Merge tag 'LA.QSSI.13.0.r1-10000-qssi.0' into tachibana

"LA.QSSI.13.0.r1-10000-qssi.0"

Change-Id: I95f03a97f939a3f6309f06e33feffee509f5d557

28 files changed, 172 insertions, 73 deletions

diff --git a/audio_a2dp_hw/include/audio_a2dp_hw.h b/audio_a2dp_hw/include/audio_a2dp_hw.h
index 0d95c1b5b..fd92ee31a 100644
--- a/audio_a2dp_hw/include/audio_a2dp_hw.h
+++ b/audio_a2dp_hw/include/audio_a2dp_hw.h
@@ -139,7 +139,8 @@ typedef enum {
   A2DP_CTRL_ACK_PENDING,
   A2DP_CTRL_ACK_LONG_WAIT_ERR,
   A2DP_CTRL_ACK_UNKNOWN,
-  A2DP_CTRL_ACK_STREAM_SUSPENDED
+  A2DP_CTRL_ACK_STREAM_SUSPENDED,
+  A2DP_CTRL_ACK_SHORT_WAIT_ERR,
 } tA2DP_CTRL_ACK;
 
 typedef uint32_t tA2DP_SAMPLE_RATE;
diff --git a/audio_hal_interface/a2dp_encoding.cc b/audio_hal_interface/a2dp_encoding.cc
index c4a6692b2..b800e2803 100644
--- a/audio_hal_interface/a2dp_encoding.cc
+++ b/audio_hal_interface/a2dp_encoding.cc
@@ -407,6 +407,8 @@ BluetoothAudioCtrlAck a2dp_ack_to_bt_audio_ctrl_ack(tA2DP_CTRL_ACK ack) {
       return BluetoothAudioCtrlAck::FAILURE;
     case A2DP_CTRL_ACK_LONG_WAIT_ERR:
       return BluetoothAudioCtrlAck::FAILURE_LONG_WAIT;
+    case A2DP_CTRL_ACK_SHORT_WAIT_ERR:
+      return BluetoothAudioCtrlAck::FAILURE_SHORT_WAIT;
     default:
       return BluetoothAudioCtrlAck::FAILURE;
   }
@@ -1425,7 +1427,8 @@ bool a2dp_get_selected_hal_codec_config(CodecConfiguration* codec_config) {
   // Obtain the MTU
   codec_config->peerMtu = peer_param.peer_mtu - A2DP_HEADER_SIZE;
   if (A2DP_MEDIA_CT_SBC == codec_type) {
-    bitrate = A2DP_GetOffloadBitrateSbc(a2dp_codec_configs, peer_param.is_peer_edr);
+    bitrate = A2DP_GetOffloadBitrateSbc(a2dp_codec_configs, peer_param.is_peer_edr,
+                                        (const uint8_t*)p_codec_info);
     LOG(INFO) << __func__ << "SBC bitrate" << bitrate;
     codec_config->encodedAudioBitrate = bitrate * 1000;
   }
@@ -2135,7 +2138,8 @@ bool a2dp_get_selected_hal_codec_config_2_1(CodecConfiguration_2_1* codec_config
   // Obtain the MTU
   codec_config->peerMtu = peer_param.peer_mtu - A2DP_HEADER_SIZE;
   if (A2DP_MEDIA_CT_SBC == codec_type) {
-    bitrate = A2DP_GetOffloadBitrateSbc(a2dp_codec_configs, peer_param.is_peer_edr);
+    bitrate = A2DP_GetOffloadBitrateSbc(a2dp_codec_configs, peer_param.is_peer_edr,
+                                        (const uint8_t*)p_codec_info);
     LOG(INFO) << __func__ << "SBC bitrate" << bitrate;
     codec_config->encodedAudioBitrate = bitrate * 1000;
   }
diff --git a/audio_hal_interface/aidl/a2dp_encoding.cc b/audio_hal_interface/aidl/a2dp_encoding.cc
index 63c802e2b..36bfe8340 100644
--- a/audio_hal_interface/aidl/a2dp_encoding.cc
+++ b/audio_hal_interface/aidl/a2dp_encoding.cc
@@ -334,7 +334,8 @@ bool a2dp_get_selected_hal_codec_config(CodecConfiguration* codec_config) {
   codec_type = A2DP_GetCodecType((const uint8_t*)p_codec_info);
   codec_config->peerMtu = peer_param.peer_mtu - A2DP_HEADER_SIZE;
   if (A2DP_MEDIA_CT_SBC == codec_type) {
-    bitrate = A2DP_GetOffloadBitrateSbc(a2dp_config, peer_param.is_peer_edr);
+    bitrate = A2DP_GetOffloadBitrateSbc(a2dp_config, peer_param.is_peer_edr,
+                                        (const uint8_t*)p_codec_info);
     LOG(INFO) << __func__ << "AIDL SBC bitrate" << bitrate;
     codec_config->encodedAudioBitrate = bitrate * 1000;
   }  else if (A2DP_MEDIA_CT_NON_A2DP == codec_type) {
diff --git a/audio_hal_interface/client_interface.cc b/audio_hal_interface/client_interface.cc
index 480db4d29..0068b4a0e 100644
--- a/audio_hal_interface/client_interface.cc
+++ b/audio_hal_interface/client_interface.cc
@@ -63,6 +63,8 @@ std::ostream& operator<<(std::ostream& os, const BluetoothAudioCtrlAck& ack) {
       return os << "FAILURE";
     case BluetoothAudioCtrlAck::FAILURE_LONG_WAIT:
       return os << "FAILURE_LONG_WAIT";
+    case BluetoothAudioCtrlAck::FAILURE_SHORT_WAIT:
+      return os << "FAILURE_SHORT_WAIT";
     default:
       return os << "UNDEFINED " << static_cast<int8_t>(ack);
   }
diff --git a/audio_hal_interface/client_interface.h b/audio_hal_interface/client_interface.h
index 859ac86cc..981fd37f1 100644
--- a/audio_hal_interface/client_interface.h
+++ b/audio_hal_interface/client_interface.h
@@ -72,7 +72,8 @@ enum class BluetoothAudioCtrlAck : uint8_t {
   FAILURE_BUSY,
   FAILURE_DISCONNECTING,
   FAILURE,
-  FAILURE_LONG_WAIT
+  FAILURE_LONG_WAIT,
+  FAILURE_SHORT_WAIT,
 };
 
