Merge "Check the service is in the supported profile list instead of using system property" into tm-d1-dev
diff --git a/OWNERS b/OWNERS
index 2d3b648..02b536d 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,6 +1,7 @@
 # Project owners
 sattiraju@google.com
 siyuanh@google.com
+sungsoo@google.com
 zachoverflow@google.com
 
 # Per-file ownership
diff --git a/android/app/jni/com_android_bluetooth_gatt.cpp b/android/app/jni/com_android_bluetooth_gatt.cpp
index 2942ab1..963eb56 100644
--- a/android/app/jni/com_android_bluetooth_gatt.cpp
+++ b/android/app/jni/com_android_bluetooth_gatt.cpp
@@ -312,14 +312,8 @@
   if (!sCallbackEnv.valid()) return;
 
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(), NULL);
-  if (status == 0) {  // Success
-    jb.reset(sCallbackEnv->NewByteArray(len));
-    sCallbackEnv->SetByteArrayRegion(jb.get(), 0, len, (jbyte*)value);
-  } else {
-    uint8_t value = 0;
-    jb.reset(sCallbackEnv->NewByteArray(1));
-    sCallbackEnv->SetByteArrayRegion(jb.get(), 0, 1, (jbyte*)&value);
-  }
+  jb.reset(sCallbackEnv->NewByteArray(len));
+  sCallbackEnv->SetByteArrayRegion(jb.get(), 0, len, (jbyte*)value);
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onWriteCharacteristic,
                                conn_id, status, handle, jb.get());
 }
@@ -356,14 +350,8 @@
   if (!sCallbackEnv.valid()) return;
 
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(), NULL);
-  if (status == 0) {  // Success
-    jb.reset(sCallbackEnv->NewByteArray(len));
-    sCallbackEnv->SetByteArrayRegion(jb.get(), 0, len, (jbyte*)value);
-  } else {
-    uint8_t value = 0;
-    jb.reset(sCallbackEnv->NewByteArray(1));
-    sCallbackEnv->SetByteArrayRegion(jb.get(), 0, 1, (jbyte*)&value);
-  }
+  jb.reset(sCallbackEnv->NewByteArray(len));
+  sCallbackEnv->SetByteArrayRegion(jb.get(), 0, len, (jbyte*)value);
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onWriteDescriptor, conn_id,
                                status, handle, jb.get());
 }
diff --git a/android/app/src/com/android/bluetooth/bass_client/BassClientService.java b/android/app/src/com/android/bluetooth/bass_client/BassClientService.java
index 881ef14..95803d0 100755
--- a/android/app/src/com/android/bluetooth/bass_client/BassClientService.java
+++ b/android/app/src/com/android/bluetooth/bass_client/BassClientService.java
@@ -69,7 +69,6 @@
 
     private final Map<BluetoothDevice, BassClientStateMachine> mStateMachines = new HashMap<>();
     private final Object mSearchScanCallbackLock = new Object();
-    private final Map<Integer, ScanResult> mScanBroadcasts = new HashMap<>();
 
     private HandlerThread mStateMachinesThread;
     private HandlerThread mCallbackHandlerThread;
@@ -327,16 +326,8 @@
     }
 
     private boolean hasRoomForBroadcastSourceAddition(BluetoothDevice device) {
-        boolean isRoomAvailable = false;
-        String emptyBluetoothDevice = "00:00:00:00:00:00";
-        for (BluetoothLeBroadcastReceiveState recvState: getAllSources(device)) {
-            if (recvState.getSourceDevice().getAddress().equals(emptyBluetoothDevice)) {
-                isRoomAvailable = true;
-                break;
-            }
-        }
-        log("isRoomAvailable: " + isRoomAvailable);
-        return isRoomAvailable;
+        List<BluetoothLeBroadcastReceiveState> currentAllSources = getAllSources(device);
+        return currentAllSources.size() < getMaximumSourceCapacity(device);
     }
 
     private BassClientStateMachine getOrCreateStateMachine(BluetoothDevice device) {
@@ -642,29 +633,16 @@
                             BassConstants.BAAS_UUID)) {
                         return;
                     }
-                    log( "Broadcast Source Found:" + result.getDevice());
-                    byte[] broadcastIdArray = listOfUuids.get(BassConstants.BAAS_UUID);
-                    int broadcastId = (int)(((broadcastIdArray[2] & 0xff) << 16)
-                            | ((broadcastIdArray[1] & 0xff) << 8)
-                            | (broadcastIdArray[0] & 0xff));
-                    if (mScanBroadcasts.get(broadcastId) == null) {
-                        log("selectBroadcastSource: broadcastId " + broadcastId);
-                        mScanBroadcasts.put(broadcastId, result);
-                        synchronized (mStateMachines) {
-                            for (BassClientStateMachine sm : mStateMachines.values()) {
-                                if (sm.isConnected()) {
-                                    selectSource(sm.getDevice(), result, false);
-                                }
-                            }
-                        }
-                    }
+                    Message msg = mBassUtils.getAutoAssistScanHandler()
+                            .obtainMessage(BassConstants.AA_SCAN_SUCCESS);
+                    msg.obj = result;
+                    mBassUtils.getAutoAssistScanHandler().sendMessage(msg);
                 }
 
                 public void onScanFailed(int errorCode) {
                     Log.e(TAG, "Scan Failure:" + errorCode);
                 }
             };
-            mScanBroadcasts.clear();
             ScanSettings settings = new ScanSettings.Builder().setCallbackType(
                     ScanSettings.CALLBACK_TYPE_ALL_MATCHES)
                     .setScanMode(ScanSettings.SCAN_MODE_LOW_LATENCY)
@@ -710,7 +688,6 @@
             scanner.stopScan(mSearchScanCallback);
             mSearchScanCallback = null;
             mCallbacks.notifySearchStopped(BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST);
-            mScanBroadcasts.clear();
         }
     }
 
