diff --git a/components/bt/bluedroid/api/esp_blufi_api.c b/components/bt/bluedroid/api/esp_blufi_api.c
index b735ad549..f304b68dd 100644
--- a/components/bt/bluedroid/api/esp_blufi_api.c
+++ b/components/bt/bluedroid/api/esp_blufi_api.c
@@ -22,6 +22,7 @@
 #include "btc_main.h"
 #include "future.h"
 #include "btc_gatts.h"
+#include "btc_gatt_util.h"
 
 esp_err_t esp_blufi_register_callbacks(esp_blufi_callbacks_t *callbacks)
 {
@@ -57,6 +58,23 @@ esp_err_t esp_blufi_send_wifi_conn_report(wifi_mode_t opmode, esp_blufi_sta_conn
     return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list)
+{
+    btc_msg_t msg;
+    btc_blufi_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_BLUFI;
+    msg.act = BTC_BLUFI_ACT_SEND_WIFI_LIST;
+    arg.wifi_list.apCount = apCount;
+    arg.wifi_list.list = list;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
 
 esp_err_t esp_blufi_profile_init(void)
 {
@@ -103,7 +121,7 @@ esp_err_t esp_blufi_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTS;
     msg.act = BTC_GATTS_ACT_CLOSE;
-    arg.close.conn_id = conn_id;
+    arg.close.conn_id = BTC_GATT_CREATE_CONN_ID(gatts_if, conn_id);
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t), NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
diff --git a/components/bt/bluedroid/api/include/esp_blufi_api.h b/components/bt/bluedroid/api/include/esp_blufi_api.h
index 8ab9ba350..575ae22c2 100644
--- a/components/bt/bluedroid/api/include/esp_blufi_api.h
+++ b/components/bt/bluedroid/api/include/esp_blufi_api.h
@@ -50,6 +50,7 @@ typedef enum {
     ESP_BLUFI_EVENT_RECV_CLIENT_PRIV_KEY,                /*<! When Phone send Client Private key to ESP32, this event happen */
     ESP_BLUFI_EVENT_RECV_SERVER_PRIV_KEY,                /*<! When Phone send Server Private key to ESP32, this event happen */
     ESP_BLUFI_EVENT_RECV_SLAVE_DISCONNECT_BLE,           /*<! When Phone send Disconnect key to ESP32, this event happen */
+    ESP_BLUFI_EVENT_GET_WIFI_LIST,                       /*<! When Phone send get wifi list command to ESP32, this event happen */
 } esp_blufi_cb_event_t;
 
 /// BLUFI config status
@@ -61,13 +62,13 @@ typedef enum {
 /// BLUFI init status
 typedef enum {
     ESP_BLUFI_INIT_OK = 0,
-    ESP_BLUFI_INIT_FAILED = 0,
+    ESP_BLUFI_INIT_FAILED,
 } esp_blufi_init_state_t;
 
 /// BLUFI deinit status
 typedef enum {
     ESP_BLUFI_DEINIT_OK = 0,
-    ESP_BLUFI_DEINIT_FAILED = 0,
+    ESP_BLUFI_DEINIT_FAILED,
 } esp_blufi_deinit_state_t;
 
 /**
@@ -93,6 +94,12 @@ typedef struct {
     bool softap_channel_set;        /*!< is channel of softap interface set */
 } esp_blufi_extra_info_t;
 
+/** @brief Description of an WiFi AP */
+typedef struct {
+    uint8_t ssid[33];                     /**< SSID of AP */
+    int8_t  rssi;                         /**< signal strength of AP */
+} esp_blufi_ap_record_t;
+
 /**
  * @brief BLUFI callback parameters union 
  */
@@ -347,6 +354,17 @@ esp_err_t esp_blufi_profile_deinit(void);
  */
 esp_err_t esp_blufi_send_wifi_conn_report(wifi_mode_t opmode, esp_blufi_sta_conn_state_t sta_conn_state, uint8_t softap_conn_num, esp_blufi_extra_info_t *extra_info);
 
+/**
+ *
+ * @brief           This function is called to send wifi list
+ * @param apCount :  wifi list count
+ * @param list   : wifi list
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t esp_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list);
+
 /**
  *
  * @brief           Get BLUFI profile version
diff --git a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
index 8ffafd7e8..fa5d1400e 100644
--- a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_prf.c
@@ -31,6 +31,7 @@
 #include "btc_blufi_prf.h"
 #include "btc_task.h"
 #include "btc_manage.h"
+#include "btc_gatt_util.h"
 
