am 23ae7c52: Merge "Added code to reuse the signal fds and avoid fd close" into klp-wireless-dev

* commit '23ae7c526b529cf1c76c4a4cc8a341545493404d':
  Added code to reuse the signal fds and avoid fd close
diff --git a/Android.mk b/Android.mk
index a44ad1b..91b00ea 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,17 +1,23 @@
 LOCAL_PATH := $(call my-dir)
 
+bdroid_CFLAGS := -Wno-unused-parameter
+
 # Setup bdroid local make variables for handling configuration
 ifneq ($(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR),)
   bdroid_C_INCLUDES := $(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR)
-  bdroid_CFLAGS := -DHAS_BDROID_BUILDCFG
+  bdroid_CFLAGS += -DHAS_BDROID_BUILDCFG
 else
   bdroid_C_INCLUDES :=
-  bdroid_CFLAGS := -DHAS_NO_BDROID_BUILDCFG
+  bdroid_CFLAGS += -DHAS_NO_BDROID_BUILDCFG
 endif
 
 bdroid_CFLAGS += -Wall -Werror
 bdroid_CFLAGS += -DBTA_AVK_INCLUDED
 
+ifneq ($(BOARD_BLUETOOTH_BDROID_HCILP_INCLUDED),)
+  bdroid_CFLAGS += -DHCILP_INCLUDED=$(BOARD_BLUETOOTH_BDROID_HCILP_INCLUDED)
+endif
+
 include $(call all-subdir-makefiles)
 
 # Cleanup our locals
diff --git a/CleanSpec.mk b/CleanSpec.mk
index b84e1b6..518119b 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -44,6 +44,10 @@
 #$(call add-clean-step, find $(OUT_DIR) -type f -name "IGTalkSession*" -print0 | xargs -0 rm -f)
 #$(call add-clean-step, rm -rf $(PRODUCT_OUT)/data/*)
 
+# Start of Clean Step list:
+$(call add-clean-step, find $(OUT_DIR) -type f -iname "*blue*" -print0 | xargs -0 rm -f)
+$(call add-clean-step, find $(OUT_DIR) -type f -iname "*bdroid*" -print0 | xargs -0 rm -f)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/audio_a2dp_hw/Android.mk b/audio_a2dp_hw/Android.mk
index c4a54fa..6fb83cb 100644
--- a/audio_a2dp_hw/Android.mk
+++ b/audio_a2dp_hw/Android.mk
@@ -12,8 +12,10 @@
 LOCAL_CFLAGS += -std=c99
 
 LOCAL_MODULE := audio.a2dp.default
-LOCAL_MODULE_PATH := $(TARGET_OUT_SHARED_LIBRARIES)/hw
+LOCAL_MODULE_RELATIVE_PATH := hw
+
+LOCAL_SHARED_LIBRARIES := libcutils liblog
 
 LOCAL_MODULE_TAGS := optional
 
-include $(BUILD_STATIC_LIBRARY)
+include $(BUILD_SHARED_LIBRARY)
diff --git a/audio_a2dp_hw/audio_a2dp_hw.c b/audio_a2dp_hw/audio_a2dp_hw.c
index 5315b1f..60feaba 100644
--- a/audio_a2dp_hw/audio_a2dp_hw.c
+++ b/audio_a2dp_hw/audio_a2dp_hw.c
@@ -25,6 +25,7 @@
  *****************************************************************************/
 
 #include <errno.h>
+#include <inttypes.h>
 #include <pthread.h>
 #include <stdint.h>
 #include <sys/time.h>
@@ -47,7 +48,7 @@
 
 #define LOG_TAG "audio_a2dp_hw"
 /* #define LOG_NDEBUG 0 */
-#include <cutils/log.h>
+#include <log/log.h>
 
 /*****************************************************************************
 **  Constants & Macros
@@ -202,7 +203,7 @@
     struct sockaddr_un remote;
     int len;
 
-    INFO("connect to %s (sz %d)", path, buffer_sz);
+    INFO("connect to %s (sz %zu)", path, buffer_sz);
 
     skt_fd = socket(AF_LOCAL, SOCK_STREAM, 0);
 
@@ -552,7 +553,7 @@
     struct a2dp_stream_out *out = (struct a2dp_stream_out *)stream;
     int sent;
 
-    DEBUG("write %d bytes (fd %d)", bytes, out->common.audio_fd);
+    DEBUG("write %zu bytes (fd %d)", bytes, out->common.audio_fd);
 
     if (out->common.state == AUDIO_A2DP_STATE_SUSPENDED)
     {
@@ -597,7 +598,7 @@
         out->common.state = AUDIO_A2DP_STATE_STOPPED;
     }
 
-    DEBUG("wrote %d bytes out of %d bytes", sent, bytes);
+    DEBUG("wrote %d bytes out of %zu bytes", sent, bytes);
     return sent;
 }
 
@@ -606,7 +607,7 @@
 {
     struct a2dp_stream_out *out = (struct a2dp_stream_out *)stream;
 
-    DEBUG("rate %d", out->common.cfg.rate);
+    DEBUG("rate %" PRIu32,out->common.cfg.rate);
 
     return out->common.cfg.rate;
 }
@@ -615,7 +616,7 @@
 {
     struct a2dp_stream_out *out = (struct a2dp_stream_out *)stream;
 
-    DEBUG("out_set_sample_rate : %d", rate);
+    DEBUG("out_set_sample_rate : %" PRIu32, rate);
 
     if (rate != AUDIO_STREAM_DEFAULT_RATE)
     {
@@ -632,7 +633,7 @@
 {
     struct a2dp_stream_out *out = (struct a2dp_stream_out *)stream;
 
-    DEBUG("buffer_size : %d", out->common.buffer_sz);
+    DEBUG("buffer_size : %zu", out->common.buffer_sz);
 
     return out->common.buffer_sz;
 }
@@ -641,7 +642,7 @@
 {
     struct a2dp_stream_out *out = (struct a2dp_stream_out *)stream;
 
-    DEBUG("channels 0x%x", out->common.cfg.channel_flags);
+    DEBUG("channels 0x%" PRIx32, out->common.cfg.channel_flags);
 
     return out->common.cfg.channel_flags;
 }
diff --git a/bta/Android.mk b/bta/Android.mk
index 6feeff2..c863d10 100644
--- a/bta/Android.mk
+++ b/bta/Android.mk
@@ -1,5 +1,3 @@
-ifneq ($(TARGET_SIMULATOR),true)
-
 LOCAL_PATH:= $(call my-dir)
 
 include $(CLEAR_VARS)
@@ -75,6 +73,10 @@
     ./hl/bta_hl_utils.c \
     ./hl/bta_hl_sdp.c \
     ./hl/bta_hl_ci.c \
+    ./mce/bta_mce_api.c \
+    ./mce/bta_mce_main.c \
+    ./mce/bta_mce_act.c \
+    ./mce/bta_mce_cfg.c \
     ./sys/bta_sys_main.c \
     ./sys/bta_sys_ci.c \
     ./sys/bta_sys_conn.c \
@@ -91,6 +93,7 @@
 LOCAL_MODULE_CLASS := STATIC_LIBRARIES
 LOCAL_MODULE_TAGS := optional
 LOCAL_SHARED_LIBRARIES := libcutils libc
+LOCAL_MULTILIB := 32
 
 LOCAL_C_INCLUDES+= . \
                    $(LOCAL_PATH)/include \
@@ -111,5 +114,3 @@
 
 
 include $(BUILD_STATIC_LIBRARY)
-
-endif  # TARGET_SIMULATOR != true
diff --git a/bta/av/bta_av_aact.c b/bta/av/bta_av_aact.c
index acde0b5..46b9f67 100644
--- a/bta/av/bta_av_aact.c
+++ b/bta/av/bta_av_aact.c
@@ -979,13 +979,13 @@
 
     if (bta_av_cb.features & BTA_AV_FEAT_MASTER)
     {
-    L2CA_SetDesireRole(L2CAP_ROLE_DISALLOW_SWITCH);
+        L2CA_SetDesireRole(L2CAP_ROLE_DISALLOW_SWITCH);
 
-    if (bta_av_cb.audio_open_cnt == 1)
-    {
-        /* there's already an A2DP connection. do not allow switch */
-        bta_sys_clear_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
-    }
+        if (bta_av_cb.audio_open_cnt == 1)
+        {
+            /* there's already an A2DP connection. do not allow switch */
+            bta_sys_clear_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
+        }
     }
     /* store peer addr other parameters */
     bta_av_save_addr(p_scb, p_data->api_open.bd_addr);
@@ -2352,15 +2352,15 @@
         p_scb->q_tag = BTA_AV_Q_TAG_START;
     }
 
-    if (p_scb->wait & BTA_AV_WAIT_ACP_CAPS_ON)
-    {
-        p_scb->wait |= BTA_AV_WAIT_ACP_CAPS_STARTED;
-    }
-
     if (p_scb->wait)
     {
-        APPL_TRACE_DEBUG("wait:x%x q_tag:%d- not started", p_scb->wait, p_scb->q_tag);
-        return;
+        APPL_TRACE_ERROR("wait:x%x q_tag:%d- not started", p_scb->wait, p_scb->q_tag);
+        /* Clear first bit of p_scb->wait and not to return from this point else
+         * HAL layer gets blocked. And if there is delay in Get Capability response as
+         * first bit of p_scb->wait is cleared hence it ensures bt_av_start_ok is not called
+         * again from bta_av_save_caps.
+        */
+        p_scb->wait &= ~BTA_AV_WAIT_ACP_CAPS_ON;
     }
 
     /* tell role manager to check M/S role */
diff --git a/bta/av/bta_av_act.c b/bta/av/bta_av_act.c
index 618aec4..624e160 100644
--- a/bta/av/bta_av_act.c
+++ b/bta/av/bta_av_act.c
@@ -870,7 +870,7 @@
     BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
 #if (AVRC_METADATA_INCLUDED == TRUE)
     tAVRC_STS   res;
-    UINT8       ctype;
+    UINT8       ctype = 0;
     tAVRC_RESPONSE  rc_rsp;
 
     rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
diff --git a/bta/av/bta_av_cfg.c b/bta/av/bta_av_cfg.c
index d9f2efc..9eb8bd6 100644
--- a/bta/av/bta_av_cfg.c
+++ b/bta/av/bta_av_cfg.c
@@ -38,11 +38,7 @@
 };
 
 /* AVRCP cupported categories */
-#if (AVRC_CTLR_INCLUDED == TRUE)
-#define BTA_AV_RC_SUPF_CT       (AVRC_SUPF_CT_CAT1 | AVRC_SUPF_CT_CAT2)
-#else
 #define BTA_AV_RC_SUPF_CT       (AVRC_SUPF_CT_CAT2)
-#endif
 
 /* Added to modify
 **	1. flush timeout
diff --git a/bta/dm/bta_dm_act.c b/bta/dm/bta_dm_act.c
index 9012dc6..da76beb 100644
--- a/bta/dm/bta_dm_act.c
+++ b/bta/dm/bta_dm_act.c
@@ -38,6 +38,7 @@
 #include "l2c_api.h"
 #include "wbt_api.h"
 #include "utl.h"
+#include "gap_api.h"    /* For GAP_BleReadPeerPrefConnParams */
 #include <string.h>
 
 #if (GAP_INCLUDED == TRUE)
diff --git a/bta/dm/bta_dm_cfg.c b/bta/dm/bta_dm_cfg.c
index 73daac0..aea6fb8 100644
--- a/bta/dm/bta_dm_cfg.c
+++ b/bta/dm/bta_dm_cfg.c
@@ -111,11 +111,11 @@
 tBTA_DM_RM *p_bta_dm_rm_cfg = (tBTA_DM_RM *)&bta_dm_rm_cfg;
 
 #if BLE_INCLUDED == TRUE
+#  define BTA_DM_NUM_PM_ENTRY         22  /* number of entries in bta_dm_pm_cfg except the first */
+#  define BTA_DM_NUM_PM_SPEC          14  /* number of entries in bta_dm_pm_spec */
+#else
 #  define BTA_DM_NUM_PM_ENTRY         20  /* number of entries in bta_dm_pm_cfg except the first */
 #  define BTA_DM_NUM_PM_SPEC          12  /* number of entries in bta_dm_pm_spec */
-#else
-#  define BTA_DM_NUM_PM_ENTRY         18  /* number of entries in bta_dm_pm_cfg except the first */
-#  define BTA_DM_NUM_PM_SPEC          10  /* number of entries in bta_dm_pm_spec */
 #endif
 
 tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_CFG bta_dm_pm_cfg[BTA_DM_NUM_PM_ENTRY + 1] =
@@ -138,10 +138,12 @@
   {BTA_ID_JV,  BTA_JV_PM_ID_1,      6},  /* app BTA_JV_PM_ID_1, reuse ftc spec table */
   {BTA_ID_JV,  BTA_ALL_APP_ID,      7},  /* reuse fts spec table */
   {BTA_ID_HL,  BTA_ALL_APP_ID,      8},  /* reuse fts spec table */
-  {BTA_ID_HS,  BTA_ALL_APP_ID,      9}   /* HS spec table */
+  {BTA_ID_HS,  BTA_ALL_APP_ID,      9},  /* HS spec table */
+  {BTA_ID_PAN, BTUI_PAN_ID_PANU,   10},  /* PANU spec table */
+  {BTA_ID_PAN, BTUI_PAN_ID_NAP,    11}   /* NAP spec table */
 #if BLE_INCLUDED == TRUE
-  ,{BTA_ID_GATTC,  BTA_ALL_APP_ID,   10}  /* gattc spec table */
-  ,{BTA_ID_GATTS,  BTA_ALL_APP_ID,   11}  /* gatts spec table */
+  ,{BTA_ID_GATTC,  BTA_ALL_APP_ID,  12}   /* gattc spec table */
+  ,{BTA_ID_GATTS,  BTA_ALL_APP_ID,  13}  /* gatts spec table */
 #endif
 };
 
@@ -154,12 +156,12 @@
   (BTA_DM_PM_SSR2),                                              /* the SSR entry */
 #endif
   {
-      {{BTA_DM_PM_SNIFF,  5000},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn open sniff  */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
       {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app open */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app close */
-      {{BTA_DM_PM_SNIFF3, 5000},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco open, active */
-      {{BTA_DM_PM_SNIFF,  5000},   {BTA_DM_PM_NO_ACTION, 0}},   /* sco close sniff  */
+      {{BTA_DM_PM_SNIFF_SCO_OPEN_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* idle */
       {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},   /* busy */
       {{BTA_DM_PM_RETRY,  5000},   {BTA_DM_PM_NO_ACTION, 0}}    /* mode change retry */
@@ -177,7 +179,7 @@
       {{BTA_DM_PM_NO_PREF,   0},  {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
       {{BTA_DM_PM_NO_ACTION, 0},  {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
       {{BTA_DM_PM_NO_ACTION, 0},  {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
-      {{BTA_DM_PM_SNIFF,  5000},  {BTA_DM_PM_NO_ACTION, 0}},    /* sco open sniff */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open sniff */
       {{BTA_DM_PM_PARK,   5000},  {BTA_DM_PM_NO_ACTION, 0}},    /* sco close  park */
       {{BTA_DM_PM_NO_ACTION, 0},  {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
       {{BTA_DM_PM_NO_ACTION, 0},  {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
@@ -211,14 +213,14 @@
   (BTA_DM_PM_SSR3),                                              /* the SSR entry */
 #endif
   {
-      {{BTA_DM_PM_SNIFF4, 5000},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn open  sniff */
+      {{BTA_DM_PM_SNIFF_HD_ACTIVE_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
       {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
-      {{BTA_DM_PM_SNIFF2, 5000},   {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
-      {{BTA_DM_PM_SNIFF4,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
+      {{BTA_DM_PM_SNIFF_HD_IDLE_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+      {{BTA_DM_PM_SNIFF_HD_ACTIVE_IDX, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
   }
  },
@@ -230,13 +232,13 @@
   (BTA_DM_PM_SSR2),                                              /* the SSR entry */
 #endif
   {
-      {{BTA_DM_PM_SNIFF,  5000},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn open  sniff */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
       {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
-      {{BTA_DM_PM_SNIFF,  5000},   {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
       {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
   }
@@ -249,14 +251,14 @@
   (BTA_DM_PM_SSR1),                                              /* the SSR entry */
 #endif
   {
-      {{BTA_DM_PM_SNIFF2, 30000},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn open  sniff */
+      {{BTA_DM_PM_SNIFF_HH_OPEN_IDX, BTA_DM_PM_HH_OPEN_DELAY},{BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
       {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close, used for HH suspend   */
-      {{BTA_DM_PM_SNIFF2, 30000},   {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
-      {{BTA_DM_PM_SNIFF2, 30000},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
+      {{BTA_DM_PM_SNIFF_HH_IDLE_IDX, BTA_DM_PM_HH_IDLE_DELAY}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+      {{BTA_DM_PM_SNIFF_HH_ACTIVE_IDX, BTA_DM_PM_HH_ACTIVE_DELAY}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
   }
  },
@@ -274,7 +276,7 @@
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
-      {{BTA_DM_PM_SNIFF,  5000},   {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
       {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
   }
@@ -293,7 +295,7 @@
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
-      {{BTA_DM_PM_SNIFF,  7000},   {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
       {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
   }
@@ -306,7 +308,7 @@
   (BTA_DM_PM_SSR2),                                              /* the SSR entry */
 #endif
   {
-      {{BTA_DM_PM_SNIFF,  5000},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn open sniff  */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
       {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app open */
       {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},   /* app close */
@@ -318,6 +320,44 @@
   }
  },
 
+  /* PANU */
+ {
+  (BTA_DM_PM_SNIFF),                                             /* allow sniff */
+#if (BTM_SSR_INCLUDED == TRUE)
+  (BTA_DM_PM_SSR2),                                              /* the SSR entry */
+#endif
+  {
+      {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn open  active */
+      {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
+      {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+      {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
+  }
+ },
+
+  /* NAP */
+ {
+  (BTA_DM_PM_SNIFF),                                             /* allow sniff */
+#if (BTM_SSR_INCLUDED == TRUE)
+  (BTA_DM_PM_SSR2),                                              /* the SSR entry */
+#endif
+  {
+      {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn open  active */
+      {{BTA_DM_PM_NO_PREF,   0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
+      {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+      {{BTA_DM_PM_ACTIVE,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
+      {{BTA_DM_PM_NO_ACTION, 0},   {BTA_DM_PM_NO_ACTION, 0}}     /* mode change retry */
+  }
+ },
+
   /* HS */
  {
   (BTA_DM_PM_SNIFF | BTA_DM_PM_PARK),                           /* allow park & sniff */
@@ -344,13 +384,13 @@
   (BTA_DM_PM_SSR2),                                              /* the SSR entry */
 #endif
   {
-      {{BTA_DM_PM_SNIFF,  10000},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn open  active */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 10000}, {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
       {{BTA_DM_PM_NO_PREF,    0},   {BTA_DM_PM_NO_ACTION, 0}},    /* conn close  */
       {{BTA_DM_PM_ACTIVE,     0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
       {{BTA_DM_PM_NO_ACTION,  0},   {BTA_DM_PM_NO_ACTION, 0}},    /* app close */
       {{BTA_DM_PM_NO_ACTION,  0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco open  */
       {{BTA_DM_PM_NO_ACTION,  0},   {BTA_DM_PM_NO_ACTION, 0}},    /* sco close   */
-      {{BTA_DM_PM_SNIFF,  10000},   {BTA_DM_PM_NO_ACTION, 0}},    /* idle */
+      {{BTA_DM_PM_SNIFF_A2DP_IDX, 10000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
       {{BTA_DM_PM_ACTIVE,     0},   {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
 #if (AMP_INCLUDED == TRUE)
       {{BTA_DM_PM_NO_ACTION,  0},   {BTA_DM_PM_NO_ACTION, 0}},   /* amp */
@@ -393,21 +433,29 @@
 #endif  /* BTE_SIM_APP */
 };
 
+/* Please refer to the SNIFF table definitions in bta_api.h.
+ *
+ * Adding to or Modifying the Table
+ * Additional sniff parameter entries can be added for BTA_DM_PM_SNIFF5 - BTA_DM_PM_SNIFF7.
+ * Overrides of additional table entries can be specified in bdroid_buildcfg.h.  If additional
+ * sniff parameter entries are added or an override of an existing entry is specified in
+ * bdroid_buildcfg.h then the BTA_DM_PM_*_IDX defines in bta_api.h will need to be match the new
+ * ordering.
+ *
+ * Table Ordering
+ * Sniff Table entries must be ordered from highest latency (biggest interval) to lowest latency.
+ * If there is a conflict among the connected services the setting with the lowest latency will
+ * be selected.
+ */
 tBTA_DM_PM_TYPE_QUALIFIER tBTM_PM_PWR_MD bta_dm_pm_md[] =
 {
-/* more sniff parameter entries can be added for BTA_DM_PM_SNIFF3 - BTA_DM_PM_SNIFF7, if needed
-When entries are added or removed, BTA_DM_PM_PARK_IDX needs to be updated to reflect the actual index
-BTA_DM_PM_PARK_IDX is defined in bta_api.h and can be override by the bdroid_buildcfg.h settings.
-The SNIFF table entries must be in the order from highest latency (biggest interval) to lowest latency.
-If there's a conflict among the connected services, the setting with lowest latency wins.
-*/
 /* sniff modes: max interval, min interval, attempt, timeout */
-  {800, 400, 4, 1, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF - A2DP */
-  {400, 200, 4, 1, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF1 */
-  {180, 150, 4, 1, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF2- HD idle */
-  {150,  50, 4, 1, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF3- SCO open */
-  { 54,  30, 4, 1, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF4- HD active*/
-  {800, 400, 0, 0, BTM_PM_MD_PARK}
+  {BTA_DM_PM_SNIFF_MAX,  BTA_DM_PM_SNIFF_MIN,  BTA_DM_PM_SNIFF_ATTEMPT,  BTA_DM_PM_SNIFF_TIMEOUT,  BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF - A2DP */
+  {BTA_DM_PM_SNIFF1_MAX, BTA_DM_PM_SNIFF1_MIN, BTA_DM_PM_SNIFF1_ATTEMPT, BTA_DM_PM_SNIFF1_TIMEOUT, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF1 */
+  {BTA_DM_PM_SNIFF2_MAX, BTA_DM_PM_SNIFF2_MIN, BTA_DM_PM_SNIFF2_ATTEMPT, BTA_DM_PM_SNIFF2_TIMEOUT, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF2- HD idle */
+  {BTA_DM_PM_SNIFF3_MAX, BTA_DM_PM_SNIFF3_MIN, BTA_DM_PM_SNIFF3_ATTEMPT, BTA_DM_PM_SNIFF3_TIMEOUT, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF3- SCO open */
+  {BTA_DM_PM_SNIFF4_MAX, BTA_DM_PM_SNIFF4_MIN, BTA_DM_PM_SNIFF4_ATTEMPT, BTA_DM_PM_SNIFF4_TIMEOUT, BTM_PM_MD_SNIFF}, /*for BTA_DM_PM_SNIFF4- HD active*/
+  {BTA_DM_PM_PARK_MAX,   BTA_DM_PM_PARK_MIN,   BTA_DM_PM_PARK_ATTEMPT,   BTA_DM_PM_PARK_TIMEOUT,   BTM_PM_MD_PARK}
 
 #ifdef BTE_SIM_APP      /* For Insight builds only */
   /* Entries at the end of the bta_dm_pm_md table are user-defined (runtime configurable),
diff --git a/bta/gatt/bta_gattc_act.c b/bta/gatt/bta_gattc_act.c
index 11bb1b0..530794b 100644
--- a/bta/gatt/bta_gattc_act.c
+++ b/bta/gatt/bta_gattc_act.c
@@ -2308,7 +2308,7 @@
 {
     tBTA_GATTC_RCB      *p_clreg = bta_gattc_cl_get_regcb(p_msg->api_listen.client_if);
     tBTA_GATTC          cb_data;
-    (void)(p_cb);
+    UNUSED(p_cb);
 
     cb_data.reg_oper.client_if = p_msg->api_listen.client_if;
     cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start);
diff --git a/bta/gatt/bta_gattc_api.c b/bta/gatt/bta_gattc_api.c
index d83155f..a91b20e 100644
--- a/bta/gatt/bta_gattc_api.c
+++ b/bta/gatt/bta_gattc_api.c
@@ -415,7 +415,6 @@
         memcpy(&p_descr_result->descr_id, &p_descr_result->char_id.char_id, sizeof(tBTA_GATT_ID));
         memcpy(&p_descr_result->char_id, p_char_id, sizeof(tBTA_GATTC_CHAR_ID));
     }
-
     return status;
 
 }
@@ -427,7 +426,7 @@
 **                  of the characterisctic.
 **
 ** Parameters       conn_id: connection ID which identify the server.
-**                  p_start_descr_id: start the characteristic search from the next record
+**                  p_start_descr_id: start the descriptor search from the next record
 **                           after the one identified by p_start_descr_id.
 **                  p_descr_uuid_cond: Characteristic descriptor UUID, if NULL find
 **                               the first available characteristic descriptor.
diff --git a/bta/hh/bta_hh_le.c b/bta/hh/bta_hh_le.c
index 9b8cdda..1fa3c8c 100644
--- a/bta/hh/bta_hh_le.c
+++ b/bta/hh/bta_hh_le.c
@@ -500,7 +500,7 @@
     UINT8   i;
 
