Added missing #include directives
am: 65ee728284

Change-Id: I5b293b7ff4665312efdf1bcc00a6f2f5058d2670
diff --git a/bta/av/bta_av_ssm.c b/bta/av/bta_av_ssm.c
index 812004d..ef34849 100644
--- a/bta/av/bta_av_ssm.c
+++ b/bta/av/bta_av_ssm.c
@@ -308,7 +308,7 @@
 /* STR_SECURITY_IND_EVT */  {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
 /* STR_SECURITY_CFM_EVT */  {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
 /* STR_WRITE_CFM_EVT */     {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
-/* STR_SUSPEND_CFM_EVT */   {BTA_AV_SUSPEND_CONT,   BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
+/* STR_SUSPEND_CFM_EVT */   {BTA_AV_SUSPEND_CFM,    BTA_AV_SUSPEND_CONT,   BTA_AV_RCFG_SST },
 /* STR_RECONFIG_CFM_EVT */  {BTA_AV_RCFG_CFM,       BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
 /* AVRC_TIMER_EVT */        {BTA_AV_SIGNORE,        BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
 /* AVDT_CONNECT_EVT */      {BTA_AV_RCFG_OPEN,      BTA_AV_SIGNORE,        BTA_AV_RCFG_SST },
diff --git a/btif/co/bta_hh_co.cc b/btif/co/bta_hh_co.cc
index 4603517..c115c32 100644
--- a/btif/co/bta_hh_co.cc
+++ b/btif/co/bta_hh_co.cc
@@ -16,25 +16,25 @@
  *
  ******************************************************************************/
 
-
+#include <assert.h>
 #include <ctype.h>
+#include <errno.h>
 #include <fcntl.h>
-#include <sys/poll.h>
+#include <linux/uhid.h>
 #include <pthread.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdint.h>
-#include <errno.h>
+#include <sys/poll.h>
 #include <unistd.h>
-#include <linux/uhid.h>
-#include <unistd.h>
+
+#include "btcore/include/bdaddr.h"
 #include "osi/include/osi.h"
-#include "btif_hh.h"
 #include "bta_api.h"
 #include "bta_hh_api.h"
-#include "btif_util.h"
 #include "bta_hh_co.h"
-#include "btcore/include/bdaddr.h"
+#include "btif_hh.h"
+#include "btif_util.h"
 
 const char *dev_path = "/dev/uhid";
 
@@ -60,8 +60,8 @@
 static int uhid_write(int fd, const struct uhid_event *ev)
 {
     ssize_t ret;
-
     OSI_NO_INTR(ret = write(fd, ev, sizeof(*ev)));
+
     if (ret < 0){
         int rtn = -errno;
         APPL_TRACE_ERROR("%s: Cannot write to uhid:%s",
@@ -77,17 +77,20 @@
 }
 
 /* Internal function to parse the events received from UHID driver*/
-static int uhid_event(btif_hh_device_t *p_dev)
+static int uhid_read_event(btif_hh_device_t *p_dev)
 {
+    assert(p_dev);
+
     struct uhid_event ev;
-    ssize_t ret;
     memset(&ev, 0, sizeof(ev));
+
     if(!p_dev)
     {
         APPL_TRACE_ERROR("%s: Device not found",__func__)
         return -1;
     }
-    ret = read(p_dev->fd, &ev, sizeof(ev));
+    ssize_t ret;
+    OSI_NO_INTR(ret = read(p_dev->fd, &ev, sizeof(ev)));
     if (ret == 0) {
         APPL_TRACE_ERROR("%s: Read HUP on uhid-cdev %s", __func__,
                                                  strerror(errno));
@@ -216,8 +219,8 @@
         }
         if (pfds[0].revents & POLLIN) {
             APPL_TRACE_DEBUG("%s: POLLIN", __func__);
-            ret = uhid_event(p_dev);
-            if (ret != -EINTR && ret != 0)
+            ret = uhid_read_event(p_dev);
+            if (ret != 0)
                 break;
         }
     }
diff --git a/btif/src/btif_config.cc b/btif/src/btif_config.cc
index b12bd0c..f10366a 100644
--- a/btif/src/btif_config.cc
+++ b/btif/src/btif_config.cc
@@ -136,7 +136,7 @@
   if (is_factory_reset())
     delete_config_files();
 
-  std::string file_source;
+  const char *file_source = NULL;
 
   config = btif_config_open(CONFIG_FILE_PATH);
   btif_config_source = ORIGINAL;
@@ -160,8 +160,8 @@
     file_source = "Empty";
   }
 