 #include "blufi_int.h"
 
@@ -209,6 +210,9 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         break;
     case BTA_GATTS_CONF_EVT:
         LOG_DEBUG("CONIRM EVT\n");
+        if (p_data && p_data->req_data.value){
+            osi_free(p_data->req_data.value);
+        }
         /* Nothing */
         break;
     case BTA_GATTS_CREATE_EVT:
@@ -276,7 +280,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         msg.pid = BTC_PID_BLUFI;
         msg.act = ESP_BLUFI_EVENT_BLE_CONNECT;
         memcpy(param.connect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
-        param.connect.conn_id=p_data->conn.conn_id;
+        param.connect.conn_id=BTC_GATT_GET_CONN_ID(p_data->conn.conn_id);
         param.connect.server_if=p_data->conn.server_if;
         btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
         break;
@@ -574,6 +578,40 @@ static void btc_blufi_wifi_conn_report(uint8_t opmode, uint8_t sta_conn_state, u
     osi_free(data);
 }
 
+void btc_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list)
+{
+    uint8_t type;
+    uint8_t *data;
+    int data_len;
+    uint8_t *p;
+    // malloc size: (len + RSSI + ssid buffer) * apCount;
+    uint malloc_size = (1 + 1 + sizeof(list->ssid)) * apCount;
+    p = data = osi_malloc(malloc_size);
+    if (data == NULL) {
+        LOG_ERROR("malloc error\n");
+        return;
+    }
+    type = BLUFI_BUILD_TYPE(BLUFI_TYPE_DATA, BLUFI_TYPE_DATA_SUBTYPE_WIFI_LIST);
+    for (int i = 0; i < apCount; ++i)
+    {
+        uint len = strlen((const char *)list[i].ssid);
+        data_len = (p - data);
+        //current_len + ssid + rssi + total_len_value
+        if((data_len + len + 1 + 1) >  malloc_size) {
+            LOG_ERROR("%s len error", __func__);
+            osi_free(data);
+            return;
+        }
+        *p++ = len + 1; // length of ssid + rssi
+        *p++ = list[i].rssi;
+        memcpy(p, list[i].ssid, len);
+        p = p + len;
+    }
+    data_len = (p - data);
+    btc_blufi_send_encap(type, data, data_len);
+    osi_free(data);
+}
+
 static void btc_blufi_send_ack(uint8_t seq)
 {
     uint8_t type;
@@ -737,6 +775,9 @@ void btc_blufi_cb_handler(btc_msg_t *msg)
     case ESP_BLUFI_EVENT_GET_WIFI_STATUS:
         btc_blufi_cb_to_app(ESP_BLUFI_EVENT_GET_WIFI_STATUS, NULL);
         break;
+    case ESP_BLUFI_EVENT_GET_WIFI_LIST:
+        btc_blufi_cb_to_app(ESP_BLUFI_EVENT_GET_WIFI_LIST, NULL);
+        break;
     case ESP_BLUFI_EVENT_DEAUTHENTICATE_STA:
         btc_blufi_cb_to_app(ESP_BLUFI_EVENT_DEAUTHENTICATE_STA, NULL);
         break;
@@ -867,6 +908,19 @@ void btc_blufi_call_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         }
         break;
     }
+    case BTC_BLUFI_ACT_SEND_WIFI_LIST:{
+        esp_blufi_ap_record_t *list = src->wifi_list.list;
+        src->wifi_list.list = NULL;
+        if (list == NULL || src->wifi_list.apCount <= 0) {
+            break;
+        }
+        dst->wifi_list.list = (esp_blufi_ap_record_t *)osi_malloc(sizeof(esp_blufi_ap_record_t) * src->wifi_list.apCount);
+        if (dst->wifi_list.list == NULL) {
+            break;
+        }
+        memcpy(dst->wifi_list.list, list, sizeof(esp_blufi_ap_record_t) * src->wifi_list.apCount);
+        break;
+    }
     default:
         break;
     }
@@ -898,6 +952,13 @@ void btc_blufi_call_deep_free(btc_msg_t *msg)
         osi_free(info);
         break;
     }
+    case BTC_BLUFI_ACT_SEND_WIFI_LIST:{
+        esp_blufi_ap_record_t *list = (esp_blufi_ap_record_t *)arg->wifi_list.list;
+        if (list){
+            osi_free(list);
+        }
+        break;
+    }
     default:
         break;
     }
@@ -921,6 +982,10 @@ void btc_blufi_call_handler(btc_msg_t *msg)
                                    arg->wifi_conn_report.extra_info,
                                    arg->wifi_conn_report.extra_info_len);
         break;
+    case BTC_BLUFI_ACT_SEND_WIFI_LIST:{
+        btc_blufi_send_wifi_list(arg->wifi_list.apCount, arg->wifi_list.list);
+        break;
+    }
     default:
         LOG_ERROR("%s UNKNOWN %d\n", __func__, msg->act);
         break;
diff --git a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c
index 14cdb5721..23dcdfc01 100644
--- a/components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/blufi_protocol.c
@@ -106,6 +106,12 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_RECV_SLAVE_DISCONNECT_BLE;
             btc_transfer_context(&msg, NULL, 0, NULL);
             break;
+        case BLUFI_TYPE_CTRL_SUBTYPE_GET_WIFI_LIST:
+            msg.sig = BTC_SIG_API_CB;
+            msg.pid = BTC_PID_BLUFI;
+            msg.act = ESP_BLUFI_EVENT_GET_WIFI_LIST;
+            btc_transfer_context(&msg, NULL, 0, NULL);
+            break;
         default:
             LOG_ERROR("%s Unkown Ctrl pkt %02x\n", __func__, type);
             break;
diff --git a/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h b/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
index bfac52942..024e1de79 100644
--- a/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
+++ b/components/bt/bluedroid/btc/profile/esp/blufi/include/blufi_int.h
@@ -16,7 +16,7 @@
 #define __BLUFI_INT_H__
 
