diff --git a/msm8998/libbt-vendor/Android.mk b/msm8998/libbt-vendor/Android.mk
index f69700f..208cc9b 100644
--- a/msm8998/libbt-vendor/Android.mk
+++ b/msm8998/libbt-vendor/Android.mk
@@ -30,10 +30,12 @@
         src/hw_ar3k.c \
         src/bt_vendor_persist.cpp
 
+ifneq ($(TARGET_USES_AOSP),true)
 #Disable this flag in case if FM over UART support not needed
 ifeq ($(QCOM_BT_FM_OVER_UART),true)
 LOCAL_CFLAGS := -DFM_OVER_UART
 endif
+endif
 
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
 LOCAL_CFLAGS += -DPANIC_ON_SOC_CRASH
diff --git a/msm8998/libbt-vendor/include/bt_vendor_qcom.h b/msm8998/libbt-vendor/include/bt_vendor_qcom.h
index 526fc18..c71ce8a 100644
--- a/msm8998/libbt-vendor/include/bt_vendor_qcom.h
+++ b/msm8998/libbt-vendor/include/bt_vendor_qcom.h
@@ -84,7 +84,8 @@
     char *rfkill_state;
     bool enable_extldo;
 };
-extern struct bt_qcom_struct q;
+extern struct bt_qcom_struct *q;
+extern pthread_mutex_t q_lock;
 
 #endif /* BT_VENDOR_QCOM_H */
 
diff --git a/msm8998/libbt-vendor/src/bt_vendor_qcom.c b/msm8998/libbt-vendor/src/bt_vendor_qcom.c
index e3f4fa1..86a6fc9 100644
--- a/msm8998/libbt-vendor/src/bt_vendor_qcom.c
+++ b/msm8998/libbt-vendor/src/bt_vendor_qcom.c
@@ -65,7 +65,7 @@
 /******************************************************************************
 **  Variables
 ******************************************************************************/
-struct bt_qcom_struct q;
+struct bt_qcom_struct *q = NULL;
 pthread_mutex_t q_lock = PTHREAD_MUTEX_INITIALIZER;
 
 int userial_clock_operation(int fd, int cmd);
@@ -413,7 +413,7 @@
 #endif
 
     /* Assign rfkill_id and find bluetooth rfkill state path*/
-    for(i = 0; (q.rfkill_id == -1) && (q.rfkill_state == NULL); i++)
+    for(i = 0; (q->rfkill_id == -1) && (q->rfkill_state == NULL); i++)
     {
         snprintf(rfkill_type, sizeof(rfkill_type), "/sys/class/rfkill/rfkill%d/type", i);
         if ((fd = open(rfkill_type, O_RDONLY)) < 0)
@@ -432,17 +432,17 @@
 
         if ((size >= 9) && !memcmp(type, "bluetooth", 9))
         {
-            asprintf(&q.rfkill_state, "/sys/class/rfkill/rfkill%d/state", q.rfkill_id = i);
+            asprintf(&q->rfkill_state, "/sys/class/rfkill/rfkill%d/state", q->rfkill_id = i);
             break;
         }
     }
 
     /* Get rfkill State to control */
-    if (q.rfkill_state != NULL)
+    if (q->rfkill_state != NULL)
     {
-        if ((fd = open(q.rfkill_state, O_RDWR)) < 0)
+        if ((fd = open(q->rfkill_state, O_RDWR)) < 0)
         {
-            ALOGE("open(%s) for write failed: %s (%d)", q.rfkill_state, strerror(errno), errno);
+            ALOGE("open(%s) for write failed: %s (%d)", q->rfkill_state, strerror(errno), errno);
 #ifdef WIFI_BT_STATUS_SYNC
             bt_semaphore_release(lock_fd);
             bt_semaphore_destroy(lock_fd);
@@ -459,7 +459,7 @@
 #endif
             goto done;
     }
-    ret = asprintf(&enable_ldo_path, "/sys/class/rfkill/rfkill%d/device/extldo", q.rfkill_id);
+    ret = asprintf(&enable_ldo_path, "/sys/class/rfkill/rfkill%d/device/extldo", q->rfkill_id);
     if( (ret < 0 ) || (enable_ldo_path == NULL) )
     {
         ALOGE("Memory Allocation failure");
@@ -481,7 +481,7 @@
         if (ret < 0) {
             ALOGI("%s: Not able to set property wc_transport.extldo\n", __func__);
         }
-        q.enable_extldo = TRUE;
+        q->enable_extldo = TRUE;
     }
 