 std::ostream& operator<<(std::ostream& os, const BluetoothAudioCtrlAck& ack);
@@ -92,6 +93,8 @@ inline BluetoothAudioStatus BluetoothAudioCtrlAckToHalStatus(
       return BluetoothAudioStatus::FAILURE_DISC_IN_PROGRESS;
     case BluetoothAudioCtrlAck::FAILURE_LONG_WAIT:
       return BluetoothAudioStatus::LW_ERROR;
+    case BluetoothAudioCtrlAck::FAILURE_SHORT_WAIT:
+      return BluetoothAudioStatus::SW_ERROR;
     default:
       return BluetoothAudioStatus::FAILURE;
   }
diff --git a/bta/include/bta_jv_api.h b/bta/include/bta_jv_api.h
index 8a893c053..f4b108c3b 100644
--- a/bta/include/bta_jv_api.h
+++ b/bta/include/bta_jv_api.h
@@ -29,6 +29,7 @@
 #include "bta_api.h"
 #include "btm_api.h"
 #include "l2c_api.h"
+#include "gatt_api.h"
 
 /*****************************************************************************
  *  Constants and data types
@@ -427,7 +428,7 @@ void BTA_JvDisable(void);
  *                  false if not.
  *
  ******************************************************************************/
-bool BTA_JvIsEncrypted(const RawAddress& bd_addr);
+bool BTA_JvIsEncrypted(const RawAddress& bd_addr, tGATT_TRANSPORT transport_link);
 
 /*******************************************************************************
  *
diff --git a/bta/jv/bta_jv_api.cc b/bta/jv/bta_jv_api.cc
index cfeaa754f..f099cb829 100644
--- a/bta/jv/bta_jv_api.cc
+++ b/bta/jv/bta_jv_api.cc
@@ -117,15 +117,15 @@ void BTA_JvDisable(void) {
  *                  false if not.
  *
  ******************************************************************************/
-bool BTA_JvIsEncrypted(const RawAddress& bd_addr) {
+bool BTA_JvIsEncrypted(const RawAddress& bd_addr, tGATT_TRANSPORT transport_link) {
   bool is_encrypted = false;
-  uint8_t sec_flags, le_flags;
+  uint8_t sec_flags = 0x00;
 
-  if (BTM_GetSecurityFlags(bd_addr, &sec_flags) &&
-      BTM_GetSecurityFlagsByTransport(bd_addr, &le_flags, BT_TRANSPORT_LE)) {
-    if (sec_flags & BTM_SEC_FLAG_ENCRYPTED || le_flags & BTM_SEC_FLAG_ENCRYPTED)
-      is_encrypted = true;
-  }
+    if (BTM_GetSecurityFlagsByTransport(bd_addr, &sec_flags, transport_link)) {
+    if (sec_flags & BTM_SEC_FLAG_ENCRYPTED) {
+        is_encrypted = true;
+      }
+    }
   return is_encrypted;
 }
 /*******************************************************************************
diff --git a/btif/co/bta_av_co.cc b/btif/co/bta_av_co.cc
index cd978784a..9cf645846 100644
--- a/btif/co/bta_av_co.cc
+++ b/btif/co/bta_av_co.cc
@@ -798,10 +798,13 @@ void bta_av_co_audio_setconfig(tBTA_AV_HNDL hndl, const uint8_t* p_codec_info,
     if (!codec_config_supported) {
       category = AVDT_ASC_CODEC;
       status = A2DP_WRONG_CODEC;
+    } else {
+      status = A2dp_IsCodecConfigMatch(p_codec_info);
+      APPL_TRACE_DEBUG("%s: after setotaconfig call cfg match for codec %s", __func__,
+                         A2DP_CodecName(p_codec_info));
     }
   }
 
-  status = A2dp_IsCodecConfigMatch(p_codec_info);
   error_code = A2dp_SendSetConfigRspErrorCodeForPTS();
 