@@ -816,7 +793,6 @@
         }
         Message message = stateMachine.obtainMessage(BassClientStateMachine.UPDATE_BCAST_SOURCE);
         message.arg1 = sourceId;
-        message.arg2 = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_INVALID;
         message.obj = updatedMetadata;
         stateMachine.sendMessage(message);
     }
@@ -845,20 +821,6 @@
                     BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
             return;
         }
-        BluetoothLeBroadcastReceiveState recvState =
-                stateMachine.getBroadcastReceiveStateForSourceId(sourceId);
-        BluetoothLeBroadcastMetadata metaData =
-                stateMachine.getCurrentBroadcastMetadata(sourceId);
-        if (metaData != null && recvState != null && recvState.getPaSyncState() ==
-                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCHRONIZED) {
-            log("Force source to lost PA sync");
-            Message message = stateMachine.obtainMessage(
-                    BassClientStateMachine.UPDATE_BCAST_SOURCE);
-            message.arg1 = sourceId;
-            message.arg2 = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE;
-            message.obj = metaData;
-            stateMachine.sendMessage(message);
-        }
         Message message = stateMachine.obtainMessage(BassClientStateMachine.REMOVE_BCAST_SOURCE);
         message.arg1 = sourceId;
         stateMachine.sendMessage(message);
diff --git a/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java b/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java
index 1e30480..418ff0d 100755
--- a/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java
+++ b/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java
@@ -436,13 +436,7 @@
                 channel.setSelected(false);
                 subGroup.addChannel(channel.build());
             }
-            byte[] arrayCodecId = baseLevel2.codecId;
-            long codeId = (long) ((arrayCodecId[4] & 0xff) << 32
-                    | (arrayCodecId[3] & 0xff) << 24
-                    | (arrayCodecId[2] & 0xff) << 16
-                    | (arrayCodecId[1] & 0xff) << 8
-                    | (arrayCodecId[0] & 0xff));
-            subGroup.setCodecId(codeId);
+            subGroup.setCodecId(ByteBuffer.wrap(baseLevel2.codecId).getLong());
             subGroup.setCodecSpecificConfig(BluetoothLeAudioCodecConfigMetadata.
                     fromRawBytes(baseLevel2.codecConfigInfo));
             subGroup.setContentMetadata(BluetoothLeAudioContentMetadata.
@@ -450,18 +444,6 @@
             metaData.addSubgroup(subGroup.build());
         }
         metaData.setSourceDevice(device, device.getAddressType());
-        byte[] arrayPresentationDelay = baseData.getLevelOne().presentationDelay;
-        int presentationDelay = (int) ((arrayPresentationDelay[2] & 0xff) << 16
-                | (arrayPresentationDelay[1] & 0xff)
-                | (arrayPresentationDelay[0] & 0xff));
-        metaData.setPresentationDelayMicros(presentationDelay);
-        PeriodicAdvertisementResult result =
-                mService.getPeriodicAdvertisementResult(device);
-        if (result != null) {
-            int broadcastId = result.getBroadcastId();
-            log("broadcast ID: " + broadcastId);
-            metaData.setBroadcastId(broadcastId);
-        }
         return metaData.build();
     }
 
@@ -652,7 +634,6 @@
             byte metaDataSyncState = receiverState[BassConstants.BCAST_RCVR_STATE_PA_SYNC_IDX];
             byte encryptionStatus = receiverState[BassConstants.BCAST_RCVR_STATE_ENC_STATUS_IDX];
             byte[] badBroadcastCode = null;
-            int badBroadcastCodeLen = 0;
             if (encryptionStatus
                     == BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_BAD_CODE) {
                 badBroadcastCode = new byte[BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE];
@@ -663,12 +644,11 @@
                         0,
                         BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE);
                 badBroadcastCode = reverseBytes(badBroadcastCode);
-                badBroadcastCodeLen = BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE;
             }
             byte numSubGroups = receiverState[BassConstants.BCAST_RCVR_STATE_BADCODE_START_IDX
-                    + badBroadcastCodeLen];
+                    + BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE];
             int offset = BassConstants.BCAST_RCVR_STATE_BADCODE_START_IDX
-                    + badBroadcastCodeLen + 1;
+                    + BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE + 1;
             ArrayList<BluetoothLeAudioContentMetadata> metadataList =
                     new ArrayList<BluetoothLeAudioContentMetadata>();
             ArrayList<Long> audioSyncState = new ArrayList<Long>();
@@ -679,8 +659,6 @@
                 offset += BassConstants.BCAST_RCVR_STATE_BIS_SYNC_SIZE;
                 log("BIS index byte array: ");
                 BassUtils.printByteArray(audioSyncIndex);
-                ByteBuffer wrapped = ByteBuffer.wrap(reverseBytes(audioSyncIndex));
-                audioSyncState.add((long) wrapped.getInt());
 
                 byte metaDataLength = receiverState[offset++];
                 if (metaDataLength > 0) {
@@ -1271,7 +1249,7 @@
     }
 
     private byte[] convertBroadcastMetadataToUpdateSourceByteArray(int sourceId,
-            BluetoothLeBroadcastMetadata metaData, int paSync) {
+            BluetoothLeBroadcastMetadata metaData) {
         BluetoothLeBroadcastReceiveState existingState =
                 getBroadcastReceiveStateForSourceId(sourceId);
         if (existingState == null) {
@@ -1303,9 +1281,7 @@
         // Source_ID
         res[offset++] = (byte) sourceId;
         // PA_Sync
-        if (paSync != BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_INVALID) {
-            res[offset++] = (byte) paSync;
-        } else if (existingState.getPaSyncState()
+        if (existingState.getPaSyncState()
                 == BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCHRONIZED) {
             res[offset++] = (byte) (0x01);
         } else {
@@ -1317,12 +1293,7 @@
         // Num_Subgroups
         res[offset++] = numSubGroups;
         for (int i = 0; i < numSubGroups; i++) {
-            int bisIndexValue;
-            if (paSync != BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_INVALID) {
-                bisIndexValue = 0;
-            } else {
-                bisIndexValue = existingState.getBisSyncState().get(i).intValue();
-            }
+            int bisIndexValue = existingState.getBisSyncState().get(i).intValue();
             log("UPDATE_BCAST_SOURCE: bisIndexValue : " + bisIndexValue);
             // BIS_Sync
             res[offset++] = (byte) (bisIndexValue & 0x00000000000000FF);
@@ -1520,10 +1491,9 @@
                 case UPDATE_BCAST_SOURCE:
                     metaData = (BluetoothLeBroadcastMetadata) message.obj;
                     int sourceId = message.arg1;
-                    int paSync = message.arg2;
                     log("Updating Broadcast source" + metaData);
                     byte[] updateSourceInfo = convertBroadcastMetadataToUpdateSourceByteArray(
-                            sourceId, metaData, paSync);
+                            sourceId, metaData);
                     if (updateSourceInfo == null) {
                         Log.e(TAG, "update source: source Info is NULL");
                         break;
diff --git a/android/app/src/com/android/bluetooth/mcp/McpService.java b/android/app/src/com/android/bluetooth/mcp/McpService.java
index 208997a..dca1c1d 100644
--- a/android/app/src/com/android/bluetooth/mcp/McpService.java
+++ b/android/app/src/com/android/bluetooth/mcp/McpService.java
@@ -176,6 +176,11 @@
     }
 
     public void onDeviceUnauthorized(BluetoothDevice device) {
+        if (Utils.isPtsTestMode()) {
+            Log.d(TAG, "PTS test: setDeviceAuthorized");
+            setDeviceAuthorized(device, true);
+            return;
+        }
         Log.w(TAG, "onDeviceUnauthorized - authorization notification not implemented yet ");
     }
 
