Snap for 4444158 from ee8bb9058453d51ca6ab4349b3e3ee1e50a3eaaf to oreo-cts-release

Change-Id: I4aa3a4e68dcbf9a52d866384b48138bf15b2c8d1
diff --git a/bta/av/bta_av_act.cc b/bta/av/bta_av_act.cc
index 1e27c25..67a8299 100644
--- a/bta/av/bta_av_act.cc
+++ b/bta/av/bta_av_act.cc
@@ -1788,6 +1788,23 @@
       peer_features |=
           bta_av_check_peer_features(UUID_SERVCLASS_AV_REM_CTRL_TARGET);
     }
+
+    /* Change our features if the remote AVRCP version is 1.3 or less */
+    tSDP_DISC_REC* p_rec = nullptr;
+    p_rec = SDP_FindServiceInDb(p_cb->p_disc_db,
+                                UUID_SERVCLASS_AV_REMOTE_CONTROL, p_rec);
+    if (p_rec != NULL &&
+        SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST) != NULL) {
+      /* get profile version (if failure, version parameter is not updated) */
+      uint16_t peer_rc_version = 0xFFFF;  // Don't change the AVRCP version
+      SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL,
+                                  &peer_rc_version);
+      if (peer_rc_version <= AVRC_REV_1_3) {
+        APPL_TRACE_DEBUG("%s Using AVRCP 1.3 Capabilities with remote device",
+                         __func__);
+        p_bta_av_cfg = (tBTA_AV_CFG*)&bta_av_cfg_compatibility;
+      }
+    }
   }
 
   p_cb->disc = 0;
diff --git a/bta/av/bta_av_cfg.cc b/bta/av/bta_av_cfg.cc
index 5fc75ba..10baa33 100644
--- a/bta/av/bta_av_cfg.cc
+++ b/bta/av/bta_av_cfg.cc
@@ -111,6 +111,18 @@
   (sizeof(bta_avk_meta_caps_evt_ids) / sizeof(bta_avk_meta_caps_evt_ids[0]))
 #endif /* BTA_AVK_NUM_RC_EVT_IDS */
 
+// These are the only events used with AVRCP1.3
+const uint8_t bta_av_meta_caps_evt_ids_avrcp13[] = {
+    AVRC_EVT_PLAY_STATUS_CHANGE, AVRC_EVT_TRACK_CHANGE,
+    AVRC_EVT_PLAY_POS_CHANGED,
+};
+
+#ifndef BTA_AV_NUM_RC_EVT_IDS_AVRCP13
+#define BTA_AV_NUM_RC_EVT_IDS_AVRCP13         \
+  (sizeof(bta_av_meta_caps_evt_ids_avrcp13) / \
+   sizeof(bta_av_meta_caps_evt_ids_avrcp13[0]))
+#endif /* BTA_AVK_NUM_RC_EVT_IDS_AVRCP13 */
+
 /* the MTU for the AVRCP browsing channel */
 #ifndef BTA_AV_MAX_RC_BR_MTU
 #define BTA_AV_MAX_RC_BR_MTU 1008
@@ -186,6 +198,42 @@
     {0},                       /* Default AVRCP target name */
 };
 
+/* This configuration to be used when we are using AVRCP1.3 */
+const tBTA_AV_CFG bta_av_cfg_compatibility = {
+    BTA_AV_RC_COMP_ID, /* AVRCP Company ID */
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    512,                  /* AVRCP MTU at L2CAP for control channel */
+    BTA_AV_MAX_RC_BR_MTU, /* AVRCP MTU at L2CAP for browsing channel */
+#else
+    48,                   /* AVRCP MTU at L2CAP for control channel */
+    BTA_AV_MAX_RC_BR_MTU, /* AVRCP MTU at L2CAP for browsing channel */
+#endif
+    BTA_AV_RC_SUPF_CT,     /* AVRCP controller categories */
+    AVRC_SUPF_TG_CAT1,     /* Only support CAT1 for AVRCP1.3 */
+    672,                   /* AVDTP signaling channel MTU at L2CAP */
+    BTA_AV_MAX_A2DP_MTU,   /* AVDTP audio transport channel MTU at L2CAP
+                            */
+    bta_av_audio_flush_to, /* AVDTP audio transport channel flush
+                              timeout */
+    6,                     /* AVDTP audio channel max data queue size */
+    BTA_AV_MAX_VDP_MTU,    /* AVDTP video transport channel MTU at L2CAP */
+    600,                   /* AVDTP video transport channel flush timeout */
+    false, /* true, to accept AVRC 1.3 group nevigation command */
+    2,     /* company id count in p_meta_co_ids */
+    BTA_AV_NUM_RC_EVT_IDS_AVRCP13,    /* event id count for AVRCP1.3*/
+    BTA_AV_RC_PASS_RSP_CODE,          /* the default response code for pass
+                                         through commands */
+    bta_av_meta_caps_co_ids,          /* the metadata Get Capabilities response
+                                         for company id */
+    bta_av_meta_caps_evt_ids_avrcp13, /* the the metadata Get Capabilities
+                                         response for event id, compatible
+                                         with AVRCP1.3*/
+    NULL,              /* the action function table for VDP stream */
+    NULL,              /* action function to register VDP */
+    BTA_AV_RC_CT_NAME, /* Default AVRCP controller name */
+    BTA_AV_RC_TG_NAME  /* Default AVRCP target name */
+};
+
 tBTA_AV_CFG* p_bta_av_cfg = NULL;
 
