Snap for 7901677 from 641fdb7f3faf8d79e6220ea31422c5ed3014d39c to sc-platform-releaseandroid-platform-12.0.0_r3android-platform-12.0.0_r2

Change-Id: I706a75c954f38863f4b7f596f0cbab176a93f7c5

19 files changed, 53 insertions, 28 deletions

diff --git a/bta/av/bta_av_main.cc b/bta/av/bta_av_main.cc
index 887171853..d91e0ab71 100644
--- a/bta/av/bta_av_main.cc
+++ b/bta/av/bta_av_main.cc
@@ -624,7 +624,8 @@ static void bta_av_api_register(tBTA_AV_DATA* p_data) {
          *
          * We create 1.4 for SINK since we support browsing.
          */
-        if (profile_initialized == UUID_SERVCLASS_AUDIO_SOURCE) {
+        if (profile_initialized == UUID_SERVCLASS_AUDIO_SOURCE &&
+            !is_new_avrcp_enabled()) {
           bta_ar_reg_avrc(UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL, NULL,
                           p_bta_av_cfg->avrc_ct_cat,
                           (bta_av_cb.features & BTA_AV_FEAT_BROWSE),
diff --git a/bta/dm/bta_dm_act.cc b/bta/dm/bta_dm_act.cc
index 8f9e26e52..2566b5b42 100644
--- a/bta/dm/bta_dm_act.cc
+++ b/bta/dm/bta_dm_act.cc
@@ -979,7 +979,7 @@ static bool bta_dm_read_remote_device_name(const RawAddress& bd_addr,
 void bta_dm_inq_cmpl(uint8_t num) {
   if (bta_dm_search_get_state() == BTA_DM_SEARCH_CANCELLING) {
     bta_dm_search_set_state(BTA_DM_SEARCH_IDLE);
-    bta_dm_search_cancel_cmpl();
+    bta_dm_execute_queued_request();
     return;
   }
 
@@ -1278,6 +1278,7 @@ void bta_dm_search_cmpl() {
   /* no BLE connection, i.e. Classic service discovery end */
   if (conn_id == GATT_INVALID_CONN_ID) {
     bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
+    bta_dm_execute_queued_request();
     return;
   }
 
@@ -1288,6 +1289,7 @@ void bta_dm_search_cmpl() {
   if (count == 0) {
     LOG_INFO("Empty GATT database - no BLE services discovered");
     bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
+    bta_dm_execute_queued_request();
     return;
   }
 
@@ -1500,17 +1502,6 @@ void bta_dm_search_clear_queue() {
 
 /*******************************************************************************
  *
- * Function         bta_dm_search_cancel_cmpl
- *
- * Description      Search cancel is complete
- *
- * Returns          void
- *
- ******************************************************************************/
-void bta_dm_search_cancel_cmpl() { bta_dm_execute_queued_request(); }
-
-/*******************************************************************************
- *
  * Function         bta_dm_search_cancel_notify
  *
  * Description      Notify application that search has been cancelled
diff --git a/bta/dm/bta_dm_api.cc b/bta/dm/bta_dm_api.cc
index 8e9e4c1e6..f10d55f5e 100644
--- a/bta/dm/bta_dm_api.cc
+++ b/bta/dm/bta_dm_api.cc
@@ -103,6 +103,8 @@ void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp) {
  *
  ******************************************************************************/
 void BTA_DmSearchCancel(void) {
+  bta_dm_search_clear_queue();
+
   switch (bta_dm_search_get_state()) {
     case BTA_DM_SEARCH_IDLE:
       bta_dm_search_cancel_notify();
@@ -112,7 +114,6 @@ void BTA_DmSearchCancel(void) {
       bta_dm_search_cancel();
       break;
     case BTA_DM_SEARCH_CANCELLING:
-      bta_dm_search_clear_queue();
       bta_dm_search_cancel_notify();
       break;
     case BTA_DM_DISCOVER_ACTIVE:
diff --git a/bta/dm/bta_dm_int.h b/bta/dm/bta_dm_int.h
index 1f5952e7b..daf3e017e 100644
--- a/bta/dm/bta_dm_int.h
+++ b/bta/dm/bta_dm_int.h
@@ -541,7 +541,6 @@ extern void bta_dm_queue_disc(tBTA_DM_MSG* p_data);
 extern void bta_dm_execute_queued_request();
 extern bool bta_dm_is_search_request_queued();
 extern void bta_dm_search_clear_queue();
-extern void bta_dm_search_cancel_cmpl();
 extern void bta_dm_search_cancel_notify();
 extern void bta_dm_disc_rmt_name(tBTA_DM_MSG* p_data);
 extern tBTA_DM_PEER_DEVICE* bta_dm_find_peer_device(
diff --git a/bta/dm/bta_dm_main.cc b/bta/dm/bta_dm_main.cc
index 3b84f9d98..ad3366989 100644
--- a/bta/dm/bta_dm_main.cc
+++ b/bta/dm/bta_dm_main.cc
@@ -129,7 +129,7 @@ bool bta_dm_search_sm_execute(BT_HDR_RIGID* p_msg) {
           bta_dm_search_set_state(BTA_DM_SEARCH_IDLE);
           bta_dm_free_sdp_db();
           bta_dm_search_cancel_notify();
-          bta_dm_search_cancel_cmpl();
+          bta_dm_execute_queued_request();
           break;
       }
       break;
diff --git a/btif/src/btif_dm.cc b/btif/src/btif_dm.cc
index 49be64145..941a8ea87 100644
--- a/btif/src/btif_dm.cc
+++ b/btif/src/btif_dm.cc
@@ -473,7 +473,6 @@ static void bond_state_changed(bt_status_t status, const RawAddress& bd_addr,
     pairing_cb.bd_addr = bd_addr;
   } else {
     pairing_cb = {};
-    bta_dm_execute_queued_request();
   }
 }
 
