Index: program/patch.prog
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/program/patch.prog	(revision 950)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/program/patch.prog	(working copy)
@@ -1,4 +1,3 @@
-define HFP
 
 
 /******************************************/
@@ -10,14 +9,16 @@
 	beq patch00_0,p_soft_reset0
 	//page patch
 	beq patch00_7,p_idle_start_page
+	beq patch02_1,p_master_page_no_interval
 	beq patch02_3,p_page_start
 	beq patch02_7,p_page_check_train
 	beq patch1b_1,p_ml2cap_proc_signal_disconn_req
+	
 	//lpm exen patch
 	beq patch00_1,p_soft_reset
 	beq patch10_5,p_shutdown_radio
 	beq patch11_1,p_set_freq_tx
-	//enc patch
+	//
 	beq patch06_4,p_send_eir
 	//lpm patch
 	beq patch12_4,p_ahead_window
@@ -30,16 +31,17 @@
 	beq patch1d_3,p_le_init_conn
 	//context patch
 	beq patch00_5,p_connection_incontext
+	beq patch05_4,p_context_new
 	beq patch05_6,p_context_search
 	beq patch0d_7,p_sniff_check_window
 	beq patch14_6,p_lpm_recover_clk
 	beq patch14_7,p_lpm_dispatch
 	beq patch15_3,p_lpm_dispatch_unconn
-//	beq patch07_3,p_sconn_successful
-ifdef HFP	
+	beq patch16_4,p_app_process_bb_event
+	//
+	beq patch07_3,p_sconn_successful
 	//hfp patch
 	beq patch17_7,p_l2cap_init_wake
-endif	
 	//role switch patch
 	beq patch04_6,p_role_switch_master
 	beq patch05_0,p_roles_replyto_fhs
@@ -58,7 +60,7 @@
 	beq patch23_4,p_le_prepare_tx
 	beq patch23_6,p_le_send_packet
 	beq patch23_7,p_le_parse
-	beq patch24_2,p_le_parse_l2cap
+	beq patch24_1,p_le_parse_l2cap
 	beq patch26_0,p_le_modified_name
 	beq patch26_2,p_le_lpm_set_mult
 	beq patch27_2,p_parse_lmp
@@ -74,14 +76,16 @@
 	//sdp patch
 	beq patch2d_2,p_process_upper_sm_reconn
 	beq patch2f_2,p_sdp_process
-ifdef HFP
 	//hfp patch
 	beq patch2a_1,p_rfcomm_rx_process
 	beq patch2a_4,p_parse_uih_rp_spp
 	beq patch2b_0,p_rfcomm_send_param_neg_cmd
 	beq patch2c_3,p_scheduler_process
-endif	
+
+
+
 	beq patch28_4,p_process_conn_sm
+	
 	branch assert
 	
 
@@ -289,39 +293,29 @@
 	setarg p_module_bt_conn_process
 	store 2,mem_cb_bt_process
 
-ifdef HFP
-	call p_hfp_clear_parms
-endif
-
 	call module_lpm_uart_init
 	call module_gpio_init
 	call check_module_disabled
-	branch module_hci_event_enter_standby_mode
+	call module_hci_event_enter_standby_mode
+
+	branch p_hfp_clear_parms
 
