Fix heap overflow in nfa_rw_store_ndef_rx_buf am: f75e4bfe4a
am: 170489f6f5

Change-Id: I255e13cb3f44c5648802235669e8473fb84eff34
diff --git a/Android.bp b/Android.bp
index 30c3e60..f049a1d 100644
--- a/Android.bp
+++ b/Android.bp
@@ -13,6 +13,10 @@
         "src/adaptation/CrcChecksum.cpp",
         "src/nfca_version.c",
     ],
+    header_libs: [
+        "libhardware_headers",
+        "libhardware_legacy_headers",
+    ],
     shared_libs: [
         "libcutils",
         "liblog",
diff --git a/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp b/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
index 026f5e6..f5b3f0c 100644
--- a/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
+++ b/halimpl/bcm2079x/adaptation/NonVolatileStore.cpp
@@ -28,6 +28,7 @@
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
+#include <unistd.h>
 #include <string>
 #include "CrcChecksum.h"
 #include "config.h"
@@ -81,7 +82,7 @@
     size_t actualReadData = read(fileStream, p_buf, nbytes);
     close(fileStream);
     if (actualReadData > 0) {
-      ALOGD("%s: data size=%u", __func__, actualReadData);
+      ALOGD("%s: data size=%zu", __func__, actualReadData);
       nfc_hal_nv_ci_read(actualReadData, NFC_HAL_NV_CO_OK, block);
     } else {
       ALOGE("%s: fail to read", __func__);
@@ -132,7 +133,7 @@
     unsigned short checksum = crcChecksumCompute(p_buf, nbytes);
     size_t actualWrittenCrc = write(fileStream, &checksum, sizeof(checksum));
     size_t actualWrittenData = write(fileStream, p_buf, nbytes);
-    ALOGD("%s: %d bytes written", __func__, actualWrittenData);
+    ALOGD("%s: %zu bytes written", __func__, actualWrittenData);
     if ((actualWrittenData == nbytes) &&
         (actualWrittenCrc == sizeof(checksum))) {
       nfc_hal_nv_ci_write(NFC_HAL_NV_CO_OK);
diff --git a/halimpl/bcm2079x/adaptation/StartupConfig.cpp b/halimpl/bcm2079x/adaptation/StartupConfig.cpp
index b3ee468..333bc3b 100644
--- a/halimpl/bcm2079x/adaptation/StartupConfig.cpp
+++ b/halimpl/bcm2079x/adaptation/StartupConfig.cpp
@@ -87,7 +87,7 @@
     return false;
   }
 
-  ALOGD("%s: try append %u bytes", fn,
+  ALOGD("%s: try append %zu bytes", fn,
         (uint8_string::size_type)(newContentLen));
   // append new payload into private buffer
   mBuffer.append(newContent + 1, (uint8_string::size_type)(newContentLen - 1));
diff --git a/halimpl/bcm2079x/adaptation/_OverrideLog.cpp b/halimpl/bcm2079x/adaptation/_OverrideLog.cpp
index c788b60..0fe9bae 100644
--- a/halimpl/bcm2079x/adaptation/_OverrideLog.cpp
+++ b/halimpl/bcm2079x/adaptation/_OverrideLog.cpp
@@ -26,6 +26,7 @@
  ******************************************************************************/
 #include "_OverrideLog.h"
 #include <cutils/properties.h>
+#include <stdio.h>
 #include <string.h>
 #include "android_logmsg.h"
 #include "config.h"
diff --git a/halimpl/bcm2079x/adaptation/patchram.cpp b/halimpl/bcm2079x/adaptation/patchram.cpp
index f4f01ac..3fc4b5a 100644
--- a/halimpl/bcm2079x/adaptation/patchram.cpp
+++ b/halimpl/bcm2079x/adaptation/patchram.cpp
@@ -26,6 +26,7 @@
 #include "nfc_hal_post_reset.h"
 }
 #include <cutils/properties.h>
+#include <inttypes.h>
 #include <malloc.h>
 #include <string>
 #include "StartupConfig.h"
@@ -375,10 +376,10 @@
 **
 *******************************************************************************/
 static void StartPatchDownload(uint32_t chipid) {
-  ALOGD("%s: chipid=%lx", __func__, chipid);
+  ALOGD("%s: chipid=%" PRIu32, __func__, chipid);
 
   char chipID[30];
-  sprintf(chipID, "%lx", chipid);
+  sprintf(chipID, "%" PRIu32, chipid);
   ALOGD("%s: chidId=%s", __func__, chipID);
 
   readOptionalConfig(chipID);  // Read optional chip specific settings
@@ -400,16 +401,18 @@
         if (sI2cFixPrmBuf != NULL) {
           size_t actualLen = fread(sI2cFixPrmBuf, 1, lenPrmBuffer, fd);
           if (actualLen == lenPrmBuffer) {
-            ALOGD("%s Setting I2C fix to %s (size: %lu)", __func__, sPrePatchFn,
-                  lenPrmBuffer);
+            ALOGD("%s Setting I2C fix to %s (size: %" PRIu32 ")", __func__,
+                  sPrePatchFn, lenPrmBuffer);
             HAL_NfcPrmSetI2cPatch((uint8_t*)sI2cFixPrmBuf,
                                   (uint16_t)lenPrmBuffer, 0);
           } else
-            ALOGE("%s fail reading i2c fix; actual len=%zu; expected len=%lu",
-                  __func__, actualLen, lenPrmBuffer);
+            ALOGE(
+                "%s fail reading i2c fix; actual len=%zu; expected len="
+                "%" PRIu32,
+                __func__, actualLen, lenPrmBuffer);
         } else {
-          ALOGE("%s Unable to get buffer to i2c fix (%lu bytes)", __func__,
-                lenPrmBuffer);
+          ALOGE("%s Unable to get buffer to i2c fix (%" PRIu32 " bytes)",
+                __func__, lenPrmBuffer);
         }
 
         fclose(fd);
@@ -430,8 +433,8 @@
       fd = fopen(sPatchFn, "rb");
       if (fd != NULL) {
         uint32_t lenPrmBuffer = getFileLength(fd);
-        ALOGD("%s Downloading patchfile %s (size: %lu) format=%u", __func__,
-              sPatchFn, lenPrmBuffer, NFC_HAL_PRM_FORMAT_NCD);
+        ALOGD("%s Downloading patchfile %s (size: %" PRIu32 ") format=%u",
+              __func__, sPatchFn, lenPrmBuffer, NFC_HAL_PRM_FORMAT_NCD);
         sPrmBuf = malloc(lenPrmBuffer);
         if (sPrmBuf != NULL) {
           size_t actualLen = fread(sPrmBuf, 1, lenPrmBuffer, fd);
@@ -446,8 +449,8 @@
           } else
             ALOGE("%s fail reading patchram", __func__);
         } else
-          ALOGE("%s Unable to buffer to hold patchram (%lu bytes)", __func__,
-                lenPrmBuffer);
+          ALOGE("%s Unable to buffer to hold patchram (%" PRIu32 " bytes)",
+                __func__, lenPrmBuffer);
 
         fclose(fd);
       } else
@@ -483,7 +486,8 @@
 **
 *******************************************************************************/
 void nfc_hal_post_reset_init(uint32_t brcm_hw_id, uint8_t nvm_type) {
-  ALOGD("%s: brcm_hw_id=0x%lx, nvm_type=%d", __func__, brcm_hw_id, nvm_type);
+  ALOGD("%s: brcm_hw_id=0x%" PRIu32 ", nvm_type=%d", __func__, brcm_hw_id,
+        nvm_type);
   tHAL_NFC_STATUS stat = HAL_NFC_STATUS_FAILED;
   uint8_t max_credits = 1, allow_no_nvm = 0;
 
@@ -580,7 +584,7 @@
 
   if ((hwId == 0) && (xtalFreq == 0) && (xtalIndex == 0)) return;
 
-  ALOGD("%s: hwId=0x%lX; freq=%u; index=%u", __func__, hwId, xtalFreq,
+  ALOGD("%s: hwId=0x%" PRIX32 "; freq=%u; index=%u", __func__, hwId, xtalFreq,
         xtalIndex);
   nfc_post_reset_cb.dev_init_config.xtal_cfg[0].brcm_hw_id =
       (hwId & BRCM_NFC_GEN_MASK);
diff --git a/halimpl/bcm2079x/adaptation/spdhelper.cpp b/halimpl/bcm2079x/adaptation/spdhelper.cpp
index 7acb52c..b936753 100644
--- a/halimpl/bcm2079x/adaptation/spdhelper.cpp
+++ b/halimpl/bcm2079x/adaptation/spdhelper.cpp
@@ -56,7 +56,7 @@
   string strNew;
 