@@ -1330,7 +1329,6 @@ static void btif_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,
         // Both SDP and bonding are done, clear pairing control block in case
         // it is not already cleared
         pairing_cb = {};
-        bta_dm_execute_queued_request();
 
         // Send one empty UUID to Java to unblock pairing intent when SDP failed
         // or no UUID is discovered
@@ -2217,7 +2215,9 @@ void btif_dm_get_remote_services(RawAddress remote_addr, const int transport) {
                    remote_addr.ToString().c_str());
 
   BTA_DmDiscover(remote_addr, btif_dm_search_services_evt, transport,
-                 remote_addr != pairing_cb.bd_addr && is_bonding_or_sdp());
+                 remote_addr != pairing_cb.bd_addr &&
+                     remote_addr != pairing_cb.static_bdaddr &&
+                     is_bonding_or_sdp());
 }
 
 void btif_dm_enable_service(tBTA_SERVICE_ID service_id, bool enable) {
diff --git a/btif/src/btif_hf_client.cc b/btif/src/btif_hf_client.cc
index 3a8e4ea72..6dc81ceae 100644
--- a/btif/src/btif_hf_client.cc
+++ b/btif/src/btif_hf_client.cc
@@ -164,6 +164,7 @@ static void btif_in_hf_client_generic_evt(uint16_t event, char* p_param) {
   btif_hf_client_cb_t* cb = btif_hf_client_get_cb_by_bda(*bd_addr);
   if (cb == NULL || !is_connected(cb)) {
     BTIF_TRACE_ERROR("%s: failed to find block for bda", __func__);
+    return;
   }
 
   BTIF_TRACE_EVENT("%s: event=%d", __func__, event);
diff --git a/device/include/interop_database.h b/device/include/interop_database.h
index 159cfacc5..5811bd893 100644
--- a/device/include/interop_database.h
+++ b/device/include/interop_database.h
@@ -166,11 +166,14 @@ static const interop_addr_entry_t interop_addr_database[] = {
     // Honda Civic Carkit
     {{{0x0c, 0xd9, 0xc1, 0, 0, 0}}, 3, INTEROP_AVRCP_1_4_ONLY},
 
+    // BMW Carkit
+    {{{0x9c, 0xdf, 0x03, 0, 0, 0}}, 3, INTEROP_AVRCP_1_4_ONLY},
+
     // KDDI Carkit
     {{{0x44, 0xea, 0xd8, 0, 0, 0}}, 3, INTEROP_DISABLE_SNIFF},
 
     // Toyota Camry 2018 Carkit HFP AT+BIND missing
-    {{{0x94, 0xb2, 0xcc, 0x30, 0, 0}}, 4, INTEROP_SLC_SKIP_BIND_COMMAND}
+    {{{0x94, 0xb2, 0xcc, 0x30, 0, 0}}, 4, INTEROP_SLC_SKIP_BIND_COMMAND},
 };
 