 
 p_module_process_bb_event:
 	copy regc,pdata
-	rtneq BT_EVT_STORE_NVRAM
-	/***************classic event****************/
 	beq BT_EVT_BB_CONNECTED,p_module_process_bb_conn	
 	beq BT_EVT_SPP_DISCONNECTED,p_module_process_spp_disconnected
 	beq BT_EVT_BB_DISCONNECTED,p_module_process_bb_event_disconned
 	beq BT_EVT_SETUP_COMPLETE,p_module_process_setup_complete
 	beq BT_EVT_RECONN_FAILED,p_module_process_reconn_fail
 	beq BT_EVT_RECONN_PAGE_TIMEOUT,p_module_process_page_time_out
-	beq BT_EVT_SWITCH_FAIL_MASTER,app_bt_disconnect
 	beq BT_EVT_LINKKEY_GENERATE,p_module_process_linkkey_generate
-ifdef HFP
 	beq BT_EVT_HFP_CONNECTED,p_module_process_hfp_connected
 	beq BT_EVT_HFP_START_DIALING,p_module_process_hfp_start_dialing
 	beq BT_EVT_HFP_STOP_DIALING,p_module_process_hfp_stop_dialing
-endif
-	/***************ble event****************/
 	beq BT_EVT_LE_CONNECTED,p_module_process_le_conn
 	beq BT_EVT_LE_DISCONNECTED,p_module_process_bb_even_le_disconn
-	beq BT_EVT_LE_IDENTITY_ADDR_INFO,p_module_process_le_enc_info
-	beq BT_EVT_LE_START_ENC,p_module_process_le_start_enc
-	beq BT_EVT_LE_RCV_ENC_REQ,p_module_process_le_rcv_enc_req
+	rtneq BT_EVT_STORE_NVRAM
 	branch module_process_bb_event+1
 
 p_module_process_bb_conn:
@@ -332,11 +326,9 @@
 
 
 p_module_process_bb_event_disconned:
-ifdef HFP
-	call p_hfp_clear_parms
-endif
 	jam 0,mem_au_fail_timer
 	jam 0,mem_rx_iocap_req
+	call p_hfp_clear_parms
 	call module_spp_clear_last_transmite_clock
 	fetch 1,mem_flag_pairing_state
 	ncall module_hci_event_bt_pairing_fail,blank
@@ -357,14 +349,13 @@
 p_module_process_page_time_out:
 p_module_process_reconn_fail:
 	jam 10,mem_bt_reconnect_timer
-	rtn
-//	branch p_module_hci_event_bt_reconn_fail
+	branch p_module_hci_event_bt_reconn_fail
 
 
 //event opcode 0xb1
-//p_module_hci_event_bt_reconn_fail:
-//	jam HCI_EVENT_BT_RECONNECT_FAIL,mem_module_uart_opcode
-//	branch module_hci_event_enter_standby_mode_len0
+p_module_hci_event_bt_reconn_fail:
+	jam HCI_EVENT_BT_RECONNECT_FAIL,mem_module_uart_opcode
+	branch module_hci_event_enter_standby_mode_len0
 
 
 //event opcode 0xb1
@@ -373,7 +364,7 @@
 	branch module_hci_event_enter_standby_mode_len0
 
 
-ifdef HFP
+
 p_module_process_hfp_connected:
 	jam HCI_EVENT_HFP_CONNECTED,mem_module_uart_opcode
 	branch module_hci_event_enter_standby_mode_len0
@@ -390,9 +381,8 @@
 p_module_process_hfp_stop_dialing:
 	jam HCI_EVENT_HFP_STOP_DIALING,mem_module_uart_opcode
 	branch module_hci_event_enter_standby_mode_len0
-endif
-
 
+	
 p_module_process_le_conn:
 	call module_clear_recv_confirm_flag
 	call app_ble_stop_adv
@@ -407,33 +397,6 @@
 	branch module_hci_event_le_disconnect
 