 #if BTA_HH_DEBUG == TRUE
-    APPL_TRACE_DEBUG("bta_hh_le_find_rpt_by_idtype: r_tpye: %d rpt_id: %d", r_type, rpt_id);
+    APPL_TRACE_DEBUG("bta_hh_le_find_rpt_by_idtype: r_type: %d rpt_id: %d", r_type, rpt_id);
 #endif
 
     for (i = 0 ; i < BTA_HH_LE_RPT_MAX; i ++, p_rpt++)
@@ -908,7 +908,7 @@
     {
         BTA_GATTC_WriteCharDescr(p_cb->conn_id,
                             &descr_id,
-                            BTA_GATTC_TYPE_WRITE_NO_RSP,
+                            BTA_GATTC_TYPE_WRITE,
                             &value,
                             BTA_GATT_AUTH_REQ_NONE);
 
@@ -1828,6 +1828,7 @@
             hs_data.status  = BTA_HH_OK;
             p_buf->len = p_data->p_value->unformat.len + 1;
             p_buf->layer_specific = 0;
+            p_buf->offset = 0;
 
             /* attach report ID as the first byte of the report before sending it to USB HID driver */
             pp = (UINT8*)(p_buf + 1);
@@ -2262,7 +2263,7 @@
     else if (p_data->char_id.char_id.uuid.uu.uuid16 == GATT_UUID_HID_BT_KB_INPUT)
         app_id = BTA_HH_APP_ID_KB;
 
-    APPL_TRACE_ERROR("Notification received on report ID: %d", p_rpt->rpt_id);
+    APPL_TRACE_DEBUG("Notification received on report ID: %d", p_rpt->rpt_id);
 
     /* need to append report ID to the head of data */
     if (p_rpt->rpt_id != 0)
diff --git a/bta/hl/bta_hl_utils.c b/bta/hl/bta_hl_utils.c
index af3db24..3a5df45 100644
--- a/bta/hl/bta_hl_utils.c
+++ b/bta/hl/bta_hl_utils.c
@@ -1462,6 +1462,8 @@
     tBTA_HL_MDL_CFG     *p_mdl;
     UINT8 i ;
     BOOLEAN found=FALSE;
+
+    *p_mdl_cfg_idx = 0;
     for (i=0; i< BTA_HL_NUM_MDL_CFGS; i++)
     {
         p_mdl = BTA_HL_GET_MDL_CFG_PTR(app_idx, i);
@@ -2725,6 +2727,11 @@
         }
         success = TRUE;
     }
+    else
+    {
+      p_cfg->mtu = L2CAP_DEFAULT_MTU;
+      p_cfg->fcs = BTA_HL_L2C_NO_FCS;
+    }
 
 #if BTA_HL_DEBUG == TRUE
     if (!success)
diff --git a/bta/include/bta_api.h b/bta/include/bta_api.h
index 0653d01..e43b23b 100644
--- a/bta/include/bta_api.h
+++ b/bta/include/bta_api.h
@@ -1194,6 +1194,96 @@
 #define BTA_DM_PM_PARK_IDX      5 /* the actual index to bta_dm_pm_md[] for PARK mode */
 #endif
 
+#ifndef BTA_DM_PM_SNIFF_A2DP_IDX
+#define BTA_DM_PM_SNIFF_A2DP_IDX      BTA_DM_PM_SNIFF
+#endif
+
+#ifndef BTA_DM_PM_SNIFF_HD_IDLE_IDX
+#define BTA_DM_PM_SNIFF_HD_IDLE_IDX   BTA_DM_PM_SNIFF2
+#endif
+
+#ifndef BTA_DM_PM_SNIFF_SCO_OPEN_IDX
+#define BTA_DM_PM_SNIFF_SCO_OPEN_IDX  BTA_DM_PM_SNIFF3
+#endif
+
+#ifndef BTA_DM_PM_SNIFF_HD_ACTIVE_IDX
+#define BTA_DM_PM_SNIFF_HD_ACTIVE_IDX BTA_DM_PM_SNIFF4
+#endif
+
+#ifndef BTA_DM_PM_SNIFF_HH_OPEN_IDX
+#define BTA_DM_PM_SNIFF_HH_OPEN_IDX BTA_DM_PM_SNIFF2
+#endif
+
+#ifndef BTA_DM_PM_SNIFF_HH_ACTIVE_IDX
+#define BTA_DM_PM_SNIFF_HH_ACTIVE_IDX BTA_DM_PM_SNIFF2
+#endif
+
+#ifndef BTA_DM_PM_SNIFF_HH_IDLE_IDX
+#define BTA_DM_PM_SNIFF_HH_IDLE_IDX BTA_DM_PM_SNIFF2
+#endif
+
+
+#ifndef BTA_DM_PM_HH_OPEN_DELAY
+#define BTA_DM_PM_HH_OPEN_DELAY 30000
+#endif
+
+#ifndef BTA_DM_PM_HH_ACTIVE_DELAY
+#define BTA_DM_PM_HH_ACTIVE_DELAY 30000
+#endif
+
+#ifndef BTA_DM_PM_HH_IDLE_DELAY
+#define BTA_DM_PM_HH_IDLE_DELAY 30000
+#endif
+
+/* The Sniff Parameters defined below must be ordered from highest
+ * latency (biggest interval) to lowest latency.  If there is a conflict
+ * among the connected services the setting with the lowest latency will
+ * be selected.  If a device should override a sniff parameter then it
+ * must insure that order is maintained.
+ */
+#ifndef BTA_DM_PM_SNIFF_MAX
+#define BTA_DM_PM_SNIFF_MAX      800
+#define BTA_DM_PM_SNIFF_MIN      400
+#define BTA_DM_PM_SNIFF_ATTEMPT  4
+#define BTA_DM_PM_SNIFF_TIMEOUT  1
+#endif
+
+#ifndef BTA_DM_PM_SNIFF1_MAX
+#define BTA_DM_PM_SNIFF1_MAX     400
+#define BTA_DM_PM_SNIFF1_MIN     200
+#define BTA_DM_PM_SNIFF1_ATTEMPT 4
+#define BTA_DM_PM_SNIFF1_TIMEOUT 1
+#endif
+
+#ifndef BTA_DM_PM_SNIFF2_MAX
+#define BTA_DM_PM_SNIFF2_MAX     180
+#define BTA_DM_PM_SNIFF2_MIN     150
+#define BTA_DM_PM_SNIFF2_ATTEMPT 4
+#define BTA_DM_PM_SNIFF2_TIMEOUT 1
+#endif
+
+#ifndef BTA_DM_PM_SNIFF3_MAX
+#define BTA_DM_PM_SNIFF3_MAX     150
+#define BTA_DM_PM_SNIFF3_MIN     50
+#define BTA_DM_PM_SNIFF3_ATTEMPT 4
+#define BTA_DM_PM_SNIFF3_TIMEOUT 1
+#endif
+
+#ifndef BTA_DM_PM_SNIFF4_MAX
+#define BTA_DM_PM_SNIFF4_MAX     54
+#define BTA_DM_PM_SNIFF4_MIN     30
+#define BTA_DM_PM_SNIFF4_ATTEMPT 4
+#define BTA_DM_PM_SNIFF4_TIMEOUT 1
+#endif
+
+#ifndef BTA_DM_PM_PARK_MAX
+#define BTA_DM_PM_PARK_MAX       800
+#define BTA_DM_PM_PARK_MIN       400
+#define BTA_DM_PM_PARK_ATTEMPT   0
+#define BTA_DM_PM_PARK_TIMEOUT   0
+#endif
+
+
 /* Switch callback events */
 #define BTA_DM_SWITCH_CMPL_EVT      0       /* Completion of the Switch API */
 
diff --git a/bta/include/bta_mce_api.h b/bta/include/bta_mce_api.h
new file mode 100644
index 0000000..b9fbf6a
--- /dev/null
+++ b/bta/include/bta_mce_api.h
@@ -0,0 +1,132 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2006-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This is the public interface file the BTA MCE I/F
+ *
+ ******************************************************************************/
+#ifndef BTA_MCE_API_H
+#define BTA_MCE_API_H
+
+#include "data_types.h"
+#include "bt_target.h"
+#include "bt_types.h"
+#include "bta_api.h"
+#include "btm_api.h"
+
+/*****************************************************************************
+**  Constants and data types
+*****************************************************************************/
+/* status values */
+#define BTA_MCE_SUCCESS             0            /* Successful operation. */
+#define BTA_MCE_FAILURE             1            /* Generic failure. */
+#define BTA_MCE_BUSY                2            /* Temporarily can not handle this request. */
+
+typedef UINT8 tBTA_MCE_STATUS;
+
+/* MCE I/F callback events */
+/* events received by tBTA_MCE_DM_CBACK */
+#define BTA_MCE_ENABLE_EVT               0  /* MCE enabled */
+#define BTA_MCE_MAS_DISCOVERY_COMP_EVT   1  /* SDP MAS discovery complete */
+#define BTA_MCE_MAX_EVT                  2  /* max number of MCE events */
+
+#define BTA_MCE_MAX_MAS_INSTANCES 12
+
+typedef UINT16 tBTA_MCE_EVT;
+
+typedef struct
+{
+    UINT8   scn;
+    char    *p_srv_name;
+    UINT16  srv_name_len;
+    UINT8   instance_id;
+    UINT8   msg_type;
+} tBTA_MCE_MAS_INFO;
+
+/* data associated with BTA_MCE_MAS_DISCOVERY_COMP_EVT */
+typedef struct
+{
+    tBTA_MCE_STATUS    status;
+    BD_ADDR            remote_addr;
+    int                num_mas;
+    tBTA_MCE_MAS_INFO  mas[BTA_MCE_MAX_MAS_INSTANCES];
+} tBTA_MCE_MAS_DISCOVERY_COMP;
+
+/* union of data associated with MCE callback */
+typedef union
+{
+    tBTA_MCE_STATUS              status;         /* BTA_MCE_ENABLE_EVT */
+    tBTA_MCE_MAS_DISCOVERY_COMP  mas_disc_comp;  /* BTA_MCE_MAS_DISCOVERY_COMP_EVT */
+} tBTA_MCE;
+
+/* MCE DM Interface callback */
+typedef void (tBTA_MCE_DM_CBACK)(tBTA_MCE_EVT event, tBTA_MCE *p_data, void * user_data);
+
+/* MCE configuration structure */
+typedef struct
+{
+    UINT16  sdp_db_size;            /* The size of p_sdp_db */
+    tSDP_DISCOVERY_DB   *p_sdp_db;  /* The data buffer to keep SDP database */
+} tBTA_MCE_CFG;
+
+/*****************************************************************************
+**  External Function Declarations
+*****************************************************************************/
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/*******************************************************************************
+**
+** Function         BTA_MceEnable
+**
+** Description      Enable the MCE I/F service. When the enable
+**                  operation is complete the callback function will be
+**                  called with a BTA_MCE_ENABLE_EVT. This function must
+**                  be called before other functions in the MCE API are
+**                  called.
+**
+** Returns          BTA_MCE_SUCCESS if successful.
+**                  BTA_MCE_FAIL if internal failure.
+**
+*******************************************************************************/
+BTA_API extern tBTA_MCE_STATUS BTA_MceEnable(tBTA_MCE_DM_CBACK *p_cback);
+
+/*******************************************************************************
+**
+** Function         BTA_MceGetRemoteMasInstances
+**
+** Description      This function performs service discovery for the MAS service
+**                  by the given peer device. When the operation is completed
+**                  the tBTA_MCE_DM_CBACK callback function will be  called with
+**                  a BTA_MCE_MAS_DISCOVERY_COMP_EVT.
+**
+** Returns          BTA_MCE_SUCCESS, if the request is being processed.
+**                  BTA_MCE_FAILURE, otherwise.
+**
+*******************************************************************************/
+BTA_API extern tBTA_MCE_STATUS BTA_MceGetRemoteMasInstances(BD_ADDR bd_addr);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* BTA_MCE_API_H */
diff --git a/bta/jv/bta_jv_act.c b/bta/jv/bta_jv_act.c
index 5fcba70..3419089 100644
--- a/bta/jv/bta_jv_act.c
+++ b/bta/jv/bta_jv_act.c
@@ -285,8 +285,8 @@
         return BTA_JV_FAILURE;
     }
     APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: max_sess:%d, curr_sess:%d, p_pcb:%p, user:"
-            "%d, state:%d, jv handle: 0x%x" ,p_cb->max_sess, p_cb->curr_sess, p_pcb,
-            (int)p_pcb->user_data, p_pcb->state, p_pcb->handle);
+            "%p, state:%d, jv handle: 0x%x" ,p_cb->max_sess, p_cb->curr_sess, p_pcb,
+            p_pcb->user_data, p_pcb->state, p_pcb->handle);
 
     if (p_cb->curr_sess <= 0)
         return BTA_JV_SUCCESS;
@@ -296,32 +296,32 @@
     case BTA_JV_ST_CL_CLOSING:
     case BTA_JV_ST_SR_CLOSING:
         APPL_TRACE_WARNING("bta_jv_free_sr_rfc_cb: return on closing, port state:%d, "
-                "scn:%d, p_pcb:%p, user_data:%d", p_pcb->state, p_cb->scn, p_pcb,
-                (int)p_pcb->user_data);
+                "scn:%d, p_pcb:%p, user_data:%p", p_pcb->state, p_cb->scn, p_pcb,
+                p_pcb->user_data);
         status = BTA_JV_FAILURE;
         return status;
     case BTA_JV_ST_CL_OPEN:
     case BTA_JV_ST_CL_OPENING:
         APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: state: %d, scn:%d,"
-                          " user_data:%d", p_pcb->state, p_cb->scn, (int)p_pcb->user_data);
+                          " user_data:%p", p_pcb->state, p_cb->scn, p_pcb->user_data);
         p_pcb->state = BTA_JV_ST_CL_CLOSING;
         break;
     case BTA_JV_ST_SR_LISTEN:
         p_pcb->state = BTA_JV_ST_SR_CLOSING;
         remove_server = TRUE;
         APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: state: BTA_JV_ST_SR_LISTEN, scn:%d,"
-                " user_data:%d", p_cb->scn, (int)p_pcb->user_data);
+                " user_data:%p", p_cb->scn, p_pcb->user_data);
         break;
     case BTA_JV_ST_SR_OPEN:
         p_pcb->state = BTA_JV_ST_SR_CLOSING;
         APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: state: BTA_JV_ST_SR_OPEN, scn:%d,"
-                " user_data:%d", p_cb->scn, (int)p_pcb->user_data);
+                " user_data:%p", p_cb->scn, p_pcb->user_data);
         break;
     default:
         APPL_TRACE_WARNING("bta_jv_free_sr_rfc_cb():failed, ignore port state:%d, scn:"
-                "%d, p_pcb:%p, jv handle: 0x%x, port_handle: %d, user_data:%d",
+                "%d, p_pcb:%p, jv handle: 0x%x, port_handle: %d, user_data:%p",
                 p_pcb->state, p_cb->scn, p_pcb, p_pcb->handle, p_pcb->port_handle,
-                (int)p_pcb->user_data);
+                p_pcb->user_data);
         status = BTA_JV_FAILURE;
         break;
     }
@@ -2436,7 +2436,7 @@
     tBTA_JV_API_RFCOMM_SERVER *ls = &(p_data->rfcomm_server);
     tBTA_JV_RFC_CB           *p_cb = NULL;
     tBTA_JV_PCB              *p_pcb = NULL;
-    APPL_TRACE_ERROR("bta_jv_rfcomm_stop_server");
+    APPL_TRACE_DEBUG("bta_jv_rfcomm_stop_server");
     if(!ls->handle)
     {
         APPL_TRACE_ERROR("bta_jv_rfcomm_stop_server, jv handle is null");
diff --git a/bta/jv/bta_jv_cfg.c b/bta/jv/bta_jv_cfg.c
index 675801f..21bd2a8 100644
--- a/bta/jv/bta_jv_cfg.c
+++ b/bta/jv/bta_jv_cfg.c
@@ -1,5 +1,6 @@
 /******************************************************************************
  *
+ *  Copyright (C) 2014 The Android Open Source Project
  *  Copyright (C) 2004-2012 Broadcom Corporation
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -42,7 +43,7 @@
  * p_bta_jv_cfg->p_sdp_raw_data can be allocated before calling BTA_JvStartDiscovery
  * it can be de-allocated after the last call to access the database */
 static UINT8 bta_jv_sdp_raw_data[BTA_JV_SDP_RAW_DATA_SIZE];
-static UINT8 bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE];
+static UINT8 __attribute__ ((aligned(4))) bta_jv_sdp_db_data[BTA_JV_SDP_DB_SIZE];
 
 /* JV configuration structure */
 const tBTA_JV_CFG bta_jv_cfg =
diff --git a/bta/mce/bta_mce_act.c b/bta/mce/bta_mce_act.c
new file mode 100644
index 0000000..652254f
--- /dev/null
+++ b/bta/mce/bta_mce_act.c
@@ -0,0 +1,186 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2003-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This file contains action functions for MCE.
+ *
+ ******************************************************************************/
+
+#include <hardware/bluetooth.h>
+#include <arpa/inet.h>
+
+#include "bt_types.h"
+#include "gki.h"
+#include "bd.h"
+#include "utl.h"
+#include "bta_sys.h"
+#include "bta_api.h"
+#include "bta_mce_api.h"
+#include "bta_mce_int.h"
+#include "btm_api.h"
+#include "btm_int.h"
+#include "sdp_api.h"
+#include <string.h>
+
+/*****************************************************************************
+**  Constants
+*****************************************************************************/
+
+static const tBT_UUID bta_mce_mas_uuid = {
+    .len = 2,
+    .uu.uuid16 = UUID_SERVCLASS_MESSAGE_ACCESS
+};
+
+/*******************************************************************************
+**
+** Function     bta_mce_search_cback
+**
+** Description  Callback from btm after search is completed
+**
+** Returns      void
+**
+*******************************************************************************/
+
+static void bta_mce_search_cback(UINT16 result, void * user_data)
+{
+    tSDP_DISC_REC *p_rec = NULL;
+    tBTA_MCE_MAS_DISCOVERY_COMP evt_data;
+    int found = 0;
+
+    APPL_TRACE_DEBUG("bta_mce_start_discovery_cback res: 0x%x", result);
+
+    bta_mce_cb.sdp_active = BTA_MCE_SDP_ACT_NONE;
+
+    if (bta_mce_cb.p_dm_cback == NULL) return;
+
+    evt_data.status = BTA_MCE_FAILURE;
+    bdcpy(evt_data.remote_addr, bta_mce_cb.remote_addr);
+    evt_data.num_mas = 0;
+
+    if (result == SDP_SUCCESS || result == SDP_DB_FULL)
+    {
+        do
+        {
+            tSDP_DISC_ATTR *p_attr;
+            tSDP_PROTOCOL_ELEM pe;
+
+            p_rec = SDP_FindServiceUUIDInDb(p_bta_mce_cfg->p_sdp_db, (tBT_UUID*) &bta_mce_mas_uuid, p_rec);
+
+            APPL_TRACE_DEBUG("p_rec:%p", p_rec);
+
+            if (p_rec == NULL)
+                break;
+
+            if (!SDP_FindProtocolListElemInRec(p_rec, UUID_PROTOCOL_RFCOMM, &pe))
+                continue;
+
+            evt_data.mas[found].scn = pe.params[0];
+
+            if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME)) == NULL)
+                continue;
+
+            evt_data.mas[found].p_srv_name = (char *) p_attr->attr_value.v.array;
+            evt_data.mas[found].srv_name_len= SDP_DISC_ATTR_LEN(p_attr->attr_len_type);
+
+            if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAS_INSTANCE_ID)) == NULL)
+                break;
+
+                 evt_data.mas[found].instance_id = p_attr->attr_value.v.u8;
+
+            if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_MSG_TYPE)) == NULL)
+                break;
+
+            evt_data.mas[found].msg_type = p_attr->attr_value.v.u8;
+
+            found++;
+        } while (p_rec != NULL && found < BTA_MCE_MAX_MAS_INSTANCES);
+
+        evt_data.num_mas = found;
+        evt_data.status = BTA_MCE_SUCCESS;
+    }
+
+    bta_mce_cb.p_dm_cback(BTA_MCE_MAS_DISCOVERY_COMP_EVT, (tBTA_MCE*) &evt_data, user_data);
+}
+
+/*******************************************************************************
+**
+** Function     bta_mce_enable
+**
+** Description  Initializes the MCE I/F
+**
+** Returns      void
+**
+*******************************************************************************/
+void bta_mce_enable(tBTA_MCE_MSG *p_data)
+{
+    tBTA_MCE_STATUS status = BTA_MCE_SUCCESS;
+    bta_mce_cb.p_dm_cback = p_data->enable.p_cback;
+    bta_mce_cb.p_dm_cback(BTA_MCE_ENABLE_EVT, (tBTA_MCE *)&status, NULL);
+}
+
+/*******************************************************************************
+**
+** Function     bta_mce_get_remote_mas_instances
+**
+** Description  Discovers MAS instances on remote device
+**
+** Returns      void
+**
+*******************************************************************************/
+void bta_mce_get_remote_mas_instances(tBTA_MCE_MSG *p_data)
+{
+    if(p_data == NULL)
+    {
+    APPL_TRACE_DEBUG("MCE control block handle is null");
+    return;
+    }
+    tBTA_MCE_STATUS status = BTA_MCE_FAILURE;
+
+    APPL_TRACE_DEBUG("%s in, sdp_active:%d", __FUNCTION__, bta_mce_cb.sdp_active);
+
+    if (bta_mce_cb.sdp_active != BTA_MCE_SDP_ACT_NONE)
+    {
+        /* SDP is still in progress */
+        status = BTA_MCE_BUSY;
+        if(bta_mce_cb.p_dm_cback)
+            bta_mce_cb.p_dm_cback(BTA_MCE_MAS_DISCOVERY_COMP_EVT, (tBTA_MCE *)&status, NULL);
+
+        return;
+    }
+
+    bta_mce_cb.sdp_active = BTA_MCE_SDP_ACT_YES;
+    bdcpy(bta_mce_cb.remote_addr, p_data->get_rmt_mas.bd_addr);
+
+    SDP_InitDiscoveryDb (p_bta_mce_cfg->p_sdp_db, p_bta_mce_cfg->sdp_db_size, 1,
+                                (tBT_UUID*) &bta_mce_mas_uuid, 0, NULL);
+
+    if (!SDP_ServiceSearchAttributeRequest2(p_data->get_rmt_mas.bd_addr, p_bta_mce_cfg->p_sdp_db,
+                                                bta_mce_search_cback, NULL))
+    {
+        bta_mce_cb.sdp_active = BTA_MCE_SDP_ACT_NONE;
+
+        /* failed to start SDP. report the failure right away */
+        if (bta_mce_cb.p_dm_cback)
+            bta_mce_cb.p_dm_cback(BTA_MCE_MAS_DISCOVERY_COMP_EVT, (tBTA_MCE *)&status, NULL);
+    }
+    /*
+    else report the result when the cback is called
+    */
+}
diff --git a/bta/mce/bta_mce_api.c b/bta/mce/bta_mce_api.c
new file mode 100644
index 0000000..ff2713c
--- /dev/null
+++ b/bta/mce/bta_mce_api.c
@@ -0,0 +1,112 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2003-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This is the implementation of the API for MCE subsystem
+ *
+ ******************************************************************************/
+
+#include "bta_api.h"
+#include "bd.h"
+#include "bta_sys.h"
+#include "bta_mce_api.h"
+#include "bta_mce_int.h"
+#include "gki.h"
+#include <string.h>
+#include "port_api.h"
+#include "sdp_api.h"
+
+/*****************************************************************************
+**  Constants
+*****************************************************************************/
+
+static const tBTA_SYS_REG bta_mce_reg =
+{
+    bta_mce_sm_execute,
+    NULL
+};
+
+/*******************************************************************************
+**
+** Function         BTA_MceEnable
+**
+** Description      Enable the MCE I/F service. When the enable
+**                  operation is complete the callback function will be
+**                  called with a BTA_MCE_ENABLE_EVT. This function must
+**                  be called before other functions in the MCE API are
+**                  called.
+**
+** Returns          BTA_MCE_SUCCESS if successful.
+**                  BTA_MCE_FAIL if internal failure.
+**
+*******************************************************************************/
+tBTA_MCE_STATUS BTA_MceEnable(tBTA_MCE_DM_CBACK *p_cback)
+{
+    tBTA_MCE_STATUS status = BTA_MCE_FAILURE;
+    tBTA_MCE_API_ENABLE  *p_buf;
+
+    APPL_TRACE_API(__FUNCTION__);
+    if(p_cback && FALSE == bta_sys_is_register(BTA_ID_MCE))
+    {
+        memset(&bta_mce_cb, 0, sizeof(tBTA_MCE_CB));
+
+        /* register with BTA system manager */
+        bta_sys_register(BTA_ID_MCE, &bta_mce_reg);
+
+        if (p_cback && (p_buf = (tBTA_MCE_API_ENABLE *) GKI_getbuf(sizeof(tBTA_MCE_API_ENABLE))) != NULL)
+        {
+            p_buf->hdr.event = BTA_MCE_API_ENABLE_EVT;
+            p_buf->p_cback = p_cback;
+            bta_sys_sendmsg(p_buf);
+            status = BTA_MCE_SUCCESS;
+        }
+    }
+    return(status);
+}
+
+/*******************************************************************************
+**
+** Function         BTA_MceGetRemoteMasInstances
+**
+** Description      This function performs service discovery for the MAS service
+**                  by the given peer device. When the operation is completed
+**                  the tBTA_MCE_DM_CBACK callback function will be  called with
+**                  a BTA_MCE_MAS_DISCOVERY_COMP_EVT.
+**
+** Returns          BTA_MCE_SUCCESS, if the request is being processed.
+**                  BTA_MCE_FAILURE, otherwise.
+**
+*******************************************************************************/
+tBTA_MCE_STATUS BTA_MceGetRemoteMasInstances(BD_ADDR bd_addr)
+{
+    tBTA_MCE_STATUS ret = BTA_MCE_FAILURE;
+    tBTA_MCE_API_GET_REMOTE_MAS_INSTANCES *p_msg;
+
+    APPL_TRACE_API(__FUNCTION__);
+    if ((p_msg = (tBTA_MCE_API_GET_REMOTE_MAS_INSTANCES *)GKI_getbuf(sizeof(tBTA_MCE_API_GET_REMOTE_MAS_INSTANCES))) != NULL)
+    {
+        p_msg->hdr.event = BTA_MCE_API_GET_REMOTE_MAS_INSTANCES_EVT;
+        bdcpy(p_msg->bd_addr, bd_addr);
+        bta_sys_sendmsg(p_msg);
+        ret = BTA_MCE_SUCCESS;
+    }
+
+    return(ret);
+}
diff --git a/bta/mce/bta_mce_cfg.c b/bta/mce/bta_mce_cfg.c
new file mode 100644
index 0000000..db9fe66
--- /dev/null
+++ b/bta/mce/bta_mce_cfg.c
@@ -0,0 +1,44 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2003-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This file contains compile-time configurable constants for MCE
+ *
+ ******************************************************************************/
+
+#include "gki.h"
+#include "bta_api.h"
+#include "bd.h"
+#include "bta_mce_api.h"
+
+#ifndef BTA_MCE_SDP_DB_SIZE
+#define BTA_MCE_SDP_DB_SIZE  4500
+#endif
+
+static UINT8 __attribute__ ((aligned(4))) bta_mce_sdp_db_data[BTA_MCE_SDP_DB_SIZE];
+
+/* MCE configuration structure */
+const tBTA_MCE_CFG bta_mce_cfg =
+{
+    BTA_MCE_SDP_DB_SIZE,
+    (tSDP_DISCOVERY_DB *)bta_mce_sdp_db_data /* The data buffer to keep SDP database */
+};
+
+tBTA_MCE_CFG *p_bta_mce_cfg = (tBTA_MCE_CFG *) &bta_mce_cfg;
diff --git a/bta/mce/bta_mce_int.h b/bta/mce/bta_mce_int.h
new file mode 100644
index 0000000..9032f6a
--- /dev/null
+++ b/bta/mce/bta_mce_int.h
@@ -0,0 +1,97 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2003-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This is the private interface file for the BTA MCE I/F
+ *
+ ******************************************************************************/
+#ifndef BTA_MCE_INT_H
+#define BTA_MCE_INT_H
+
+#include "bta_sys.h"
+#include "bta_api.h"
+#include "bta_mce_api.h"
+
+/*****************************************************************************
+**  Constants
+*****************************************************************************/
+
+enum
+{
+    /* these events are handled by the state machine */
+    BTA_MCE_API_ENABLE_EVT = BTA_SYS_EVT_START(BTA_ID_MCE),
+    BTA_MCE_API_GET_REMOTE_MAS_INSTANCES_EVT,
+    BTA_MCE_MAX_INT_EVT
+};
+
+/* data type for BTA_MCE_API_ENABLE_EVT */
+typedef struct
+{
+    BT_HDR             hdr;
+    tBTA_MCE_DM_CBACK  *p_cback;
+} tBTA_MCE_API_ENABLE;
+
+/* data type for BTA_MCE_API_GET_REMOTE_MAS_INSTANCES_EVT */
+typedef struct
+{
+    BT_HDR   hdr;
+    BD_ADDR  bd_addr;
+} tBTA_MCE_API_GET_REMOTE_MAS_INSTANCES;
+
+/* union of all data types */
+typedef union
+{
+    /* GKI event buffer header */
+    BT_HDR                                 hdr;
+    tBTA_MCE_API_ENABLE                    enable;
+    tBTA_MCE_API_GET_REMOTE_MAS_INSTANCES  get_rmt_mas;
+} tBTA_MCE_MSG;
+
+/* MCE control block */
+typedef struct
+{
+    UINT8              sdp_active;  /* see BTA_MCE_SDP_ACT_* */
+    BD_ADDR            remote_addr;
+    tBTA_MCE_DM_CBACK  *p_dm_cback;
+} tBTA_MCE_CB;
+
+enum
+{
+    BTA_MCE_SDP_ACT_NONE = 0,
+    BTA_MCE_SDP_ACT_YES       /* waiting for SDP result */
+};
+
+/* MCE control block */
+#if BTA_DYNAMIC_MEMORY == FALSE
+extern tBTA_MCE_CB bta_mce_cb;
+#else
+extern tBTA_MCE_CB *bta_mce_cb_ptr;
+#define bta_mce_cb (*bta_mce_cb_ptr)
+#endif
+
+/* config struct */
+extern tBTA_MCE_CFG *p_bta_mce_cfg;
+
+extern BOOLEAN bta_mce_sm_execute(BT_HDR *p_msg);
+
+extern void bta_mce_enable (tBTA_MCE_MSG *p_data);
+extern void bta_mce_get_remote_mas_instances (tBTA_MCE_MSG *p_data);
+
+#endif /* BTA_MCE_INT_H */
diff --git a/bta/mce/bta_mce_main.c b/bta/mce/bta_mce_main.c
new file mode 100644
index 0000000..f313eb0
--- /dev/null
+++ b/bta/mce/bta_mce_main.c
@@ -0,0 +1,77 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2003-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *
+ *  This is the main implementation file for the BTA MCE I/F
+ *
+ ******************************************************************************/
+
+#include "bta_api.h"
+#include "bta_sys.h"
+#include "bta_mce_api.h"
+#include "bta_mce_int.h"
+
+/*****************************************************************************
+** Constants and types
+*****************************************************************************/
+
+#if BTA_DYNAMIC_MEMORY == FALSE
+tBTA_MCE_CB bta_mce_cb;
+#endif
+
+/* state machine action enumeration list */
+#define BTA_MCE_NUM_ACTIONS  (BTA_MCE_MAX_INT_EVT & 0x00ff)
+
+/* type for action functions */
+typedef void (*tBTA_MCE_ACTION)(tBTA_MCE_MSG *p_data);
+
+/* action function list */
+const tBTA_MCE_ACTION bta_mce_action[] =
+{
+    bta_mce_enable,                    /* BTA_MCE_API_ENABLE_EVT */
+    bta_mce_get_remote_mas_instances,  /* BTA_MCE_API_GET_REMOTE_MAS_INSTANCES_EVT */
+};
+
+/*******************************************************************************
+**
+** Function         bta_mce_sm_execute
+**
+** Description      State machine event handling function for MCE
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+BOOLEAN bta_mce_sm_execute(BT_HDR *p_msg)
+{
+    if(p_msg == NULL) return FALSE;
+
+    BOOLEAN ret = FALSE;
+    UINT16 action = (p_msg->event & 0x00ff);
+
+    /* execute action functions */
+    if(action < BTA_MCE_NUM_ACTIONS)
+    {
+        (*bta_mce_action[action])((tBTA_MCE_MSG*)p_msg);
+        ret = TRUE;
+    }
+
+    return(ret);
+}
diff --git a/bta/pan/bta_pan_act.c b/bta/pan/bta_pan_act.c
index 575416e..6e2d620 100644
--- a/bta/pan/bta_pan_act.c
+++ b/bta/pan/bta_pan_act.c
@@ -43,6 +43,40 @@
 #define BTA_PAN_TX_MASK              0xF0
 