   // Get the patch ID from the prm data.
-  for (int i = 0; i < 8 && i < len; ++i) strNew.append(toHex(*prm++));
+  for (uint32_t i = 0; i < 8 && i < len; ++i) strNew.append(toHex(*prm++));
 
   // If it is not the same patch as before, then reset things.
   if (strNew != mPatchId) {
diff --git a/halimpl/bcm2079x/gki/common/gki.h b/halimpl/bcm2079x/gki/common/gki.h
index a3e478a..f452719 100644
--- a/halimpl/bcm2079x/gki/common/gki.h
+++ b/halimpl/bcm2079x/gki/common/gki.h
@@ -363,7 +363,7 @@
 extern void GKI_exit_task(uint8_t);
 extern uint8_t GKI_get_taskid(void);
 extern void GKI_init(void);
-extern uint8_t* GKI_map_taskname(uint8_t);
+extern int8_t* GKI_map_taskname(uint8_t);
 extern uint8_t GKI_resume_task(uint8_t);
 extern void GKI_run(void*);
 extern void GKI_stop(void);
diff --git a/halimpl/bcm2079x/gki/ulinux/gki_ulinux.c b/halimpl/bcm2079x/gki/ulinux/gki_ulinux.c
index 255d7c2..74743c4 100644
--- a/halimpl/bcm2079x/gki/ulinux/gki_ulinux.c
+++ b/halimpl/bcm2079x/gki/ulinux/gki_ulinux.c
@@ -19,6 +19,7 @@
 #include <malloc.h>
 #include <stdarg.h>
 #include <stdio.h>
+#include <unistd.h>
 
 #define GKI_DEBUG FALSE
 
@@ -886,7 +887,7 @@
 ** NOTE             this function needs no customization
 **
 *******************************************************************************/
-uint8_t* GKI_map_taskname(uint8_t task_id) {
+int8_t* GKI_map_taskname(uint8_t task_id) {
   GKI_TRACE_1("GKI_map_taskname %d", task_id);
 
   if (task_id < GKI_MAX_TASKS) {
@@ -896,7 +897,7 @@
   } else if (task_id == GKI_MAX_TASKS) {
     return (gki_cb.com.OSTName[GKI_get_taskid()]);
   } else {
-    return (uint8_t*)"BAD";
+    return (int8_t*)"BAD";
   }
 }
 
diff --git a/halimpl/pn54x/hal/phNxpNciHal.c b/halimpl/pn54x/hal/phNxpNciHal.c
index f09294e..5a799d5 100644
--- a/halimpl/pn54x/hal/phNxpNciHal.c
+++ b/halimpl/pn54x/hal/phNxpNciHal.c
@@ -21,7 +21,6 @@
 #include <phNxpNciHal.h>
 #include <phNxpNciHal_Adaptation.h>
 #include <phNxpNciHal_Dnld.h>
-#include <phNxpNciHal_Kovio.h>
 #include <phNxpNciHal_NfcDepSWPrio.h>
 #include <phNxpNciHal_ext.h>
 #include <phTmlNfc.h>
@@ -70,9 +69,6 @@
 
 extern uint16_t fw_maj_ver;
 extern uint16_t rom_version;
-extern int send_to_upper_kovio;
-extern int kovio_detected;
-extern int disable_kovio;
 #if (NFC_NXP_CHIP_TYPE != PN547C2)
 extern uint8_t gRecFWDwnld;
 static uint8_t gRecFwRetryCount;  // variable to hold dummy FW recovery count
@@ -83,7 +79,6 @@
 uint8_t discovery_cmd[50] = {0};
 uint8_t discovery_cmd_len = 0;
 #endif
-extern bool_t rf_deactive_cmd;
 uint32_t timeoutTimerId = 0;
 phNxpNciHal_Sem_t config_data;
 
@@ -768,15 +763,6 @@
     phNxpNciHal_clean_P2P_Prio();
   }
 #endif
-  /* Specific logic to block RF disable when Kovio detection logic is active */
-  if (p_data[0] == 0x21 && p_data[1] == 0x06 && p_data[2] == 0x01) {
-    rf_deactive_cmd = true;
-    if (kovio_detected == true) {
-      NXPLOG_NCIHAL_D(
-          "Kovio detection logic is active: Set Flag to disable it.");
-      disable_kovio = 0x01;
-    }
-  }
 