 
-p_module_process_le_start_enc:
-	jam HCI_EVENT_LE_START_ENC,mem_module_uart_opcode
-	branch module_hci_event_enter_standby_mode_len0
-
-p_module_process_le_rcv_enc_req:
-	jam HCI_EVENT_LE_RCV_ENC_REQ,mem_module_uart_opcode
-	branch module_hci_event_enter_standby_mode_len0
-
-p_module_process_le_enc_info:
-	jam HCI_EVENT_LE_ENC_INFO,mem_module_uart_opcode
-	setarg 46
-	call module_hci_prepare_tx
-	fetch 6,mem_le_lap
-	istore 6,contwu	
-	fetch 6,mem_le_peer_addr
-	istore 6,contwu
-	fetch 2,mem_le_ediv
-	istore 2,contwu
-	arg mem_le_irk,contr
-	arg 16,loopcnt
-	call uart_copy_tx_bytes	
-	arg mem_le_ltk,contr
-	arg 16,loopcnt
-	call uart_copy_tx_bytes
-	branch uartd_send
-
-
 p_module_process_linkkey_generate:
 p_module_hci_event_linkkey_generate:
 	jam HCI_EVENT_BT_ENC_INFO,mem_module_uart_opcode
@@ -551,15 +514,14 @@
 	beq HCI_CMD_SLEEP,p_module_hci_cmd_enter_sleep
 	beq HCI_CMD_SET_PAIRING_REQ,p_module_hci_cmd_set_pairing_mode
 	beq HCI_CMD_ADD_SERVICE_CHARAC_UUID,p_module_hci_cmd_add_service_charac_uuid
-	beq HCI_CMD_SET_COD,p_module_hci_cmd_le_set_adv_data_set_cod
-	beq HCI_CMD_SET_WAKE_GPIO,p_module_hci_cmd_set_wake_gpio
+	beq HCI_CMD_SET_COD,module_hci_cmd_le_set_adv_data_set_cod
+	beq HCI_CMD_SET_WAKE_GPIO,module_hci_cmd_set_wake_gpio
 	beq HCI_TEST_CMD_CLOSE_LPM,p_module_hci_test_cmde_close_lpm
 	beq HCI_CMD_MCU_SET_BT_WAKE_TIMER,p_module_hci_mcu_set_bt_wake_timer
 	beq HCI_CMD_CREATE_BT_RECONNECT,p_moudle_hci_cmd_create_bt_reconnect
 	beq HCI_CMD_CANCEL_BT_RECONNECT,p_moudle_hci_cmd_cancel_bt_reconnect
 	beq HCI_CMD_LE_SET_VISIBILITY_REQ,p_module_hci_cmd_le_set_visibility
 	beq HCI_CMD_BT_SET_VISIBILITY_REQ,p_module_hci_cmd_bt_set_visibility
-	beq HCI_CMD_LE_SEND_ENC_RSP,p_module_hci_cmd_le_send_enc_rsp
 	branch module_hci_cmd_control + 2
 
 
@@ -628,28 +590,6 @@
 	branch app_ble_start_adv,true
 	branch app_ble_stop_adv
 
-p_module_hci_cmd_le_send_enc_rsp:
-	call module_hci_event_receive_valid_cmd
-	fetch 1,mem_le_pairing_state
-	beq FLAG_LE_PAIRING_AFTER_AUTH,p_le_parse_enc_req_after_auth
-	fetch 1,mem_le_configuration
-	bbit1 BIT_BLE_PAIRING_FIXED_LTK,le_parse_enc_req_fixed_ltk
-	fetch 1,mem_nv_data_number
-	ncall load_device_list_mode_4,blank
-	fetch 1,mem_ltk_exists
-	beq 0,le_ltk_lost
-p_le_parse_enc_req_after_auth:
-	jam FLAG_LE_RCV_ENC_START,mem_le_enc_state
-	call le_send_enc_rsp
-	call le_send_start_enc_req
-	call generate_sk
-
-	fetch 2,mem_context_ptr	//save mem_le_sk
-	iforce contw
-	force context_size,loopcnt
-	arg mem_le_state,contr
-	branch memcpy_fast
-
 
 p_module_hci_test_cmde_close_lpm:
 	ifetch 1,contru
@@ -668,7 +608,7 @@
 	branch module_hci_sspairing_mode
 
 
-p_module_hci_cmd_le_set_adv_data_set_cod:
+module_hci_cmd_le_set_adv_data_set_cod:
 	ifetch 3,contru
 	store 3,mem_class
 	branch module_hci_event_receive_valid_cmd
@@ -677,7 +617,7 @@
 p_module_hci_cmd_enter_sleep:
 	branch app_enter_hibernate
 
-p_module_hci_cmd_set_wake_gpio:
+module_hci_cmd_set_wake_gpio:
 	ifetch 1,contru
 
