1 /******************************************************************************
2  *
3  *  Copyright 2002-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This module contains the action functions associated with the stream
22  *  control block state machine.
23  *
24  ******************************************************************************/
25 
26 #define LOG_TAG "bluetooth"
27 
28 #include <string.h>
29 #include "a2dp_codec_api.h"
30 #include "avdt_api.h"
31 #include "avdt_int.h"
32 #include "avdtc_api.h"
33 #include "bt_common.h"
34 #include "bt_target.h"
35 #include "bt_types.h"
36 #include "bt_utils.h"
37 #include "btu.h"
38 #include "osi/include/log.h"
39 #include "osi/include/osi.h"
40 
41 /* This table is used to lookup the callback event that matches a particular
42  * state machine API request event.  Note that state machine API request
43  * events are at the beginning of the event list starting at zero, thus
44  * allowing for this table.
45  */
46 const uint8_t avdt_scb_cback_evt[] = {
47     0,                     /* API_REMOVE_EVT (no event) */
48     AVDT_WRITE_CFM_EVT,    /* API_WRITE_REQ_EVT */
49     0,                     /* API_GETCONFIG_REQ_EVT (no event) */
50     0,                     /* API_DELAY_RPT_REQ_EVT (no event) */
51     AVDT_OPEN_CFM_EVT,     /* API_SETCONFIG_REQ_EVT */
52     AVDT_OPEN_CFM_EVT,     /* API_OPEN_REQ_EVT */
53     AVDT_CLOSE_CFM_EVT,    /* API_CLOSE_REQ_EVT */
54     AVDT_RECONFIG_CFM_EVT, /* API_RECONFIG_REQ_EVT */
55     AVDT_SECURITY_CFM_EVT, /* API_SECURITY_REQ_EVT */
56     0                      /* API_ABORT_REQ_EVT (no event) */
57 };
58 
59 /*******************************************************************************
60  *
61  * Function         avdt_scb_gen_ssrc
62  *
63  * Description      This function generates a SSRC number unique to the stream.
64  *
65  * Returns          SSRC value.
66  *
67  ******************************************************************************/
avdt_scb_gen_ssrc(AvdtpScb * p_scb)68 uint32_t avdt_scb_gen_ssrc(AvdtpScb* p_scb) {
69   /* combine the value of the media type and codec type of the SCB */
70   return ((uint32_t)(p_scb->stream_config.cfg.codec_info[1] |
71                      p_scb->stream_config.cfg.codec_info[2]));
72 }
73 
74 /*******************************************************************************
75  *
76  * Function         avdt_scb_hdl_abort_cmd
77  *
78  * Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
79  *                  to initiate sending of an abort response message.
80  *
81  * Returns          Nothing.
82  *
83  ******************************************************************************/
avdt_scb_hdl_abort_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)84 void avdt_scb_hdl_abort_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
85   p_scb->role = AVDT_CLOSE_ACP;
86   avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
87 }
88 
89 /*******************************************************************************
90  *
91  * Function         avdt_scb_hdl_abort_rsp
92  *
93  * Description      This function is an empty function; it serves as a
94  *                  placeholder for a conformance API action function.
95  *
96  * Returns          Nothing.
97  *
98  ******************************************************************************/
avdt_scb_hdl_abort_rsp(UNUSED_ATTR AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)99 void avdt_scb_hdl_abort_rsp(UNUSED_ATTR AvdtpScb* p_scb,
100                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
101   return;
102 }
103 
104 /*******************************************************************************
105  *
106  * Function         avdt_scb_hdl_close_cmd
107  *
108  * Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
109  *                  to initiate sending of a close response message.
110  *
111  * Returns          Nothing.
112  *
113  ******************************************************************************/
avdt_scb_hdl_close_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)114 void avdt_scb_hdl_close_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
115   p_scb->role = AVDT_CLOSE_ACP;
116   avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
117 }
118 
119 /*******************************************************************************
120  *
121  * Function         avdt_scb_hdl_close_rsp
122  *
123  * Description      This function sets the close_code variable to the error
124  *                  code returned in the close response.
125  *
126  * Returns          Nothing.
127  *
128  ******************************************************************************/
avdt_scb_hdl_close_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)129 void avdt_scb_hdl_close_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
130   p_scb->close_code = p_data->msg.hdr.err_code;
131 }
132 
133 /*******************************************************************************
134  *
135  * Function         avdt_scb_hdl_getconfig_cmd
136  *
137  * Description      This function retrieves the configuration parameters of
138  *                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
139  *                  to initiate sending of a get configuration response message.
140  *
141  * Returns          Nothing.
142  *
143  ******************************************************************************/
avdt_scb_hdl_getconfig_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)144 void avdt_scb_hdl_getconfig_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
145   p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
146 
147   avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
148 }
149 
150 /*******************************************************************************
151  *
152  * Function         avdt_scb_hdl_getconfig_rsp
153  *
154  * Description      This function is an empty function; it serves as a
155  *                  placeholder for a conformance API action function.
156  *
157  * Returns          Nothing.
158  *
159  ******************************************************************************/
avdt_scb_hdl_getconfig_rsp(UNUSED_ATTR AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)160 void avdt_scb_hdl_getconfig_rsp(UNUSED_ATTR AvdtpScb* p_scb,
161                                 UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
162   return;
163 }
164 
165 /*******************************************************************************
166  *
167  * Function         avdt_scb_hdl_open_cmd
168  *
169  * Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
170  *                  to initiate sending of an open response message.
171  *
172  * Returns          Nothing.
173  *
174  ******************************************************************************/
avdt_scb_hdl_open_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)175 void avdt_scb_hdl_open_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
176   avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
177 }
178 
179 /*******************************************************************************
180  *
181  * Function         avdt_scb_hdl_open_rej
182  *
183  * Description      This function calls the application callback function
184  *                  indicating the open request has failed.  It initializes
185  *                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
186  *                  to the CCB.
187  *
188  * Returns          Nothing.
189  *
190  ******************************************************************************/
avdt_scb_hdl_open_rej(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)191 void avdt_scb_hdl_open_rej(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
192   /* do exactly same as setconfig reject */
193   avdt_scb_hdl_setconfig_rej(p_scb, p_data);
194 }
195 
196 /*******************************************************************************
197  *
198  * Function         avdt_scb_hdl_open_rsp
199  *
200  * Description      This function calls avdt_ad_open_req() to initiate
201  *                  connection of the transport channel for this stream.
202  *
203  * Returns          Nothing.
204  *
205  ******************************************************************************/
avdt_scb_hdl_open_rsp(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)206 void avdt_scb_hdl_open_rsp(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
207   /* initiate opening of trans channels for this SEID */
208   p_scb->role = AVDT_OPEN_INT;
209   avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
210 
211   /* start tc connect timer */
212   alarm_set_on_mloop(p_scb->transport_channel_timer,
213                      AVDT_SCB_TC_CONN_TIMEOUT_MS,
214                      avdt_scb_transport_channel_timer_timeout, p_scb);
215 }
216 
217 /*******************************************************************************
218  *
219  * Function         avdt_scb_hdl_pkt_no_frag
220  *
221  * Description
222  *
223  * Returns          Nothing.