-  if (!file_source.empty())
-    config_set_string(config, INFO_SECTION, FILE_SOURCE, file_source.c_str());
+  if (file_source != NULL)
+    config_set_string(config, INFO_SECTION, FILE_SOURCE, file_source);
 
   if (!config) {
     LOG_ERROR(LOG_TAG, "%s unable to allocate a config object.", __func__);
diff --git a/btif/src/btif_dm.cc b/btif/src/btif_dm.cc
index 3cb0b25..d9c38f9 100644
--- a/btif/src/btif_dm.cc
+++ b/btif/src/btif_dm.cc
@@ -2532,7 +2532,7 @@
                                uint8_t pin_len, bt_pin_code_t *pin_code)
 {
     BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
-    if (pin_code == NULL)
+    if (pin_code == NULL || pin_len > PIN_CODE_LEN)
         return BT_STATUS_FAIL;
 #if (BLE_INCLUDED == TRUE)
 
diff --git a/btif/src/btif_media_task.cc b/btif/src/btif_media_task.cc
index 6d99ec7..7392013 100644
--- a/btif/src/btif_media_task.cc
+++ b/btif/src/btif_media_task.cc
@@ -153,8 +153,10 @@
 #define BTIF_MEDIA_BITRATE_STEP 5
 #endif
 
-/* Middle quality quality setting @ 44.1 khz */
-#define DEFAULT_SBC_BITRATE 328
+#ifndef BTIF_A2DP_DEFAULT_BITRATE
+/* High quality quality setting @ 44.1 khz */
+#define BTIF_A2DP_DEFAULT_BITRATE 328
+#endif
 
 #ifndef BTIF_A2DP_NON_EDR_MAX_RATE
 #define BTIF_A2DP_NON_EDR_MAX_RATE 229
@@ -460,8 +462,8 @@
 static void log_tstamps_us(const char *comment, uint64_t timestamp_us)
 {
     static uint64_t prev_us = 0;
-    APPL_TRACE_DEBUG("[%s] ts %08llu, diff : %08llu, queue sz %d", comment, timestamp_us, timestamp_us - prev_us,
-                fixed_queue_length(btif_media_cb.TxAaQ));
+    APPL_TRACE_DEBUG("[%s] ts %08llu, diff : %08llu, queue sz %d", comment, timestamp_us,
+        timestamp_us - prev_us, fixed_queue_length(btif_media_cb.TxAaQ));
     prev_us = timestamp_us;
 }
 
@@ -785,7 +787,7 @@
 
 static uint16_t btif_media_task_get_sbc_rate(void)
 {
-    uint16_t rate = DEFAULT_SBC_BITRATE;
+    uint16_t rate = BTIF_A2DP_DEFAULT_BITRATE;
 
     /* restrict bitrate if a2dp link is non-edr */
     if (!btif_av_is_peer_edr())
@@ -3021,10 +3023,8 @@
             /* Read PCM data and upsample them if needed */
             if (btif_media_aa_read_feeding(UIPC_CH_ID_AV_AUDIO))
             {
-                /* SBC encode and descramble frame */
                 SBC_Encoder(&(btif_media_cb.encoder));
-                A2D_SbcChkFrInit(btif_media_cb.encoder.pu8Packet);
-                A2D_SbcDescramble(btif_media_cb.encoder.pu8Packet, btif_media_cb.encoder.u16PacketLength);
+
                 /* Update SBC frame length */
                 p_buf->len += btif_media_cb.encoder.u16PacketLength;
                 nb_frame--;
diff --git a/device/include/interop.h b/device/include/interop.h
index 7b8ad46..369dad0 100644
--- a/device/include/interop.h
+++ b/device/include/interop.h
@@ -58,7 +58,16 @@
   // Keyboards should use a variable pin at all times. However, some keyboards
   // require a fixed pin of all 0000. This workaround enables auto pairing for
   // those keyboards.
-  INTEROP_KEYBOARD_REQUIRES_FIXED_PIN
+  INTEROP_KEYBOARD_REQUIRES_FIXED_PIN,
+
+  // Some headsets have audio jitter issues because of increased re-transmissions as the
+  // 3 Mbps packets have a lower link margin, and are more prone to interference. We can
+  // disable 3DH packets (use only 2DH packets) for the ACL link to improve sensitivity
+  // when streaming A2DP audio to the headset. Air sniffer logs show reduced
+  // re-transmissions after switching to 2DH packets.
+  //
+  // Disable 3Mbps packets and use only 2Mbps packets for ACL links when streaming audio.
+  INTEROP_2MBPS_LINK_ONLY
 } interop_feature_t;
 