   /* Check for NXP ext before sending write */
   status =
@@ -982,7 +968,7 @@
     }
     /* Read successful send the event to higher layer */
     else if ((nxpncihal_ctrl.p_nfc_stack_data_cback != NULL) &&
-             (status == NFCSTATUS_SUCCESS) && (send_to_upper_kovio == 1)) {
+             (status == NFCSTATUS_SUCCESS)) {
       (*nxpncihal_ctrl.p_nfc_stack_data_cback)(nxpncihal_ctrl.rx_data_len,
                                                nxpncihal_ctrl.p_rx_data);
     }
@@ -2634,7 +2620,7 @@
     retry_core_init_cnt++;
     goto retry_core_init;
   }
-  if (nxpncihal_ctrl.nci_data.nci_version == NCI_VERSION_2_0) {
+  if (nxpncihal_ctrl.nci_info.nci_version == NCI_VERSION_2_0) {
     status = phNxpNciHal_send_ext_cmd(sizeof(cmd_init_nci2_0), cmd_init_nci2_0);
   } else {
     status = phNxpNciHal_send_ext_cmd(sizeof(cmd_init_nci), cmd_init_nci);
diff --git a/halimpl/pn54x/hal/phNxpNciHal_Kovio.c b/halimpl/pn54x/hal/phNxpNciHal_Kovio.c
deleted file mode 100644
index f239fcc..0000000
--- a/halimpl/pn54x/hal/phNxpNciHal_Kovio.c
+++ /dev/null
@@ -1,242 +0,0 @@
-/*
- * Copyright (C) 2012-2014 NXP Semiconductors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <phNxpLog.h>
-#include <phNxpNciHal_Kovio.h>
-
-/* Timeout value to wait for RF INTF Activated NTF.*/
-#define KOVIO_TIMEOUT 1000
-#define KOVIO_ACT_NTF_TEMP_BUFF_LEN         \
-  64 /* length of temp buffer to manipulate \
-the activated notification to match BCM format*/
-#define MAX_WRITE_RETRY 5
-
-/******************* Global variables *****************************************/
-extern phNxpNciHal_Control_t nxpncihal_ctrl;
-extern NFCSTATUS phNxpNciHal_send_ext_cmd(uint16_t cmd_len, uint8_t* p_cmd);
-
-int kovio_detected = 0x00;
-int send_to_upper_kovio = 0x01;
-int disable_kovio = 0x00;
-bool_t rf_deactive_cmd = false;
-static uint8_t rf_deactivate_cmd[] = {0x21, 0x06, 0x01, 0x03}; /* discovery */
-static uint8_t rf_deactivated_ntf[] = {0x61, 0x06, 0x02, 0x03, 0x01};
-static uint8_t reset_ntf[] = {0x60, 0x00, 0x06, 0xA0, 0x00,
-                              0xC7, 0xD4, 0x00, 0x00};
-
-static uint32_t kovio_timer;
-
-/************** Kovio functions ***************************************/
-
-static NFCSTATUS phNxpNciHal_rf_deactivate(void);
-
-/*******************************************************************************
-**
-** Function         hal_write_cb
-**
-** Description      Callback function for hal write.
-**
-** Returns          None
-**
-*******************************************************************************/
-static void hal_write_cb(void* pContext, phTmlNfc_TransactInfo_t* pInfo) {
-  UNUSED(pContext);
-  UNUSED(pInfo);
-  return;
-}
-
-/*******************************************************************************
-**
-** Function         kovio_timer_handler
-**
-** Description      Callback function for kovio timer.
-**
-** Returns          None
-**
-*******************************************************************************/
-static void kovio_timer_handler(uint32_t timerId, void* pContext) {
-  UNUSED(timerId);
-  UNUSED(pContext);
-  NXPLOG_NCIHAL_D(
-      ">> kovio_timer_handler. Did not receive RF_INTF_ACTIVATED_NTF, Kovio "
-      "TAG must be removed.");
-
-  phOsalNfc_Timer_Delete(kovio_timer);
-
-  kovio_detected = 0x00;
-  send_to_upper_kovio = 0x01;
-  disable_kovio = 0x00;
-  /*
-   * send kovio deactivated ntf to upper layer.
-  */
-  NXPLOG_NCIHAL_D(">> send kovio deactivated ntf to upper layer.");
-  if (nxpncihal_ctrl.p_nfc_stack_data_cback != NULL) {
-    (*nxpncihal_ctrl.p_nfc_stack_data_cback)(sizeof(rf_deactivated_ntf),
-                                             rf_deactivated_ntf);
-  }
-  return;
-}
-
-/*******************************************************************************
-**
-** Function         phNxpNciHal_rf_deactivate
-**
-** Description      Sends rf deactivate cmd to NFCC
-**
-** Returns          NFCSTATUS_SUCCESS if successful,otherwise NFCSTATUS_FAILED
-**
-*******************************************************************************/
-static NFCSTATUS phNxpNciHal_rf_deactivate() {
-  NFCSTATUS status = NFCSTATUS_SUCCESS;
-  int cb_data;
-  int retryCnt = 0;
-
-  do {
-    retryCnt++;
-    status = phTmlNfc_Write(rf_deactivate_cmd, sizeof(rf_deactivate_cmd),
-                            (pphTmlNfc_TransactCompletionCb_t)&hal_write_cb,
-                            &cb_data);
-  } while (status != NFCSTATUS_PENDING && retryCnt <= MAX_WRITE_RETRY);
-
-  if (status != NFCSTATUS_PENDING) {
-    // phNxpNciHal_emergency_recovery();
-    if (nxpncihal_ctrl.p_nfc_stack_data_cback != NULL &&
-        nxpncihal_ctrl.hal_open_status == true) {
-      NXPLOG_NCIHAL_D(
-          "Send the Core Reset NTF to upper layer, which will trigger the "
-          "recovery\n");
-      // Send the Core Reset NTF to upper layer, which will trigger the
-      // recovery.
-      send_to_upper_kovio = 0;
-      nxpncihal_ctrl.rx_data_len = sizeof(reset_ntf);
-      memcpy(nxpncihal_ctrl.p_rx_data, reset_ntf, sizeof(reset_ntf));
-      (*nxpncihal_ctrl.p_nfc_stack_data_cback)(nxpncihal_ctrl.rx_data_len,
-                                               nxpncihal_ctrl.p_rx_data);
-    }
-  }
-
-  return status;
-}
-
-/*******************************************************************************
-**
-** Function         phNxpNciHal_kovio_rsp_ext
-**
-** Description      Implements kovio presence check. In BCM controller this is
-**                  managed by NFCC. But since PN54X does not handle this, the
-**                  presence check is mimiced here.
-**                  For the very first time Kovio is detected, NTF has to be
-**                  passed on to upper layer. for every NTF, DH send a
-**                  deactivated command to NFCC and NFCC follows this up with
-**                  another activated notification. When the tag is removed,
-**                  activated notification stops coming and this is indicated to
-**                  upper layer with a HAL generated deactivated notification.
-**
-** Returns          NFCSTATUS_SUCCESS if successful,otherwise NFCSTATUS_FAILED
-**
-*******************************************************************************/
-NFCSTATUS phNxpNciHal_kovio_rsp_ext(uint8_t* p_ntf, uint16_t* p_len) {
-  NFCSTATUS status = NFCSTATUS_SUCCESS;
-  uint8_t tBuff[KOVIO_ACT_NTF_TEMP_BUFF_LEN];
-
-  send_to_upper_kovio = 1;
-  if ((p_ntf[0] == 0x61) && (p_ntf[1] == 0x05)) {
-#if (NFC_NXP_CHIP_TYPE != PN547C2)
-    if ((p_ntf[5] == 0x81) && (p_ntf[6] == 0x70))
-#else
-    if ((p_ntf[5] == 0x8A) && (p_ntf[6] == 0x77))
-#endif
-    {
-      if (kovio_detected == 0) {
-        if ((*p_len - 9) < KOVIO_ACT_NTF_TEMP_BUFF_LEN) {
-          p_ntf[2] += 1;
-          memcpy(tBuff, &p_ntf[9], *p_len - 9);
-          p_ntf[9] = p_ntf[9] + 1;
-          memcpy(&p_ntf[10], tBuff, *p_len - 9);
-          *p_len += 1;
-        } else {
-          NXPLOG_NCIHAL_D("Kovio Act ntf payload exceeded temp buffer size");
-        }
-        kovio_detected = 1;
-        kovio_timer = phOsalNfc_Timer_Create();
-        NXPLOG_NCIHAL_D("custom kovio timer Created - %d", kovio_timer);
-      } else {
-        send_to_upper_kovio = 0;
-      }
-
-      if (!rf_deactive_cmd) {
-        NXPLOG_NCIHAL_D("Send RF deactivate command to NFCC");
-        status = phNxpNciHal_rf_deactivate();
-      } else {
-        NXPLOG_NCIHAL_D("RF deactivate command is already sent to NFCC");
-        disable_kovio = true;
-        send_to_upper_kovio = 0;
-      }
-      status = phOsalNfc_Timer_Start(kovio_timer, KOVIO_TIMEOUT,
-                                     &kovio_timer_handler, NULL);
-      if (NFCSTATUS_SUCCESS == status) {
-        NXPLOG_NCIHAL_D("kovio timer started");
-      } else {
-        NXPLOG_NCIHAL_E("kovio timer not started!!!");
-        status = NFCSTATUS_FAILED;
-      }
-    } else {
-      if (kovio_detected == 1) {
-        phNxpNciHal_clean_Kovio_Ext();
-        NXPLOG_NCIHAL_D(
-            "Disabling Kovio detection logic as another tag type detected");
-      }
-    }
-  } else if ((p_ntf[0] == 0x41) && (p_ntf[1] == 0x06) && (p_ntf[2] == 0x01)) {
-    rf_deactive_cmd = false;
-    if (kovio_detected == 1) send_to_upper_kovio = 0;
-    if ((kovio_detected == 1) && (disable_kovio == 0x01)) {
-      NXPLOG_NCIHAL_D("Disabling Kovio detection logic");
-      phNxpNciHal_clean_Kovio_Ext();
-      disable_kovio = 0x00;
-    }
-  } else if ((p_ntf[0] == 0x61) && (p_ntf[1] == 0x06) && (p_ntf[2] == 0x02) &&
-             (p_ntf[3] == 0x03) && (p_ntf[4] == 0x00)) {
-    if (kovio_detected == 1) send_to_upper_kovio = 0;
-  } else if ((p_ntf[0] == 0x61) && (p_ntf[1] == 0x03)) {
-    if (kovio_detected == 1) send_to_upper_kovio = 0;
-  }
-  return status;
-}
-/*******************************************************************************
-**
-** Function         phNxpNciHal_clean_Kovio_Ext
-**
-** Description      Clean up Kovio extension state machine.
-** Returns          NFCSTATUS_SUCCESS if successful,otherwise NFCSTATUS_FAILED
-**
-*******************************************************************************/
-void phNxpNciHal_clean_Kovio_Ext() {
-  NXPLOG_NCIHAL_D(">> Cleaning up Kovio State machine and timer.");
-  phOsalNfc_Timer_Delete(kovio_timer);
-  kovio_detected = 0x00;
-  send_to_upper_kovio = 0x01;
-  disable_kovio = 0x00;
-  /*
-   * send kovio deactivated ntf to upper layer.
-  */
-  NXPLOG_NCIHAL_D(">> send kovio deactivated ntf to upper layer.");
-  if (nxpncihal_ctrl.p_nfc_stack_data_cback != NULL) {
-    (*nxpncihal_ctrl.p_nfc_stack_data_cback)(sizeof(rf_deactivated_ntf),
-                                             rf_deactivated_ntf);
-  }
-  return;
-}
diff --git a/halimpl/pn54x/hal/phNxpNciHal_Kovio.h b/halimpl/pn54x/hal/phNxpNciHal_Kovio.h
deleted file mode 100644
index dbb0ce7..0000000
--- a/halimpl/pn54x/hal/phNxpNciHal_Kovio.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012-2014 NXP Semiconductors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef _PHNXPNCIHAL_KOVIO_H_
-#define _PHNXPNCIHAL_KOVIO_H_
-
-#include <phNxpNciHal.h>
-#include <phTmlNfc.h>
-#include <string.h>
-
-extern NFCSTATUS phNxpNciHal_kovio_rsp_ext(uint8_t* p_ntf, uint16_t* p_len);
-extern void phNxpNciHal_clean_Kovio_Ext();
-
-#endif /* _PHNXPNCIHAL_KOVIO_H_ */
diff --git a/halimpl/pn54x/hal/phNxpNciHal_ext.c b/halimpl/pn54x/hal/phNxpNciHal_ext.c
index 21d39ce..864f9ae 100644
--- a/halimpl/pn54x/hal/phNxpNciHal_ext.c
+++ b/halimpl/pn54x/hal/phNxpNciHal_ext.c
@@ -18,7 +18,6 @@
 #include <phNxpConfig.h>
 #include <phNxpLog.h>
 #include <phNxpNciHal.h>
-#include <phNxpNciHal_Kovio.h>
 #include <phNxpNciHal_NfcDepSWPrio.h>
 #include <phNxpNciHal_ext.h>
 #include <phTmlNfc.h>
@@ -32,9 +31,6 @@
 extern phNxpNciHal_Control_t nxpncihal_ctrl;
 extern phNxpNciProfile_Control_t nxpprofile_ctrl;
 
