Merge commit '4bf68bf020c7fd1aabcdc4b5d8f5fbb8bacdec9d' into merge_work

Change-Id: Ibc6d6e691b7f97611d16f96220346dfd6ffbbf52

58 files changed, 591 insertions, 231 deletions

diff --git a/bta/ag/bta_ag_sco.c b/bta/ag/bta_ag_sco.c
index a9f6d37c6..42fd82f77 100644
--- a/bta/ag/bta_ag_sco.c
+++ b/bta/ag/bta_ag_sco.c
@@ -23,7 +23,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bta_api.h"
 #include "bta_ag_api.h"
 #include "bta_ag_co.h"
diff --git a/bta/av/bta_av_aact.c b/bta/av/bta_av_aact.c
index fd5752381..c394d66ea 100644
--- a/bta/av/bta_av_aact.c
+++ b/bta/av/bta_av_aact.c
@@ -2172,6 +2172,7 @@ void bta_av_reconfig (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
         /* close the stream */
         APPL_TRACE_DEBUG("close/open num_protect: %d", p_cfg->num_protect);
         if(p_scb->started)
+        {
             bta_av_str_stopped(p_scb, NULL);
             p_scb->started = FALSE;
 
@@ -2179,7 +2180,7 @@ void bta_av_reconfig (tBTA_AV_SCB *p_scb, tBTA_AV_DATA *p_data)
             L2CA_FlushChannel (p_scb->l2c_cid, L2CAP_FLUSH_CHANS_ALL);
 
             AVDT_CloseReq(p_scb->avdt_handle);
-
+        }
     }
 }
 
diff --git a/bta/dm/bta_dm_act.c b/bta/dm/bta_dm_act.c
index ee3ba8f35..2feb2cc3c 100644
--- a/bta/dm/bta_dm_act.c
+++ b/bta/dm/bta_dm_act.c
@@ -5001,17 +5001,24 @@ void bta_dm_ble_track_advertiser(tBTA_DM_MSG *p_data)
     BD_ADDR bda;
     memset(&bda, 0 , sizeof(BD_ADDR));
     tBTM_BLE_VSC_CB cmn_ble_vsc_cb;
+    tBTA_DM_BLE_TRACK_ADV_DATA track_adv_data;
 
     BTM_BleGetVendorCapabilities(&cmn_ble_vsc_cb);
 
     if (0 != cmn_ble_vsc_cb.tot_scan_results_strg)
     {
-        btm_status = BTM_BleTrackAdvertiser(p_data->ble_track_advert.p_track_adv_cback,
+        btm_status = BTM_BleTrackAdvertiser((tBTM_BLE_TRACK_ADV_CBACK *)
+                                            p_data->ble_track_advert.p_track_adv_cback,
                                             p_data->ble_track_advert.ref_value);
     }
 
     if(BTM_CMD_STARTED != btm_status)
-       p_data->ble_track_advert.p_track_adv_cback(0, 0, bda, 0, p_data->ble_track_advert.ref_value);
+    {
+        memset(&track_adv_data, 0, sizeof(tBTA_DM_BLE_TRACK_ADV_DATA));
+        track_adv_data.advertiser_info_present = NO_ADV_INFO_PRESENT; /* Indicates failure */
+        track_adv_data.client_if = (UINT8)p_data->ble_track_advert.ref_value;
+        p_data->ble_track_advert.p_track_adv_cback(&track_adv_data);
+    }
 }
 
 /*******************************************************************************
diff --git a/bta/dm/bta_dm_cfg.c b/bta/dm/bta_dm_cfg.c
index e16b9f3fa..afa54d7e5 100644
--- a/bta/dm/bta_dm_cfg.c
+++ b/bta/dm/bta_dm_cfg.c
@@ -24,7 +24,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bt_target.h"
 #include "bta_sys.h"
 #include "bta_api.h"
diff --git a/bta/hf_client/bta_hf_client_act.c b/bta/hf_client/bta_hf_client_act.c
index 880baca16..30b523726 100644
--- a/bta/hf_client/bta_hf_client_act.c
+++ b/bta/hf_client/bta_hf_client_act.c
@@ -32,6 +32,7 @@
 #include "bta_sys.h"
 #include "utl.h"
 #include "bt_utils.h"
+#include "osi/include/compat.h"
 #include <string.h>
 
 /*****************************************************************************
diff --git a/bta/hf_client/bta_hf_client_api.c b/bta/hf_client/bta_hf_client_api.c
index 2d95ca3f0..62d83358b 100644
--- a/bta/hf_client/bta_hf_client_api.c
+++ b/bta/hf_client/bta_hf_client_api.c
@@ -27,6 +27,7 @@
 #include <string.h>
 #include "bta_hf_client_api.h"
 #include "bta_hf_client_int.h"
+#include "osi/include/compat.h"
 
 /*****************************************************************************
 **  Constants and data types
diff --git a/bta/hh/bta_hh_act.c b/bta/hh/bta_hh_act.c
index 3c5cf7396..fdcc99821 100644
--- a/bta/hh/bta_hh_act.c
+++ b/bta/hh/bta_hh_act.c
@@ -165,15 +165,15 @@ void bta_hh_disc_cmpl(void)
     tBTA_HH_STATUS  status = BTA_HH_OK;
 
     /* Deregister with lower layer */
-    if (HID_HostDeregister()!= HID_SUCCESS)
+    if (HID_HostDeregister() != HID_SUCCESS)
         status = BTA_HH_ERR;
 
 #if (BTA_HH_LE_INCLUDED == TRUE)
     bta_hh_le_deregister();
-    return;
-#endif
-
+    UNUSED(status);
+#else
     bta_hh_cleanup_disable(status);
+#endif
 }
 
 /*******************************************************************************
@@ -189,7 +189,7 @@ static void bta_hh_sdp_cback(UINT16 result, UINT16 attr_mask,
                                   tHID_DEV_SDP_INFO *sdp_rec )
 {
     tBTA_HH_DEV_CB     *p_cb = bta_hh_cb.p_cur;
-    UINT8              hdl;
+    UINT8              hdl = 0;
     tBTA_HH_STATUS    status = BTA_HH_ERR_SDP;
 
     /* make sure sdp succeeded and hh has not been disabled */
diff --git a/bta/hh/bta_hh_le.c b/bta/hh/bta_hh_le.c
index 99a5627f8..fee2cda85 100644
--- a/bta/hh/bta_hh_le.c
+++ b/bta/hh/bta_hh_le.c
@@ -2317,11 +2317,12 @@ void bta_hh_le_write_char_descr_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_b
     else
     {
 #if BTA_HH_DEBUG == TRUE
-        APPL_TRACE_ERROR("Unexpected write to %s(0x%04x)",
+            APPL_TRACE_ERROR("Unexpected write to %s(0x%04x)",
                         bta_hh_uuid_to_str(p_data->descr_type.uuid.uu.uuid16),
                         p_data->descr_type.uuid.uu.uuid16);
 #else
-        APPL_TRACE_ERROR("Unexpected write to (0x%04x)", p_data->descr_type.uuid.uu.uuid16);
+            APPL_TRACE_ERROR("Unexpected write to (0x%04x)",
+                        p_data->descr_type.uuid.uu.uuid16);
 #endif
     }
 
diff --git a/bta/hl/bta_hl_ci.c b/bta/hl/bta_hl_ci.c
index 792b08f37..17e1e67f9 100644
--- a/bta/hl/bta_hl_ci.c
+++ b/bta/hl/bta_hl_ci.c
@@ -24,7 +24,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bta_api.h"
 #include "btm_api.h"
 #include "bta_sys.h"
diff --git a/bta/hl/bta_hl_main.c b/bta/hl/bta_hl_main.c
index 7d7cc839f..86fdd17e3 100644
--- a/bta/hl/bta_hl_main.c
+++ b/bta/hl/bta_hl_main.c
@@ -938,11 +938,9 @@ static void bta_hl_api_cch_close(tBTA_HL_CB *p_cb, tBTA_HL_DATA *p_data)
                 APPL_TRACE_ERROR("bta_hl_api_cch_close Null Callback");
             }
             break;
-
         default:
             APPL_TRACE_ERROR("status code=%d", status);
             break;
-
     }
 
 }
diff --git a/bta/include/bta_api.h b/bta/include/bta_api.h
index e7c9f7337..31d8729ce 100644
--- a/bta/include/bta_api.h
+++ b/bta/include/bta_api.h
@@ -982,6 +982,7 @@ typedef UINT8  tBTA_DM_BLE_PF_RSSI_THRESHOLD;
 typedef UINT8  tBTA_DM_BLE_PF_DELIVERY_MODE;
 typedef UINT16 tBTA_DM_BLE_PF_TIMEOUT;
 typedef UINT8  tBTA_DM_BLE_PF_TIMEOUT_CNT;
+typedef UINT16 tBTA_DM_BLE_PF_ADV_TRACK_ENTRIES;
 
 typedef struct
 {
@@ -994,6 +995,7 @@ typedef struct
     tBTA_DM_BLE_PF_TIMEOUT found_timeout;
     tBTA_DM_BLE_PF_TIMEOUT lost_timeout;
     tBTA_DM_BLE_PF_TIMEOUT_CNT found_timeout_cnt;
+    tBTA_DM_BLE_PF_ADV_TRACK_ENTRIES num_of_tracking_entries;
 } tBTA_DM_BLE_PF_FILT_PARAMS;
 
 /* Search callback events */
@@ -1107,6 +1109,12 @@ typedef tBTM_BLE_ENERGY_USED        tBTA_DM_BLE_ENERGY_USED;
 
 typedef UINT8 tBTA_DM_CONTRL_STATE;
 
+typedef UINT8 tBTA_DM_BLE_ADV_STATE;
+typedef UINT8 tBTA_DM_BLE_ADV_INFO_PRESENT;
+typedef UINT8 tBTA_DM_BLE_RSSI_VALUE;
+typedef UINT16 tBTA_DM_BLE_ADV_INFO_TIMESTAMP;
+
+typedef tBTM_BLE_TRACK_ADV_DATA tBTA_DM_BLE_TRACK_ADV_DATA;
 
 typedef void (tBTA_BLE_SCAN_THRESHOLD_CBACK)(tBTA_DM_BLE_REF_VALUE ref_value);
 
@@ -1122,8 +1130,7 @@ typedef void (tBTA_BLE_TRACK_ADV_CMPL_CBACK)(int action, tBTA_STATUS status,
                                              tBTA_DM_BLE_PF_AVBL_SPACE avbl_space,
                                              tBTA_DM_BLE_REF_VALUE ref_value);
 