@@ -194,9 +199,10 @@
     }
 
     public int getDeviceAuthorization(BluetoothDevice device) {
-        // TODO: For now just reject authorization for other than LeAudio device already authorized.
-        //       Consider intent based authorization mechanism for non-LeAudio devices.
-        return mDeviceAuthorizations.getOrDefault(device, BluetoothDevice.ACCESS_UNKNOWN);
+        // TODO: For now just reject authorization for other than LeAudio device already authorized
+        // except for PTS. Consider intent based authorization mechanism for non-LeAudio devices.
+        return mDeviceAuthorizations.getOrDefault(device, Utils.isPtsTestMode()
+                ? BluetoothDevice.ACCESS_ALLOWED : BluetoothDevice.ACCESS_UNKNOWN);
     }
 
     @GuardedBy("mLock")
diff --git a/service/java/com/android/server/bluetooth/BluetoothManagerService.java b/service/java/com/android/server/bluetooth/BluetoothManagerService.java
index 9ddadd0..b32176d 100644
--- a/service/java/com/android/server/bluetooth/BluetoothManagerService.java
+++ b/service/java/com/android/server/bluetooth/BluetoothManagerService.java
@@ -2210,7 +2210,11 @@
                         break;
                     }
                     if (msg.arg1 > 0) {
-                        mContext.unbindService(psc);
+                        try {
+                            mContext.unbindService(psc);
+                        } catch (IllegalArgumentException e) {
+                            Log.e(TAG, "Unable to unbind service with intent: " + psc.mIntent, e);
+                        }
                         psc.bindService(msg.arg1 - 1);
                     }
                     break;
diff --git a/system/bta/dm/bta_dm_act.cc b/system/bta/dm/bta_dm_act.cc
index cc6b793..52bb644 100644
--- a/system/bta/dm/bta_dm_act.cc
+++ b/system/bta/dm/bta_dm_act.cc
@@ -44,6 +44,7 @@
 #include "main/shim/shim.h"
 #include "osi/include/allocator.h"
 #include "osi/include/compat.h"
+#include "osi/include/fixed_queue.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
 #include "stack/btm/btm_ble_int.h"
@@ -320,6 +321,8 @@
   /* hw is ready, go on with BTA DM initialization */
   alarm_free(bta_dm_search_cb.search_timer);
   alarm_free(bta_dm_search_cb.gatt_close_timer);
+  osi_free(bta_dm_search_cb.p_pending_search);
+  fixed_queue_free(bta_dm_search_cb.pending_discovery_queue, osi_free);
   memset(&bta_dm_search_cb, 0, sizeof(bta_dm_search_cb));
 }
 
@@ -339,6 +342,8 @@
   /* hw is ready, go on with BTA DM initialization */
   alarm_free(bta_dm_search_cb.search_timer);
   alarm_free(bta_dm_search_cb.gatt_close_timer);
+  osi_free(bta_dm_search_cb.p_pending_search);
+  fixed_queue_free(bta_dm_search_cb.pending_discovery_queue, osi_free);
   memset(&bta_dm_search_cb, 0, sizeof(bta_dm_search_cb));
   /*
    * TODO: Should alarm_free() the bta_dm_search_cb timers during
@@ -347,6 +352,7 @@
   bta_dm_search_cb.search_timer = alarm_new("bta_dm_search.search_timer");
   bta_dm_search_cb.gatt_close_timer =
       alarm_new("bta_dm_search.gatt_close_timer");
+  bta_dm_search_cb.pending_discovery_queue = fixed_queue_new(SIZE_MAX);
 
   memset(&bta_dm_conn_srvcs, 0, sizeof(bta_dm_conn_srvcs));
   memset(&bta_dm_di_cb, 0, sizeof(tBTA_DM_DI_CB));
@@ -990,7 +996,7 @@
 void bta_dm_inq_cmpl(uint8_t num) {
   if (bta_dm_search_get_state() == BTA_DM_SEARCH_CANCELLING) {
     bta_dm_search_set_state(BTA_DM_SEARCH_IDLE);
-    bta_dm_search_cancel_cmpl();
+    bta_dm_execute_queued_request();
     return;
   }
 
@@ -1289,6 +1295,7 @@
   /* no BLE connection, i.e. Classic service discovery end */
   if (conn_id == GATT_INVALID_CONN_ID) {
     bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
+    bta_dm_execute_queued_request();
     return;
   }
 
@@ -1299,6 +1306,7 @@
   if (count == 0) {
     LOG_INFO("Empty GATT database - no BLE services discovered");
     bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
+    bta_dm_execute_queued_request();
     return;
   }
 
@@ -1323,6 +1331,8 @@
   bta_dm_search_cb.p_search_cback(BTA_DM_DISC_BLE_RES_EVT, &result);
 
   bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
+
+  bta_dm_execute_queued_request();
 }
 
 /*******************************************************************************
@@ -1419,13 +1429,13 @@
  *
  * Function         bta_dm_queue_search
  *
- * Description      Queues search command while search is being cancelled
+ * Description      Queues search command
  *
  * Returns          void
  *
  ******************************************************************************/
 void bta_dm_queue_search(tBTA_DM_MSG* p_data) {
-  bta_dm_search_clear_queue();
+  osi_free_and_reset((void**)&bta_dm_search_cb.p_pending_search);
   bta_dm_search_cb.p_pending_search =
       (tBTA_DM_MSG*)osi_malloc(sizeof(tBTA_DM_API_SEARCH));
   memcpy(bta_dm_search_cb.p_pending_search, p_data, sizeof(tBTA_DM_API_SEARCH));
@@ -1435,17 +1445,62 @@
  *
  * Function         bta_dm_queue_disc
  *
- * Description      Queues discovery command while search is being cancelled
+ * Description      Queues discovery command
  *
  * Returns          void
  *
  ******************************************************************************/
 void bta_dm_queue_disc(tBTA_DM_MSG* p_data) {
-  bta_dm_search_clear_queue();
-  bta_dm_search_cb.p_pending_discovery =
+  tBTA_DM_MSG* p_pending_discovery =
       (tBTA_DM_MSG*)osi_malloc(sizeof(tBTA_DM_API_DISCOVER));
-  memcpy(bta_dm_search_cb.p_pending_discovery, p_data,
-         sizeof(tBTA_DM_API_DISCOVER));
+  memcpy(p_pending_discovery, p_data, sizeof(tBTA_DM_API_DISCOVER));
+  fixed_queue_enqueue(bta_dm_search_cb.pending_discovery_queue,
+                      p_pending_discovery);
+}
+
+/*******************************************************************************
+ *
+ * Function         bta_dm_execute_queued_request
+ *
+ * Description      Executes queued request if one exists
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_dm_execute_queued_request() {
+  if (bta_dm_search_cb.p_pending_search) {
+    // Updated queued event to search event to trigger start search
+    if (bta_dm_search_cb.p_pending_search->hdr.event ==
+        BTA_DM_API_QUEUE_SEARCH_EVT) {
+      bta_dm_search_cb.p_pending_search->hdr.event = BTA_DM_API_SEARCH_EVT;
+    }
+    LOG_INFO("%s Start pending search", __func__);
+    bta_sys_sendmsg(bta_dm_search_cb.p_pending_search);
+    bta_dm_search_cb.p_pending_search = NULL;
+  } else {
+    tBTA_DM_MSG* p_pending_discovery = (tBTA_DM_MSG*)fixed_queue_try_dequeue(
+        bta_dm_search_cb.pending_discovery_queue);
+    if (p_pending_discovery) {
+      if (p_pending_discovery->hdr.event == BTA_DM_API_QUEUE_DISCOVER_EVT) {
+        p_pending_discovery->hdr.event = BTA_DM_API_DISCOVER_EVT;
+      }
+      LOG_INFO("%s Start pending discovery", __func__);
+      bta_sys_sendmsg(p_pending_discovery);
+    }
+  }
+}
+
+/*******************************************************************************
+ *
+ * Function         bta_dm_is_search_request_queued
+ *
+ * Description      Checks if there is a queued search request
+ *
+ * Returns          bool
+ *
+ ******************************************************************************/
+bool bta_dm_is_search_request_queued() {
+  return bta_dm_search_cb.p_pending_search != NULL;
 }
 
