diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c b/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c
index 22164218d3f..d09eaa96b20 100644
--- a/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c
+++ b/components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c
@@ -495,11 +495,11 @@ void bta_gatts_add_char_descr(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_
 
 /*******************************************************************************
 **
-** Function         bta_gatts_add_char_descr
+** Function         bta_gatts_set_attr_value
 **
-** Description      action function to add characteristic descriptor.
+** Description      This function is used to set the attribute value.
 **
-** Returns          none.
+** Returns          None.
 **
 *******************************************************************************/
 void bta_gatts_set_attr_value(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_msg)
@@ -526,8 +526,23 @@ void bta_gatts_set_attr_value(tBTA_GATTS_SRVC_CB *p_srvc_cb, tBTA_GATTS_DATA *p_
     }
 }
 
+/*******************************************************************************
+**
+** Function         bta_gatts_get_attr_value
+**
+** Description      This function retrieves the attribute value associated with
+**                  the given attribute handle.
+**
+** Returns          tGATT_STATUS - GATT status indicating success or failure in
+**                  retrieving the attribute value.
+**
+*******************************************************************************/
+
 tGATT_STATUS bta_gatts_get_attr_value(UINT16 attr_handle, UINT16 *length, UINT8 **value)
 {
+    if (GATTS_GetAttributeValueInternal(attr_handle, length, value) == 0) {
+        return 0;
+    }
 
    return GATTS_GetAttributeValue(attr_handle, length, value);
 }
diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_api.c b/components/bt/host/bluedroid/stack/gatt/gatt_api.c
index 9a5e28da367..31cf6c25449 100644
--- a/components/bt/host/bluedroid/stack/gatt/gatt_api.c
+++ b/components/bt/host/bluedroid/stack/gatt/gatt_api.c
@@ -781,7 +781,7 @@ tGATT_STATUS GATTS_SetAttributeValue(UINT16 attr_handle, UINT16 length, UINT8 *v
 **
 ** Function         GATTS_GetAttributeValue
 **
-** Description      This function sends to set the attribute value .
+** Description      This function sends to get the attribute value .
 **
 ** Parameter        attr_handle: the attribute handle
 **                  length:the attribute value length in the database
@@ -807,6 +807,26 @@ tGATT_STATUS GATTS_GetAttributeValue(UINT16 attr_handle, UINT16 *length, UINT8 *
      status =  gatts_get_attribute_value(&p_decl->svc_db, attr_handle, length, value);
      return status;
 }
+
+/*******************************************************************************
+**
+** Function         GATTS_GetAttributeValueInternal
+**
+** Description      This function sends to get the attribute value of internal gatt and gap service.
+**
+** Parameter        attr_handle: the attribute handle
+**                  length:the attribute value length in the database
+**                  value: the attribute value out put
+*
+**
+** Returns          tGATT_STATUS - GATT status indicating success or failure in
+**                  retrieving the attribute value.
+**
+*******************************************************************************/
+tGATT_STATUS GATTS_GetAttributeValueInternal(UINT16 attr_handle, UINT16 *length, UINT8 **value)
+{
+    return gatts_get_attr_value_internal(attr_handle, length, value);
+}
 #endif  ///GATTS_INCLUDED == TRUE
 
 
diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_attr.c b/components/bt/host/bluedroid/stack/gatt/gatt_attr.c
index 441d0398e8f..ce3b8028950 100644
--- a/components/bt/host/bluedroid/stack/gatt/gatt_attr.c
+++ b/components/bt/host/bluedroid/stack/gatt/gatt_attr.c
@@ -40,7 +40,7 @@
 #define BLE_GATT_CL_SUPP_FEAT_BITMASK 0x07
 
 #define GATTP_MAX_NUM_INC_SVR       0
-#define GATTP_MAX_CHAR_NUM          4
+#define GATTP_MAX_CHAR_NUM          5
 #define GATTP_MAX_ATTR_NUM          (GATTP_MAX_CHAR_NUM * 2 + GATTP_MAX_NUM_INC_SVR + 1)
 #define GATTP_MAX_CHAR_VALUE_SIZE   50
 
@@ -205,18 +205,6 @@ tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_RE
 
     p_rsp->attr_value.handle = p_data->handle;
 
-    /* handle request for reading service changed */
-    if (p_data->handle == gatt_cb.handle_of_h_r) {
-        status = GATTS_GetAttributeValue(p_data->handle, &len, &value);
-        if(status == GATT_SUCCESS && len > 0 && value) {
-            if(len > GATT_MAX_ATTR_LEN) {
-                len = GATT_MAX_ATTR_LEN;
-            }
-            p_rsp->attr_value.len = len;
-            memcpy(p_rsp->attr_value.value, value, len);
-        }
-    }
-
     /* handle request for reading client supported features */
     if (p_data->handle == gatt_cb.handle_of_cl_supported_feat) {
         if (tcb == NULL) {
@@ -224,7 +212,7 @@ tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_RE
         }
         p_rsp->attr_value.len = 1;
         memcpy(p_rsp->attr_value.value, &tcb->cl_supp_feat, 1);
-        status = GATT_SUCCESS;
+        return GATT_SUCCESS;
     }
 
