Android 10.0.0 Release 37 (QQ3A.200605.001)

* tag 'android-10.0.0_r37': (47 commits)
  RESTRICT AUTOMERGE: Camera: fix use after free in sensor timestamp
  keep tx3g{Buffer,Size,Filled} in sync
  Fix race condition in AudioTrack::releaseBuffer()
  Fix race condition in AudioRecord::releaseBuffer()
  rtsp: fix integer overflow caused by malformed packets
  IDrm: fix uninitialized variable in GET_OFFLINE_LICENSE_STATE
  audio policy: fix disordered sequence while changing device
  RESTRICT AUTOMERGE: Camera: fix use after free in sensor timestamp
  RESTRICT AUTOMERGE: Camera: fix use after free in sensor timestamp
  BnCrypto: fix use-before-init in CREATE_PLUGIN
  Camera: Add onCameraOpened/onCameraClosed callbacks
  [DO NOT MERGE] Fix Heap use after free in clearkey getSecureStops
  Check if calling uid is system uid for setAllowedPolicyCapture.
  clearkey default: parsePssh securely
  RESTRICT AUTOMERGE CCodec: make config consistent before/after flush
  Reduce the latecy of encoding 1st frame
  [media][sfplugin] fix -Wdangling-gsl
  [DO NOT MERGE] Fix uninitialized data in IHDCP decrypt
  OpusHeader: Fix integer overflow in GetOpusHeaderBuffers
  MPEG4Extractor: check the default sample info before checking the validity of sample size.
  ...

Change-Id: Ibb33de8b4828ed99095af7d629ffc290c188e10d

The onCameraOpened/onCameraClosed callbacks are used to notify camera
service client with [] permission that a certain camera device has been
opened/closed.

Test: Manually check callbacks are received in SystemUI app
Bug: 150540299
Change-Id: If6f3624c43927c30afef7df0a780eafe3ae4c527
Merged-In: If6f3624c43927c30afef7df0a780eafe3ae4c527

Android 10.0.0 release 31

* tag 'android-10.0.0_r31': (28 commits)
  Revert "DO NOT MERGE Set module versions to 299900000 Dev branch..."
  AudioFlinger: Clear effect_uuid_t in case of short read
  Check actual read bytes for TS packets
  RESTRICT AUTOMERGE Harden Clearkey releaseSecureStops implementation.
  RESTRICT AUTOMERGE Fix Heap buffer overflow in clearkey releaseSecureStops
  camera2 ndk: Allow nullptr for ACameraCaptureSession_captureCallbacks.onClosed.
  Added usage to init call for audiostream registration.
  Camera: Handle onBuffersDiscarded callback
  camera2ndk: ~ACameraCaptureSession shouldn't hold device lock in ACameraDevice_close().
  Camera: Check consumer interface before disconnecting
  do not send max pts gap to full-frame image encoders
  C2SoftMpeg4Enc: Handle yStride not equal to aligned width
  vpxdec: handle non-display frames
  Fix secondary output under&over run
  Camera: Heic: Wait for output TS before dequeuing output buffers
  Camera: Heic: Handle out-of-order buffer outputs
  Camera: Heic: Wait for first output tile callback before muxer start
  g711 channel count limits
  aacenc: fix possible shift in remainder
  bufferpool@2.0 tune eviction params
  ...

Change-Id: Ifa70e0e7345d25ad0b78d2e25ef1a85dbd93eadf

Bug: 134680093
Bug: 146357162

Test: AImageReaderVendorTest

Merged-In: I8d365b434c257e949496d9495d0fa31a18a2e068
Change-Id: I8d365b434c257e949496d9495d0fa31a18a2e068
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
(cherry picked from commit 9da975d887ef8d63970e4b11dc9f2c0e0da92705)

* Some devices need additional code to load their cameras. Add a hook
  for extra classes and symbols to be included.

Originally implemented in Android.mk at 38b27bf2e5079441358288402b38865ba7c1d9d6
Credit to Ethan Chen for original Android.mk implementation

Change-Id: Iec667af2f0bfdb41f14df342cb128908244d7af0

-Add support for receiving dataCallback with fd/buffer as frame buffer

CRs-fixed: 654901
Change-Id: I5c16e560f1e209a6ab4afa4f3437602b02992b9b

 * If targets define a specific header path, then let it be the case
   and don't override it to avoid mismatched headers in the modules.

 * This only became an issue since O due to moved camera headers (commit e2b43843fd12783188edd2c54188ea8d26864788).

Change-Id: I6bf7d1da7448d71f7821d40501db971f837781db

 * Values end up NULL on some drivers, don't crash.

Change-Id: Ic897dbd4629cf3af98c85f93be202c382dde806b

We call disconnectLocked before stopping CameraDevice's looper, in order to avoid this situation:

1) Its possible that an OnResultReceived callback is received, and posts an
   AMessage with sp<ACameraCaptureSession> on CameraDevice's looper.

2) Before the looper message is processsed, ACameraDevice_close() is
   called by the client, which results in the looper being stopped and
   cleared with device lock held.

3) When the looper is getting cleared, the AMessage containg the
   ACameraCaptureSession pointer is destructed leading to
   ~ACameraCaptureSession running without knowing that the device is
   being closed, as a result it tries to hold device lock, resulting in
   a deadlock.

Bug: 141603005

Test: CTS native tests
Test: use camera2 vndk client for extended periods of time

Change-Id: Ia0d47fc2975981055cd1f2103c1cbe8d76642fe4
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
(cherry picked from commit a8bf1c6e6d210833070152adf130f4d988fc255e)

The cameraservice is only registered to service manager after onFirstRef
is returned. To reduce the probability of getBinderService() call
returning null, move pingCameraServiceProxy to end of onFirstRef().

Also add debug messages in onFirstRef and main() for better diagnoses.

Test: Camera CTS
Bug: 140414594
Change-Id: I52defd1c138ade57ebc5181c42aff30921fbeaeb