 typedef struct {
diff --git a/gd/hci/hci_metrics_logging.cc b/gd/hci/hci_metrics_logging.cc
index 00fb9a211..2d250e2eb 100644
--- a/gd/hci/hci_metrics_logging.cc
+++ b/gd/hci/hci_metrics_logging.cc
@@ -30,15 +30,23 @@ void log_hci_event(
   EventCode event_code = event_view.GetEventCode();
   switch (event_code) {
     case EventCode::COMMAND_COMPLETE: {
+      CommandCompleteView complete_view = CommandCompleteView::Create(event_view);
+      ASSERT(complete_view.IsValid());
+      if (complete_view.GetCommandOpCode() == OpCode::NONE) {
+        return;
+      }
       ASSERT(command_view->IsValid());
       log_link_layer_connection_command_complete(event_view, command_view);
       log_classic_pairing_command_complete(event_view, command_view);
       break;
     }
     case EventCode::COMMAND_STATUS: {
-      ASSERT(command_view->IsValid());
       CommandStatusView response_view = CommandStatusView::Create(event_view);
       ASSERT(response_view.IsValid());
+      if (response_view.GetCommandOpCode() == OpCode::NONE) {
+        return;
+      }
+      ASSERT(command_view->IsValid());
       log_link_layer_connection_command_status(command_view, response_view.GetStatus());
       log_classic_pairing_command_status(command_view, response_view.GetStatus());
       break;
diff --git a/internal_include/bt_target.h b/internal_include/bt_target.h
index 12f04d46a..dd8c74eba 100644
--- a/internal_include/bt_target.h
+++ b/internal_include/bt_target.h
@@ -285,7 +285,7 @@
 /* Sets the Page_Scan_Activity:  the interval between the start of two
  * consecutive page scans. */
 #ifndef BTM_DEFAULT_CONN_INTERVAL
-#define BTM_DEFAULT_CONN_INTERVAL 0x0800
+#define BTM_DEFAULT_CONN_INTERVAL 0x0400
 #endif
 
 /* When automatic inquiry scan is enabled, this sets the inquiry scan window. */
diff --git a/osi/src/allocator.cc b/osi/src/allocator.cc
index 1c0449e14..e2c356dd3 100644
--- a/osi/src/allocator.cc
+++ b/osi/src/allocator.cc
@@ -56,6 +56,7 @@ char* osi_strndup(const char* str, size_t len) {
 }
 
 void* osi_malloc(size_t size) {
+  CHECK(static_cast<ssize_t>(size) >= 0);
   size_t real_size = allocation_tracker_resize_for_canary(size);
   void* ptr = malloc(real_size);
   CHECK(ptr);
@@ -63,6 +64,7 @@ void* osi_malloc(size_t size) {
 }
 
 void* osi_calloc(size_t size) {
+  CHECK(static_cast<ssize_t>(size) >= 0);
   size_t real_size = allocation_tracker_resize_for_canary(size);
   void* ptr = calloc(1, real_size);
   CHECK(ptr);
diff --git a/profile/avrcp/device.cc b/profile/avrcp/device.cc
index f31d736b1..5a889b04e 100644
--- a/profile/avrcp/device.cc
+++ b/profile/avrcp/device.cc
@@ -411,6 +411,11 @@ void Device::HandleVolumeChanged(
 void Device::SetVolume(int8_t volume) {
   // TODO (apanicke): Implement logic for Multi-AVRCP
   DEVICE_VLOG(1) << __func__ << ": volume=" << (int)volume;
+  if (volume == volume_) {
+    DEVICE_LOG(WARNING)
+        << __func__ << ": Ignoring volume change same as current volume level";
+    return;
+  }
   auto request = SetAbsoluteVolumeRequestBuilder::MakeBuilder(volume);
 
   uint8_t label = MAX_TRANSACTION_LABEL;
diff --git a/profile/avrcp/tests/avrcp_device_test.cc b/profile/avrcp/tests/avrcp_device_test.cc
index 516949291..379ea0446 100644
--- a/profile/avrcp/tests/avrcp_device_test.cc
+++ b/profile/avrcp/tests/avrcp_device_test.cc
@@ -1351,6 +1351,19 @@ TEST_F(AvrcpDeviceTest, volumeRejectedTest) {
   EXPECT_CALL(response_cb, Call(_, _, _)).Times(0);
 }
 
+TEST_F(AvrcpDeviceTest, setVolumeOnceTest) {
+  int vol = 0x48;
+
+  auto set_abs_vol = SetAbsoluteVolumeRequestBuilder::MakeBuilder(vol);
+
+  // Ensure that SetVolume only been call once.
+  EXPECT_CALL(response_cb, Call(_, false, matchPacket(std::move(set_abs_vol))))
+      .Times(1);
+
+  test_device->SetVolume(vol);
+  test_device->SetVolume(vol);
+}
+
 TEST_F(AvrcpDeviceTest, playPushedActiveDeviceTest) {
   MockMediaInterface interface;
   NiceMock<MockA2dpInterface> a2dp_interface;
diff --git a/stack/gatt/gatt_cl.cc b/stack/gatt/gatt_cl.cc
index 8c3567d7a..ae22dd68f 100644
--- a/stack/gatt/gatt_cl.cc
+++ b/stack/gatt/gatt_cl.cc
@@ -46,6 +46,8 @@
 #define GATT_MTU_RSP_MIN_LEN 2
 #define GATT_READ_BY_TYPE_RSP_MIN_LEN 1
 