224  *
225  ******************************************************************************/
avdt_scb_hdl_pkt_no_frag(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)226 void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
227   uint8_t *p, *p_start;
228   uint8_t o_v, o_p, o_x, o_cc;
229   uint8_t m_pt;
230   uint8_t marker;
231   uint16_t seq;
232   uint32_t time_stamp;
233   uint16_t offset;
234   uint16_t ex_len;
235   uint8_t pad_len = 0;
236   uint16_t len = p_data->p_pkt->len;
237 
238   p = p_start = (uint8_t*)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
239 
240   /* parse media packet header */
241   offset = 12;
242   // AVDT_MSG_PRS_OCTET1(1) + AVDT_MSG_PRS_M_PT(1) + UINT16(2) + UINT32(4) + 4
243   if (offset > len) goto length_error;
244   AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
245   AVDT_MSG_PRS_M_PT(p, m_pt, marker);
246   BE_STREAM_TO_UINT16(seq, p);
247   BE_STREAM_TO_UINT32(time_stamp, p);
248   p += 4;
249 
250   /* skip over any csrc's in packet */
251   offset += o_cc * 4;
252   p += o_cc * 4;
253 
254   /* check for and skip over extension header */
255   if (o_x) {
256     offset += 4;
257     if (offset > len) goto length_error;
258     p += 2;
259     BE_STREAM_TO_UINT16(ex_len, p);
260     offset += ex_len * 4;
261     p += ex_len * 4;
262   }
263 
264   /* adjust length for any padding at end of packet */
265   if (o_p) {
266     /* padding length in last byte of packet */
267     pad_len = *(p_start + p_data->p_pkt->len);
268   }
269 
270   /* do sanity check */
271   if ((offset > p_data->p_pkt->len) ||
272       ((pad_len + offset) > p_data->p_pkt->len)) {
273     AVDT_TRACE_WARNING("Got bad media packet");
274     osi_free_and_reset((void**)&p_data->p_pkt);
275   }
276   /* adjust offset and length and send it up */
277   else {
278     p_data->p_pkt->len -= (offset + pad_len);
279     p_data->p_pkt->offset += offset;
280 
281     if (p_scb->stream_config.p_sink_data_cback != NULL) {
282       /* report sequence number */
283       p_data->p_pkt->layer_specific = seq;
284       (*p_scb->stream_config.p_sink_data_cback)(
285           avdt_scb_to_hdl(p_scb), p_data->p_pkt, time_stamp,
286           (uint8_t)(m_pt | (marker << 7)));
287     } else {
288       osi_free_and_reset((void**)&p_data->p_pkt);
289     }
290   }
291   return;
292 length_error:
293   android_errorWriteLog(0x534e4554, "111450156");
294   AVDT_TRACE_WARNING("%s: hdl packet length %d too short: must be at least %d",
295                      __func__, len, offset);
296   osi_free_and_reset((void**)&p_data->p_pkt);
297 }
298 
299 /*******************************************************************************
300  *
301  * Function         avdt_scb_hdl_report
302  *
303  * Description
304  *
305  * Returns          Nothing.
306  *
307  ******************************************************************************/
avdt_scb_hdl_report(AvdtpScb * p_scb,uint8_t * p,uint16_t len)308 uint8_t* avdt_scb_hdl_report(AvdtpScb* p_scb, uint8_t* p, uint16_t len) {
309   uint16_t result = AVDT_SUCCESS;
310   uint8_t* p_start = p;
311   uint32_t ssrc;
312   uint8_t o_v, o_p, o_cc;
313   uint16_t min_len = 0;
314   AVDT_REPORT_TYPE pt;
315   tAVDT_REPORT_DATA report;
316 
317   AVDT_TRACE_DEBUG("%s", __func__);
318   if (p_scb->stream_config.p_report_cback) {
319     /* parse report packet header */
320     min_len += 8;
321     if (min_len > len) {
322       android_errorWriteLog(0x534e4554, "111450156");
323       AVDT_TRACE_WARNING(
324           "%s: hdl packet length %d too short: must be at least %d", __func__,
325           len, min_len);
326       goto avdt_scb_hdl_report_exit;
327     }
328     AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
329     pt = *p++;
330     p += 2;
331     BE_STREAM_TO_UINT32(ssrc, p);
332 
333     switch (pt) {
334       case AVDT_RTCP_PT_SR: /* the packet type - SR (Sender Report) */
335         min_len += 20;
336         if (min_len > len) {
337           android_errorWriteLog(0x534e4554, "111450156");
338           AVDT_TRACE_WARNING(
339               "%s: hdl packet length %d too short: must be at least %d",
340               __func__, len, min_len);
341           goto avdt_scb_hdl_report_exit;
342         }
343         BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
344         BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
345         BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
346         BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
347         BE_STREAM_TO_UINT32(report.sr.octet_count, p);
348         break;
349 
350       case AVDT_RTCP_PT_RR: /* the packet type - RR (Receiver Report) */
351         min_len += 20;
352         if (min_len > len) {
353           android_errorWriteLog(0x534e4554, "111450156");
354           AVDT_TRACE_WARNING(
355               "%s: hdl packet length %d too short: must be at least %d",
356               __func__, len, min_len);
357           goto avdt_scb_hdl_report_exit;
358         }
359         report.rr.frag_lost = *p;
360         BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
361         report.rr.packet_lost &= 0xFFFFFF;
362         BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
363         BE_STREAM_TO_UINT32(report.rr.jitter, p);
364         BE_STREAM_TO_UINT32(report.rr.lsr, p);
365         BE_STREAM_TO_UINT32(report.rr.dlsr, p);
366         break;
367 
368       case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
369         uint8_t sdes_type;
370         min_len += 1;
371         if (min_len > len) {
372           android_errorWriteLog(0x534e4554, "111450156");
373           AVDT_TRACE_WARNING(
374               "%s: hdl packet length %d too short: must be at least %d",
375               __func__, len, min_len);
376           goto avdt_scb_hdl_report_exit;
377         }
378         BE_STREAM_TO_UINT8(sdes_type, p);
379         if (sdes_type == AVDT_RTCP_SDES_CNAME) {
380           uint8_t name_length;
381           min_len += 1;
382           if (min_len > len) {
383             android_errorWriteLog(0x534e4554, "111450156");
384             AVDT_TRACE_WARNING(
385                 "%s: hdl packet length %d too short: must be at least %d",
386                 __func__, len, min_len);
387             goto avdt_scb_hdl_report_exit;
388           }
389           BE_STREAM_TO_UINT8(name_length, p);
390           if (name_length > len - 2 || name_length > AVDT_MAX_CNAME_SIZE) {
391             result = AVDT_BAD_PARAMS;
392           } else {
393             BE_STREAM_TO_ARRAY(p, &(report.cname[0]), name_length);
394           }
395         } else {
396           if (min_len + 1 > len) {
397             android_errorWriteLog(0x534e4554, "111450156");
398             AVDT_TRACE_WARNING(
399                 "%s: hdl packet length %d too short: must be at least %d",
400                 __func__, len, min_len);
401             goto avdt_scb_hdl_report_exit;
402           }
403           AVDT_TRACE_WARNING(" - SDES SSRC=0x%08x sc=%d %d len=%d %s", ssrc,
404                              o_cc, *p, *(p + 1), p + 2);
405           result = AVDT_BUSY;
406         }
407         break;
408 
409       default:
410         AVDT_TRACE_ERROR("Bad Report pkt - packet type: %d", pt);
411         result = AVDT_BAD_PARAMS;
412     }
413 
414     if (result == AVDT_SUCCESS)
415       (*p_scb->stream_config.p_report_cback)(avdt_scb_to_hdl(p_scb), pt,
416                                              &report);
417   }
418 avdt_scb_hdl_report_exit:
419   p_start += len;
420   return p_start;
421 }
422 
423 /*******************************************************************************
424  *
425  * Function         avdt_scb_hdl_pkt
426  *
427  * Description
428  *
429  * Returns          Nothing.