     if(on == '0'){
@@ -490,7 +490,7 @@
         property_set("wc_transport.soc_initialized", "0");
     }
 
-    if (q.soc_type >= BT_SOC_CHEROKEE && q.soc_type < BT_SOC_RESERVED) {
+    if (q->soc_type >= BT_SOC_CHEROKEE && q->soc_type < BT_SOC_RESERVED) {
        ALOGI("open bt power devnode,send ioctl power op  :%d ",en);
        fd_btpower = open(BT_PWR_CNTRL_DEVICE, O_RDWR, O_NONBLOCK);
        if (fd_btpower < 0) {
@@ -511,7 +511,7 @@
        /* Write value to control rfkill */
        if(fd >= 0) {
            if ((size = write(fd, &on, 1)) < 0) {
-               ALOGE("write(%s) failed: %s (%d)", q.rfkill_state, strerror(errno), errno);
+               ALOGE("write(%s) failed: %s (%d)", q->rfkill_state, strerror(errno), errno);
 #ifdef WIFI_BT_STATUS_SYNC
                bt_semaphore_release(lock_fd);
                bt_semaphore_destroy(lock_fd);
@@ -606,6 +606,7 @@
 static int init(const bt_vendor_callbacks_t *cb, unsigned char *bdaddr)
 {
     char prop[PROPERTY_VALUE_MAX] = {0};
+    struct bt_qcom_struct *temp = NULL;
     int ret = BT_STATUS_SUCCESS, i;
 
     ALOGI("++%s", __FUNCTION__);
@@ -616,18 +617,26 @@
         goto out;
     }
 
-    q.rfkill_id = -1;
-    q.enable_extldo = FALSE;
-    q.cb = cb;
-    q.ant_fd = -1;
-    q.soc_type = get_bt_soc_type();
-    soc_init(q.soc_type);
+    temp = (struct bt_qcom_struct *) malloc(sizeof(*q));
+    if (!temp) {
+        ALOGE("Failed to allocate memory. err %s(%d)", strerror(errno), errno);
+        ret = -BT_STATUS_NOMEM;
+        goto out;
+    }
+    memset(temp, 0, sizeof(*temp));
 
-    le2bd(bdaddr, q.bdaddr);
-    print_bdaddr(q.bdaddr);
+    temp->rfkill_id = -1;
+    temp->enable_extldo = FALSE;
+    temp->cb = cb;
+    temp->ant_fd = -1;
+    temp->soc_type = get_bt_soc_type();
+    soc_init(temp->soc_type);
+
+    le2bd(bdaddr, temp->bdaddr);
+    print_bdaddr(temp->bdaddr);
     snprintf(prop, sizeof(prop), "%02x:%02x:%02x:%02x:%02x:%02x",
-             q.bdaddr[0], q.bdaddr[1], q.bdaddr[2],
-             q.bdaddr[3], q.bdaddr[4], q.bdaddr[5]);
+             temp->bdaddr[0], temp->bdaddr[1], temp->bdaddr[2],
+             temp->bdaddr[3], temp->bdaddr[4], temp->bdaddr[5]);
     ret = property_set("wc_transport.stack_bdaddr", prop);
     if (ret < 0) {
         ALOGE("Failed to set wc_transport.stack_bdaddr prop, ret = %d", ret);
@@ -641,9 +650,12 @@
 #endif /* WIFI_BT_STATUS_SYNC */
 