 const uint16_t bta_av_rc_id[] = {
diff --git a/bta/av/bta_av_int.h b/bta/av/bta_av_int.h
index e1237bb..6688f71 100644
--- a/bta/av/bta_av_int.h
+++ b/bta/av/bta_av_int.h
@@ -576,6 +576,7 @@
 extern tBTA_AV_CFG* p_bta_av_cfg;
 extern const tBTA_AV_CFG bta_avk_cfg;
 extern const tBTA_AV_CFG bta_av_cfg;
+extern const tBTA_AV_CFG bta_av_cfg_compatibility;
 
 /* rc id config struct */
 extern uint16_t* p_bta_av_rc_id;
diff --git a/bta/gatt/bta_gatts_act.cc b/bta/gatt/bta_gatts_act.cc
index 86dfd9a..15b48db 100644
--- a/bta/gatt/bta_gatts_act.cc
+++ b/bta/gatt/bta_gatts_act.cc
@@ -305,7 +305,7 @@
   tBTA_GATTS cb_data;
 
   cb_data.srvc_oper.server_if = p_rcb->gatt_if;
-  // cb_data.srvc_oper.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+  cb_data.srvc_oper.service_id = p_srvc_cb->service_id;
 
   if (GATTS_DeleteService(p_rcb->gatt_if, &p_srvc_cb->service_uuid,
                           p_srvc_cb->service_id)) {
diff --git a/btif/src/btif_sdp_server.cc b/btif/src/btif_sdp_server.cc
index 43d489b..b84d694 100644
--- a/btif/src/btif_sdp_server.cc
+++ b/btif/src/btif_sdp_server.cc
@@ -214,7 +214,8 @@
 static int free_sdp_slot(int id) {
   int handle = -1;
   bluetooth_sdp_record* record = NULL;
-  if (id >= MAX_SDP_SLOTS) {
+  if (id < 0 || id >= MAX_SDP_SLOTS) {
+    android_errorWriteLog(0x534e4554, "37502513");
     APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
     return handle;
   }
diff --git a/stack/gap/gap_conn.cc b/stack/gap/gap_conn.cc
index c51363b..fcc2161 100644
--- a/stack/gap/gap_conn.cc
+++ b/stack/gap/gap_conn.cc
@@ -142,6 +142,9 @@
   /* update the transport */
   p_ccb->transport = transport;
 
+  /* The service_id must be set before calling gap_release_ccb(). */
+  p_ccb->service_id = service_id;
+
   /* If caller specified a BD address, save it */
   if (p_rem_bda) {
     /* the bd addr is not BT_BD_ANY, then a bd address was specified */
@@ -211,7 +214,6 @@
   }
 
   /* Register with Security Manager for the specific security level */
-  p_ccb->service_id = service_id;
   if (!BTM_SetSecurityLevel((uint8_t)!is_server, p_serv_name, p_ccb->service_id,
                             security, p_ccb->psm, 0, 0)) {
     GAP_TRACE_ERROR("GAP_CONN - Security Error");
diff --git a/test/suite/gatt/gatt_unittest.cc b/test/suite/gatt/gatt_unittest.cc
index 598ae41..c216d6e 100644
--- a/test/suite/gatt/gatt_unittest.cc
+++ b/test/suite/gatt/gatt_unittest.cc
@@ -98,16 +98,24 @@
   gatt_server_interface()->add_service(server_if, service);
   semaphore_wait(service_added_callback_sem_);
   EXPECT_TRUE(status() == BT_STATUS_SUCCESS) << "Error adding service.";
+  EXPECT_TRUE(server_interface_id() == server_if) << "Wrong server_if added.";
+  int service_handle_added = service_handle();
 
   // Stops server.
   gatt_server_interface()->stop_service(server_if, service_handle());
   semaphore_wait(service_stopped_callback_sem_);
   EXPECT_TRUE(status() == BT_STATUS_SUCCESS) << "Error stopping server.";
+  EXPECT_TRUE(service_handle() == service_handle_added)
+      << "Wrong service handle stopped.";
+  EXPECT_TRUE(server_interface_id() == server_if) << "Wrong server_if stopped.";
 
   // Deletes service.
   gatt_server_interface()->delete_service(server_if, service_handle());
   semaphore_wait(service_deleted_callback_sem_);
   EXPECT_TRUE(status() == BT_STATUS_SUCCESS) << "Error deleting service.";
+  EXPECT_TRUE(service_handle() == service_handle_added)
+      << "Wrong service handle deleted.";
+  EXPECT_TRUE(server_interface_id() == server_if) << "Wrong server_if deleted.";
 
   // Unregisters gatt server. No callback is expected.
   gatt_server_interface()->unregister_server(server_if);