430  *
431  ******************************************************************************/
avdt_scb_hdl_pkt(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)432 void avdt_scb_hdl_pkt(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
433   if (p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT) {
434     uint8_t* p = (uint8_t*)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
435     avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
436     osi_free_and_reset((void**)&p_data->p_pkt);
437   } else {
438     avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
439   }
440 }
441 
442 /*******************************************************************************
443  *
444  * Function         avdt_scb_drop_pkt
445  *
446  * Description      Drop an incoming media packet.  This function is called if
447  *                  a media packet is received in any state besides streaming.
448  *
449  * Returns          Nothing.
450  *
451  ******************************************************************************/
avdt_scb_drop_pkt(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)452 void avdt_scb_drop_pkt(UNUSED_ATTR AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
453   AVDT_TRACE_ERROR("%s dropped incoming media packet", __func__);
454   osi_free_and_reset((void**)&p_data->p_pkt);
455 }
456 
457 /*******************************************************************************
458  *
459  * Function         avdt_scb_hdl_reconfig_cmd
460  *
461  * Description      This function calls the application callback function
462  *                  with a reconfiguration indication.
463  *
464  * Returns          Nothing.
465  *
466  ******************************************************************************/
avdt_scb_hdl_reconfig_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)467 void avdt_scb_hdl_reconfig_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
468   /* if command not supported */
469   if (p_scb->stream_config.nsc_mask & AvdtpStreamConfig::AVDT_NSC_RECONFIG) {
470     /* send reject */
471     p_data->msg.hdr.err_code = AVDT_ERR_NSC;
472     p_data->msg.hdr.err_param = 0;
473     avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
474   } else {
475     /* store requested configuration */
476     p_scb->req_cfg = *p_data->msg.reconfig_cmd.p_cfg;
477 
478     /* call application callback */
479     (*p_scb->stream_config.p_avdt_ctrl_cback)(
480         avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_RECONFIG_IND_EVT,
481         (tAVDT_CTRL*)&p_data->msg.reconfig_cmd, p_scb->stream_config.scb_index);
482   }
483 }
484 
485 /*******************************************************************************
486  *
487  * Function         avdt_scb_hdl_reconfig_rsp
488  *
489  * Description      This function calls the application callback function
490  *                  with a reconfiguration confirm.
491  *
492  * Returns          Nothing.
493  *
494  ******************************************************************************/
avdt_scb_hdl_reconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)495 void avdt_scb_hdl_reconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
496   if (p_data->msg.hdr.err_code == 0) {
497     /* store new configuration */
498     if (p_scb->req_cfg.num_codec > 0) {
499       p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
500       memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info,
501              AVDT_CODEC_SIZE);
502     }
503     if (p_scb->req_cfg.num_protect > 0) {
504       p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
505       memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info,
506              AVDT_PROTECT_SIZE);
507     }
508   }
509 
510   p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
511 
512   /* call application callback */
513   (*p_scb->stream_config.p_avdt_ctrl_cback)(
514       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_RECONFIG_CFM_EVT,
515       (tAVDT_CTRL*)&p_data->msg.svccap, p_scb->stream_config.scb_index);
516 }
517 
518 /*******************************************************************************
519  *
520  * Function         avdt_scb_hdl_security_cmd
521  *
522  * Description      This function calls the application callback with a
523  *                  security indication.
524  *
525  * Returns          Nothing.
526  *
527  ******************************************************************************/
avdt_scb_hdl_security_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)528 void avdt_scb_hdl_security_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
529   /* if command not supported */
530   if (p_scb->stream_config.nsc_mask & AvdtpStreamConfig::AVDT_NSC_SECURITY) {
531     /* send reject */
532     p_data->msg.hdr.err_code = AVDT_ERR_NSC;
533     avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
534   } else {
535     /* call application callback */
536     (*p_scb->stream_config.p_avdt_ctrl_cback)(
537         avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_SECURITY_IND_EVT,
538         (tAVDT_CTRL*)&p_data->msg.security_cmd, p_scb->stream_config.scb_index);
539   }
540 }
541 
542 /*******************************************************************************
543  *
544  * Function         avdt_scb_hdl_security_rsp
545  *
546  * Description      This function calls the application callback with a
547  *                  security confirm.
548  *
549  * Returns          Nothing.
550  *
551  ******************************************************************************/
avdt_scb_hdl_security_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)552 void avdt_scb_hdl_security_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
553   /* call application callback */
554   (*p_scb->stream_config.p_avdt_ctrl_cback)(
555       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_SECURITY_CFM_EVT,
556       (tAVDT_CTRL*)&p_data->msg.security_cmd, p_scb->stream_config.scb_index);
557 }
558 
559 /*******************************************************************************
560  *
561  * Function         avdt_scb_hdl_setconfig_cmd
562  *
563  * Description      This function marks the SCB as in use and copies the
564  *                  configuration and peer SEID to the SCB.  It then calls
565  *                  the application callback with a configuration indication.
566  *
567  * Returns          Nothing.
568  *
569  ******************************************************************************/
avdt_scb_hdl_setconfig_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)570 void avdt_scb_hdl_setconfig_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
571   AVDT_TRACE_DEBUG("%s: p_scb->in_use=%d p_avdt_scb=%p scb_index=%d", __func__,
572                    p_scb->in_use, p_scb, p_scb->stream_config.scb_index);
573 
574   if (!p_scb->in_use) {
575     AVDT_TRACE_DEBUG(
576         "%s: codec: %s", __func__,
577         A2DP_CodecInfoString(p_scb->stream_config.cfg.codec_info).c_str());
578     AVDT_TRACE_DEBUG(
579         "%s: codec: %s", __func__,
580         A2DP_CodecInfoString(p_data->msg.config_cmd.p_cfg->codec_info).c_str());
581     AvdtpSepConfig* p_cfg = p_data->msg.config_cmd.p_cfg;
582     if (A2DP_GetCodecType(p_scb->stream_config.cfg.codec_info) ==
583         A2DP_GetCodecType(p_cfg->codec_info)) {
584       /* copy info to scb */
585       AvdtpCcb* p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
586       if (p_scb->p_ccb != p_ccb) {
587         AVDT_TRACE_ERROR(
588             "%s: mismatch in AVDTP SCB/CCB state: (p_scb->p_ccb=%p != "
589             "p_ccb=%p): "
590             "p_scb=%p scb_handle=%d ccb_idx=%d",
591             __func__, p_scb->p_ccb, p_ccb, p_scb, p_scb->ScbHandle(),
592             p_data->msg.config_cmd.hdr.ccb_idx);
593         avdt_scb_rej_not_in_use(p_scb, p_data);
594         return;
595       }
596       /* set sep as in use */
597       p_scb->in_use = true;
598 
599       p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
600       p_scb->req_cfg = *p_cfg;
601       /* call app callback */
602       /* handle of scb- which is same as sep handle of bta_av_cb.p_scb*/
603       (*p_scb->stream_config.p_avdt_ctrl_cback)(
604           avdt_scb_to_hdl(p_scb),
605           p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
606           AVDT_CONFIG_IND_EVT, (tAVDT_CTRL*)&p_data->msg.config_cmd,
607           p_scb->stream_config.scb_index);
608     } else {
609       p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
610       p_data->msg.hdr.err_param = 0;
611       avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
612                         p_data->msg.hdr.sig_id, &p_data->msg);
613     }
614   } else {
615     AVDT_TRACE_DEBUG("%s: calling avdt_scb_rej_in_use()", __func__);
616     avdt_scb_rej_in_use(p_scb, p_data);
617   }
618 }
619 
620 /*******************************************************************************
621  *
622  * Function         avdt_scb_hdl_setconfig_rej
623  *
624  * Description      This function marks the SCB as not in use and calls the
625  *                  application callback with an open confirm indicating
626  *                  failure.