   APPL_TRACE_DEBUG("%s: status : %d, error_code: %d",
@@ -1265,9 +1268,21 @@ static bool bta_av_co_check_peer_eligible_for_aac_codec(
     vndr_prdt_ver_present = true;
   }
   if (vndr_prdt_ver_present && (vendor == A2DP_AAC_BOSE_VENDOR_ID)) {
-    APPL_TRACE_DEBUG("%s: vendor id info matches ", __func__);
+    APPL_TRACE_DEBUG("%s: vendor id info matches to BOSE vendor ", __func__);
     vndr_prdt_ver_present = false;
     aac_support = true;
+    if (bta_av_co_audio_device_addr_check_is_enabled(&p_peer->addr)) {
+      if (interop_match_addr_or_name(INTEROP_DISABLE_AAC_CODEC, &p_peer->addr)) {
+        APPL_TRACE_DEBUG("AAC is not supported for this BL BOSE remote device");
+        aac_support = false;
+      }
+    } else {
+      if (btif_storage_get_stored_remote_name(p_peer->addr, remote_name) &&
+          interop_match_name(INTEROP_DISABLE_AAC_CODEC, remote_name)) {
+        APPL_TRACE_DEBUG("AAC is not supported for this BL BOSE remote device");
+        aac_support = false;
+      }
+    }
   } else if (vndr_prdt_ver_present && interop_database_match_version(INTEROP_ENABLE_AAC_CODEC, version) &&
       interop_match_vendor_product_ids(INTEROP_ENABLE_AAC_CODEC, vendor, product)) {
     APPL_TRACE_DEBUG("%s: vendor id, product id and version info matching with conf file", __func__);
diff --git a/btif/src/btif_a2dp_audio_interface.cc b/btif/src/btif_a2dp_audio_interface.cc
index e27246416..355f077fd 100644
--- a/btif/src/btif_a2dp_audio_interface.cc
+++ b/btif/src/btif_a2dp_audio_interface.cc
@@ -816,7 +816,8 @@ uint8_t btif_a2dp_audio_process_request(uint8_t cmd)
         peer_param.peer_mtu = peer_param.peer_mtu - A2DP_HEADER_SIZE;
         if (A2DP_MEDIA_CT_SBC == codec_type)
         {
-          bitrate = A2DP_GetOffloadBitrateSbc(CodecConfig, peer_param.is_peer_edr);
+          bitrate = A2DP_GetOffloadBitrateSbc(CodecConfig, peer_param.is_peer_edr,
+                                              (const uint8_t*)p_codec_info);
           LOG_INFO(LOG_TAG,"bitrate = %d", bitrate);
           bitrate *= 1000;
         }
@@ -1263,7 +1264,8 @@ uint8_t btif_a2dp_audio_process_request(uint8_t cmd)
         peer_param.peer_mtu = peer_param.peer_mtu - A2DP_HEADER_SIZE;
         if (A2DP_MEDIA_CT_SBC == codec_type)
         {
-          bitrate = A2DP_GetOffloadBitrateSbc(CodecConfig, peer_param.is_peer_edr);
+          bitrate = A2DP_GetOffloadBitrateSbc(CodecConfig, peer_param.is_peer_edr,
+                                              (const uint8_t*)p_codec_info);
           LOG_INFO(LOG_TAG,"bitrate = %d", bitrate);
           bitrate *= 1000;
         }
diff --git a/btif/src/btif_av.cc b/btif/src/btif_av.cc
index 2eadc236c..c10290cfa 100644
--- a/btif/src/btif_av.cc
+++ b/btif/src/btif_av.cc
@@ -4876,7 +4876,12 @@ static bt_status_t set_active_device(const RawAddress& bd_addr) {
     if (!bd_addr.IsEmpty())
       btif_transfer_context(btif_av_handle_event, BTIF_AV_CHECK_PENDING_PLAY_EVT,
                                     (char *)&bd_addr, sizeof(RawAddress), NULL);
-    return BT_STATUS_SUCCESS;
+    BTIF_TRACE_EVENT("%s: session_wait: %d",__func__, session_wait);
+    if (session_wait) {
+      return BT_STATUS_SUCCESS;
+    } else {
+      return BT_STATUS_FAIL;
+    }
   } else {
     /* Initiate handoff for the device with address in the argument*/
     return btif_transfer_context(btif_av_handle_event,
@@ -6854,7 +6859,7 @@ int64_t btif_get_average_delay() {
 ** Returns          bool
 *******************************************************************************/
 bool btif_device_in_sink_role() {
-    char a2dp_role[6] = "false";
+    char a2dp_role[255] = "false";
     osi_property_get("persist.vendor.service.bt.a2dp.sink", a2dp_role, "false");
     if (strncmp("true", a2dp_role, 4) == 0){
         BTIF_TRACE_EVENT("%s: SINK role true ",__func__);
@@ -6967,7 +6972,7 @@ void btif_av_set_remote_playing_state(int index, bool playing_state) {
 *******************************************************************************/
 int btif_get_max_allowable_sink_connections() {
     int def_no_of_conn = 1;
-    char number_of_conn[2];
+    char number_of_conn[255];
     osi_property_get("persist.vendor.bt.a2dp.sink_conn", number_of_conn, "1");
     BTIF_TRACE_DEBUG("%s, number_of_conn = %s", __func__, number_of_conn);
     if (!strncmp(number_of_conn, "2", 1)) {
diff --git a/btif/src/btif_dm.cc b/btif/src/btif_dm.cc
index 095baba19..785a089e7 100644
--- a/btif/src/btif_dm.cc
+++ b/btif/src/btif_dm.cc
@@ -1844,11 +1844,14 @@ static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
           /* When SDP failed, deleting bonded device from the database and sending
           * disconnect before moving bond state to BOND NONE.
           */
-          BTIF_TRACE_WARNING("%s: deleting bonded device from database", __func__);
-          btif_storage_remove_bonded_device(&bd_addr);
-          BTA_DmRemoveDevice(bd_addr);
-          pairing_cb.sdp_attempts = 0;
-          bond_state_changed(BT_STATUS_FAIL, pairing_cb.bd_addr, BT_BOND_STATE_NONE);
+          if (!interop_match_addr_or_name(
+              INTEROP_SEND_BONDED_INTENT_AFTER_SDP_TIMEOUT, &bd_addr)) {
+            BTIF_TRACE_WARNING("%s: deleting bonded device from database", __func__);
+            btif_storage_remove_bonded_device(&bd_addr);
+            BTA_DmRemoveDevice(bd_addr);
+            pairing_cb.sdp_attempts = 0;
+            bond_state_changed(BT_STATUS_FAIL, pairing_cb.bd_addr, BT_BOND_STATE_NONE);
+          }
           return;
         }
       }
diff --git a/btif/src/btif_gatt_util.cc b/btif/src/btif_gatt_util.cc
index 6be1cb238..4ae77953d 100644
--- a/btif/src/btif_gatt_util.cc
+++ b/btif/src/btif_gatt_util.cc
@@ -58,8 +58,10 @@ void btif_to_bta_response(tGATTS_RSP* p_dest, btgatt_response_t* p_src) {
  ******************************************************************************/
 