-extern int kovio_detected;
-extern int disable_kovio;
-extern int send_to_upper_kovio;
 extern uint32_t cleanup_timer;
 uint8_t icode_detected = 0x00;
 uint8_t icode_send_eof = 0x00;
@@ -90,9 +86,6 @@
   icode_detected = 0x00;
   icode_send_eof = 0x00;
   setEEModeDone = 0x00;
-  kovio_detected = 0x00;
-  disable_kovio = 0x00;
-  send_to_upper_kovio = 0x01;
   EnableP2P_PrioLogic = false;
 }
 
@@ -142,8 +135,7 @@
 
   NXPLOG_NCIHAL_D("Is EnableP2P_PrioLogic: 0x0%X", EnableP2P_PrioLogic);
   if (phNxpDta_IsEnable() == false) {
-    if ((icode_detected != 1) && (kovio_detected != 1) &&
-        (EnableP2P_PrioLogic == true)) {
+    if ((icode_detected != 1) && (EnableP2P_PrioLogic == true)) {
       if (phNxpNciHal_NfcDep_comapre_ntf(p_ntf, *p_len) == NFCSTATUS_FAILED) {
         status = phNxpNciHal_NfcDep_rsp_ext(p_ntf, p_len);
         if (status != NFCSTATUS_INVALID_PARAMETER) {
@@ -155,7 +147,6 @@
 #endif
 
   status = NFCSTATUS_SUCCESS;
-  status = phNxpNciHal_kovio_rsp_ext(p_ntf, p_len);
 
   if (p_ntf[0] == 0x61 && p_ntf[1] == 0x05) {
 #if (NFC_NXP_CHIP_TYPE == PN548C2)
diff --git a/halimpl/pn54x/log/phNxpLog.c b/halimpl/pn54x/log/phNxpLog.c
index 4b3661c..49d6911 100644
--- a/halimpl/pn54x/log/phNxpLog.c
+++ b/halimpl/pn54x/log/phNxpLog.c
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <stdio.h>
 #include <string.h>
 #if !defined(NXPLOG__H_INCLUDED)
 #include "phNxpConfig.h"
diff --git a/halimpl/pn54x/log/phNxpLog.h b/halimpl/pn54x/log/phNxpLog.h
index c2e1d33..5037a4c 100644
--- a/halimpl/pn54x/log/phNxpLog.h
+++ b/halimpl/pn54x/log/phNxpLog.h
@@ -17,7 +17,7 @@
 #if !defined(NXPLOG__H_INCLUDED)
 #define NXPLOG__H_INCLUDED
 
-#include <cutils/log.h>
+#include <log/log.h>
 
 typedef struct nci_log_level {
   uint8_t global_log_level;
diff --git a/src/adaptation/CrcChecksum.cpp b/src/adaptation/CrcChecksum.cpp
index 4ac7089..af20f6e 100644
--- a/src/adaptation/CrcChecksum.cpp
+++ b/src/adaptation/CrcChecksum.cpp
@@ -20,6 +20,7 @@
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
+#include <unistd.h>
 #include <string>
 #include "_OverrideLog.h"
 
diff --git a/src/gki/common/gki.h b/src/gki/common/gki.h
index 465cd59..1458e32 100644
--- a/src/gki/common/gki.h
+++ b/src/gki/common/gki.h
@@ -29,9 +29,6 @@
 #include "bt_types.h"
 #include "gki_target.h"
 
-/* Uncomment this line for verbose GKI debugging and buffer tracking */
-#define GKI_BUFFER_DEBUG FALSE
-
 /* Error codes */
 #define GKI_SUCCESS 0x00
 #define GKI_FAILURE 0x01
@@ -389,19 +386,9 @@
 extern void GKI_delete_pool(uint8_t);
 extern void* GKI_find_buf_start(void*);
 extern void GKI_freebuf(void*);
-#if (GKI_BUFFER_DEBUG == TRUE)
-#define GKI_getbuf(size) GKI_getbuf_debug(size, __func__, __LINE__)
-extern void* GKI_getbuf_debug(uint16_t, const char*, int);
-#else
 extern void* GKI_getbuf(uint16_t);
-#endif
 extern uint16_t GKI_get_buf_size(void*);
-#if (GKI_BUFFER_DEBUG == TRUE)
-#define GKI_getpoolbuf(id) GKI_getpoolbuf_debug(id, __func__, __LINE__)
-extern void* GKI_getpoolbuf_debug(uint8_t, const char*, int);
-#else
 extern void* GKI_getpoolbuf(uint8_t);
-#endif
 
 extern uint16_t GKI_poolcount(uint8_t);
 extern uint16_t GKI_poolfreecount(uint8_t);
@@ -469,15 +456,6 @@
 */
 extern void GKI_exception(uint16_t, char*);
 
-#if (GKI_DEBUG == TRUE)
-extern void GKI_PrintBufferUsage(uint8_t* p_num_pools, uint16_t* p_cur_used);
-extern void GKI_PrintBuffer(void);
-extern void GKI_print_task(void);
-#else
-#undef GKI_PrintBufferUsage
-#define GKI_PrintBuffer() NULL
-#endif
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/gki/common/gki_buffer.c b/src/gki/common/gki_buffer.c
index d83b389..3f95093 100644
--- a/src/gki/common/gki_buffer.c
+++ b/src/gki/common/gki_buffer.c
@@ -27,15 +27,6 @@
 static void gki_remove_from_pool_list(uint8_t pool_id);
 #endif /*  BTU_STACK_LITE_ENABLED == FALSE */
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-#define LOG_TAG "GKI_DEBUG"
-#include <android/log.h>
-#include <cutils/log.h>
-#define LOGD(format, ...)                                       \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         format, ##__VA_ARGS__)
-#endif
 /*******************************************************************************
 **
 ** Function         gki_init_free_queue
@@ -73,13 +64,6 @@
   p_cb->freeq[id].cur_cnt = 0;
   p_cb->freeq[id].max_cnt = 0;
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-  LOGD(
-      "gki_init_free_queue() init pool=%d, size=%d (aligned=%d) total=%d "
-      "start=%p",
-      id, size, tempsize, total, p_mem);
-#endif
-
   /* Initialize  index table */
   if (p_mem) {
     hdr = (BUFFER_HDR_T*)p_mem;
@@ -101,13 +85,9 @@
   return;
 }
 
-#if (GKI_USE_DEFERED_ALLOC_BUF_POOLS == TRUE)
 static bool gki_alloc_free_queue(uint8_t id) {
   FREE_QUEUE_T* Q;
   tGKI_COM_CB* p_cb = &gki_cb.com;
-#if GKI_BUFFER_DEBUG
-  ALOGD("\ngki_alloc_free_queue in, id:%d \n", id);
-#endif
 
   Q = &p_cb->freeq[p_cb->pool_list[id]];
 
@@ -115,28 +95,14 @@
     void* p_mem = GKI_os_malloc((Q->size + BUFFER_PADDING_SIZE) * Q->total);
     if (p_mem) {
 // re-initialize the queue with allocated memory
-#if GKI_BUFFER_DEBUG
-      ALOGD(
-          "\ngki_alloc_free_queue calling  gki_init_free_queue, id:%d  "
-          "size:%d, totol:%d\n",
-          id, Q->size, Q->total);
-#endif
       gki_init_free_queue(id, Q->size, Q->total, p_mem);
-#if GKI_BUFFER_DEBUG
-      ALOGD("\ngki_alloc_free_queue ret OK, id:%d  size:%d, totol:%d\n", id,
-            Q->size, Q->total);
-#endif
       return true;
     }
     GKI_exception(GKI_ERROR_BUF_SIZE_TOOBIG,
                   "gki_alloc_free_queue: Not enough memory");
   }
-#if GKI_BUFFER_DEBUG
-  ALOGD("\ngki_alloc_free_queue out failed, id:%d\n", id);
-#endif
   return false;
 }
-#endif
 
 /*******************************************************************************
 **
@@ -176,91 +142,6 @@
   /* Use default from target.h */
   p_cb->pool_access_mask = GKI_DEF_BUFPOOL_PERM_MASK;
 