 #define BTC_BLUFI_GREAT_VER   0x01  //Version + Subversion
-#define BTC_BLUFI_SUB_VER     0x00  //Version + Subversion
+#define BTC_BLUFI_SUB_VER     0x01  //Version + Subversion
 #define BTC_BLUFI_VERSION     ((BTC_BLUFI_GREAT_VER<<8)|BTC_BLUFI_SUB_VER)  //Version + Subversion
 
 /* service engine control block */
@@ -93,6 +93,7 @@ typedef struct blufi_frag_hdr blufi_frag_hdr_t;
 #define BLUFI_TYPE_CTRL_SUBTYPE_DEAUTHENTICATE_STA      0x06
 #define BLUFI_TYPE_CTRL_SUBTYPE_GET_VERSION             0x07
 #define BLUFI_TYPE_CTRL_SUBTYPE_DISCONNECT_BLE          0x08
+#define BLUFI_TYPE_CTRL_SUBTYPE_GET_WIFI_LIST           0x09
 
 #define BLUFI_TYPE_DATA                                 0x1
 #define BLUFI_TYPE_DATA_SUBTYPE_NEG                     0x00
@@ -111,7 +112,8 @@ typedef struct blufi_frag_hdr blufi_frag_hdr_t;
 #define BLUFI_TYPE_DATA_SUBTYPE_CLIENT_PRIV_KEY         0x0d
 #define BLUFI_TYPE_DATA_SUBTYPE_SERVER_PRIV_KEY         0x0e
 #define BLUFI_TYPE_DATA_SUBTYPE_WIFI_REP                0x0f
-#define BLUFI_TYPE_DATA_SUBTYPE_REPLY_VERSION           0x10 
+#define BLUFI_TYPE_DATA_SUBTYPE_REPLY_VERSION           0x10
+#define BLUFI_TYPE_DATA_SUBTYPE_WIFI_LIST               0x11
 #define BLUFI_TYPE_IS_CTRL(type)        (BLUFI_GET_TYPE((type)) == BLUFI_TYPE_CTRL)
 #define BLUFI_TYPE_IS_DATA(type)        (BLUFI_GET_TYPE((type)) == BLUFI_TYPE_DATA)
 
diff --git a/components/bt/bluedroid/btc/profile/esp/include/btc_blufi_prf.h b/components/bt/bluedroid/btc/profile/esp/include/btc_blufi_prf.h
index 1d82d0c9a..93fe6bf2e 100644
--- a/components/bt/bluedroid/btc/profile/esp/include/btc_blufi_prf.h
+++ b/components/bt/bluedroid/btc/profile/esp/include/btc_blufi_prf.h
@@ -23,6 +23,7 @@ typedef enum {
     BTC_BLUFI_ACT_INIT = 0,
     BTC_BLUFI_ACT_DEINIT,
     BTC_BLUFI_ACT_SEND_CFG_REPORT,
+    BTC_BLUFI_ACT_SEND_WIFI_LIST,
 } btc_blufi_act_t;
 
