1 /******************************************************************************
2  *
3  *  Copyright (C) 2004-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains action functions for advanced audio/video main state
22  *  machine.
23  *
24  ******************************************************************************/
25 
26 #include "bt_target.h"
27 #if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE)
28 
29 #include <string.h>
30 #include "bta_av_api.h"
31 #include "bta_av_int.h"
32 #include "avdt_api.h"
33 #include "utl.h"
34 #include "l2c_api.h"
35 #include "osi/include/list.h"
36 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
37 #include "bta_ar_api.h"
38 #endif
39 
40 #define LOG_TAG "bt_bta_av"
41 #include "osi/include/log.h"
42 
43 /*****************************************************************************
44 **  Constants
45 *****************************************************************************/
46 /* the timer in milliseconds to wait for open req after setconfig for incoming connections */
47 #ifndef BTA_AV_SIG_TIME_VAL
48 #define BTA_AV_SIG_TIME_VAL 8000
49 #endif
50 
51 /* In millisec to wait for signalling from SNK when it is initiated from SNK.   */
52 /* If not, we will start signalling from SRC.                                   */
53 #ifndef BTA_AV_ACP_SIG_TIME_VAL
54 #define BTA_AV_ACP_SIG_TIME_VAL 2000
55 #endif
56 
57 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle);
58 
59 /*******************************************************************************
60 **
61 ** Function         bta_av_get_rcb_by_shdl
62 **
63 ** Description      find the RCB associated with the given SCB handle.
64 **
65 ** Returns          tBTA_AV_RCB
66 **
67 *******************************************************************************/
bta_av_get_rcb_by_shdl(UINT8 shdl)68 tBTA_AV_RCB * bta_av_get_rcb_by_shdl(UINT8 shdl)
69 {
70     tBTA_AV_RCB *p_rcb = NULL;
71     int         i;
72 
73     for (i=0; i<BTA_AV_NUM_RCB; i++)
74     {
75         if (bta_av_cb.rcb[i].shdl == shdl && bta_av_cb.rcb[i].handle != BTA_AV_RC_HANDLE_NONE)
76         {
77             p_rcb = &bta_av_cb.rcb[i];
78             break;
79         }
80     }
81     return p_rcb;
82 }
83 #define BTA_AV_STS_NO_RSP       0xFF    /* a number not used by tAVRC_STS */
84 
85 /*******************************************************************************
86 **
87 ** Function         bta_av_del_rc
88 **
89 ** Description      delete the given AVRC handle.
90 **
91 ** Returns          void
92 **
93 *******************************************************************************/
bta_av_del_rc(tBTA_AV_RCB * p_rcb)94 void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
95 {
96     tBTA_AV_SCB  *p_scb;
97     UINT8        rc_handle;      /* connected AVRCP handle */
98 
99     p_scb = NULL;
100     if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
101     {
102         if(p_rcb->shdl)
103         {
104             /* Validate array index*/
105             if ((p_rcb->shdl - 1) < BTA_AV_NUM_STRS)
106             {
107                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
108             }
109             if(p_scb)
110             {
111                 APPL_TRACE_DEBUG("bta_av_del_rc shdl:%d, srch:%d rc_handle:%d", p_rcb->shdl,
112                                   p_scb->rc_handle, p_rcb->handle);
113                 if(p_scb->rc_handle == p_rcb->handle)
114                     p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
115                 /* just in case the RC timer is active
116                 if(bta_av_cb.features & BTA_AV_FEAT_RCCT && p_scb->chnl == BTA_AV_CHNL_AUDIO) */
117                     bta_sys_stop_timer(&p_scb->timer);
118             }
119         }
120 
121         APPL_TRACE_EVENT("bta_av_del_rc  handle: %d status=0x%x, rc_acp_handle:%d, idx:%d",
122             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, bta_av_cb.rc_acp_idx);
123         rc_handle = p_rcb->handle;
124         if(!(p_rcb->status & BTA_AV_RC_CONN_MASK) ||
125             ((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT) )
126         {
127             p_rcb->status = 0;
128             p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
129             p_rcb->shdl = 0;
130             p_rcb->lidx = 0;
131         }
132         /* else ACP && connected. do not clear the handle yet */
133         AVRC_Close(rc_handle);
134         if (rc_handle == bta_av_cb.rc_acp_handle)
135             bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
136         APPL_TRACE_EVENT("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
137             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
138     }
139 }
140 
141 
142 /*******************************************************************************
143 **
144 ** Function         bta_av_close_all_rc
145 **
146 ** Description      close the all AVRC handle.
147 **
148 ** Returns          void
149 **
150 *******************************************************************************/
bta_av_close_all_rc(tBTA_AV_CB * p_cb)151 static void bta_av_close_all_rc(tBTA_AV_CB *p_cb)
152 {
153     int i;
154 
155     for(i=0; i<BTA_AV_NUM_RCB; i++)
156     {
157         if ((p_cb->disabling == TRUE) || (bta_av_cb.rcb[i].shdl != 0))
158             bta_av_del_rc(&bta_av_cb.rcb[i]);
159     }
160 }
161 
162 /*******************************************************************************
163 **
164 ** Function         bta_av_del_sdp_rec
165 **
166 ** Description      delete the given SDP record handle.