-#if (GKI_USE_DEFERED_ALLOC_BUF_POOLS == FALSE && \
-     GKI_USE_DYNAMIC_BUFFERS == TRUE)
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 0)
-  p_cb->bufpool0 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF0_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF0_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 1)
-  p_cb->bufpool1 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF1_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF1_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 2)
-  p_cb->bufpool2 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF2_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF2_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 3)
-  p_cb->bufpool3 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF3_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF3_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 4)
-  p_cb->bufpool4 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF4_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF4_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 5)
-  p_cb->bufpool5 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF5_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF5_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 6)
-  p_cb->bufpool6 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF6_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF6_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 7)
-  p_cb->bufpool7 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF7_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF7_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 8)
-  p_cb->bufpool8 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF8_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF8_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 9)
-  p_cb->bufpool9 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF9_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF9_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 10)
-  p_cb->bufpool10 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF10_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF10_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 11)
-  p_cb->bufpool11 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF11_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF11_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 12)
-  p_cb->bufpool12 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF12_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF12_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 13)
-  p_cb->bufpool13 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF13_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF13_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 14)
-  p_cb->bufpool14 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF14_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF14_MAX);
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 15)
-  p_cb->bufpool15 = (uint8_t*)GKI_os_malloc(
-      (GKI_BUF15_SIZE + BUFFER_PADDING_SIZE) * GKI_BUF15_MAX);
-#endif
-
-#endif
-
 #if (GKI_NUM_FIXED_BUF_POOLS > 0)
   gki_init_free_queue(0, GKI_BUF0_SIZE, GKI_BUF0_MAX, p_cb->bufpool0);
 #endif
@@ -367,28 +248,18 @@
 ** Returns          A pointer to the buffer, or NULL if none available
 **
 *******************************************************************************/
-#if (GKI_BUFFER_DEBUG == TRUE)
-void* GKI_getbuf_debug(uint16_t size, const char* _function_, int _line_)
-#else
 void* GKI_getbuf(uint16_t size)
-#endif
 {
   uint8_t i;
   FREE_QUEUE_T* Q;
   BUFFER_HDR_T* p_hdr;
   tGKI_COM_CB* p_cb = &gki_cb.com;
-#if (GKI_BUFFER_DEBUG == TRUE)
-  uint8_t x;
-#endif
 
   if (size == 0) {
     GKI_exception(GKI_ERROR_BUF_SIZE_ZERO, "getbuf: Size is zero");
     return (NULL);
   }
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-  LOGD("GKI_getbuf() requesting %d func:%s(line=%d)", size, _function_, _line_);
-#endif
   /* Find the first buffer pool that is public that can hold the desired size */
   for (i = 0; i < p_cb->curr_total_no_of_pools; i++) {
     if (size <= p_cb->freeq[p_cb->pool_list[i]].size) break;
@@ -410,13 +281,11 @@
 
     Q = &p_cb->freeq[p_cb->pool_list[i]];
     if (Q->cur_cnt < Q->total) {
-#if (GKI_USE_DEFERED_ALLOC_BUF_POOLS == TRUE)
       if (Q->p_first == 0 && gki_alloc_free_queue(i) != true) {
         GKI_TRACE_ERROR_0("GKI_getbuf() out of buffer");
         GKI_enable();
         return NULL;
       }
-#endif
 
       if (Q->p_first == 0) {
         /* gki_alloc_free_queue() failed to alloc memory */
@@ -439,48 +308,11 @@
       p_hdr->status = BUF_STATUS_UNLINKED;
       p_hdr->p_next = NULL;
       p_hdr->Type = 0;
-#if (GKI_BUFFER_DEBUG == TRUE)
-      LOGD("GKI_getbuf() allocated, %x, %x (%d of %d used) %d",
-           (uint8_t*)p_hdr + BUFFER_HDR_SIZE, p_hdr, Q->cur_cnt, Q->total,
-           p_cb->freeq[i].total);
-
-      strncpy(p_hdr->_function, _function_, _GKI_MAX_FUNCTION_NAME_LEN);
-      p_hdr->_function[_GKI_MAX_FUNCTION_NAME_LEN] = '\0';
-      p_hdr->_line = _line_;
-#endif
       return ((void*)((uint8_t*)p_hdr + BUFFER_HDR_SIZE));
     }
   }
 
   GKI_TRACE_ERROR_0("GKI_getbuf() unable to allocate buffer!!!!!");
-#if (GKI_BUFFER_DEBUG == TRUE)
-  LOGD("GKI_getbuf() unable to allocate buffer!!!!!");
-  LOGD("******************** GKI Memory Pool Dump ********************");
-
-  p_cb = &gki_cb.com;
-
-  LOGD("Dumping total of %d buffer pools", p_cb->curr_total_no_of_pools);
-
-  for (i = 0; i < p_cb->curr_total_no_of_pools; i++) {
-    p_hdr = (BUFFER_HDR_T*)p_cb->pool_start[i];
-
-    LOGD("pool %d has a total of %d buffers (start=%p)", i,
-         p_cb->freeq[i].total, p_hdr);
-
-    for (x = 0; p_hdr && x < p_cb->freeq[i].total; x++) {
-      if (p_hdr->status != BUF_STATUS_FREE) {
-        LOGD("pool:%d, buf[%d]:%x, hdr:%x status=%d func:%s(line=%d)", i, x,
-             (uint8_t*)p_hdr + BUFFER_HDR_SIZE, p_hdr, p_hdr->status,
-             p_hdr->_function, p_hdr->_line);
-      }
-
-      p_hdr = (BUFFER_HDR_T*)((uint8_t*)p_hdr + p_cb->pool_size[i]);
-    }
-  }
-  LOGD("**************************************************************");
-#endif
-
-  GKI_TRACE_ERROR_0("Failed to allocate GKI buffer");
 
   GKI_enable();
 
@@ -503,11 +335,7 @@
 ** Returns          A pointer to the buffer, or NULL if none available
 **
 *******************************************************************************/
-#if (GKI_BUFFER_DEBUG == TRUE)
-void* GKI_getpoolbuf_debug(uint8_t pool_id, const char* _function_, int _line_)
-#else
 void* GKI_getpoolbuf(uint8_t pool_id)
-#endif
 {
   FREE_QUEUE_T* Q;
   BUFFER_HDR_T* p_hdr;
@@ -515,18 +343,12 @@
 
   if (pool_id >= GKI_NUM_TOTAL_BUF_POOLS) return (NULL);
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-  LOGD("GKI_getpoolbuf() requesting from %d func:%s(line=%d)", pool_id,
-       _function_, _line_);
-#endif
   /* Make sure the buffers aren't disturbed til finished with allocation */
   GKI_disable();
 
   Q = &p_cb->freeq[pool_id];
   if (Q->cur_cnt < Q->total) {
-#if (GKI_USE_DEFERED_ALLOC_BUF_POOLS == TRUE)
     if (Q->p_first == 0 && gki_alloc_free_queue(pool_id) != true) return NULL;
-#endif
 
     if (Q->p_first == 0) {
       /* gki_alloc_free_queue() failed to alloc memory */
@@ -549,28 +371,14 @@
     p_hdr->p_next = NULL;
     p_hdr->Type = 0;
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-    LOGD("GKI_getpoolbuf() allocated, %x, %x (%d of %d used) %d",
-         (uint8_t*)p_hdr + BUFFER_HDR_SIZE, p_hdr, Q->cur_cnt, Q->total,
-         p_cb->freeq[pool_id].total);
-
-    strncpy(p_hdr->_function, _function_, _GKI_MAX_FUNCTION_NAME_LEN);
-    p_hdr->_function[_GKI_MAX_FUNCTION_NAME_LEN] = '\0';
-    p_hdr->_line = _line_;
-#endif
     return ((void*)((uint8_t*)p_hdr + BUFFER_HDR_SIZE));
   }
 
   /* If here, no buffers in the specified pool */
   GKI_enable();
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-  /* try for free buffers in public pools */
-  return (GKI_getbuf_debug(p_cb->freeq[pool_id].size, _function_, _line_));
-#else
   /* try for free buffers in public pools */
   return (GKI_getbuf(p_cb->freeq[pool_id].size));
-#endif
 }
 
 /*******************************************************************************
@@ -598,11 +406,6 @@
 
   p_hdr = (BUFFER_HDR_T*)((uint8_t*)p_buf - BUFFER_HDR_SIZE);
 
-#if (GKI_BUFFER_DEBUG == TRUE)
-  LOGD("GKI_freebuf() freeing, %x, %x, func:%s(line=%d)", p_buf, p_hdr,
-       p_hdr->_function, p_hdr->_line);
-#endif
-
   if (p_hdr->status != BUF_STATUS_UNLINKED) {
     GKI_exception(GKI_ERROR_FREEBUF_BUF_LINKED, "Freeing Linked Buf");
     return;
diff --git a/src/gki/common/gki_common.h b/src/gki/common/gki_common.h
index f44e292..8f0cc7a 100644
--- a/src/gki/common/gki_common.h
+++ b/src/gki/common/gki_common.h
@@ -20,10 +20,6 @@
 
 #include "gki.h"
 