 typedef union {
@@ -33,6 +34,13 @@ typedef union {
         esp_blufi_extra_info_t *extra_info;
         int extra_info_len;
     } wifi_conn_report;
+    /*
+        BTC_BLUFI_ACT_SEND_WIFI_LIST
+    */
+    struct blufi_wifi_list {
+        uint16_t apCount;
+        esp_blufi_ap_record_t *list;
+    } wifi_list;
 } btc_blufi_args_t;
 
 void btc_blufi_cb_handler(btc_msg_t *msg);
diff --git a/examples/bluetooth/blufi/main/blufi_example_main.c b/examples/bluetooth/blufi/main/blufi_example_main.c
index a780d606c..b2233f22e 100644
--- a/examples/bluetooth/blufi/main/blufi_example_main.c
+++ b/examples/bluetooth/blufi/main/blufi_example_main.c
@@ -139,6 +139,38 @@ static esp_err_t example_net_event_handler(void *ctx, system_event_t *event)
             esp_blufi_send_wifi_conn_report(mode, ESP_BLUFI_STA_CONN_FAIL, 0, NULL);
         }
         break;
+    case SYSTEM_EVENT_SCAN_DONE: {
+        uint16_t apCount = 0;
+        esp_wifi_scan_get_ap_num(&apCount);
+        if (apCount == 0) {
+            BLUFI_INFO("Nothing AP found");
+            break;
+        }
+        wifi_ap_record_t *ap_list = (wifi_ap_record_t *)malloc(sizeof(wifi_ap_record_t) * apCount);
+        if (!ap_list) {
+            BLUFI_ERROR("malloc error, ap_list is NULL");
+            break;
+        }
+        ESP_ERROR_CHECK(esp_wifi_scan_get_ap_records(&apCount, ap_list));
+        esp_blufi_ap_record_t * blufi_ap_list = (esp_blufi_ap_record_t *)malloc(apCount * sizeof(esp_blufi_ap_record_t));
+        if (!blufi_ap_list) {
+            if (ap_list) {
+                free(ap_list);
+            }
+            BLUFI_ERROR("malloc error, blufi_ap_list is NULL");
+            break;
+        }
+        for (int i = 0; i < apCount; ++i)
+        {
+            blufi_ap_list[i].rssi = ap_list[i].rssi;
+            memcpy(blufi_ap_list[i].ssid, ap_list[i].ssid, sizeof(ap_list[i].ssid));
+        }
+        esp_blufi_send_wifi_list(apCount, blufi_ap_list);
+        esp_wifi_scan_stop();
+        free(ap_list);
+        free(blufi_ap_list);
+        break;
+    }
     default:
         break;
     }
@@ -181,8 +213,8 @@ static void example_event_callback(esp_blufi_cb_event_t event, esp_blufi_cb_para
         break;
     case ESP_BLUFI_EVENT_BLE_CONNECT:
         BLUFI_INFO("BLUFI ble connect\n");
-        server_if=param->connect.server_if;
-        conn_id=param->connect.conn_id;
+        server_if = param->connect.server_if;
+        conn_id = param->connect.conn_id;
         esp_ble_gap_stop_advertising();
         blufi_security_init();
         break;
@@ -225,7 +257,7 @@ static void example_event_callback(esp_blufi_cb_event_t event, esp_blufi_cb_para
     }
     case ESP_BLUFI_EVENT_RECV_SLAVE_DISCONNECT_BLE:
         BLUFI_INFO("blufi close a gatt connection");
-        esp_blufi_close(server_if,conn_id);
+        esp_blufi_close(server_if, conn_id);
         break;
     case ESP_BLUFI_EVENT_DEAUTHENTICATE_STA:
         /* TODO */
@@ -283,6 +315,16 @@ static void example_event_callback(esp_blufi_cb_event_t event, esp_blufi_cb_para
         esp_wifi_set_config(WIFI_IF_AP, &ap_config);
         BLUFI_INFO("Recv SOFTAP CHANNEL %d\n", ap_config.ap.channel);
         break;
+    case ESP_BLUFI_EVENT_GET_WIFI_LIST:{
+        wifi_scan_config_t scanConf = {
+            .ssid = NULL,
+            .bssid = NULL,
+            .channel = 0,
+            .show_hidden = false
+        };
+        ESP_ERROR_CHECK(esp_wifi_scan_start(&scanConf, true));
+        break;
+    }
 	case ESP_BLUFI_EVENT_RECV_USERNAME:
         /* Not handle currently */
         break;