 /*******************************************************************************
+ **
+ ** Function    bta_pan_pm_conn_busy
+ **
+ ** Description set pan pm connection busy state
+ **
+ ** Params      p_scb: state machine control block of pan connection
+ **
+ ** Returns     void
+ **
+ *******************************************************************************/
+static void bta_pan_pm_conn_busy(tBTA_PAN_SCB *p_scb)
+{
+    if ((p_scb != NULL) && (p_scb->state != BTA_PAN_IDLE_ST))
+        bta_sys_busy(BTA_ID_PAN, p_scb->app_id, p_scb->bd_addr);
+}
+
+/*******************************************************************************
+ **
+ ** Function    bta_pan_pm_conn_idle
+ **
+ ** Description set pan pm connection idle state
+ **
+ ** Params      p_scb: state machine control block of pan connection
+ **
+ ** Returns     void
+ **
+ *******************************************************************************/
+static void bta_pan_pm_conn_idle(tBTA_PAN_SCB *p_scb)
+{
+    if ((p_scb != NULL) && (p_scb->state != BTA_PAN_IDLE_ST))
+        bta_sys_idle(BTA_ID_PAN, p_scb->app_id, p_scb->bd_addr);
+}
+
+/*******************************************************************************
 **
 ** Function         bta_pan_conn_state_cback
 **
@@ -457,6 +491,8 @@
         bta_pan_scb_dealloc(p_scb);
         bdcpy(data.bd_addr, p_data->api_open.bd_addr);
         data.status = BTA_PAN_FAIL;
+        data.local_role = p_data->api_open.local_role;
+        data.peer_role = p_data->api_open.peer_role;
         bta_pan_cb.p_cback(BTA_PAN_OPEN_EVT, (tBTA_PAN *)&data);
     }
 
@@ -625,12 +661,14 @@
     /* if data path configured for tx pull */
     if ((bta_pan_cb.flow_mask & BTA_PAN_TX_MASK) == BTA_PAN_TX_PULL)
     {
+        bta_pan_pm_conn_busy(p_scb);
         /* call application callout function for tx path */
         bta_pan_co_tx_path(p_scb->handle, p_scb->app_id);
 
         /* free data that exceeds queue level */
         while(p_scb->data_queue.count > bta_pan_cb.q_level)
             GKI_freebuf(GKI_dequeue(&p_scb->data_queue));
+        bta_pan_pm_conn_idle(p_scb);
     }
     /* if configured for zero copy push */
     else if ((bta_pan_cb.flow_mask & BTA_PAN_TX_MASK) == BTA_PAN_TX_PUSH_BUF)
@@ -702,6 +740,7 @@
 {
     if ((bta_pan_cb.flow_mask & BTA_PAN_RX_MASK) == BTA_PAN_RX_PUSH_BUF)
     {
+        bta_pan_pm_conn_busy(p_scb);
 
         PAN_WriteBuf (p_scb->handle,
                       ((tBTA_PAN_DATA_PARAMS *)p_data)->dst,
@@ -709,6 +748,7 @@
                       ((tBTA_PAN_DATA_PARAMS *)p_data)->protocol,
                       (BT_HDR *)p_data,
                       ((tBTA_PAN_DATA_PARAMS *)p_data)->ext);
+        bta_pan_pm_conn_idle(p_scb);
 
     }
 }
diff --git a/bta/pan/bta_pan_api.c b/bta/pan/bta_pan_api.c
index c515ff9..0a69b0f 100644
--- a/bta/pan/bta_pan_api.c
+++ b/bta/pan/bta_pan_api.c
@@ -25,8 +25,6 @@
 
 #include "bt_target.h"
 
-#if defined(BTA_PAN_INCLUDED) && (BTA_PAN_INCLUDED == TRUE)
-
 #include "bta_api.h"
 #include "bta_sys.h"
 #include "pan_api.h"
@@ -35,6 +33,9 @@
 #include "bta_pan_int.h"
 #include "bd.h"
 #include <string.h>
+#include "bt_utils.h"
+
+#if defined(BTA_PAN_INCLUDED) && (BTA_PAN_INCLUDED == TRUE)
 
 static const tBTA_SYS_REG bta_pan_reg =
 {
@@ -209,4 +210,36 @@
         bta_sys_sendmsg(p_buf);
     }
 }
+#else
+
+void BTA_PanEnable(tBTA_PAN_CBACK p_cback)
+{
+    UNUSED(p_cback);
+}
+
+void BTA_PanDisable(void)
+{
+}
+
+void BTA_PanSetRole(tBTA_PAN_ROLE role, tBTA_PAN_ROLE_INFO *p_user_info, tBTA_PAN_ROLE_INFO *p_gn_info,
+                    tBTA_PAN_ROLE_INFO *p_nap_info)
+{
+    UNUSED(role);
+    UNUSED(p_user_info);
+    UNUSED(p_gn_info);
+    UNUSED(p_nap_info);
+}
+
+void BTA_PanOpen(BD_ADDR bd_addr, tBTA_PAN_ROLE local_role, tBTA_PAN_ROLE peer_role)
+{
+    UNUSED(bd_addr);
+    UNUSED(local_role);
+    UNUSED(peer_role);
+}
+
+void BTA_PanClose(UINT16 handle)
+{
+    UNUSED(handle);
+}
+
 #endif /* BTA_PAN_INCLUDED */
diff --git a/bta/pan/bta_pan_ci.c b/bta/pan/bta_pan_ci.c
index f8e5832..7e67477 100644
--- a/bta/pan/bta_pan_ci.c
+++ b/bta/pan/bta_pan_ci.c
@@ -24,8 +24,6 @@
 
 #include "bt_target.h"
 
-#if defined(BTA_PAN_INCLUDED) && (BTA_PAN_INCLUDED == TRUE)
-
 #include <string.h>
 
 #include "gki.h"
@@ -35,7 +33,9 @@
 #include "bta_pan_api.h"
 #include "bta_pan_ci.h"
 #include "bta_pan_int.h"
+#include "bt_utils.h"
 
+#if defined(BTA_PAN_INCLUDED) && (BTA_PAN_INCLUDED == TRUE)
 
 /*******************************************************************************
 **
@@ -256,5 +256,61 @@
     PAN_SetProtocolFilters(handle, num_filters, p_start_array, p_end_array );
 
 }
+#else
+
+void bta_pan_ci_tx_ready(UINT16 handle)
+{
+    UNUSED(handle);
+}
+
+void bta_pan_ci_rx_ready(UINT16 handle)
+{
+    UNUSED(handle);
+}
+
+void bta_pan_ci_tx_flow(UINT16 handle, BOOLEAN enable)
+{
+    UNUSED(handle);
+    UNUSED(enable);
+}
+
+void bta_pan_ci_rx_writebuf(UINT16 handle, BD_ADDR src, BD_ADDR dst, UINT16 protocol, BT_HDR *p_buf, BOOLEAN ext)
+{
+    UNUSED(handle);
+    UNUSED(src);
+    UNUSED(dst);
+    UNUSED(protocol);
+    UNUSED(p_buf);
+    UNUSED(ext);
+}
+
+BT_HDR * bta_pan_ci_readbuf(UINT16 handle, BD_ADDR src, BD_ADDR dst, UINT16 *p_protocol,
+                            BOOLEAN* p_ext, BOOLEAN* p_forward)
+{
+    UNUSED(handle);
+    UNUSED(src);
+    UNUSED(dst);
+    UNUSED(p_protocol);
+    UNUSED(p_ext);
+    UNUSED(p_forward);
+    return NULL;
+}
+
+void bta_pan_ci_set_pfilters(UINT16 handle, UINT16 num_filters, UINT16 *p_start_array, UINT16 *p_end_array)
+{
+    UNUSED(handle);
+    UNUSED(num_filters);
+    UNUSED(p_start_array);
+    UNUSED(p_end_array);
+}
+
+void bta_pan_ci_set_mfilters(UINT16 handle, UINT16 num_mcast_filters, UINT8 *p_start_array,
+                             UINT8 *p_end_array)
+{
+    UNUSED(handle);
+    UNUSED(num_mcast_filters);
+    UNUSED(p_start_array);
+    UNUSED(p_end_array);
+}
 
 #endif /* BTA_PAN_API */
diff --git a/bta/pan/bta_pan_int.h b/bta/pan/bta_pan_int.h
index 1667e57..bd75311 100644
--- a/bta/pan/bta_pan_int.h
+++ b/bta/pan/bta_pan_int.h
@@ -56,6 +56,14 @@
     BTA_PAN_API_OPEN_EVT
 };
 
+/* state machine states */
+enum
+{
+    BTA_PAN_IDLE_ST,
+    BTA_PAN_OPEN_ST,
+    BTA_PAN_CLOSING_ST
+};
+
 
 
 
diff --git a/bta/pan/bta_pan_main.c b/bta/pan/bta_pan_main.c
index 7fa0508..3a69994 100644
--- a/bta/pan/bta_pan_main.c
+++ b/bta/pan/bta_pan_main.c
@@ -84,14 +84,6 @@
 #define BTA_PAN_NUM_COLS             2       /* number of columns in state tables */
 
 
-/* state machine states */
-enum
-{
-    BTA_PAN_IDLE_ST,
-    BTA_PAN_OPEN_ST,
-    BTA_PAN_CLOSING_ST
-};
-
 
 /* state table for listen state */
 const UINT8 bta_pan_st_idle[][BTA_PAN_NUM_COLS] =
diff --git a/btif/include/btif_mce.h b/btif/include/btif_mce.h
new file mode 100644
index 0000000..aa61cfb
--- /dev/null
+++ b/btif/include/btif_mce.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2009-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ *
+ *  Filename:      btif_mce.h
+ *
+ *  Description:   Bluetooth MCE Interface
+ *
+ *******************************************************************************/
+
+#ifndef BTIF_MCE_H
+#define BTIF_MCE_H
+
+#include <hardware/bt_mce.h>
+
+btmce_interface_t *btif_mce_get_interface();
+
+#endif
diff --git a/btif/src/bluetooth.c b/btif/src/bluetooth.c
index a88a40c..21b6f24 100644
--- a/btif/src/bluetooth.c
+++ b/btif/src/bluetooth.c
@@ -36,6 +36,7 @@
 #include <hardware/bt_hh.h>
 #include <hardware/bt_hl.h>
 #include <hardware/bt_pan.h>
+#include <hardware/bt_mce.h>
 #include <hardware/bt_gatt.h>
 #include <hardware/bt_rc.h>
 
@@ -89,6 +90,8 @@
 extern bthl_interface_t *btif_hl_get_interface();
 /*pan*/
 extern btpan_interface_t *btif_pan_get_interface();
+/*map client*/
+extern btmce_interface_t *btif_mce_get_interface();
 #if BLE_INCLUDED == TRUE
 /* gatt */
 extern btgatt_interface_t *btif_gatt_get_interface();
@@ -351,7 +354,10 @@
     if (is_profile(profile_id, BT_PROFILE_HEALTH_ID))
         return btif_hl_get_interface();
 
-#if ( BTA_GATT_INCLUDED == TRUE &&BLE_INCLUDED == TRUE)
+    if (is_profile(profile_id, BT_PROFILE_MAP_CLIENT_ID))
+        return btif_mce_get_interface();
+
+#if ( BTA_GATT_INCLUDED == TRUE && BLE_INCLUDED == TRUE)
     if (is_profile(profile_id, BT_PROFILE_GATT_ID))
         return btif_gatt_get_interface();
 #endif
diff --git a/btif/src/btif_av.c b/btif/src/btif_av.c
index 731c0dc..4399153 100644
--- a/btif/src/btif_av.c
+++ b/btif/src/btif_av.c
@@ -121,7 +121,6 @@
     case BTA_AV_VENDOR_CMD_EVT: \
     case BTA_AV_META_MSG_EVT: \
     case BTA_AV_RC_FEAT_EVT: \
-    case BTA_AV_REMOTE_RSP_EVT: \
     { \
          btif_rc_handler(e, d);\
     }break; \
@@ -334,7 +333,6 @@
         case BTA_AV_VENDOR_CMD_EVT:
         case BTA_AV_META_MSG_EVT:
         case BTA_AV_RC_FEAT_EVT:
-        case BTA_AV_REMOTE_RSP_EVT:
             btif_rc_handler(event, (tBTA_AV*)p_data);
             break;
 
@@ -894,8 +892,6 @@
 
 bt_status_t btif_av_init()
 {
-    btif_av_cb.sm_handle = NULL;
-
     if (btif_av_cb.sm_handle == NULL)
     {
         if (btif_a2dp_start_media_task() != GKI_SUCCESS)
@@ -997,15 +993,7 @@
     return BT_STATUS_SUCCESS;
 }
 
-static bt_status_t connect_src(bt_bdaddr_t *bd_addr)
-{
-    BTIF_TRACE_EVENT("%s", __FUNCTION__);
-    CHECK_BTAV_INIT();
-
-    return btif_queue_connect(UUID_SERVCLASS_AUDIO_SINK, bd_addr, connect_int);
-}
-
-static bt_status_t connect_sink(bt_bdaddr_t *bd_addr)
+static bt_status_t src_connect_sink(bt_bdaddr_t *bd_addr)
 {
     BTIF_TRACE_EVENT("%s", __FUNCTION__);
     CHECK_BTAV_INIT();
@@ -1013,6 +1001,14 @@
     return btif_queue_connect(UUID_SERVCLASS_AUDIO_SOURCE, bd_addr, connect_int);
 }
 
+static bt_status_t sink_connect_src(bt_bdaddr_t *bd_addr)
+{
+    BTIF_TRACE_EVENT("%s", __FUNCTION__);
+    CHECK_BTAV_INIT();
+
+    return btif_queue_connect(UUID_SERVCLASS_AUDIO_SINK, bd_addr, connect_int);
+}
+
 /*******************************************************************************
 **
 ** Function         disconnect
@@ -1080,7 +1076,7 @@
 static const btav_interface_t bt_av_src_interface = {
     sizeof(btav_interface_t),
     init_src,
-    connect_src,
+    src_connect_sink,
     disconnect,
     cleanup_src,
 };
@@ -1088,7 +1084,7 @@
 static const btav_interface_t bt_av_sink_interface = {
     sizeof(btav_interface_t),
     init_sink,
-    connect_sink,
+    sink_connect_src,
     disconnect,
     cleanup_sink,
 };
diff --git a/btif/src/btif_core.c b/btif/src/btif_core.c
index 97b5ff1..c168e6c 100644
--- a/btif/src/btif_core.c
+++ b/btif/src/btif_core.c
@@ -1,5 +1,6 @@
 /******************************************************************************
  *
+ *  Copyright (C) 2014 The Android Open Source Project
  *  Copyright (C) 2009-2012 Broadcom Corporation
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -48,6 +49,7 @@
 #include "btif_util.h"
 #include "btif_sock.h"
 #include "btif_pan.h"
+#include "btif_mce.h"
 #include "btif_profile_queue.h"
 #include "btif_config.h"
 /************************************************************************************
diff --git a/btif/src/btif_dm.c b/btif/src/btif_dm.c
index 6b0daa8..8ab9137 100644
--- a/btif/src/btif_dm.c
+++ b/btif/src/btif_dm.c
@@ -159,6 +159,7 @@
 extern bt_status_t btif_av_execute_service(BOOLEAN b_enable);
 extern bt_status_t btif_hh_execute_service(BOOLEAN b_enable);
 extern bt_status_t btif_hf_client_execute_service(BOOLEAN b_enable);
+extern bt_status_t btif_mce_execute_service(BOOLEAN b_enable);
 extern int btif_hh_connect(bt_bdaddr_t *bd_addr);
 extern void bta_gatt_convert_uuid16_to_uuid128(UINT8 uuid_128[LEN_UUID_128], UINT16 uuid_16);
 
@@ -190,6 +191,10 @@
          {
              btif_hf_client_execute_service(b_enable);
          }break;
+         case BTA_MAP_SERVICE_ID:
+         {
+             btif_mce_execute_service(b_enable);
+         }break;
          default:
               BTIF_TRACE_ERROR("%s: Unknown service being enabled", __FUNCTION__);
               return BT_STATUS_FAIL;
diff --git a/btif/src/btif_gatt_client.c b/btif/src/btif_gatt_client.c
index f4ad664..5d1c6db 100644
--- a/btif/src/btif_gatt_client.c
+++ b/btif/src/btif_gatt_client.c
@@ -59,10 +59,10 @@
 
 #define CHECK_BTGATT_INIT() if (bt_gatt_callbacks == NULL)\
     {\
-        ALOGW("%s: BTGATT not initialized", __FUNCTION__);\
+        BTIF_TRACE_WARNING("%s: BTGATT not initialized", __FUNCTION__);\
         return BT_STATUS_NOT_READY;\
     } else {\
-        ALOGD("%s", __FUNCTION__);\
+        BTIF_TRACE_DEBUG("%s", __FUNCTION__);\
     }
 