 // Check if a given |addr| matches a known interoperability workaround as identified
diff --git a/device/include/interop_database.h b/device/include/interop_database.h
index f79fbbd..49cb8a5 100644
--- a/device/include/interop_database.h
+++ b/device/include/interop_database.h
@@ -36,28 +36,28 @@
   {{{0xac, 0x9e, 0x17,      0,0,0}}, 3, INTEROP_DISABLE_LE_SECURE_CONNECTIONS},
   {{{0xf0, 0x79, 0x59,      0,0,0}}, 3, INTEROP_DISABLE_LE_SECURE_CONNECTIONS},
 
-  // Motorola Key Link
-  {{{0x1c, 0x96, 0x5a,      0,0,0}}, 3, INTEROP_DISABLE_LE_SECURE_CONNECTIONS},
-
-  // Flic smart button
-  {{{0x80, 0xe4, 0xda, 0x70,  0,0}}, 4, INTEROP_DISABLE_LE_SECURE_CONNECTIONS},
+  // Ausdom M05 - unacceptably loud volume
+  {{{0xa0, 0xe9, 0xdb,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
   // BMW car kits (Harman/Becker)
   {{{0x9c, 0xdf, 0x03,      0,0,0}}, 3, INTEROP_AUTO_RETRY_PAIRING},
 
-  // Ausdom M05 - unacceptably loud volume
-  {{{0xa0, 0xe9, 0xdb,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
+  // Flic smart button
+  {{{0x80, 0xe4, 0xda, 0x70,  0,0}}, 4, INTEROP_DISABLE_LE_SECURE_CONNECTIONS},
 
   // iKross IKBT83B HS - unacceptably loud volume
   {{{0x00, 0x14, 0x02,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
-  // Jabra EXTREAM2 - unacceptably loud volume
+  // Jabra EXTREME 2 - unacceptably loud volume
   {{{0x1c, 0x48, 0xf9,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
   // JayBird BlueBuds X - low granularity on volume control
   {{{0x44, 0x5e, 0xf3,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
   {{{0xd4, 0x9c, 0x28,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
+  // JayBird Family
+  {{{0x00, 0x18, 0x91,      0,0,0}}, 3, INTEROP_2MBPS_LINK_ONLY},
+
   // LG Tone HBS-730 - unacceptably loud volume
   {{{0x00, 0x18, 0x6b,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
   {{{0xb8, 0xad, 0x3e,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
@@ -65,12 +65,22 @@
   // LG Tone HV-800 - unacceptably loud volume
   {{{0xa0, 0xe9, 0xdb,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
+  // Motorola Key Link
+  {{{0x1c, 0x96, 0x5a,      0,0,0}}, 3, INTEROP_DISABLE_LE_SECURE_CONNECTIONS},
+
   // Mpow Cheetah - unacceptably loud volume
   {{{0x00, 0x11, 0xb1,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
+  // Nissan car kits (ALPS) - auto-pairing fails and rejects next pairing
+  {{{0x34, 0xc7, 0x31,      0,0,0}}, 3, INTEROP_DISABLE_AUTO_PAIRING},
+
   // SOL REPUBLIC Tracks Air - unable to adjust volume back off from max
   {{{0xa4, 0x15, 0x66,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
+  // Subaru car kits (ALPS) - auto-pairing fails and rejects next pairing
+  {{{0x00, 0x07, 0x04,      0,0,0}}, 3, INTEROP_DISABLE_AUTO_PAIRING},
+  {{{0xe0, 0x75, 0x0a,      0,0,0}}, 3, INTEROP_DISABLE_AUTO_PAIRING},
+
   // Swage Rokitboost HS - unacceptably loud volume
   {{{0x00, 0x14, 0xf1,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
@@ -78,11 +88,8 @@
   {{{0x00, 0x26, 0x7e,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
   {{{0x90, 0x03, 0xb7,      0,0,0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
-  // Subaru car kits (ALPS) - auto-pairing fails and rejects next pairing
-  {{{0xe0, 0x75, 0x0a,      0,0,0}}, 3, INTEROP_DISABLE_AUTO_PAIRING},
-
   // Unknown keyboard (carried over from auto_pair_devlist.conf)
-  {{{0x00, 0x0F, 0xF6,      0,0,0}}, 3, INTEROP_KEYBOARD_REQUIRES_FIXED_PIN}
+  {{{0x00, 0x0F, 0xF6,      0,0,0}}, 3, INTEROP_KEYBOARD_REQUIRES_FIXED_PIN},
 };
 