-#ifndef GKI_DEBUG
-#define GKI_DEBUG FALSE
-#endif
-
 /* Task States: (For OSRdyTbl) */
 #define TASK_DEAD 0    /* b0000 */
 #define TASK_READY 1   /* b0001 */
@@ -63,14 +59,6 @@
   uint8_t task_id;            /* task which allocated the buffer*/
   uint8_t status;             /* FREE, UNLINKED or QUEUED */
   uint8_t Type;
-
-#if (GKI_BUFFER_DEBUG == TRUE)
-/* for tracking who allocated the buffer */
-#define _GKI_MAX_FUNCTION_NAME_LEN (50)
-  char _function[_GKI_MAX_FUNCTION_NAME_LEN + 1];
-  int _line;
-#endif
-
 } BUFFER_HDR_T;
 
 typedef struct _free_queue {
@@ -98,18 +86,6 @@
 #define BUF_STATUS_UNLINKED 1
 #define BUF_STATUS_QUEUED 2
 
-#define GKI_USE_DEFERED_ALLOC_BUF_POOLS TRUE
-
-/* Exception related structures (Used in debug mode only)
-*/
-#if (GKI_DEBUG == TRUE)
-typedef struct {
-  uint16_t type;
-  uint8_t taskid;
-  uint8_t msg[GKI_MAX_EXCEPTION_MSGLEN];
-} EXCEPTION_T;
-#endif
-
 /* Put all GKI variables into one control block
 */
 typedef struct {
@@ -117,7 +93,6 @@
 */
 /* The stack and stack size are not used on Windows
 */
-#if (GKI_USE_DYNAMIC_BUFFERS == FALSE)
 
 #if (GKI_NUM_FIXED_BUF_POOLS > 0)
   uint8_t bufpool0[(ALIGN_POOL(GKI_BUF0_SIZE) + BUFFER_PADDING_SIZE) *
@@ -199,74 +174,6 @@
                     GKI_BUF15_MAX];
 #endif
 
-#else
-/* Definitions for dynamic buffer use */
-#if (GKI_NUM_FIXED_BUF_POOLS > 0)
-  uint8_t* bufpool0;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 1)
-  uint8_t* bufpool1;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 2)
-  uint8_t* bufpool2;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 3)
-  uint8_t* bufpool3;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 4)
-  uint8_t* bufpool4;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 5)
-  uint8_t* bufpool5;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 6)
-  uint8_t* bufpool6;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 7)
-  uint8_t* bufpool7;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 8)
-  uint8_t* bufpool8;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 9)
-  uint8_t* bufpool9;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 10)
-  uint8_t* bufpool10;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 11)
-  uint8_t* bufpool11;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 12)
-  uint8_t* bufpool12;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 13)
-  uint8_t* bufpool13;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 14)
-  uint8_t* bufpool14;
-#endif
-
-#if (GKI_NUM_FIXED_BUF_POOLS > 15)
-  uint8_t* bufpool15;
-#endif
-
-#endif
-
   uint8_t* OSStack[GKI_MAX_TASKS];     /* pointer to beginning of stack */
   uint16_t OSStackSize[GKI_MAX_TASKS]; /* stack size available to each task */
 
@@ -366,11 +273,6 @@
   bool system_tick_running; /* TRUE if system tick is running. Valid only if
                                p_tick_cb is not NULL */
 
-#if (GKI_DEBUG == TRUE)
-  uint16_t ExceptionCnt; /* number of GKI exceptions that have happened */
-  EXCEPTION_T Exception[GKI_MAX_EXCEPTION];
-#endif
-
 } tGKI_COM_CB;
 
 #ifdef __cplusplus
@@ -392,26 +294,6 @@
 extern void OSIntEnter(void);
 extern void OSIntExit(void);
 