 #if (BLE_DELAY_REQUEST_ENC == FALSE)
-static bool btif_gatt_is_link_encrypted(const RawAddress& bd_addr) {
-  return BTA_JvIsEncrypted(bd_addr);
+static bool btif_gatt_is_link_encrypted(const RawAddress& bd_addr,
+                                        tGATT_TRANSPORT transport_link) {
+  BTIF_TRACE_DEBUG(" Starting  of %s: ", __func__);
+  return BTA_JvIsEncrypted(bd_addr, transport_link);
 }
 
 static void btif_gatt_set_encryption_cb(UNUSED_ATTR const RawAddress& bd_addr,
@@ -75,11 +77,15 @@ static void btif_gatt_set_encryption_cb(UNUSED_ATTR const RawAddress& bd_addr,
 void btif_gatt_check_encrypted_link(RawAddress bd_addr,
                                     tGATT_TRANSPORT transport_link) {
   tBTM_LE_PENC_KEYS key;
+  BTIF_TRACE_DEBUG(" Starting  of %s: transport = %d", __func__,
+                   transport_link);
   if ((btif_storage_get_ble_bonding_key(
            &bd_addr, BTIF_DM_LE_KEY_PENC, (uint8_t*)&key,
            sizeof(tBTM_LE_PENC_KEYS)) == BT_STATUS_SUCCESS) &&
-      !btif_gatt_is_link_encrypted(bd_addr)) {
-    BTIF_TRACE_DEBUG("%s: transport = %d", __func__, transport_link);
+      !btif_gatt_is_link_encrypted(bd_addr, transport_link)) {
+    BTIF_TRACE_DEBUG(
+        "%s: link is not encrypted, trigger Encryption transport = %d",
+        __func__, transport_link);
     BTA_DmSetEncryption(bd_addr, transport_link, &btif_gatt_set_encryption_cb,
                         BTM_BLE_SEC_ENCRYPT);
   }
diff --git a/btif/src/btif_rc.cc b/btif/src/btif_rc.cc
index 650f69b54..a9b269add 100644
--- a/btif/src/btif_rc.cc
+++ b/btif/src/btif_rc.cc
@@ -3121,6 +3121,11 @@ static bt_status_t register_notification_rsp(
                    dump_rc_notification_event_id(event_id));
   std::unique_lock<std::mutex> lock(btif_rc_cb.lock);
 
+  if (event_id > MAX_RC_NOTIFICATIONS) {
+    BTIF_TRACE_ERROR("Invalid event id");
+    return BT_STATUS_PARM_INVALID;
+  }
+
   memset(&(avrc_rsp.reg_notif), 0, sizeof(tAVRC_REG_NOTIF_RSP));
 
   avrc_rsp.reg_notif.event_id = event_id;
diff --git a/device/include/interop.h b/device/include/interop.h
index f188cec0b..c99d44442 100644
--- a/device/include/interop.h
+++ b/device/include/interop.h
@@ -309,6 +309,10 @@ typedef enum {
   // interop list.
   INTEROP_SKIP_ROBUST_CACHING_READ,
 