-typedef void (tBTA_BLE_TRACK_ADV_CBACK)(int filt_index, tBLE_ADDR_TYPE addr_type, BD_ADDR bda,
-                                        int adv_state, tBTA_DM_BLE_REF_VALUE ref_value);
+typedef void (tBTA_BLE_TRACK_ADV_CBACK)(tBTA_DM_BLE_TRACK_ADV_DATA *p_adv_data);
 
 typedef void (tBTA_BLE_ENERGY_INFO_CBACK)(tBTA_DM_BLE_TX_TIME_MS tx_time,
                                           tBTA_DM_BLE_RX_TIME_MS rx_time,
diff --git a/bta/mce/bta_mce_main.c b/bta/mce/bta_mce_main.c
index a7cbb01a3..a0536ff9f 100644
--- a/bta/mce/bta_mce_main.c
+++ b/bta/mce/bta_mce_main.c
@@ -24,7 +24,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bta_api.h"
 #include "bta_sys.h"
 #include "bta_mce_api.h"
diff --git a/bta/sys/bta_sys_conn.c b/bta/sys/bta_sys_conn.c
index accff7c92..087a9ff75 100644
--- a/bta/sys/bta_sys_conn.c
+++ b/bta/sys/bta_sys_conn.c
@@ -23,7 +23,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bta_api.h"
 #include "bta_sys.h"
 #include "bta_sys_int.h"
diff --git a/bta/sys/utl.c b/bta/sys/utl.c
index d193d6f78..c2b0b4ce5 100644
--- a/bta/sys/utl.c
+++ b/bta/sys/utl.c
@@ -22,7 +22,6 @@
  *
  ******************************************************************************/
 #include <stddef.h>
-
 #include "utl.h"
 #include "gki.h"
 #include "btm_api.h"
diff --git a/btif/co/bta_hh_co.c b/btif/co/bta_hh_co.c
index 5ca4fc3ab..b0ab2e08e 100644
--- a/btif/co/bta_hh_co.c
+++ b/btif/co/bta_hh_co.c
@@ -26,6 +26,7 @@
 #include <string.h>
 #include <stdint.h>
 #include <errno.h>
+#include <unistd.h>
 #include <linux/uhid.h>
 #include <unistd.h>
 #include "btif_hh.h"
diff --git a/btif/include/btif_gatt_util.h b/btif/include/btif_gatt_util.h
index 18983175f..b0292b8d7 100644
--- a/btif/include/btif_gatt_util.h
+++ b/btif/include/btif_gatt_util.h
@@ -36,6 +36,8 @@ uint16_t set_read_value(btgatt_read_params_t *p_dest, tBTA_GATTC_READ *p_src);
 uint16_t get_uuid16(tBT_UUID *p_uuid);
 
 void btif_gatt_check_encrypted_link(BD_ADDR bd_addr);
+extern void btif_gatt_move_track_adv_data(btgatt_track_adv_info_t *p_dest,
+                                btgatt_track_adv_info_t *p_src);
 
 #endif
 
diff --git a/btif/include/btif_sock_sdp.h b/btif/include/btif_sock_sdp.h
index d374d72cd..857c2fba2 100644
--- a/btif/include/btif_sock_sdp.h
+++ b/btif/include/btif_sock_sdp.h
@@ -19,6 +19,8 @@
 #ifndef BTIF_SOCK_SDP_H
 #define BTIF_SOCK_SDP_H
 
+#include <string.h>
+
 static const uint8_t  UUID_OBEX_OBJECT_PUSH[] = {0x00, 0x00, 0x11, 0x05, 0x00, 0x00, 0x10, 0x00,
                                                  0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB};
 static const uint8_t  UUID_PBAP_PSE[]         = {0x00, 0x00, 0x11, 0x2F, 0x00, 0x00, 0x10, 0x00,
diff --git a/btif/include/btif_sock_util.h b/btif/include/btif_sock_util.h
index 6e504f9bc..eff18d2d3 100644
--- a/btif/include/btif_sock_util.h
+++ b/btif/include/btif_sock_util.h
@@ -27,42 +27,8 @@
 #ifndef BTIF_SOCK_UTIL_H
 #define BTIF_SOCK_UTIL_H
 
-#include <pthread.h>
-
 #include "osi/include/log.h"
 
-/*******************************************************************************
-**  Functions
-********************************************************************************/
-
-static inline void init_slot_lock( pthread_mutex_t* mutex)
-{
-    pthread_mutexattr_t attr;
-    pthread_mutexattr_init(&attr);
-    pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE_NP);
-    pthread_mutex_init(mutex, &attr);
-}
-
-static inline void lock_slot(pthread_mutex_t* mutex)
-{
-    // TODO: Commented out since definition of pthread_mutext_t changed to remove value.
-    // Check is for a programming error - however, should re-implement if there's a 
-    // solution.
-    //if(mutex->value)
-        pthread_mutex_lock(mutex);
-    //else LOG_ERROR("mutex: %p is not initialized", mutex);
-}
-
-static inline void unlock_slot(pthread_mutex_t* mutex)
-{
-    // TODO: Commented out since definition of pthread_mutext_t changed to remove value.
-    // Check is for a programming error - however, should re-implement if there's a 
-    // solution.
-    //if(mutex->value)
-        pthread_mutex_unlock(mutex);
-    //else LOG_ERROR("mutex: %p is not initialized", mutex);
-}
-
 void dump_bin(const char* title, const char* data, int size);
 
 int sock_send_fd(int sock_fd, const uint8_t* buffer, int len, int send_fd);
diff --git a/btif/src/btif_config.c b/btif/src/btif_config.c
index 3c5e1c43f..8679e3c00 100644
--- a/btif/src/btif_config.c
+++ b/btif/src/btif_config.c
@@ -29,6 +29,7 @@
 #include "btif_config.h"
 #include "btif_config_transcode.h"
 #include "btif_util.h"
+#include "osi/include/compat.h"
 #include "osi/include/config.h"
 #include "btcore/include/module.h"
 #include "osi/include/osi.h"
diff --git a/btif/src/btif_core.c b/btif/src/btif_core.c
index f202d7b0b..220965957 100644
--- a/btif/src/btif_core.c
+++ b/btif/src/btif_core.c
@@ -848,11 +848,11 @@ static void execute_storage_request(UINT16 event, char *p_param)
                 local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
                 local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
                 local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
-                local_le_features.scan_result_storage_size_hibyte =
-                    (cmn_vsc_cb.tot_scan_results_strg >> 8) & (0xFF);
-                local_le_features.scan_result_storage_size_lobyte =
-                    (cmn_vsc_cb.tot_scan_results_strg) & (0xFF);
+                local_le_features.scan_result_storage_size = cmn_vsc_cb.tot_scan_results_strg;
                 local_le_features.activity_energy_info_supported = cmn_vsc_cb.energy_support;
+                local_le_features.version_supported = cmn_vsc_cb.version_supported;
+                local_le_features.total_trackable_advertisers =
+                    cmn_vsc_cb.total_trackable_advertisers;
                 memcpy(prop.val, &local_le_features, prop.len);
                 #endif
             }
diff --git a/btif/src/btif_dm.c b/btif/src/btif_dm.c
index 5b86ab406..9e81af62e 100644
--- a/btif/src/btif_dm.c
+++ b/btif/src/btif_dm.c
@@ -27,9 +27,11 @@
 
 #define LOG_TAG "bt_btif_dm"
 
+#include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <hardware/bluetooth.h>
@@ -1903,11 +1905,11 @@ static void btif_dm_upstreams_evt(UINT16 event, char* p_param)
             local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
             local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
             local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
-            local_le_features.scan_result_storage_size_hibyte =
-                (cmn_vsc_cb.tot_scan_results_strg >> 8) & (0xFF);
-            local_le_features.scan_result_storage_size_lobyte =
-                (cmn_vsc_cb.tot_scan_results_strg) & (0xFF);
             local_le_features.activity_energy_info_supported = cmn_vsc_cb.energy_support;
+            local_le_features.scan_result_storage_size = cmn_vsc_cb.tot_scan_results_strg;
+            local_le_features.version_supported = cmn_vsc_cb.version_supported;
+            local_le_features.total_trackable_advertisers =
+                        cmn_vsc_cb.total_trackable_advertisers;
             memcpy(prop.val, &local_le_features, prop.len);
             HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1, &prop);
             break;
@@ -2506,7 +2508,7 @@ bt_status_t btif_dm_get_adapter_property(bt_property_t *prop)
         case BT_PROPERTY_BDNAME:
         {
             bt_bdname_t *bd_name = (bt_bdname_t*)prop->val;
-            strncpy((char *)bd_name->name,btif_get_default_local_name(),
+            strncpy((char *)bd_name->name, (char *)btif_get_default_local_name(),
                    sizeof(bd_name->name) - 1);
             bd_name->name[sizeof(bd_name->name) - 1] = 0;
             prop->len = strlen((char *)bd_name->name);
diff --git a/btif/src/btif_gatt_client.c b/btif/src/btif_gatt_client.c
index bd72e032f..df766c101 100644
--- a/btif/src/btif_gatt_client.c
+++ b/btif/src/btif_gatt_client.c
@@ -136,12 +136,10 @@ typedef struct
 {
     uint8_t  status;
     uint8_t  client_if;
-    uint8_t  filt_index;
-    uint8_t  adv_state;
     uint8_t  action;
     uint8_t  avbl_space;
     uint8_t  lost_timeout;
-    bt_bdaddr_t bd_addr;
+    tBLE_ADDR_TYPE addr_type;
     uint8_t  batch_scan_full_max;
     uint8_t  batch_scan_trunc_max;
     uint8_t  batch_scan_notify_threshold;
@@ -149,10 +147,10 @@ typedef struct
     uint32_t scan_interval;
     uint32_t scan_window;
     tBTA_BLE_DISCARD_RULE discard_rule;
-    tBLE_ADDR_TYPE        addr_type;
-    btgatt_batch_reports read_reports;
+    btgatt_batch_reports  read_reports;
 } btgatt_batch_track_cb_t;
 
+
 typedef tBTA_DM_BLE_PF_FILT_PARAMS btgatt_adv_filt_param_t;
 
 typedef struct
@@ -778,10 +776,13 @@ static void btif_gattc_upstreams_evt(uint16_t event, char* p_param)
 
         case BTA_GATTC_ADV_VSC_EVT:
         {
-            btgatt_batch_track_cb_t *p_data = (btgatt_batch_track_cb_t*) p_param;
-            HAL_CBACK(bt_gatt_callbacks, client->track_adv_event_cb
-                    ,p_data->client_if, p_data->filt_index, p_data->addr_type, &p_data->bd_addr
-                    ,p_data->adv_state);
+            btgatt_track_adv_info_t *p_data = (btgatt_track_adv_info_t*)p_param;
+            btgatt_track_adv_info_t adv_info_data;
+
+            memset(&adv_info_data, 0, sizeof(btgatt_track_adv_info_t));
+
+            btif_gatt_move_track_adv_data(&adv_info_data, p_data);
+            HAL_CBACK(bt_gatt_callbacks, client->track_adv_event_cb, &adv_info_data);
             break;
         }
 
@@ -994,19 +995,15 @@ static void bta_scan_results_cb (tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_dat
                                  (char*) &btif_cb, sizeof(btif_gattc_cb_t), NULL);
 }
 
-static void bta_track_adv_event_cb(int filt_index, tBLE_ADDR_TYPE addr_type, BD_ADDR bda,
-                                        int adv_state, tBTA_DM_BLE_REF_VALUE ref_value)
+static void bta_track_adv_event_cb(tBTA_DM_BLE_TRACK_ADV_DATA *p_track_adv_data)
 {
-    btgatt_batch_track_cb_t btif_scan_track_cb;
-    BTIF_TRACE_DEBUG("%s :%d, %d, %d, %d",
-        __FUNCTION__,filt_index, addr_type, adv_state, ref_value);
-    btif_scan_track_cb.filt_index = filt_index;
-    btif_scan_track_cb.addr_type = addr_type;
-    memcpy(btif_scan_track_cb.bd_addr.address, bda, sizeof(BD_ADDR));
-    btif_scan_track_cb.client_if = ref_value;
-    btif_scan_track_cb.adv_state = adv_state;
+    btgatt_track_adv_info_t btif_scan_track_cb;
+    BTIF_TRACE_DEBUG("%s",__FUNCTION__);
+    btif_gatt_move_track_adv_data(&btif_scan_track_cb,
+                (btgatt_track_adv_info_t*)p_track_adv_data);
+
     btif_transfer_context(btif_gattc_upstreams_evt, BTA_GATTC_ADV_VSC_EVT,
-                          (char*) &btif_scan_track_cb, sizeof(btgatt_batch_track_cb_t), NULL);
+                          (char*) &btif_scan_track_cb, sizeof(btgatt_track_adv_info_t), NULL);
 }
 
 static void btm_read_rssi_cb (tBTM_RSSI_RESULTS *p_result)
@@ -1980,26 +1977,26 @@ static bt_status_t btif_gattc_conn_parameter_update(const bt_bdaddr_t *bd_addr,
                                  (char*) &btif_cb, sizeof(btif_conn_param_cb_t), NULL);
 }
 