 /*******************************************************************************
@@ -1459,26 +1514,7 @@
  ******************************************************************************/
 void bta_dm_search_clear_queue() {
   osi_free_and_reset((void**)&bta_dm_search_cb.p_pending_search);
-  osi_free_and_reset((void**)&bta_dm_search_cb.p_pending_discovery);
-}
-
-/*******************************************************************************
- *
- * Function         bta_dm_search_cancel_cmpl
- *
- * Description      Search cancel is complete
- *
- * Returns          void
- *
- ******************************************************************************/
-void bta_dm_search_cancel_cmpl() {
-  if (bta_dm_search_cb.p_pending_search) {
-    bta_sys_sendmsg(bta_dm_search_cb.p_pending_search);
-    bta_dm_search_cb.p_pending_search = NULL;
-  } else if (bta_dm_search_cb.p_pending_discovery) {
-    bta_sys_sendmsg(bta_dm_search_cb.p_pending_discovery);
-    bta_dm_search_cb.p_pending_discovery = NULL;
-  }
+  fixed_queue_flush(bta_dm_search_cb.pending_discovery_queue, osi_free);
 }
 
 /*******************************************************************************
diff --git a/system/bta/dm/bta_dm_api.cc b/system/bta/dm/bta_dm_api.cc
index cf060ee..5e1a878 100644
--- a/system/bta/dm/bta_dm_api.cc
+++ b/system/bta/dm/bta_dm_api.cc
@@ -80,11 +80,16 @@
  * Returns          void
  *
  ******************************************************************************/
-void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback) {
+void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp) {
   tBTA_DM_API_SEARCH* p_msg =
       (tBTA_DM_API_SEARCH*)osi_calloc(sizeof(tBTA_DM_API_SEARCH));
 
-  p_msg->hdr.event = BTA_DM_API_SEARCH_EVT;
+  /* Queue request if a device is bonding or performing service discovery */
+  if (is_bonding_or_sdp) {
+    p_msg->hdr.event = BTA_DM_API_QUEUE_SEARCH_EVT;
+  } else {
+    p_msg->hdr.event = BTA_DM_API_SEARCH_EVT;
+  }
   p_msg->p_cback = p_cback;
 
   bta_sys_sendmsg(p_msg);
@@ -101,6 +106,8 @@
  *
  ******************************************************************************/
 void BTA_DmSearchCancel(void) {
+  bta_dm_search_clear_queue();
+
   switch (bta_dm_search_get_state()) {
     case BTA_DM_SEARCH_IDLE:
       bta_dm_search_cancel_notify();
@@ -110,7 +117,6 @@
       bta_dm_search_cancel();
       break;
     case BTA_DM_SEARCH_CANCELLING:
-      bta_dm_search_clear_queue();
       bta_dm_search_cancel_notify();
       break;
     case BTA_DM_DISCOVER_ACTIVE:
@@ -132,11 +138,15 @@
  *
  ******************************************************************************/
 void BTA_DmDiscover(const RawAddress& bd_addr, tBTA_DM_SEARCH_CBACK* p_cback,
-                    tBT_TRANSPORT transport) {
+                    tBT_TRANSPORT transport, bool is_bonding_or_sdp) {
   tBTA_DM_API_DISCOVER* p_msg =
       (tBTA_DM_API_DISCOVER*)osi_calloc(sizeof(tBTA_DM_API_DISCOVER));
 
-  p_msg->hdr.event = BTA_DM_API_DISCOVER_EVT;
+  if (is_bonding_or_sdp) {
+    p_msg->hdr.event = BTA_DM_API_QUEUE_DISCOVER_EVT;
+  } else {
+    p_msg->hdr.event = BTA_DM_API_DISCOVER_EVT;
+  }
   p_msg->bd_addr = bd_addr;
   p_msg->transport = transport;
   p_msg->p_cback = p_cback;
diff --git a/system/bta/dm/bta_dm_int.h b/system/bta/dm/bta_dm_int.h
index a39c872..e51d9ac 100644
--- a/system/bta/dm/bta_dm_int.h
+++ b/system/bta/dm/bta_dm_int.h
@@ -70,17 +70,19 @@
   BTA_DM_SDP_RESULT_EVT,
   BTA_DM_SEARCH_CMPL_EVT,
   BTA_DM_DISCOVERY_RESULT_EVT,
-  BTA_DM_DISC_CLOSE_TOUT_EVT
+  BTA_DM_DISC_CLOSE_TOUT_EVT,
+  BTA_DM_API_QUEUE_SEARCH_EVT,
+  BTA_DM_API_QUEUE_DISCOVER_EVT
 };
 
-/* data type for BTA_DM_API_SEARCH_EVT */
+/* data type for BTA_DM_API_SEARCH_EVT and BTA_DM_API_QUEUE_SEARCH_EVT */
 typedef struct {
   BT_HDR_RIGID hdr;
   tBTA_SERVICE_MASK services;
   tBTA_DM_SEARCH_CBACK* p_cback;
 } tBTA_DM_API_SEARCH;
 