+  // Some dual-mode remote devices always failed to respond to sdp request.
+  // Send out the bonded intent after 3s timeout if sdp is still not finished.
+  INTEROP_SEND_BONDED_INTENT_AFTER_SDP_TIMEOUT,
+
   END_OF_INTEROP_LIST
 } interop_feature_t;
 
diff --git a/stack/a2dp/a2dp_sbc.cc b/stack/a2dp/a2dp_sbc.cc
index 8b61db886..743b173bd 100644
--- a/stack/a2dp/a2dp_sbc.cc
+++ b/stack/a2dp/a2dp_sbc.cc
@@ -746,8 +746,9 @@ int A2DP_GetMaxBitpoolSbc(const uint8_t* p_codec_info) {
   return sbc_cie.max_bitpool;
 }
 
-uint16_t A2DP_GetOffloadBitrateSbc(A2dpCodecConfig* a2dp_codec_config, bool peer_edr) {
-  return a2dp_sbc_calulate_offload_bitrate(a2dp_codec_config, peer_edr);
+uint16_t A2DP_GetOffloadBitrateSbc(A2dpCodecConfig* a2dp_codec_config, bool peer_edr,
+                                   const uint8_t* p_codec_info) {
+  return a2dp_sbc_calulate_offload_bitrate(a2dp_codec_config, peer_edr, p_codec_info);
 }
 int A2DP_GetSinkTrackChannelTypeSbc(const uint8_t* p_codec_info) {
   tA2DP_SBC_CIE sbc_cie;
diff --git a/stack/a2dp/a2dp_sbc_encoder.cc b/stack/a2dp/a2dp_sbc_encoder.cc
index d84bc88da..67c909f2d 100644
--- a/stack/a2dp/a2dp_sbc_encoder.cc
+++ b/stack/a2dp/a2dp_sbc_encoder.cc
@@ -955,8 +955,8 @@ static uint32_t a2dp_sbc_frame_length(void) {
   return frame_len;
 }
 
-uint16_t a2dp_sbc_calulate_offload_bitrate(A2dpCodecConfig* a2dp_codec_config, bool is_peer_edr) {
-  uint8_t codec_info[AVDT_CODEC_SIZE];
+uint16_t a2dp_sbc_calulate_offload_bitrate(A2dpCodecConfig* a2dp_codec_config, bool is_peer_edr,
+                                           const uint8_t *p_codec_info) {
   uint16_t s16SamplingFreq,sample_rate;
   int16_t s16BitPool = 0;
   int16_t s16BitRate;
@@ -969,14 +969,7 @@ uint16_t a2dp_sbc_calulate_offload_bitrate(A2dpCodecConfig* a2dp_codec_config, b
   uint16_t s16AllocationMethod, s16NumOfChannels;
   uint16_t offload_bitrate;
   LOG_ERROR(LOG_TAG,"%s is peer edr = %d",__func__, is_peer_edr);
-  if (!a2dp_codec_config->copyOutOtaCodecConfig(codec_info)) {
-    LOG_ERROR(LOG_TAG,
-              "%s: Cannot update the codec encoder for %s: "
-              "invalid codec config",
-              __func__, a2dp_codec_config->name().c_str());
-    return 0;
-  }
-  const uint8_t* p_codec_info = codec_info;
+
   min_bitpool = A2DP_GetMinBitpoolSbc(p_codec_info);
   max_bitpool = A2DP_GetMaxBitpoolSbc(p_codec_info);
   // The feeding parameters
@@ -1066,11 +1059,6 @@ uint16_t a2dp_sbc_calulate_offload_bitrate(A2dpCodecConfig* a2dp_codec_config, b
                     (((32 / s16NumOfChannels) +
                       (4 * s16NumOfSubBands)) /
                      s16NumOfBlocks));
-
-     //uint16_t m16BitPool =
-     //    (s16BitPool > (16 * s16NumOfSubBands))
-     //        ? (16 * s16NumOfSubBands)
-     //        : s16BitPool;
     }
 
     if (s16BitPool < 0) s16BitPool = 0;
diff --git a/stack/a2dp/a2dp_vendor.cc b/stack/a2dp/a2dp_vendor.cc
index b55913494..6bd92e25b 100644
--- a/stack/a2dp/a2dp_vendor.cc
+++ b/stack/a2dp/a2dp_vendor.cc
@@ -815,8 +815,14 @@ tA2DP_STATUS A2DP_VendorIsCodecConfigMatch(const uint8_t* p_codec_info) {
     return A2DP_VendorIsCodecConfigMatchLdac(p_codec_info);
   }
 
+  // Check for AptX-Adaptive
+  if (vendor_id == A2DP_APTX_ADAPTIVE_VENDOR_ID &&
+      codec_id == A2DP_APTX_ADAPTIVE_CODEC_ID_BLUETOOTH) {
+    LOG_DEBUG(LOG_TAG, "%s: checking for Aptx-Adaptive codecConfig match", __func__);
+    return A2DP_VendorIsCodecConfigMatchAptxAdaptive(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return false;
 }
-
diff --git a/stack/a2dp/a2dp_vendor_aptx_adaptive.cc b/stack/a2dp/a2dp_vendor_aptx_adaptive.cc
index 8e21f155f..b04b58e44 100644
--- a/stack/a2dp/a2dp_vendor_aptx_adaptive.cc
+++ b/stack/a2dp/a2dp_vendor_aptx_adaptive.cc
@@ -736,6 +736,16 @@ bool A2DP_VendorAdjustCodecAptxAdaptive(uint8_t* p_codec_info) {
   return true;
 }
 
