diff --git a/components/bt/Kconfig b/components/bt/Kconfig
index 0c9430e93..b178eb3c7 100644
--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@@ -289,6 +289,13 @@ config BTC_TASK_STACK_SIZE
     help
         This select btc task stack size
 
+config BTU_TASK_STACK_SIZE
+    int "Bluetooth Bluedroid Host Stack task stack size"
+    depends on BLUEDROID_ENABLED
+    default 4096
+    help
+        This select btu task stack size
+
 config BLUEDROID_MEM_DEBUG
     bool "Bluedroid memory debug"
     depends on BLUEDROID_ENABLED
diff --git a/components/bt/bluedroid/bta/dm/bta_dm_api.c b/components/bt/bluedroid/bta/dm/bta_dm_api.c
index f4b1ac3f5..c5d5440fc 100644
--- a/components/bt/bluedroid/bta/dm/bta_dm_api.c
+++ b/components/bt/bluedroid/bta/dm/bta_dm_api.c
@@ -1222,10 +1222,11 @@ void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len,
     tBTA_DM_API_SET_ADV_CONFIG_RAW  *p_msg;
 
     if ((p_msg = (tBTA_DM_API_SET_ADV_CONFIG_RAW *)
-                 osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG_RAW))) != NULL) {
+                 osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG_RAW) + raw_adv_len)) != NULL) {
         p_msg->hdr.event = BTA_DM_API_BLE_SET_ADV_CONFIG_RAW_EVT;
         p_msg->p_adv_data_cback = p_adv_data_cback;
-        p_msg->p_raw_adv = p_raw_adv;
+        p_msg->p_raw_adv = (UINT8 *)(p_msg + 1);
+        memcpy(p_msg->p_raw_adv, p_raw_adv, raw_adv_len);
         p_msg->raw_adv_len = raw_adv_len;
 
         bta_sys_sendmsg(p_msg);
@@ -1307,10 +1308,11 @@ void BTA_DmBleSetScanRspRaw (UINT8 *p_raw_scan_rsp, UINT32 raw_scan_rsp_len,
     tBTA_DM_API_SET_ADV_CONFIG_RAW  *p_msg;
 
     if ((p_msg = (tBTA_DM_API_SET_ADV_CONFIG_RAW *)
-                 osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG_RAW))) != NULL) {
+                 osi_malloc(sizeof(tBTA_DM_API_SET_ADV_CONFIG_RAW) + raw_scan_rsp_len)) != NULL) {
         p_msg->hdr.event = BTA_DM_API_BLE_SET_SCAN_RSP_RAW_EVT;
         p_msg->p_adv_data_cback = p_scan_rsp_data_cback;
-        p_msg->p_raw_adv = p_raw_scan_rsp;
+        p_msg->p_raw_adv = (UINT8 *)(p_msg + 1);
+        memcpy(p_msg->p_raw_adv, p_raw_scan_rsp, raw_scan_rsp_len);
         p_msg->raw_adv_len = raw_scan_rsp_len;
 
         bta_sys_sendmsg(p_msg);
diff --git a/components/bt/bluedroid/bta/gatt/bta_gatt_common.c b/components/bt/bluedroid/bta/gatt/bta_gatt_common.c
index cd36966a5..10a58f582 100644
--- a/components/bt/bluedroid/bta/gatt/bta_gatt_common.c
+++ b/components/bt/bluedroid/bta/gatt/bta_gatt_common.c
@@ -27,4 +27,10 @@
 void BTA_GATT_SetLocalMTU(uint16_t mtu)
 {
     gatt_set_local_mtu(mtu);
-}
\ No newline at end of file
+}
+
+uint16_t BTA_GATT_GetLocalMTU(void)
+{
+    return gatt_get_local_mtu();
+}
+
diff --git a/components/bt/bluedroid/bta/include/bta/bta_gatt_common.h b/components/bt/bluedroid/bta/include/bta/bta_gatt_common.h
index 96bd34802..d4c60fe2b 100644
--- a/components/bt/bluedroid/bta/include/bta/bta_gatt_common.h
+++ b/components/bt/bluedroid/bta/include/bta/bta_gatt_common.h
@@ -31,6 +31,8 @@ extern "C"
 
 extern void BTA_GATT_SetLocalMTU(uint16_t mtu);
 
+extern uint16_t BTA_GATT_GetLocalMTU(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/bt/bluedroid/hci/include/hci/packet_fragmenter.h b/components/bt/bluedroid/hci/include/hci/packet_fragmenter.h
index 80b442f28..285555427 100644
--- a/components/bt/bluedroid/hci/include/hci/packet_fragmenter.h
+++ b/components/bt/bluedroid/hci/include/hci/packet_fragmenter.h
@@ -46,7 +46,7 @@ typedef struct packet_fragmenter_t {
     // Release all resources associated with the fragmenter.
     void (*cleanup)(void);
 
-    // CHeck if Current fragmenter is ongoing
+    // Check if Current fragmenter is ongoing
     BT_HDR *(*fragment_current_packet)(void);
 
     // Fragments |packet| if necessary and hands off everything to the fragmented callback.
diff --git a/components/bt/bluedroid/osi/include/osi/alarm.h b/components/bt/bluedroid/osi/include/osi/alarm.h
index 3dc177c7a..a1d3fa896 100644
--- a/components/bt/bluedroid/osi/include/osi/alarm.h
+++ b/components/bt/bluedroid/osi/include/osi/alarm.h
@@ -33,7 +33,7 @@ typedef enum {
     OSI_ALARM_ERR_INVALID_STATE = -3,
 } osi_alarm_err_t;
 
-#define ALARM_CBS_NUM   30
+#define ALARM_CBS_NUM   50
 #define ALARM_ID_BASE   1000
 
 int osi_alarm_create_mux(void);
diff --git a/components/bt/bluedroid/osi/include/osi/thread.h b/components/bt/bluedroid/osi/include/osi/thread.h
index 1aa773c01..e3b51ed28 100644
--- a/components/bt/bluedroid/osi/include/osi/thread.h
+++ b/components/bt/bluedroid/osi/include/osi/thread.h
@@ -72,7 +72,7 @@ typedef enum {
 #define HCI_H4_QUEUE_LEN                1
 
 #define BTU_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
-#define BTU_TASK_STACK_SIZE             (4096 + BT_TASK_EXTRA_STACK_SIZE)
+#define BTU_TASK_STACK_SIZE             (CONFIG_BTU_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)
 #define BTU_TASK_PRIO                   (configMAX_PRIORITIES - 5)
 #define BTU_TASK_NAME                   "btuT"
 #define BTU_QUEUE_LEN                   50