167 **
168 ** Returns          void
169 **
170 *******************************************************************************/
bta_av_del_sdp_rec(UINT32 * p_sdp_handle)171 static void bta_av_del_sdp_rec(UINT32 *p_sdp_handle)
172 {
173     if(*p_sdp_handle != 0)
174     {
175         SDP_DeleteRecord(*p_sdp_handle);
176         *p_sdp_handle = 0;
177     }
178 }
179 
180 /*******************************************************************************
181 **
182 ** Function         bta_av_avrc_sdp_cback
183 **
184 ** Description      AVRCP service discovery callback.
185 **
186 ** Returns          void
187 **
188 *******************************************************************************/
bta_av_avrc_sdp_cback(UINT16 status)189 static void bta_av_avrc_sdp_cback(UINT16 status)
190 {
191     BT_HDR *p_msg;
192     UNUSED(status);
193 
194     if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
195     {
196         p_msg->event = BTA_AV_SDP_AVRC_DISC_EVT;
197         bta_sys_sendmsg(p_msg);
198     }
199 }
200 
201 /*******************************************************************************
202 **
203 ** Function         bta_av_rc_ctrl_cback
204 **
205 ** Description      AVRCP control callback.
206 **
207 ** Returns          void
208 **
209 *******************************************************************************/
bta_av_rc_ctrl_cback(UINT8 handle,UINT8 event,UINT16 result,BD_ADDR peer_addr)210 static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_ADDR peer_addr)
211 {
212     tBTA_AV_RC_CONN_CHG *p_msg;
213     UINT16 msg_event = 0;
214     UNUSED(result);
215 
216 #if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
217     APPL_TRACE_EVENT("rc_ctrl handle: %d event=0x%x", handle, event);
218 #else
219     APPL_TRACE_EVENT("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
220 #endif
221     if (event == AVRC_OPEN_IND_EVT)
222     {
223         /* save handle of opened connection
224         bta_av_cb.rc_handle = handle;*/
225 
226         msg_event = BTA_AV_AVRC_OPEN_EVT;
227     }
228     else if (event == AVRC_CLOSE_IND_EVT)
229     {
230         msg_event = BTA_AV_AVRC_CLOSE_EVT;
231     }
232 
233     if (msg_event)
234     {
235         if ((p_msg = (tBTA_AV_RC_CONN_CHG *) GKI_getbuf(sizeof(tBTA_AV_RC_CONN_CHG))) != NULL)
236         {
237             p_msg->hdr.event = msg_event;
238             p_msg->handle    = handle;
239             if(peer_addr)
240                 bdcpy(p_msg->peer_addr, peer_addr);
241             bta_sys_sendmsg(p_msg);
242         }
243     }
244 }
245 
246 /*******************************************************************************
247 **
248 ** Function         bta_av_rc_msg_cback
249 **
250 ** Description      AVRCP message callback.
251 **
252 ** Returns          void
253 **
254 *******************************************************************************/
bta_av_rc_msg_cback(UINT8 handle,UINT8 label,UINT8 opcode,tAVRC_MSG * p_msg)255 static void bta_av_rc_msg_cback(UINT8 handle, UINT8 label, UINT8 opcode, tAVRC_MSG *p_msg)
256 {
257     UINT8           *p_data_src = NULL;
258     UINT16          data_len = 0;
259 
260     APPL_TRACE_DEBUG("%s handle: %u opcode=0x%x", __func__, handle, opcode);
261 
262     /* Determine the size of the buffer we need */
263     if (opcode == AVRC_OP_VENDOR && p_msg->vendor.p_vendor_data != NULL) {
264         p_data_src = p_msg->vendor.p_vendor_data;
265         data_len = (UINT16) p_msg->vendor.vendor_len;
266     } else if (opcode == AVRC_OP_PASS_THRU && p_msg->pass.p_pass_data != NULL) {
267         p_data_src = p_msg->pass.p_pass_data;
268         data_len = (UINT16) p_msg->pass.pass_len;
269     }
270 
271     /* Create a copy of the message */
272     tBTA_AV_RC_MSG *p_buf =
273         (tBTA_AV_RC_MSG *)GKI_getbuf((UINT16)(sizeof(tBTA_AV_RC_MSG) + data_len));
274     if (p_buf != NULL) {
275         p_buf->hdr.event = BTA_AV_AVRC_MSG_EVT;
276         p_buf->handle = handle;
277         p_buf->label = label;
278         p_buf->opcode = opcode;
279         memcpy(&p_buf->msg, p_msg, sizeof(tAVRC_MSG));
280         /* Copy the data payload, and set the pointer to it */
281         if (p_data_src != NULL) {
282             UINT8 *p_data_dst = (UINT8 *)(p_buf + 1);
283             memcpy(p_data_dst, p_data_src, data_len);
284             if (opcode == AVRC_OP_VENDOR)
