flags/sdp.aconfig

@@ -7,3 +7,13 @@ flag {
     description: "Check for NIL SDP property length"
     bug: "329171845"
 }
+
+flag {
+    name: "call_sdp_free_in_main_thread"
+    namespace: "bluetooth"
+    description: "Free SDP service in main thread instead of management thread"
+    bug: "415917037"
+    metadata {
+        purpose: PURPOSE_BUGFIX
+    }
+}

system/bta/le_audio/le_audio_types.h

@@ -313,7 +313,7 @@ constexpr uint16_t kLeAudioVendorCompanyIdUndefined = 0x00;
 constexpr uint16_t kLeAudioVendorCodecIdUndefined = 0x00;
 
 constexpr uint16_t kLeAudioVendorCompanyIdGoogle = 0x00E0;
-constexpr uint16_t kLeAudioVendorCodecIdHeadtracking = 0x0001;
+constexpr uint16_t kLeAudioVendorCodecIdHeadtracking = 0x0002;
 
 /* Metadata types from Assigned Numbers */
 constexpr uint8_t kLeAudioMetadataTypePreferredAudioContext = 0x01;

system/stack/btm/btm_ble_gap.cc

@@ -559,13 +559,11 @@ tBTM_STATUS BTM_BleObserve(bool start, uint8_t duration, tBTM_INQ_RESULTS_CB* p_
               (btm_cb.ble_ctr_cb.inq_var.scan_type == BTM_BLE_SCAN_MODE_NONE)
                       ? BTM_BLE_SCAN_MODE_ACTI
                       : btm_cb.ble_ctr_cb.inq_var.scan_type;
-      btm_send_hci_set_scan_params(btm_cb.ble_ctr_cb.inq_var.scan_type, (uint16_t)ll_scan_interval,
-                                   (uint8_t)ll_scan_window, (uint16_t)scan_phy,
-                                   btm_cb.ble_ctr_cb.inq_var.scan_interval_coded,
-                                   btm_cb.ble_ctr_cb.inq_var.scan_window_coded,
-                                   btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type,
-                                   BTM_BLE_DEFAULT_SFP);
-
+      btm_send_hci_set_scan_params(
+              btm_cb.ble_ctr_cb.inq_var.scan_type, (uint16_t)ll_scan_interval,
+              (uint8_t)ll_scan_window, btm_cb.ble_ctr_cb.inq_var.scan_interval_coded,
+              btm_cb.ble_ctr_cb.inq_var.scan_window_coded, (uint16_t)scan_phy,
+              btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type, BTM_BLE_DEFAULT_SFP);
       btm_ble_start_scan();
     }
 

system/stack/sdp/sdp_main.cc

@@ -313,7 +313,8 @@ tCONN_CB* sdp_conn_originate(const RawAddress& bd_addr) {
  ******************************************************************************/
 void sdp_disconnect(tCONN_CB* p_ccb, tSDP_REASON reason) {
   tCONN_CB& ccb = *p_ccb;
-  log::verbose("SDP - disconnect  CID: 0x{:x}", ccb.connection_id);
+  log::verbose("SDP - disconnect  CID: 0x{:x}, cbb.con_state: {}", ccb.connection_id,
+               sdp_state_text(ccb.con_state));
 
   /* Check if we have a connection ID */
   if (ccb.connection_id != 0) {
@@ -326,6 +327,15 @@ void sdp_disconnect(tCONN_CB* p_ccb, tSDP_REASON reason) {
       if (!stack::l2cap::get_interface().L2CA_DisconnectReq(ccb.connection_id)) {
         log::warn("Unable to disconnect L2CAP peer:{} cid:{}", ccb.device_address,
                   ccb.connection_id);
+      } else if (ccb.con_state == tSDP_STATE::CONN_PEND) {
+        /* If we successfully disconnect L2CAP, and there are no CCBs for that CID that are
+         * connected, clean up all CCBs */
+        tCONN_CB* o_ccb = sdpu_find_ccb_by_cid(ccb.connection_id);
+        if (o_ccb == nullptr || o_ccb->con_state == tSDP_STATE::CONN_SETUP) {
+          log::verbose("Successfully disconnected L2CAP, cleaning up CCBs for peer:{} cid:0x{:x}",
+                       ccb.device_address, ccb.connection_id);
+          sdpu_clear_all_ccbs_for_cid(ccb.connection_id);
+        }
       }
     }
   }

system/stack/sdp/sdp_utils.cc

@@ -568,6 +568,31 @@ void sdpu_clear_pend_ccb(const tCONN_CB& ccb) {
   return;
 }
 