-static bt_status_t btif_gattc_scan_filter_param_setup(int client_if, int action,
-    int filt_index, int feat_seln, int list_logic_type, int filt_logic_type, int rssi_high_thres,
-    int rssi_low_thres, int dely_mode, int found_timeout, int lost_timeout, int found_timeout_cnt)
+static bt_status_t btif_gattc_scan_filter_param_setup(btgatt_filt_param_setup_t
+                                                      filt_param)
 {
     CHECK_BTGATT_INIT();
     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
     btgatt_adv_filter_cb_t btif_filt_cb;
     memset(&btif_filt_cb, 0, sizeof(btgatt_adv_filter_cb_t));
-    btif_filt_cb.action = action;
-    btif_filt_cb.client_if = client_if;
-    btif_filt_cb.filt_index = filt_index;
-    btif_filt_cb.adv_filt_param.feat_seln = feat_seln;
-    btif_filt_cb.adv_filt_param.list_logic_type = list_logic_type;
-    btif_filt_cb.adv_filt_param.filt_logic_type = filt_logic_type;
-    btif_filt_cb.adv_filt_param.rssi_high_thres = rssi_high_thres;
-    btif_filt_cb.adv_filt_param.rssi_low_thres = rssi_low_thres;
-    btif_filt_cb.adv_filt_param.dely_mode = dely_mode;
-    btif_filt_cb.adv_filt_param.found_timeout = found_timeout;
-    btif_filt_cb.adv_filt_param.lost_timeout = lost_timeout;
-    btif_filt_cb.adv_filt_param.found_timeout_cnt = found_timeout_cnt;
+    btif_filt_cb.client_if = filt_param.client_if;
+    btif_filt_cb.action = filt_param.action;
+    btif_filt_cb.filt_index = filt_param.filt_index;
+    btif_filt_cb.adv_filt_param.feat_seln = filt_param.feat_seln;
+    btif_filt_cb.adv_filt_param.list_logic_type = filt_param.list_logic_type;
+    btif_filt_cb.adv_filt_param.filt_logic_type = filt_param.filt_logic_type;
+    btif_filt_cb.adv_filt_param.rssi_high_thres = filt_param.rssi_high_thres;
+    btif_filt_cb.adv_filt_param.rssi_low_thres = filt_param.rssi_low_thres;
+    btif_filt_cb.adv_filt_param.dely_mode = filt_param.dely_mode;
+    btif_filt_cb.adv_filt_param.found_timeout = filt_param.found_timeout;
+    btif_filt_cb.adv_filt_param.lost_timeout = filt_param.lost_timeout;
+    btif_filt_cb.adv_filt_param.found_timeout_cnt = filt_param.found_timeout_cnt;
+    btif_filt_cb.adv_filt_param.num_of_tracking_entries = filt_param.num_of_tracking_entries;
     return btif_transfer_context(btgattc_handle_event, BTIF_GATTC_SCAN_FILTER_PARAM_SETUP,
                                  (char*) &btif_filt_cb, sizeof(btgatt_adv_filter_cb_t), NULL);
 }
diff --git a/btif/src/btif_gatt_util.c b/btif/src/btif_gatt_util.c
index 7e0075721..da3d71250 100644
--- a/btif/src/btif_gatt_util.c
+++ b/btif/src/btif_gatt_util.c
@@ -344,3 +344,28 @@ void btif_gatt_check_encrypted_link (BD_ADDR bd_addr)
 }
 
 #endif
+
+void btif_gatt_move_track_adv_data(btgatt_track_adv_info_t *p_dest,
+                              btgatt_track_adv_info_t *p_src)
+{
+    memset(p_dest, 0, sizeof(btgatt_track_adv_info_t));
+
+    memcpy(p_dest, p_src, sizeof(btgatt_track_adv_info_t));
+
+    if (p_src->adv_pkt_len > 0)
+    {
+        p_dest->p_adv_pkt_data = GKI_getbuf(p_src->adv_pkt_len);
+        memcpy(p_dest->p_adv_pkt_data, p_src->p_adv_pkt_data,
+               p_src->adv_pkt_len);
+        GKI_freebuf(p_src->p_adv_pkt_data);
+    }
+
+    if (p_src->scan_rsp_len > 0)
+    {
+        p_dest->p_scan_rsp_data = GKI_getbuf(p_src->scan_rsp_len);
+        memcpy(p_dest->p_scan_rsp_data, p_src->p_scan_rsp_data,
+               p_src->scan_rsp_len);
+        GKI_freebuf(p_src->p_scan_rsp_data);
+    }
+}
+
diff --git a/btif/src/btif_pan.c b/btif/src/btif_pan.c
index 24333b00f..80196365f 100644
--- a/btif/src/btif_pan.c
+++ b/btif/src/btif_pan.c
@@ -36,6 +36,7 @@
 #include <netinet/in.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <string.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ -129,7 +130,7 @@ void btif_pan_init()
     {
         BTIF_TRACE_DEBUG("Enabling PAN....");
         memset(&btpan_cb, 0, sizeof(btpan_cb));
-        btpan_cb.tap_fd = -1;
+        btpan_cb.tap_fd = INVALID_FD;
         btpan_cb.flow = 1;
         int i;
         for(i = 0; i < MAX_PAN_CONNS; i++)
@@ -142,14 +143,14 @@ void btif_pan_init()
 
 static void pan_disable()
 {
-    if(btpan_cb.enabled)
+    if (btpan_cb.enabled)
     {
         btpan_cb.enabled = 0;
         BTA_PanDisable();
-        if(btpan_cb.tap_fd != -1)
+        if (btpan_cb.tap_fd != INVALID_FD)
         {
             btpan_tap_close(btpan_cb.tap_fd);
-            btpan_cb.tap_fd = -1;
+            btpan_cb.tap_fd = INVALID_FD;
         }
     }
 }
@@ -311,6 +312,8 @@ static int tap_if_up(const char *devname, const bt_bdaddr_t *addr)
     int sk, err;
 
     sk = socket(AF_INET, SOCK_DGRAM, 0);
+    if(sk < 0)
+        return -1 ;
 
     //set mac addr
     memset(&ifr, 0, sizeof(ifr));
@@ -370,6 +373,8 @@ static int tap_if_down(const char *devname)
     int sk;
 
     sk = socket(AF_INET, SOCK_DGRAM, 0);
+    if(sk < 0)
+        return -1 ;
 
     memset(&ifr, 0, sizeof(ifr));
     strncpy(ifr.ifr_name, devname, IF_NAMESIZE - 1);
@@ -428,7 +433,7 @@ int btpan_tap_open()
     }
     BTIF_TRACE_ERROR("can not bring up tap interface:%s", TAP_IF_NAME);
     close(fd);
-    return -1;
+    return INVALID_FD;
 }
 
 int btpan_tap_send(int tap_fd, const BD_ADDR src, const BD_ADDR dst, UINT16 proto, const char* buf,
@@ -436,7 +441,7 @@ int btpan_tap_send(int tap_fd, const BD_ADDR src, const BD_ADDR dst, UINT16 prot
 {
     UNUSED(ext);
     UNUSED(forward);
-    if(tap_fd != -1)
+    if(tap_fd != INVALID_FD)
     {
         tETH_HDR eth_hdr;
         memcpy(&eth_hdr.h_dest, dst, ETH_ADDR_LEN);
@@ -462,8 +467,8 @@ int btpan_tap_send(int tap_fd, const BD_ADDR src, const BD_ADDR dst, UINT16 prot
 
 int btpan_tap_close(int fd)
 {
-    tap_if_down(TAP_IF_NAME);
-    close(fd);
+    if(tap_if_down(TAP_IF_NAME) == 0)
+        close(fd);
     if(pan_pth >= 0)
         btsock_thread_wakeup(pan_pth);
     return 0;
@@ -660,7 +665,7 @@ static void btu_exec_tap_fd_read(void *p_param) {
     struct pollfd ufd;
     int fd = (int)p_param;
 
-    if (fd == -1 || fd != btpan_cb.tap_fd)
+    if (fd == INVALID_FD || fd != btpan_cb.tap_fd)
         return;
 
     // Don't occupy BTU context too long, avoid GKI buffer overruns and
@@ -752,7 +757,7 @@ static void btpan_tap_fd_signaled(int fd, int type, int flags, uint32_t user_id)
     }
 
     if(flags & SOCK_THREAD_FD_EXCEPTION) {
-        btpan_cb.tap_fd = -1;
+        btpan_cb.tap_fd = INVALID_FD;
         btpan_tap_close(fd);
         btif_pan_close_all_conns();
     } else if(flags & SOCK_THREAD_FD_RD)
diff --git a/btif/src/btif_profile_queue.c b/btif/src/btif_profile_queue.c
index 569386046..86025efc6 100644
--- a/btif/src/btif_profile_queue.c
+++ b/btif/src/btif_profile_queue.c
@@ -25,6 +25,7 @@
  ******************************************************************************/
 
 #include <assert.h>
+#include <string.h>
 #include <hardware/bluetooth.h>
 #include <string.h>
 
diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index 1c26dff7e..645bb8189 100644
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -284,7 +284,7 @@ int uinput_create(char *name)
     }
     memset(&dev, 0, sizeof(dev));
     if (name)
-        strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE);
+        strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE-1);
 
     dev.id.bustype = BUS_BLUETOOTH;
     dev.id.vendor  = 0x0000;
diff --git a/btif/src/btif_sock_rfc.c b/btif/src/btif_sock_rfc.c
index 4b9040ebe..43dfc56f9 100644
--- a/btif/src/btif_sock_rfc.c
+++ b/btif/src/btif_sock_rfc.c
@@ -20,6 +20,7 @@
 
 #include <assert.h>
 #include <errno.h>
+#include <features.h>
 #include <hardware/bluetooth.h>
 #include <hardware/bt_sock.h>
 #include <string.h>
@@ -41,6 +42,7 @@
 #include "btu.h"
 #include "gki.h"
 #include "hcimsgs.h"
+#include "osi/include/compat.h"
 #include "osi/include/list.h"
 #include "osi/include/osi.h"
 #include "osi/include/log.h"
@@ -81,7 +83,7 @@ typedef struct {
 static rfc_slot_t rfc_slots[MAX_RFC_CHANNEL];
 static uint32_t rfc_slot_id;
 static volatile int pth = -1; // poll thread handle
-static pthread_mutex_t slot_lock;
+static pthread_mutex_t slot_lock = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
 
 static rfc_slot_t *find_free_slot(void);
 static void cleanup_rfc_slot(rfc_slot_t *rs);
@@ -107,7 +109,6 @@ bt_status_t btsock_rfc_init(int poll_thread_handle) {
   }
 
   BTA_JvEnable(jv_dm_cback);
-  init_slot_lock(&slot_lock);
 
   return BT_STATUS_SUCCESS;
 }
@@ -115,13 +116,13 @@ bt_status_t btsock_rfc_init(int poll_thread_handle) {
 void btsock_rfc_cleanup(void) {
   pth = -1;
 
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
   for (size_t i = 0; i < ARRAY_SIZE(rfc_slots); ++i) {
     if (rfc_slots[i].id)
       cleanup_rfc_slot(&rfc_slots[i]);
     list_free(rfc_slots[i].incoming_queue);
   }
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static rfc_slot_t *find_free_slot(void) {
@@ -255,7 +256,7 @@ bt_status_t btsock_rfc_listen(const char *service_name, const uint8_t *service_u
   }
 
   int status = BT_STATUS_FAIL;
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = alloc_rfc_slot(NULL, service_name, service_uuid, channel, flags, true);
   if (!slot) {
@@ -271,7 +272,7 @@ bt_status_t btsock_rfc_listen(const char *service_name, const uint8_t *service_u
   status = BT_STATUS_SUCCESS;
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
   return status;
 }
 