285                 p_buf->msg.vendor.p_vendor_data = p_data_dst;
286             else if (opcode == AVRC_OP_PASS_THRU)
287                 p_buf->msg.pass.p_pass_data = p_data_dst;
288         }
289         bta_sys_sendmsg(p_buf);
290     }
291 }
292 
293 /*******************************************************************************
294 **
295 ** Function         bta_av_rc_create
296 **
297 ** Description      alloc RCB and call AVRC_Open
298 **
299 ** Returns          the created rc handle
300 **
301 *******************************************************************************/
bta_av_rc_create(tBTA_AV_CB * p_cb,UINT8 role,UINT8 shdl,UINT8 lidx)302 UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
303 {
304     tAVRC_CONN_CB ccb;
305     BD_ADDR_PTR   bda = (BD_ADDR_PTR)bd_addr_any;
306     UINT8         status = BTA_AV_RC_ROLE_ACP;
307     tBTA_AV_SCB  *p_scb = p_cb->p_scb[shdl - 1];
308     int i;
309     UINT8   rc_handle;
310     tBTA_AV_RCB *p_rcb;
311 
312     if(role == AVCT_INT)
313     {
314         bda = p_scb->peer_addr;
315         status = BTA_AV_RC_ROLE_INT;
316     }
317     else
318     {
319         if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL )
320         {
321             APPL_TRACE_ERROR("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
322             return p_rcb->handle;
323         }
324     }
325 
326     ccb.p_ctrl_cback = bta_av_rc_ctrl_cback;
327     ccb.p_msg_cback = bta_av_rc_msg_cback;
328     ccb.company_id = p_bta_av_cfg->company_id;
329     ccb.conn = role;
330     /* note: BTA_AV_FEAT_RCTG = AVRC_CT_TARGET, BTA_AV_FEAT_RCCT = AVRC_CT_CONTROL */
331     ccb.control = p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_RCCT | AVRC_CT_PASSIVE);
332 
333 
334     if (AVRC_Open(&rc_handle, &ccb, bda) != AVRC_SUCCESS)
335         return BTA_AV_RC_HANDLE_NONE;
336 
337     i = rc_handle;
338     p_rcb = &p_cb->rcb[i];
339 
340     if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
341     {
342         APPL_TRACE_ERROR("bta_av_rc_create found duplicated handle:%d", rc_handle);
343     }
344 
345     p_rcb->handle = rc_handle;
346     p_rcb->status = status;
347     p_rcb->shdl = shdl;
348     p_rcb->lidx = lidx;
349     p_rcb->peer_features = 0;
350     if(lidx == (BTA_AV_NUM_LINKS + 1))
351     {
352         /* this LIDX is reserved for the AVRCP ACP connection */
353         p_cb->rc_acp_handle = p_rcb->handle;
354         p_cb->rc_acp_idx = (i + 1);
355         APPL_TRACE_DEBUG("rc_acp_handle:%d idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
356     }
357     APPL_TRACE_DEBUG("create %d, role: %d, shdl:%d, rc_handle:%d, lidx:%d, status:0x%x",
358         i, role, shdl, p_rcb->handle, lidx, p_rcb->status);
359 
360     return rc_handle;
361 }
362 
363 /*******************************************************************************
364 **
365 ** Function         bta_av_valid_group_navi_msg
366 **
367 ** Description      Check if it is Group Navigation Msg for Metadata
368 **
369 ** Returns          BTA_AV_RSP_ACCEPT or BTA_AV_RSP_NOT_IMPL.
370 **
371 *******************************************************************************/
bta_av_group_navi_supported(UINT8 len,UINT8 * p_data,BOOLEAN is_inquiry)372 static tBTA_AV_CODE bta_av_group_navi_supported(UINT8 len, UINT8 *p_data, BOOLEAN is_inquiry)
373 {
374     tBTA_AV_CODE ret=BTA_AV_RSP_NOT_IMPL;
375     UINT8 *p_ptr = p_data;
376     UINT16 u16;
377     UINT32 u32;
378 
379     if (p_bta_av_cfg->avrc_group && len == BTA_GROUP_NAVI_MSG_OP_DATA_LEN)
380     {
381         BTA_AV_BE_STREAM_TO_CO_ID(u32, p_ptr);
382         BE_STREAM_TO_UINT16(u16, p_ptr);
383 
384         if (u32 == AVRC_CO_METADATA)
385         {
386             if (is_inquiry)
387             {
388                 if (u16 <= AVRC_PDU_PREV_GROUP)
389                     ret = BTA_AV_RSP_IMPL_STBL;
390             }
391             else
392             {
393                 if (u16 <= AVRC_PDU_PREV_GROUP)
394                     ret = BTA_AV_RSP_ACCEPT;
395                 else
396                     ret = BTA_AV_RSP_REJ;
397             }
398         }
399     }
400 
401     return ret;
402 }
403 
404 /*******************************************************************************
405 **
406 ** Function         bta_av_op_supported
407 **
408 ** Description      Check if remote control operation is supported.