 typedef struct {
@@ -93,9 +100,15 @@
 
 static const interop_name_entry_t interop_name_database[] = {
   // Carried over from auto_pair_devlist.conf migration
-  {"BMW",     3, INTEROP_DISABLE_AUTO_PAIRING},
   {"Audi",    4, INTEROP_DISABLE_AUTO_PAIRING},
+  {"BMW",     3, INTEROP_DISABLE_AUTO_PAIRING},
   {"Parrot",  6, INTEROP_DISABLE_AUTO_PAIRING},
-  {"Car",     3, INTEROP_DISABLE_AUTO_PAIRING}
+  {"Car",     3, INTEROP_DISABLE_AUTO_PAIRING},
+
+  // Nissan Quest rejects pairing after "0000"
+  {"NISSAN",  6, INTEROP_DISABLE_AUTO_PAIRING},
+
+  // Subaru car kits ("CAR M_MEDIA")
+  {"CAR",     3, INTEROP_DISABLE_AUTO_PAIRING},
 };
 
diff --git a/device/src/interop.c b/device/src/interop.c
index 8e59394..50020f7 100644
--- a/device/src/interop.c
+++ b/device/src/interop.c
@@ -114,6 +114,7 @@
     CASE_RETURN_STR(INTEROP_DISABLE_ABSOLUTE_VOLUME)
     CASE_RETURN_STR(INTEROP_DISABLE_AUTO_PAIRING)
     CASE_RETURN_STR(INTEROP_KEYBOARD_REQUIRES_FIXED_PIN)
+    CASE_RETURN_STR(INTEROP_2MBPS_LINK_ONLY)
   }
 
   return "UNKNOWN";
diff --git a/embdrv/sbc/encoder/srce/sbc_encoder.c b/embdrv/sbc/encoder/srce/sbc_encoder.c
index bb729dc..4bf95d5 100644
--- a/embdrv/sbc/encoder/srce/sbc_encoder.c
+++ b/embdrv/sbc/encoder/srce/sbc_encoder.c
@@ -29,87 +29,6 @@
 
 SINT16 EncMaxShiftCounter;
 
-/*************************************************************************************************
- * SBC encoder scramble code
- * Purpose: to tie the SBC code with BTE/mobile stack code,
- *          especially for the case when the SBC is ported into a third-party Multimedia chip
- *
- * Algorithm:
- *  init process: all counters reset to 0,
- *                calculate base_index: (6 + s16NumOfChannels*s16NumOfSubBands/2)
- *    scramble side:    the init process happens every time SBC_Encoder_Init() is called.
- *    descramble side:  it would be nice to know if he "init" process has happened.
- *                      alter the SBC SYNC word 0x9C (1001 1100) to 0x8C (1000 1100).
- *
- *  scramble process:
- *    The CRC byte:
- *    Every SBC frame has a frame header.
- *    The 1st byte is the sync word and the following 2 bytes are about the stream format.
- *    They are supposed to be "constant" within a "song"
- *    The 4th byte is the CRC byte. The CRC byte is bound to be random.
- *    Derive 2 items from the CRC byte; one is the "use" bit, the other is the "index".
- *
- *    SBC keeps 2 sets of "use" & "index"; derived the current and the previous frame.
- *
- *    The "use" bit is any bit in SBC_PRTC_USE_MASK is set.
- *    If set, SBC uses the "index" from the current frame.
- *    If not set, SBC uses the "index" from the previous frame or 0.
- *
- *    index = (CRC & 0x3) + ((CRC & 0x30) >> 2) // 8 is the max index
- *
- *    if(index > 0)
- *    {
- *        p = &u8frame[base_index];
- *        if((index&1)&&(u16PacketLength > (base_index+index*2)))
- *        {
- *            // odd index: swap 2 bytes
- *            tmp = p[index];
- *            p[index] = p[index*2];
- *            p[index*2] = tmp;
- *        }
- *        else
- *        {
- *            // even index: shift by 3
- *            tmp = (p[index] >> 5) + (p[index] << 3);
- *            p[index] = tmp;
- *        }
- *    }
- *    //else index is 0. The frame stays unaltered
- *
- */
-
-#define SBC_PRTC_CRC_IDX        3
-#define SBC_PRTC_USE_MASK       0x64
-#define SBC_PRTC_SYNC_MASK      0x10
-#define SBC_PRTC_CIDX           0
-#define SBC_PRTC_LIDX           1
-typedef struct
-{
-    uint8_t use;
-    uint8_t idx;
-} tSBC_FR_CB;
-
-typedef struct
-{
-    tSBC_FR_CB      fr[2];
-    uint8_t         init;
-    uint8_t         index;
-    uint8_t         base;
-} tSBC_PRTC_CB;
-tSBC_PRTC_CB sbc_prtc_cb;
-
-#define SBC_PRTC_IDX(sc) (((sc) & 0x3) + (((sc) & 0x30) >> 2))
-#define SBC_PRTC_CHK_INIT(ar) {if(sbc_prtc_cb.init == 0){sbc_prtc_cb.init=1; (ar)[0] &= ~SBC_PRTC_SYNC_MASK;}}
-#define SBC_PRTC_C2L() {p_last=&sbc_prtc_cb.fr[SBC_PRTC_LIDX]; p_cur=&sbc_prtc_cb.fr[SBC_PRTC_CIDX]; \
-                        p_last->idx = p_cur->idx; p_last->use = p_cur->use;}
-#define SBC_PRTC_GETC(ar) {p_cur->use = (ar)[SBC_PRTC_CRC_IDX] & SBC_PRTC_USE_MASK; \
-                           p_cur->idx = SBC_PRTC_IDX((ar)[SBC_PRTC_CRC_IDX]);}
-#define SBC_PRTC_CHK_CRC(ar) {SBC_PRTC_C2L();SBC_PRTC_GETC(ar);sbc_prtc_cb.index = (p_cur->use)?SBC_PRTC_CIDX:SBC_PRTC_LIDX;}
-#define SBC_PRTC_SCRMB(ar) {idx = sbc_prtc_cb.fr[sbc_prtc_cb.index].idx; \
-    if(idx > 0){if((idx&1)&&(pstrEncParams->u16PacketLength > (sbc_prtc_cb.base+(idx<<1)))) \
-                {tmp2=idx<<1; tmp=(ar)[idx];(ar)[idx]=(ar)[tmp2];(ar)[tmp2]=tmp;} \
-                else{tmp2=(ar)[idx]; tmp=(tmp2>>5)+(tmp2<<3);(ar)[idx]=(uint8_t)tmp;}}}
-
 #if (SBC_JOINT_STE_INCLUDED == TRUE)
 SINT32   s32LRDiff[SBC_MAX_NUM_OF_BLOCKS]    = {0};
 SINT32   s32LRSum[SBC_MAX_NUM_OF_BLOCKS]     = {0};
@@ -132,8 +51,6 @@
     SINT32 *pSum, *pDiff;
 #endif
     uint8_t  *pu8;
-    tSBC_FR_CB  *p_cur, *p_last;
-    uint32_t     idx, tmp, tmp2;
     register SINT32  s32NumOfSubBands = pstrEncParams->s16NumOfSubBands;
 