     /* Everything successful */
+    q = temp;
     return ret;
 
 out:
+    if (temp)
+        free(temp);
     ALOGI("--%s ret %d", __FUNCTION__, ret);
     return ret;
 }
@@ -763,7 +775,7 @@
                 ALOGI("bt-vendor : BT_VND_OP_POWER_CTRL: %s",
                         (nState == BT_VND_PWR_ON)? "On" : "Off" );
 
-                switch(q.soc_type)
+                switch(q->soc_type)
                 {
                     case BT_SOC_DEFAULT:
                         if (readTrpState())
@@ -785,9 +797,7 @@
                     case BT_SOC_AR3K:
                     case BT_SOC_CHEROKEE:
                         /* BT Chipset Power Control through Device Tree Node */
-                        pthread_mutex_lock(&q_lock);
                         retval = bt_powerup(nState);
-                        pthread_mutex_unlock(&q_lock);
                     default:
                         break;
                 }
@@ -796,10 +806,10 @@
 
         case BT_VND_OP_FW_CFG: {
                 /* call hciattach to initalize the stack */
-                if (q.soc_type == BT_SOC_ROME) {
+                if (q->soc_type == BT_SOC_ROME) {
                     if (is_soc_initialized()) {
                         ALOGI("Bluetooth FW and transport layer are initialized");
-                        q.cb->fwcfg_cb(BT_VND_OP_RESULT_SUCCESS);
+                        q->cb->fwcfg_cb(BT_VND_OP_RESULT_SUCCESS);
                     } else {
                         ALOGE("bt_vendor_cbacks is null or SoC not initialized");
                         ALOGE("Error : hci, smd initialization Error");
@@ -807,13 +817,13 @@
                     }
                 } else {
                     ALOGI("Bluetooth FW and transport layer are initialized");
-                    q.cb->fwcfg_cb(BT_VND_OP_RESULT_SUCCESS);
+                    q->cb->fwcfg_cb(BT_VND_OP_RESULT_SUCCESS);
                 }
         }
             break;
 
         case BT_VND_OP_SCO_CFG:
-            q.cb->scocfg_cb(BT_VND_OP_RESULT_SUCCESS); //dummy
+            q->cb->scocfg_cb(BT_VND_OP_RESULT_SUCCESS); //dummy
             break;
 #ifdef ENABLE_ANT
         case BT_VND_OP_ANT_USERIAL_OPEN:
@@ -837,17 +847,17 @@
                 int (*fd_array)[] = (int (*)[]) param;
                 int idx, fd = -1, fd_filter = -1;
                 ALOGI("bt-vendor : BT_VND_OP_USERIAL_OPEN");
-                switch(q.soc_type)
+                switch(q->soc_type)
                 {
                     case BT_SOC_DEFAULT:
                         {
-                            if(bt_hci_init_transport(q.fd) != -1){
+                            if(bt_hci_init_transport(q->fd) != -1){
                                 int (*fd_array)[] = (int (*) []) param;
 