@@ -287,7 +288,7 @@ bt_status_t btsock_rfc_connect(const bt_bdaddr_t *bd_addr, const uint8_t *servic
     return BT_STATUS_NOT_READY;
 
   int status = BT_STATUS_FAIL;
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = alloc_rfc_slot(bd_addr, NULL, service_uuid, channel, flags, false);
   if (!slot) {
@@ -329,7 +330,7 @@ bt_status_t btsock_rfc_connect(const bt_bdaddr_t *bd_addr, const uint8_t *servic
   status = BT_STATUS_SUCCESS;
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
   return status;
 }
 
@@ -410,7 +411,7 @@ static bool send_app_connect_signal(int fd, const bt_bdaddr_t* addr, int channel
 }
 
 static void on_cl_rfc_init(tBTA_JV_RFCOMM_CL_INIT *p_init, uint32_t id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = find_rfc_slot_by_id(id);
   if (!slot)
@@ -422,11 +423,11 @@ static void on_cl_rfc_init(tBTA_JV_RFCOMM_CL_INIT *p_init, uint32_t id) {
     cleanup_rfc_slot(slot);
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static void on_srv_rfc_listen_started(tBTA_JV_RFCOMM_START *p_start, uint32_t id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = find_rfc_slot_by_id(id);
   if (!slot)
@@ -443,12 +444,12 @@ static void on_srv_rfc_listen_started(tBTA_JV_RFCOMM_START *p_start, uint32_t id
     cleanup_rfc_slot(slot);
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static uint32_t on_srv_rfc_connect(tBTA_JV_RFCOMM_SRV_OPEN *p_open, uint32_t id) {
   uint32_t new_listen_slot_id = 0;
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *srv_rs = find_rfc_slot_by_id(id);
   if (!srv_rs)
@@ -466,12 +467,12 @@ static uint32_t on_srv_rfc_connect(tBTA_JV_RFCOMM_SRV_OPEN *p_open, uint32_t id)
   new_listen_slot_id = srv_rs->id;
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
   return new_listen_slot_id;
 }
 
 static void on_cli_rfc_connect(tBTA_JV_RFCOMM_OPEN *p_open, uint32_t id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = find_rfc_slot_by_id(id);
   if (!slot)
@@ -491,32 +492,32 @@ static void on_cli_rfc_connect(tBTA_JV_RFCOMM_OPEN *p_open, uint32_t id) {
     LOG_ERROR("%s unable to send connect completion signal to caller.", __func__);
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static void on_rfc_close(UNUSED_ATTR tBTA_JV_RFCOMM_CLOSE *p_close, uint32_t id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   // rfc_handle already closed when receiving rfcomm close event from stack.
   rfc_slot_t *slot = find_rfc_slot_by_id(id);
   if (slot)
     cleanup_rfc_slot(slot);
 
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static void on_rfc_write_done(UNUSED_ATTR tBTA_JV_RFCOMM_WRITE *p, uint32_t id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = find_rfc_slot_by_id(id);
   if (slot && !slot->f.outgoing_congest)
     btsock_thread_add_fd(pth, slot->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_RD, slot->id);
 
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static void on_rfc_outgoing_congest(tBTA_JV_RFCOMM_CONG *p, uint32_t id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = find_rfc_slot_by_id(id);
   if (slot) {
@@ -525,7 +526,7 @@ static void on_rfc_outgoing_congest(tBTA_JV_RFCOMM_CONG *p, uint32_t id) {
       btsock_thread_add_fd(pth, slot->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_RD, slot->id);
   }
 
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 static void *rfcomm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data) {
@@ -569,7 +570,7 @@ static void *rfcomm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data) {
       break;
 
     default:
-      LOG_ERROR("%s unhandled event %d, slot id: %d", __func__, event, (uintptr_t)user_data);
+      LOG_ERROR("%s unhandled event %d, slot id: %zi", __func__, event, (uintptr_t)user_data);
       break;
   }
   return new_user_data;
@@ -579,7 +580,7 @@ static void jv_dm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data) {
   uint32_t id = (uintptr_t)user_data;
   switch(event) {
     case BTA_JV_CREATE_RECORD_EVT: {
-      lock_slot(&slot_lock);
+      pthread_mutex_lock(&slot_lock);
 
       rfc_slot_t *slot = find_rfc_slot_by_id(id);
       if (slot && create_server_sdp_record(slot)) {
@@ -590,12 +591,12 @@ static void jv_dm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data) {
         cleanup_rfc_slot(slot);
       }
 
-      unlock_slot(&slot_lock);
+      pthread_mutex_unlock(&slot_lock);
       break;
     }
 
     case BTA_JV_DISCOVERY_COMP_EVT: {
-      lock_slot(&slot_lock);
+      pthread_mutex_lock(&slot_lock);
       rfc_slot_t *slot = find_rfc_slot_by_id(id);
       if (p_data->disc_comp.status == BTA_JV_SUCCESS && p_data->disc_comp.scn) {
         if (slot && slot->f.doing_sdp_request) {
@@ -627,7 +628,7 @@ static void jv_dm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data) {
         slot->f.doing_sdp_request = true;
       }
 
-      unlock_slot(&slot_lock);
+      pthread_mutex_unlock(&slot_lock);
       break;
     }
 
@@ -698,7 +699,7 @@ static bool flush_incoming_que_on_wr_signal(rfc_slot_t *slot) {
 }
 
 void btsock_rfc_signaled(UNUSED_ATTR int fd, int flags, uint32_t user_id) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   rfc_slot_t *slot = find_rfc_slot_by_id(user_id);
   if (!slot)
@@ -735,11 +736,11 @@ void btsock_rfc_signaled(UNUSED_ATTR int fd, int flags, uint32_t user_id) {
   }
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
 }
 
 int bta_co_rfc_data_incoming(void *user_data, BT_HDR *p_buf) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   int ret = 0;
   uint32_t id = (uintptr_t)user_data;
@@ -770,12 +771,12 @@ int bta_co_rfc_data_incoming(void *user_data, BT_HDR *p_buf) {
   }
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
   return ret;  // Return 0 to disable data flow.
 }
 
 int bta_co_rfc_data_outgoing_size(void *user_data, int *size) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   uint32_t id = (uintptr_t)user_data;
   int ret = false;
@@ -792,12 +793,12 @@ int bta_co_rfc_data_outgoing_size(void *user_data, int *size) {
   }
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
   return ret;
 }
 
 int bta_co_rfc_data_outgoing(void *user_data, uint8_t *buf, uint16_t size) {
-  lock_slot(&slot_lock);
+  pthread_mutex_lock(&slot_lock);
 
   uint32_t id = (uintptr_t)user_data;
   int ret = false;
@@ -814,6 +815,6 @@ int bta_co_rfc_data_outgoing(void *user_data, uint8_t *buf, uint16_t size) {
   }
 
 out:;
-  unlock_slot(&slot_lock);
+  pthread_mutex_unlock(&slot_lock);
   return ret;
 }
diff --git a/btif/src/btif_sock_thread.c b/btif/src/btif_sock_thread.c
index fc7408999..0216f53c2 100644
--- a/btif/src/btif_sock_thread.c
+++ b/btif/src/btif_sock_thread.c
@@ -32,6 +32,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <errno.h>
+#include <features.h>
 #include <string.h>
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -110,6 +111,61 @@ static inline void add_poll(int h, int fd, int type, int flags, uint32_t user_id
 
 static pthread_mutex_t thread_slot_lock = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
 
+static inline void set_socket_blocking(int s, int blocking)
+{
+    int opts;
+    opts = fcntl(s, F_GETFL);
+    if (opts<0) APPL_TRACE_ERROR("set blocking (%s)", strerror(errno));
+    if(blocking)
+        opts &= ~O_NONBLOCK;
+    else opts |= O_NONBLOCK;
+    if (fcntl(s, F_SETFL, opts) < 0)
+        APPL_TRACE_ERROR("set blocking (%s)", strerror(errno));
+}
+
+static inline int create_server_socket(const char* name)
+{
+    int s = socket(AF_LOCAL, SOCK_STREAM, 0);
+    if(s < 0)
+        return -1;
+    APPL_TRACE_DEBUG("covert name to android abstract name:%s", name);
+    if(socket_local_server_bind(s, name, ANDROID_SOCKET_NAMESPACE_ABSTRACT) >= 0)
+    {
+        if(listen(s, 5) == 0)
+        {
+            APPL_TRACE_DEBUG("listen to local socket:%s, fd:%d", name, s);
+            return s;
+        }
+        else APPL_TRACE_ERROR("listen to local socket:%s, fd:%d failed, errno:%d", name, s, errno);
+    }
+    else APPL_TRACE_ERROR("create local socket:%s fd:%d, failed, errno:%d", name, s, errno);
+    close(s);
+    return -1;
+}
+static inline int connect_server_socket(const char* name)
+{
+    int s = socket(AF_LOCAL, SOCK_STREAM, 0);
+    if(s < 0)
+        return -1;
+    set_socket_blocking(s, TRUE);
+    if(socket_local_client_connect(s, name, ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM) >= 0)
+    {
+        APPL_TRACE_DEBUG("connected to local socket:%s, fd:%d", name, s);
+        return s;
+    }
+    else APPL_TRACE_ERROR("connect to local socket:%s, fd:%d failed, errno:%d", name, s, errno);
+    close(s);
+    return -1;
+}
+static inline int accept_server_socket(int s)
+{
+    struct sockaddr_un client_address;
+    socklen_t clen;
+    int fd = accept(s, (struct sockaddr*)&client_address, &clen);
+    APPL_TRACE_DEBUG("accepted fd:%d for server fd:%d", fd, s);
+    return fd;
+}
+
 static inline int create_thread(void *(*start_routine)(void *), void * arg,
                                 pthread_t * thread_id)
 {
@@ -118,6 +174,7 @@ static inline int create_thread(void *(*start_routine)(void *), void * arg,
     pthread_attr_setdetachstate(&thread_attr, PTHREAD_CREATE_JOINABLE);
     return pthread_create(thread_id, &thread_attr, start_routine, arg);
 }
+
 static void init_poll(int cmd_fd);
 static int alloc_thread_slot()
 {
@@ -564,4 +621,3 @@ static void *sock_poll_thread(void *arg)
     APPL_TRACE_DEBUG("socket poll thread exiting, h:%d", h);
     return 0;
 }
-
diff --git a/btif/src/btif_storage.c b/btif/src/btif_storage.c
index 2924a2a2f..cd5d008da 100644
--- a/btif/src/btif_storage.c
+++ b/btif/src/btif_storage.c
@@ -42,6 +42,7 @@
 #include "btif_storage.h"
 #include "btif_util.h"
 #include "btcore/include/bdaddr.h"
+#include "osi/include/compat.h"
 #include "osi/include/config.h"
 #include "gki.h"
 #include "osi/include/osi.h"
diff --git a/embdrv/sbc/encoder/include/sbc_types.h b/embdrv/sbc/encoder/include/sbc_types.h
index 991fc7dcc..4bb8829c7 100644
--- a/embdrv/sbc/encoder/include/sbc_types.h
+++ b/embdrv/sbc/encoder/include/sbc_types.h
@@ -25,6 +25,8 @@
 #ifndef SBC_TYPES_H
 #define SBC_TYPES_H
 
+#include <stdint.h>
+
 #ifdef BUILDCFG
 #include "bt_target.h"
 #endif
@@ -39,7 +41,7 @@ typedef long SINT32;
 #if (SBC_FOR_EMBEDDED_LINUX == TRUE)
 typedef long long SINT64;
 #else
-typedef __int64 SINT64;
+typedef int64_t SINT64;
 #endif
 