-/* Debug aids
-*/
-typedef void (*FP_PRINT)(char*, ...);
-
-#if (GKI_DEBUG == TRUE)
-
-typedef void (*PKT_PRINT)(uint8_t*, uint16_t);
-
-extern void gki_print_task(FP_PRINT);
-extern void gki_print_exception(FP_PRINT);
-extern void gki_print_timer(FP_PRINT);
-extern void gki_print_stack(FP_PRINT);
-extern void gki_print_buffer(FP_PRINT);
-extern void gki_print_buffer_statistics(FP_PRINT, int16_t);
-extern void gki_print_used_bufs(FP_PRINT, uint8_t);
-extern void gki_dump(uint8_t*, uint16_t, FP_PRINT);
-extern void gki_dump2(uint16_t*, uint16_t, FP_PRINT);
-extern void gki_dump4(uint32_t*, uint16_t, FP_PRINT);
-
-#endif
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/gki/common/gki_debug.c b/src/gki/common/gki_debug.c
deleted file mode 100644
index 16627c5..0000000
--- a/src/gki/common/gki_debug.c
+++ /dev/null
@@ -1,308 +0,0 @@
-/******************************************************************************
- *
- *  Copyright (C) 1999-2012 Broadcom Corporation
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-#include "gki_int.h"
-
-#if (GKI_DEBUG == TRUE)
-
-const int8_t* const OSTaskStates[] = {
-    (int8_t*)"DEAD",                                                /* 0 */
-    (int8_t*)"REDY",                                                /* 1 */
-    (int8_t*)"WAIT",                                                /* 2 */
-    (int8_t*)"",     (int8_t*)"DELY",                               /* 4 */
-    (int8_t*)"",     (int8_t*)"",     (int8_t*)"", (int8_t*)"SUSP", /* 8 */
-};
-
-/*******************************************************************************
-**
-** Function         GKI_PrintBufferUsage
-**
-** Description      Displays Current Buffer Pool summary
-**
-** Returns          void
-**
-*******************************************************************************/
-void GKI_PrintBufferUsage(uint8_t* p_num_pools, uint16_t* p_cur_used) {
-  int i;
-  FREE_QUEUE_T* p;
-  uint8_t num = gki_cb.com.curr_total_no_of_pools;
-  uint16_t cur[GKI_NUM_TOTAL_BUF_POOLS];
-
-  GKI_TRACE_0("");
-  GKI_TRACE_0("--- GKI Buffer Pool Summary (R - restricted, P - public) ---");
-
-  GKI_TRACE_0("POOL     SIZE  USED  MAXU  TOTAL");
-  GKI_TRACE_0("------------------------------");
-  for (i = 0; i < gki_cb.com.curr_total_no_of_pools; i++) {
-    p = &gki_cb.com.freeq[i];
-    if ((1 << i) & gki_cb.com.pool_access_mask) {
-      GKI_TRACE_5("%02d: (R), %4d, %3d, %3d, %3d", i, p->size, p->cur_cnt,
-                  p->max_cnt, p->total);
-    } else {
-      GKI_TRACE_5("%02d: (P), %4d, %3d, %3d, %3d", i, p->size, p->cur_cnt,
-                  p->max_cnt, p->total);
-    }
-    cur[i] = p->cur_cnt;
-  }
-  if (p_num_pools) *p_num_pools = num;
-  if (p_cur_used) memcpy(p_cur_used, cur, num * 2);
-}
-
-/*******************************************************************************
-**
-** Function         GKI_PrintBuffer
-**
-** Description      Called internally by OSS to print the buffer pools
-**
-** Returns          void
-**
-*******************************************************************************/
-void GKI_PrintBuffer(void) {
-  uint16_t i;
-  for (i = 0; i < GKI_NUM_TOTAL_BUF_POOLS; i++) {
-    GKI_TRACE_5("pool:%4u free %4u cur %3u max %3u  total%3u", i,
-                gki_cb.com.freeq[i].size, gki_cb.com.freeq[i].cur_cnt,
-                gki_cb.com.freeq[i].max_cnt, gki_cb.com.freeq[i].total);
-  }
-}
-
-/*******************************************************************************
-**
-** Function         gki_calc_stack
-**
-** Description      This function tries to calculate the amount of
-**                  stack used by looking non magic num. Magic num is consider
-**                  the first byte in the stack.
-**
-** Returns          the number of unused byte on the stack. 4 in case of stack
-**                  overrun
-**
-*******************************************************************************/
-uint16_t gki_calc_stack(uint8_t task) {
-  int j, stacksize;
-  uint32_t MagicNum;
-  uint32_t* p;
-
-  stacksize = (int)gki_cb.com.OSStackSize[task];
-  p = (uint32_t*)gki_cb.com.OSStack[task]; /* assume stack is aligned, */
-  MagicNum = *p;
-
-  for (j = 0; j < stacksize; j++) {
-    if (*p++ != MagicNum) break;
-  }
-
-  return (j * sizeof(uint32_t));
-}
-
-/*******************************************************************************
-**
-** Function         GKI_print_task
-**
-** Description      Print task stack usage.
-**
-** Returns          void
-**
-*******************************************************************************/
-void GKI_print_task(void) {
-#ifdef _BT_WIN32
-  GKI_TRACE_0("Service not available under insight");
-#else
-  uint8_t TaskId;
-
-  GKI_TRACE_0("TID TASKNAME STATE FREE_STACK  STACK");
-  for (TaskId = 0; TaskId < GKI_MAX_TASKS; TaskId++) {
-    if (gki_cb.com.OSRdyTbl[TaskId] != TASK_DEAD) {
-      GKI_TRACE_5("%2u   %-8s %-5s  0x%04X     0x%04X Bytes", (uint16_t)TaskId,
-                  gki_cb.com.OSTName[TaskId],
-                  OSTaskStates[gki_cb.com.OSRdyTbl[TaskId]],
-                  gki_calc_stack(TaskId), gki_cb.com.OSStackSize[TaskId]);
-    }
-  }
-#endif
-}
-
-/*******************************************************************************
-**
-** Function         gki_print_buffer_statistics
-**
-** Description      Called internally by OSS to print the buffer pools
-**                  statistics
-**
-** Returns          void
-**
-*******************************************************************************/
-void gki_print_buffer_statistics(FP_PRINT print, int16_t pool) {
-  uint16_t i;
-  BUFFER_HDR_T* hdr;
-  uint16_t size, act_size, maxbuffs;
-  uint32_t* magic;
-
-  if (pool > GKI_NUM_TOTAL_BUF_POOLS || pool < 0) {
-    print("Not a valid Buffer pool\n");
-    return;
-  }
-
-  size = gki_cb.com.freeq[pool].size;
-  maxbuffs = gki_cb.com.freeq[pool].total;
-  act_size = size + BUFFER_PADDING_SIZE;
-  print("Buffer Pool[%u] size=%u cur_cnt=%u max_cnt=%u  total=%u\n", pool,
-        gki_cb.com.freeq[pool].size, gki_cb.com.freeq[pool].cur_cnt,
-        gki_cb.com.freeq[pool].max_cnt, gki_cb.com.freeq[pool].total);
-
-  print("      Owner  State    Sanity\n");
-  print("----------------------------\n");
-  hdr = (BUFFER_HDR_T*)(gki_cb.com.pool_start[pool]);
-  for (i = 0; i < maxbuffs; i++) {
-    magic = (uint32_t*)((uint8_t*)hdr + BUFFER_HDR_SIZE + size);
-    print("%3d: 0x%02x %4d %10s\n", i, hdr->task_id, hdr->status,
-          (*magic == MAGIC_NO) ? "OK" : "CORRUPTED");
-    hdr = (BUFFER_HDR_T*)((uint8_t*)hdr + act_size);
-  }
-  return;
-}
-
-/*******************************************************************************
-**
-** Function         gki_print_used_bufs
-**
-** Description      Dumps used buffers in the particular pool
-**
-*******************************************************************************/
-void gki_print_used_bufs(FP_PRINT print, uint8_t pool_id) {
-  uint8_t* p_start;
-  uint16_t buf_size;
-  uint16_t num_bufs;
-  BUFFER_HDR_T* p_hdr;
-  uint16_t i;
-  uint32_t* magic;
-  uint16_t* p;
-
-  if (pool_id >= GKI_NUM_TOTAL_BUF_POOLS &&
-      gki_cb.com.pool_start[pool_id] != 0) {
-    print("Not a valid Buffer pool\n");
-    return;
-  }
-
-  p_start = gki_cb.com.pool_start[pool_id];
-  buf_size = gki_cb.com.freeq[pool_id].size + BUFFER_PADDING_SIZE;
-  num_bufs = gki_cb.com.freeq[pool_id].total;
-
-  for (i = 0; i < num_bufs; i++, p_start += buf_size) {
-    p_hdr = (BUFFER_HDR_T*)p_start;
-    magic = (uint32_t*)((uint8_t*)p_hdr + buf_size - sizeof(uint32_t));
-    p = (uint16_t*)p_hdr;
-
-    if (p_hdr->status != BUF_STATUS_FREE) {
-      print(
-          "%d:0x%x (Q:%d,Task:%s,Stat:%d,%s) %04x %04x %04x %04x %04x %04x "
-          "%04x %04x\n",
-          i, p_hdr, p_hdr->q_id, GKI_map_taskname(p_hdr->task_id),
-          p_hdr->status, (*magic == MAGIC_NO) ? "OK" : "CORRUPTED", p[0], p[1],
-          p[2], p[3], p[4], p[5], p[6], p[7]);
-    }
-  }
-}
-
-/*******************************************************************************
-**
-** Function         gki_print_task
-**
-** Description      This function prints the task states.
-**
-** Returns          void
-**
-*******************************************************************************/
-void gki_print_task(FP_PRINT print) {
-  uint8_t i;
-
-  print("TID VID TASKNAME STATE WAIT WAITFOR TIMEOUT STACK\n");
-  print("-------------------------------------------------\n");
-  for (i = 0; i < GKI_MAX_TASKS; i++) {
-    if (gki_cb.com.OSRdyTbl[i] != TASK_DEAD) {
-      print("%2u  %-8s %-5s %04X    %04X %7u %u/%u Bytes\n", (uint16_t)i,
-            gki_cb.com.OSTName[i], OSTaskStates[gki_cb.com.OSRdyTbl[i]],
-            gki_cb.com.OSWaitEvt[i], gki_cb.com.OSWaitForEvt[i],
-            gki_cb.com.OSWaitTmr[i], gki_calc_stack(i),
-            gki_cb.com.OSStackSize[i]);
-    }
-  }
-}
-
-/*******************************************************************************
-**
-** Function         gki_print_exception
-**
-** Description      This function prints the exception information.
-**
-** Returns          void
-**
-*******************************************************************************/
-void gki_print_exception(FP_PRINT print) {
-  uint16_t i;
-  EXCEPTION_T* pExp;
-
-  print("GKI Exceptions:\n");
-  for (i = 0; i < gki_cb.com.ExceptionCnt; i++) {
-    pExp = &gki_cb.com.Exception[i];
-    print("%d: Type=%d, Task=%d: %s\n", i, (int32_t)pExp->type,
-          (int32_t)pExp->taskid, (int8_t*)pExp->msg);
-  }
-}
-
-/*****************************************************************************/
-void gki_dump(uint8_t* s, uint16_t len, FP_PRINT print) {
-  uint16_t i, j;
-
-  for (i = 0, j = 0; i < len; i++) {
-    if (j == 0)
-      print("\n%lX: %02X, ", &s[i], s[i]);
-    else if (j == 7)
-      print("%02X,  ", s[i]);
-    else
-      print("%02X, ", s[i]);
-    if (++j == 16) j = 0;
-  }
-  print("\n");
-}
-
-void gki_dump2(uint16_t* s, uint16_t len, FP_PRINT print) {
-  uint16_t i, j;
-
-  for (i = 0, j = 0; i < len; i++) {
-    if (j == 0)
-      print("\n%lX: %04X, ", &s[i], s[i]);
-    else
-      print("%04X, ", s[i]);
-    if (++j == 8) j = 0;
-  }
-  print("\n");
-}
-
-void gki_dump4(uint32_t* s, uint16_t len, FP_PRINT print) {
-  uint16_t i, j;
-
-  for (i = 0, j = 0; i < len; i++) {
-    if (j == 0)
-      print("\n%lX: %08lX, ", &s[i], s[i]);
-    else
-      print("%08lX, ", s[i]);
-    if (++j == 4) j = 0;
-  }
-  print("\n");
-}
-
-#endif
diff --git a/src/gki/ulinux/gki_int.h b/src/gki/ulinux/gki_int.h
index 6c60be0..4d3f121 100644
--- a/src/gki/ulinux/gki_int.h
+++ b/src/gki/ulinux/gki_int.h
@@ -39,9 +39,6 @@
   pthread_mutex_t gki_timer_mutex;
   pthread_cond_t gki_timer_cond;
   int gki_timer_wake_lock_on;
-#if (GKI_DEBUG == TRUE)
-  pthread_mutex_t GKI_trace_mutex;
-#endif
 } tGKI_OS;
 
 /* condition to exit or continue GKI_run() timer loop */
diff --git a/src/gki/ulinux/gki_ulinux.c b/src/gki/ulinux/gki_ulinux.c
index 92f3898..31bdcd6 100644
--- a/src/gki/ulinux/gki_ulinux.c
+++ b/src/gki/ulinux/gki_ulinux.c
@@ -20,8 +20,6 @@
 #include <stdarg.h>
 #include <stdio.h>
 