409 **
410 ** Returns          BTA_AV_RSP_ACCEPT of supported, BTA_AV_RSP_NOT_IMPL if not.
411 **
412 *******************************************************************************/
bta_av_op_supported(tBTA_AV_RC rc_id,BOOLEAN is_inquiry)413 static tBTA_AV_CODE bta_av_op_supported(tBTA_AV_RC rc_id, BOOLEAN is_inquiry)
414 {
415     tBTA_AV_CODE ret_code = BTA_AV_RSP_NOT_IMPL;
416 
417     if (p_bta_av_rc_id)
418     {
419         if (is_inquiry)
420         {
421             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
422             {
423                 ret_code = BTA_AV_RSP_IMPL_STBL;
424             }
425         }
426         else
427         {
428             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
429             {
430                 ret_code = BTA_AV_RSP_ACCEPT;
431             }
432             else if ((p_bta_av_cfg->rc_pass_rsp == BTA_AV_RSP_INTERIM) && p_bta_av_rc_id_ac)
433             {
434                 if (p_bta_av_rc_id_ac[rc_id >> 4] & (1 << (rc_id & 0x0F)))
435                 {
436                     ret_code = BTA_AV_RSP_INTERIM;
437                 }
438             }
439         }
440 
441     }
442     return ret_code;
443 }
444 
445 /*******************************************************************************
446 **
447 ** Function         bta_av_find_lcb
448 **
449 ** Description      Given BD_addr, find the associated LCB.
450 **
451 ** Returns          NULL, if not found.
452 **
453 *******************************************************************************/
bta_av_find_lcb(BD_ADDR addr,UINT8 op)454 tBTA_AV_LCB * bta_av_find_lcb(BD_ADDR addr, UINT8 op)
455 {
456     tBTA_AV_CB   *p_cb = &bta_av_cb;
457     int     xx;
458     UINT8   mask;
459     tBTA_AV_LCB *p_lcb = NULL;
460 
461     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
462     {
463         mask = 1 << xx; /* the used mask for this lcb */
464         if((mask & p_cb->conn_lcb) && 0 ==( bdcmp(p_cb->lcb[xx].addr, addr)))
465         {
466             p_lcb = &p_cb->lcb[xx];
467             if(op == BTA_AV_LCB_FREE)
468             {
469                 p_cb->conn_lcb &= ~mask; /* clear the connect mask */
470                 APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
471             }
472             break;
473         }
474     }
475     return p_lcb;
476 }
477 
478 /*******************************************************************************
479 **
480 ** Function         bta_av_rc_opened
481 **
482 ** Description      Set AVRCP state to opened.
483 **
484 ** Returns          void
485 **
486 *******************************************************************************/
bta_av_rc_opened(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)487 void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
488 {
489     tBTA_AV_RC_OPEN rc_open;
490     tBTA_AV_SCB     *p_scb;
491     int         i;
492     UINT8       shdl = 0;
493     tBTA_AV_LCB *p_lcb;
494     tBTA_AV_RCB *p_rcb;
495     UINT8       tmp;
496     UINT8       disc = 0;
497 
498     /* find the SCB & stop the timer */
499     for(i=0; i<BTA_AV_NUM_STRS; i++)
500     {
501         p_scb = p_cb->p_scb[i];
502         if(p_scb && bdcmp(p_scb->peer_addr, p_data->rc_conn_chg.peer_addr) == 0)
503         {
504             p_scb->rc_handle = p_data->rc_conn_chg.handle;
505             APPL_TRACE_DEBUG("bta_av_rc_opened shdl:%d, srch %d", i + 1, p_scb->rc_handle);
506             shdl = i+1;
507             LOG_INFO("%s allow incoming AVRCP connections:%d", __func__, p_scb->use_rc);
508             bta_sys_stop_timer(&p_scb->timer);
509             disc = p_scb->hndl;
510             break;
511         }
512     }
513 
514     i = p_data->rc_conn_chg.handle;
515     if (p_cb->rcb[i].handle == BTA_AV_RC_HANDLE_NONE)
516     {
517         APPL_TRACE_ERROR("not a valid handle:%d any more", i);
518         return;
519     }
520 
521 
522     if (p_cb->rcb[i].lidx == (BTA_AV_NUM_LINKS + 1) && shdl != 0)
523     {
524         /* rc is opened on the RC only ACP channel, but is for a specific
525          * SCB -> need to switch RCBs */
526         p_rcb = bta_av_get_rcb_by_shdl(shdl);
527         if (p_rcb)
528         {
529             p_rcb->shdl = p_cb->rcb[i].shdl;
530             tmp         = p_rcb->lidx;
531             p_rcb->lidx = p_cb->rcb[i].lidx;
532             p_cb->rcb[i].lidx = tmp;
533             p_cb->rc_acp_handle = p_rcb->handle;
534             p_cb->rc_acp_idx = (p_rcb - p_cb->rcb) + 1;
535             APPL_TRACE_DEBUG("switching RCB rc_acp_handle:%d idx:%d",
536                                p_cb->rc_acp_handle, p_cb->rc_acp_idx);
537         }
538     }
539 
540     p_cb->rcb[i].shdl = shdl;
541     rc_open.rc_handle = i;
542     APPL_TRACE_ERROR("bta_av_rc_opened rcb[%d] shdl:%d lidx:%d/%d",
543             i, shdl, p_cb->rcb[i].lidx, p_cb->lcb[BTA_AV_NUM_LINKS].lidx);
544     p_cb->rcb[i].status |= BTA_AV_RC_CONN_MASK;
545 
546     if(!shdl && 0 == p_cb->lcb[BTA_AV_NUM_LINKS].lidx)
547     {
548         /* no associated SCB -> connected to an RC only device
549          * update the index to the extra LCB */
550         p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
551         bdcpy(p_lcb->addr, p_data->rc_conn_chg.peer_addr);
552         APPL_TRACE_DEBUG("rc_only bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
553                       p_lcb->addr[0], p_lcb->addr[1],
554                       p_lcb->addr[2], p_lcb->addr[3],