-/* data type for BTA_DM_API_DISCOVER_EVT */
+/* data type for BTA_DM_API_DISCOVER_EVT and BTA_DM_API_QUEUE_DISCOVER_EVT */
 typedef struct {
   BT_HDR_RIGID hdr;
   RawAddress bd_addr;
@@ -356,7 +358,7 @@
   alarm_t* search_timer;
   uint8_t service_index;
   tBTA_DM_MSG* p_pending_search;
-  tBTA_DM_MSG* p_pending_discovery;
+  fixed_queue_t* pending_discovery_queue;
   bool wait_disc;
   bool sdp_results;
   bluetooth::Uuid uuid;
@@ -533,8 +535,9 @@
 extern void bta_dm_discovery_cmpl(tBTA_DM_MSG* p_data);
 extern void bta_dm_queue_search(tBTA_DM_MSG* p_data);
 extern void bta_dm_queue_disc(tBTA_DM_MSG* p_data);
+extern void bta_dm_execute_queued_request();
+extern bool bta_dm_is_search_request_queued();
 extern void bta_dm_search_clear_queue();
-extern void bta_dm_search_cancel_cmpl();
 extern void bta_dm_search_cancel_notify();
 extern void bta_dm_disc_rmt_name(tBTA_DM_MSG* p_data);
 extern tBTA_DM_PEER_DEVICE* bta_dm_find_peer_device(
diff --git a/system/bta/dm/bta_dm_main.cc b/system/bta/dm/bta_dm_main.cc
index 5dd404b..523831b 100644
--- a/system/bta/dm/bta_dm_main.cc
+++ b/system/bta/dm/bta_dm_main.cc
@@ -82,6 +82,12 @@
         case BTA_DM_DISC_CLOSE_TOUT_EVT:
           bta_dm_close_gatt_conn(message);
           break;
+        case BTA_DM_API_QUEUE_SEARCH_EVT:
+          bta_dm_queue_search(message);
+          break;
+        case BTA_DM_API_QUEUE_DISCOVER_EVT:
+          bta_dm_queue_disc(message);
+          break;
       }
       break;
     case BTA_DM_SEARCH_ACTIVE:
@@ -101,14 +107,20 @@
         case BTA_DM_DISC_CLOSE_TOUT_EVT:
           bta_dm_close_gatt_conn(message);
           break;
+        case BTA_DM_API_DISCOVER_EVT:
+        case BTA_DM_API_QUEUE_DISCOVER_EVT:
+          bta_dm_queue_disc(message);
+          break;
       }
       break;
     case BTA_DM_SEARCH_CANCELLING:
       switch (p_msg->event) {
         case BTA_DM_API_SEARCH_EVT:
+        case BTA_DM_API_QUEUE_SEARCH_EVT:
           bta_dm_queue_search(message);
           break;
         case BTA_DM_API_DISCOVER_EVT:
+        case BTA_DM_API_QUEUE_DISCOVER_EVT:
           bta_dm_queue_disc(message);
           break;
         case BTA_DM_SDP_RESULT_EVT:
@@ -118,7 +130,7 @@
           bta_dm_search_set_state(BTA_DM_SEARCH_IDLE);
           bta_dm_free_sdp_db();
           bta_dm_search_cancel_notify();
-          bta_dm_search_cancel_cmpl();
+          bta_dm_execute_queued_request();
           break;
       }
       break;
@@ -136,6 +148,14 @@
         case BTA_DM_DISCOVERY_RESULT_EVT:
           bta_dm_disc_result(message);
           break;
+        case BTA_DM_API_SEARCH_EVT:
+        case BTA_DM_API_QUEUE_SEARCH_EVT:
+          bta_dm_queue_search(message);
+          break;
+        case BTA_DM_API_DISCOVER_EVT:
+        case BTA_DM_API_QUEUE_DISCOVER_EVT:
+          bta_dm_queue_disc(message);
+          break;
       }
       break;
   }
diff --git a/system/bta/gatt/bta_gattc_act.cc b/system/bta/gatt/bta_gattc_act.cc
index cd9da7a..783ab69 100644
--- a/system/bta/gatt/bta_gattc_act.cc
+++ b/system/bta/gatt/bta_gattc_act.cc
@@ -385,6 +385,16 @@
     return;
   }
 
+  tBTA_GATTC_RCB* p_clreg = p_clcb->p_rcb;
+  /* Re-enable notification registration for closed connection */
+  for (int i = 0; i < BTA_GATTC_NOTIF_REG_MAX; i++) {
+    if (p_clreg->notif_reg[i].in_use &&
+        p_clreg->notif_reg[i].remote_bda == p_clcb->bda &&
+        p_clreg->notif_reg[i].app_disconnected) {
+      p_clreg->notif_reg[i].app_disconnected = false;
+    }
+  }
+
   /* a connected remote device */
   if (GATT_GetConnIdIfConnected(
           p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
@@ -511,6 +521,16 @@
 
   if (p_clcb->p_srcb->mtu == 0) p_clcb->p_srcb->mtu = GATT_DEF_BLE_MTU_SIZE;
 
+  tBTA_GATTC_RCB* p_clreg = p_clcb->p_rcb;
+  /* Re-enable notification registration for closed connection */
+  for (int i = 0; i < BTA_GATTC_NOTIF_REG_MAX; i++) {
+    if (p_clreg->notif_reg[i].in_use &&
+        p_clreg->notif_reg[i].remote_bda == p_clcb->bda &&
+        p_clreg->notif_reg[i].app_disconnected) {
+      p_clreg->notif_reg[i].app_disconnected = false;
+    }
+  }
+
   /* start database cache if needed */
   if (p_clcb->p_srcb->gatt_database.IsEmpty() ||
       p_clcb->p_srcb->state != BTA_GATTC_SERV_IDLE) {
@@ -604,6 +624,14 @@
     bta_sys_conn_close(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
   }
 
+  /* Disable notification registration for closed connection */
+  for (int i = 0; i < BTA_GATTC_NOTIF_REG_MAX; i++) {
+    if (p_clreg->notif_reg[i].in_use &&
+        p_clreg->notif_reg[i].remote_bda == p_clcb->bda) {
+      p_clreg->notif_reg[i].app_disconnected = true;
+    }
+  }
+
   bta_gattc_clcb_dealloc(p_clcb);
 
   if (p_data->hdr.event == BTA_GATTC_API_CLOSE_EVT) {
@@ -963,13 +991,28 @@
   GATT_WRITE_OP_CB cb = p_clcb->p_q_cmd->api_write.write_cb;
   void* my_cb_data = p_clcb->p_q_cmd->api_write.write_cb_data;
 