-                                    (*fd_array)[CH_CMD] = q.fd[0];
-                                    (*fd_array)[CH_EVT] = q.fd[0];
-                                    (*fd_array)[CH_ACL_OUT] = q.fd[1];
-                                    (*fd_array)[CH_ACL_IN] = q.fd[1];
+                                    (*fd_array)[CH_CMD] = q->fd[0];
+                                    (*fd_array)[CH_EVT] = q->fd[0];
+                                    (*fd_array)[CH_ACL_OUT] = q->fd[1];
+                                    (*fd_array)[CH_ACL_IN] = q->fd[1];
                             }
                             else {
                                 retval = -1;
@@ -922,7 +932,7 @@
                                         }
                                         if (i == 6 && !ignore_boot_prop) {
                                             ALOGV("Valid BD address read from prop");
-                                            memcpy(q.bdaddr, local_bd_addr_from_prop, sizeof(vnd_local_bd_addr));
+                                            memcpy(q->bdaddr, local_bd_addr_from_prop, sizeof(vnd_local_bd_addr));
                                             ignore_boot_prop = FALSE;
                                         } else {
                                             ALOGE("There are not enough tokens in BD addr");
@@ -948,12 +958,12 @@
                                 }
 #endif //READ_BT_ADDR_FROM_PROP
                                     /* Always read BD address from NV file */
-                                if(ignore_boot_prop && !bt_vendor_nv_read(1, q.bdaddr))
+                                if(ignore_boot_prop && !bt_vendor_nv_read(1, q->bdaddr))
                                 {
                                    /* Since the BD address is configured in boot time We should not be here */
                                    ALOGI("Failed to read BD address. Use the one from bluedroid stack/ftm");
                                 }
-                                if(rome_soc_init(fd, (char*)q.bdaddr)<0) {
+                                if(rome_soc_init(fd, (char*)q->bdaddr)<0) {
                                     retval = -1;
                                 } else {
                                     ALOGV("rome_soc_init is completed");
@@ -975,7 +985,7 @@
 #ifdef ENABLE_ANT
                                     if (is_ant_req) {
                                         ALOGI("%s: connect to ant channel", __func__);
-                                        q.ant_fd = fd_filter = connect_to_local_socket("ant_sock");
+                                        q->ant_fd = fd_filter = connect_to_local_socket("ant_sock");
                                     }
                                     else
 #endif
@@ -1012,7 +1022,7 @@
                                     }
                                 }
                             } else {
-                                if (q.soc_type == BT_SOC_ROME)
+                                if (q->soc_type == BT_SOC_ROME)
                                     ALOGE("Failed to initialize ROME Controller!!!");
                             }
 
@@ -1038,14 +1048,14 @@
 #ifdef ENABLE_ANT
                                 if (is_ant_req) {
                                     ALOGI("%s: connect to ant channel", __func__);
-                                    q.ant_fd = fd_filter = connect_to_local_socket("ant_sock");
+                                    q->ant_fd = fd_filter = connect_to_local_socket("ant_sock");
                                 }
                                 else
 #endif
 #ifdef FM_OVER_UART
-                                if (is_fm_req && (q.soc_type >=BT_SOC_ROME && q.soc_type < BT_SOC_RESERVED)) {
+                                if (is_fm_req && (q->soc_type >=BT_SOC_ROME && q->soc_type < BT_SOC_RESERVED)) {
                                     ALOGI("%s: connect to fm channel", __func__);
-                                    q.fm_fd = fd_filter = connect_to_local_socket("fm_sock");
+                                    q->fm_fd = fd_filter = connect_to_local_socket("fm_sock");
                                 }
                                 else
 #endif
@@ -1081,22 +1091,20 @@
                         }
                         break;
                     default:
-                        ALOGE("Unknown soc_type: 0x%x", q.soc_type);
+                        ALOGE("Unknown soc_type: 0x%x", q->soc_type);
                         break;
                   }
             } break;
 #ifdef ENABLE_ANT
         case BT_VND_OP_ANT_USERIAL_CLOSE:
             {
-                pthread_mutex_lock(&q_lock);
                 ALOGI("bt-vendor : BT_VND_OP_ANT_USERIAL_CLOSE");
                 property_set("wc_transport.clean_up","1");
-                if (q.ant_fd != -1) {
+                if (q->ant_fd != -1) {
                     ALOGE("closing ant_fd");
-                    close(q.ant_fd);
-                    q.ant_fd = -1;
+                    close(q->ant_fd);
+                    q->ant_fd = -1;
                 }
-                pthread_mutex_unlock(&q_lock);
             }
             break;
 #endif
@@ -1105,34 +1113,32 @@
             {
                 ALOGI("bt-vendor : BT_VND_OP_FM_USERIAL_CLOSE");
                 property_set("wc_transport.clean_up","1");
-                if (q.fm_fd != -1) {
+                if (q->fm_fd != -1) {
                     ALOGE("closing fm_fd");
-                    close(q.fm_fd);
-                    q.fm_fd = -1;
+                    close(q->fm_fd);
+                    q->fm_fd = -1;
                 }
                 break;
             }
 #endif
         case BT_VND_OP_USERIAL_CLOSE:
             {
-                ALOGI("bt-vendor : BT_VND_OP_USERIAL_CLOSE soc_type: %d", q.soc_type);
-                switch(q.soc_type)
+                ALOGI("bt-vendor : BT_VND_OP_USERIAL_CLOSE soc_type: %d", q->soc_type);
+                switch(q->soc_type)
                 {
                     case BT_SOC_DEFAULT:
-                        bt_hci_deinit_transport(q.fd);
+                        bt_hci_deinit_transport(q->fd);
                         break;
                     case BT_SOC_ROME:
                     case BT_SOC_AR3K:
                     case BT_SOC_CHEROKEE:
                     {
-                        pthread_mutex_lock(&q_lock);
                         property_set("wc_transport.clean_up","1");
                         userial_vendor_close();
-                        pthread_mutex_unlock(&q_lock);
                         break;
                     }
                     default:
-                        ALOGE("Unknown soc_type: 0x%x", q.soc_type);
+                        ALOGE("Unknown soc_type: 0x%x", q->soc_type);
                         break;
                 }
             }
@@ -1151,7 +1157,7 @@
             break;
 