627  *
628  * Returns          Nothing.
629  *
630  ******************************************************************************/
avdt_scb_hdl_setconfig_rej(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)631 void avdt_scb_hdl_setconfig_rej(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
632   /* clear scb variables */
633   avdt_scb_clr_vars(p_scb, p_data);
634 
635   /* tell ccb we're done with signaling channel */
636   avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
637                  AVDT_CCB_UL_CLOSE_EVT, NULL);
638 
639   /* call application callback */
640   (*p_scb->stream_config.p_avdt_ctrl_cback)(
641       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_OPEN_CFM_EVT,
642       (tAVDT_CTRL*)&p_data->msg.hdr, p_scb->stream_config.scb_index);
643 }
644 
645 /*******************************************************************************
646  *
647  * Function         avdt_scb_snd_snk_delay_rpt_req
648  *
649  * Description      This function sends the delay report request once it is sink
650  *
651  * Returns          Nothing.
652  *
653  ******************************************************************************/
avdt_scb_snd_snk_delay_rpt_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)654 void avdt_scb_snd_snk_delay_rpt_req(AvdtpScb* p_scb,
655                                     UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
656   if (p_scb->p_ccb == NULL) {
657     return;
658   }
659 
660   // In sink mode, report a fixed delay value when this device is the sink
661   // side. Delay value in this function is in unit of 1/10ms.
662   if (p_scb->stream_config.tsep != AVDT_TSEP_SNK) {
663     return;
664   }
665 
666   tAVDT_SCB_EVT evt;
667   evt.apidelay.hdr.seid = p_scb->peer_seid;
668   evt.apidelay.delay = AVDT_SINK_DELAY_MS * 10;
669   avdt_scb_event(p_scb, AVDT_SCB_API_DELAY_RPT_REQ_EVT, &evt);
670 }
671 
672 /*******************************************************************************
673  *
674  * Function         avdt_scb_hdl_setconfig_rsp
675  *
676  * Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
677  *                  to initiate sending of an open command message.
678  *
679  *                  This function sends the SCB an AVDT_SCB_API_DELAY_RPT_REQ_EVT
680  *                  to initiate sending of delay report command message only
681  *                  when the endpoint takes sink role.
682  *
683  * Returns          Nothing.
684  *
685  ******************************************************************************/
avdt_scb_hdl_setconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)686 void avdt_scb_hdl_setconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
687   tAVDT_EVT_HDR single;
688 
689   if (p_scb->p_ccb != NULL) {
690     /* save configuration */
691     p_scb->curr_cfg = p_scb->req_cfg;
692 
693     // In sink mode, report delay value when this device initiates the connection.
694     // Delay reporting is sent before open request (i.e., in configured state).
695     avdt_scb_snd_snk_delay_rpt_req(p_scb, p_data);
696 
697     /* initiate open */
698     single.seid = p_scb->peer_seid;
699     tAVDT_SCB_EVT avdt_scb_evt;
700     avdt_scb_evt.msg.single = single;
701     avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, &avdt_scb_evt);
702   }
703 }
704 
705 /*******************************************************************************
706  *
707  * Function         avdt_scb_hdl_start_cmd
708  *
709  * Description      This function calls the application callback with a
710  *                  start indication.
711  *
712  * Returns          Nothing.
713  *
714  ******************************************************************************/
avdt_scb_hdl_start_cmd(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)715 void avdt_scb_hdl_start_cmd(AvdtpScb* p_scb,
716                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
717   (*p_scb->stream_config.p_avdt_ctrl_cback)(
718       avdt_scb_to_hdl(p_scb),
719       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
720       AVDT_START_IND_EVT, NULL, p_scb->stream_config.scb_index);
721 }
722 
723 /*******************************************************************************
724  *
725  * Function         avdt_scb_hdl_start_rsp
726  *
727  * Description      This function calls the application callback with a
728  *                  start confirm.
729  *
730  * Returns          Nothing.
731  *
732  ******************************************************************************/
avdt_scb_hdl_start_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)733 void avdt_scb_hdl_start_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
734   (*p_scb->stream_config.p_avdt_ctrl_cback)(
735       avdt_scb_to_hdl(p_scb),
736       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
737       AVDT_START_CFM_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
738       p_scb->stream_config.scb_index);
739 }
740 
741 /*******************************************************************************
742  *
743  * Function         avdt_scb_hdl_suspend_cmd
744  *
745  * Description      This function calls the application callback with a suspend
746  *                  indication.
747  *
748  * Returns          Nothing.
749  *
750  ******************************************************************************/
avdt_scb_hdl_suspend_cmd(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)751 void avdt_scb_hdl_suspend_cmd(AvdtpScb* p_scb,
752                               UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
753   (*p_scb->stream_config.p_avdt_ctrl_cback)(
754       avdt_scb_to_hdl(p_scb),
755       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
756       AVDT_SUSPEND_IND_EVT, NULL, p_scb->stream_config.scb_index);
757 }
758 
759 /*******************************************************************************
760  *
761  * Function         avdt_scb_hdl_suspend_rsp
762  *
763  * Description      This function calls the application callback with a suspend
764  *                  confirm.
765  *
766  * Returns          Nothing.
767  *
768  ******************************************************************************/
avdt_scb_hdl_suspend_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)769 void avdt_scb_hdl_suspend_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
770   (*p_scb->stream_config.p_avdt_ctrl_cback)(
771       avdt_scb_to_hdl(p_scb),
772       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
773       AVDT_SUSPEND_CFM_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
774       p_scb->stream_config.scb_index);
775 }
776 
777 /*******************************************************************************
778  *
779  * Function         avdt_scb_hdl_tc_close
780  *
781  * Description      This function is called when the transport channel is
782  *                  closed.  It marks the SCB as not in use and
783  *                  initializes certain SCB parameters.  It then sends
784  *                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
785  *                  initiated the close.  It then checks to see if the SCB
786  *                  is to be removed.  If it is it deallocates the SCB.
787  *                  Finally, it calls the application callback with a close
788  *                  indication.
789  *
790  * Returns          Nothing.
