GitLab

am 0ff8f69e: am 87f26bcd: Merge "DO NOT MERGE BLE Secuity manager state machine generate wrong pairing success event." into klp-dev

* commit '0ff8f69e':
  DO NOT MERGE BLE Secuity manager state machine generate wrong pairing success event.

am 037c5da2: am ea8acc97: Merge "DO NOT MERGE fix a potential native crash during bluetooth sutdown" into klp-dev

* commit '037c5da2':
  DO NOT MERGE fix a potential native crash during bluetooth sutdown

am 0f8cc120: am 1e0849e9: Merge "DO NOT MERGE the HID device state is out of sync after upair." into klp-dev

* commit '0f8cc120':
  DO NOT MERGE the HID device state is out of sync after upair.

am 94eb9d6f: am 30466dfd: Merge "DO NOT MERGE Can only support two HID report instance for BLE HID." into klp-dev

* commit '94eb9d6f':
  DO NOT MERGE Can only support two HID report instance for BLE HID.

am 86254778: am 7a528bc8: Merge "DO NOT MERGE read report array out of boundary for BLE HID device." into klp-dev

* commit '86254778':
  DO NOT MERGE read report array out of boundary for BLE HID device.

am 87f26bcd: Merge "DO NOT MERGE BLE Secuity manager state machine generate wrong pairing success event." into klp-dev

* commit '87f26bcd':
  DO NOT MERGE BLE Secuity manager state machine generate wrong pairing success event.

am ea8acc97: Merge "DO NOT MERGE fix a potential native crash during bluetooth sutdown" into klp-dev

* commit 'ea8acc97':
  DO NOT MERGE fix a potential native crash during bluetooth sutdown

* commit '1e0849e9':
  DO NOT MERGE the HID device state is out of sync after upair.

am 30466dfd: Merge "DO NOT MERGE Can only support two HID report instance for BLE HID." into klp-dev

* commit '30466dfd':
  DO NOT MERGE Can only support two HID report instance for BLE HID.

am 7a528bc8: Merge "DO NOT MERGE read report array out of boundary for BLE HID device." into klp-dev

* commit '7a528bc8':
  DO NOT MERGE read report array out of boundary for BLE HID device.

am c7dfda09: am 7a6fad89: Merge "DO NOT MERGE need to increase maximum number HID report for HOGP" into klp-dev

* commit 'c7dfda09':
  DO NOT MERGE need to increase maximum number HID report for HOGP

* commit 'af16d116':
  DO NOT MERGE trouble syncing with fitbit and can't turn off bluetooth.

* commit '7a6fad89':
  DO NOT MERGE need to increase maximum number HID report for HOGP

* commit '91f01220':
  DO NOT MERGE trouble syncing with fitbit and can't turn off bluetooth.

Merge "DO NOT MERGE BLE Secuity manager state machine generate wrong pairing success event." into klp-dev

this is to work around broadcom firmware problem to handle
unsolicited command complete event for HCI_LE_Create_Connection_Cancel
and LE connection complete event with status error code (0x2)
unknown connection identifier from bluetooth controller
the workaround is to release the HCI connection to avoid out of sync
with bluetooth controller, which cause BT can't be turned off.

bug:11614046
Change-Id: Ia5c5ad0c6c9b1a4f03253cac8a7caaf21341c88c

 we call smp_proc_release_delay to setup a timer.
We will send a pair failure message to uplayer after the time expired.
Right before the time expire, the l2cap connection is disconnected
from remote device, we receive L2C_DISC, which will call smp_delay_terminate,
 smp_delay_terminate will send a pair success message to uplayer.
The fix is not to change the status if the remote device disconnect the link

bug:11716967
Change-Id: I8ca63599a170ec86913785aafea552301cec37df

When bluetooth is initialized which call gki_buffer_init,
the buffer pool is allocated by GKI_os_malloc which is
to call libc malloc function.
When bluetooth is cleanup which call GKI_shutdown,
the buffer pool will be  freed by GKI_os_free
which is to call libc free function.
So if we access the buffer, after the whole buffer pool is freed,
we will get this native crash.
if we call cleanup during bluetooth disabling:
the state is still BTIF_CORE_STATE_DISABLING,
then GKI_shutdown will call before bte_main_disable
( bt_hc_if->cleanup();), which is  before userial thread exit.
Then we may trigger this native crash.

bug:11793775
Change-Id: Ic8ced12848d25f918a28f4d5ba29b803d6ac5bd7

the HID device state is out of sync between java layer and bluedroid stack after upair.
This will cause the HID device can't be connected after repair.
YOu can find the following error message
E/HidService( 1452): Hid Device not disconnected: 00:15:9E:20:29:41

bug:11718702
Change-Id: I271bb77a2cc205c5a0ef396db86b87902d29966b

The follwoing code cause this problem:
BTA_HH_LE_RPT_INST_ID_MAP(s,c)=(UINT8)(((s)<<4)||(c))
The code use || instead of |, this cause we can only generate
two instance HID report 0 and 1(false and true).

bug:12213520
Change-Id: If6b7cfd9633255401aef12aafd918ee147f256b6

report array out of boundary when read HID report reference
descriptor for BLE HID device.

bug:12208657
Change-Id: Ic60fd7555045f367b4fcd606510f52f60e36995e

The Mat mouse have more than 10 report (11),
which exceed our limitation

bug:12214036
Change-Id: Id578bf7959f73dc3bd57664eccf49ab5580ec76b

* commit '6ca1594d':
  DO NOT MERGE LE: Add service UUIDs and data to advertising data

* commit 'b74fe9e2':
  DO NOT MERGE LE: Add service UUIDs and data to advertising data

* commit 'f6918978':
  Add HID handshake_callback

Add support for UUIDs and custom service data in the advertising and
scan response records.

Cherry picking ble advertising changes from master to KLP MR2.
b/13137996

Change-Id: I6470427ad194871488cc90f3ab384b9ecf326b15

* commit 'be6d58f3':
  Fix GKI exception of calling free on an already freed buffer

* commit 'f9c6502a':
  Change some printfs in sdp_api.c to SDP_TRACE_DEBUG

It is called when the equivalent pkt is received from the HID
client as a normal response to set_report() and set_protocol_mode(),
and for errors for get_report() and get_protocol_mode().

Change-Id: I26ec37348e597f294f83907bbd256c88db5ac2ef
Signed-off-by: Mike J. Chen <mjchen@google.com>

Various parts of btif_hh.c were creating GKI buffers and
keeping references to them and freeing them in odd and
unnecessary ways.  The buffer is freed by lower levels
of the stack once the buffer has been sent to the chip
at the l2c layer and shouldn't be freed by btif_hh itself
since it's possible to double free, and there could
also be race conditions with other threads already processing
the buffer while the reference is freed if the API calls
are invoked again before the previous invocation was completely
processed.

Also added a helper routine to simplify buffer creation and
initialization.

Change-Id: Ia6039983502e2670b2325d90310244edf843b692
Signed-off-by: Mike J. Chen <mjchen@google.com>

The printfs were going to console, which is generally not useful
in Android.

Change-Id: I3b08247c916dc084dfb004ac71fe234d9a541927
Signed-off-by: Mike J. Chen <mjchen@google.com>

* commit '509b2d73':
  TARGET_SIMULATOR is long dead.

Change-Id: I6ba4a55c865370f12ae30f445661b54bbc714f8a

Change-Id: Idc42f72a94c205cfe94feb220651a483cf418e84