         case BT_VND_OP_LPM_SET_MODE:
-            if (q.soc_type == BT_SOC_AR3K) {
+            if (q->soc_type == BT_SOC_AR3K) {
                 if (!param) {
                     ALOGE("opcode = %d: param is null", opcode_init);
                     break;
@@ -1164,7 +1170,7 @@
                 else {
                     lpm_set_ar3k(UPIO_LPM_MODE, UPIO_DEASSERT, 0);
                 }
-                q.cb->lpm_cb(BT_VND_OP_RESULT_SUCCESS);
+                q->cb->lpm_cb(BT_VND_OP_RESULT_SUCCESS);
             } else {
                 int lpm_result = BT_VND_OP_RESULT_SUCCESS;
 
@@ -1180,12 +1186,12 @@
                     lpm_result = BT_VND_OP_RESULT_FAIL;
                 }
 
-                q.cb->lpm_cb(lpm_result);
+                q->cb->lpm_cb(lpm_result);
             }
             break;
 
         case BT_VND_OP_LPM_WAKE_SET_STATE: {
-            switch(q.soc_type) {
+            switch(q->soc_type) {
             case BT_SOC_CHEROKEE:
             case BT_SOC_ROME: {
                 if (!param) {
@@ -1203,7 +1209,7 @@
 
 #ifdef QCOM_BT_SIBS_ENABLE
                 ALOGI("Invoking HCI H4 callback function");
-                q.cb->lpm_set_state_cb(wake_assert);
+                q->cb->lpm_set_state_cb(wake_assert);
 #endif
             }
             break;
@@ -1220,16 +1226,16 @@
             case BT_SOC_DEFAULT:
                 break;
             default:
-                ALOGE("Unknown soc_type: 0x%x", q.soc_type);
+                ALOGE("Unknown soc_type: 0x%x", q->soc_type);
                 break;
             }
         }
             break;
         case BT_VND_OP_EPILOG: {
 #if (HW_NEED_END_WITH_HCI_RESET == FALSE)
-            q.cb->epilog_cb(BT_VND_OP_RESULT_SUCCESS);
+            q->cb->epilog_cb(BT_VND_OP_RESULT_SUCCESS);
 #else
-                switch(q.soc_type)
+                switch(q->soc_type)
                 {
                   case BT_SOC_CHEROKEE:
                   case BT_SOC_ROME:
@@ -1242,7 +1248,7 @@
                            }
                            else
                            {
-                                q.cb->epilog_cb(BT_VND_OP_RESULT_SUCCESS);
+                                q->cb->epilog_cb(BT_VND_OP_RESULT_SUCCESS);
                            }
                        }
                        break;
@@ -1262,7 +1268,7 @@
                      break;
                 }
 