791  *
792  ******************************************************************************/
avdt_scb_hdl_tc_close(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)793 void avdt_scb_hdl_tc_close(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
794   uint8_t hdl = avdt_scb_to_hdl(p_scb);
795   tAVDT_CTRL_CBACK* p_avdt_ctrl_cback = p_scb->stream_config.p_avdt_ctrl_cback;
796   tAVDT_CTRL avdt_ctrl;
797   uint8_t event;
798   AvdtpCcb* p_ccb = p_scb->p_ccb;
799   RawAddress remote_addr = p_ccb->peer_addr;
800   uint8_t scb_index = p_scb->stream_config.scb_index;
801 
802   /* set up hdr */
803   avdt_ctrl.hdr.err_code = p_scb->close_code;
804 
805   /* clear sep variables */
806   avdt_scb_clr_vars(p_scb, p_data);
807   p_scb->media_seq = 0;
808   p_scb->cong = false;
809 
810   /* free pkt we're holding, if any */
811   osi_free_and_reset((void**)&p_scb->p_pkt);
812 
813   alarm_cancel(p_scb->transport_channel_timer);
814 
815   if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT)) {
816     /* tell ccb we're done with signaling channel */
817     avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
818   }
819   event =
820       (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
821   p_scb->role = AVDT_CLOSE_ACP;
822 
823   if (p_scb->remove) {
824     avdt_scb_dealloc(p_scb, NULL);
825   }
826 
827   /* call app callback */
828   (*p_avdt_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl, scb_index);
829 }
830 
831 /*******************************************************************************
832  *
833  * Function         avdt_scb_snd_delay_rpt_req
834  *
835  * Description      This function calls the application callback with a delay
836  *                  report.
837  *
838  * Returns          Nothing.
839  *
840  ******************************************************************************/
avdt_scb_snd_delay_rpt_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)841 void avdt_scb_snd_delay_rpt_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
842   if (p_scb->stream_config.cfg.psc_mask & AVDT_PSC_DELAY_RPT) {
843     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT,
844                       (tAVDT_MSG*)&p_data->apidelay);
845   }
846 }
847 
848 /*******************************************************************************
849  *
850  * Function         avdt_scb_hdl_delay_rpt_cmd
851  *
852  * Description      This function calls the application callback with a delay
853  *                  report.
854  *
855  * Returns          Nothing.
856  *
857  ******************************************************************************/
avdt_scb_hdl_delay_rpt_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)858 void avdt_scb_hdl_delay_rpt_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
859   (*p_scb->stream_config.p_avdt_ctrl_cback)(
860       avdt_scb_to_hdl(p_scb),
861       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
862       AVDT_DELAY_REPORT_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
863       p_scb->stream_config.scb_index);
864 
865   if (p_scb->p_ccb)
866     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
867   else
868     avdt_scb_rej_not_in_use(p_scb, p_data);
869 }
870 
871 /*******************************************************************************
872  *
873  * Function         avdt_scb_hdl_delay_rpt_rsp
874  *
875  * Description      This function calls the application callback with a delay
876  *                  report.
877  *
878  * Returns          Nothing.
879  *
880  ******************************************************************************/
avdt_scb_hdl_delay_rpt_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)881 void avdt_scb_hdl_delay_rpt_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
882   (*p_scb->stream_config.p_avdt_ctrl_cback)(
883       avdt_scb_to_hdl(p_scb),
884       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
885       AVDT_DELAY_REPORT_CFM_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
886       p_scb->stream_config.scb_index);
887 }
888 
889 /*******************************************************************************
890  *
891  * Function         avdt_scb_hdl_tc_close_sto
892  *
893  * Description      This function is called when a channel is closed in OPEN
894  *                  state.  Check the channel type and process accordingly.
895  *
896  * Returns          Nothing.
897  *
898  ******************************************************************************/
avdt_scb_hdl_tc_close_sto(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)899 void avdt_scb_hdl_tc_close_sto(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
900   tAVDT_CTRL avdt_ctrl;
901   /* AVDT_CHAN_SIG does not visit this action */
902   if (p_data && p_data->close.type != AVDT_CHAN_MEDIA) {
903     /* it's reporting or recovery channel,
904      * the channel close in open state means the peer does not support it */
905     if (p_data->close.old_tc_state == AVDT_AD_ST_OPEN) {
906       avdt_ctrl.hdr.err_code = 0;
907       avdt_ctrl.hdr.err_param = 0;
908       /* call app callback */
909       (*p_scb->stream_config.p_avdt_ctrl_cback)(
910           avdt_scb_to_hdl(p_scb),
911           p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
912           AVDT_REPORT_DISCONN_EVT, &avdt_ctrl, p_scb->stream_config.scb_index);
913     }
914   } else {
915     /* must be in OPEN state. need to go back to idle */
916     avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
917     avdt_scb_hdl_tc_close(p_scb, p_data);
918   }
919 }
920 
921 /*******************************************************************************
922  *
923  * Function         avdt_scb_hdl_tc_open
924  *
925  * Description      This function is called when the transport channel is
926  *                  opened while in the opening state.  It calls the
927  *                  application callback with an open indication or open
928  *                  confirm depending on who initiated the open procedure.
929  *
930  * Returns          Nothing.
931  *
932  ******************************************************************************/
avdt_scb_hdl_tc_open(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)933 void avdt_scb_hdl_tc_open(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
934   uint8_t event;
935   uint8_t role;
936 
937   alarm_cancel(p_scb->transport_channel_timer);
938 
939   event =
940       (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
941   p_data->open.hdr.err_code = 0;
942 
943   AVDT_TRACE_DEBUG("%s: psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x", __func__,
944                    p_scb->stream_config.cfg.psc_mask, p_scb->req_cfg.psc_mask,
945                    p_scb->curr_cfg.psc_mask);
946   if (p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) {
947     /* open the reporting channel, if both devices support it */
948     role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
949     avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
950   }
951 
952   /* call app callback */
953   (*p_scb->stream_config.p_avdt_ctrl_cback)(
954       avdt_scb_to_hdl(p_scb),
955       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty, event,
956       (tAVDT_CTRL*)&p_data->open, p_scb->stream_config.scb_index);
957 }
958 
959 /*******************************************************************************
960  *
961  * Function         avdt_scb_hdl_tc_open_sto
962  *
963  * Description      This function is called when the transport channel is
964  *                  opened while in the opening state.  It calls the
965  *                  application callback with an open indication or open
966  *                  confirm depending on who initiated the open procedure.
967  *
968  * Returns          Nothing.
969  *
970  ******************************************************************************/
avdt_scb_hdl_tc_open_sto(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)971 void avdt_scb_hdl_tc_open_sto(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
972   tAVDT_CTRL avdt_ctrl;
973   /* open reporting channel here, when it is implemented */
974 
975   /* call app callback */
976   if (p_data->open.hdr.err_code == AVDT_CHAN_REPORT) {
977     avdt_ctrl.hdr.err_code = 0;
978     avdt_ctrl.hdr.err_param = 1;
979     (*p_scb->stream_config.p_avdt_ctrl_cback)(
980         avdt_scb_to_hdl(p_scb),
981         p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
982         AVDT_REPORT_CONN_EVT, &avdt_ctrl, p_scb->stream_config.scb_index);
983   }
984 }
985 
986 /*******************************************************************************
987  *
988  * Function         avdt_scb_hdl_write_req
989  *
990  * Description      This function frees the media packet currently stored in
991  *                  the SCB, if any.  Then it builds a new media packet from
992  *                  with the passed in buffer and stores it in the SCB.