+tA2DP_STATUS A2DP_VendorIsCodecConfigMatchAptxAdaptive(const uint8_t* p_codec_info) {
+  tA2DP_APTX_ADAPTIVE_CIE aptx_adaptive_cie;
+
+  LOG_DEBUG(LOG_TAG, "%s", __func__);
+  tA2DP_STATUS a2dp_status =
+      A2DP_ParseInfoAptxAdaptive(&aptx_adaptive_cie, p_codec_info, false);
+  LOG_DEBUG(LOG_TAG, "%s: a2dp_status: %d", __func__, a2dp_status);
+  return a2dp_status;
+}
+
 btav_a2dp_codec_index_t A2DP_VendorSourceCodecIndexAptxAdaptive(
     const uint8_t* p_codec_info) {
   return BTAV_A2DP_CODEC_INDEX_SOURCE_APTX_ADAPTIVE;
diff --git a/stack/avdt/avdt_ccb_act.cc b/stack/avdt/avdt_ccb_act.cc
index 717165c61..e92c5dad4 100644
--- a/stack/avdt/avdt_ccb_act.cc
+++ b/stack/avdt/avdt_ccb_act.cc
@@ -180,9 +180,21 @@ bool avdt_ccb_check_peer_eligible_for_aac_codec(tAVDT_CCB* p_ccb) {
     vndr_prdt_ver_present = true;
   }
   if (vndr_prdt_ver_present && (vendor == A2DP_AAC_BOSE_VENDOR_ID)) {
-    APPL_TRACE_DEBUG("%s: vendor id info matches ", __func__);
+    APPL_TRACE_DEBUG("%s: vendor id info matches BOSE vendor ", __func__);
     vndr_prdt_ver_present = false;
     aac_support = true;
+    if (bta_av_co_audio_device_addr_check_is_enabled(&p_ccb->peer_addr)) {
+      if (interop_match_addr_or_name(INTEROP_DISABLE_AAC_CODEC, &p_ccb->peer_addr)) {
+        AVDT_TRACE_EVENT("%s: bose device is BL, skipping AAC advertise\n", __func__);
+        aac_support = false;
+      }
+    } else {
+      if (btif_storage_get_stored_remote_name(p_ccb->peer_addr, remote_name) &&
+          interop_match_name(INTEROP_DISABLE_AAC_CODEC, remote_name)) {
+        AVDT_TRACE_EVENT("%s: bose device is BL, skipping AAC advertise\n", __func__);
+        aac_support = false;
+      }
+    }
   } else if (vndr_prdt_ver_present &&
       interop_match_vendor_product_ids(INTEROP_ENABLE_AAC_CODEC, vendor, product) &&
       interop_database_match_version(INTEROP_ENABLE_AAC_CODEC, version)) {
diff --git a/stack/avdt/avdt_scb_act.cc b/stack/avdt/avdt_scb_act.cc
index fc354068a..9606f5383 100644
--- a/stack/avdt/avdt_scb_act.cc
+++ b/stack/avdt/avdt_scb_act.cc
@@ -282,7 +282,7 @@ void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB* p_scb, tAVDT_SCB_EVT* p_data) {
     p += ex_len * 4;
   }
 
-  if ((p - p_start) > len) {
+  if ((p - p_start) >= len) {
     android_errorWriteLog(0x534e4554, "142546355");
     osi_free_and_reset((void**)&p_data->p_pkt);
     return;
@@ -292,11 +292,11 @@ void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB* p_scb, tAVDT_SCB_EVT* p_data) {
   /* adjust length for any padding at end of packet */
   if (o_p) {
     /* padding length in last byte of packet */
-    pad_len = *(p_start + len);
+    pad_len = *(p_start + len - 1);
   }
 
   /* do sanity check */
-  if (pad_len > (len - offset)) {
+  if (pad_len >= (len - offset)) {
     AVDT_TRACE_WARNING("Got bad media packet");
     osi_free_and_reset((void**)&p_data->p_pkt);
   }
diff --git a/stack/btm/btm_acl.cc b/stack/btm/btm_acl.cc
index eb8b530ce..4462dd6a1 100644
--- a/stack/btm/btm_acl.cc
+++ b/stack/btm/btm_acl.cc
@@ -58,6 +58,7 @@
 #include "controller.h"
 #include <btcommon_interface_defs.h>
 #include "btif/include/btif_config.h"
+#include "stack/gatt/gatt_int.h"
 