-#define GKI_DEBUG FALSE
-
 #include <pthread.h> /* must be 1st header defined  */
 #include <time.h>
 #include "bt_trace.h"
@@ -150,9 +148,6 @@
   p_os = &gki_cb.os;
   pthread_mutex_init(&p_os->GKI_mutex, &attr);
 /* pthread_mutex_init(&GKI_sched_mutex, NULL); */
-#if (GKI_DEBUG == TRUE)
-  pthread_mutex_init(&p_os->GKI_trace_mutex, NULL);
-#endif
   /* pthread_mutex_init(&thread_delay_mutex, NULL); */ /* used in GKI_delay */
   /* pthread_cond_init (&thread_delay_cond, NULL); */
 
@@ -344,9 +339,6 @@
   /* Destroy mutex and condition variable objects */
   pthread_mutex_destroy(&gki_cb.os.GKI_mutex);
 /*    pthread_mutex_destroy(&GKI_sched_mutex); */
-#if (GKI_DEBUG == TRUE)
-  pthread_mutex_destroy(&gki_cb.os.GKI_trace_mutex);
-#endif
 /*    pthread_mutex_destroy(&thread_delay_mutex);
  pthread_cond_destroy (&thread_delay_cond); */
 #if (FALSE == GKI_PTHREAD_JOINABLE)
@@ -944,21 +936,6 @@
   GKI_TRACE_ERROR_0(
       "********************************************************************");
 
-#if (GKI_DEBUG == TRUE)
-  GKI_disable();
-
-  if (gki_cb.com.ExceptionCnt < GKI_MAX_EXCEPTION) {
-    EXCEPTION_T* pExp;
-
-    pExp = &gki_cb.com.Exception[gki_cb.com.ExceptionCnt++];
-    pExp->type = code;
-    pExp->taskid = GKI_get_taskid();
-    strncpy((char*)pExp->msg, msg, GKI_MAX_EXCEPTION_MSGLEN - 1);
-  }
-
-  GKI_enable();
-#endif
-
   GKI_TRACE_ERROR_2("GKI_exception %d %s done", code, msg);
 
   return;
diff --git a/src/hal/include/gki_hal_target.h b/src/hal/include/gki_hal_target.h
index abef5a9..4b065c7 100644
--- a/src/hal/include/gki_hal_target.h
+++ b/src/hal/include/gki_hal_target.h
@@ -126,11 +126,6 @@
 **
 ******************************************************************************/
 
-/* TRUE if GKI uses dynamic buffers. */
-#ifndef GKI_USE_DYNAMIC_BUFFERS
-#define GKI_USE_DYNAMIC_BUFFERS FALSE
-#endif
-
 /* The size of the buffers in pool 0. */
 #ifndef GKI_BUF0_SIZE
 #define GKI_BUF0_SIZE 64
@@ -206,11 +201,6 @@
 #define GKI_SEVERE(code)
 #endif
 
-/* TRUE if GKI includes debug functionality. */
-#ifndef GKI_DEBUG
-#define GKI_DEBUG FALSE
-#endif
-
 /* Maximum number of exceptions logged. */
 #ifndef GKI_MAX_EXCEPTION
 #define GKI_MAX_EXCEPTION 8
@@ -225,41 +215,6 @@
 #define GKI_SEND_MSG_FROM_ISR FALSE
 #endif
 
-#if (GKI_DEBUG == TRUE)
-#ifdef LOG_TAG
-#undef LOG_TAG
-#endif
-#define LOG_TAG "GKI_LINUX"
-/* GKI Trace Macros */
-#define GKI_TRACE_0(m)                                          \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m)
-#define GKI_TRACE_1(m, p1)                                      \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1)
-#define GKI_TRACE_2(m, p1, p2)                                  \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2)
-#define GKI_TRACE_3(m, p1, p2, p3)                              \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3)
-#define GKI_TRACE_4(m, p1, p2, p3, p4)                          \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3, p4)
-#define GKI_TRACE_5(m, p1, p2, p3, p4, p5)                      \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3, p4, p5)
-#define GKI_TRACE_6(m, p1, p2, p3, p4, p5, p6)                  \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3, p4, p5, p6)
-#else
 #define GKI_TRACE_0(m)
 #define GKI_TRACE_1(m, p1)
 #define GKI_TRACE_2(m, p1, p2)
@@ -268,8 +223,6 @@
 #define GKI_TRACE_5(m, p1, p2, p3, p4, p5)
 #define GKI_TRACE_6(m, p1, p2, p3, p4, p5, p6)
 
-#endif
-
 #define GKI_TRACE_ERROR_0(m)                                                   \
   LogMsg(                                                                      \
       TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | TRACE_TYPE_ERROR, \
diff --git a/src/include/gki_target.h b/src/include/gki_target.h
index f113f0b..6413124 100644
--- a/src/include/gki_target.h
+++ b/src/include/gki_target.h
@@ -129,11 +129,6 @@
 **
 ******************************************************************************/
 
-/* TRUE if GKI uses dynamic buffers. */
-#ifndef GKI_USE_DYNAMIC_BUFFERS
-#define GKI_USE_DYNAMIC_BUFFERS FALSE
-#endif
-
 /* The size of the buffers in pool 0. */
 #ifndef GKI_BUF0_SIZE
 #define GKI_BUF0_SIZE 64
@@ -286,11 +281,6 @@
 #define GKI_SEVERE(code)
 #endif
 
-/* TRUE if GKI includes debug functionality. */
-#ifndef GKI_DEBUG
-#define GKI_DEBUG FALSE
-#endif
-
 /* Maximum number of exceptions logged. */
 #ifndef GKI_MAX_EXCEPTION
 #define GKI_MAX_EXCEPTION 8
@@ -371,41 +361,6 @@
 #define GKI_BUF8_MAX 30
 #endif
 
-#if (GKI_DEBUG == TRUE)
-#ifdef LOG_TAG
-#undef LOG_TAG
-#endif
-#define LOG_TAG "GKI_LINUX"
-/* GKI Trace Macros */
-#define GKI_TRACE_0(m)                                          \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m)
-#define GKI_TRACE_1(m, p1)                                      \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1)
-#define GKI_TRACE_2(m, p1, p2)                                  \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2)
-#define GKI_TRACE_3(m, p1, p2, p3)                              \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3)
-#define GKI_TRACE_4(m, p1, p2, p3, p4)                          \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3, p4)
-#define GKI_TRACE_5(m, p1, p2, p3, p4, p5)                      \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3, p4, p5)
-#define GKI_TRACE_6(m, p1, p2, p3, p4, p5, p6)                  \
-  LogMsg(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | \
-             TRACE_TYPE_GENERIC,                                \
-         m, p1, p2, p3, p4, p5, p6)
-#else
 #define GKI_TRACE_0(m)
 #define GKI_TRACE_1(m, p1)
 #define GKI_TRACE_2(m, p1, p2)
@@ -414,8 +369,6 @@
 #define GKI_TRACE_5(m, p1, p2, p3, p4, p5)
 #define GKI_TRACE_6(m, p1, p2, p3, p4, p5, p6)
 
-#endif
-
 #define GKI_TRACE_ERROR_0(m)                                                   \
   LogMsg(                                                                      \
       TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI | TRACE_TYPE_ERROR, \
diff --git a/src/nfc/nfc/nfc_ncif.cc b/src/nfc/nfc/nfc_ncif.cc
index 4846b45..8e0048a 100644
--- a/src/nfc/nfc/nfc_ncif.cc
+++ b/src/nfc/nfc/nfc_ncif.cc
@@ -718,7 +718,7 @@
     p_i93->dsfid = *p++;
     STREAM_TO_ARRAY(p_i93->uid, p, NFC_ISO15693_UID_LEN);
   } else if (NCI_DISCOVERY_TYPE_POLL_KOVIO == p_param->mode) {
-    p_param->param.pk.uid_len = *p++;
+    p_param->param.pk.uid_len = len;
     if (p_param->param.pk.uid_len > NFC_KOVIO_MAX_LEN) {
       NFC_TRACE_ERROR2("Kovio UID len:0x%x exceeds max(0x%x)",
                        p_param->param.pk.uid_len, NFC_KOVIO_MAX_LEN);
diff --git a/src/nfc/tags/rw_i93.c b/src/nfc/tags/rw_i93.c
index 990fd92..6c6f4bd 100644
--- a/src/nfc/tags/rw_i93.c
+++ b/src/nfc/tags/rw_i93.c
@@ -2764,7 +2764,7 @@
       ((event == NFC_DATA_CEVT) && (p_data->status != NFC_STATUS_OK))) {
     nfc_stop_quick_timer(&p_i93->timer);
 
-    if (event == NFC_ERROR_CEVT) {
+    if (event == NFC_ERROR_CEVT || (p_data->status != NFC_STATUS_OK)) {
       if ((p_i93->retry_count < RW_MAX_RETRIES) && (p_i93->p_retry_cmd)) {
         p_i93->retry_count++;