993  *
994  * Returns          Nothing.
995  *
996  ******************************************************************************/
avdt_scb_hdl_write_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)997 void avdt_scb_hdl_write_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
998   uint8_t* p;
999   uint32_t ssrc;
1000   bool add_rtp_header = !(p_data->apiwrite.opt & AVDT_DATA_OPT_NO_RTP);
1001 
1002   /* free packet we're holding, if any; to be replaced with new */
1003   if (p_scb->p_pkt != NULL) {
1004     /* this shouldn't be happening */
1005     AVDT_TRACE_WARNING("Dropped media packet; congested");
1006   }
1007   osi_free_and_reset((void**)&p_scb->p_pkt);
1008 
1009   /* Recompute only if the RTP header wasn't disabled by the API */
1010   if (add_rtp_header) {
1011     bool is_content_protection = (p_scb->curr_cfg.num_protect > 0);
1012     add_rtp_header =
1013         A2DP_UsesRtpHeader(is_content_protection, p_scb->curr_cfg.codec_info);
1014   }
1015 
1016   /* Build a media packet, and add an RTP header if required. */
1017   if (add_rtp_header) {
1018     ssrc = avdt_scb_gen_ssrc(p_scb);
1019 
1020     p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
1021     p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
1022     p_scb->media_seq++;
1023     p = (uint8_t*)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
1024 
1025     UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
1026     UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
1027     UINT16_TO_BE_STREAM(p, p_scb->media_seq);
1028     UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
1029     UINT32_TO_BE_STREAM(p, ssrc);
1030   }
1031 
1032   /* store it */
1033   p_scb->p_pkt = p_data->apiwrite.p_buf;
1034 }
1035 
1036 /*******************************************************************************
1037  *
1038  * Function         avdt_scb_snd_abort_req
1039  *
1040  * Description      This function sends an abort command message.
1041  *
1042  * Returns          Nothing.
1043  *
1044  ******************************************************************************/
avdt_scb_snd_abort_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1045 void avdt_scb_snd_abort_req(AvdtpScb* p_scb,
1046                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1047   tAVDT_EVT_HDR hdr;
1048 
1049   AVDT_TRACE_DEBUG("%s: p_scb->p_ccb=%p", __func__, p_scb->p_ccb);
1050 
1051   if (p_scb->p_ccb != NULL) {
1052     p_scb->role = AVDT_CLOSE_INT;
1053 
1054     hdr.seid = p_scb->peer_seid;
1055 
1056     tAVDT_MSG avdt_msg;
1057     avdt_msg.hdr = hdr;
1058     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, &avdt_msg);
1059   }
1060 }
1061 
1062 /*******************************************************************************
1063  *
1064  * Function         avdt_scb_snd_abort_rsp
1065  *
1066  * Description      This function sends an abort response message.
1067  *
1068  * Returns          Nothing.
1069  *
1070  ******************************************************************************/
avdt_scb_snd_abort_rsp(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1071 void avdt_scb_snd_abort_rsp(UNUSED_ATTR AvdtpScb* p_scb,
1072                             tAVDT_SCB_EVT* p_data) {
1073   avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
1074                     &p_data->msg);
1075 }
1076 
1077 /*******************************************************************************
1078  *
1079  * Function         avdt_scb_snd_close_req
1080  *
1081  * Description      This function sends a close command message.
1082  *
1083  * Returns          Nothing.
1084  *
1085  ******************************************************************************/
avdt_scb_snd_close_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1086 void avdt_scb_snd_close_req(AvdtpScb* p_scb,
1087                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1088   tAVDT_EVT_HDR hdr;
1089 
1090   p_scb->role = AVDT_CLOSE_INT;
1091 
1092   hdr.seid = p_scb->peer_seid;
1093 
1094   tAVDT_MSG avdt_msg;
1095   avdt_msg.hdr = hdr;
1096   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, &avdt_msg);
1097 }
1098 
1099 /*******************************************************************************
1100  *
1101  * Function         avdt_scb_snd_stream_close
1102  *
1103  * Description      This function sends a close command message.
1104  *
1105  * Returns          Nothing.
1106  *
1107  ******************************************************************************/
avdt_scb_snd_stream_close(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1108 void avdt_scb_snd_stream_close(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1109   osi_free_and_reset((void**)&p_scb->p_pkt);
1110   avdt_scb_snd_close_req(p_scb, p_data);
1111 }
1112 
1113 /*******************************************************************************
1114  *
1115  * Function         avdt_scb_snd_close_rsp
1116  *
1117  * Description      This function sends a close response message.
1118  *
1119  * Returns          Nothing.
1120  *
1121  ******************************************************************************/
avdt_scb_snd_close_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1122 void avdt_scb_snd_close_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1123   avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
1124 }
1125 
1126 /*******************************************************************************
1127  *
1128  * Function         avdt_scb_snd_getconfig_req
1129  *
1130  * Description      This function sends a get configuration command message.
1131  *
1132  * Returns          Nothing.
1133  *
1134  ******************************************************************************/
avdt_scb_snd_getconfig_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1135 void avdt_scb_snd_getconfig_req(AvdtpScb* p_scb,
1136                                 UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1137   tAVDT_EVT_HDR hdr;
1138 
1139   hdr.seid = p_scb->peer_seid;
1140 
1141   tAVDT_MSG avdt_msg;
1142   avdt_msg.hdr = hdr;
1143   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, &avdt_msg);
1144 }
1145 
1146 /*******************************************************************************
1147  *
1148  * Function         avdt_scb_snd_getconfig_rsp
1149  *
1150  * Description      This function sends a get configuration response message.
1151  *
1152  * Returns          Nothing.
1153  *
1154  ******************************************************************************/
avdt_scb_snd_getconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1155 void avdt_scb_snd_getconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1156   avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
1157 }
1158 
1159 /*******************************************************************************
1160  *
1161  * Function         avdt_scb_snd_open_req
1162  *
1163  * Description      This function sends an open command message.
1164  *
1165  * Returns          Nothing.
1166  *
1167  ******************************************************************************/
avdt_scb_snd_open_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1168 void avdt_scb_snd_open_req(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1169   tAVDT_EVT_HDR hdr;
1170 
1171   hdr.seid = p_scb->peer_seid;
1172 
1173   tAVDT_MSG avdt_msg;
1174   avdt_msg.hdr = hdr;
1175   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, &avdt_msg);
1176 }
1177 
1178 /*******************************************************************************
1179  *
1180  * Function         avdt_scb_snd_open_rsp
1181  *
1182  * Description      This function sends an open response message.  It also
1183  *                  calls avdt_ad_open_req() to accept a transport channel
1184  *                  connection.
1185  *
1186  * Returns          Nothing.
1187  *
1188  ******************************************************************************/
avdt_scb_snd_open_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1189 void avdt_scb_snd_open_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1190   /* notify adaption that we're waiting for transport channel open */
1191   p_scb->role = AVDT_OPEN_ACP;
1192   avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
1193 
1194   /* send response */
1195   avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
1196 
1197   alarm_set_on_mloop(p_scb->transport_channel_timer,
1198                      AVDT_SCB_TC_CONN_TIMEOUT_MS,
1199                      avdt_scb_transport_channel_timer_timeout, p_scb);
1200 }
1201 
1202 /*******************************************************************************
1203  *
1204  * Function         avdt_scb_snd_reconfig_req
1205  *
1206  * Description      This function stores the configuration parameters in the
1207  *                  SCB and sends a reconfiguration command message.