     /* handle request for reading database hash */
@@ -232,16 +220,25 @@ tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_RE
         p_rsp->attr_value.len = BT_OCTET16_LEN;
         memcpy(p_rsp->attr_value.value, gatt_cb.database_hash, BT_OCTET16_LEN);
         gatt_sr_update_cl_status(tcb, true);
-        status = GATT_SUCCESS;
+        return GATT_SUCCESS;
     }
 
     /* handle request for reading server supported features */
     if (p_data->handle == gatt_cb.handle_of_sr_supported_feat) {
         p_rsp->attr_value.len = 1;
         memcpy(p_rsp->attr_value.value, &gatt_cb.gatt_sr_supported_feat_mask, 1);
-        status = GATT_SUCCESS;
+        return GATT_SUCCESS;
     }
 
+    /* handle request for reading service changed des and the others */
+    status = GATTS_GetAttributeValue(p_data->handle, &len, &value);
+    if(status == GATT_SUCCESS && len > 0 && value) {
+        if(len > GATT_MAX_ATTR_LEN) {
+            len = GATT_MAX_ATTR_LEN;
+        }
+        p_rsp->attr_value.len = len;
+        memcpy(p_rsp->attr_value.value, value, len);
+    }
     return status;
 }
 
diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_db.c b/components/bt/host/bluedroid/stack/gatt/gatt_db.c
index ed03d0453b6..cd2d2ddc498 100644
--- a/components/bt/host/bluedroid/stack/gatt/gatt_db.c
+++ b/components/bt/host/bluedroid/stack/gatt/gatt_db.c
@@ -780,7 +780,7 @@ tGATT_STATUS gatts_set_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
 ** Returns          Status of the operation.
 **
 *******************************************************************************/
-static tGATT_STATUS gatts_get_attr_value_internal(UINT16 attr_handle, UINT16 *length, UINT8 **value)
+tGATT_STATUS gatts_get_attr_value_internal(UINT16 attr_handle, UINT16 *length, UINT8 **value)
 {
     UINT8 i;
     tGATT_READ_REQ read_req;
@@ -788,6 +788,17 @@ static tGATT_STATUS gatts_get_attr_value_internal(UINT16 attr_handle, UINT16 *le
     tGATT_SR_REG *p_rcb = gatt_cb.sr_reg;
     UINT8 service_uuid[LEN_UUID_128] = {0};
 
+    if (length == NULL){
+        GATT_TRACE_ERROR("gatts_get_attr_value_internal Fail:length is NULL.\n");
+        return GATT_INVALID_PDU;
+    }
+
+    if (value == NULL){
+        GATT_TRACE_ERROR("gatts_get_attr_value_internal Fail:value is NULL.\n");
+        *length = 0;
+        return GATT_INVALID_PDU;
+    }
+
     // find the service by handle
     for (i = 0; i < GATT_MAX_SR_PROFILES; i++, p_rcb++) {
         if (p_rcb->in_use && p_rcb->s_hdl <= attr_handle && p_rcb->e_hdl >= attr_handle) {
@@ -868,10 +879,6 @@ tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
         return GATT_INVALID_PDU;
     }
 
-    if (gatts_get_attr_value_internal(attr_handle, length, value) == GATT_SUCCESS) {
-        return GATT_SUCCESS;
-    }
-
     p_cur = (tGATT_ATTR16 *) p_db->p_attr_list;
 
     while (p_cur != NULL) {
diff --git a/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h b/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h
index d688b29df74..63bf39ed313 100644
--- a/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h
+++ b/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h
@@ -754,7 +754,7 @@ extern UINT16 gatts_add_char_descr (tGATT_SVC_DB *p_db, tGATT_PERM perm,
 
 extern tGATT_STATUS gatts_set_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
                                     UINT16 length, UINT8 *value);
-
+extern tGATT_STATUS gatts_get_attr_value_internal(UINT16 attr_handle, UINT16 *length, UINT8 **value);
 extern tGATT_STATUS gatts_get_attribute_value(tGATT_SVC_DB *p_db, UINT16 attr_handle,
                                     UINT16 *length, UINT8 **value);
 extern BOOLEAN gatts_is_auto_response(UINT16 attr_handle);
diff --git a/components/bt/host/bluedroid/stack/include/stack/gatt_api.h b/components/bt/host/bluedroid/stack/include/stack/gatt_api.h
index f972fdcbcb2..7872e139b5c 100644
--- a/components/bt/host/bluedroid/stack/include/stack/gatt_api.h
+++ b/components/bt/host/bluedroid/stack/include/stack/gatt_api.h
@@ -943,7 +943,7 @@ tGATT_STATUS GATTS_SetAttributeValue(UINT16 attr_handle, UINT16 length, UINT8 *v
 *******************************************************************************/
 tGATT_STATUS GATTS_GetAttributeValue(UINT16 attr_handle, UINT16 *length, UINT8 **value);
 
-
+tGATT_STATUS GATTS_GetAttributeValueInternal(UINT16 attr_handle, UINT16 *length, UINT8 **value);
 
 /*******************************************************************************/
 /* GATT Profile Client Functions */