 
@@ -326,7 +326,7 @@
             memcpy(p_dev_cb->remote_dev[i].bd_addr.address, p_bda, BD_ADDR_LEN);
             p_dev_cb->addr_type = addr_type;
             p_dev_cb->remote_dev[i].in_use = TRUE;
-            ALOGD("%s device added idx=%d", __FUNCTION__, i  );
+            BTIF_TRACE_DEBUG("%s device added idx=%d", __FUNCTION__, i  );
             break;
         }
     }
@@ -337,7 +337,7 @@
         memcpy(p_dev_cb->remote_dev[i].bd_addr.address, p_bda, BD_ADDR_LEN);
         p_dev_cb->addr_type = addr_type;
         p_dev_cb->remote_dev[i].in_use = TRUE;
-        ALOGD("%s device overwrite idx=%d", __FUNCTION__, i  );
+        BTIF_TRACE_DEBUG("%s device overwrite idx=%d", __FUNCTION__, i  );
         p_dev_cb->next_storage_idx++;
         if(p_dev_cb->next_storage_idx >= BTIF_GATT_MAX_OBSERVED_DEV)
                p_dev_cb->next_storage_idx = 0;
@@ -375,10 +375,10 @@
 
     if(p_eir_remote_name)
     {
-         memcpy(bdname.name, p_eir_remote_name, remote_name_len);
-         bdname.name[remote_name_len]='\0';
+        memcpy(bdname.name, p_eir_remote_name, remote_name_len);
+        bdname.name[remote_name_len]='\0';
 
-        ALOGD("%s BLE device name=%s len=%d dev_type=%d", __FUNCTION__, bdname.name,
+        BTIF_TRACE_DEBUG("%s BLE device name=%s len=%d dev_type=%d", __FUNCTION__, bdname.name,
               remote_name_len, p_btif_cb->device_type  );
         btif_dm_update_ble_remote_properties( p_btif_cb->bd_addr.address,   bdname.name,
                                                p_btif_cb->device_type);
@@ -389,7 +389,7 @@
 
 static void btif_gattc_upstreams_evt(uint16_t event, char* p_param)
 {
-    ALOGD("%s: Event %d", __FUNCTION__, event);
+    BTIF_TRACE_EVENT("%s: Event %d", __FUNCTION__, event);
 
     tBTA_GATTC *p_data = (tBTA_GATTC*)p_param;
     switch (event)
@@ -531,7 +531,7 @@
         }
 
         case BTA_GATTC_ACL_EVT:
-            ALOGD("BTA_GATTC_ACL_EVT: status = %d", p_data->status);
+            BTIF_TRACE_EVENT("BTA_GATTC_ACL_EVT: status = %d", p_data->status);
             /* Ignore for now */
             break;
 
@@ -764,7 +764,7 @@
         }
 
         default:
-            ALOGE("%s: Unhandled event (%d)!", __FUNCTION__, event);
+            BTIF_TRACE_ERROR("%s: Unhandled event (%d)!", __FUNCTION__, event);
             break;
     }
 
@@ -1080,7 +1080,7 @@
 
     if (!p_cb && !p_adv_data && !p_inst_cb && !p_scan_track_cb && !p_adv_filt_cb) return;
 
-    ALOGD("%s: Event %d", __FUNCTION__, event);
+    BTIF_TRACE_EVENT("%s: Event %d", __FUNCTION__, event);
 
     switch (event)
     {
@@ -1455,7 +1455,7 @@
                 }
 
                 default:
-                    ALOGE("%s: Unknown filter type (%d)!", __FUNCTION__, p_cb->action);
+                    BTIF_TRACE_ERROR("%s: Unknown filter type (%d)!", __FUNCTION__, p_cb->action);
                     break;
             }
             break;
@@ -1627,7 +1627,7 @@
         }
 
         default:
-            ALOGE("%s: Unknown event (%d)!", __FUNCTION__, event);
+            BTIF_TRACE_ERROR("%s: Unknown event (%d)!", __FUNCTION__, event);
             break;
     }
 }
diff --git a/btif/src/btif_gatt_test.c b/btif/src/btif_gatt_test.c
index 219bacd..4d71ad9 100644
--- a/btif/src/btif_gatt_test.c
+++ b/btif/src/btif_gatt_test.c
@@ -234,15 +234,15 @@
 
         case 0x02: /* Connect */
         {
-            ALOGD("%s: CONNECT - device=%02x:%02x:%02x:%02x:%02x:%02x (dev_type=%d)",
+            ALOGD("%s: CONNECT - device=%02x:%02x:%02x:%02x:%02x:%02x (dev_type=%d, addr_type=%d)",
                 __FUNCTION__,
                 params->bda1->address[0], params->bda1->address[1],
                 params->bda1->address[2], params->bda1->address[3],
                 params->bda1->address[4], params->bda1->address[5],
-                params->u1);
+                params->u1, params->u2);
 
             if (params->u1 == BT_DEVICE_TYPE_BLE)
-                BTM_SecAddBleDevice(params->bda1->address, NULL, BT_DEVICE_TYPE_BLE, 0);
+                BTM_SecAddBleDevice(params->bda1->address, NULL, BT_DEVICE_TYPE_BLE, params->u2);
 
             if ( !GATT_Connect(test_cb.gatt_if, params->bda1->address, TRUE, BT_TRANSPORT_LE) )
             {
diff --git a/btif/src/btif_gatt_util.c b/btif/src/btif_gatt_util.c
index c0a670c..ed66703 100644
--- a/btif/src/btif_gatt_util.c
+++ b/btif/src/btif_gatt_util.c
@@ -43,7 +43,7 @@
 #define GATTC_READ_VALUE_TYPE_VALUE          0x0000  /* Attribute value itself */
 #define GATTC_READ_VALUE_TYPE_AGG_FORMAT     0x2905  /* Characteristic Aggregate Format*/
 
-static char BASE_UUID[16] = {
+static unsigned char BASE_UUID[16] = {
     0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
     0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
diff --git a/btif/src/btif_hh.c b/btif/src/btif_hh.c
index 034807c..6dfc68b 100644
--- a/btif/src/btif_hh.c
+++ b/btif/src/btif_hh.c
@@ -847,16 +847,20 @@
 
             BTIF_TRACE_DEBUG("BTA_HH_GET_RPT_EVT: status = %d, handle = %d",
                  p_data->hs_data.status, p_data->hs_data.handle);
-            /* p_rpt_data in HANDSHAKE response case */
-            if (hdr) {
-                data = (UINT8 *)(hdr + 1) + hdr->offset;
-                len = hdr->len;
-            }
             p_dev = btif_hh_find_connected_dev_by_handle(p_data->hs_data.handle);
             if (p_dev) {
-                HAL_CBACK(bt_hh_callbacks, get_report_cb,
-                          (bt_bdaddr_t*) &(p_dev->bd_addr),
-                          (bthh_status_t) p_data->hs_data.status, data, len);
+                /* p_rpt_data is NULL in HANDSHAKE response case */
+                if (hdr) {
+                    data = (UINT8 *)(hdr + 1) + hdr->offset;
+                    len = hdr->len;
+                    HAL_CBACK(bt_hh_callbacks, get_report_cb,
+                              (bt_bdaddr_t*) &(p_dev->bd_addr),
+                              (bthh_status_t) p_data->hs_data.status, data, len);
+                } else {
+                    HAL_CBACK(bt_hh_callbacks, handshake_cb,
+                              (bt_bdaddr_t*) &(p_dev->bd_addr),
+                              (bthh_status_t) p_data->hs_data.status);
+                }
             } else {
                 BTIF_TRACE_WARNING("Error: cannot find device with handle %d", p_data->hs_data.handle);
             }
@@ -865,6 +869,12 @@
         case BTA_HH_SET_RPT_EVT:
             BTIF_TRACE_DEBUG("BTA_HH_SET_RPT_EVT: status = %d, handle = %d",
             p_data->dev_status.status, p_data->dev_status.handle);
+            p_dev = btif_hh_find_connected_dev_by_handle(p_data->dev_status.handle);
+            if (p_dev != NULL) {
+                HAL_CBACK(bt_hh_callbacks, handshake_cb,
+                          (bt_bdaddr_t*) &(p_dev->bd_addr),
+                          (bthh_status_t) p_data->hs_data.status);
+            }
             break;
 
         case BTA_HH_GET_PROTO_EVT:
@@ -874,13 +884,27 @@
                  p_data->hs_data.rsp_data.proto_mode,
                  (p_data->hs_data.rsp_data.proto_mode == BTA_HH_PROTO_RPT_MODE) ? "Report Mode" :
                  (p_data->hs_data.rsp_data.proto_mode == BTA_HH_PROTO_BOOT_MODE) ? "Boot Mode" : "Unsupported");
-            HAL_CBACK(bt_hh_callbacks, protocol_mode_cb,(bt_bdaddr_t*) &(p_dev->bd_addr), (bthh_status_t)p_data->hs_data.status,
-                             (bthh_protocol_mode_t) p_data->hs_data.rsp_data.proto_mode);
+            if (p_data->hs_data.rsp_data.proto_mode != BTA_HH_PROTO_UNKNOWN) {
+                HAL_CBACK(bt_hh_callbacks, protocol_mode_cb,
+                          (bt_bdaddr_t*) &(p_dev->bd_addr),
+                          (bthh_status_t)p_data->hs_data.status,
+                          (bthh_protocol_mode_t) p_data->hs_data.rsp_data.proto_mode);
+            } else {
+                HAL_CBACK(bt_hh_callbacks, handshake_cb,
+                          (bt_bdaddr_t*) &(p_dev->bd_addr),
+                          (bthh_status_t)p_data->hs_data.status);
+            }
             break;
 
         case BTA_HH_SET_PROTO_EVT:
             BTIF_TRACE_DEBUG("BTA_HH_SET_PROTO_EVT: status = %d, handle = %d",
                  p_data->dev_status.status, p_data->dev_status.handle);
+            p_dev = btif_hh_find_connected_dev_by_handle(p_data->dev_status.handle);
+            if (p_dev) {
+                HAL_CBACK(bt_hh_callbacks, handshake_cb,
+                          (bt_bdaddr_t*)&(p_dev->bd_addr),
+                          (bthh_status_t)p_data->hs_data.status);
+            }
             break;
 
         case BTA_HH_GET_IDLE_EVT:
@@ -1534,7 +1558,7 @@
         memset(hexbuf, 0, len);
         //TODO
         hex_bytes_filled = ascii_2_hex(report, len, hexbuf);
-        ALOGI("Hex bytes filled, hex value: %d", hex_bytes_filled);
+        BTIF_TRACE_DEBUG("Hex bytes filled, hex value: %d", hex_bytes_filled);
         if (hex_bytes_filled) {
             BT_HDR* p_buf = create_pbuf(hex_bytes_filled, hexbuf);
             if (p_buf == NULL) {
diff --git a/btif/src/btif_hl.c b/btif/src/btif_hl.c
index 300a1da..153cb5b 100644
--- a/btif/src/btif_hl.c
+++ b/btif/src/btif_hl.c
@@ -188,6 +188,9 @@
     btif_hl_mcl_cb_t    *p_mcb;
     UINT8 i, j;
     BOOLEAN found=FALSE;
+
+    *p_app_idx = 0;
+    *p_mcl_idx = 0;
     for (i=0; i < BTA_HL_NUM_APPS ; i ++)
     {
         p_acb  =BTIF_HL_GET_APP_CB_PTR(i);
@@ -1001,6 +1004,8 @@
     UINT8 i,j;
     int mdl_cfg_channel_id;
 
+    *p_app_idx = 0;
+    *p_mdl_cfg_idx =0;
     for (i=0; i < BTA_HL_NUM_APPS ; i ++)
     {
         p_acb =BTIF_HL_GET_APP_CB_PTR(i);
@@ -1124,6 +1129,9 @@
     BOOLEAN found=FALSE;
     UINT8 i,j,k;
 
+    *p_app_idx = 0;
+    *p_mcl_idx =0;
+    *p_mdl_idx = 0;
     for (i=0; i < BTA_HL_NUM_APPS ; i ++)
     {
         p_acb =BTIF_HL_GET_APP_CB_PTR(i);
@@ -1278,6 +1286,7 @@
     btif_hl_app_cb_t  *p_acb =BTIF_HL_GET_APP_CB_PTR(app_idx);
     btif_hl_mcl_cb_t  *p_mcb;
 
+    *p_mcl_idx = 0;
     for (i=0; i < BTA_HL_NUM_MCLS ; i ++)
     {
         p_mcb = BTIF_HL_GET_MCL_CB_PTR(app_idx, i);
@@ -1539,6 +1548,7 @@
             *p = BTA_HL_MDEP_ROLE_SINK;
             break;
         default:
+            *p = BTA_HL_MDEP_ROLE_SOURCE;
             status = FALSE;
             break;
     }
@@ -1698,6 +1708,7 @@
     BOOLEAN found=FALSE;
     UINT8 i;
 
+    *p_app_idx = 0;
     for (i=0; i < BTA_HL_NUM_APPS ; i ++)
     {
         if (btif_hl_cb.acb[i].in_use &&
@@ -1980,6 +1991,7 @@
     BOOLEAN found=FALSE;
     UINT8 i;
 
+    *p_app_idx = 0;
     for (i=0; i < BTA_HL_NUM_APPS ; i ++)
     {
         BTIF_TRACE_DEBUG("btif_hl_find_app_idx_using_mdepId: MDEP-ID = %d",
@@ -2567,7 +2579,6 @@
     BOOLEAN                  status = FALSE;
     tBTA_HL_DCH_OPEN_PARAM   dch_open;
 
-
     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
 
     if (btif_hl_find_app_idx_using_app_id(p_data->cch_open_cfm.app_id, &app_idx))
@@ -4063,7 +4074,7 @@
 **
 *******************************************************************************/
 static bt_status_t destroy_channel(int channel_id){
-    UINT8 app_idx, mcl_idx, mdl_idx, mdl_cfg_idx, app_id, mdep_cfg_idx;
+    UINT8 app_idx, mcl_idx, mdl_idx, mdl_cfg_idx, app_id, mdep_cfg_idx = 0;
     bt_status_t status = BT_STATUS_SUCCESS;
     btif_hl_mdl_cfg_t     *p_mdl;
     btif_hl_mcl_cb_t     *p_mcb;
diff --git a/btif/src/btif_mce.c b/btif/src/btif_mce.c
new file mode 100644
index 0000000..2ec2d41
--- /dev/null
+++ b/btif/src/btif_mce.c
@@ -0,0 +1,177 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2014 The Android Open Source Project
+ *  Copyright (C) 2009-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/************************************************************************************
+ *
+ *  Filename:      btif_mce.c
+ *
+ *  Description:   Message Access Profile (MCE role) Bluetooth Interface
+ *
+ *
+ ***********************************************************************************/
+
+#include <hardware/bluetooth.h>
+#include <hardware/bt_mce.h>
+#include <stdlib.h>
+
+#define LOG_TAG "BTIF_MCE"
+#include "btif_common.h"
+#include "btif_util.h"
+#include "btif_profile_queue.h"
+#include "bta_api.h"
+#include "bta_mce_api.h"
+
+#include "bd.h"
+
+/*****************************************************************************
+**  Static variables
+******************************************************************************/
+
+static btmce_callbacks_t *bt_mce_callbacks = NULL;
+
+static void btif_mce_mas_discovery_comp_evt(UINT16 event, char *p_param)
+{
+    tBTA_MCE_MAS_DISCOVERY_COMP *evt_data = (tBTA_MCE_MAS_DISCOVERY_COMP*) p_param;
+    btmce_mas_instance_t insts[BTA_MCE_MAX_MAS_INSTANCES];
+    bt_bdaddr_t addr;
+    int i;
+
+    BTIF_TRACE_EVENT("%s:  event = %d", __FUNCTION__, event);
+
+    if (event != BTA_MCE_MAS_DISCOVERY_COMP_EVT)
+        return;
+
+    for (i = 0; i < evt_data->num_mas; i++)
+    {
+        insts[i].id = evt_data->mas[i].instance_id;
+        insts[i].scn = evt_data->mas[i].scn;
+        insts[i].msg_types = evt_data->mas[i].msg_type;
+        insts[i].p_name = evt_data->mas[i].p_srv_name;
+    }
+
+    bdcpy(addr.address, evt_data->remote_addr);
+
+    HAL_CBACK(bt_mce_callbacks, remote_mas_instances_cb, evt_data->status, &addr, evt_data->num_mas, insts);
+}
+
+static void mas_discovery_comp_copy_cb(UINT16 event, char *p_dest, char *p_src)
+{
+    tBTA_MCE_MAS_DISCOVERY_COMP *p_dest_data =  (tBTA_MCE_MAS_DISCOVERY_COMP *) p_dest;
+    tBTA_MCE_MAS_DISCOVERY_COMP *p_src_data =  (tBTA_MCE_MAS_DISCOVERY_COMP *) p_src;
+    char *p_dest_str;
+    int i;
+
+    if (!p_src)
+        return;
+
+    if (event != BTA_MCE_MAS_DISCOVERY_COMP_EVT)
+        return;
+
+    memcpy(p_dest_data, p_src_data, sizeof(tBTA_MCE_MAS_DISCOVERY_COMP));
+
+    p_dest_str = p_dest + sizeof(tBTA_MCE_MAS_DISCOVERY_COMP);
+
+    for (i = 0; i < p_src_data->num_mas; i++)
+    {
+        p_dest_data->mas[i].p_srv_name = p_dest_str;
+        memcpy(p_dest_str, p_src_data->mas[i].p_srv_name, p_src_data->mas[i].srv_name_len);
+        p_dest_str += p_src_data->mas[i].srv_name_len;
+        *(p_dest_str++) = '\0';
+    }
+}
+
+static void mce_dm_cback(tBTA_MCE_EVT event, tBTA_MCE *p_data, void *user_data)
+{
+    switch (event)
+    {
+        case BTA_MCE_MAS_DISCOVERY_COMP_EVT:
+            {
+                int i;
+                UINT16 param_len = sizeof(tBTA_MCE);
+
+                /* include space for all p_srv_name copies including null-termination */
+                for (i = 0; i < p_data->mas_disc_comp.num_mas; i++)
+                    param_len += (p_data->mas_disc_comp.mas[i].srv_name_len + 1);
+
+                /* need to deepy copy p_srv_name and null-terminate */
+                btif_transfer_context(btif_mce_mas_discovery_comp_evt, event,
+                                        (char*)p_data, param_len, mas_discovery_comp_copy_cb);
+
+                break;
+            }
+    }
+}
+
+static bt_status_t init(btmce_callbacks_t* callbacks)
+{
+    BTIF_TRACE_EVENT("%s", __FUNCTION__);
+
+    bt_mce_callbacks = callbacks;
+
+    btif_enable_service(BTA_MAP_SERVICE_ID);
+
+    return BT_STATUS_SUCCESS;
+}
+
+static bt_status_t get_remote_mas_instances(bt_bdaddr_t *bd_addr)
+{
+    bdstr_t bdstr;
+
+    BTIF_TRACE_EVENT("%s: remote_addr=%s", __FUNCTION__, bd2str(bd_addr, &bdstr));
+
+    BTA_MceGetRemoteMasInstances(bd_addr->address);
+
+    return BT_STATUS_SUCCESS;
+}
+
+static const btmce_interface_t mce_if = {
+    sizeof(btmce_interface_t),
+    init,
+    get_remote_mas_instances,
+};
+
+const btmce_interface_t *btif_mce_get_interface(void)
+{
+    BTIF_TRACE_EVENT("%s", __FUNCTION__);
+    return &mce_if;
+}
+
+/*******************************************************************************
+**
+** Function         btif_mce_execute_service
+**
+** Description      Initializes/Shuts down the service
+**
+** Returns          BT_STATUS_SUCCESS on success, BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bt_status_t btif_mce_execute_service(BOOLEAN b_enable)
+{
+    BTIF_TRACE_EVENT("%s enable:%d", __FUNCTION__, b_enable);
+
+     if (b_enable)
+     {
+         BTA_MceEnable(mce_dm_cback);
+     }
+     else
+     {
+         /* This is called on BT disable so no need to extra cleanup */
+     }
+     return BT_STATUS_SUCCESS;
+}
diff --git a/btif/src/btif_media_task.c b/btif/src/btif_media_task.c
index 6ba45dc..4de63bc 100644
--- a/btif/src/btif_media_task.c
+++ b/btif/src/btif_media_task.c
@@ -1737,7 +1737,7 @@
 {
     BT_HDR *p_buf;
 
-    if (GKI_IS_QUEUE_EMPTY(&(btif_media_cb.RxSbcQ))== TRUE) /*  Que is already empty */
+    if (GKI_queue_is_empty(&(btif_media_cb.RxSbcQ))== TRUE) /*  Que is already empty */
         return TRUE;
 
     if (NULL == (p_buf = GKI_getbuf(sizeof(BT_HDR))))
diff --git a/btif/src/btif_pan.c b/btif/src/btif_pan.c
index cc3799e..088c609 100644
--- a/btif/src/btif_pan.c
+++ b/btif/src/btif_pan.c
@@ -214,16 +214,20 @@
 
 static volatile int btpan_dev_local_role;
 static tBTA_PAN_ROLE_INFO bta_panu_info = {PANU_SERVICE_NAME, 0, PAN_SECURITY};
-static tBTA_PAN_ROLE_INFO bta_pan_nap_info = {PAN_NAP_SERVICE_NAME, 0, PAN_SECURITY};
+static tBTA_PAN_ROLE_INFO bta_pan_nap_info = {PAN_NAP_SERVICE_NAME, 1, PAN_SECURITY};
 
 static bt_status_t btpan_enable(int local_role)
 {
     int bta_pan_role;
     BTIF_TRACE_DEBUG("local_role:%d", local_role);
     bta_pan_role = btpan_role_to_bta(local_role);
+#if BTA_PAN_INCLUDED == TRUE
     BTA_PanSetRole(bta_pan_role, &bta_panu_info, NULL, &bta_pan_nap_info);
     btpan_dev_local_role = local_role;
     return BT_STATUS_SUCCESS;
+#else
+    return BT_STATUS_FAIL;
+#endif
 }
 
 static int btpan_get_local_role()
@@ -326,6 +330,16 @@
     /*         ifr.ifr_hwaddr.sa_data[0], ifr.ifr_hwaddr.sa_data[1], ifr.ifr_hwaddr.sa_data[2], */
     /*         ifr.ifr_hwaddr.sa_data[3], ifr.ifr_hwaddr.sa_data[4], ifr.ifr_hwaddr.sa_data[5]); */
 