-                switch(q.soc_type)
+                switch(q->soc_type)
                 {
                     case BT_SOC_CHEROKEE:
                             retval = 3200000;
@@ -1291,11 +1297,16 @@
 
     ALOGI("++%s", __FUNCTION__);
 
+    pthread_mutex_lock(&q_lock);
+    if (!q) {
+        ALOGE("ssr_cleanup called with NULL context");
+        goto out;
+    }
     if (property_set("wc_transport.patch_dnld_inprog", "null") < 0) {
         ALOGE("Failed to set property");
     }
 
-    if (q.soc_type >= BT_SOC_ROME && q.soc_type < BT_SOC_RESERVED) {
+    if (q->soc_type >= BT_SOC_ROME && q->soc_type < BT_SOC_RESERVED) {
 #ifdef ENABLE_ANT
         /*Indicate to filter by sending special byte */
         if (reason == CMD_TIMEOUT) {
@@ -1332,6 +1343,7 @@
     op(BT_VND_OP_POWER_CTRL, &pwr_state);
 
 out:
+    pthread_mutex_unlock(&q_lock);
     ALOGI("--%s", __FUNCTION__);
 }
 
@@ -1341,7 +1353,9 @@
     ALOGI("cleanup");
 
     pthread_mutex_lock(&q_lock);
-    q.cb = NULL;
+    q->cb = NULL;
+    free(q);
+    q = NULL;
     pthread_mutex_unlock(&q_lock);
 
 #ifdef WIFI_BT_STATUS_SYNC
@@ -1379,12 +1393,12 @@
 
     ALOGV("%s:", __FUNCTION__);
 
-    if ((q.soc_type = get_bt_soc_type()) < 0) {
+    if ((q->soc_type = get_bt_soc_type()) < 0) {
         ALOGE("%s: Failed to detect BT SOC Type", __FUNCTION__);
         return -1;
     }
 
-    switch(q.soc_type)
+    switch(q->soc_type)
     {
         case BT_SOC_ROME:
             ALOGI("%s: ROME case", __func__);
@@ -1401,7 +1415,7 @@
         case BT_SOC_DEFAULT:
             break;
         default:
-            ALOGE("Unknown btSocType: 0x%x", q.soc_type);
+            ALOGE("Unknown btSocType: 0x%x", q->soc_type);
             break;
     }
     return retval;
diff --git a/msm8998/libbt-vendor/src/hardware.c b/msm8998/libbt-vendor/src/hardware.c
index 6984ff0..ff421c2 100644
--- a/msm8998/libbt-vendor/src/hardware.c
+++ b/msm8998/libbt-vendor/src/hardware.c
@@ -132,12 +132,18 @@
 
     ALOGI("%s Opcode:0x%04X Status: %d", __FUNCTION__, opcode, status);
 
+    pthread_mutex_lock(&q_lock);
+    if (!q) {
+        ALOGE("hw_epilog_cback called with NULL context");
+        goto out;
+    }
     /* Must free the RX event buffer */
-    q.cb->dealloc(p_evt_buf);
+    q->cb->dealloc(p_evt_buf);
 
     /* Once epilog process is done, must call callback to notify caller */
-    q.cb->epilog_cb(BT_VND_OP_RESULT_SUCCESS);
-
+    q->cb->epilog_cb(BT_VND_OP_RESULT_SUCCESS);
+out:
+    pthread_mutex_unlock(&q_lock);
 }
 