+#define L2CAP_PKT_OVERHEAD 4
+
 using base::StringPrintf;
 using bluetooth::Uuid;
 using bluetooth::eatt::EattExtension;
@@ -1094,7 +1096,7 @@ void gatt_process_mtu_rsp(tGATT_TCB& tcb, tGATT_CLCB* p_clcb, uint16_t len,
       tcb.payload_size = mtu;
   }
 
-  BTM_SetBleDataLength(tcb.peer_bda, tcb.payload_size);
+  BTM_SetBleDataLength(tcb.peer_bda, tcb.payload_size + L2CAP_PKT_OVERHEAD);
 
   gatt_end_operation(p_clcb, status, NULL);
 }
diff --git a/stack/gatt/gatt_sr.cc b/stack/gatt/gatt_sr.cc
index c0aedfafa..9fe642cba 100644
--- a/stack/gatt/gatt_sr.cc
+++ b/stack/gatt/gatt_sr.cc
@@ -32,6 +32,7 @@
 #include "stack/eatt/eatt.h"
 #include "stack/l2cap/l2c_int.h"
 #define GATT_MTU_REQ_MIN_LEN 2
+#define L2CAP_PKT_OVERHEAD 4
 
 using base::StringPrintf;
 using bluetooth::Uuid;
@@ -814,7 +815,7 @@ static void gatts_process_mtu_req(tGATT_TCB& tcb, uint16_t cid, uint16_t len,
 
   LOG(INFO) << "MTU request PDU with MTU size " << +tcb.payload_size;
 
-  BTM_SetBleDataLength(tcb.peer_bda, tcb.payload_size);
+  BTM_SetBleDataLength(tcb.peer_bda, tcb.payload_size + L2CAP_PKT_OVERHEAD);
 
   tGATT_SR_MSG gatt_sr_msg;
   gatt_sr_msg.mtu = tcb.payload_size;
diff --git a/stack/include/avrc_api.h b/stack/include/avrc_api.h
index 7796ae0b6..4aceb6073 100644
--- a/stack/include/avrc_api.h
+++ b/stack/include/avrc_api.h
@@ -131,7 +131,7 @@
 #endif
 
 #ifndef AVRC_DEFAULT_VERSION
-#define AVRC_DEFAULT_VERSION AVRC_1_4_STRING
+#define AVRC_DEFAULT_VERSION AVRC_1_5_STRING
 #endif
 
 /* Supported categories */
diff --git a/stack/include/hci_evt_length.h b/stack/include/hci_evt_length.h
index 046816b01..6219f279b 100644
--- a/stack/include/hci_evt_length.h
+++ b/stack/include/hci_evt_length.h
@@ -80,7 +80,7 @@ static const uint8_t hci_event_parameters_minimum_length[] = {
     10,   //  0x3B - HCI_User_Passkey_Notification Event
     7,    //  0x3C - HCI_Keypress_Notification Event
     14,   //  0x3D - HCI_Remote_Host_Supported_Features_Notification Event
-    0,    //  0x3E - LE Meta event
+    1,    //  0x3E - LE Meta event
     0,    //  0x3F - N/A
     2,    //  0x40 - HCI_Physical_Link_Complete Event
     1,    //  0x41 - HCI_Channel_Selected Event
diff --git a/stack/test/common/mock_bta_dm_act.cc b/stack/test/common/mock_bta_dm_act.cc
index b7b39dbac..1a7defe28 100644
--- a/stack/test/common/mock_bta_dm_act.cc
+++ b/stack/test/common/mock_bta_dm_act.cc
@@ -103,7 +103,6 @@ void bta_dm_sdp_result(tBTA_DM_MSG* p_data) {
   mock_function_count_map[__func__]++;
 }
 void bta_dm_search_cancel() { mock_function_count_map[__func__]++; }
-void bta_dm_search_cancel_cmpl() { mock_function_count_map[__func__]++; }
 void bta_dm_search_cancel_notify() { mock_function_count_map[__func__]++; }
 void bta_dm_execute_queued_request() { mock_function_count_map[__func__]++; }
 bool bta_dm_is_search_request_queued() {
diff --git a/test/mock/mock_bta_dm_act.cc b/test/mock/mock_bta_dm_act.cc
index 171613d5f..80326b3c5 100644
--- a/test/mock/mock_bta_dm_act.cc
+++ b/test/mock/mock_bta_dm_act.cc
@@ -133,7 +133,6 @@ void bta_dm_sdp_result(tBTA_DM_MSG* p_data) {
   mock_function_count_map[__func__]++;
 }
 void bta_dm_search_cancel() { mock_function_count_map[__func__]++; }
-void bta_dm_search_cancel_cmpl() { mock_function_count_map[__func__]++; }
 void bta_dm_search_cancel_notify() { mock_function_count_map[__func__]++; }
 void bta_dm_execute_queued_request() { mock_function_count_map[__func__]++; }
 bool bta_dm_is_search_request_queued() {