+    /* The IEEE has specified that the most significant bit of the most significant byte is used to
+     * determine a multicast address. If its a 1, that means multicast, 0 means unicast.
+     * Kernel returns an error if we try to set a multicast address for the tun-tap ethernet interface.
+     * Mask this bit to avoid any issue with auto generated address.
+     */
+    if (ifr.ifr_hwaddr.sa_data[0] & 0x01) {
+        BTIF_TRACE_WARNING("Not a unicast MAC address, force multicast bit flipping");
+        ifr.ifr_hwaddr.sa_data[0] &= ~0x01;
+    }
+
     err = ioctl(sk, SIOCSIFHWADDR, (caddr_t)&ifr);
 
     if (err < 0) {
diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index a651518..de6c328 100644
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -775,16 +775,16 @@
         {
             BTIF_TRACE_DEBUG("Peer_features:%x", p_data->rc_open.peer_features);
             handle_rc_connect( &(p_data->rc_open) );
-        }
-        break;
+        }break;
+
         case BTA_AV_RC_CLOSE_EVT:
         {
             handle_rc_disconnect( &(p_data->rc_close) );
-        }
-        break;
+        }break;
+
         case BTA_AV_REMOTE_CMD_EVT:
         {
-            BTIF_TRACE_DEBUG("CMD: rc_id:0x%x key_state:%d", p_data->remote_cmd.rc_id,
+            BTIF_TRACE_DEBUG("rc_id:0x%x key_state:%d", p_data->remote_cmd.rc_id,
                                p_data->remote_cmd.key_state);
             handle_rc_passthrough_cmd( (&p_data->remote_cmd) );
         }
diff --git a/btif/src/btif_sock_rfc.c b/btif/src/btif_sock_rfc.c
index 698191f..5f27507 100644
--- a/btif/src/btif_sock_rfc.c
+++ b/btif/src/btif_sock_rfc.c
@@ -280,26 +280,35 @@
                                         int open_handle, int new_listen_handle)
 {
     rfc_slot_t *accept_rs = alloc_rfc_slot(addr, srv_rs->service_name, srv_rs->service_uuid, srv_rs->scn, 0, FALSE);
-    clear_slot_flag(&accept_rs->f);
-    accept_rs->f.server = FALSE;
-    accept_rs->f.connected = TRUE;
-    accept_rs->security = srv_rs->security;
-    accept_rs->mtu = srv_rs->mtu;
-    accept_rs->role = srv_rs->role;
-    accept_rs->rfc_handle = open_handle;
-    accept_rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(open_handle);
-     //now update listen rfc_handle of server slot
-    srv_rs->rfc_handle = new_listen_handle;
-    srv_rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(new_listen_handle);
-    BTIF_TRACE_DEBUG("create_srv_accept__rfc_slot(open_handle: 0x%x, new_listen_handle:"
-            "0x%x) accept_rs->rfc_handle:0x%x, srv_rs_listen->rfc_handle:0x%x"
-      ,open_handle, new_listen_handle, accept_rs->rfc_port_handle, srv_rs->rfc_port_handle);
-    asrt(accept_rs->rfc_port_handle != srv_rs->rfc_port_handle);
-  //now swap the slot id
-    uint32_t new_listen_id = accept_rs->id;
-    accept_rs->id = srv_rs->id;
-    srv_rs->id = new_listen_id;
-    return accept_rs;
+    if( accept_rs)
+    {
+        clear_slot_flag(&accept_rs->f);
+        accept_rs->f.server = FALSE;
+        accept_rs->f.connected = TRUE;
+        accept_rs->security = srv_rs->security;
+        accept_rs->mtu = srv_rs->mtu;
+        accept_rs->role = srv_rs->role;
+        accept_rs->rfc_handle = open_handle;
+        accept_rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(open_handle);
+        //now update listen rfc_handle of server slot
+        srv_rs->rfc_handle = new_listen_handle;
+        srv_rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(new_listen_handle);
+        BTIF_TRACE_DEBUG("create_srv_accept__rfc_slot(open_handle: 0x%x, new_listen_handle:"
+                "0x%x) accept_rs->rfc_handle:0x%x, srv_rs_listen->rfc_handle:0x%x"
+                ,open_handle, new_listen_handle, accept_rs->rfc_port_handle, srv_rs->rfc_port_handle);
+        asrt(accept_rs->rfc_port_handle != srv_rs->rfc_port_handle);
+        //now swap the slot id
+        uint32_t new_listen_id = accept_rs->id;
+        accept_rs->id = srv_rs->id;
+        srv_rs->id = new_listen_id;
+
+        return accept_rs;
+    }
+    else
+    {
+        APPL_TRACE_ERROR(" accept_rs is NULL %s", __FUNCTION__);
+        return NULL;
+    }
 }
 bt_status_t btsock_rfc_listen(const char* service_name, const uint8_t* service_uuid, int channel,
                             int* sock_fd, int flags)
@@ -331,7 +340,7 @@
     if(rs)
     {
         APPL_TRACE_DEBUG("BTA_JvCreateRecordByUser:%s", service_name);
-        BTA_JvCreateRecordByUser((void *)rs->id);
+        BTA_JvCreateRecordByUser((void *)(intptr_t)rs->id);
         *sock_fd = rs->app_fd;
         rs->app_fd = -1; //the fd ownership is transferred to app
         status = BT_STATUS_SUCCESS;
@@ -361,7 +370,7 @@
         {
             APPL_TRACE_DEBUG("connecting to rfcomm channel:%d without service discovery", channel);
             if(BTA_JvRfcommConnect(rs->security, rs->role, rs->scn, rs->addr.address,
-                        rfcomm_cback, (void*)rs->id) == BTA_JV_SUCCESS)
+                        rfcomm_cback, (void*)(intptr_t)rs->id) == BTA_JV_SUCCESS)
             {
                 if(send_app_scn(rs))
                 {
@@ -387,7 +396,7 @@
             rfc_slot_t* rs_doing_sdp = find_rfc_slot_requesting_sdp();
             if(rs_doing_sdp == NULL)
             {
-                BTA_JvStartDiscovery((UINT8*)bd_addr->address, 1, &sdp_uuid, (void*)rs->id);
+                BTA_JvStartDiscovery((UINT8*)bd_addr->address, 1, &sdp_uuid, (void*)(intptr_t)rs->id);
                 rs->f.pending_sdp_request = FALSE;
                 rs->f.doing_sdp_request = TRUE;
             }
@@ -470,7 +479,7 @@
     {
         if(rs->f.server && !rs->f.closing && rs->rfc_handle)
         {
-            BTA_JvRfcommStopServer(rs->rfc_handle, (void*)rs->id);
+            BTA_JvRfcommStopServer(rs->rfc_handle, (void*)(uintptr_t)rs->id);
             rs->rfc_handle = 0;
         }
         if(rs->f.server)
@@ -500,7 +509,7 @@
     if(rs->rfc_handle && !rs->f.closing && !rs->f.server)
     {
         APPL_TRACE_DEBUG("closing rfcomm connection, rfc_handle:0x%x", rs->rfc_handle);
-        BTA_JvRfcommClose(rs->rfc_handle, (void*)rs->id);
+        BTA_JvRfcommClose(rs->rfc_handle, (void*)(uintptr_t)rs->id);
         rs->rfc_handle = 0;
     }
     free_rfc_slot_scn(rs);
@@ -685,25 +694,25 @@
     switch (event)
     {
     case BTA_JV_RFCOMM_START_EVT:
-        on_srv_rfc_listen_started(&p_data->rfc_start, (uint32_t)user_data);
+        on_srv_rfc_listen_started(&p_data->rfc_start, (uintptr_t)user_data);
         break;
 
     case BTA_JV_RFCOMM_CL_INIT_EVT:
-        on_cl_rfc_init(&p_data->rfc_cl_init, (uint32_t)user_data);
+        on_cl_rfc_init(&p_data->rfc_cl_init, (uintptr_t)user_data);
         break;
 
     case BTA_JV_RFCOMM_OPEN_EVT:
         BTA_JvSetPmProfile(p_data->rfc_open.handle,BTA_JV_PM_ID_1,BTA_JV_CONN_OPEN);
-        on_cli_rfc_connect(&p_data->rfc_open, (uint32_t)user_data);
+        on_cli_rfc_connect(&p_data->rfc_open, (uintptr_t)user_data);
         break;
     case BTA_JV_RFCOMM_SRV_OPEN_EVT:
         BTA_JvSetPmProfile(p_data->rfc_srv_open.handle,BTA_JV_PM_ALL,BTA_JV_CONN_OPEN);
-        new_user_data = (void*)on_srv_rfc_connect(&p_data->rfc_srv_open, (uint32_t)user_data);
+        new_user_data = (void*)(intptr_t)on_srv_rfc_connect(&p_data->rfc_srv_open, (uintptr_t)user_data);
         break;
 
     case BTA_JV_RFCOMM_CLOSE_EVT:
-        APPL_TRACE_DEBUG("BTA_JV_RFCOMM_CLOSE_EVT: user_data:%d", (uint32_t)user_data);
-        on_rfc_close(&p_data->rfc_close, (uint32_t)user_data);
+        APPL_TRACE_DEBUG("BTA_JV_RFCOMM_CLOSE_EVT: user_data:%d", (uintptr_t)user_data);
+        on_rfc_close(&p_data->rfc_close, (uintptr_t)user_data);
         break;
 
     case BTA_JV_RFCOMM_READ_EVT:
@@ -711,7 +720,7 @@
         break;
 
     case BTA_JV_RFCOMM_WRITE_EVT:
-        on_rfc_write_done(&p_data->rfc_write, (uint32_t)user_data);
+        on_rfc_write_done(&p_data->rfc_write, (uintptr_t)user_data);
         break;
 
     case BTA_JV_RFCOMM_DATA_IND_EVT:
@@ -720,10 +729,10 @@
 
     case BTA_JV_RFCOMM_CONG_EVT:
         //on_rfc_cong(&p_data->rfc_cong);
-        on_rfc_outgoing_congest(&p_data->rfc_cong, (uint32_t)user_data);
+        on_rfc_outgoing_congest(&p_data->rfc_cong, (uintptr_t)user_data);
         break;
     default:
-        APPL_TRACE_ERROR("unhandled event %d, slot id:%d", event, (uint32_t)user_data);
+        APPL_TRACE_ERROR("unhandled event %d, slot id:%d", event, (uintptr_t)user_data);
         break;
     }
     return new_user_data;
@@ -731,7 +740,7 @@
 
 static void jv_dm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data)
 {
-    uint32_t id = (uint32_t)user_data;
+    uint32_t id = (uintptr_t)user_data;
     APPL_TRACE_DEBUG("jv_dm_cback: event:%d, slot id:%d", event, id);
     switch(event)
     {
@@ -743,7 +752,7 @@
                 {
                     //now start the rfcomm server after sdp & channel # assigned
                     BTA_JvRfcommStartServer(rs->security, rs->role, rs->scn, MAX_RFC_SESSION, rfcomm_cback,
-                                            (void*)rs->id);
+                                            (void*)(uintptr_t)rs->id);
                 }
                 else if(rs)
                 {
@@ -766,7 +775,7 @@
                     if(rs && rs->f.doing_sdp_request)
                     {
                         if(BTA_JvRfcommConnect(rs->security, rs->role, p_data->disc_comp.scn, rs->addr.address,
-                                    rfcomm_cback, (void*)rs->id) == BTA_JV_SUCCESS)
+                                    rfcomm_cback, (void*)(uintptr_t)rs->id) == BTA_JV_SUCCESS)
                         {
                             rs->scn = p_data->disc_comp.scn;
                             rs->f.doing_sdp_request = FALSE;
@@ -798,7 +807,7 @@
                     tSDP_UUID sdp_uuid;
                     sdp_uuid.len = 16;
                     memcpy(sdp_uuid.uu.uuid128, rs->service_uuid, sizeof(sdp_uuid.uu.uuid128));
-                    BTA_JvStartDiscovery((UINT8*)rs->addr.address, 1, &sdp_uuid, (void*)rs->id);
+                    BTA_JvStartDiscovery((UINT8*)rs->addr.address, 1, &sdp_uuid, (void*)(uintptr_t)rs->id);
                     rs->f.pending_sdp_request = FALSE;
                     rs->f.doing_sdp_request = TRUE;
                 }
@@ -936,7 +945,7 @@
 
 int bta_co_rfc_data_incoming(void *user_data, BT_HDR *p_buf)
 {
-    uint32_t id = (uint32_t)user_data;
+    uint32_t id = (uintptr_t)user_data;
     int ret = 0;
     lock_slot(&slot_lock);
     rfc_slot_t* rs = find_rfc_slot_by_id(id);
@@ -972,7 +981,7 @@
 }
 int bta_co_rfc_data_outgoing_size(void *user_data, int *size)
 {
-    uint32_t id = (uint32_t)user_data;
+    uint32_t id = (uintptr_t)user_data;
     int ret = FALSE;
     *size = 0;
     lock_slot(&slot_lock);
@@ -996,7 +1005,7 @@
 }
 int bta_co_rfc_data_outgoing(void *user_data, UINT8* buf, UINT16 size)
 {
-    uint32_t id = (uint32_t)user_data;
+    uint32_t id = (uintptr_t)user_data;
     int ret = FALSE;
     lock_slot(&slot_lock);
     rfc_slot_t* rs = find_rfc_slot_by_id(id);
diff --git a/btif/src/btif_sock_thread.c b/btif/src/btif_sock_thread.c
index 0bff884..687a1c5 100644
--- a/btif/src/btif_sock_thread.c
+++ b/btif/src/btif_sock_thread.c
@@ -232,7 +232,7 @@
     if(h >= 0)
     {
         init_poll(h);
-        if((ts[h].thread_id = create_thread(sock_poll_thread, (void*)h)) != -1)
+        if((ts[h].thread_id = create_thread(sock_poll_thread, (void*)(uintptr_t)h)) != -1)
         {
             APPL_TRACE_DEBUG("h:%d, thread id:%d", h, ts[h].thread_id);
             ts[h].callback = callback;
@@ -556,7 +556,7 @@
 {
     struct pollfd pfds[MAX_POLL];
     memset(pfds, 0, sizeof(pfds));
-    int h = (int)arg;
+    int h = (intptr_t)arg;
     for(;;)
     {
         prepare_poll_fds(h, pfds);
diff --git a/btif/src/btif_storage.c b/btif/src/btif_storage.c
index 63dc030..d3ecc45 100644
--- a/btif/src/btif_storage.c
+++ b/btif/src/btif_storage.c
@@ -457,12 +457,20 @@
                 bt_linkkey_file_found = FALSE;
             }
         }
+#if (BLE_INCLUDED == TRUE)
         if((btif_in_fetch_bonded_ble_device(bdstr, FALSE, NULL) != BT_STATUS_SUCCESS)
                 && (!bt_linkkey_file_found))
         {
             BTIF_TRACE_DEBUG("Remote device:%s, no link key or ble key found", bdstr);
             return BT_STATUS_FAIL;
         }
+#else
+        if((!bt_linkkey_file_found))
+        {
+            BTIF_TRACE_DEBUG("Remote device:%s, no link key found", bdstr);
+            return BT_STATUS_FAIL;
+        }
+#endif
     return BT_STATUS_SUCCESS;
 }
 
diff --git a/gki/Android.mk b/gki/Android.mk
index f2611c1..b85e344 100644
--- a/gki/Android.mk
+++ b/gki/Android.mk
@@ -1,5 +1,3 @@
-ifneq ($(TARGET_SIMULATOR),true)
-
 LOCAL_PATH:= $(call my-dir)
 
 include $(CLEAR_VARS)
@@ -29,7 +27,6 @@
 LOCAL_MODULE := libbt-brcm_gki
 LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := STATIC_LIBRARIES
+LOCAL_MULTILIB := 32
 
 include $(BUILD_STATIC_LIBRARY)
-
-endif  # TARGET_SIMULATOR != true
diff --git a/gki/common/gki.h b/gki/common/gki.h
index 406b060..0382e2d 100644
--- a/gki/common/gki.h
+++ b/gki/common/gki.h
@@ -146,14 +146,11 @@
 GKI_API extern void    GKI_init(void);
 GKI_API extern void    GKI_shutdown(void);
 GKI_API extern INT8   *GKI_map_taskname(UINT8);
-GKI_API extern void    GKI_run(void *);
-GKI_API extern void    GKI_freeze(void);
+GKI_API extern void    GKI_run(void);
 GKI_API extern void    GKI_stop(void);
 
 /* To send buffers and events between tasks
 */
-GKI_API extern UINT8   GKI_isend_event (UINT8, UINT16);
-GKI_API extern void    GKI_isend_msg (UINT8, UINT8, void *);
 GKI_API extern void   *GKI_read_mbox  (UINT8);
 GKI_API extern void    GKI_send_msg   (UINT8, UINT8, void *);
 GKI_API extern UINT8   GKI_send_event (UINT8, UINT16);
@@ -188,9 +185,7 @@
 GKI_API extern void    GKI_add_to_timer_list (TIMER_LIST_Q *, TIMER_LIST_ENT  *);
 GKI_API extern void    GKI_delay(UINT32);
 GKI_API extern UINT32  GKI_get_tick_count(void);
-GKI_API extern INT8   *GKI_get_time_stamp(INT8 *);
 GKI_API extern void    GKI_init_timer_list (TIMER_LIST_Q *);
-GKI_API extern void    GKI_init_timer_list_entry (TIMER_LIST_ENT  *);
 GKI_API extern INT32   GKI_ready_to_sleep (void);
 GKI_API extern void    GKI_remove_from_timer_list (TIMER_LIST_Q *, TIMER_LIST_ENT  *);
 GKI_API extern void    GKI_start_timer(UINT8, INT32, BOOLEAN);
@@ -201,22 +196,7 @@
 GKI_API extern UINT16  GKI_wait(UINT16, UINT32);
 GKI_API extern BOOLEAN GKI_timer_queue_is_empty(const TIMER_LIST_Q *timer_q);
 GKI_API extern TIMER_LIST_ENT *GKI_timer_getfirst(const TIMER_LIST_Q *timer_q);
-GKI_API extern TIMER_LIST_ENT *GKI_timer_getlast(const TIMER_LIST_Q *timer_q);
-GKI_API extern INT32 GKI_timer_ticks_getlast(const TIMER_LIST_Q *timer_q);
-GKI_API extern TIMER_LIST_ENT *GKI_timer_entry_next(const TIMER_LIST_ENT *tle);
-GKI_API extern INT32 GKI_timer_ticks_getcurrent(const TIMER_LIST_ENT *tle);
 GKI_API extern INT32 GKI_timer_ticks_getinitial(const TIMER_LIST_ENT *tle);
-GKI_API extern BOOLEAN GKI_timer_in_use(const TIMER_LIST_ENT *tle);
-
-/* Start and Stop system time tick callback
- * true for start system tick if time queue is not empty
- * false to stop system tick if time queue is empty
-*/
-typedef void (SYSTEM_TICK_CBACK)(BOOLEAN);
-
-/* Time queue management for system ticks
-*/
-GKI_API extern void    GKI_timer_queue_register_callback(SYSTEM_TICK_CBACK *);
 
 /* Disable Interrupts, Enable Interrupts
 */
diff --git a/gki/common/gki_buffer.c b/gki/common/gki_buffer.c
index 582f3aa..84625ac 100644
--- a/gki/common/gki_buffer.c
+++ b/gki/common/gki_buffer.c
@@ -1166,71 +1166,6 @@
     return ((UINT16)(Q->total - Q->cur_cnt));
 }
 
-#if (defined(GKI_SEND_MSG_FROM_ISR) &&  GKI_SEND_MSG_FROM_ISR == TRUE)
-/*******************************************************************************
-**
-** Function         GKI_isend_msg
-**
-** Description      Called from interrupt context to send a buffer to a task
-**
-** Returns          Nothing
-**
-*******************************************************************************/
-void GKI_isend_msg (UINT8 task_id, UINT8 mbox, void *msg)
-{
-    BUFFER_HDR_T    *p_hdr;
-    tGKI_COM_CB *p_cb = &gki_cb.com;
-
-    /* If task non-existant or not started, drop buffer */
-    if ((task_id >= GKI_MAX_TASKS) || (mbox >= NUM_TASK_MBOX) || (p_cb->OSRdyTbl[task_id] == TASK_DEAD))
-    {
-        GKI_exception(GKI_ERROR_SEND_MSG_BAD_DEST, "Sending to unknown dest");
-        GKI_freebuf (msg);
-        return;
-    }
-
-#if (GKI_ENABLE_BUF_CORRUPTION_CHECK == TRUE)
-    if (gki_chk_buf_damage(msg))
-    {
-        GKI_exception(GKI_ERROR_BUF_CORRUPTED, "Send - Buffer corrupted");
-        return;
-    }
-#endif
-
-#if (GKI_ENABLE_OWNER_CHECK == TRUE)
-    if (gki_chk_buf_owner(msg))
-    {
-        GKI_exception(GKI_ERROR_NOT_BUF_OWNER, "Send by non-owner");
-        return;
-    }
-#endif
-
-    p_hdr = (BUFFER_HDR_T *) ((UINT8 *) msg - BUFFER_HDR_SIZE);
-
-    if (p_hdr->status != BUF_STATUS_UNLINKED)
-    {
-        GKI_exception(GKI_ERROR_SEND_MSG_BUF_LINKED, "Send - buffer linked");
-        return;
-    }
-
-    if (p_cb->OSTaskQFirst[task_id][mbox])
-        p_cb->OSTaskQLast[task_id][mbox]->p_next = p_hdr;
-    else
-        p_cb->OSTaskQFirst[task_id][mbox] = p_hdr;
-
-    p_cb->OSTaskQLast[task_id][mbox] = p_hdr;
-
-    p_hdr->p_next = NULL;
-    p_hdr->status = BUF_STATUS_QUEUED;
-    p_hdr->task_id = task_id;
-
-    GKI_isend_event(task_id, (UINT16)EVENT_MASK(mbox));
-
-    return;
-}
-#endif
-
-
 /*******************************************************************************
 **
 ** Function         GKI_get_pool_bufsize
diff --git a/gki/common/gki_common.h b/gki/common/gki_common.h
index d94a3a2..042024e1 100644
--- a/gki/common/gki_common.h
+++ b/gki/common/gki_common.h
@@ -267,9 +267,6 @@
     /* Timer related variables
     */
     INT32   OSTicksTilExp;      /* Number of ticks till next timer expires */
-#if (defined(GKI_DELAY_STOP_SYS_TICK) && (GKI_DELAY_STOP_SYS_TICK > 0))
-    UINT32  OSTicksTilStop;     /* inactivity delay timer; OS Ticks till stopping system tick */
-#endif
     INT32   OSNumOrigTicks;     /* Number of ticks between last timer expiration to the next one */
 
     INT32   OSWaitTmr   [GKI_MAX_TASKS];  /* ticks the task has to wait, for specific events */
@@ -324,10 +321,6 @@
 
     BOOLEAN     timer_nesting;                      /* flag to prevent timer interrupt nesting */
 
-    /* System tick callback */
-    SYSTEM_TICK_CBACK *p_tick_cb;
-    BOOLEAN     system_tick_running;                /* TRUE if system tick is running. Valid only if p_tick_cb is not NULL */
-
 #if (GKI_DEBUG == TRUE)
     UINT16      ExceptionCnt;                       /* number of GKI exceptions that have happened */
     EXCEPTION_T Exception[GKI_MAX_EXCEPTION];
diff --git a/gki/common/gki_time.c b/gki/common/gki_time.c
index fcb2235..1a15549 100644
--- a/gki/common/gki_time.c
+++ b/gki/common/gki_time.c
@@ -20,10 +20,6 @@
 #include <utils/Log.h>
 #include "gki_int.h"
 
-#ifndef BT_ERROR_TRACE_0
-#define BT_ERROR_TRACE_0(l,m)
-#endif
-
 /* Make sure that this has been defined in target.h */
 #ifndef GKI_NUM_TIMERS
 #error  NO TIMERS: Must define at least 1 timer in the system!
@@ -33,8 +29,6 @@
 #define GKI_NO_NEW_TMRS_STARTED (0x7fffffffL)   /* Largest signed positive timer count */
 #define GKI_UNUSED_LIST_ENTRY   (0x80000000L)   /* Marks an unused timer list entry (initial value) */
 
-#define GKI_ERROR(fmt, ...)  ALOGE ("ERROR : %s: " fmt, __FUNCTION__, ## __VA_ARGS__)
-
 // Used for controlling alarms from AlarmService.
 extern void alarm_service_reschedule(void);
 
@@ -54,9 +48,6 @@
 
     gki_cb.com.OSTicksTilExp = 0;       /* Remaining time (of OSTimeCurTimeout) before next timer expires */
     gki_cb.com.OSNumOrigTicks = 0;
-#if (defined(GKI_DELAY_STOP_SYS_TICK) && (GKI_DELAY_STOP_SYS_TICK > 0))
-    gki_cb.com.OSTicksTilStop = 0;      /* clear inactivity delay timer */
-#endif
 
     for (tt = 0; tt < GKI_MAX_TASKS; tt++)
     {
@@ -83,9 +74,6 @@
 #endif
     }
 
-    gki_cb.com.p_tick_cb = NULL;
-    gki_cb.com.system_tick_running = FALSE;
-
     return;
 }
 
@@ -216,28 +204,6 @@
 
     GKI_disable();
 
-    if(gki_timers_is_timer_running() == FALSE)
-    {
-#if (defined(GKI_DELAY_STOP_SYS_TICK) && (GKI_DELAY_STOP_SYS_TICK > 0))
-        /* if inactivity delay timer is not running, start system tick */
-        if(gki_cb.com.OSTicksTilStop == 0)
-        {
-#endif
-            if(gki_cb.com.p_tick_cb)
-            {
-                /* start system tick */
-                gki_cb.com.system_tick_running = TRUE;
-                (gki_cb.com.p_tick_cb) (TRUE);
-            }
-#if (defined(GKI_DELAY_STOP_SYS_TICK) && (GKI_DELAY_STOP_SYS_TICK > 0))
-        }
-        else
-        {
-            /* clear inactivity delay timer */
-            gki_cb.com.OSTicksTilStop = 0;
-        }
-#endif
-    }
     /* Add the time since the last task timer update.
     ** Note that this works when no timers are active since
     ** both OSNumOrigTicks and OSTicksTilExp are 0.
@@ -340,31 +306,6 @@
             break;
 #endif
     }
-
-    GKI_disable();
-
-    if (gki_timers_is_timer_running() == FALSE)
-    {
-        if (gki_cb.com.p_tick_cb)
-        {
-#if (defined(GKI_DELAY_STOP_SYS_TICK) && (GKI_DELAY_STOP_SYS_TICK > 0))
-            /* if inactivity delay timer is not running */
-            if ((gki_cb.com.system_tick_running)&&(gki_cb.com.OSTicksTilStop == 0))
-            {
-                /* set inactivity delay timer */
-                /* when timer expires, system tick will be stopped */
-                gki_cb.com.OSTicksTilStop = GKI_DELAY_STOP_SYS_TICK;
-            }
-#else
-            gki_cb.com.system_tick_running = FALSE;
-            gki_cb.com.p_tick_cb(FALSE); /* stop system tick */
-#endif
-        }
-    }
-
-    GKI_enable();
-
-
 }
 
 
@@ -405,32 +346,12 @@
 
     gki_cb.com.timer_nesting = 1;
 
-#if (defined(GKI_DELAY_STOP_SYS_TICK) && (GKI_DELAY_STOP_SYS_TICK > 0))
-    /* if inactivity delay timer is set and expired */
-    if (gki_cb.com.OSTicksTilStop)
-    {
-        if( gki_cb.com.OSTicksTilStop <= (UINT32)ticks_since_last_update )
-        {
-            if(gki_cb.com.p_tick_cb)
-            {
-                gki_cb.com.system_tick_running = FALSE;
-                (gki_cb.com.p_tick_cb) (FALSE); /* stop system tick */
-            }
-            gki_cb.com.OSTicksTilStop = 0;      /* clear inactivity delay timer */
-            gki_cb.com.timer_nesting = 0;
-            return;
-        }
-        else
-            gki_cb.com.OSTicksTilStop -= ticks_since_last_update;
-    }
-#endif
-
     /* No need to update the ticks if no timeout has occurred */
     if (gki_cb.com.OSTicksTilExp > 0)
     {
         // When using alarms from AlarmService we should
         // always have work to be done here.
-        GKI_ERROR("No work to be done when expected work\n");
+        ALOGE("%s no work to be done when expected work", __func__);
         gki_cb.com.timer_nesting = 0;
         return;
     }
@@ -444,15 +365,12 @@
      */
     gki_cb.com.OSNumOrigTicks -= gki_cb.com.OSTicksTilExp;
 