 /*******************************************************************************
@@ -145,7 +151,7 @@
 ** Function         hw_epilog_process
 **
 ** Description      Sample implementation of epilog process. This process is
-**                  called with q_lock held and q.cb is assumed to be valid.
+**                  called with q_lock held and q->cb is assumed to be valid.
 **
 ** Returns          None
 **
@@ -159,7 +165,7 @@
 
     /* Sending a HCI_RESET */
     /* Must allocate command buffer via HC's alloc API */
-    p_buf = (HC_BT_HDR *) q.cb->alloc(BT_HC_HDR_SIZE + HCI_CMD_PREAMBLE_SIZE);
+    p_buf = (HC_BT_HDR *) q->cb->alloc(BT_HC_HDR_SIZE + HCI_CMD_PREAMBLE_SIZE);
     if (p_buf)
     {
         p_buf->event = MSG_STACK_TO_HC_HCI_CMD;
@@ -172,12 +178,12 @@
         *p = 0; /* parameter length */
 
         /* Send command via HC's xmit_cb API */
-        q.cb->xmit_cb(HCI_RESET, p_buf, hw_epilog_cback);
+        q->cb->xmit_cb(HCI_RESET, p_buf, hw_epilog_cback);
     }
     else
     {
         ALOGE("vendor lib epilog process aborted [no buffer]");
-        q.cb->epilog_cb(BT_VND_OP_RESULT_FAIL);
+        q->cb->epilog_cb(BT_VND_OP_RESULT_FAIL);
     }
 }
 #endif // (HW_NEED_END_WITH_HCI_RESET == TRUE)
diff --git a/msm8998/libbt-vendor/src/hw_ar3k.c b/msm8998/libbt-vendor/src/hw_ar3k.c
index a5d73e2..1a68aab 100644
--- a/msm8998/libbt-vendor/src/hw_ar3k.c
+++ b/msm8998/libbt-vendor/src/hw_ar3k.c
@@ -50,6 +50,7 @@
 #include <string.h>
 
 #include "bt_hci_bdroid.h"
+#include "bt_vendor_qcom.h"
 #include "hci_uart.h"
 #include "hw_ar3k.h"
 #include "bt_vendor_qcom.h"
diff --git a/msm8998/libbt-vendor/src/hw_rome.c b/msm8998/libbt-vendor/src/hw_rome.c
index 9a69460..ccfb137 100644
--- a/msm8998/libbt-vendor/src/hw_rome.c
+++ b/msm8998/libbt-vendor/src/hw_rome.c
@@ -155,30 +155,30 @@
         {
             case EDL_PATCH_VER_RES_EVT:
             case EDL_APP_VER_RES_EVT:
-                productid = (unsigned int)(rsp[PATCH_PROD_ID_OFFSET +3] << 24 |
-                                    rsp[PATCH_PROD_ID_OFFSET+2] << 16 |
-                                    rsp[PATCH_PROD_ID_OFFSET+1] << 8 |
-                                    rsp[PATCH_PROD_ID_OFFSET]  );
-                ALOGI("\t Current Product ID\t\t: 0x%08x", productid);
+                ALOGI("\t Current Product ID\t\t: 0x%08x",
+                    productid = (unsigned int)(rsp[PATCH_PROD_ID_OFFSET +3] << 24 |
+                                        rsp[PATCH_PROD_ID_OFFSET+2] << 16 |
+                                        rsp[PATCH_PROD_ID_OFFSET+1] << 8 |
+                                        rsp[PATCH_PROD_ID_OFFSET]  ));
 
                 /* Patch Version indicates FW patch version */
-                patchversion = (unsigned short)(rsp[PATCH_PATCH_VER_OFFSET + 1] << 8 |
-                                       rsp[PATCH_PATCH_VER_OFFSET] );
-                ALOGI("\t Current Patch Version\t\t: 0x%04x", patchversion);
+                ALOGI("\t Current Patch Version\t\t: 0x%04x",
+                    (patchversion = (unsigned short)(rsp[PATCH_PATCH_VER_OFFSET + 1] << 8 |
+                                            rsp[PATCH_PATCH_VER_OFFSET] )));
 