555                       p_lcb->addr[4], p_lcb->addr[5]);
556         p_lcb->lidx = BTA_AV_NUM_LINKS + 1;
557             p_cb->rcb[i].lidx = p_lcb->lidx;
558         p_lcb->conn_msk = 1;
559         APPL_TRACE_ERROR("rcb[%d].lidx=%d, lcb.conn_msk=x%x",
560             i, p_cb->rcb[i].lidx, p_lcb->conn_msk);
561         disc = p_data->rc_conn_chg.handle|BTA_AV_CHNL_MSK;
562     }
563 
564     bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
565     rc_open.peer_features = p_cb->rcb[i].peer_features;
566     rc_open.status = BTA_AV_SUCCESS;
567     APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
568                       rc_open.peer_features);
569     if(rc_open.peer_features == 0)
570     {
571         /* we have not done SDP on peer RC capabilities.
572          * peer must have initiated the RC connection */
573         rc_open.peer_features = BTA_AV_FEAT_RCCT;
574         bta_av_rc_disc(disc);
575     }
576     (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
577 
578 }
579 
580 
581 /*******************************************************************************
582 **
583 ** Function         bta_av_rc_remote_cmd
584 **
585 ** Description      Send an AVRCP remote control command.
586 **
587 ** Returns          void
588 **
589 *******************************************************************************/
bta_av_rc_remote_cmd(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)590 void bta_av_rc_remote_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
591 {
592     tBTA_AV_RCB    *p_rcb;
593     if (p_cb->features & BTA_AV_FEAT_RCCT)
594     {
595         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
596         {
597             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
598             if(p_rcb->status & BTA_AV_RC_CONN_MASK)
599             {
600                 AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
601                      &p_data->api_remote_cmd.msg);
602             }
603         }
604     }
605 }
606 
607 /*******************************************************************************
608 **
609 ** Function         bta_av_rc_vendor_cmd
610 **
611 ** Description      Send an AVRCP vendor specific command.
612 **
613 ** Returns          void
614 **
615 *******************************************************************************/
bta_av_rc_vendor_cmd(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)616 void bta_av_rc_vendor_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
617 {
618     tBTA_AV_RCB    *p_rcb;
619     if ( (p_cb->features & (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR)) ==
620          (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR))
621     {
622         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
623         {
624             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
625             AVRC_VendorCmd(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
626         }
627     }
628 }
629 
630 /*******************************************************************************
631 **
632 ** Function         bta_av_rc_vendor_rsp
633 **
634 ** Description      Send an AVRCP vendor specific response.
635 **
636 ** Returns          void
637 **
638 *******************************************************************************/
bta_av_rc_vendor_rsp(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)639 void bta_av_rc_vendor_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
640 {
641     tBTA_AV_RCB    *p_rcb;
642     if ( (p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
643          (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR))
644     {
645         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
646         {
647             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
648             AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
649         }
650     }
651 }
652 
653 /*******************************************************************************
654 **
655 ** Function         bta_av_rc_meta_rsp
656 **
657 ** Description      Send an AVRCP metadata/advanced control command/response.
658 **
659 ** Returns          void
660 **
661 *******************************************************************************/
bta_av_rc_meta_rsp(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)662 void bta_av_rc_meta_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
663 {
664     tBTA_AV_RCB *p_rcb;
665     BOOLEAN         do_free = TRUE;
666 
667     if ((p_cb->features & BTA_AV_FEAT_METADATA) && (p_data->hdr.layer_specific < BTA_AV_NUM_RCB))
668     {
669         if ((p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCTG)) ||
670             (!p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCCT)) )
671         {
672             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
673             if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE) {
674                 AVRC_MsgReq(p_rcb->handle, p_data->api_meta_rsp.label,
675                             p_data->api_meta_rsp.rsp_code,
676                             p_data->api_meta_rsp.p_pkt);
677                 do_free = FALSE;
678             }
679         }
680     }
681 
682     if (do_free)
683         GKI_freebuf (p_data->api_meta_rsp.p_pkt);
684 }
685 
686 /*******************************************************************************
687 **
688 ** Function         bta_av_rc_free_rsp
689 **
690 ** Description      free an AVRCP metadata command buffer.