     pstrEncParams->pu8NextPacket = pstrEncParams->pu8Packet;
@@ -270,17 +187,6 @@
         pu8 = pstrEncParams->pu8NextPacket;
         /* Quantize the encoded audio */
         EncPacking(pstrEncParams);
-
-        /* scramble the code */
-        SBC_PRTC_CHK_INIT(pu8);
-        SBC_PRTC_CHK_CRC(pu8);
-#if 0
-        if(pstrEncParams->u16PacketLength > ((sbc_prtc_cb.fr[sbc_prtc_cb.index].idx * 2) + sbc_prtc_cb.base))
-            printf("len: %d, idx: %d\n", pstrEncParams->u16PacketLength, sbc_prtc_cb.fr[sbc_prtc_cb.index].idx);
-        else
-            printf("len: %d, idx: %d!!!!\n", pstrEncParams->u16PacketLength, sbc_prtc_cb.fr[sbc_prtc_cb.index].idx);
-#endif
-        SBC_PRTC_SCRMB((&pu8[sbc_prtc_cb.base]));
     }
     while(--(pstrEncParams->u8NumPacketToEncode));
 
@@ -397,7 +303,4 @@
             pstrEncParams->u16BitRate, pstrEncParams->s16BitPool);
 
     SbcAnalysisInit();
-
-    memset(&sbc_prtc_cb, 0, sizeof(tSBC_PRTC_CB));
-    sbc_prtc_cb.base = 6 + pstrEncParams->s16NumOfChannels*pstrEncParams->s16NumOfSubBands/2;
 }
diff --git a/hci/src/packet_fragmenter.cc b/hci/src/packet_fragmenter.cc
index 1c8a145..74f6fbf 100644
--- a/hci/src/packet_fragmenter.cc
+++ b/hci/src/packet_fragmenter.cc
@@ -150,6 +150,12 @@
         return;
       }
 
+      if (acl_length < L2CAP_HEADER_SIZE) {
+        LOG_WARN(LOG_TAG, "%s L2CAP packet too small (%d < %d). Dropping it.", __func__, packet->len, L2CAP_HEADER_SIZE);
+        buffer_allocator->free(packet);
+        return;
+      }
+
       uint16_t full_length = l2cap_length + L2CAP_HEADER_SIZE + HCI_ACL_PREAMBLE_SIZE;
 
       // Check for buffer overflow and that the full packet size + BT_HDR size is less than
diff --git a/osi/src/allocation_tracker.cc b/osi/src/allocation_tracker.cc
index 1b8d5a1..c4f9705 100644
--- a/osi/src/allocation_tracker.cc
+++ b/osi/src/allocation_tracker.cc
@@ -37,21 +37,15 @@
   bool freed;
 } allocation_t;
 