-  osi_free_and_reset((void**)&p_clcb->p_q_cmd);
-
   if (cb) {
-    cb(p_clcb->bta_conn_id, p_data->status, p_data->p_cmpl->att_value.handle,
-       p_data->p_cmpl->att_value.len, p_data->p_cmpl->att_value.value,
-       my_cb_data);
+    if (p_data->status == 0 &&
+        p_clcb->p_q_cmd->api_write.write_type == BTA_GATTC_WRITE_PREPARE) {
+      LOG_DEBUG("Handling prepare write success response: handle 0x%04x",
+                p_data->p_cmpl->att_value.handle);
+      /* If this is successful Prepare write, lets provide to the callback the
+       * data provided by server */
+      cb(p_clcb->bta_conn_id, p_data->status, p_data->p_cmpl->att_value.handle,
+         p_data->p_cmpl->att_value.len, p_data->p_cmpl->att_value.value,
+         my_cb_data);
+    } else {
+      LOG_DEBUG("Handling write response type: %d: handle 0x%04x",
+                p_clcb->p_q_cmd->api_write.write_type,
+                p_data->p_cmpl->att_value.handle);
+      /* Otherwise, provide data which were intended to write. */
+      cb(p_clcb->bta_conn_id, p_data->status, p_data->p_cmpl->att_value.handle,
+         p_clcb->p_q_cmd->api_write.len, p_clcb->p_q_cmd->api_write.p_value,
+         my_cb_data);
+    }
   }
+
+  osi_free_and_reset((void**)&p_clcb->p_q_cmd);
 }
 
 /** execute write complete */
diff --git a/system/bta/gatt/bta_gattc_int.h b/system/bta/gatt/bta_gattc_int.h
index 917ecc4..1df5e53 100644
--- a/system/bta/gatt/bta_gattc_int.h
+++ b/system/bta/gatt/bta_gattc_int.h
@@ -230,6 +230,7 @@
 
 typedef struct {
   bool in_use;
+  bool app_disconnected;
   RawAddress remote_bda;
   uint16_t handle;
 } tBTA_GATTC_NOTIF_REG;
diff --git a/system/bta/gatt/bta_gattc_utils.cc b/system/bta/gatt/bta_gattc_utils.cc
index ed67729..f49ae36 100644
--- a/system/bta/gatt/bta_gattc_utils.cc
+++ b/system/bta/gatt/bta_gattc_utils.cc
@@ -352,7 +352,8 @@
   for (i = 0; i < BTA_GATTC_NOTIF_REG_MAX; i++) {
     if (p_clreg->notif_reg[i].in_use &&
         p_clreg->notif_reg[i].remote_bda == p_srcb->server_bda &&
-        p_clreg->notif_reg[i].handle == p_notify->handle) {
+        p_clreg->notif_reg[i].handle == p_notify->handle &&
+        !p_clreg->notif_reg[i].app_disconnected) {
       VLOG(1) << "Notification registered!";
       return true;
     }
diff --git a/system/bta/include/bta_api.h b/system/bta/include/bta_api.h
index 447823a..b98c8e4 100644
--- a/system/bta/include/bta_api.h
+++ b/system/bta/include/bta_api.h
@@ -710,13 +710,15 @@
  *                  first performs an inquiry; for each device found from the
  *                  inquiry it gets the remote name of the device.  If
  *                  parameter services is nonzero, service discovery will be
- *                  performed on each device for the services specified.
+ *                  performed on each device for the services specified. If the
+ *                  parameter is_bonding_or_sdp is true, the request will be
+ *                  queued until bonding or sdp completes
  *
  *
  * Returns          void
  *
  ******************************************************************************/
-extern void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback);
+extern void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp);
 
 /*******************************************************************************
  *
@@ -744,7 +746,7 @@
  ******************************************************************************/
 extern void BTA_DmDiscover(const RawAddress& bd_addr,
                            tBTA_DM_SEARCH_CBACK* p_cback,
-                           tBT_TRANSPORT transport);
+                           tBT_TRANSPORT transport, bool is_bonding_or_sdp);
 
 /*******************************************************************************
  *
diff --git a/system/bta/le_audio/devices_test.cc b/system/bta/le_audio/devices_test.cc
index 7628182..706bfa2 100644
--- a/system/bta/le_audio/devices_test.cc
+++ b/system/bta/le_audio/devices_test.cc
@@ -526,6 +526,13 @@
     for (const auto& audio_set_conf : *configurations) {
       // the configuration should fail if there are no active ases expected
       bool success_expected = data_size > 0;
+      bool not_matching_scenario = false;
+      uint8_t snk_ases_cnt = 0;
+      uint8_t src_ases_cnt = 0;
+      PublishedAudioCapabilitiesBuilder snk_pac_builder, src_pac_builder;
+      snk_pac_builder.Reset();
+      src_pac_builder.Reset();
+
       for (int i = 0; i < data_size; i++) {
         success_expected &= (data[i].active_channel_num_snk +
                              data[i].active_channel_num_src) > 0;
@@ -536,19 +543,34 @@
          * DualDev). This is just how the test is created and this limitation
          * should be removed b/230107540
          */
-        PublishedAudioCapabilitiesBuilder snk_pac_builder, src_pac_builder;
         for (const auto& entry : (*audio_set_conf).confs) {
+          /* Configuration requires more devices than are supplied */
+          if (entry.device_cnt > data_size) {
+            not_matching_scenario = true;
+            break;
+          }
           if (entry.direction == kLeAudioDirectionSink) {
+            snk_ases_cnt += entry.ase_cnt;
             snk_pac_builder.Add(entry.codec, data[i].audio_channel_counts_snk);
           } else {
             src_pac_builder.Add(entry.codec, data[i].audio_channel_counts_src);
           }
         }
 
+        /* Scenario requires more ASEs than defined requirement */
+        if (snk_ases_cnt < data[i].audio_channel_counts_snk ||
+            src_ases_cnt < data[i].audio_channel_counts_src) {
+          not_matching_scenario = true;
+        }
+
+        if (not_matching_scenario) break;
+
         data[i].device->snk_pacs_ = snk_pac_builder.Get();
         data[i].device->src_pacs_ = src_pac_builder.Get();
       }
 
+      if (not_matching_scenario) continue;
+
       /* Stimulate update of active context map */
       group_->UpdateActiveContextsMap(static_cast<uint16_t>(context_type));
       ASSERT_EQ(success_expected, group_->Configure(context_type));
diff --git a/system/bta/le_audio/state_machine.cc b/system/bta/le_audio/state_machine.cc
index 2265f42..aaeba87 100644
--- a/system/bta/le_audio/state_machine.cc
+++ b/system/bta/le_audio/state_machine.cc
@@ -579,6 +579,7 @@
     if ((group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) &&
         (group->GetTargetState() == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE)) {
       LOG(INFO) << __func__ << " group: " << group->group_id_ << " is in IDLE";
+      group->UpdateActiveContextsMap();
       return;
     }
 