-#if GKI_TIMER_LIST_NOPREEMPT == TRUE
     /* Protect this section because if a GKI_timer_stop happens between:
      *   - gki_cb.com.OSTaskTmr0[task_id] -= gki_cb.com.OSNumOrigTicks;
      *   - gki_cb.com.OSTaskTmr0[task_id] = gki_cb.com.OSTaskTmr0R[task_id];
      * then the timer may appear stopped while it is about to be reloaded.
-     * Note: Not needed if this function cannot be preempted (typical).
      */
     GKI_disable();
-#endif
 
     /* Check for OS Task Timers */
     for (task_id = 0; task_id < GKI_MAX_TASKS; task_id++)
@@ -477,12 +395,7 @@
             {
                 /* Reload timer and set Timer 0 Expired event mask */
                 gki_cb.com.OSTaskTmr0[task_id] = gki_cb.com.OSTaskTmr0R[task_id];
-
-#if (defined(GKI_TIMER_UPDATES_FROM_ISR) &&  GKI_TIMER_UPDATES_FROM_ISR == TRUE)
-                GKI_isend_event (task_id, TIMER_0_EVT_MASK);
-#else
                 GKI_send_event (task_id, TIMER_0_EVT_MASK);
-#endif
             }
         }
 
@@ -501,12 +414,7 @@
             {
                 /* Reload timer and set Timer 1 Expired event mask */
                 gki_cb.com.OSTaskTmr1[task_id] = gki_cb.com.OSTaskTmr1R[task_id];
-
-#if (defined(GKI_TIMER_UPDATES_FROM_ISR) &&  GKI_TIMER_UPDATES_FROM_ISR == TRUE)
-                GKI_isend_event (task_id, TIMER_1_EVT_MASK);
-#else
                 GKI_send_event (task_id, TIMER_1_EVT_MASK);
-#endif
             }
         }
 
@@ -525,12 +433,7 @@
             {
                 /* Reload timer and set Timer 2 Expired event mask */
                 gki_cb.com.OSTaskTmr2[task_id] = gki_cb.com.OSTaskTmr2R[task_id];
-
-#if (defined(GKI_TIMER_UPDATES_FROM_ISR) &&  GKI_TIMER_UPDATES_FROM_ISR == TRUE)
-                GKI_isend_event (task_id, TIMER_2_EVT_MASK);
-#else
                 GKI_send_event (task_id, TIMER_2_EVT_MASK);
-#endif
             }
         }
 
@@ -549,12 +452,7 @@
             {
                 /* Reload timer and set Timer 3 Expired event mask */
                 gki_cb.com.OSTaskTmr3[task_id] = gki_cb.com.OSTaskTmr3R[task_id];
-
-#if (defined(GKI_TIMER_UPDATES_FROM_ISR) &&  GKI_TIMER_UPDATES_FROM_ISR == TRUE)
-                GKI_isend_event (task_id, TIMER_3_EVT_MASK);
-#else
                 GKI_send_event (task_id, TIMER_3_EVT_MASK);
-#endif
             }
         }
 
@@ -577,12 +475,7 @@
     // Set alarm service for next alarm.
     alarm_service_reschedule();
 
-#if GKI_TIMER_LIST_NOPREEMPT == TRUE
-    /* End the critical section */
     GKI_enable();
-#endif
-
-//    GKI_ERROR("Timer expired - next expiration ticks:%ld\n", next_expiration);
 
     gki_cb.com.timer_nesting = 0;
 
@@ -591,26 +484,6 @@
 
 /*******************************************************************************
 **
-** Function         GKI_timer_queue_register_callback
-**
-** Description      This function is called by applications to register system tick
-**                  start/stop callback for time queues
-**
-**
-** Parameters       p_callback - (input) pointer to the system tick callback
-**
-** Returns          BOOLEAN
-**
-*******************************************************************************/
-void GKI_timer_queue_register_callback (SYSTEM_TICK_CBACK *p_callback)
-{
-    gki_cb.com.p_tick_cb = p_callback;
-
-    return;
-}
-
-/*******************************************************************************
-**
 ** Function         GKI_init_timer_list
 **
 ** Description      This function is called by applications when they
@@ -637,61 +510,12 @@
     return timer_q->p_first;
 }
 
-TIMER_LIST_ENT *GKI_timer_getlast(const TIMER_LIST_Q *timer_q) {
-    assert(timer_q != NULL);
-    return timer_q->p_last;
-}
-
-/* Returns the number of ticks of the last entry in the queue. */
-INT32 GKI_timer_ticks_getlast(const TIMER_LIST_Q *timer_q) {
-    assert(timer_q != NULL);
-    return timer_q->last_ticks;
-}
-
-/*******************************************************************************
-**
-** Function         GKI_init_timer_list_entry
-**
-** Description      This function is called by the applications when they
-**                  want to initialize a timer list entry. This must be
-**                  done prior to first use of the entry.
-**
-** Parameters       p_tle           - (input) pointer to a timer list queue entry
-**
-** Returns          void
-**
-*******************************************************************************/
-void GKI_init_timer_list_entry(TIMER_LIST_ENT *tle) {
-    tle->p_next  = NULL;
-    tle->p_prev  = NULL;
-    tle->ticks   = GKI_UNUSED_LIST_ENTRY;
-    tle->ticks_initial = 0;
-    tle->in_use  = FALSE;
-}
-
-/* Returns the next linked entry from this tle or NULL. */
-TIMER_LIST_ENT *GKI_timer_entry_next(const TIMER_LIST_ENT *tle) {
-    assert(tle != NULL);
-    return tle->p_next;
-}
-
-/* Returns the current number of ticks for this timer entry. */
-INT32 GKI_timer_ticks_getcurrent(const TIMER_LIST_ENT *tle) {
-    assert(tle != NULL);
-    return tle->ticks;
-}
-
 /* Returns the initial number of ticks for this timer entry. */
 INT32 GKI_timer_ticks_getinitial(const TIMER_LIST_ENT *tle) {
     assert(tle != NULL);
     return tle->ticks_initial;
 }
 
-BOOLEAN GKI_timer_in_use(const TIMER_LIST_ENT *tle) {
-    assert(tle != NULL);
-    return tle->in_use;
-}
-
 /*******************************************************************************
 **
 ** Function         GKI_update_timer_list
@@ -801,14 +625,9 @@
         }
         else
         {
-            BT_ERROR_TRACE_0(TRACE_LAYER_GKI, "GKI_get_remaining_ticks: No timer entry in the list");
             return(0);
         }
     }
-    else
-    {
-        BT_ERROR_TRACE_0(TRACE_LAYER_GKI, "GKI_get_remaining_ticks: timer entry is not active");
-    }
 
     return (rem_ticks);
 }
@@ -867,7 +686,7 @@
             if (p_temp == NULL)
             {
                 /* list is corrupted, exit to avoid crash */
-                GKI_ERROR("GKI_add_to_timer_list : Timerlist Q is empty");
+                ALOGE("%s: Timerlist Q is empty", __func__);
                 GKI_exception(GKI_ERROR_TIMER_LIST_CORRUPTED, "*** "
                         "GKI_add_to_timer_list(): timer list corrupted! ***");
                 return;
diff --git a/gki/ulinux/gki_int.h b/gki/ulinux/gki_int.h
index aa38848..ec9b1cb 100644
--- a/gki/ulinux/gki_int.h
+++ b/gki/ulinux/gki_int.h
@@ -61,18 +61,11 @@
     pthread_cond_t      thread_evt_cond[GKI_MAX_TASKS];
     pthread_mutex_t     thread_timeout_mutex[GKI_MAX_TASKS];
     pthread_cond_t      thread_timeout_cond[GKI_MAX_TASKS];
-    int                 no_timer_suspend;   /* 1: no suspend, 0 stop calling GKI_timer_update() */
-    pthread_mutex_t     gki_timer_mutex;
-    pthread_cond_t      gki_timer_cond;
 #if (GKI_DEBUG == TRUE)
     pthread_mutex_t     GKI_trace_mutex;
 #endif
 } tGKI_OS;
 
-/* condition to exit or continue GKI_run() timer loop */
-#define GKI_TIMER_TICK_RUN_COND 1
-#define GKI_TIMER_TICK_STOP_COND 0
-
 extern void gki_system_tick_start_stop_cback(BOOLEAN start);
 
 /* Contains common control block as well as OS specific variables */
diff --git a/gki/ulinux/gki_ulinux.c b/gki/ulinux/gki_ulinux.c
index 0b4706d..256a5ae 100644
--- a/gki/ulinux/gki_ulinux.c
+++ b/gki/ulinux/gki_ulinux.c
@@ -40,23 +40,6 @@
 **  Constants & Macros
 ******************************************************************************/
 
-#ifndef GKI_TICK_TIMER_DEBUG
-#define GKI_TICK_TIMER_DEBUG FALSE
-#endif
-
-#define GKI_VERBOSE(fmt, ...) ALOGV ("%s: " fmt, __FUNCTION__, ## __VA_ARGS__)
-#define GKI_INFO(fmt, ...) ALOGI ("%s: " fmt, __FUNCTION__, ## __VA_ARGS__)
-#define GKI_ERROR(fmt, ...) ALOGE ("%s: " fmt, __FUNCTION__, ## __VA_ARGS__)
-
-/* always log errors */
-#define GKI_ERROR_LOG(fmt, ...)  ALOGE ("##### ERROR : %s: " fmt "#####", __FUNCTION__, ## __VA_ARGS__)
-
-#if defined (GKI_TICK_TIMER_DEBUG) && (GKI_TICK_TIMER_DEBUG == TRUE)
-#define GKI_TIMER_TRACE(fmt, ...) ALOGI ("%s: " fmt, __FUNCTION__, ## __VA_ARGS__)
-#else
-#define GKI_TIMER_TRACE(fmt, ...)
-#endif
-
 #define SCHED_NORMAL 0
 #define SCHED_FIFO 1
 #define SCHED_RR 2
@@ -79,8 +62,6 @@
 **  Local type definitions
 ******************************************************************************/
 
-#define pthread_cond_timedwait_monotonic pthread_cond_timedwait
-
 typedef struct
 {
     UINT8 task_id;          /* GKI task id */
@@ -106,6 +87,9 @@
 // NOTE: Must be manipulated with the GKI_disable() lock held.
 static alarm_service_t alarm_service;
 
+static timer_t posix_timer;
+static bool timer_created;
+
 // If the next wakeup time is less than this threshold, we should acquire
 // a wakelock instead of setting a wake alarm so we're not bouncing in
 // and out of suspend frequently.
@@ -125,10 +109,32 @@
 **  Functions
 ******************************************************************************/
 
+static bool set_nonwake_alarm(uint64_t delay_millis) {
+  if (!timer_created) {
+    ALOGE("%s timer is not available, not setting timer for %llums", __func__, delay_millis);
+    return false;
+  }
+
+  struct timeval tv;
+  gettimeofday(&tv, NULL);
+
+  uint64_t millis = (tv.tv_sec * 1000LL) + (tv.tv_usec / 1000LL) + delay_millis;
+
+  struct itimerspec new_value;
+  memset(&new_value, 0, sizeof(new_value));
+  new_value.it_value.tv_sec = (millis / 1000);
+  new_value.it_value.tv_nsec = (millis % 1000) * 1000000LL;
+  if (timer_settime(posix_timer, TIMER_ABSTIME, &new_value, NULL) == -1) {
+    ALOGE("%s unable to set timer: %s", __func__, strerror(errno));
+    return false;
+  }
+
+  return true;
+}
+
 /** Callback from Java thread after alarm from AlarmService fires. */
 static void bt_alarm_cb(void *data) {
-    alarm_service_t *alarm_service = (alarm_service_t *)data;
-    GKI_timer_update(alarm_service->num_ticks);
+    GKI_timer_update(alarm_service.num_ticks);
 }
 
 /** NOTE: This is only called on init and may be called without the GKI_disable()
@@ -156,14 +162,14 @@
     // No more timers remaining. Release wakelock if we're holding one.
     if (ticks_till_next_exp == 0) {
         if (alarm_service.wakelock) {
-            GKI_VERBOSE("%s releasing wake lock.", __func__);
+            ALOGV("%s releasing wake lock.", __func__);
             alarm_service.wakelock = false;
             int rc = bt_os_callouts->release_wake_lock(WAKE_LOCK_ID);
             if (rc != BT_STATUS_SUCCESS) {
-                GKI_ERROR("%s unable to release wake lock with no timers: %d", __func__, rc);
+                ALOGE("%s unable to release wake lock with no timers: %d", __func__, rc);
             }
         }
-        GKI_VERBOSE("%s no more alarms.", __func__);
+        ALOGV("%s no more alarms.", __func__);
         return;
     }
 
@@ -175,20 +181,20 @@
         // The next deadline is close, just take a wakelock and set a regular (non-wake) timer.
         int rc = bt_os_callouts->acquire_wake_lock(WAKE_LOCK_ID);
         if (rc != BT_STATUS_SUCCESS) {
-            GKI_ERROR("%s unable to acquire wake lock: %d", __func__, rc);
+            ALOGE("%s unable to acquire wake lock: %d", __func__, rc);
             return;
         }
         alarm_service.wakelock = true;
-        GKI_VERBOSE("%s acquired wake lock, setting short alarm (%lldms).", __func__, ticks_in_millis);
-        if (!bt_os_callouts->set_wake_alarm(ticks_in_millis, false, bt_alarm_cb, &alarm_service)) {
-            GKI_ERROR("%s unable to set short alarm.", __func__);
+        ALOGV("%s acquired wake lock, setting short alarm (%lldms).", __func__, ticks_in_millis);
+        if (!set_nonwake_alarm(ticks_in_millis)) {
+            ALOGE("%s unable to set short alarm.", __func__);
         }
     } else {
         // The deadline is far away, set a wake alarm and release wakelock if we're holding it.
         if (!bt_os_callouts->set_wake_alarm(ticks_in_millis, true, bt_alarm_cb, &alarm_service)) {
-            GKI_ERROR("%s unable to set long alarm, releasing wake lock anyway.", __func__);
+            ALOGE("%s unable to set long alarm, releasing wake lock anyway.", __func__);
         } else {
-            GKI_VERBOSE("%s set long alarm (%lldms), releasing wake lock.", __func__, ticks_in_millis);
+            ALOGV("%s set long alarm (%lldms), releasing wake lock.", __func__, ticks_in_millis);
         }
         alarm_service.wakelock = false;
         bt_os_callouts->release_wake_lock(WAKE_LOCK_ID);
@@ -212,13 +218,13 @@
 
     prctl(PR_SET_NAME, (unsigned long)gki_cb.com.OSTName[p_pthread_info->task_id], 0, 0, 0);
 
-    GKI_INFO("gki_task_entry task_id=%i [%s] starting\n", p_pthread_info->task_id,
+    ALOGI("gki_task_entry task_id=%i [%s] starting\n", p_pthread_info->task_id,
                 gki_cb.com.OSTName[p_pthread_info->task_id]);
 
     /* Call the actual thread entry point */
     (p_pthread_info->task_entry)(p_pthread_info->params);
 
-    GKI_INFO("gki_task task_id=%i [%s] terminating\n", p_pthread_info->task_id,
+    ALOGI("gki_task task_id=%i [%s] terminating\n", p_pthread_info->task_id,
                 gki_cb.com.OSTName[p_pthread_info->task_id]);
 
     pthread_exit(0);    /* GKI tasks have no return value */
@@ -262,13 +268,17 @@
     /* pthread_mutex_init(&thread_delay_mutex, NULL); */  /* used in GKI_delay */
     /* pthread_cond_init (&thread_delay_cond, NULL); */
 
-    /* Initialiase GKI_timer_update suspend variables & mutexes to be in running state.
-     * this works too even if GKI_NO_TICK_STOP is defined in btld.txt */
-    p_os->no_timer_suspend = GKI_TIMER_TICK_RUN_COND;
-    pthread_mutex_init(&p_os->gki_timer_mutex, NULL);
-#ifndef NO_GKI_RUN_RETURN
-    pthread_cond_init(&p_os->gki_timer_cond, NULL);
-#endif
+    struct sigevent sigevent;
+    memset(&sigevent, 0, sizeof(sigevent));
+    sigevent.sigev_notify = SIGEV_THREAD;
+    sigevent.sigev_notify_function = (void (*)(union sigval))bt_alarm_cb;
+    sigevent.sigev_value.sival_ptr = NULL;
+    if (timer_create(CLOCK_REALTIME, &sigevent, &posix_timer) == -1) {
+        ALOGE("%s unable to create POSIX timer: %s", __func__, strerror(errno));
+        timer_created = false;
+    } else {
+        timer_created = true;
+    }
 }
 
 
@@ -320,7 +330,7 @@
 
     if (task_id >= GKI_MAX_TASKS)
     {
-        GKI_ERROR_LOG("Error! task ID > max task allowed");
+        ALOGE("Error! task ID > max task allowed");
         return (GKI_FAILURE);
     }
 
@@ -331,8 +341,12 @@
     gki_cb.com.OSWaitEvt[task_id]   = 0;
 
     /* Initialize mutex and condition variable objects for events and timeouts */
+    pthread_condattr_t cond_attr;
+    pthread_condattr_init(&cond_attr);
+    pthread_condattr_setclock(&cond_attr, CLOCK_MONOTONIC);
+
     pthread_mutex_init(&gki_cb.os.thread_evt_mutex[task_id], NULL);
-    pthread_cond_init (&gki_cb.os.thread_evt_cond[task_id], NULL);
+    pthread_cond_init (&gki_cb.os.thread_evt_cond[task_id], &cond_attr);
     pthread_mutex_init(&gki_cb.os.thread_timeout_mutex[task_id], NULL);
     pthread_cond_init (&gki_cb.os.thread_timeout_cond[task_id], NULL);
 
@@ -359,7 +373,7 @@
 
     if (ret != 0)
     {
-         GKI_ERROR_LOG("pthread_create failed(%d), %s!\n\r", ret, taskname);
+         ALOGE("pthread_create failed(%d), %s!", ret, taskname);
          return GKI_FAILURE;
     }
 
@@ -444,11 +458,11 @@
         result = pthread_join( gki_cb.os.thread_id[task_id], NULL );
         if ( result < 0 )
         {
-            GKI_ERROR_LOG( "pthread_join() FAILED: result: %d", result );
+            ALOGE( "pthread_join() FAILED: result: %d", result );
         }
 #endif
         GKI_exit_task(task_id);
-        GKI_INFO( "GKI_shutdown(): task [%s] terminated\n", gki_cb.com.OSTName[task_id]);
+        ALOGI( "GKI_shutdown(): task [%s] terminated\n", gki_cb.com.OSTName[task_id]);
     }
 }
 
@@ -476,7 +490,7 @@
 
     if (task_id != my_task_id)
     {
-        GKI_ERROR_LOG("%s: Wrong context - current task %d is not the given task id %d",\
+        ALOGE("%s: Wrong context - current task %d is not the given task id %d",\
                       __FUNCTION__, my_task_id, task_id);
         return;
     }
@@ -569,7 +583,6 @@
                 ALOGE( "pthread_join() FAILED: result: %d", result );
             }
 #endif
-            // GKI_ERROR_LOG( "GKI_shutdown(): task %s dead\n", gki_cb.com.OSTName[task_id]);
             GKI_exit_task(task_id - 1);
         }
     }
@@ -587,26 +600,9 @@
     i = 0;
 #endif
 
-}
-
-/*******************************************************************************
- **
- ** Function        gki_system_tick_start_stop_cback
- **
- ** Description     This function runs a task
- **
- ** Parameters:     start: TRUE start system tick (again), FALSE stop
- **
- ** Returns         void
- **
- *********************************************************************************/
-
-void gki_system_tick_start_stop_cback(BOOLEAN start)
-{
-    if (start) {
-        GKI_VERBOSE("Starting system ticks\n");
-    } else {
-        GKI_VERBOSE("Stopping system ticks\n");
+    if (timer_created) {
+        timer_delete(posix_timer);
+        timer_created = false;
     }
 }
 
@@ -649,23 +645,6 @@
 
 /*****************************************************************************
 **
-** Function        GKI_freeze
-**
-** Description     Freeze GKI. Relevant only when NO_GKI_RUN_RETURN is defined
-**
-** Returns
-**
-*******************************************************************************/
-
-void GKI_freeze()
-{
-#ifdef NO_GKI_RUN_RETURN
-    pthread_mutex_unlock( &gki_cb.os.gki_timer_mutex );
-#endif
-}
-
-/*****************************************************************************
-**
 ** Function        GKI_run
 **
 ** Description     Main GKI loop
@@ -674,20 +653,11 @@
 **
 *******************************************************************************/
 
-void GKI_run (void * p_task_id)
+void GKI_run(void)
 {
-    UNUSED(p_task_id);
-
-#ifndef GKI_NO_TICK_STOP
     /* adjust btld scheduling scheme now */
     gki_set_timer_scheduling();
-
-    /* register start stop function which disable timer loop in GKI_run() when no timers are
-     * in any GKI/BTA/BTU this should save power when BTLD is idle! */
-    GKI_timer_queue_register_callback( gki_system_tick_start_stop_cback );
     GKI_TRACE( "GKI_run(): Start/Stop GKI_timer_update_registered!" );
-#endif
-    return;
 }
 
 
@@ -774,9 +744,8 @@
             }
             abstime.tv_sec += sec;
 
-            pthread_cond_timedwait_monotonic(&gki_cb.os.thread_evt_cond[rtask],
+            pthread_cond_timedwait(&gki_cb.os.thread_evt_cond[rtask],
                     &gki_cb.os.thread_evt_mutex[rtask], &abstime);
-
         }
         else
         {
@@ -912,33 +881,6 @@
 
 /*******************************************************************************
 **
-** Function         GKI_isend_event
-**
-** Description      This function is called from ISRs to send events to other
-**                  tasks. The only difference between this function and GKI_send_event
-**                  is that this function assumes interrupts are already disabled.
-**
-** Parameters:      task_id -  (input) The destination task Id for the event.
-**                  event   -  (input) The event flag
-**
-** Returns          GKI_SUCCESS if all OK, else GKI_FAILURE
-**
-** NOTE             This function is NOT called by the Broadcom stack and
-**                  profiles. If you want to use it in your own implementation,
-**                  put your code here, otherwise you can delete the entire
-**                  body of the function.
-**
-*******************************************************************************/
-UINT8 GKI_isend_event (UINT8 task_id, UINT16 event)
-{
-    GKI_TRACE("GKI_isend_event %d %x", task_id, event);
-    GKI_TRACE("GKI_isend_event %d %x done", task_id, event);
-    return    GKI_send_event(task_id, event);
-}
-
-
-/*******************************************************************************
-**
 ** Function         GKI_get_taskid
 **
 ** Description      This function gets the currently running task ID.
@@ -1060,20 +1002,20 @@
     UINT8 task_id;
     int i = 0;
 
-    GKI_ERROR_LOG( "GKI_exception(): Task State Table\n");
+    ALOGE( "GKI_exception(): Task State Table");
 
     for(task_id = 0; task_id < GKI_MAX_TASKS; task_id++)
     {
-        GKI_ERROR_LOG( "TASK ID [%d] task name [%s] state [%d]\n",
+        ALOGE( "TASK ID [%d] task name [%s] state [%d]",
                          task_id,
                          gki_cb.com.OSTName[task_id],
                          gki_cb.com.OSRdyTbl[task_id]);
     }
 
-    GKI_ERROR_LOG("GKI_exception %d %s", code, msg);
-    GKI_ERROR_LOG( "\n********************************************************************\n");
-    GKI_ERROR_LOG( "* GKI_exception(): %d %s\n", code, msg);
-    GKI_ERROR_LOG( "********************************************************************\n");
+    ALOGE("GKI_exception %d %s", code, msg);
+    ALOGE( "********************************************************************");
+    ALOGE( "* GKI_exception(): %d %s", code, msg);
+    ALOGE( "********************************************************************");
 
 #if 0//(GKI_DEBUG == TRUE)
     GKI_disable();
@@ -1095,58 +1037,6 @@
     return;
 }
 
-
-/*******************************************************************************
-**
-** Function         GKI_get_time_stamp
-**
-** Description      This function formats the time into a user area
-**
-** Parameters:      tbuf -  (output) the address to the memory containing the
-**                  formatted time
-**
-** Returns          the address of the user area containing the formatted time
-**                  The format of the time is ????
-**
-** NOTE             This function is only called by OBEX.
-**
-*******************************************************************************/
-INT8 *GKI_get_time_stamp (INT8 *tbuf)
-{
-    UINT32 ms_time;
-    UINT32 s_time;
-    UINT32 m_time;
-    UINT32 h_time;
-    INT8   *p_out = tbuf;
-
-    gki_cb.com.OSTicks = times(0);
-    ms_time = GKI_TICKS_TO_MS(gki_cb.com.OSTicks);
-    s_time  = ms_time/100;   /* 100 Ticks per second */
-    m_time  = s_time/60;
-    h_time  = m_time/60;
-
-    ms_time -= s_time*100;
-    s_time  -= m_time*60;
-    m_time  -= h_time*60;
-
-    *p_out++ = (INT8)((h_time / 10) + '0');
-    *p_out++ = (INT8)((h_time % 10) + '0');
-    *p_out++ = ':';
-    *p_out++ = (INT8)((m_time / 10) + '0');
-    *p_out++ = (INT8)((m_time % 10) + '0');
-    *p_out++ = ':';
-    *p_out++ = (INT8)((s_time / 10) + '0');
-    *p_out++ = (INT8)((s_time % 10) + '0');
-    *p_out++ = ':';
-    *p_out++ = (INT8)((ms_time / 10) + '0');
-    *p_out++ = (INT8)((ms_time % 10) + '0');
-    *p_out++ = ':';
-    *p_out   = 0;
-
-    return (tbuf);
-}
-
-
 /*******************************************************************************
 **
 ** Function         GKI_os_malloc
@@ -1216,6 +1106,6 @@
 