 static void btm_read_remote_features(uint16_t handle);
 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
@@ -1050,6 +1051,20 @@ void btm_read_remote_version_complete(uint8_t* p) {
       if (p_acl_cb->transport == BT_TRANSPORT_LE) {
         l2cble_notify_le_connection(p_acl_cb->remote_addr);
         btm_use_preferred_conn_params(p_acl_cb->remote_addr);
+        if ((p_acl_cb->lmp_version >= HCI_PROTO_VERSION_5_1)
+            && gatt_is_robust_caching_enabled()) {
+          bool skip_caching_enable = false;
+          BD_NAME bd_name;
+          if (BTM_GetRemoteDeviceName(p_acl_cb->remote_addr, bd_name)) {
+            if (interop_database_match_name(INTEROP_SKIP_ROBUST_CACHING_READ, (char*) bd_name)) {
+              skip_caching_enable = true;
+            }
+          }
+          VLOG(1) << __func__ << " skip_caching_enable:" << +skip_caching_enable;
+          if (!skip_caching_enable) {
+            GATT_EnableRobustCaching(p_acl_cb->remote_addr, BT_TRANSPORT_LE);
+          }
+        }
       }
         VLOG(2) << __func__ << " btm_read_remote_version_complete: BDA: " << p_acl_cb->remote_addr;
         BTM_TRACE_WARNING ("btm_read_remote_version_complete lmp_version %d manufacturer %d lmp_subversion %d",
diff --git a/stack/btm/btm_ble_gap.cc b/stack/btm/btm_ble_gap.cc
index 345e10ed1..fd94a503a 100644
--- a/stack/btm/btm_ble_gap.cc
+++ b/stack/btm/btm_ble_gap.cc
@@ -1011,6 +1011,10 @@ void btm_ble_start_sync_request(uint8_t sid, RawAddress addr, uint16_t skip, uin
   uint8_t options = 0;
   uint8_t cte_type = 7;
   int index = btm_ble_get_psync_index(sid, addr);
+  if (index == MAX_SYNC_TRANSACTION) {
+      BTM_TRACE_ERROR("[PSync]%s: index not found", __func__);
+      return;
+  }
   tBTM_BLE_PERIODIC_SYNC *p = &btm_ble_pa_sync_cb.p_sync[index];
   p->sync_state = PERIODIC_SYNC_PENDING;
   btsnd_hcic_ble_create_periodic_sync(options, sid, address_type, addr, skip, timeout,cte_type);
@@ -1076,6 +1080,10 @@ static void btm_ble_start_sync_timeout(void *data) {
   RawAddress address = p_head->address;
 
   int index = btm_ble_get_psync_index(adv_sid, address);
+  if (index == MAX_SYNC_TRANSACTION) {
+      BTM_TRACE_ERROR("[PSync]%s: index not found", __func__);
+      return;
+  }
 
   tBTM_BLE_PERIODIC_SYNC *p = &btm_ble_pa_sync_cb.p_sync[index];
 
@@ -1253,11 +1261,19 @@ void btm_ble_periodic_adv_sync_lost(uint8_t *param, uint16_t param_len) {
   uint16_t sync_handle;
   if (param_len != SYNC_LOST_EVT_LEN) {
     BTM_TRACE_ERROR("[PSync]%s: Invalid event length",__func__);
+    return;
   }
   STREAM_TO_UINT16(sync_handle, param);
+  BTM_TRACE_DEBUG("[PSync]%s: sync_handle = %d", __func__, sync_handle);
   int index = btm_ble_get_psync_index_from_handle(sync_handle);
+  if (index == MAX_SYNC_TRANSACTION) {
+      BTM_TRACE_ERROR("[PSync]%s: index not found", __func__);
+      return;
+  }
   tBTM_BLE_PERIODIC_SYNC *ps = &btm_ble_pa_sync_cb.p_sync[index];
-  ps->sync_lost_cb.Run(sync_handle);
+  if (ps->sync_lost_cb) {
+      ps->sync_lost_cb.Run(sync_handle);
+  }
 
   ps->in_use = false;
   ps->sid = 0;
@@ -1415,6 +1431,11 @@ void BTM_BlePeriodicSyncTransfer(RawAddress addr, uint16_t service_data,
   }
 
   int index = btm_ble_get_free_sync_transfer_index();
+  if (index == MAX_SYNC_TRANSACTION) {
+      BTM_TRACE_ERROR("[PSync]%s: index is unavailable", __func__);
+      cb.Run(BTM_NO_RESOURCES, addr);
+      return;
+  }
   tBTM_BLE_PERIODIC_SYNC_TRANSFER *p_sync_transfer = &btm_ble_pa_sync_cb.sync_transfer[index];
   p_sync_transfer->in_use = true;
   p_sync_transfer->conn_handle = conn_handle;
@@ -1449,6 +1470,11 @@ void BTM_BlePeriodicSyncSetInfo(RawAddress addr, uint16_t service_data,
   }
 
   int index = btm_ble_get_free_sync_transfer_index();
+  if (index == MAX_SYNC_TRANSACTION) {
+      BTM_TRACE_ERROR("[PSync]%s: index is unavailable", __func__);
+      cb.Run(BTM_NO_RESOURCES, addr);
+      return;
+  }
   tBTM_BLE_PERIODIC_SYNC_TRANSFER *p_sync_transfer = &btm_ble_pa_sync_cb.sync_transfer[index];
   p_sync_transfer->in_use = true;
   p_sync_transfer->conn_handle = conn_handle;
diff --git a/stack/gatt/gatt_main.cc b/stack/gatt/gatt_main.cc
index a3fa189c2..71880b787 100644
--- a/stack/gatt/gatt_main.cc
+++ b/stack/gatt/gatt_main.cc
@@ -721,23 +721,6 @@ static void gatt_le_connect_cback(uint16_t chan, const RawAddress& bd_addr,
     }
   }
 