-static const size_t canary_size = 8;
-static char canary[canary_size];
+static const char *canary = "tinybird";
+
+static size_t canary_size;
 static std::unordered_map<void*, allocation_t*> allocations;
 static pthread_mutex_t lock;
 static bool enabled = false;
 
 void allocation_tracker_init(void) {
-  if (enabled)
-    return;
-
-  // randomize the canary contents
-  for (size_t i = 0; i < canary_size; i++)
-     canary[i] = (char)osi_rand();
-
-  LOG_DEBUG(LOG_TAG, "canary initialized");
+  canary_size = strlen(canary);
 
   pthread_mutex_init(&lock, NULL);
 
diff --git a/stack/a2dp/a2d_int.h b/stack/a2dp/a2d_int.h
index d7569d1..45a2a15 100644
--- a/stack/a2dp/a2d_int.h
+++ b/stack/a2dp/a2d_int.h
@@ -57,7 +57,6 @@
 {
     tA2D_FIND_CB    find;   /* find service control block */
     uint8_t         trace_level;
-    bool            use_desc;
     uint16_t        avdt_sdp_ver;   /* AVDTP version */
 } tA2D_CB;
 
diff --git a/stack/a2dp/a2d_sbc.c b/stack/a2dp/a2d_sbc.c
index 37d712f..834466b 100644
--- a/stack/a2dp/a2d_sbc.c
+++ b/stack/a2dp/a2d_sbc.c
@@ -31,177 +31,6 @@
 #include "a2d_sbc.h"
 #include "bt_utils.h"
 