+/*******************************************************************************
+ *
+ * Function         sdpu_clear_all_ccbs_for_cid
+ *
+ * Description      This function releases all sdp ccbs for given CID
+ *
+ *                  uint16_t : Remote CID
+ *
+ * Returns          returns none.
+ *
+ ******************************************************************************/
+void sdpu_clear_all_ccbs_for_cid(uint16_t cid) {
+  uint16_t xx;
+  tCONN_CB* p_ccb{};
+
+  // Look through each connection control block for active sdp on given cid
+  for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
+    if ((p_ccb->connection_id == cid) && (p_ccb->con_flags & SDP_FLAGS_IS_ORIG)) {
+      sdpu_callback(*p_ccb, tSDP_STATUS::SDP_CONN_FAILED);
+      sdpu_release_ccb(*p_ccb);
+    }
+  }
+  return;
+}
+
 /*******************************************************************************
  *
  * Function         sdpu_build_attrib_seq

system/stack/sdp/sdpint.h

@@ -289,6 +289,7 @@ uint16_t sdpu_get_active_ccb_cid(const RawAddress& bd_addr);
 bool sdpu_process_pend_ccb_same_cid(const tCONN_CB& ccb);
 bool sdpu_process_pend_ccb_new_cid(const tCONN_CB& ccb);
 void sdpu_clear_pend_ccb(const tCONN_CB& ccb);
+void sdpu_clear_all_ccbs_for_cid(uint16_t cid);
 void sdpu_callback(const tCONN_CB& ccb, tSDP_REASON reason);
 
 /* Functions provided by sdp_db.cc */

system/stack/test/sdp/stack_sdp_test.cc

@@ -482,3 +482,29 @@ TEST_F(StackSdpInitTest, SDP_Dumpsys_ccb) {
 
   SDP_Dumpsys(1);
 }
+
+TEST_F(StackSdpInitTest, sdp_cancel_pending_conn) {
+  EXPECT_CALL(mock_stack_l2cap_interface_, L2CA_ConnectReqWithSecurity(_, _, _))
+          .WillOnce(Invoke([](uint16_t /* psm */, const RawAddress& /* p_bd_addr */,
+                              uint16_t /* sec_level */) -> uint16_t {
+            return L2CA_ConnectReqWithSecurity_cid;
+          }));
+  EXPECT_CALL(mock_stack_l2cap_interface_, L2CA_DisconnectReq(_)).WillOnce(Return(true));
+
+  ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, nullptr));
+  const int cid = L2CA_ConnectReqWithSecurity_cid;
+  tCONN_CB* p_ccb1 = find_ccb(cid, tSDP_STATE::CONN_SETUP);
+  ASSERT_NE(p_ccb1, nullptr);
+  ASSERT_EQ(p_ccb1->con_state, tSDP_STATE::CONN_SETUP);
+
+  ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, nullptr));
+  tCONN_CB* p_ccb2 = find_ccb(cid, tSDP_STATE::CONN_PEND);
+  ASSERT_NE(p_ccb2, nullptr);
+  ASSERT_NE(p_ccb2, p_ccb1);
+  ASSERT_EQ(p_ccb2->con_state, tSDP_STATE::CONN_PEND);
+
+  // Cancel CCB that is pending connection, expect both CCBs to be idle
+  sdp_disconnect(p_ccb2, tSDP_STATUS::SDP_CANCEL);
+  ASSERT_EQ(p_ccb1->con_state, tSDP_STATE::IDLE);
+  ASSERT_EQ(p_ccb2->con_state, tSDP_STATE::IDLE);
+}