req_flag
+	branch scheduler_start_upper_sm
+
+
 
Index: program/scheduler.prog
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/program/scheduler.prog	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/program/scheduler.prog	(working copy)
@@ -345,14 +345,14 @@
 	copy pdata,temp
 	setarg L2CAP_SDP_channel
 	copy pdata,timeup
-	branch ML2CAP_send_signal_connect_req
+	branch ml2cap_send_signal_connect_req
 	
 upper_sm_send_sdp_cfg:
 	bpatchx patch2d_4,mem_patch2d
 	call l2cap_malloc_signal_channel
 	fetch 2,mem_SDP_remote_CID
 	copy pdata,temp
-	branch ML2CAP_send_signal_config_req
+	branch ml2cap_send_signal_config_req
 	
 upper_sm_send_sdp_disconn:
 	bpatchx patch2d_5,mem_patch2d
@@ -379,14 +379,14 @@
 	copy pdata,temp
 	setarg L2CAP_RFCOMM_channel
 	copy pdata,timeup
-	branch ML2CAP_send_signal_connect_req
+	branch ml2cap_send_signal_connect_req
 
 upper_sm_send_rfcomm_cfg:
 	bpatchx patch2e_0,mem_patch2e
 	call l2cap_malloc_signal_channel
 	fetch 2,mem_rfcomm_remote_cid
 	copy pdata,temp
-	branch ML2CAP_send_signal_config_req
+	branch ml2cap_send_signal_config_req
 
 upper_sm_send_hid_ctrl_conn:
 	bpatchx patch2e_1,mem_patch2e
@@ -395,14 +395,14 @@
 	copy pdata,temp
 	setarg L2CAP_HID_Control_channel
 	copy pdata,timeup
-	branch ML2CAP_send_signal_connect_req
+	branch ml2cap_send_signal_connect_req
 
 upper_sm_send_hid_ctrl_cfg:
 	bpatchx patch2e_2,mem_patch2e
 	call l2cap_malloc_signal_channel
 	fetch 2,mem_hid_ctrl_remote_cid
 	copy pdata,temp
-	branch ML2CAP_send_signal_config_req
+	branch ml2cap_send_signal_config_req
 
 upper_sm_send_hid_int_conn:
 	bpatchx patch2e_3,mem_patch2e
@@ -411,14 +411,14 @@
 	copy pdata,temp
 	setarg L2CAP_HID_interrupt_channel
 	copy pdata,timeup
-	branch ML2CAP_send_signal_connect_req
+	branch ml2cap_send_signal_connect_req
 	
 upper_sm_send_hid_int_cfg:
 	bpatchx patch2e_4,mem_patch2e
 	call l2cap_malloc_signal_channel
 	fetch 2,mem_hid_int_remote_cid
 	copy pdata,temp
-	branch ML2CAP_send_signal_config_req
+	branch ml2cap_send_signal_config_req
 
 upper_sm_send_rfcomm_sabm:
 	bpatchx patch2e_5,mem_patch2e
Index: sched/109x.dat
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/109x.dat	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/109x.dat	(working copy)
@@ -26,11 +26,11 @@
 mem_inq_window:20 00
 mem_page_window:20 00
 mem_page_interval:00 00
-mem_page_to:00 20
+mem_page_to:80 0c	#uint 0.625ms
 mem_rx_window_init:80 04
 mem_rx_window_sniff:00 10
 
-
+mem_page_mode:01
 
 mem_lmp_version:08 0e 05 04 00
 
Index: sched/ble_config.dat
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/ble_config.dat	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/ble_config.dat	(working copy)
@@ -3,7 +3,6 @@
 mem_module_data_write_handle:2d 00
 mem_module_data_write_handle2:2f 00
 
-mem_le_pres:02 03 00 05 10 02 03
 
 mem_le_interval_min:
 08 00 #min interval
@@ -11,18 +10,19 @@
 00 00 #latency
 2c 01 #timeout
 