691 **
692 ** Returns          void
693 **
694 *******************************************************************************/
bta_av_rc_free_rsp(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)695 void bta_av_rc_free_rsp (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
696 {
697     UNUSED(p_cb);
698 
699     GKI_freebuf (p_data->api_meta_rsp.p_pkt);
700 }
701 
702 /*******************************************************************************
703 **
704 ** Function         bta_av_rc_meta_req
705 **
706 ** Description      Send an AVRCP metadata command.
707 **
708 ** Returns          void
709 **
710 *******************************************************************************/
bta_av_rc_free_msg(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)711 void bta_av_rc_free_msg (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
712 {
713     UNUSED(p_cb);
714     UNUSED(p_data);
715 }
716 
717 
718 
719 /*******************************************************************************
720 **
721 ** Function         bta_av_chk_notif_evt_id
722 **
723 ** Description      make sure the requested player id is valid.
724 **
725 ** Returns          BTA_AV_STS_NO_RSP, if no error
726 **
727 *******************************************************************************/
bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR * p_vendor)728 static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
729 {
730     tAVRC_STS   status = BTA_AV_STS_NO_RSP;
731     UINT8       xx;
732     UINT16      u16;
733     UINT8       *p = p_vendor->p_vendor_data + 2;
734 
735     BE_STREAM_TO_UINT16 (u16, p);
736     /* double check the fixed length */
737     if ((u16 != 5) || (p_vendor->vendor_len != 9))
738     {
739         status = AVRC_STS_INTERNAL_ERR;
740     }
741     else
742     {
743         /* make sure the player_id is valid */
744         for (xx=0; xx<p_bta_av_cfg->num_evt_ids; xx++)
745         {
746             if (*p == p_bta_av_cfg->p_meta_evt_ids[xx])
747             {
748                 break;
749             }
750         }
751         if (xx == p_bta_av_cfg->num_evt_ids)
752         {
753             status = AVRC_STS_BAD_PARAM;
754         }
755     }
756 
757     return status;
758 }
759 
760 /*******************************************************************************
761 **
762 ** Function         bta_av_proc_meta_cmd
763 **
764 ** Description      Process an AVRCP metadata command from the peer.
765 **
766 ** Returns          TRUE to respond immediately
767 **
768 *******************************************************************************/
bta_av_proc_meta_cmd(tAVRC_RESPONSE * p_rc_rsp,tBTA_AV_RC_MSG * p_msg,UINT8 * p_ctype)769 tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE  *p_rc_rsp, tBTA_AV_RC_MSG *p_msg, UINT8 *p_ctype)
770 {
771     tBTA_AV_EVT evt = BTA_AV_META_MSG_EVT;
772     UINT8       u8, pdu, *p;
773     UINT16      u16;
774     tAVRC_MSG_VENDOR    *p_vendor = &p_msg->msg.vendor;
775 
776 #if (AVRC_METADATA_INCLUDED == TRUE)
777 
778     pdu = *(p_vendor->p_vendor_data);
779     p_rc_rsp->pdu = pdu;
780     *p_ctype = AVRC_RSP_REJ;
781     /* Metadata messages only use PANEL sub-unit type */
782     if (p_vendor->hdr.subunit_type != AVRC_SUB_PANEL)
783     {
784         APPL_TRACE_DEBUG("SUBUNIT must be PANEL");
785         /* reject it */
786         evt=0;
787         p_vendor->hdr.ctype = BTA_AV_RSP_NOT_IMPL;
788         AVRC_VendorRsp(p_msg->handle, p_msg->label, &p_msg->msg.vendor);
789     }
790     else if (!AVRC_IsValidAvcType(pdu, p_vendor->hdr.ctype) )
791     {
792         APPL_TRACE_DEBUG("Invalid pdu/ctype: 0x%x, %d", pdu, p_vendor->hdr.ctype);
793         /* reject invalid message without reporting to app */
794         evt = 0;
795         p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
796     }
797     else
798     {
799         switch (pdu)
800         {
801         case AVRC_PDU_GET_CAPABILITIES:
802             /* process GetCapabilities command without reporting the event to app */
803             evt = 0;
804             u8 = *(p_vendor->p_vendor_data + 4);
805             p = p_vendor->p_vendor_data + 2;
806             p_rc_rsp->get_caps.capability_id = u8;
807             BE_STREAM_TO_UINT16 (u16, p);
808             if ((u16 != 1) || (p_vendor->vendor_len != 5))
809             {
810                 p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
811             }
812             else
813             {
814                 p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;
815                 if (u8 == AVRC_CAP_COMPANY_ID)
816                 {
817                     *p_ctype = AVRC_RSP_IMPL_STBL;
818                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_co_ids;
819                     memcpy(p_rc_rsp->get_caps.param.company_id, p_bta_av_cfg->p_meta_co_ids,
820                            (p_bta_av_cfg->num_co_ids << 2));
821                 }
822                 else if (u8 == AVRC_CAP_EVENTS_SUPPORTED)
823                 {
824                     *p_ctype = AVRC_RSP_IMPL_STBL;
825                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_evt_ids;
826                     memcpy(p_rc_rsp->get_caps.param.event_id, p_bta_av_cfg->p_meta_evt_ids,
827                            p_bta_av_cfg->num_evt_ids);