-/*************************************************************************************************
- * SBC descramble code
- * Purpose: to tie the SBC code with BTE/mobile stack code,
- *          especially for the case when the SBC is ported into a third-party Multimedia chip
- *
- * Algorithm:
- *  init process: all counters reset to 0,
- *                calculate base_index: (6 + s16NumOfChannels*s16NumOfSubBands/2)
- *    scramble side:    the init process happens every time SBC_Encoder_Init() is called.
- *    descramble side:  it would be nice to know if he "init" process has happened.
- *                      alter the SBC SYNC word 0x9C (1001 1100) to 0x8C (1000 1100).
- *
- *  scramble process:
- *    The CRC byte:
- *    Every SBC frame has a frame header.
- *    The 1st byte is the sync word and the following 2 bytes are about the stream format.
- *    They are supposed to be "constant" within a "song"
- *    The 4th byte is the CRC byte. The CRC byte is bound to be random.
- *    Derive 2 items from the CRC byte; one is the "use" bit, the other is the "index".
- *
- *    SBC keeps 2 sets of "use" & "index"; derived the current and the previous frame.
- *
- *    The "use" bit is any bit in SBC_PRTC_USE_MASK is set.
- *    If set, SBC uses the "index" from the current frame.
- *    If not set, SBC uses the "index" from the previous frame or 0.
- *
- *    index = (CRC & 0x3) + ((CRC & 0x30) >> 2) // 8 is the max index
- *
- *    if(index > 0)
- *    {
- *        p = &u8frame[base_index];
- *        if((index&1)&&(u16PacketLength > (base_index+index*2)))
- *        {
- *            // odd index: swap 2 bytes
- *            tmp = p[index];
- *            p[index] = p[index*2];
- *            p[index*2] = tmp;
- *        }
- *        else
- *        {
- *            // even index: shift by 3
- *            tmp = (p[index] >> 3) + (p[index] << 5);
- *            p[index] = tmp;
- *        }
- *    }
- *    //else index is 0. The frame stays unaltered
- *
- */
-#define A2D_SBC_SYNC_WORD       0x9C
-#define A2D_SBC_CRC_IDX         3
-#define A2D_SBC_USE_MASK        0x64
-#define A2D_SBC_SYNC_MASK       0x10
-#define A2D_SBC_CIDX            0
-#define A2D_SBC_LIDX            1
-#define A2D_SBC_CH_M_BITS       0xC /* channel mode bits: 0: mono; 1 ch */
-#define A2D_SBC_SUBBAND_BIT     0x1 /* num of subband bit: 0:4; 1: 8 */
-
-#define A2D_SBC_GET_IDX(sc) (((sc) & 0x3) + (((sc) & 0x30) >> 2))
-
-typedef struct
-{
-    uint8_t use;
-    uint8_t idx;
-} tA2D_SBC_FR_CB;
-
-typedef struct
-{
-    tA2D_SBC_FR_CB  fr[2];
-    uint8_t         index;
-    uint8_t         base;
-} tA2D_SBC_DS_CB;
-
-static tA2D_SBC_DS_CB a2d_sbc_ds_cb;
-/*int a2d_count = 0;*/
-/******************************************************************************
-**
-** Function         A2D_SbcChkFrInit
-**
-** Description      check if need to init the descramble control block.
-**
-** Returns          nothing.
-******************************************************************************/
-void A2D_SbcChkFrInit(uint8_t *p_pkt)
-{
-    uint8_t fmt;
-    uint8_t num_chnl = 1;
-    uint8_t num_subband = 4;
-
-    if((p_pkt[0] & A2D_SBC_SYNC_MASK) == 0)
-    {
-        a2d_cb.use_desc = true;
-        fmt = p_pkt[1];
-        p_pkt[0] |= A2D_SBC_SYNC_MASK;
-        memset(&a2d_sbc_ds_cb, 0, sizeof(tA2D_SBC_DS_CB));
-        if(fmt & A2D_SBC_CH_M_BITS)
-            num_chnl = 2;
-        if(fmt & A2D_SBC_SUBBAND_BIT)
-            num_subband = 8;
-        a2d_sbc_ds_cb.base = 6 + num_chnl*num_subband/2;
-        /*printf("base: %d\n", a2d_sbc_ds_cb.base);
-        a2d_count = 0;*/
-    }
-}
-
-/******************************************************************************
-**
-** Function         A2D_SbcDescramble
-**
-** Description      descramble the packet.
-**
-** Returns          nothing.
-******************************************************************************/
-void A2D_SbcDescramble(uint8_t *p_pkt, uint16_t len)
-{
-    tA2D_SBC_FR_CB *p_cur, *p_last;
-    uint32_t idx, tmp, tmp2;
-
-    if(a2d_cb.use_desc)
-    {
-        /* c2l */
-        p_last  = &a2d_sbc_ds_cb.fr[A2D_SBC_LIDX];
-        p_cur   = &a2d_sbc_ds_cb.fr[A2D_SBC_CIDX];
-        p_last->idx = p_cur->idx;
-        p_last->use = p_cur->use;
-        /* getc */
-        p_cur->use = p_pkt[A2D_SBC_CRC_IDX] & A2D_SBC_USE_MASK;
-        p_cur->idx = A2D_SBC_GET_IDX(p_pkt[A2D_SBC_CRC_IDX]);
-        a2d_sbc_ds_cb.index = (p_cur->use)?A2D_SBC_CIDX:A2D_SBC_LIDX;
-        /*
-        printf("%05d: ar[%02d]: x%02x, msk: x%02x, use: %s, idx: %02d, ",
-            a2d_count++,
-            A2D_SBC_CRC_IDX, p_pkt[A2D_SBC_CRC_IDX], A2D_SBC_USE_MASK,
-            (p_cur->use)?"cur":"lst", p_cur->idx);
-        */
-        /* descramble */
-        idx = a2d_sbc_ds_cb.fr[a2d_sbc_ds_cb.index].idx;
-        if(idx > 0)
-        {
-            p_pkt = &p_pkt[a2d_sbc_ds_cb.base];
-            if((idx&1) && (len > (a2d_sbc_ds_cb.base+(idx<<1))))
-            {
-                tmp2        = (idx<<1);
-                tmp         = p_pkt[idx];
-                p_pkt[idx]  = p_pkt[tmp2];
-                p_pkt[tmp2]  = tmp;
-                /*
-                printf("tmp2: %02d, len: %d, idx: %d\n",
-                    tmp2, len, a2d_sbc_ds_cb.fr[a2d_sbc_ds_cb.index].idx);
-                    */
-            }
-            else
-            {
-                tmp2        = p_pkt[idx];
-                tmp         = (tmp2>>3)+(tmp2<<5);
-                p_pkt[idx]  = (uint8_t)tmp;
-                /*
-                printf("tmp: x%02x, len: %d, idx: %d(cmp:%d)\n",
-                    (uint8_t)tmp2, len, a2d_sbc_ds_cb.fr[a2d_sbc_ds_cb.index].idx,
-                    (a2d_sbc_ds_cb.base+(idx<<1)));
-                    */
-            }
-        }
-        /*
-        else
-        {
-            printf("!!!!\n");
-        }
-        */
-    }
-}
-
 /******************************************************************************
 **
 ** Function         A2D_BldSbcInfo
diff --git a/stack/avdt/avdt_l2c.c b/stack/avdt/avdt_l2c.c
index e5a4c4a..02830fd 100644
--- a/stack/avdt/avdt_l2c.c
+++ b/stack/avdt/avdt_l2c.c
@@ -33,7 +33,7 @@
 #include "l2cdefs.h"
 #include "btm_api.h"
 #include "btm_int.h"
-
+#include "device/include/interop.h"
 