     GKI_enable();
 
-    GKI_INFO("GKI_exit_task %d done", task_id);
+    ALOGI("GKI_exit_task %d done", task_id);
     return;
 }
diff --git a/hci/Android.mk b/hci/Android.mk
index b09ddaf..f93e658 100644
--- a/hci/Android.mk
+++ b/hci/Android.mk
@@ -2,6 +2,8 @@
 
 include $(CLEAR_VARS)
 
+LOCAL_CFLAGS += $(bdroid_CFLAGS)
+
 LOCAL_SRC_FILES := \
 	src/bt_hci_bdroid.c \
 	src/btsnoop.c \
@@ -10,9 +12,11 @@
 	src/utils.c \
 	src/vendor.c
 
+LOCAL_CFLAGS := -Wno-unused-parameter
+
 ifeq ($(BLUETOOTH_HCI_USE_MCT),true)
 
-LOCAL_CFLAGS := -DHCI_USE_MCT
+LOCAL_CFLAGS += -DHCI_USE_MCT
 
 LOCAL_SRC_FILES += \
 	src/hci_mct.c \
@@ -29,7 +33,8 @@
 LOCAL_C_INCLUDES += \
 	$(LOCAL_PATH)/include \
 	$(LOCAL_PATH)/../osi/include \
-	$(LOCAL_PATH)/../utils/include
+	$(LOCAL_PATH)/../utils/include \
+        $(bdroid_C_INCLUDES)
 
 LOCAL_MODULE := libbt-hci
 LOCAL_MODULE_TAGS := optional
diff --git a/hci/include/bt_hci_bdroid.h b/hci/include/bt_hci_bdroid.h
index b7e4330..bb285d9 100644
--- a/hci/include/bt_hci_bdroid.h
+++ b/hci/include/bt_hci_bdroid.h
@@ -32,6 +32,10 @@
 
 #include "bt_hci_lib.h"
 
+#ifdef HAS_BDROID_BUILDCFG
+#include "bdroid_buildcfg.h"
+#endif
+
 /******************************************************************************
 **  Constants & Macros
 ******************************************************************************/
@@ -62,9 +66,8 @@
 #endif
 #endif  // (BTHC_LINUX_BASE_POLICY != SCHED_NORMAL)
 
-#ifndef BTHC_USERIAL_READ_MEM_SIZE
-#define BTHC_USERIAL_READ_MEM_SIZE (1024)
-#endif
+#define HCI_ACL_MAX_SIZE 1024
+#define HCI_MAX_FRAME_SIZE (HCI_ACL_MAX_SIZE + 4)
 
 /* Host/Controller lib internal event ID */
 #define HC_EVENT_PRELOAD               0x0001
diff --git a/hci/src/lpm.c b/hci/src/lpm.c
index 10d395e..cdc6660 100644
--- a/hci/src/lpm.c
+++ b/hci/src/lpm.c
@@ -153,7 +153,7 @@
     if (bt_lpm_cb.timer_created == TRUE)
     {
         ts.it_value.tv_sec = bt_lpm_cb.timeout_ms/1000;
-        ts.it_value.tv_nsec = 1000*(bt_lpm_cb.timeout_ms%1000);
+        ts.it_value.tv_nsec = 1000000*(bt_lpm_cb.timeout_ms%1000);
         ts.it_interval.tv_sec = 0;
         ts.it_interval.tv_nsec = 0;
 
diff --git a/hci/src/userial.c b/hci/src/userial.c
index 0fd3285..f186ffa 100644
--- a/hci/src/userial.c
+++ b/hci/src/userial.c
@@ -58,7 +58,6 @@
 #endif
 
 #define MAX_SERIAL_PORT (USERIAL_PORT_3 + 1)
-#define READ_LIMIT (BTHC_USERIAL_READ_MEM_SIZE - BT_HC_HDR_SIZE)
 
 // The set of events one can send to the userial read thread.
 // Note that the values must be >= 0x8000000000000000 to guarantee delivery
@@ -208,8 +207,8 @@
     {
         if (bt_hc_cbacks)
         {
-            p_buf = (HC_BT_HDR *) bt_hc_cbacks->alloc( \
-                                                BTHC_USERIAL_READ_MEM_SIZE);
+            p_buf = (HC_BT_HDR *) bt_hc_cbacks->alloc(
+                        BT_HC_HDR_SIZE + HCI_MAX_FRAME_SIZE + 1); /* H4 HDR = 1 */
         }
         else
             p_buf = NULL;
@@ -220,7 +219,7 @@
             p_buf->layer_specific = 0;
 
             p = (uint8_t *) (p_buf + 1);
-            rx_length = select_read(userial_cb.fd, p, READ_LIMIT);
+            rx_length = select_read(userial_cb.fd, p, HCI_MAX_FRAME_SIZE + 1);
         }
         else
         {
diff --git a/include/bt_target.h b/include/bt_target.h
index ec73999..34ccd50 100644
--- a/include/bt_target.h
+++ b/include/bt_target.h
@@ -307,10 +307,6 @@
 #define HL_INCLUDED  TRUE
 #endif
 
-#ifndef NO_GKI_RUN_RETURN
-#define NO_GKI_RUN_RETURN  TRUE
-#endif
-
 #ifndef AG_VOICE_SETTINGS
 #define AG_VOICE_SETTINGS  HCI_DEFAULT_VOICE_SETTINGS
 #endif
diff --git a/include/gki_target.h b/include/gki_target.h
index 673f60b..d71c268 100644
--- a/include/gki_target.h
+++ b/include/gki_target.h
@@ -129,17 +129,6 @@
 #define GKI_OS_TICKS_TO_SECS(x)   ((x) / OS_TICKS_PER_SEC))
 #endif
 
-
-/* delay in ticks before stopping system tick. */
-#ifndef GKI_DELAY_STOP_SYS_TICK
-#define GKI_DELAY_STOP_SYS_TICK     0
-#endif
-
-/* Option to guarantee no preemption during timer expiration (most system don't need this) */
-#ifndef GKI_TIMER_LIST_NOPREEMPT
-#define GKI_TIMER_LIST_NOPREEMPT    TRUE
-#endif
-
 /******************************************************************************
 **
 ** Buffer configuration
@@ -316,11 +305,6 @@
 #define GKI_MAX_EXCEPTION_MSGLEN    64
 #endif
 
-#ifndef GKI_SEND_MSG_FROM_ISR
-#define GKI_SEND_MSG_FROM_ISR    FALSE
-#endif
-
-
 /* The following is intended to be a reserved pool for SCO
 over HCI data and intentionally kept out of order */
 
diff --git a/main/Android.mk b/main/Android.mk
index ab23dee..bf0a02f 100644
--- a/main/Android.mk
+++ b/main/Android.mk
@@ -34,6 +34,7 @@
 	../btif/src/btif_hf_client.c \
 	../btif/src/btif_hh.c \
 	../btif/src/btif_hl.c \
+	../btif/src/btif_mce.c \
 	../btif/src/btif_media_task.c \
 	../btif/src/btif_pan.c \
 	../btif/src/btif_profile_queue.c \
@@ -129,10 +130,11 @@
 	libbt-utils \
 	libbt-qcom_sbc_decoder \
 	libosi \
-	libtinyxml2
+	libtinyxml2 \
+	libbt-qcom_sbc_decoder
 
 LOCAL_MODULE := bluetooth.default
-LOCAL_MODULE_PATH := $(TARGET_OUT_SHARED_LIBRARIES)/hw
+LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := SHARED_LIBRARIES
 LOCAL_REQUIRED_MODULES := \
@@ -140,5 +142,6 @@
 	bt_did.conf \
 	bt_stack.conf \
 	libbt-vendor
+LOCAL_MULTILIB := 32
 
 include $(BUILD_SHARED_LIBRARY)
diff --git a/main/bte_main.c b/main/bte_main.c
index 906f383..2b604a8 100755
--- a/main/bte_main.c
+++ b/main/bte_main.c
@@ -204,7 +204,7 @@
 
     bte_hci_enable();
 
-    GKI_run(0);
+    GKI_run();
 }
 
 /******************************************************************************
@@ -224,7 +224,6 @@
     preload_stop_wait_timer();
     bte_hci_disable();
     GKI_destroy_task(BTU_TASK);
-    GKI_freeze();
 }
 
 /******************************************************************************
diff --git a/stack/Android.mk b/stack/Android.mk
index 12c08c9..c4b17ef 100644
--- a/stack/Android.mk
+++ b/stack/Android.mk
@@ -1,5 +1,3 @@
-ifneq ($(TARGET_SIMULATOR),true)
-
 LOCAL_PATH:= $(call my-dir)
 
 include $(CLEAR_VARS)
@@ -156,7 +154,6 @@
 LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_CLASS := STATIC_LIBRARIES
 LOCAL_SHARED_LIBRARIES := libcutils libc
+LOCAL_MULTILIB := 32
 
 include $(BUILD_STATIC_LIBRARY)
-
-endif  # TARGET_SIMULATOR != true
diff --git a/stack/a2dp/a2d_sbc.c b/stack/a2dp/a2d_sbc.c
index a4e5255..3858b4a 100644
--- a/stack/a2dp/a2d_sbc.c
+++ b/stack/a2dp/a2d_sbc.c
@@ -24,12 +24,13 @@
  ******************************************************************************/
 
 #include "bt_target.h"
-
-#if (A2D_SBC_INCLUDED == TRUE)
 #include <string.h>
 #include "a2d_api.h"
 #include "a2d_int.h"
 #include "a2d_sbc.h"
+#include "bt_utils.h"
+
+#if (A2D_SBC_INCLUDED == TRUE)
 
 /*************************************************************************************************
  * SBC descramble code
@@ -398,4 +399,57 @@
     }
 }
 
+#else /* A2D_SBC_INCLUDED == TRUE */
+
+void A2D_SbcChkFrInit(UINT8 *p_pkt)
+{
+    UNUSED(p_pkt);
+}
+
+void A2D_SbcDescramble(UINT8 *p_pkt, UINT16 len)
+{
+    UNUSED(p_pkt);
+    UNUSED(len);
+}
+
+tA2D_STATUS A2D_BldSbcInfo(UINT8 media_type, tA2D_SBC_CIE *p_ie,
+                           UINT8 *p_result)
+{
+    UNUSED(media_type);
+    UNUSED(p_ie);
+    UNUSED(p_result);
+    return A2D_FAIL;
+}
+
+tA2D_STATUS A2D_ParsSbcInfo(tA2D_SBC_CIE *p_ie, UINT8 *p_info,
+                            BOOLEAN for_caps)
+{
+    UNUSED(p_ie);
+    UNUSED(p_info);
+    UNUSED(for_caps);
+    return A2D_FAIL;
+}
+
+void A2D_BldSbcMplHdr(UINT8 *p_dst, BOOLEAN frag, BOOLEAN start,
+                      BOOLEAN last, UINT8 num)
+{
+    UNUSED(p_dst);
+    UNUSED(frag);
+    UNUSED(start);
+    UNUSED(last);
+    UNUSED(num);
+}
+
+void A2D_ParsSbcMplHdr(UINT8 *p_src, BOOLEAN *p_frag,
+                       BOOLEAN *p_start, BOOLEAN *p_last,
+                       UINT8 *p_num)
+{
+    UNUSED(p_src);
+    UNUSED(p_frag);
+    UNUSED(p_start);
+    UNUSED(p_last);
+    UNUSED(p_num);
+}
+
+
 #endif /* A2D_SBC_INCLUDED == TRUE */
diff --git a/stack/btm/btm_acl.c b/stack/btm/btm_acl.c
index 24d1b4a..e7fda01 100644
--- a/stack/btm/btm_acl.c
+++ b/stack/btm/btm_acl.c
@@ -38,6 +38,7 @@
 #include "l2c_int.h"
 #include "hcidefs.h"
 #include "bd.h"
+#include "bt_utils.h"
 
 static void btm_establish_continue (tACL_CONN *p_acl_cb);
 static void btm_read_remote_features (UINT16 handle);
@@ -235,6 +236,9 @@
 
     return st;
 #else
+    UNUSED(p_dev_rec);
+    UNUSED(conn_addr);
+    UNUSED(p_addr_type);
     return FALSE;
 #endif
 }
diff --git a/stack/btm/btm_ble.c b/stack/btm/btm_ble.c
index 518531b..86d1260 100644
--- a/stack/btm/btm_ble.c
+++ b/stack/btm/btm_ble.c
@@ -564,7 +564,7 @@
                 if (supervision_tout != BTM_BLE_CONN_PARAM_UNDEF)
                     p_dev_rec->conn_params.supervision_tout = supervision_tout;
                 else
-                    p_dev_rec->conn_params.slave_latency = BTM_BLE_CONN_TIMEOUT_DEF;
+                    p_dev_rec->conn_params.supervision_tout = BTM_BLE_CONN_TIMEOUT_DEF;
 
             }
 
@@ -851,6 +851,7 @@
                      bd_addr[2],bd_addr[3],
                      bd_addr[4],bd_addr[5]);
 
+    *p_div = 0;
     p_dev_rec = btm_find_dev (bd_addr);
 
     if (p_dev_rec && p_dev_rec->ble.keys.div)
diff --git a/stack/btm/btm_ble_bgconn.c b/stack/btm/btm_ble_bgconn.c
index 5d9981e..6cb9397 100644
--- a/stack/btm/btm_ble_bgconn.c
+++ b/stack/btm/btm_ble_bgconn.c
@@ -86,10 +86,12 @@
         {
             if (p_dev_rec->ble.ble_addr_type == BLE_ADDR_PUBLIC || !BTM_BLE_IS_RESOLVE_BDA(bd_addr))
             {
+#if (defined BLE_VND_INCLUDED && BLE_VND_INCLUDED == TRUE)
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
                 /* add device into IRK list */
                 btm_ble_vendor_irk_list_load_dev(p_dev_rec);
 #endif
+#endif
                 started = btsnd_hcic_ble_add_white_list (p_dev_rec->ble.ble_addr_type, bd_addr);
             }
             if (memcmp(p_dev_rec->ble.static_addr, bd_addr, BD_ADDR_LEN) != 0 &&
diff --git a/stack/btm/btm_ble_gap.c b/stack/btm/btm_ble_gap.c
index 7e3771a..3b5afab 100644
--- a/stack/btm/btm_ble_gap.c
+++ b/stack/btm/btm_ble_gap.c
@@ -330,11 +330,12 @@
                                             btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type,
                                             BTM_BLE_DEFAULT_SFP); /* assume observe always not using white list */
 
+#if (defined BLE_VND_INCLUDED && BLE_VND_INCLUDED == TRUE)
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
             /* enable IRK list */
             btm_ble_vendor_irk_list_known_dev (TRUE);
 #endif
-
+#endif
             status = btm_ble_start_scan(BTM_BLE_DUPLICATE_DISABLE);
         }
         if (status == BTM_CMD_STARTED)
@@ -2073,6 +2074,133 @@
     return rt;
 }
 
+static void btm_ble_appearance_to_cod(UINT16 appearance, UINT8 *dev_class)
+{
+    dev_class[0] = 0;
+
+    switch (appearance)
+    {
+        case BTM_BLE_APPEARANCE_GENERIC_PHONE:
+            dev_class[1] = BTM_COD_MAJOR_PHONE;
+            dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_COMPUTER:
+            dev_class[1] = BTM_COD_MAJOR_COMPUTER;
+            dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_REMOTE:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_REMOTE_CONTROL;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_THERMOMETER:
+        case BTM_BLE_APPEARANCE_THERMOMETER_EAR:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_THERMOMETER;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_HEART_RATE:
+        case BTM_BLE_APPEARANCE_HEART_RATE_BELT:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_HEART_PULSE_MONITOR;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE:
+        case BTM_BLE_APPEARANCE_BLOOD_PRESSURE_ARM:
+        case BTM_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_BLOOD_MONITOR;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER:
+        case BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP:
+        case BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_PULSE_OXIMETER;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_GLUCOSE:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_GLUCOSE_METER;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_WEIGHT:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_WEIGHING_SCALE;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_WALKING:
+        case BTM_BLE_APPEARANCE_WALKING_IN_SHOE:
+        case BTM_BLE_APPEARANCE_WALKING_ON_SHOE:
+        case BTM_BLE_APPEARANCE_WALKING_ON_HIP:
+            dev_class[1] = BTM_COD_MAJOR_HEALTH;
+            dev_class[2] = BTM_COD_MINOR_STEP_COUNTER;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_WATCH:
+        case BTM_BLE_APPEARANCE_SPORTS_WATCH:
+            dev_class[1] = BTM_COD_MAJOR_WEARABLE;
+            dev_class[2] = BTM_COD_MINOR_WRIST_WATCH;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_EYEGLASSES:
+            dev_class[1] = BTM_COD_MAJOR_WEARABLE;
+            dev_class[2] = BTM_COD_MINOR_GLASSES;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_DISPLAY:
+            dev_class[1] = BTM_COD_MAJOR_IMAGING;
+            dev_class[2] = BTM_COD_MINOR_DISPLAY;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER:
+            dev_class[1] = BTM_COD_MAJOR_AUDIO;
+            dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
+            break;
+        case BTM_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER:
+        case BTM_BLE_APPEARANCE_HID_BARCODE_SCANNER:
+        case BTM_BLE_APPEARANCE_GENERIC_HID:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
+            break;
+        case BTM_BLE_APPEARANCE_HID_KEYBOARD:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_KEYBOARD;
+            break;
+        case BTM_BLE_APPEARANCE_HID_MOUSE:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_POINTING;
+            break;
+        case BTM_BLE_APPEARANCE_HID_JOYSTICK:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_JOYSTICK;
+            break;
+        case BTM_BLE_APPEARANCE_HID_GAMEPAD:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_GAMEPAD;
+            break;
+        case BTM_BLE_APPEARANCE_HID_DIGITIZER_TABLET:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_DIGITIZING_TABLET;
+            break;
+        case BTM_BLE_APPEARANCE_HID_CARD_READER:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_CARD_READER;
+            break;
+        case BTM_BLE_APPEARANCE_HID_DIGITAL_PEN:
+            dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+            dev_class[2] = BTM_COD_MINOR_DIGITAL_PAN;
+            break;
+        case BTM_BLE_APPEARANCE_UKNOWN:
+        case BTM_BLE_APPEARANCE_GENERIC_CLOCK:
+        case BTM_BLE_APPEARANCE_GENERIC_TAG:
+        case BTM_BLE_APPEARANCE_GENERIC_KEYRING:
+        case BTM_BLE_APPEARANCE_GENERIC_CYCLING:
+        case BTM_BLE_APPEARANCE_CYCLING_COMPUTER:
+        case BTM_BLE_APPEARANCE_CYCLING_SPEED:
+        case BTM_BLE_APPEARANCE_CYCLING_CADENCE:
+        case BTM_BLE_APPEARANCE_CYCLING_POWER:
+        case BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE:
+        case BTM_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS:
+        case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION:
+        case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV:
+        case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD:
+        case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV:
+        default:
+            dev_class[1] = BTM_COD_MAJOR_UNCLASSIFIED;
+            dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
+    };
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_update_inq_result
@@ -2143,19 +2271,31 @@
 
     if (p_le_inq_cb->adv_len != 0)
     {
-        if ((p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache,
-                                         BTM_BLE_AD_TYPE_16SRV_CMPL, &len)) != NULL)
+        /* Check to see the BLE device has the Appearance UUID in the advertising data.  If it does
+         * then try to convert the appearance value to a class of device value Bluedroid can use.
+         * Otherwise fall back to trying to infer if it is a HID device based on the service class.
+         */
+        p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache, BTM_BLE_AD_TYPE_APPEARANCE, &len);
+        if (p_uuid16 && len == 2)
         {
-            UINT8 i;
-            for (i = 0; i + 2 <= len; i = i + 2)
+            btm_ble_appearance_to_cod((UINT16)p_uuid16[0] | (p_uuid16[1] << 8), p_cur->dev_class);
+        }
+        else
+        {
+            if ((p_uuid16 = BTM_CheckAdvData(p_le_inq_cb->adv_data_cache,
+                                             BTM_BLE_AD_TYPE_16SRV_CMPL, &len)) != NULL)
             {
-                /* if this BLE device support HID over LE, set HID Major in class of device */
-                if ((p_uuid16[i] | (p_uuid16[i+1] << 8)) == UUID_SERVCLASS_LE_HID)
+                UINT8 i;
+                for (i = 0; i + 2 <= len; i = i + 2)
                 {
-                    p_cur->dev_class[0] = 0;
-                    p_cur->dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
-                    p_cur->dev_class[2] = 0;
-                    break;
+                    /* if this BLE device support HID over LE, set HID Major in class of device */
+                    if ((p_uuid16[i] | (p_uuid16[i+1] << 8)) == UUID_SERVCLASS_LE_HID)
+                    {
+                        p_cur->dev_class[0] = 0;
+                        p_cur->dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
+                        p_cur->dev_class[2] = 0;
+                        break;
+                    }
                 }
             }
         }
@@ -2243,24 +2383,28 @@
     BD_ADDR             bda;
     UINT8               evt_type = 0, *p = p_data;
     UINT8               addr_type = 0;
+    UINT8               num_reports;
+    UINT8               data_len;
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
     BOOLEAN             match = FALSE;
 #endif
 
-    /* always get one device at a time */
-    p ++;
+    /* Extract the number of reports in this event. */
+    STREAM_TO_UINT8(num_reports, p);
 
-    /* Extract inquiry results */
-    STREAM_TO_UINT8    (evt_type, p);
-    STREAM_TO_UINT8    (addr_type, p);
-    STREAM_TO_BDADDR   (bda, p);
+    while (num_reports--)
+    {
+        /* Extract inquiry results */
+        STREAM_TO_UINT8    (evt_type, p);
+        STREAM_TO_UINT8    (addr_type, p);
+        STREAM_TO_BDADDR   (bda, p);
 
 #ifdef BTM_BLE_PC_ADV_TEST_MODE /* For general stack code (e.g. BTInsight testing), we simply do not define it to exclude or set it to TRUE to include */
-    if (BTM_BLE_PC_ADV_TEST_MODE)   /* For stack component, it is always defined and maps to a global variable g_bDraculaAdvertisingMode */
-    {
-        if (btm_cb.ble_ctr_cb.p_scan_req_cback)
-            (*btm_cb.ble_ctr_cb.p_scan_req_cback)(bda, addr_type, evt_type);
-    }
+        if (BTM_BLE_PC_ADV_TEST_MODE)   /* For stack component, it is always defined and maps to a global variable g_bDraculaAdvertisingMode */
+        {
+            if (btm_cb.ble_ctr_cb.p_scan_req_cback)
+                (*btm_cb.ble_ctr_cb.p_scan_req_cback)(bda, addr_type, evt_type);
+        }
 #endif
 
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
@@ -2272,24 +2416,30 @@
 #endif
 #endif
 
-    /* Only process the results if the inquiry is still active */
-    if (!BTM_BLE_IS_SCAN_ACTIVE(btm_cb.ble_ctr_cb.scan_activity))
-        return;
+        /* Only process the results if the inquiry is still active */
+        if (!BTM_BLE_IS_SCAN_ACTIVE(btm_cb.ble_ctr_cb.scan_activity))
+            return;
 
     BTM_TRACE_DEBUG("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x",
                                      bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]);
 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
 #if SMP_INCLUDED == TRUE
-    /* always do RRA resolution on host */
-    if (!match && BTM_BLE_IS_RESOLVE_BDA(bda))
-    {
-        btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, p_data);
-    }
-    else
+        /* always do RRA resolution on host */
+        if (!match && BTM_BLE_IS_RESOLVE_BDA(bda))
+        {
+            btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, p_data);
+        }
+        else
 #endif
 #endif
-    {
-        btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
+        {
+            btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
+        }
+
+        STREAM_TO_UINT8(data_len, p);
+
+        /* Advance to the next event data_len + rssi byte */
+        p += data_len + 1;
     }
 }
 
diff --git a/stack/btm/btm_sec.c b/stack/btm/btm_sec.c
index 01de1b6..c9a185a 100644
--- a/stack/btm/btm_sec.c
+++ b/stack/btm/btm_sec.c
@@ -5054,6 +5054,10 @@
     tBTM_SEC_DEV_REC *p_dev_rec;
     tBTM_CB          *p_cb = &btm_cb;
 
+#ifdef PORCHE_PAIRING_CONFLICT
+    UINT8 default_pin_code_len = 4;
+    PIN_CODE default_pin_code = {0x30, 0x30, 0x30, 0x30};
+#endif
     BTM_TRACE_EVENT ("btm_sec_pin_code_request()  State: %s, BDA:%04x%08x",
                       btm_pair_state_descr(btm_cb.pairing_state),
                       (p_bda[0]<<8)+p_bda[1], (p_bda[2]<<24)+(p_bda[3]<<16)+(p_bda[4]<<8)+p_bda[5] );
@@ -5087,7 +5091,8 @@
             BTM_TRACE_EVENT ("btm_sec_pin_code_request from remote dev. for local initiated pairing");
             if(! btm_cb.pin_code_len_saved)
             {
-                btsnd_hcic_pin_code_neg_reply (p_bda);
+                btm_sec_change_pairing_state (BTM_PAIR_STATE_WAIT_AUTH_COMPLETE);
+                btsnd_hcic_pin_code_req_reply (p_bda, default_pin_code_len, default_pin_code);
             }
             else
             {
diff --git a/stack/btu/btu_hcif.c b/stack/btu/btu_hcif.c
index 1be90db..23204a7 100644
--- a/stack/btu/btu_hcif.c
+++ b/stack/btu/btu_hcif.c
@@ -37,6 +37,8 @@
 #include "btm_api.h"
 #include "btm_int.h"
 