828                 }
829                 else
830                 {
831                     APPL_TRACE_DEBUG("Invalid capability ID: 0x%x", u8);
832                     /* reject - unknown capability ID */
833                     p_rc_rsp->get_caps.status = AVRC_STS_BAD_PARAM;
834                 }
835             }
836             break;
837 
838 
839         case AVRC_PDU_REGISTER_NOTIFICATION:
840             /* make sure the event_id is implemented */
841             p_rc_rsp->rsp.status = bta_av_chk_notif_evt_id (p_vendor);
842             if (p_rc_rsp->rsp.status != BTA_AV_STS_NO_RSP)
843                 evt = 0;
844             break;
845 
846         }
847     }
848 #else
849     APPL_TRACE_DEBUG("AVRCP 1.3 Metadata not supporteed. Reject command.");
850     /* reject invalid message without reporting to app */
851     evt = 0;
852     p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
853 #endif
854 
855     return evt;
856 }
857 
858 
859 /*******************************************************************************
860 **
861 ** Function         bta_av_rc_msg
862 **
863 ** Description      Process an AVRCP message from the peer.
864 **
865 ** Returns          void
866 **
867 *******************************************************************************/
bta_av_rc_msg(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)868 void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
869 {
870     tBTA_AV_EVT evt = 0;
871     tBTA_AV     av;
872     BT_HDR      *p_pkt = NULL;
873     tAVRC_MSG_VENDOR    *p_vendor = &p_data->rc_msg.msg.vendor;
874     BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
875 #if (AVRC_METADATA_INCLUDED == TRUE)
876     UINT8       ctype = 0;
877     tAVRC_RESPONSE  rc_rsp;
878 
879     rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
880 #endif
881 
882     if (p_data->rc_msg.opcode == AVRC_OP_PASS_THRU)
883     {
884     /* if this is a pass thru command */
885         if ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_CTRL) ||
886             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) ||
887             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ)
888             )
889         {
890         /* check if operation is supported */
891             if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR)
892             {
893                 p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
894 #if (AVRC_METADATA_INCLUDED == TRUE)
895                 if (p_cb->features & BTA_AV_FEAT_METADATA)
896                     p_data->rc_msg.msg.hdr.ctype =
897                         bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
898                         p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
899 #endif
900             }
901             else
902             {
903                 p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
904             }
905 
906             APPL_TRACE_DEBUG("ctype %d",p_data->rc_msg.msg.hdr.ctype)
907 
908             /* send response */
909             if (p_data->rc_msg.msg.hdr.ctype != BTA_AV_RSP_INTERIM)
910                 AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
911 
912             /* set up for callback if supported */
913             if (p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_ACCEPT || p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_INTERIM)
914             {
915                 evt = BTA_AV_REMOTE_CMD_EVT;
916                 av.remote_cmd.rc_id = p_data->rc_msg.msg.pass.op_id;
917                 av.remote_cmd.key_state = p_data->rc_msg.msg.pass.state;
918                 av.remote_cmd.p_data = p_data->rc_msg.msg.pass.p_pass_data;
919                 av.remote_cmd.len = p_data->rc_msg.msg.pass.pass_len;
920                 memcpy(&av.remote_cmd.hdr, &p_data->rc_msg.msg.hdr, sizeof (tAVRC_HDR));
921                 av.remote_cmd.label = p_data->rc_msg.label;
922             }
923         }
924         /* else if this is a pass thru response */
925         else if (p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
926         {
927             /* set up for callback */
928             evt = BTA_AV_REMOTE_RSP_EVT;
929             av.remote_rsp.rc_id = p_data->rc_msg.msg.pass.op_id;
930             av.remote_rsp.key_state = p_data->rc_msg.msg.pass.state;
931             av.remote_rsp.rsp_code = p_data->rc_msg.msg.hdr.ctype;
932             av.remote_rsp.label = p_data->rc_msg.label;
933         }
934         /* must be a bad ctype -> reject*/
935         else
936         {
937             p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
938             AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
939         }
940     }
941     /* else if this is a vendor specific command or response */
942     else if (p_data->rc_msg.opcode == AVRC_OP_VENDOR)
943     {
944         /* set up for callback */
945         av.vendor_cmd.code = p_data->rc_msg.msg.hdr.ctype;
946         av.vendor_cmd.company_id = p_vendor->company_id;
947         av.vendor_cmd.label = p_data->rc_msg.label;
948         av.vendor_cmd.p_data = p_vendor->p_vendor_data;
949         av.vendor_cmd.len = p_vendor->vendor_len;
950 
951         /* if configured to support vendor specific and it's a command */
952         if ((p_cb->features & BTA_AV_FEAT_VENDOR)  &&