                 /* ROM Build Version indicates ROM build version like 1.0/1.1/2.0 */
-                buildversion = (int)(rsp[PATCH_ROM_BUILD_VER_OFFSET + 1] << 8 |
-                                       rsp[PATCH_ROM_BUILD_VER_OFFSET] );
-                ALOGI("\t Current ROM Build Version\t: 0x%04x", buildversion);
+                ALOGI("\t Current ROM Build Version\t: 0x%04x", buildversion =
+                    (int)(rsp[PATCH_ROM_BUILD_VER_OFFSET + 1] << 8 |
+                                            rsp[PATCH_ROM_BUILD_VER_OFFSET] ));
 
                 /* In case rome 1.0/1.1, there is no SOC ID version available */
                 if (paramlen - 10)
                 {
-                    soc_id = (unsigned int)(rsp[PATCH_SOC_VER_OFFSET +3] << 24 |
-                                     rsp[PATCH_SOC_VER_OFFSET+2] << 16 |
-                                     rsp[PATCH_SOC_VER_OFFSET+1] << 8 |
-                                     rsp[PATCH_SOC_VER_OFFSET]  );
-                    ALOGI("\t Current SOC Version\t\t: 0x%08x", soc_id);
+                    ALOGI("\t Current SOC Version\t\t: 0x%08x", soc_id =
+                        (unsigned int)(rsp[PATCH_SOC_VER_OFFSET +3] << 24 |
+                                                rsp[PATCH_SOC_VER_OFFSET+2] << 16 |
+                                                rsp[PATCH_SOC_VER_OFFSET+1] << 8 |
+                                                rsp[PATCH_SOC_VER_OFFSET]  ));
                 }
 
                 if (NULL != (btversionfile = fopen(BT_VERSION_FILEPATH, "wb"))) {
@@ -817,6 +817,7 @@
     return err;
 }
 
+/* This function is called with q_lock held and q is non-NULL */
 int rome_get_tlv_file(char *file_path)
 {
     FILE * pFile;
@@ -907,7 +908,7 @@
 
             /* Write BD Address */
             if(nvm_ptr->tag_id == TAG_NUM_2){
-                memcpy(nvm_byte_ptr, q.bdaddr, 6);
+                memcpy(nvm_byte_ptr, q->bdaddr, 6);
                 ALOGI("BD Address: %.02x:%.02x:%.02x:%.02x:%.02x:%.02x",
                     *nvm_byte_ptr, *(nvm_byte_ptr+1), *(nvm_byte_ptr+2),
                     *(nvm_byte_ptr+3), *(nvm_byte_ptr+4), *(nvm_byte_ptr+5));
@@ -1347,7 +1348,7 @@
     {
         /* Write BD Address */
         if(cmds[i][TAG_NUM_OFFSET] == TAG_NUM_2){
-            memcpy(&cmds[i][TAG_BDADDR_OFFSET], q.bdaddr, 6);
+            memcpy(&cmds[i][TAG_BDADDR_OFFSET], q->bdaddr, 6);
             ALOGI("BD Address: %.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
                 cmds[i][TAG_BDADDR_OFFSET ], cmds[i][TAG_BDADDR_OFFSET + 1],
                 cmds[i][TAG_BDADDR_OFFSET + 2], cmds[i][TAG_BDADDR_OFFSET + 3],
@@ -1779,10 +1780,12 @@
    return;
 }
 
+
+/* This function is called with q_lock held and q is non-NULL */
 static int disable_internal_ldo(int fd)
 {
     int ret = 0;
-    if (q.enable_extldo) {
+    if (q->enable_extldo) {
         unsigned char cmd[5] = {0x01, 0x0C, 0xFC, 0x01, 0x32};
         unsigned char rsp[HCI_MAX_EVENT_SIZE];