 #elif (SBC_IS_64_MULT_IN_WINDOW_ACCU == TRUE) || (SBC_IS_64_MULT_IN_IDCT == TRUE)
@@ -47,7 +49,7 @@ typedef __int64 SINT64;
 #if (SBC_FOR_EMBEDDED_LINUX == TRUE)
 typedef long long SINT64;
 #else
-typedef __int64 SINT64;
+typedef int64_t SINT64;
 #endif
 
 #endif
diff --git a/embdrv/sbc/encoder/srce/sbc_encoder.c b/embdrv/sbc/encoder/srce/sbc_encoder.c
index c58f3fc1f..0811ed104 100644
--- a/embdrv/sbc/encoder/srce/sbc_encoder.c
+++ b/embdrv/sbc/encoder/srce/sbc_encoder.c
@@ -23,6 +23,7 @@
  ******************************************************************************/
 
 #include <string.h>
+#include "bt_target.h"
 #include "sbc_encoder.h"
 #include "sbc_enc_func_declare.h"
 
diff --git a/hci/src/btsnoop.c b/hci/src/btsnoop.c
index 011d9264f..538fc9515 100644
--- a/hci/src/btsnoop.c
+++ b/hci/src/btsnoop.c
@@ -22,6 +22,8 @@
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <limits.h>
+#include <netinet/in.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/hci/src/hci_layer.c b/hci/src/hci_layer.c
index 33b6358af..89d5cc9ec 100644
--- a/hci/src/hci_layer.c
+++ b/hci/src/hci_layer.c
@@ -21,6 +21,9 @@
 #include <assert.h>
 #include <cutils/properties.h>
 #include <string.h>
+#include <signal.h>
+#include <string.h>
+#include <sys/types.h>
 
 #include "buffer_allocator.h"
 #include "btsnoop.h"
diff --git a/main/bte_conf.c b/main/bte_conf.c
index 75738e1cd..2bf61dac3 100644
--- a/main/bte_conf.c
+++ b/main/bte_conf.c
@@ -23,6 +23,7 @@
 #include <string.h>
 
 #include "bta_api.h"
+#include "osi/include/compat.h"
 #include "osi/include/config.h"
 #include "osi/include/log.h"
 
diff --git a/main/bte_main.c b/main/bte_main.c
index de62232df..de62232df 100755..100644
--- a/main/bte_main.c
+++ b/main/bte_main.c
diff --git a/osi/include/allocation_tracker.h b/osi/include/allocation_tracker.h
index fb9781b55..b9fa59405 100644
--- a/osi/include/allocation_tracker.h
+++ b/osi/include/allocation_tracker.h
@@ -20,6 +20,7 @@
 
 #include <stdbool.h>
 #include <stddef.h>
+#include <stdint.h>
 
 typedef struct allocation_tracker_t allocation_tracker_t;
 typedef uint8_t allocator_id_t;
diff --git a/osi/include/atomic.h b/osi/include/atomic.h
index beac2f151..a38c9c478 100644
--- a/osi/include/atomic.h
+++ b/osi/include/atomic.h
@@ -53,48 +53,48 @@
 typedef struct atomic_##name atomic_##name##_t;
 
 #define ATOMIC_STORE(name, type, sz) \
-inline void atomic_store_##name(volatile atomic_##name##_t *atomic, type val) { \
+static inline void atomic_store_##name(volatile atomic_##name##_t *atomic, type val) { \
   __atomic_store_##sz(&atomic->_val, val, __ATOMIC_SEQ_CST); \
 }
 
 #define ATOMIC_LOAD(name, type, sz) \
-inline type atomic_load_##name(volatile atomic_##name##_t *atomic) { \
+static inline type atomic_load_##name(volatile atomic_##name##_t *atomic) { \
   return __atomic_load_##sz(&atomic->_val, __ATOMIC_SEQ_CST); \
 }
 
 // Returns value after operation, e.g. new value
 #define ATOMIC_INC_PREFIX(name, type, sz) \
-inline type atomic_inc_prefix_##name(volatile atomic_##name##_t *atomic) { \
+static inline type atomic_inc_prefix_##name(volatile atomic_##name##_t *atomic) { \
   return __atomic_add_fetch_##sz(atomic, 1, __ATOMIC_SEQ_CST); \
 }
 
 // Returns value after operation, e.g. new value
 #define ATOMIC_DEC_PREFIX(name, type, sz) \
-inline type atomic_dec_prefix_##name(volatile atomic_##name##_t *atomic) { \
+static inline type atomic_dec_prefix_##name(volatile atomic_##name##_t *atomic) { \
   return __atomic_sub_fetch_##sz(atomic, 1, __ATOMIC_SEQ_CST); \
 }
 
 // Returns value before operation, e.g. old value
 #define ATOMIC_INC_POSTFIX(name, type, sz) \
-inline type atomic_inc_postfix_##name(volatile atomic_##name##_t *atomic) { \
+static inline type atomic_inc_postfix_##name(volatile atomic_##name##_t *atomic) { \
   return __atomic_fetch_add_##sz(atomic, 1, __ATOMIC_SEQ_CST); \
 }
 
 // Returns value before operation, e.g. old value
 #define ATOMIC_DEC_POSTFIX(name, type, sz) \
-inline type atomic_dec_postfix_##name(volatile atomic_##name##_t *atomic) { \
+static inline type atomic_dec_postfix_##name(volatile atomic_##name##_t *atomic) { \
   return __atomic_fetch_sub_##sz(atomic, 1, __ATOMIC_SEQ_CST); \
 }
 
 // Returns value after operation, e.g. new value
 #define ATOMIC_ADD(name, type, sz) \
-inline type atomic_add_##name(volatile atomic_##name##_t *atomic, type val) { \
+static inline type atomic_add_##name(volatile atomic_##name##_t *atomic, type val) { \
   return __atomic_add_fetch_##sz(atomic, val, __ATOMIC_SEQ_CST); \
 }
 
 // Returns value after operation, e.g. new value
 #define ATOMIC_SUB(name, type, sz) \
-inline type atomic_sub_##name(volatile atomic_##name##_t *atomic, type val) { \
+static inline type atomic_sub_##name(volatile atomic_##name##_t *atomic, type val) { \
   return __atomic_sub_fetch_##sz(atomic, val, __ATOMIC_SEQ_CST); \
 }
 
diff --git a/osi/include/compat.h b/osi/include/compat.h
new file mode 100644
index 000000000..02e13e397
--- /dev/null
+++ b/osi/include/compat.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ *  Copyright 2015 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <features.h>
+#include <sys/types.h>
+
+#if __GLIBC__
+
+/* Get thread identification. */
+pid_t gettid(void);
+
+/* Copy src to string dst of size siz. */
+size_t strlcpy(char *dst, const char *src, size_t siz);
+
+/* Appends src to string dst of size siz. */
+size_t strlcat(char *dst, const char *src, size_t siz);
+
+#endif
diff --git a/osi/src/compat.c b/osi/src/compat.c
new file mode 100644
index 000000000..ea26c188d
--- /dev/null
+++ b/osi/src/compat.c
@@ -0,0 +1,131 @@
+/******************************************************************************
+ *
+ *  Copyright 2015 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/************************************************************************************
+ *
+ *  Filename:      compat.c
+ *
+ *  Description:   Compatibility functions for non-bionic C libraries
+ *
+ *
+ ***********************************************************************************/
+
+#include <features.h>
+#include <string.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "osi/include/compat.h"
+
+#if __GLIBC__
+pid_t
+gettid(void)
+{
+  return syscall(SYS_gettid);
+}
+#endif
+
+/* These functions from bionic
+ *
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#if __GLIBC__
+/*
+ * Copy src to string dst of size siz.  At most siz-1 characters
+ * will be copied.  Always NUL terminates (unless siz == 0).
+ * Returns strlen(src); if retval >= siz, truncation occurred.
+ */
+size_t
+strlcpy(char *dst, const char *src, size_t siz)
+{
+  char *d = dst;
+  const char *s = src;
+  size_t n = siz;
+
+  /* Copy as many bytes as will fit */
+  if (n != 0) {
+    while (--n != 0) {
+      if ((*d++ = *s++) == '\0')
+        break;
+    }
+  }
+
+  /* Not enough room in dst, add NUL and traverse rest of src */
+  if (n == 0) {
+    if (siz != 0)
+      *d = '\0'; /* NUL-terminate dst */
+    while (*s++)
+      ;
+  }
+
+  return(s - src - 1); /* count does not include NUL */
+}
+#endif
+
+#if __GLIBC__
+/*
+ * Appends src to string dst of size siz (unlike strncat, siz is the
+ * full size of dst, not space left).  At most siz-1 characters
+ * will be copied.  Always NUL terminates (unless siz <= strlen(dst)).
+ * Returns strlen(src) + MIN(siz, strlen(initial dst)).
+ * If retval >= siz, truncation occurred.
+ */
+size_t
+strlcat(char *dst, const char *src, size_t siz)
+{
+  char *d = dst;
+  const char *s = src;
+  size_t n = siz;
+  size_t dlen;
+
+  /* Find the end of dst and adjust bytes left but don't go past end */
+  while (n-- != 0 && *d != '\0')
+    d++;
+  dlen = d - dst;
+  n = siz - dlen;
+
+  if (n == 0)
+    return (dlen + strlen(s));
+
+  while (*s != '\0') {
+    if (n != 1) {
+      *d++ = *s;
+      n--;
+    }
+
+    s++;
+  }
+
+  *d = '\0';
+
+  return (dlen + (s - src)); /* count does not include NUL */
+}
+#endif
diff --git a/osi/src/thread.c b/osi/src/thread.c
index 98e93e868..c6c89792a 100644
--- a/osi/src/thread.c
+++ b/osi/src/thread.c
@@ -27,6 +27,7 @@
 #include <sys/types.h>
 
 #include "osi/include/allocator.h"
+#include "osi/include/compat.h"
 #include "osi/include/fixed_queue.h"
 #include "osi/include/log.h"
 #include "osi/include/reactor.h"
diff --git a/osi/test/data_dispatcher_test.cpp b/osi/test/data_dispatcher_test.cpp
index b00cfb743..1985fee92 100644
--- a/osi/test/data_dispatcher_test.cpp
+++ b/osi/test/data_dispatcher_test.cpp
@@ -1,5 +1,7 @@
 #include <gtest/gtest.h>
 
+#include <climits>
+
 #include "AllocationTestHarness.h"
 
 extern "C" {
diff --git a/stack/avdt/avdt_ad.c b/stack/avdt/avdt_ad.c
index 45e6b36e9..a0f42a600 100644
--- a/stack/avdt/avdt_ad.c
+++ b/stack/avdt/avdt_ad.c
@@ -279,13 +279,14 @@ tAVDT_TC_TBL *avdt_ad_tc_tbl_alloc(tAVDT_CCB *p_ccb)
     /* sanity check */
     assert(i != AVDT_NUM_TC_TBL);
 
+
     /* initialize entry */
     p_tbl->peer_mtu = L2CAP_DEFAULT_MTU;
     p_tbl->cfg_flags = 0;
     p_tbl->ccb_idx = avdt_ccb_to_idx(p_ccb);
     p_tbl->state = AVDT_AD_ST_IDLE;
-
     return p_tbl;
+
 }
 
 /*******************************************************************************
@@ -538,7 +539,12 @@ void avdt_ad_open_req(UINT8 type, tAVDT_CCB *p_ccb, tAVDT_SCB *p_scb, UINT8 role
     tAVDT_TC_TBL    *p_tbl;
     UINT16          lcid;
 