-  if (gatt_is_robust_caching_enabled()) {
-    bool skip_caching_enable = false;
-    BD_NAME bd_name;
-    VLOG(1) << StringPrintf("[%s] BTM_GetRemoteDeviceName: %s", __func__, bd_addr.ToString().c_str());
-    if (BTM_GetRemoteDeviceName(bd_addr, bd_name)) {
-      VLOG(1) << StringPrintf("[%s] FileDB Device name: %s", __func__, bd_name);
-      if (interop_database_match_name(INTEROP_SKIP_ROBUST_CACHING_READ, (char*) bd_name)) {
-        VLOG(1) << StringPrintf("[%s] Skip GATT_EnableRobustCaching", __func__);
-        skip_caching_enable = true;
-      }
-    }
-    VLOG(1) << StringPrintf("[%s] skip_caching_enable: %d", __func__, skip_caching_enable);
-    if (!skip_caching_enable) {
-      GATT_EnableRobustCaching(bd_addr, BT_TRANSPORT_LE);
-    }
-  }
-
 }
 
 /** This function is called to process the congestion callback from lcb */
diff --git a/stack/include/a2dp_sbc.h b/stack/include/a2dp_sbc.h
index 1902b1b5c..3b9d0cf3c 100644
--- a/stack/include/a2dp_sbc.h
+++ b/stack/include/a2dp_sbc.h
@@ -261,8 +261,10 @@ bool A2DP_InitCodecConfigSbcSink(tAVDT_CFG* p_cfg);
 // Get SBC bitrate for offload mode
 // |config| contains codec info
 // |is_peer_edr| flag is true if peer is edr else false
+// |p_codec_info| contains codec param info
 // Returns |uint16_t| bitrate value
-uint16_t A2DP_GetOffloadBitrateSbc(A2dpCodecConfig* config, bool is_peer_edr);
+uint16_t A2DP_GetOffloadBitrateSbc(A2dpCodecConfig* config, bool is_peer_edr,
+                                   const uint8_t* p_codec_info);
 
 // Checks peer initiated setconfig with DUT supported config
 // and returns proper status.
diff --git a/stack/include/a2dp_sbc_encoder.h b/stack/include/a2dp_sbc_encoder.h
index 79c66f53a..86402efdb 100644
--- a/stack/include/a2dp_sbc_encoder.h
+++ b/stack/include/a2dp_sbc_encoder.h
@@ -65,5 +65,5 @@ void a2dp_sbc_send_frames(uint64_t timestamp_us);
 // |peer_edr| flag for peer supports edr
 // Returns |uint16_t| calculated bitrare
 uint16_t a2dp_sbc_calulate_offload_bitrate(A2dpCodecConfig* a2dp_codec_config,
-                                           bool peer_edr);
+                                           bool peer_edr, const uint8_t* p_codec_info);
 #endif  // A2DP_SBC_ENCODER_H
diff --git a/stack/include/a2dp_vendor_aptx_adaptive.h b/stack/include/a2dp_vendor_aptx_adaptive.h
index ff574ada4..2b70fec1a 100644
--- a/stack/include/a2dp_vendor_aptx_adaptive.h
+++ b/stack/include/a2dp_vendor_aptx_adaptive.h
@@ -206,4 +206,8 @@ const char* A2DP_VendorCodecIndexStrAptxAdaptive(void);
 // configuration entry pointed by |p_cfg|.
 bool A2DP_VendorInitCodecConfigAptxAdaptive(tAVDT_CFG* p_cfg);
 
+// Checks peer initiated setconfig with DUT supported config
+// and returns proper status.
+tA2DP_STATUS A2DP_VendorIsCodecConfigMatchAptxAdaptive(const uint8_t* p_codec_info);
+
 #endif  // A2DP_VENDOR_APTX_ADAPTIVE_H
diff --git a/stack/l2cap/l2c_main.cc b/stack/l2cap/l2c_main.cc
index ac9a51a6a..06c2b4e94 100644
--- a/stack/l2cap/l2c_main.cc
+++ b/stack/l2cap/l2c_main.cc
@@ -394,8 +394,8 @@ static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
             android_errorWriteLog(0x534e4554, "74202041");
             return;
           }
-          STREAM_TO_UINT16(rcid, p);
           STREAM_TO_UINT16(lcid, p);
+          STREAM_TO_UINT16(rcid, p);
 
           L2CAP_TRACE_WARNING(
               "L2CAP - rej with CID invalid, LCID: 0x%04x RCID: 0x%04x", lcid,
diff --git a/stack/sdp/sdp_server.cc b/stack/sdp/sdp_server.cc
index 6aea47b4d..003a818af 100644
--- a/stack/sdp/sdp_server.cc
+++ b/stack/sdp/sdp_server.cc
@@ -223,7 +223,7 @@ int sdp_get_stored_avrc_tg_version(RawAddress addr)
     uint16_t avrcp_features = 0;
     SDP_TRACE_DEBUG("%s target BD Addr: %s",\
              __func__, addr.ToString().c_str());
-    char pts_property[6];
+    char pts_property[PROPERTY_VALUE_MAX] = {0};
     int pts_avrcp_version;
     osi_property_get(SDP_ENABLE_PTS_AVRCP, pts_property, "false");
     if (!strncmp("true", pts_property, 4)) {