 	//lpm
@@ -1145,25 +1085,23 @@
 	arg mem_le_txheader_temp,regc
 	fetcht 5,mem_le_pcnt_tx
 	call generate_mic
+	force regidx_xor,regext_index
+	iforce regext
 	force 0,rega					/* rega is block counter */
 	call first_block_data
 	call aes_init				// 1021s ->  do_aes_ctr
-	force regidx_data,regext_index
-	copy regb,regext
-	call do_aes_cfb
 	arg mem_le_txpayload_temp,regc
 	fetch 1,mem_le_txlen_temp
 	add pdata,-1,regb
 	iadd regc,contw
 	force regidx_result,regext_index
 	deposit regext
-	istore 4,contw
-	force 0,rega
+	istore 4,contw	
 	call aes_crypt_data
 	fetch 1,mem_le_txlen_temp
 	increase 4,pdata
 	store 1,mem_le_txlen_temp
-	branch le_encrypt+21
+	branch le_encrypt+33
 
 /*
 	l2cap 组包的问题
@@ -1194,7 +1132,6 @@
 	fetch 1,mem_le_rxbuf+2
 	beq LL_FEATURE_REQ,p_le_parse_feature_req
 	beq LL_LENGTH_REQ,p_le_parse_length_request
-	beq LL_ENC_REQ,p_le_parse_enc_req
 	branch le_parse_ll+1
 	
 p_le_parse_feature_req:
@@ -1241,23 +1178,9 @@
 	rtn
 
 
-p_le_parse_enc_req:
-	ifetch 8,contr
-	store 8,mem_le_rand
-	ifetch 2,contr
-	store 2,mem_le_ediv
-	ifetch 8,contr
-	store 8,mem_le_skdm
-	ifetch 4,contr
-	store 4,mem_le_ivm
-	jam BT_EVT_LE_RCV_ENC_REQ,mem_fifo_temp
-	branch ui_ipc_send_event
-
-
 p_le_parse_l2cap:
 	ifetch 2,contr
 	beq LE_L2CAP_CID_ATT,p_le_parse_att
-	beq LE_L2CAP_CID_SMP,p_le_parse_smp
 	branch le_parse_l2cap+10
 
 p_le_parse_att:
@@ -1282,26 +1205,6 @@
 	store 2,mem_le_local_mtu
 	branch le_send_att_exchange_mtu_response
 
-	
-p_le_parse_smp:
-	ifetch 1,contr
-	beq SMP_IDENTITY_ADDRESS_INFORMATION,p_le_parse_smp_identity_address_information
-	branch le_parse_smp+1
-
-p_le_parse_smp_identity_address_information:
-	call store_contr
-	call le_check_init_key_distribution
-	isolate0 LE_INITATOR_IRK_BIT,pdata
-	branch le_send_pairing_fail_unspecified_reason,true
-	call get_contr
-	ifetch 1,contr	//address type
-	ifetch 6,contr	//bd_addr
-	store 6,mem_le_peer_addr
-	call le_check_master_addr_type
-	nrtn user
-	jam BT_EVT_LE_IDENTITY_ADDR_INFO,mem_fifo_temp
-	branch ui_ipc_send_event
-
 
 p_le_modified_name:
 	call le_modified_name_att_list
@@ -1444,11 +1347,8 @@
 	jam BT_EVT_SPP_CONNECTED,mem_fifo_temp
 	call ui_ipc_send_event
 	call get_rfcomm_param_modem_status
-	fetch 1,mem_ms_channel
-	sub pdata,1,null
-	branch parse_DLCI0_rp_uih_MS_RES_spp,zero
-	branch app_bt_disconnect
-	branch assert
+	branch parse_DLCI0_rp_uih_ms_res_spp
+
 
 p_parse_DLCI0_reconn:
 	fetch 1,mem_current_frame_type
@@ -1471,9 +1371,9 @@
 	fetcht 1,mem_remote_spp_channel
 	isub temp,null
 	branch parse_DLCI0_reconn_uih_pn_cmd_spp,zero
-	branch app_bt_disconnect
-	branch assert
+	branch rfcomm_rx_process_end
 