@@ -609,10 +610,10 @@
     /* mark ASEs as not used. */
     leAudioDevice->DeactivateAllAses();
 
-    DLOG(INFO) << __func__ << " device: " << leAudioDevice->address_
-               << " group connected: " << group->IsAnyDeviceConnected()
-               << " all active ase disconnected: "
-               << group->HaveAllActiveDevicesCisDisc();
+    LOG_DEBUG(
+        " device: %s, group connected: %d, all active ase disconnected:: %d",
+        leAudioDevice->address_.ToString().c_str(),
+        group->IsAnyDeviceConnected(), group->HaveAllActiveDevicesCisDisc());
 
     /* Group has changed. Lets update available contexts */
     group->UpdateActiveContextsMap();
diff --git a/system/btif/src/btif_dm.cc b/system/btif/src/btif_dm.cc
index e13fad3..30e08cd 100644
--- a/system/btif/src/btif_dm.cc
+++ b/system/btif/src/btif_dm.cc
@@ -1917,10 +1917,16 @@
 void btif_dm_start_discovery(void) {
   BTIF_TRACE_EVENT("%s", __func__);
 
+  if (bta_dm_is_search_request_queued()) {
+    LOG_INFO("%s skipping start discovery because a request is queued",
+             __func__);
+    return;
+  }
+
   /* Will be enabled to true once inquiry busy level has been received */
   btif_dm_inquiry_in_progress = false;
   /* find nearby devices */
-  BTA_DmSearch(btif_dm_search_devices_evt);
+  BTA_DmSearch(btif_dm_search_devices_evt, is_bonding_or_sdp());
 }
 
 /*******************************************************************************
@@ -2400,7 +2406,10 @@
   BTIF_TRACE_EVENT("%s: transport=%d, remote_addr=%s", __func__, transport,
                    remote_addr.ToString().c_str());
 
-  BTA_DmDiscover(remote_addr, btif_dm_search_services_evt, transport);
+  BTA_DmDiscover(remote_addr, btif_dm_search_services_evt, transport,
+                 remote_addr != pairing_cb.bd_addr &&
+                     remote_addr != pairing_cb.static_bdaddr &&
+                     is_bonding_or_sdp());
 }
 
 void btif_dm_enable_service(tBTA_SERVICE_ID service_id, bool enable) {
diff --git a/system/btif/src/btif_gatt_client.cc b/system/btif/src/btif_gatt_client.cc
index d3a0a0e..ae8962e 100644
--- a/system/btif/src/btif_gatt_client.cc
+++ b/system/btif/src/btif_gatt_client.cc
@@ -72,6 +72,15 @@
 /*******************************************************************************
  *  Constants & Macros
  ******************************************************************************/
+#define CLI_CBACK_WRAP_IN_JNI(P_CBACK, P_CBACK_WRAP)                 \
+  do {                                                               \
+    if (bt_gatt_callbacks && bt_gatt_callbacks->client->P_CBACK) {   \
+      BTIF_TRACE_API("HAL bt_gatt_callbacks->client->%s", #P_CBACK); \
+      do_in_jni_thread(P_CBACK_WRAP);                                \
+    } else {                                                         \
+      ASSERTC(0, "Callback is NULL", 0);                             \
+    }                                                                \
+  } while (0)
 
 #define CLI_CBACK_IN_JNI(P_CBACK, ...)                                         \
   do {                                                                         \
@@ -500,8 +509,17 @@
 
 void write_char_cb(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                    uint16_t len, const uint8_t* value, void* data) {
-  CLI_CBACK_IN_JNI(write_characteristic_cb, conn_id, status, handle, len,
-                   value);
+  std::vector<uint8_t> val(value, value + len);
+  CLI_CBACK_WRAP_IN_JNI(
+      write_characteristic_cb,
+      base::BindOnce(
+          [](write_characteristic_callback cb, uint16_t conn_id,
+             tGATT_STATUS status, uint16_t handle,
+             std::vector<uint8_t> moved_value) {
+            cb(conn_id, status, handle, moved_value.size(), moved_value.data());
+          },
+          bt_gatt_callbacks->client->write_characteristic_cb, conn_id, status,
+          handle, std::move(val)));
 }
 
 static bt_status_t btif_gattc_write_char(int conn_id, uint16_t handle,
@@ -520,7 +538,18 @@
 
 void write_descr_cb(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                     uint16_t len, const uint8_t* value, void* data) {
-  CLI_CBACK_IN_JNI(write_descriptor_cb, conn_id, status, handle, len, value);
+  std::vector<uint8_t> val(value, value + len);
+
+  CLI_CBACK_WRAP_IN_JNI(
+      write_descriptor_cb,
+      base::BindOnce(
+          [](write_descriptor_callback cb, uint16_t conn_id,
+             tGATT_STATUS status, uint16_t handle,
+             std::vector<uint8_t> moved_value) {
+            cb(conn_id, status, handle, moved_value.size(), moved_value.data());
+          },
+          bt_gatt_callbacks->client->write_descriptor_cb, conn_id, status,
+          handle, std::move(val)));
 }
 
 static bt_status_t btif_gattc_write_char_descr(int conn_id, uint16_t handle,
diff --git a/system/gd/hci/acl_manager/le_impl.h b/system/gd/hci/acl_manager/le_impl.h
index e9d1f05..dbef2f2 100644
--- a/system/gd/hci/acl_manager/le_impl.h
+++ b/system/gd/hci/acl_manager/le_impl.h
@@ -669,7 +669,7 @@
     OwnAddressType own_address_type =
         static_cast<OwnAddressType>(le_address_manager_->GetCurrentAddress().GetAddressType());
     uint16_t conn_interval_min = 0x0018;
-    uint16_t conn_interval_max = 0x0030;
+    uint16_t conn_interval_max = 0x0028;
     uint16_t conn_latency = 0x0000;
     uint16_t supervision_timeout = 0x001f4;
     ASSERT(check_connection_parameters(conn_interval_min, conn_interval_max, conn_latency, supervision_timeout));
diff --git a/system/gd/hci/controller.cc b/system/gd/hci/controller.cc
index da5986f..cd6fa1f 100644
--- a/system/gd/hci/controller.cc
+++ b/system/gd/hci/controller.cc
@@ -146,7 +146,7 @@
       LOG_INFO("LE_READ_PERIODIC_ADVERTISING_LIST_SIZE not supported, defaulting to 0");
       le_periodic_advertiser_list_size_ = 0;
     }
-    if (is_supported(OpCode::LE_SET_HOST_FEATURE)) {
+    if (is_supported(OpCode::LE_SET_HOST_FEATURE) && module_.SupportsBleConnectedIsochronousStreamCentral()) {
       hci_->EnqueueCommand(
           LeSetHostFeatureBuilder::Create(LeHostFeatureBits::CONNECTED_ISO_STREAM_HOST_SUPPORT, Enable::ENABLED),
           handler->BindOnceOn(this, &Controller::impl::le_set_host_feature_handler));
diff --git a/system/gd/hci/le_scanning_manager.cc b/system/gd/hci/le_scanning_manager.cc
index bc80498..1c1b562 100644
--- a/system/gd/hci/le_scanning_manager.cc
+++ b/system/gd/hci/le_scanning_manager.cc
@@ -501,6 +501,16 @@
       return;
     }
 