 /* callback function declarations */
 void avdt_l2c_connect_ind_cback(BD_ADDR bd_addr, uint16_t lcid, uint16_t psm, uint8_t id);
@@ -202,6 +202,15 @@
             p_tbl->state = AVDT_AD_ST_SEC_ACP;
             p_tbl->cfg_flags = AVDT_L2C_CFG_CONN_ACP;
 
+            if (interop_match_addr(INTEROP_2MBPS_LINK_ONLY, (const bt_bdaddr_t *)&bd_addr)) {
+                // Disable 3DH packets for AVDT ACL to improve sensitivity on HS
+                tACL_CONN *p_acl_cb = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
+                btm_set_packet_types(p_acl_cb, (btm_cb.btm_acl_pkt_types_supported |
+                                                HCI_PKT_TYPES_MASK_NO_3_DH1 |
+                                                HCI_PKT_TYPES_MASK_NO_3_DH3 |
+                                                HCI_PKT_TYPES_MASK_NO_3_DH5));
+            }
+
             /* Check the security */
             rc = btm_sec_mx_access_request (bd_addr, AVDT_PSM,
                 false, BTM_SEC_PROTO_AVDT,
@@ -321,6 +330,15 @@
                         p_tbl->lcid = lcid;
                         p_tbl->cfg_flags = AVDT_L2C_CFG_CONN_INT;
 
+                        if (interop_match_addr(INTEROP_2MBPS_LINK_ONLY, (const bt_bdaddr_t *) &p_ccb->peer_addr)) {
+                            // Disable 3DH packets for AVDT ACL to improve sensitivity on HS
+                            tACL_CONN *p_acl_cb = btm_bda_to_acl(p_ccb->peer_addr, BT_TRANSPORT_BR_EDR);
+                            btm_set_packet_types(p_acl_cb, (btm_cb.btm_acl_pkt_types_supported |
+                                                            HCI_PKT_TYPES_MASK_NO_3_DH1 |
+                                                            HCI_PKT_TYPES_MASK_NO_3_DH3 |
+                                                            HCI_PKT_TYPES_MASK_NO_3_DH5));
+                        }
+
                         /* Check the security */
                         btm_sec_mx_access_request (p_ccb->peer_addr, AVDT_PSM,
                             true, BTM_SEC_PROTO_AVDT,
diff --git a/stack/avdt/avdt_msg.c b/stack/avdt/avdt_msg.c
index ddbeb55..dbeb016 100644
--- a/stack/avdt/avdt_msg.c
+++ b/stack/avdt/avdt_msg.c
@@ -1661,9 +1661,9 @@
     p_buf->len = (uint16_t) (p - p_start);
 
     /* stash sig, label, and message type in buf */
-    p_buf->event = 0;
-    AVDT_BLD_LAYERSPEC(p_buf->layer_specific, 0, p_params->hdr.label);
-    AVDT_TRACE_DEBUG("avdt_msg_send_grej");
+    p_buf->event = sig_id;
+    AVDT_BLD_LAYERSPEC(p_buf->layer_specific, AVDT_MSG_TYPE_GRJ, p_params->hdr.label);
+    AVDT_TRACE_DEBUG(__func__);
 
     /* queue message and trigger ccb to send it */
     fixed_queue_enqueue(p_ccb->rsp_q, p_buf);
diff --git a/stack/gatt/gatt_api.c b/stack/gatt/gatt_api.c
index b0f22a0..db5bce7 100644
--- a/stack/gatt/gatt_api.c
+++ b/stack/gatt/gatt_api.c
@@ -1056,7 +1056,7 @@
     uint8_t      i_gatt_if=0;
     tGATT_IF     gatt_if=0;
 
-    GATT_TRACE_API("%s", __func__);
+    GATT_TRACE_API ("%s", __func__);
     gatt_dbg_display_uuid(*p_app_uuid128);
 
     for (i_gatt_if = 0, p_reg = gatt_cb.cl_rcb; i_gatt_if < GATT_MAX_APPS; i_gatt_if++, p_reg++)
@@ -1080,13 +1080,12 @@
             p_reg->app_cb      = *p_cb_info;
             p_reg->in_use      = true;
 
-            GATT_TRACE_API("%s: allocated gatt_if=%d", __func__, gatt_if);
+            GATT_TRACE_API ("%s: allocated gatt_if=%d", __func__, gatt_if);
             return gatt_if;
         }
     }
 
-    GATT_TRACE_ERROR("%s: can't Register GATT client, MAX client %d reached!",
-                     __func__, GATT_MAX_APPS);
+    GATT_TRACE_ERROR ("%s: can't Register GATT client, MAX client reached!", __func__);
     return 0;
 }