1208  *
1209  * Returns          Nothing.
1210  *
1211  ******************************************************************************/
avdt_scb_snd_reconfig_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1212 void avdt_scb_snd_reconfig_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1213   AVDT_TRACE_DEBUG("%s: p_scb->peer_seid=%d p_data->msg.hdr.seid=%d", __func__,
1214                    p_scb->peer_seid, p_data->msg.hdr.seid);
1215   AVDT_TRACE_DEBUG(
1216       "%s: codec: %s", __func__,
1217       A2DP_CodecInfoString(p_data->msg.config_cmd.p_cfg->codec_info).c_str());
1218 
1219   p_scb->req_cfg = *p_data->msg.config_cmd.p_cfg;
1220   p_data->msg.hdr.seid = p_scb->peer_seid;
1221   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
1222 }
1223 
1224 /*******************************************************************************
1225  *
1226  * Function         avdt_scb_snd_reconfig_rsp
1227  *
1228  * Description      This function stores the configuration parameters in the
1229  *                  SCB and sends a reconfiguration response message.
1230  *
1231  * Returns          Nothing.
1232  *
1233  ******************************************************************************/
avdt_scb_snd_reconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1234 void avdt_scb_snd_reconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1235   if (p_data->msg.hdr.err_code == 0) {
1236     /* store new configuration */
1237     if (p_scb->req_cfg.num_codec > 0) {
1238       p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
1239       memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info,
1240              AVDT_CODEC_SIZE);
1241     }
1242     if (p_scb->req_cfg.num_protect > 0) {
1243       p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
1244       memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info,
1245              AVDT_PROTECT_SIZE);
1246     }
1247 
1248     /* send response */
1249     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1250   } else {
1251     /* send reject */
1252     avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1253   }
1254 }
1255 
1256 /*******************************************************************************
1257  *
1258  * Function         avdt_scb_snd_security_req
1259  *
1260  * Description      This function sends a security command message.
1261  *
1262  * Returns          Nothing.
1263  *
1264  ******************************************************************************/
avdt_scb_snd_security_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1265 void avdt_scb_snd_security_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1266   p_data->msg.hdr.seid = p_scb->peer_seid;
1267   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
1268 }
1269 
1270 /*******************************************************************************
1271  *
1272  * Function         avdt_scb_snd_security_rsp
1273  *
1274  * Description      This function sends a security response message.
1275  *
1276  * Returns          Nothing.
1277  *
1278  ******************************************************************************/
avdt_scb_snd_security_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1279 void avdt_scb_snd_security_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1280   if (p_data->msg.hdr.err_code == 0) {
1281     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1282   } else {
1283     avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1284   }
1285 }
1286 
1287 /*******************************************************************************
1288  *
1289  * Function         avdt_scb_snd_setconfig_rej
1290  *
1291  * Description      This function marks the SCB as not in use and sends a
1292  *                  set configuration reject message.
1293  *
1294  * Returns          Nothing.
1295  *
1296  ******************************************************************************/
avdt_scb_snd_setconfig_rej(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1297 void avdt_scb_snd_setconfig_rej(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1298   if (p_scb->p_ccb != NULL) {
1299     avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1300 
1301     /* clear scb variables */
1302     avdt_scb_clr_vars(p_scb, p_data);
1303   }
1304 }
1305 
1306 /*******************************************************************************
1307  *
1308  * Function         avdt_scb_snd_setconfig_req
1309  *
1310  * Description      This function marks the SCB as in use and copies the
1311  *                  configuration parameters to the SCB.  Then the function
1312  *                  sends a set configuration command message and initiates
1313  *                  opening of the signaling channel.
1314  *
1315  * Returns          Nothing.
1316  *
1317  ******************************************************************************/
avdt_scb_snd_setconfig_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1318 void avdt_scb_snd_setconfig_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1319   AvdtpSepConfig *p_req, *p_cfg;
1320 
1321   AVDT_TRACE_DEBUG(
1322       "%s: codec: %s", __func__,
1323       A2DP_CodecInfoString(p_data->msg.config_cmd.p_cfg->codec_info).c_str());
1324 
1325   /* copy API parameters to scb, set scb as in use */
1326 
1327   AvdtpCcb* p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
1328   if (p_scb->p_ccb != p_ccb) {
1329     AVDT_TRACE_ERROR(
1330         "%s: mismatch in AVDTP SCB/CCB state: (p_scb->p_ccb=%p != p_ccb=%p): "
1331         "p_scb=%p scb_handle=%d ccb_idx=%d",
1332         __func__, p_scb->p_ccb, p_ccb, p_scb, p_scb->ScbHandle(),
1333         p_data->msg.config_cmd.hdr.ccb_idx);
1334     avdt_scb_rej_not_in_use(p_scb, p_data);
1335     return;
1336   }
1337   p_scb->in_use = true;
1338   p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
1339   p_req = p_data->msg.config_cmd.p_cfg;
1340   p_cfg = &p_scb->stream_config.cfg;
1341   p_scb->req_cfg = *p_data->msg.config_cmd.p_cfg;
1342 
1343   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
1344 
1345   /* tell ccb to open channel */
1346   avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
1347 }
1348 
1349 /*******************************************************************************
1350  *
1351  * Function         avdt_scb_snd_setconfig_rsp
1352  *
1353  * Description      This function copies the requested configuration into the
1354  *                  current configuration and sends a set configuration
1355  *                  response message.
1356  *
1357  * Returns          Nothing.
1358  *
1359  ******************************************************************************/
avdt_scb_snd_setconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1360 void avdt_scb_snd_setconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1361   if (p_scb->p_ccb != NULL) {
1362     p_scb->curr_cfg = p_scb->req_cfg;
1363 
1364     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1365   }
1366 }
1367 
1368 /*******************************************************************************
1369  *
1370  * Function         avdt_scb_snd_tc_close
1371  *
1372  * Description      This function calls avdt_ad_close_req() to close the
1373  *                  transport channel for this SCB.
1374  *
1375  * Returns          Nothing.
1376  *
1377  ******************************************************************************/
avdt_scb_snd_tc_close(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1378 void avdt_scb_snd_tc_close(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1379   if (p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
1380     avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
1381   avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
1382 }
1383 
1384 /*******************************************************************************
1385  *
1386  * Function         avdt_scb_cb_err
1387  *
1388  * Description      This function calls the application callback function
1389  *                  indicating an error.
1390  *
1391  * Returns          Nothing.
1392  *
1393  ******************************************************************************/
avdt_scb_cb_err(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1394 void avdt_scb_cb_err(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1395   tAVDT_CTRL avdt_ctrl;
1396 
1397   /* set error code and parameter */
1398   avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1399   avdt_ctrl.hdr.err_param = 0;
1400 
1401   /* call callback, using lookup table to get callback event */
1402   (*p_scb->stream_config.p_avdt_ctrl_cback)(
1403       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty,
1404       avdt_scb_cback_evt[p_scb->curr_evt], &avdt_ctrl,
1405       p_scb->stream_config.scb_index);
1406 }
1407 
1408 /*******************************************************************************
1409  *
1410  * Function         avdt_scb_cong_state
1411  *
1412  * Description      This function sets the congestion state of the SCB media
1413  *                  transport channel.