-    p_tbl = avdt_ad_tc_tbl_alloc(p_ccb);
+    if((p_tbl = avdt_ad_tc_tbl_alloc(p_ccb)) == NULL)
+    {
+        AVDT_TRACE_ERROR("avdt_ad_open_req: Cannot allocate p_tbl");
+        return;
+    }
+
 
     p_tbl->tcid = avdt_ad_type_to_tcid(type, p_scb);
     AVDT_TRACE_DEBUG("avdt_ad_open_req: type: %d, role: %d, tcid:%d",
diff --git a/stack/btm/btm_ble.c b/stack/btm/btm_ble.c
index d28f6f2f2..7c52a7c32 100644
--- a/stack/btm/btm_ble.c
+++ b/stack/btm/btm_ble.c
@@ -1097,24 +1097,12 @@ void btm_ble_link_sec_check(BD_ADDR bd_addr, tBTM_LE_AUTH_REQ auth_req, tBTM_BLE
 
         if (cur_sec_level >= req_sec_level)
         {
-            if (cur_sec_level == BTM_LE_SEC_NONE)
-            {
-                *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_NONE;
-            }
-            else
-            {
-                /* To avoid re-encryption on an encrypted link for an equal condition encryption */
-                /* if link has been encrypted, do nothing, go straight to furhter action
-                if (p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED)
-                    *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_DISCARD;
-                else
-                */
-                *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_ENCRYPT;
-            }
+            /* To avoid re-encryption on an encrypted link for an equal condition encryption */
+            *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_ENCRYPT;
         }
         else
         {
-            *p_sec_req_act =  BTM_BLE_SEC_REQ_ACT_PAIR; /* start the pariring process to upgrade the keys*/
+            *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_PAIR; /* start the pariring process to upgrade the keys*/
         }
     }
 
diff --git a/stack/btm/btm_ble_adv_filter.c b/stack/btm/btm_ble_adv_filter.c
index ea87383b4..9a297985d 100644
--- a/stack/btm/btm_ble_adv_filter.c
+++ b/stack/btm/btm_ble_adv_filter.c
@@ -33,7 +33,8 @@
 #include "device/include/controller.h"
 
 #define BTM_BLE_ADV_FILT_META_HDR_LENGTH 3
-#define BTM_BLE_ADV_FILT_FEAT_SELN_LEN 13
+#define BTM_BLE_ADV_FILT_FEAT_SELN_LEN  13
+#define BTM_BLE_ADV_FILT_TRACK_NUM       2
 
 #define BTM_BLE_PF_BIT_TO_MASK(x)          (UINT16)(1 << (x))
 
@@ -1045,16 +1046,17 @@ tBTM_STATUS BTM_BleAdvFilterParamSetup(int action, tBTM_BLE_PF_FILT_INDEX filt_i
                                 tBLE_BD_ADDR *p_target, tBTM_BLE_PF_PARAM_CBACK *p_cmpl_cback,
                                 tBTM_BLE_REF_VALUE ref_value)
 {
-    UINT8           param[20], *p;
-    tBTM_STATUS     st = BTM_WRONG_MODE;
+    tBTM_STATUS st = BTM_WRONG_MODE;
     tBTM_BLE_PF_COUNT *p_bda_filter = NULL;
-    UINT8 len =0;
+    UINT8 len = BTM_BLE_ADV_FILT_META_HDR_LENGTH + BTM_BLE_ADV_FILT_FEAT_SELN_LEN +
+                BTM_BLE_ADV_FILT_TRACK_NUM;
+    UINT8 param[len], *p;
 
     if (BTM_SUCCESS  != btm_ble_obtain_vsc_details())
         return st;
 
     p = param;
-    memset(param, 0, 20);
+    memset(param, 0, len);
     BTM_TRACE_EVENT (" BTM_BleAdvFilterParamSetup");
 
     if (BTM_BLE_SCAN_COND_ADD == action)
@@ -1095,9 +1097,16 @@ tBTM_STATUS BTM_BleAdvFilterParamSetup(int action, tBTM_BLE_PF_FILT_INDEX filt_i
             UINT8_TO_STREAM(p, p_filt_params->rssi_low_thres);
             /* set onlost timeout */
             UINT16_TO_STREAM(p, p_filt_params->lost_timeout);
+            /* set num_of_track_entries for firmware supporting v0.90 spec and greater */
+            if (cmn_ble_vsc_cb.version_supported > 0)
+                UINT16_TO_STREAM(p, p_filt_params->num_of_tracking_entries);
         }
 
-        len = BTM_BLE_ADV_FILT_META_HDR_LENGTH + BTM_BLE_ADV_FILT_FEAT_SELN_LEN;
+        if (0 == cmn_ble_vsc_cb.version_supported)
+            len = BTM_BLE_ADV_FILT_META_HDR_LENGTH + BTM_BLE_ADV_FILT_FEAT_SELN_LEN;
+        else
+            len = BTM_BLE_ADV_FILT_META_HDR_LENGTH + BTM_BLE_ADV_FILT_FEAT_SELN_LEN +
+                  BTM_BLE_ADV_FILT_TRACK_NUM;
 
         if ((st = BTM_VendorSpecificCommand (HCI_BLE_ADV_FILTER_OCF,
                                 (UINT8)len,
diff --git a/stack/btm/btm_ble_batchscan.c b/stack/btm/btm_ble_batchscan.c
index 7ed61dc28..d8add82f0 100644
--- a/stack/btm/btm_ble_batchscan.c
+++ b/stack/btm/btm_ble_batchscan.c
@@ -43,8 +43,6 @@ tBTM_BLE_ADV_TRACK_CB ble_advtrack_cb;
 #define BTM_BLE_BATCH_SCAN_CB_EVT_MASK       0xF0
 #define BTM_BLE_BATCH_SCAN_SUBCODE_MASK      0x0F
 
-#define BTM_BLE_TRACK_ADV_CMD_LEN               9
-
 /*******************************************************************************
 **  Local functions
 *******************************************************************************/
@@ -62,8 +60,10 @@ void btm_ble_batchscan_cleanup(void);
 *******************************************************************************/
 void btm_ble_batchscan_filter_track_adv_vse_cback(UINT8 len, UINT8 *p)
 {
-    UINT8   sub_event = 0, filt_index = 0, addr_type = 0, adv_state = 0;
-    BD_ADDR bd_addr;
+    tBTM_BLE_TRACK_ADV_DATA adv_data;
+
+    UINT8   sub_event = 0;
+    tBTM_BLE_VSC_CB cmn_ble_vsc_cb;
     STREAM_TO_UINT8(sub_event, p);
 
     BTM_TRACE_EVENT("btm_ble_batchscan_filter_track_adv_vse_cback called with event:%x", sub_event);
@@ -78,13 +78,53 @@ void btm_ble_batchscan_filter_track_adv_vse_cback(UINT8 len, UINT8 *p)
     {
         if (len < 10)
             return;
-        STREAM_TO_UINT8(filt_index, p);
-        STREAM_TO_UINT8(addr_type, p);
-        STREAM_TO_BDADDR(bd_addr, p);
-        STREAM_TO_UINT8(adv_state, p);
-        BTM_TRACE_EVENT("track_adv_vse_cback called: %d, %d, %d", filt_index, addr_type, adv_state);
-        ble_advtrack_cb.p_track_cback(filt_index, addr_type, bd_addr, adv_state,
-            ble_advtrack_cb.ref_value);
+
+        memset(&adv_data, 0 , sizeof(tBTM_BLE_TRACK_ADV_DATA));
+        BTM_BleGetVendorCapabilities(&cmn_ble_vsc_cb);
+        adv_data.client_if = (UINT8)ble_advtrack_cb.ref_value;
+        if (cmn_ble_vsc_cb.version_supported > 0)
+        {
+            /* Based on spec v0.90 */
+            STREAM_TO_UINT8(adv_data.filt_index, p);
+            STREAM_TO_UINT8(adv_data.advertiser_state, p);
+            STREAM_TO_UINT8(adv_data.advertiser_info_present, p);
+            STREAM_TO_BDADDR(adv_data.bd_addr.address, p);
+            STREAM_TO_UINT8(adv_data.addr_type, p);
+
+            /* Extract the adv info details */
+            if (ADV_INFO_PRESENT == adv_data.advertiser_info_present)
+            {
+                STREAM_TO_UINT8(adv_data.tx_power, p);
+                STREAM_TO_UINT8(adv_data.rssi_value, p);
+                STREAM_TO_UINT16(adv_data.time_stamp, p);
+
+                STREAM_TO_UINT8(adv_data.adv_pkt_len, p);
+                if (adv_data.adv_pkt_len > 0)
+                {
+                    adv_data.p_adv_pkt_data = GKI_getbuf(adv_data.adv_pkt_len);
+                    memcpy(adv_data.p_adv_pkt_data, p, adv_data.adv_pkt_len);
+                }
+
+                STREAM_TO_UINT8(adv_data.scan_rsp_len, p);
+                if (adv_data.scan_rsp_len > 0)
+                {
+                    adv_data.p_scan_rsp_data = GKI_getbuf(adv_data.scan_rsp_len);
+                    memcpy(adv_data.p_scan_rsp_data, p, adv_data.scan_rsp_len);
+                }
+            }
+        }
+        else
+        {
+            /* Based on spec v0.52 */
+            STREAM_TO_UINT8(adv_data.filt_index, p);
+            STREAM_TO_UINT8(adv_data.addr_type, p);
+            STREAM_TO_BDADDR(adv_data.bd_addr.address, p);
+            STREAM_TO_UINT8(adv_data.advertiser_state, p);
+        }
+
+        BTM_TRACE_EVENT("track_adv_vse_cback called: %d, %d, %d", adv_data.filt_index,
+                         adv_data.addr_type, adv_data.advertiser_state);
+        ble_advtrack_cb.p_track_cback(&adv_data);
         return;
     }
 }
@@ -877,7 +917,7 @@ tBTM_STATUS BTM_BleTrackAdvertiser(tBTM_BLE_TRACK_ADV_CBACK *p_track_cback,
 
     ble_advtrack_cb.p_track_cback = p_track_cback;
     ble_advtrack_cb.ref_value = ref_value;
-    return BTM_SUCCESS;
+    return BTM_CMD_STARTED;
 }
 
 /*******************************************************************************
diff --git a/stack/btm/btm_ble_bgconn.c b/stack/btm/btm_ble_bgconn.c
index 786cc76a3..21d4c9ba3 100644
--- a/stack/btm/btm_ble_bgconn.c
+++ b/stack/btm/btm_ble_bgconn.c
@@ -324,7 +324,8 @@ BOOLEAN btm_update_bg_conn_list(BOOLEAN to_add, BD_ADDR bd_addr)
             {
                 memset(p_bg_dev, 0, sizeof(tBTM_LE_BG_CONN_DEV));
                 if (p_cb->bg_dev_num < BTM_BLE_MAX_BG_CONN_DEV_NUM)
-                {/* The entry being removed is not at the highest index of the array: shift */
+                {
+                    /* The entry being removed is not at the highest index of the array: shift */
                     p_cur = p_bg_dev;
                     p_next = p_bg_dev + 1;
                     for (j = i + 1 ;j < BTM_BLE_MAX_BG_CONN_DEV_NUM && p_next->in_use ;
diff --git a/stack/btm/btm_ble_gap.c b/stack/btm/btm_ble_gap.c
index c3b140ebe..bf4765a21 100644
--- a/stack/btm/btm_ble_gap.c
+++ b/stack/btm/btm_ble_gap.c
@@ -54,6 +54,7 @@
 
 #define BTM_EXT_BLE_RMT_NAME_TIMEOUT        30
 #define MIN_ADV_LENGTH                       2
+#define BTM_NEW_VSC_CHIP_CAPBLTY_RSP_LEN    13
 