-mem_le_pairing_handle:31 00
-
 
 mem_le_local_mtu:f0
 mem_le_remote_mtu:17
 
-mem_le_secure_connect_enable:00
-mem_le_adv_channel_map:07
 mem_le_pairing_mode:00
+mem_le_pres:02 03 00 05 10 02 03
+mem_le_secure_connect_enable:00
+mem_le_pairing_handle:00 00
+
 
 mem_le_adv_enable:00
 mem_le_adv_interval:40 00
+mem_le_adv_channel_map:07
 
 mem_le_lap:21 22 01 33 02 3a
 mem_le_name_len:
@@ -41,37 +41,40 @@
 
 #attribute list: handle 2bytes, uuid 2bytes, length 1bytes, attribute Nbytes
 mem_module_le_att_list:
+
+00 00
+
 #Primary service: GATT
-01 00 02 00 28 02 01 18
+#01 00 02 00 28 02 01 18
 #Characteristic: Service changed
-02 00 02 03 28 01 20
-03 00 02 05 2a 01 00
+#02 00 02 03 28 01 20
+#03 00 02 05 2a 01 00
 #Client Characteristic Configuration
-04 00 02 02 29 02 01 00
+#04 00 02 02 29 02 01 00
 
 #Primary Service: GAP
-05 00 02 00 28 02 00 18 
+#05 00 02 00 28 02 00 18 
 #Characteristic: Device Name
-06 00 02 03 28 01 02
-07 00 02 00 2a
-1e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
+#06 00 02 03 28 01 02
+#07 00 02 00 2a
+#1e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
 #Characteristic: Appearance
-08 00 02 03 28 01 02 
-09 00 02 01 2a 02 00 00
+#08 00 02 03 28 01 02 
+#09 00 02 01 2a 02 00 00
 #Characteristic: Peripheral Preferred Connection Parameters
-0a 00 02 03 28 01 02
-0b 00 02 04 2a 08 10 00 20 00 05 00 2c 01
+#0a 00 02 03 28 01 02
+#0b 00 02 04 2a 08 10 00 20 00 05 00 2c 01
 
 #Primary service yichip transmit
-0c 00 02 00 28 10 55 e4 05 d2 af 9f a9 8f e5 4a 7d fe 43 53 53 49
+#0c 00 02 00 28 10 55 e4 05 d2 af 9f a9 8f e5 4a 7d fe 43 53 53 49
 #Characteristic tx--notify 
-0d 00 02 03 28 01 10
-0e 00 10 16 96 24 47 C6 23 61 BA D9 4B 4D 1E 43 53 53 49 01 00
+#0d 00 02 03 28 01 10
+#0e 00 10 16 96 24 47 C6 23 61 BA D9 4B 4D 1E 43 53 53 49 01 00
 #Client Characteristic Configuration
-0f 00 02 02 29 02 00 00
+#0f 00 02 02 29 02 00 00
 #Characteristic rx--write
-10 00 02 03 28 01 0c
-11 00 10 b3 9b 72 34 be ec d4 a8 f4 43 41 88 43 53 53 49 01 00
+#10 00 02 03 28 01 0c
+#11 00 10 b3 9b 72 34 be ec d4 a8 f4 43 41 88 43 53 53 49 01 00
 
-00 00
+#00 00
 
Index: sched/bt_config.dat
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/bt_config.dat	(revision 902)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/bt_config.dat	(working copy)
@@ -40,9 +40,9 @@
 mem_ptt:00
 mem_features:
 ff
-fb
+f3	#no sco link
 8f
-f8	#openACL3M fe
+78	#no esco link
 8B	#AFHclose 83
 85
 59
@@ -101,7 +101,7 @@
 
 
 
-mem_UI_HF_brsf_feature:34
+mem_ui_hf_brsf_feature:34
 
 
 