+	
 p_parse_DLCI0_reconn_uih_ms_res:
 	jam BT_EVT_SPP_CONNECTED,mem_fifo_temp
 	call ui_ipc_send_event
@@ -1482,8 +1382,7 @@
 	fetcht 1,mem_remote_spp_channel
 	isub temp,null
 	branch parse_DLCI0_reconn_uih_ms_res_spp,zero
-	branch app_bt_disconnect
-	branch assert
+	branch rfcomm_rx_process_end
 
 
 p_sp_initialize_256:	
@@ -1532,21 +1431,31 @@
 	rtn
 
 
+p_context_new:
+	arg p_context_search_empty,regc
+	branch context_new+2
+p_context_search_empty:
+	bbit1 state_inconn,context_search_next
+	bbit1 state_inpage,context_search_next
+	force 0,null
+	rtn
+
+
 p_context_search:
 	arg mem_context_new,rega
 	arg context_num_new,loopcnt
 	branch context_search_loop
 
 
-//p_sconn_successful:
-//	fetch 1,mem_state
-//	set0 state_inpage,pdata
-//	store 1,mem_state
-//	call init_lmp_work
-//	jam 0,memui_reconnect_mode
-//	jam CONN_SM_STANDBY,mem_conn_sm
-//	call page_exit
-//	branch sconn_successful+1
+p_sconn_successful:
+	fetch 1,mem_state
+	set0 state_inpage,pdata
+	store 1,mem_state
+	call init_lmp_work
+	jam 0,memui_reconnect_mode
+	jam CONN_SM_STANDBY,mem_conn_sm
+	call page_exit
+	branch sconn_successful+1
 
 
 p_sniff_check_window:
@@ -1663,19 +1572,19 @@
 	branch lpm_dispatch_unconn+2
 
 
-//p_app_process_bb_event:
-//	//return if c51 need to process bb event
-//	arg mem_ipc_fifo_bt2c51,rega
-//	call fifo_out
-//	rtn blank
-//	//reaching here mains c51 cannot get bb event.
-//	copy pdata,regc
-//	call p_app_event_normal_process
-//	branch app_process_bb_event_priority
-
-//p_app_event_normal_process:
-//	beq BT_EVT_SWITCH_FAIL_MASTER,app_bt_disconnect
-//	branch app_event_normal_process
+p_app_process_bb_event:
+	//return if c51 need to process bb event
+	arg mem_ipc_fifo_bt2c51,rega
+	call fifo_out
+	rtn blank
+	//reaching here mains c51 cannot get bb event.
+	copy pdata,regc
+	call p_app_event_normal_process
+	branch app_process_bb_event_priority
+
+p_app_event_normal_process:
+	beq BT_EVT_SWITCH_FAIL_MASTER,app_bt_disconnect
+	branch app_event_normal_process
 
 
 
@@ -1790,7 +1699,6 @@
 
 
 /**********************************hfp patch**********************************************/
-ifdef HFP
 
 p_l2cap_init_wake:
 	call l2cap_init_wake+1
@@ -2764,8 +2672,6 @@
 	istore 2,contw//cid
 	rtn
 
-endif
-
 /**********************************hfp patch**********************************************/
 
 
@@ -2788,7 +2694,7 @@
 	ifetch 2,contr
 	ifetch 2,contr
 	byteswap pdata,pdata
-	bne 1,app_bt_disconnect
+	bne 1,assert
 	ifetch 4,contr
 	store 4,mem_sdp_record_handle
 	fetch 1,mem_sdp_state
@@ -2943,6 +2849,21 @@
 	rtn positive
 	jam 7,mem_nfreq_index_page
 	branch page_check_train+6
+
+/*
+	YC 3121 page always
+*/
+
+p_master_page_no_interval:
+	branch master_page_no_interval+1
+
+
+	fetcht 2,mem_page_window
+	force 40,queue
+	call sniff_check_window
+	branch page_exit,user
+	branch page_start
+	
 	
 /**********************************page patch**********************************************/
 
Index: sched/109x.dat
===================================================================
--- /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/109x.dat	(revision 950)
+++ /YC3121_demo/ModuleDemo/BlueTooth/BT_code_patch/bt_hfp_ble/sched/109x.dat	(working copy)
@@ -26,7 +26,7 @@
 mem_inq_window:20 00
 mem_page_window:20 00
 mem_page_interval:00 00
-mem_page_to:80 0c	#uint 0.625ms
+mem_page_to:80 0c
 mem_rx_window_init:80 04
 mem_rx_window_sniff:00 10
 