 #if BLE_VND_INCLUDED == TRUE
 static tBTM_BLE_CTRL_FEATURES_CBACK    *p_ctrl_le_feature_rd_cmpl_cback = NULL;
@@ -456,6 +457,12 @@ static void btm_ble_vendor_capability_vsc_cmpl_cback (tBTM_VSC_CMPL *p_vcs_cplt_
         STREAM_TO_UINT8  (btm_cb.cmn_ble_vsc_cb.filter_support, p);
         STREAM_TO_UINT8  (btm_cb.cmn_ble_vsc_cb.max_filter, p);
         STREAM_TO_UINT8  (btm_cb.cmn_ble_vsc_cb.energy_support, p);
+
+        if (BTM_NEW_VSC_CHIP_CAPBLTY_RSP_LEN == p_vcs_cplt_params->param_len)
+        {
+            STREAM_TO_UINT16 (btm_cb.cmn_ble_vsc_cb.version_supported, p);
+            STREAM_TO_UINT16 (btm_cb.cmn_ble_vsc_cb.total_trackable_advertisers, p);
+        }
         btm_cb.cmn_ble_vsc_cb.values_read = TRUE;
     }
 
@@ -1446,10 +1453,45 @@ void btm_ble_select_adv_interval(tBTM_BLE_INQ_CB *p_cb, UINT8 evt_type, UINT16 *
 }
 /*******************************************************************************
 **
+** Function         btm_ble_update_dmt_flag_bits
+**
+** Description      Obtain updated adv flag value based on connect and discoverability mode.
+**                  Also, setup DMT support value in the flag based on whether the controller
+**                  supports both LE and BR/EDR.
+**
+** Parameters:      flag_value (Input / Output) - flag value
+**                  connect_mode (Input) - Connect mode value
+**                  disc_mode (Input) - discoverability mode
+**
+** Returns          void
+**
+*******************************************************************************/
+void btm_ble_update_dmt_flag_bits(UINT8 *adv_flag_value, const UINT16 connect_mode,
+                                   const UINT16 disc_mode)
+{
+    /* BR/EDR non-discoverable , non-connectable */
+    if ((disc_mode & BTM_DISCOVERABLE_MASK) == 0 &&
+        (connect_mode & BTM_CONNECTABLE_MASK) == 0)
+        *adv_flag_value |= BTM_BLE_BREDR_NOT_SPT;
+    else
+        *adv_flag_value &= ~BTM_BLE_BREDR_NOT_SPT;
+
+    /* if local controller support, mark both controller and host support in flag */
+    if (controller_get_interface()->supports_simultaneous_le_bredr())
+        *adv_flag_value |= (BTM_BLE_DMT_CONTROLLER_SPT|BTM_BLE_DMT_HOST_SPT);
+    else
+        *adv_flag_value &= ~(BTM_BLE_DMT_CONTROLLER_SPT|BTM_BLE_DMT_HOST_SPT);
+}
+
+/*******************************************************************************
+**
 ** Function         btm_ble_set_adv_flag
 **
 ** Description      Set adv flag in adv data.
 **
+** Parameters:      connect_mode (Input)- Connect mode value
+**                  disc_mode (Input) - discoverability mode
+**
 ** Returns          void
 **
 *******************************************************************************/
@@ -1461,25 +1503,14 @@ void btm_ble_set_adv_flag(UINT16 connect_mode, UINT16 disc_mode)
     if (p_adv_data->p_flags != NULL)
         flag = old_flag = *(p_adv_data->p_flags);
 
-    /* BR/EDR non-discoverable , non-connectable */
-    if ((disc_mode & BTM_DISCOVERABLE_MASK) == 0 &&
-        (connect_mode & BTM_CONNECTABLE_MASK) == 0)
-        flag |= BTM_BLE_BREDR_NOT_SPT;
-    else
-        flag &= ~BTM_BLE_BREDR_NOT_SPT;
-
-    /* if local controller support, mark both controller and host support in flag */
-    if (controller_get_interface()->supports_simultaneous_le_bredr())
-        flag |= (BTM_BLE_DMT_CONTROLLER_SPT|BTM_BLE_DMT_HOST_SPT);
-    else
-        flag &= ~(BTM_BLE_DMT_CONTROLLER_SPT|BTM_BLE_DMT_HOST_SPT);
+    btm_ble_update_dmt_flag_bits (&flag, connect_mode, disc_mode);
 
     LOG_DEBUG("disc_mode %04x", disc_mode);
     /* update discoverable flag */
     if (disc_mode & BTM_BLE_LIMITED_DISCOVERABLE)
     {
         flag &= ~BTM_BLE_GEN_DISC_FLAG;
-        flag |= BTM_BLE_LIMIT_DISC_FLAG ;
+        flag |= BTM_BLE_LIMIT_DISC_FLAG;
     }
     else if (disc_mode & BTM_BLE_GENERAL_DISCOVERABLE)
     {
diff --git a/stack/btm/btm_ble_multi_adv.c b/stack/btm/btm_ble_multi_adv.c
index 0ad97c4e2..74bef42cd 100644
--- a/stack/btm/btm_ble_multi_adv.c
+++ b/stack/btm/btm_ble_multi_adv.c
@@ -30,17 +30,29 @@
 #include "hcidefs.h"
 #include "btm_ble_api.h"
 
+/************************************************************************************
+**  Constants & Macros
+************************************************************************************/
 /* length of each multi adv sub command */
 #define BTM_BLE_MULTI_ADV_ENB_LEN                       3
 #define BTM_BLE_MULTI_ADV_SET_PARAM_LEN                 24
 #define BTM_BLE_MULTI_ADV_WRITE_DATA_LEN                (BTM_BLE_AD_DATA_LEN + 3)
 #define BTM_BLE_MULTI_ADV_SET_RANDOM_ADDR_LEN           8
 
+#define BTM_BLE_MULTI_ADV_CB_EVT_MASK   0xF0
+#define BTM_BLE_MULTI_ADV_SUBCODE_MASK  0x0F
+
+/************************************************************************************
+**  Static variables
+************************************************************************************/
 tBTM_BLE_MULTI_ADV_CB  btm_multi_adv_cb;
 tBTM_BLE_MULTI_ADV_INST_IDX_Q btm_multi_adv_idx_q;
 
-#define BTM_BLE_MULTI_ADV_CB_EVT_MASK   0xF0
-#define BTM_BLE_MULTI_ADV_SUBCODE_MASK  0x0F
+/************************************************************************************
+**  Externs
+************************************************************************************/
+extern void btm_ble_update_dmt_flag_bits(UINT8 *flag_value,
+                                               const UINT16 connect_mode, const UINT16 disc_mode);
 
 /*******************************************************************************
 **
@@ -642,7 +654,7 @@ tBTM_STATUS BTM_BleUpdateAdvInstParam (UINT8 inst_id, tBTM_BLE_ADV_PARAMS *p_par
 **                  adv data or scan response data.
 **
 ** Parameters       inst_id: adv instance ID
-**                  is_scan_rsp: is this scacn response, if no set as adv data.
+**                  is_scan_rsp: is this scan response. if no, set as adv data.
 **                  data_mask: adv data mask.
 **                  p_data: pointer to the adv data structure.
 **
@@ -668,6 +680,8 @@ tBTM_STATUS BTM_BleCfgAdvInstData (UINT8 inst_id, BOOLEAN is_scan_rsp,
         return BTM_ERR_PROCESSING;
     }
 
+    btm_ble_update_dmt_flag_bits(&p_data->flag, btm_cb.btm_inq_vars.connectable_mode,
+                                        btm_cb.btm_inq_vars.discoverable_mode);
 
     BTM_TRACE_EVENT("BTM_BleCfgAdvInstData called with inst_id:%d", inst_id);
     if (inst_id > BTM_BLE_MULTI_ADV_MAX || inst_id == BTM_BLE_MULTI_ADV_DEFAULT_STD)
diff --git a/stack/include/btm_ble_api.h b/stack/include/btm_ble_api.h
index 5f93c5359..307d39e34 100644
--- a/stack/include/btm_ble_api.h
+++ b/stack/include/btm_ble_api.h
@@ -27,6 +27,7 @@
 
 #include "btm_api.h"
 #include "gki.h"
+#include <hardware/bt_common_types.h>
 
 #define CHNL_MAP_LEN    5
 typedef UINT8 tBTM_BLE_CHNL_MAP[CHNL_MAP_LEN];
@@ -335,6 +336,8 @@ typedef struct
     UINT8 max_filter;
     UINT8 energy_support;
     BOOLEAN values_read;
+    UINT16  version_supported;
+    UINT16  total_trackable_advertisers;
 }tBTM_BLE_VSC_CB;
 
 /* slave preferred connection interval range */
@@ -599,6 +602,7 @@ typedef UINT8  tBTM_BLE_PF_RSSI_THRESHOLD;
 typedef UINT8  tBTM_BLE_PF_DELIVERY_MODE;
 typedef UINT16 tBTM_BLE_PF_TIMEOUT;
 typedef UINT8  tBTM_BLE_PF_TIMEOUT_CNT;
+typedef UINT16 tBTM_BLE_PF_ADV_TRACK_ENTRIES;
 
 typedef struct
 {
@@ -611,6 +615,7 @@ typedef struct
     tBTM_BLE_PF_TIMEOUT found_timeout;
     tBTM_BLE_PF_TIMEOUT lost_timeout;
     tBTM_BLE_PF_TIMEOUT_CNT found_timeout_cnt;
+    tBTM_BLE_PF_ADV_TRACK_ENTRIES num_of_tracking_entries;
 }tBTM_BLE_PF_FILT_PARAMS;
 
 enum
@@ -632,8 +637,8 @@ typedef UINT8 tBTM_BLE_FILT_CB_EVT;
 
 /* BLE adv payload filtering config complete callback */
 typedef void (tBTM_BLE_PF_CFG_CBACK)(tBTM_BLE_PF_ACTION action, tBTM_BLE_SCAN_COND_OP cfg_op,
-                                      tBTM_BLE_PF_AVBL_SPACE avbl_space, tBTM_STATUS status,
-                                      tBTM_BLE_REF_VALUE ref_value);
+                                     tBTM_BLE_PF_AVBL_SPACE avbl_space, tBTM_STATUS status,
+                                     tBTM_BLE_REF_VALUE ref_value);
 
 typedef void (tBTM_BLE_PF_CMPL_CBACK) (tBTM_BLE_PF_CFG_CBACK);
 
@@ -673,7 +678,8 @@ typedef struct
     UINT8                   data_len;       /* <= 20 bytes */
     UINT8                   *p_pattern;
     UINT16                  company_id_mask; /* UUID value mask */
-    UINT8                   *p_pattern_mask; /* Manufactuer data matching mask, same length as data pattern,
+    UINT8                   *p_pattern_mask; /* Manufacturer data matching mask,
+                                                same length as data pattern,
                                                 set to all 0xff, match exact data */
 }tBTM_BLE_PF_MANU_COND;
 
@@ -742,6 +748,11 @@ typedef struct
 #define BTM_BLE_META_PF_SRVC_DATA       0x07
 #define BTM_BLE_META_PF_ALL             0x08
 
+typedef UINT8 BTM_BLE_ADV_STATE;
+typedef UINT8 BTM_BLE_ADV_INFO_PRESENT;
+typedef UINT8 BTM_BLE_RSSI_VALUE;
+typedef UINT16 BTM_BLE_ADV_INFO_TIMESTAMP;
+
 /* These are the fields returned in each device adv packet.  It
 ** is returned in the results callback if registered.
 */
@@ -764,8 +775,12 @@ enum
 };
 typedef UINT8   tBTM_BLE_CONN_TYPE;
 