+    switch (address_type) {
+      case (uint8_t)AddressType::PUBLIC_DEVICE_ADDRESS:
+      case (uint8_t)AddressType::PUBLIC_IDENTITY_ADDRESS:
+        address_type = (uint8_t)AddressType::PUBLIC_DEVICE_ADDRESS;
+        break;
+      case (uint8_t)AddressType::RANDOM_DEVICE_ADDRESS:
+      case (uint8_t)AddressType::RANDOM_IDENTITY_ADDRESS:
+        address_type = (uint8_t)AddressType::RANDOM_DEVICE_ADDRESS;
+        break;
+    }
     scanning_callbacks_->OnScanResult(
         event_type,
         address_type,
diff --git a/system/test/mock/mock_bta_dm_act.cc b/system/test/mock/mock_bta_dm_act.cc
index 67030cc..f77e90b 100644
--- a/system/test/mock/mock_bta_dm_act.cc
+++ b/system/test/mock/mock_bta_dm_act.cc
@@ -92,7 +92,6 @@
 struct bta_dm_rmt_name bta_dm_rmt_name;
 struct bta_dm_sdp_result bta_dm_sdp_result;
 struct bta_dm_search_cancel bta_dm_search_cancel;
-struct bta_dm_search_cancel_cmpl bta_dm_search_cancel_cmpl;
 struct bta_dm_search_cancel_notify bta_dm_search_cancel_notify;
 struct bta_dm_search_clear_queue bta_dm_search_clear_queue;
 struct bta_dm_search_cmpl bta_dm_search_cmpl;
@@ -338,10 +337,6 @@
   mock_function_count_map[__func__]++;
   test::mock::bta_dm_act::bta_dm_search_cancel();
 }
-void bta_dm_search_cancel_cmpl() {
-  mock_function_count_map[__func__]++;
-  test::mock::bta_dm_act::bta_dm_search_cancel_cmpl();
-}
 void bta_dm_search_cancel_notify() {
   mock_function_count_map[__func__]++;
   test::mock::bta_dm_act::bta_dm_search_cancel_notify();
diff --git a/system/test/mock/mock_bta_dm_api.cc b/system/test/mock/mock_bta_dm_api.cc
index bbb46ab..4cbab7e 100644
--- a/system/test/mock/mock_bta_dm_api.cc
+++ b/system/test/mock/mock_bta_dm_api.cc
@@ -163,9 +163,10 @@
   test::mock::bta_dm_api::BTA_DmConfirm(bd_addr, accept);
 }
 void BTA_DmDiscover(const RawAddress& bd_addr, tBTA_DM_SEARCH_CBACK* p_cback,
-                    tBT_TRANSPORT transport) {
+                    tBT_TRANSPORT transport, bool is_bonding_or_sd) {
   mock_function_count_map[__func__]++;
-  test::mock::bta_dm_api::BTA_DmDiscover(bd_addr, p_cback, transport);
+  test::mock::bta_dm_api::BTA_DmDiscover(bd_addr, p_cback, transport,
+                                         is_bonding_or_sd);
 }
 bool BTA_DmGetConnectionState(const RawAddress& bd_addr) {
   mock_function_count_map[__func__]++;
@@ -184,9 +185,9 @@
   mock_function_count_map[__func__]++;
   return test::mock::bta_dm_api::BTA_DmRemoveDevice(bd_addr);
 }
-void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback) {
+void BTA_DmSearch(tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp) {
   mock_function_count_map[__func__]++;
-  test::mock::bta_dm_api::BTA_DmSearch(p_cback);
+  test::mock::bta_dm_api::BTA_DmSearch(p_cback, is_bonding_or_sdp);
 }
 void BTA_DmSearchCancel(void) {
   mock_function_count_map[__func__]++;
diff --git a/system/test/mock/mock_bta_dm_api.h b/system/test/mock/mock_bta_dm_api.h
index 3e64ff3..d9dd9ba 100644
--- a/system/test/mock/mock_bta_dm_api.h
+++ b/system/test/mock/mock_bta_dm_api.h
@@ -280,15 +280,15 @@
 
 // Name: BTA_DmDiscover
 // Params: const RawAddress& bd_addr, tBTA_DM_SEARCH_CBACK* p_cback,
-// tBT_TRANSPORT transport Return: void
+// tBT_TRANSPORT transport, bool is_bonding_or_sd Return: void
 struct BTA_DmDiscover {
   std::function<void(const RawAddress& bd_addr, tBTA_DM_SEARCH_CBACK* p_cback,
-                     tBT_TRANSPORT transport)>
+                     tBT_TRANSPORT transport, bool is_bonding_or_sd)>
       body{[](const RawAddress& bd_addr, tBTA_DM_SEARCH_CBACK* p_cback,
-              tBT_TRANSPORT transport) {}};
+              tBT_TRANSPORT transport, bool is_bonding_or_sd) {}};
   void operator()(const RawAddress& bd_addr, tBTA_DM_SEARCH_CBACK* p_cback,
-                  tBT_TRANSPORT transport) {
-    body(bd_addr, p_cback, transport);
+                  tBT_TRANSPORT transport, bool is_bonding_or_sd) {
+    body(bd_addr, p_cback, transport, is_bonding_or_sd);
   };
 };
 extern struct BTA_DmDiscover BTA_DmDiscover;
@@ -340,12 +340,14 @@
 extern struct BTA_DmRemoveDevice BTA_DmRemoveDevice;
 
 // Name: BTA_DmSearch
-// Params: tBTA_DM_SEARCH_CBACK* p_cback
+// Params: tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp
 // Return: void
 struct BTA_DmSearch {
-  std::function<void(tBTA_DM_SEARCH_CBACK* p_cback)> body{
-      [](tBTA_DM_SEARCH_CBACK* p_cback) {}};
-  void operator()(tBTA_DM_SEARCH_CBACK* p_cback) { body(p_cback); };
+  std::function<void(tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp)>
+      body{[](tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp) {}};
+  void operator()(tBTA_DM_SEARCH_CBACK* p_cback, bool is_bonding_or_sdp) {
+    body(p_cback, is_bonding_or_sdp);
+  };
 };
 extern struct BTA_DmSearch BTA_DmSearch;