1414  *
1415  * Returns          Nothing.
1416  *
1417  ******************************************************************************/
avdt_scb_cong_state(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1418 void avdt_scb_cong_state(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1419   p_scb->cong = p_data->llcong;
1420 }
1421 
1422 /*******************************************************************************
1423  *
1424  * Function         avdt_scb_rej_state
1425  *
1426  * Description      This function sends a reject message to the peer indicating
1427  *                  incorrect state for the received command message.
1428  *
1429  * Returns          Nothing.
1430  *
1431  ******************************************************************************/
avdt_scb_rej_state(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1432 void avdt_scb_rej_state(UNUSED_ATTR AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1433   p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
1434   p_data->msg.hdr.err_param = 0;
1435   avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1436                     p_data->msg.hdr.sig_id, &p_data->msg);
1437 }
1438 
1439 /*******************************************************************************
1440  *
1441  * Function         avdt_scb_rej_in_use
1442  *
1443  * Description      This function sends a reject message to the peer indicating
1444  *                  the stream is in use.
1445  *
1446  * Returns          Nothing.
1447  *
1448  ******************************************************************************/
avdt_scb_rej_in_use(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1449 void avdt_scb_rej_in_use(UNUSED_ATTR AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1450   p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
1451   p_data->msg.hdr.err_param = 0;
1452   avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1453                     p_data->msg.hdr.sig_id, &p_data->msg);
1454 }
1455 
1456 /*******************************************************************************
1457  *
1458  * Function         avdt_scb_rej_not_in_use
1459  *
1460  * Description      This function sends a reject message to the peer indicating
1461  *                  the stream is in use.
1462  *
1463  * Returns          Nothing.
1464  *
1465  ******************************************************************************/
avdt_scb_rej_not_in_use(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1466 void avdt_scb_rej_not_in_use(UNUSED_ATTR AvdtpScb* p_scb,
1467                              tAVDT_SCB_EVT* p_data) {
1468   p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
1469   p_data->msg.hdr.err_param = 0;
1470   avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1471                     p_data->msg.hdr.sig_id, &p_data->msg);
1472 }
1473 
1474 /*******************************************************************************
1475  *
1476  * Function         avdt_scb_set_remove
1477  *
1478  * Description      This function marks an SCB to be removed.
1479  *
1480  * Returns          Nothing.
1481  *
1482  ******************************************************************************/
avdt_scb_set_remove(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1483 void avdt_scb_set_remove(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1484   p_scb->remove = true;
1485 }
1486 
1487 /*******************************************************************************
1488  *
1489  * Function         avdt_scb_free_pkt
1490  *
1491  * Description      This function frees the media packet passed in.
1492  *
1493  * Returns          Nothing.
1494  *
1495  ******************************************************************************/
avdt_scb_free_pkt(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1496 void avdt_scb_free_pkt(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1497   tAVDT_CTRL avdt_ctrl;
1498 
1499   /* set error code and parameter */
1500   avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1501   avdt_ctrl.hdr.err_param = 0;
1502 
1503   osi_free_and_reset((void**)&p_data->apiwrite.p_buf);
1504 
1505   AVDT_TRACE_WARNING("Dropped media packet");
1506 
1507   /* we need to call callback to keep data flow going */
1508   (*p_scb->stream_config.p_avdt_ctrl_cback)(
1509       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_WRITE_CFM_EVT,
1510       &avdt_ctrl, p_scb->stream_config.scb_index);
1511 }
1512 
1513 /*******************************************************************************
1514  *
1515  * Function         avdt_scb_clr_pkt
1516  *
1517  * Description      This function frees the media packet stored in the SCB.
1518  *
1519  * Returns          Nothing.
1520  *
1521  ******************************************************************************/
avdt_scb_clr_pkt(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1522 void avdt_scb_clr_pkt(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1523   tAVDT_CTRL avdt_ctrl;
1524   AvdtpCcb* p_ccb;
1525   uint8_t tcid;
1526   uint16_t lcid;
1527 
1528   /* set error code and parameter */
1529   avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1530   avdt_ctrl.hdr.err_param = 0;
1531   /* flush the media data queued at L2CAP */
1532   p_ccb = p_scb->p_ccb;
1533   if (p_ccb != NULL) {
1534     /* get tcid from type, scb */
1535     tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
1536 
1537     lcid = avdtp_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
1538     L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_ALL);
1539   }
1540 
1541   if (p_scb->p_pkt != NULL) {
1542     osi_free_and_reset((void**)&p_scb->p_pkt);
1543 
1544     AVDT_TRACE_DEBUG("Dropped stored media packet");
1545 
1546     /* we need to call callback to keep data flow going */
1547     (*p_scb->stream_config.p_avdt_ctrl_cback)(
1548         avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_WRITE_CFM_EVT,
1549         &avdt_ctrl, p_scb->stream_config.scb_index);
1550   }
1551 }
1552 
1553 /*******************************************************************************
1554  *
1555  * Function         avdt_scb_chk_snd_pkt
1556  *
1557  * Description      This function checks if the SCB is congested, and if not
1558  *                  congested it sends a stored media packet, if any.  After it
1559  *                  sends the packet it calls the application callback function
1560  *                  with a write confirm.
1561  *
1562  * Returns          Nothing.
1563  *
1564  ******************************************************************************/
avdt_scb_chk_snd_pkt(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1565 void avdt_scb_chk_snd_pkt(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1566   tAVDT_CTRL avdt_ctrl;
1567   BT_HDR* p_pkt;
1568 
1569   avdt_ctrl.hdr.err_code = 0;
1570 
1571   if (!p_scb->cong) {
1572     if (p_scb->p_pkt != NULL) {
1573       p_pkt = p_scb->p_pkt;
1574       p_scb->p_pkt = NULL;
1575       avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
1576 
1577       (*p_scb->stream_config.p_avdt_ctrl_cback)(
1578           avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_WRITE_CFM_EVT,
1579           &avdt_ctrl, p_scb->stream_config.scb_index);
1580     }
1581   }
1582 }
1583 
1584 /*******************************************************************************
1585  *
1586  * Function         avdt_scb_transport_channel_timer
1587  *
1588  * Description      This function is called to start a timer when the peer
1589  *                  initiates closing of the stream.  The timer verifies that
1590  *                  the peer disconnects the transport channel.
1591  *
1592  * Returns          Nothing.
1593  *
1594  ******************************************************************************/
avdt_scb_transport_channel_timer(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1595 void avdt_scb_transport_channel_timer(AvdtpScb* p_scb,
1596                                       UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1597   alarm_set_on_mloop(p_scb->transport_channel_timer,
1598                      AVDT_SCB_TC_DISC_TIMEOUT_MS,
1599                      avdt_scb_transport_channel_timer_timeout, p_scb);
1600 }
1601 
1602 /*******************************************************************************
1603  *
1604  * Function         avdt_scb_clr_vars
1605  *
1606  * Description      This function initializes certain SCB variables.
1607  *
1608  * Returns          Nothing.
1609  *
1610  ******************************************************************************/
avdt_scb_clr_vars(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1611 void avdt_scb_clr_vars(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1612   p_scb->in_use = false;
1613   p_scb->peer_seid = 0;
1614 }
1615