+extern void btm_process_cancel_complete(UINT8 status, UINT8 mode);
+extern void btm_ble_test_command_complete(UINT8 *p);
 
 // btla-specific ++
 #define LOG_TAG "BTLD"
@@ -400,8 +402,7 @@
         case HCI_BLE_EVENT:
             STREAM_TO_UINT8  (ble_sub_code, p);
 
-            BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_EVENT, "BLE HCI(id=%d) event = 0x%02x)",
-                        hci_evt_code,  ble_sub_code);
+            HCI_TRACE_EVENT("BLE HCI(id=%d) event = 0x%02x)", hci_evt_code,  ble_sub_code);
 
             switch (ble_sub_code)
             {
@@ -503,7 +504,7 @@
             else
             {
                 /* Unknown controller */
-                BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU HCI(ctrl id=%d) controller ID not recognized", controller_id);
+                HCI_TRACE_WARNING("BTU HCI(ctrl id=%d) controller ID not recognized", controller_id);
                 GKI_freebuf(p_buf);;
             }
 
@@ -1513,8 +1514,7 @@
     }
     else
     {
-        BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING,
-                    "No command in queue matching opcode %d", opcode);
+        HCI_TRACE_WARNING("No command in queue matching opcode %d", opcode);
     }
 
     /* See if we can forward any more commands */
@@ -1542,7 +1542,7 @@
 #if (defined(BTU_CMD_CMPL_TOUT_DOUBLE_CHECK) && BTU_CMD_CMPL_TOUT_DOUBLE_CHECK == TRUE)
     if (!(p_hci_cmd_cb->checked_hcisu))
     {
-        BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU HCI(id=%d) command timeout - double check HCISU", controller_id);
+        HCI_TRACE_WARNING("BTU HCI(id=%d) command timeout - double check HCISU", controller_id);
 
         /* trigger HCISU to read any pending data in transport buffer */
         GKI_send_event(HCISU_TASK, HCISU_EVT_MASK);
@@ -1564,7 +1564,7 @@
     /* get queued command */
     if ((p_cmd = (BT_HDR *) GKI_dequeue (&(p_hci_cmd_cb->cmd_cmpl_q))) == NULL)
     {
-        BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "Cmd timeout; no cmd in queue");
+        HCI_TRACE_WARNING("Cmd timeout; no cmd in queue");
         return;
     }
 
@@ -1587,7 +1587,7 @@
     if (controller_id == NFC_CONTROLLER_ID)
     {
         //TODO call nfc_ncif_cmd_timeout
-        BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU NCI command timeout - header 0x%02x%02x", p[0], p[1]);
+        HCI_TRACE_WARNING("BTU NCI command timeout - header 0x%02x%02x", p[0], p[1]);
         return;
     }
 #endif
@@ -1603,7 +1603,7 @@
     ALOGE("#");
     ALOGE("######################################################################");
 #else
-    BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU HCI(id=%d) command timeout. opcode=0x%x", controller_id, opcode);
+    HCI_TRACE_WARNING("BTU HCI(id=%d) command timeout. opcode=0x%x", controller_id, opcode);
 #endif
 // btla-specific ++
 
@@ -1659,8 +1659,7 @@
      times, Bluetooth process will be killed and restarted */
     if (num_hci_cmds_timed_out >= BTM_MAX_HCI_CMD_TOUT_BEFORE_RESTART)
     {
-        BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_ERROR,
-                  "Num consecutive HCI Cmd tout =%d Restarting BT process",num_hci_cmds_timed_out);
+        HCI_TRACE_ERROR("Num consecutive HCI Cmd tout =%d Restarting BT process",num_hci_cmds_timed_out);
 
         usleep(10000); /* 10 milliseconds */
         /* Killing the process to force a restart as part of fault tolerance */
@@ -1668,8 +1667,7 @@
     }
     else
     {
-        BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "HCI Cmd timeout counter %d",
-                    num_hci_cmds_timed_out);
+        HCI_TRACE_WARNING("HCI Cmd timeout counter %d", num_hci_cmds_timed_out);
 
         /* If anyone wants device status notifications, give him one */
         btm_report_device_status (BTM_DEV_STATUS_CMD_TOUT);
@@ -1689,7 +1687,7 @@
 *******************************************************************************/
 static void btu_hcif_hardware_error_evt (UINT8 *p)
 {
-    BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_ERROR, "Ctlr H/w error event - code:0x%x", *p);
+    HCI_TRACE_ERROR("Ctlr H/w error event - code:0x%x", *p);
 
     /* If anyone wants device status notifications, give him one. */
     btm_report_device_status (BTM_DEV_STATUS_DOWN);
@@ -2258,7 +2256,7 @@
 
 static void btu_ble_process_adv_pkt (UINT8 *p)
 {
-    BT_TRACE(TRACE_LAYER_HCI, TRACE_TYPE_EVENT, "btu_ble_process_adv_pkt");
+    HCI_TRACE_EVENT("btu_ble_process_adv_pkt");
 
     btm_ble_process_adv_pkt(p);
 }
diff --git a/stack/btu/btu_task.c b/stack/btu/btu_task.c
index e58f4cb..23429a3 100644
--- a/stack/btu/btu_task.c
+++ b/stack/btu/btu_task.c
@@ -597,9 +597,11 @@
                 GKI_remove_from_timer_list(&btu_cb.timer_queue_oneshot, p_tle);
 
                 switch (p_tle->event) {
+#if (defined(BLE_INCLUDED) && BLE_INCLUDED == TRUE)
                     case BTU_TTYPE_BLE_RANDOM_ADDR:
                         btm_ble_timeout(p_tle);
                         break;
+#endif
 
                     default:
                         // FAIL
diff --git a/stack/gatt/gatt_db.c b/stack/gatt/gatt_db.c
index 1285223..b7887c9 100644
--- a/stack/gatt/gatt_db.c
+++ b/stack/gatt/gatt_db.c
@@ -423,7 +423,7 @@
                  BTM_SEC_LINK_KEY_KNOWN)
             {
                 tACL_CONN         *p;
-                p = btm_bda_to_acl(p_tcb->peer_bda);
+                p = btm_bda_to_acl(p_tcb->peer_bda, BT_TRANSPORT_LE);
                 if ((p != NULL) && (p->link_role == BTM_ROLE_MASTER))
                 {
                     tBTM_BLE_SEC_ACT sec_act = BTM_BLE_SEC_ENCRYPT;
diff --git a/stack/include/btm_ble_api.h b/stack/include/btm_ble_api.h
index 731fce9..aa71817 100644
--- a/stack/include/btm_ble_api.h
+++ b/stack/include/btm_ble_api.h
@@ -119,7 +119,6 @@
 #define BTM_BLE_CONN_SUP_TOUT_MIN       0x000A
 #define BTM_BLE_CONN_SUP_TOUT_MAX       0x0C80
 #define BTM_BLE_CONN_PARAM_UNDEF        0xffff      /* use this value when a specific value not to be overwritten */
-#define BTM_BLE_CONN_SUP_TOUT_DEF       700
 
 /* default connection parameters if not configured, use GAP recommend value for auto/selective connection */
 /* default scan interval */
@@ -183,6 +182,58 @@
 #define BTM_BLE_SIMULTANEOUS_HOST	0x01
 #endif
 
+/* Appearance Values Reported with BTM_BLE_AD_TYPE_APPEARANCE */
+#define BTM_BLE_APPEARANCE_UKNOWN                  0x0000
+#define BTM_BLE_APPEARANCE_GENERIC_PHONE           0x0040
+#define BTM_BLE_APPEARANCE_GENERIC_COMPUTER        0x0080
+#define BTM_BLE_APPEARANCE_GENERIC_WATCH           0x00C0
+#define BTM_BLE_APPEARANCE_SPORTS_WATCH            0x00C1
+#define BTM_BLE_APPEARANCE_GENERIC_CLOCK           0x0100
+#define BTM_BLE_APPEARANCE_GENERIC_DISPLAY         0x0140
+#define BTM_BLE_APPEARANCE_GENERIC_REMOTE          0x0180
+#define BTM_BLE_APPEARANCE_GENERIC_EYEGLASSES      0x01C0
+#define BTM_BLE_APPEARANCE_GENERIC_TAG             0x0200
+#define BTM_BLE_APPEARANCE_GENERIC_KEYRING         0x0240
+#define BTM_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER    0x0280
+#define BTM_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER 0x02C0
+#define BTM_BLE_APPEARANCE_GENERIC_THERMOMETER     0x0300
+#define BTM_BLE_APPEARANCE_THERMOMETER_EAR         0x0301
+#define BTM_BLE_APPEARANCE_GENERIC_HEART_RATE      0x0340
+#define BTM_BLE_APPEARANCE_HEART_RATE_BELT         0x0341
+#define BTM_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE  0x0380
+#define BTM_BLE_APPEARANCE_BLOOD_PRESSURE_ARM      0x0381
+#define BTM_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST    0x0382
+#define BTM_BLE_APPEARANCE_GENERIC_HID             0x03C0
+#define BTM_BLE_APPEARANCE_HID_KEYBOARD            0x03C1
+#define BTM_BLE_APPEARANCE_HID_MOUSE               0x03C2
+#define BTM_BLE_APPEARANCE_HID_JOYSTICK            0x03C3
+#define BTM_BLE_APPEARANCE_HID_GAMEPAD             0x03C4
+#define BTM_BLE_APPEARANCE_HID_DIGITIZER_TABLET    0x03C5
+#define BTM_BLE_APPEARANCE_HID_CARD_READER         0x03C6
+#define BTM_BLE_APPEARANCE_HID_DIGITAL_PEN         0x03C7
+#define BTM_BLE_APPEARANCE_HID_BARCODE_SCANNER     0x03C8
+#define BTM_BLE_APPEARANCE_GENERIC_GLUCOSE         0x0400
+#define BTM_BLE_APPEARANCE_GENERIC_WALKING         0x0440
+#define BTM_BLE_APPEARANCE_WALKING_IN_SHOE         0x0441
+#define BTM_BLE_APPEARANCE_WALKING_ON_SHOE         0x0442
+#define BTM_BLE_APPEARANCE_WALKING_ON_HIP          0x0443
+#define BTM_BLE_APPEARANCE_GENERIC_CYCLING         0x0480
+#define BTM_BLE_APPEARANCE_CYCLING_COMPUTER        0x0481
+#define BTM_BLE_APPEARANCE_CYCLING_SPEED           0x0482
+#define BTM_BLE_APPEARANCE_CYCLING_CADENCE         0x0483
+#define BTM_BLE_APPEARANCE_CYCLING_POWER           0x0484
+#define BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE   0x0485
+#define BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER  0x0C40
+#define BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP 0x0C41
+#define BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST    0x0C42
+#define BTM_BLE_APPEARANCE_GENERIC_WEIGHT          0x0C80
+#define BTM_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS  0x1440
+#define BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION 0x1441
+#define BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV     0x1442
+#define BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD         0x1443
+#define BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV 0x1444
+
+
 /* Structure returned with Rand/Encrypt complete callback */
 typedef struct
 {
diff --git a/stack/l2cap/l2c_ble.c b/stack/l2cap/l2c_ble.c
index fe827e3..b46a1c8 100644
--- a/stack/l2cap/l2c_ble.c
+++ b/stack/l2cap/l2c_ble.c
@@ -644,7 +644,7 @@
         return FALSE;
     }
 #if BLE_PRIVACY_SPT == TRUE
-#if (defined BLE_VND_INCLUDED || BLE_VND_INCLUDED == TRUE)
+#if (defined BLE_VND_INCLUDED && BLE_VND_INCLUDED == TRUE)
     extern tBTM_STATUS BTM_BleEnableIRKFeature(BOOLEAN enable);
     if (btm_ble_vendor_irk_list_load_dev(p_dev_rec))
         BTM_BleEnableIRKFeature(TRUE);
@@ -663,9 +663,9 @@
         (UINT16) ((p_dev_rec->conn_params.max_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ?
         p_dev_rec->conn_params.max_conn_int : BTM_BLE_CONN_INT_MAX_DEF),  /* conn_int_max  */
         (UINT16) ((p_dev_rec->conn_params.slave_latency != BTM_BLE_CONN_PARAM_UNDEF) ?
-        p_dev_rec->conn_params.slave_latency : 0), /* UINT16 conn_latency  */
+        p_dev_rec->conn_params.slave_latency : BTM_BLE_CONN_SLAVE_LATENCY_DEF), /* UINT16 conn_latency  */
         (UINT16) ((p_dev_rec->conn_params.supervision_tout != BTM_BLE_CONN_PARAM_UNDEF) ?
-        p_dev_rec->conn_params.supervision_tout : BTM_BLE_CONN_SUP_TOUT_DEF), /* conn_timeout */
+        p_dev_rec->conn_params.supervision_tout : BTM_BLE_CONN_TIMEOUT_DEF), /* conn_timeout */
                                         0,                       /* UINT16 min_len       */
                                         0))                      /* UINT16 max_len       */
     {
diff --git a/stack/l2cap/l2c_csm.c b/stack/l2cap/l2c_csm.c
index baad624..fa261b2 100644
--- a/stack/l2cap/l2c_csm.c
+++ b/stack/l2cap/l2c_csm.c
@@ -1015,6 +1015,7 @@
 #if BTM_PWR_MGR_INCLUDED == TRUE
         {
             tBTM_PM_PWR_MD settings;
+            memset((void*)&settings, 0, sizeof(settings));
             settings.mode = BTM_PM_MD_ACTIVE;
             BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p_ccb->p_lcb->remote_bd_addr, &settings);
         }
@@ -1038,6 +1039,7 @@
 #if BTM_PWR_MGR_INCLUDED == TRUE
         {
             tBTM_PM_PWR_MD settings;
+            memset((void*)&settings, 0, sizeof(settings));
             settings.mode = BTM_PM_MD_ACTIVE;
             BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p_ccb->p_lcb->remote_bd_addr, &settings);
         }
diff --git a/stack/l2cap/l2c_utils.c b/stack/l2cap/l2c_utils.c
index 97b15f3..305e02e 100644
--- a/stack/l2cap/l2c_utils.c
+++ b/stack/l2cap/l2c_utils.c
@@ -344,11 +344,20 @@
     p = (UINT8 *)(p_buf + 1) + L2CAP_SEND_CMD_OFFSET;
 
     /* Put in HCI header - handle + pkt boundary */
-#if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
-    UINT16_TO_STREAM (p, p_lcb->handle | l2cb.non_flushable_pbf);
-#else
-    UINT16_TO_STREAM (p, (p_lcb->handle | (L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT)));
+#if (BLE_INCLUDED == TRUE)
+    if (p_lcb->transport == BT_TRANSPORT_LE)
+    {
+        UINT16_TO_STREAM (p, (p_lcb->handle | (L2CAP_PKT_START_NON_FLUSHABLE << L2CAP_PKT_TYPE_SHIFT)));
+    }
+    else
 #endif
+    {
+#if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
+        UINT16_TO_STREAM (p, p_lcb->handle | l2cb.non_flushable_pbf);
+#else
+        UINT16_TO_STREAM (p, (p_lcb->handle | (L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT)));
+#endif
+    }
 
     UINT16_TO_STREAM (p, len + L2CAP_PKT_OVERHEAD + L2CAP_CMD_OVERHEAD);
     UINT16_TO_STREAM (p, len + L2CAP_CMD_OVERHEAD);
@@ -3328,22 +3337,11 @@
     /* Set the pointer to the beginning of the data minus 4 bytes for the packet header */
     p = (UINT8 *)(p_buf + 1) + p_buf->offset - HCI_DATA_PREAMBLE_SIZE;
 
-#if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
-    if ( (((p_buf->layer_specific & L2CAP_FLUSHABLE_MASK) == L2CAP_FLUSHABLE_CH_BASED) && (p_ccb->is_flushable))
-            || ((p_buf->layer_specific & L2CAP_FLUSHABLE_MASK) == L2CAP_FLUSHABLE_PKT) )
-    {
-        UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | (L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT));
-    }
-    else
-    {
-        UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | l2cb.non_flushable_pbf);
-    }
-#else
-    UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | (L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT));
-#endif
 #if (BLE_INCLUDED == TRUE)
     if (p_ccb->p_lcb->transport == BT_TRANSPORT_LE)
     {
+        UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | (L2CAP_PKT_START_NON_FLUSHABLE << L2CAP_PKT_TYPE_SHIFT));
+
         /* The HCI transport will segment the buffers. */
         if (p_buf->len > btu_cb.hcit_ble_acl_data_size)
         {
@@ -3357,6 +3355,19 @@
     else
 #endif
     {
+#if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
+        if ( (((p_buf->layer_specific & L2CAP_FLUSHABLE_MASK) == L2CAP_FLUSHABLE_CH_BASED) && (p_ccb->is_flushable))
+                || ((p_buf->layer_specific & L2CAP_FLUSHABLE_MASK) == L2CAP_FLUSHABLE_PKT) )
+        {
+            UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | (L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT));
+        }
+        else
+        {
+            UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | l2cb.non_flushable_pbf);
+        }
+#else
+        UINT16_TO_STREAM (p, p_ccb->p_lcb->handle | (L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT));
+#endif
 
         /* The HCI transport will segment the buffers. */
         if (p_buf->len > btu_cb.hcit_acl_data_size)
diff --git a/stack/pan/pan_api.c b/stack/pan/pan_api.c
index d9bafbb..6ba97b2 100644
--- a/stack/pan/pan_api.c
+++ b/stack/pan/pan_api.c
@@ -466,7 +466,7 @@
     }
 
     result = BNEP_Disconnect (pcb->handle);
-    if (pcb->con_state == PAN_STATE_CONNECTED)
+    if (pcb->con_state != PAN_STATE_IDLE)
         pan_cb.num_conns--;
 
     if (pan_cb.pan_bridge_req_cb && pcb->src_uuid == UUID_SERVCLASS_NAP)
diff --git a/stack/sdp/sdp_api.c b/stack/sdp/sdp_api.c
index d72e1b2..9b3628c 100644
--- a/stack/sdp/sdp_api.c
+++ b/stack/sdp/sdp_api.c
@@ -513,12 +513,13 @@
 
                     if ((SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UUID_DESC_TYPE)
                      && (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 2) ) {
-                        printf("SDP_FindServiceInDb - p_sattr value = 0x%x serviceuuid = 0x%x\r\n", p_sattr->attr_value.v.u16, service_uuid);
+                        SDP_TRACE_DEBUG("SDP_FindServiceInDb - p_sattr value = 0x%x serviceuuid = 0x%x\r\n",
+                                        p_sattr->attr_value.v.u16, service_uuid);
                         if(service_uuid == UUID_SERVCLASS_HDP_PROFILE)
                         {
                             if( (p_sattr->attr_value.v.u16==UUID_SERVCLASS_HDP_SOURCE) || ( p_sattr->attr_value.v.u16==UUID_SERVCLASS_HDP_SINK))
                             {
-                                printf("SDP_FindServiceInDb found HDP source or sink\n" );
+                                SDP_TRACE_DEBUG("SDP_FindServiceInDb found HDP source or sink\n" );
                                 return (p_rec);
                             }
                         }
@@ -686,14 +687,14 @@
                     if (SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UUID_DESC_TYPE)
                     {
 
-                        printf("uuid len=%d ", p_uuid->len);
+                        SDP_TRACE_DEBUG("uuid len=%d ", p_uuid->len);
                         if (p_uuid->len == 2)
                         {
-                            printf("uuid=0x%x \n", p_uuid->uu.uuid16);
+                            SDP_TRACE_DEBUG("uuid=0x%x \n", p_uuid->uu.uuid16);
                         }
                         else
                         {
-                            printf("\n");
+                            SDP_TRACE_DEBUG("\n");
                         }
 
                         if (sdpu_compare_uuid_with_attr (p_uuid, p_sattr))
diff --git a/stack/srvc/srvc_dis.c b/stack/srvc/srvc_dis.c
index 9eba4c7..50ffe12 100644
--- a/stack/srvc/srvc_dis.c
+++ b/stack/srvc/srvc_dis.c
@@ -427,6 +427,9 @@
 {
     UINT16             conn_id;
 
+    /* Initialize the DIS client if it hasn't been initialized already. */
+    srvc_eng_init();
+
     /* For now we only handle one at a time */
     if (dis_cb.dis_read_uuid_idx != 0xff)
         return(FALSE);
diff --git a/test/Android.mk b/test/Android.mk
index 3c3cb61..5053e7d 100644
--- a/test/Android.mk
+++ b/test/Android.mk
@@ -1,3 +1 @@
-ifneq ($(TARGET_SIMULATOR),true)
-  include $(call all-subdir-makefiles)
-endif
+include $(call all-subdir-makefiles)
diff --git a/test/bluedroidtest/Android.mk b/test/bluedroidtest/Android.mk
index 864bff8..8196546 100644
--- a/test/bluedroidtest/Android.mk
+++ b/test/bluedroidtest/Android.mk
@@ -22,6 +22,9 @@
     bluedroidtest.c
 
 LOCAL_C_INCLUDES :=
+LOCAL_CFLAGS := -Wno-unused-parameter
+
+LOCAL_CFLAGS += -std=c99
 
 LOCAL_CFLAGS += -std=c99
 
@@ -29,13 +32,11 @@
 
 LOCAL_MODULE:= bdt
 
-LOCAL_LDLIBS += -lpthread -ldl -llog -lreadline
-LIBS_c += -lreadline
-
 LOCAL_SHARED_LIBRARIES += libcutils   \
                           libutils    \
                           libhardware \
                           libhardware_legacy
 
-include $(BUILD_EXECUTABLE)
+LOCAL_MULTILIB := 32
 
+include $(BUILD_EXECUTABLE)
diff --git a/test/bluedroidtest/bluedroidtest.c b/test/bluedroidtest/bluedroidtest.c
index 8ec0e1e..4fc1559 100644
--- a/test/bluedroidtest/bluedroidtest.c
+++ b/test/bluedroidtest/bluedroidtest.c
@@ -201,7 +201,7 @@
         if (n%16 == 1) {
             /* store address for this line */
             snprintf(addrstr, sizeof(addrstr), "%.4x",
-               ((unsigned int)p-(unsigned int)data) );
+               (unsigned int)((uintptr_t)p-(uintptr_t)data) );
         }
 
         c = *p;
diff --git a/test/suite/Android.mk b/test/suite/Android.mk
index 0a66141..2f45180 100644
--- a/test/suite/Android.mk
+++ b/test/suite/Android.mk
@@ -38,4 +38,6 @@
 
 LOCAL_CFLAGS += -std=c99 -Wall -Wno-unused-parameter -Wno-missing-field-initializers -Werror
 
+LOCAL_MULTILIB := 32
+
 include $(BUILD_EXECUTABLE)
diff --git a/test/suite/support/callbacks.c b/test/suite/support/callbacks.c
index e824c3a..2ad12cf 100644
--- a/test/suite/support/callbacks.c
+++ b/test/suite/support/callbacks.c
@@ -25,7 +25,7 @@
                         bt_property_t *properties);
 void discovery_state_changed(bt_discovery_state_t state);
 
-void pan_control_state_changed(btpan_control_state_t state, bt_status_t error, int local_role, const char *ifname);
+void pan_control_state_changed(btpan_control_state_t state, int local_role, bt_status_t error, const char *ifname);
 void pan_connection_state_changed(btpan_connection_state_t state, bt_status_t error, const bt_bdaddr_t *bd_addr, int local_role, int remote_role);
 
 static void remote_device_properties(bt_status_t status,
diff --git a/udrv/ulinux/uipc.c b/udrv/ulinux/uipc.c
index ef57a13..a876076 100644
--- a/udrv/ulinux/uipc.c
+++ b/udrv/ulinux/uipc.c
@@ -848,7 +848,7 @@
             break;
 
         case UIPC_SET_READ_POLL_TMO:
-            uipc_main.ch[ch_id].read_poll_tmo_ms = (int)param;
+            uipc_main.ch[ch_id].read_poll_tmo_ms = (intptr_t)param;
             BTIF_TRACE_EVENT("UIPC_SET_READ_POLL_TMO : CH %d, TMO %d ms", ch_id, uipc_main.ch[ch_id].read_poll_tmo_ms );
             break;
 
diff --git a/vnd/ble/vendor_ble.c b/vnd/ble/vendor_ble.c
index d84efd3..08ff1c0 100644
--- a/vnd/ble/vendor_ble.c
+++ b/vnd/ble/vendor_ble.c
@@ -355,7 +355,9 @@
             STREAM_TO_BDADDR(target_bda, p);
             STREAM_TO_BDADDR(rra, p);
 
+#if (defined BLE_VND_INCLUDED && BLE_VND_INCLUDED == TRUE)
             btm_ble_refresh_rra(target_bda, rra);
+#endif
         }
     }