-typedef void (tBTM_BLE_TRACK_ADV_CBACK)(int filt_index, tBLE_ADDR_TYPE addr_type, BD_ADDR bda,
-                                        int adv_state, tBTM_BLE_REF_VALUE ref_value);
+#define ADV_INFO_PRESENT        0x00
+#define NO_ADV_INFO_PRESENT     0x01
+
+typedef btgatt_track_adv_info_t tBTM_BLE_TRACK_ADV_DATA;
+
+typedef void (tBTM_BLE_TRACK_ADV_CBACK)(tBTM_BLE_TRACK_ADV_DATA *p_track_adv_data);
 
 typedef UINT8 tBTM_BLE_TRACK_ADV_EVT;
 
diff --git a/stack/l2cap/l2c_ble.c b/stack/l2cap/l2c_ble.c
index 61bc72a7a..65ac7ce08 100644
--- a/stack/l2cap/l2c_ble.c
+++ b/stack/l2cap/l2c_ble.c
@@ -70,8 +70,10 @@ BOOLEAN L2CA_CancelBleConnectReq (BD_ADDR rem_bda)
 
     if (btsnd_hcic_ble_create_conn_cancel())
     {
-
-        if ((p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, BT_TRANSPORT_LE)) != NULL)
+        p_lcb = l2cu_find_lcb_by_bd_addr(rem_bda, BT_TRANSPORT_LE);
+        /* Do not remove lcb if an LE link is already up as a peripheral */
+        if (p_lcb != NULL &&
+            !(p_lcb->link_role == HCI_ROLE_SLAVE && BTM_ACL_IS_CONNECTED(rem_bda)))
         {
             p_lcb->disc_reason = L2CAP_CONN_CANCEL;
             l2cu_release_lcb (p_lcb);
diff --git a/stack/mcap/mca_dact.c b/stack/mcap/mca_dact.c
index acd8cc044..6700dd707 100644
--- a/stack/mcap/mca_dact.c
+++ b/stack/mcap/mca_dact.c
@@ -24,7 +24,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bt_target.h"
 #include "bt_utils.h"
 #include "gki.h"
diff --git a/stack/mcap/mca_main.c b/stack/mcap/mca_main.c
index 44307d24a..b99c71206 100644
--- a/stack/mcap/mca_main.c
+++ b/stack/mcap/mca_main.c
@@ -145,8 +145,8 @@ tMCA_TC_TBL * mca_tc_tbl_calloc(tMCA_CCB *p_ccb)
     p_tbl->state    = MCA_TC_ST_IDLE;
     p_tbl->lcid     = p_ccb->lcid;
     mca_cb.tc.lcid_tbl[p_ccb->lcid - L2CAP_BASE_APPL_CID] = i;
-    MCA_TRACE_DEBUG("mca_tc_tbl_calloc cb_idx: %d", p_tbl->cb_idx);
 
+    MCA_TRACE_DEBUG("%s() - cb_idx: %d", __func__, p_tbl->cb_idx);
     return p_tbl;
 }
 
@@ -186,8 +186,8 @@ tMCA_TC_TBL * mca_tc_tbl_dalloc(tMCA_DCB *p_dcb)
     p_tbl->state    = MCA_TC_ST_IDLE;
     p_tbl->lcid     = p_dcb->lcid;
     mca_cb.tc.lcid_tbl[p_dcb->lcid - L2CAP_BASE_APPL_CID] = i;
-    MCA_TRACE_DEBUG("mca_tc_tbl_dalloc tcid: %d, cb_idx: %d", p_tbl->tcid, p_tbl->cb_idx);
 
+    MCA_TRACE_DEBUG("%s() - tcid: %d, cb_idx: %d", __func__, p_tbl->tcid, p_tbl->cb_idx);
     return p_tbl;
 }
 
@@ -265,8 +265,11 @@ void mca_set_cfg_by_tbl(tL2CAP_CFG_INFO *p_cfg, tMCA_TC_TBL *p_tbl)
     else
     {
         p_dcb = mca_dcb_by_hdl(p_tbl->cb_idx);
-        p_opt = &p_dcb->p_chnl_cfg->fcr_opt;
-        fcs   = p_dcb->p_chnl_cfg->fcs;
+        if (p_dcb)
+        {
+            p_opt = &p_dcb->p_chnl_cfg->fcr_opt;
+            fcs   = p_dcb->p_chnl_cfg->fcs;
+        }
     }
     memset(p_cfg, 0, sizeof(tL2CAP_CFG_INFO));
     p_cfg->mtu_present = TRUE;
@@ -303,7 +306,7 @@ void mca_tc_close_ind(tMCA_TC_TBL *p_tbl, UINT16 reason)
     close.reason = reason;
     close.lcid   = p_tbl->lcid;
 
-    MCA_TRACE_DEBUG("mca_tc_close_ind tcid: %d, cb_idx:%d, old: %d",
+    MCA_TRACE_DEBUG("%s() - tcid: %d, cb_idx:%d, old: %d", __func__, 
                      p_tbl->tcid, p_tbl->cb_idx, p_tbl->state);
 
     /* Check if the transport channel is in use */
@@ -406,7 +409,8 @@ void mca_tc_cong_ind(tMCA_TC_TBL *p_tbl, BOOLEAN is_congested)
     tMCA_CCB   *p_ccb;
     tMCA_DCB   *p_dcb;
 
-    MCA_TRACE_DEBUG("mca_tc_cong_ind tcid: %d, cb_idx: %d", p_tbl->tcid, p_tbl->cb_idx);
+    MCA_TRACE_DEBUG("%s() - tcid: %d, cb_idx: %d", __func__, p_tbl->tcid, p_tbl->cb_idx);
+
     /* if control channel, notify ccb of congestion */
     if (p_tbl->tcid == MCA_CTRL_TCID)
     {
@@ -445,8 +449,7 @@ void mca_tc_data_ind(tMCA_TC_TBL *p_tbl, BT_HDR *p_buf)
     UINT8       *p;
     UINT8       rej_rsp_code = MCA_RSP_SUCCESS;
 
-    MCA_TRACE_DEBUG("mca_tc_data_ind tcid: %d, cb_idx: %d", p_tbl->tcid, p_tbl->cb_idx);
-
+    MCA_TRACE_DEBUG("%s() - tcid: %d, cb_idx: %d", __func__, p_tbl->tcid, p_tbl->cb_idx);
 
     /* if control channel, handle control message */
     if (p_tbl->tcid == MCA_CTRL_TCID)
@@ -463,19 +466,21 @@ void mca_tc_data_ind(tMCA_TC_TBL *p_tbl, BT_HDR *p_buf)
             {
                 if (p_buf->len != mca_std_msg_len[*p])
                 {
-                    MCA_TRACE_ERROR ("opcode: %d required len:%d, got len:%d", *p, mca_std_msg_len[*p], p_buf->len);
+                    MCA_TRACE_ERROR ("$s() - opcode: %d required len: %d, got len: %d"
+                      , __func__, *p, mca_std_msg_len[*p], p_buf->len);
                     rej_rsp_code = MCA_RSP_BAD_PARAM;
                 }
             }
             else if ((*p >= MCA_FIRST_SYNC_OP) && (*p <= MCA_LAST_SYNC_OP))
             {
-                MCA_TRACE_ERROR ("unsupported SYNC opcode: %d len:%d", *p, p_buf->len);
+                MCA_TRACE_ERROR ("%s() - unsupported SYNC opcode: %d len:%d"
+                    , __func__, *p, p_buf->len);
                 /* reject unsupported request */
                 rej_rsp_code = MCA_RSP_NO_SUPPORT;
             }
             else
             {
-                MCA_TRACE_ERROR ("bad opcode: %d len:%d", *p, p_buf->len);
+                MCA_TRACE_ERROR ("%s() - bad opcode: %d len:%d", __func__, *p, p_buf->len);
                 /* reject unsupported request */
                 rej_rsp_code = MCA_RSP_BAD_OPCODE;
             }
@@ -563,7 +568,7 @@ void mca_rcb_dealloc(tMCA_HANDLE handle)
             if (done)
             {
                 memset (p_rcb, 0, sizeof(tMCA_RCB));
-                MCA_TRACE_DEBUG("Reset MCA_RCB index=%d",handle);
+                MCA_TRACE_DEBUG("%s() - reset MCA_RCB index=%d", __func__, handle);
             }
         }
     }
diff --git a/stack/rfcomm/rfc_l2cap_if.c b/stack/rfcomm/rfc_l2cap_if.c
index 087e73a13..d72a40a79 100644
--- a/stack/rfcomm/rfc_l2cap_if.c
+++ b/stack/rfcomm/rfc_l2cap_if.c
@@ -23,7 +23,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bt_target.h"
 #include "btcore/include/counter.h"
 #include "gki.h"
diff --git a/stack/rfcomm/rfc_ts_frames.c b/stack/rfcomm/rfc_ts_frames.c
index 9b3cdca84..812089378 100644
--- a/stack/rfcomm/rfc_ts_frames.c
+++ b/stack/rfcomm/rfc_ts_frames.c
@@ -23,7 +23,6 @@
  ******************************************************************************/
 
 #include <stddef.h>
-
 #include "bt_target.h"
 #include "btcore/include/counter.h"
 #include "gki.h"
diff --git a/stack/sdp/sdp_utils.c b/stack/sdp/sdp_utils.c
index 7cc9404b8..6e5c06404 100644
--- a/stack/sdp/sdp_utils.c
+++ b/stack/sdp/sdp_utils.c
@@ -789,7 +789,7 @@ BOOLEAN sdpu_compare_uuid_with_attr (tBT_UUID *p_btuuid, tSDP_DISC_ATTR *p_attr)
        The actual size of tSDP_DISC_ATVAL does not matter.
        If the array size in tSDP_DISC_ATVAL is increase, we would increase the system RAM usage unnecessarily
     */
-    else if (!memcmp (p_btuuid->uu.uuid128, p_attr->attr_value.v.array, MAX_UUID_SIZE))
+    else if (!memcmp (p_btuuid->uu.uuid128,(void*) p_attr->attr_value.v.array, MAX_UUID_SIZE))
         return (TRUE);
 
     return (FALSE);
diff --git a/stack/srvc/srvc_eng.c b/stack/srvc/srvc_eng.c
index 39299c5fd..2fcc6d921 100644
--- a/stack/srvc/srvc_eng.c
+++ b/stack/srvc/srvc_eng.c
@@ -439,7 +439,7 @@ tGATT_STATUS srvc_eng_init (void)
     }
     else
     {
-        memset(&srvc_eng_cb, 0, sizeof(tDIS_CB));
+        memset(&srvc_eng_cb, 0, sizeof(tSRVC_ENG_CB));
 
         /* Create a GATT profile service */
         srvc_eng_cb.gatt_if = GATT_Register(&app_uuid, &srvc_gatt_cback);
diff --git a/udrv/ulinux/uipc.c b/udrv/ulinux/uipc.c
index 01438263a..c3f8527d6 100644
--- a/udrv/ulinux/uipc.c
+++ b/udrv/ulinux/uipc.c
@@ -148,6 +148,8 @@ const char* dump_uipc_event(tUIPC_EVENT event)
 static inline int create_server_socket(const char* name)
 {
     int s = socket(AF_LOCAL, SOCK_STREAM, 0);
+    if (s < 0)
+        return -1;
 
     BTIF_TRACE_EVENT("create_server_socket %s", name);
 
diff --git a/utils/src/bt_utils.c b/utils/src/bt_utils.c
index 1d1dcdd55..53a53de20 100644
--- a/utils/src/bt_utils.c
+++ b/utils/src/bt_utils.c
@@ -40,6 +40,7 @@
 #include "bt_types.h"
 #include "bt_utils.h"
 #include "btcore/include/module.h"
+#include "osi/include/compat.h"
 #include "osi/include/log.h"
 
 /*******************************************************************************