953             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
954         {
955 #if (AVRC_METADATA_INCLUDED == TRUE)
956             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
957                (p_vendor->company_id == AVRC_CO_METADATA))
958             {
959                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
960                 evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
961             }
962             else
963 #endif
964                 evt = BTA_AV_VENDOR_CMD_EVT;
965         }
966         /* else if configured to support vendor specific and it's a response */
967         else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
968                  p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
969         {
970 #if (AVRC_METADATA_INCLUDED == TRUE)
971             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
972                (p_vendor->company_id == AVRC_CO_METADATA))
973             {
974                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
975                 evt = BTA_AV_META_MSG_EVT;
976             }
977             else
978 #endif
979                 evt = BTA_AV_VENDOR_RSP_EVT;
980 
981         }
982         /* else if not configured to support vendor specific and it's a command */
983         else if (!(p_cb->features & BTA_AV_FEAT_VENDOR)  &&
984             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
985         {
986            if(p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID)
987            {
988            /* reject it */
989               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
990               p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
991            }
992            else
993               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
994            AVRC_VendorRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.vendor);
995         }
996     }
997 #if (AVRC_METADATA_INCLUDED == TRUE)
998     if (evt == 0 && rc_rsp.rsp.status != BTA_AV_STS_NO_RSP)
999     {
1000         if (!p_pkt)
1001         {
1002             rc_rsp.rsp.opcode = p_data->rc_msg.opcode;
1003             AVRC_BldResponse (0, &rc_rsp, &p_pkt);
1004         }
1005         if (p_pkt)
1006             AVRC_MsgReq (p_data->rc_msg.handle, p_data->rc_msg.label, ctype, p_pkt);
1007     }
1008 #endif
1009 
1010     /* call callback */
1011     if (evt != 0)
1012     {
1013         av.remote_cmd.rc_handle = p_data->rc_msg.handle;
1014         (*p_cb->p_cback)(evt, &av);
1015     }
1016 }
1017 
1018 /*******************************************************************************
1019 **
1020 ** Function         bta_av_rc_close
1021 **
1022 ** Description      close the specified AVRC handle.
1023 **
1024 ** Returns          void
1025 **
1026 *******************************************************************************/
bta_av_rc_close(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)1027 void bta_av_rc_close (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
1028 {
1029     UINT16 handle = p_data->hdr.layer_specific;
1030     tBTA_AV_SCB  *p_scb;
1031     tBTA_AV_RCB *p_rcb;
1032 
1033     if(handle < BTA_AV_NUM_RCB)
1034     {
1035         p_rcb = &p_cb->rcb[handle];
1036 
1037         APPL_TRACE_DEBUG("bta_av_rc_close handle: %d, status=0x%x", p_rcb->handle, p_rcb->status);
1038         if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
1039         {
1040             if(p_rcb->shdl)
1041             {
1042                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
1043                 if(p_scb)
1044                 {
1045                     /* just in case the RC timer is active
1046                     if(bta_av_cb.features & BTA_AV_FEAT_RCCT &&
1047                        p_scb->chnl == BTA_AV_CHNL_AUDIO) */
1048                         bta_sys_stop_timer(&p_scb->timer);
1049                 }
1050             }
1051 
1052             AVRC_Close(p_rcb->handle);
1053         }
1054     }
1055 }
1056 
1057 /*******************************************************************************
1058 **
1059 ** Function         bta_av_get_shdl
1060 **
1061 ** Returns          The index to p_scb[]
1062 **
1063 *******************************************************************************/
bta_av_get_shdl(tBTA_AV_SCB * p_scb)1064 static UINT8 bta_av_get_shdl(tBTA_AV_SCB *p_scb)
1065 {
1066     int     i;
1067     UINT8   shdl = 0;
1068     /* find the SCB & stop the timer */
1069     for(i=0; i<BTA_AV_NUM_STRS; i++)
1070     {
1071         if(p_scb == bta_av_cb.p_scb[i])
1072         {
1073             shdl = i+1;
1074             break;
1075         }
1076     }
1077     return shdl;
1078 }
1079 
1080 /*******************************************************************************
1081 **
1082 ** Function         bta_av_stream_chg
1083 **
1084 ** Description      audio streaming status changed.
1085 **
1086 ** Returns          void
1087 **
1088 *******************************************************************************/
bta_av_stream_chg(tBTA_AV_SCB * p_scb,BOOLEAN started)1089 void bta_av_stream_chg(tBTA_AV_SCB *p_scb, BOOLEAN started)
1090 {
1091     UINT8   started_msk;
1092     int     i;
1093     UINT8   *p_streams;
1094     BOOLEAN no_streams = FALSE;
1095     tBTA_AV_SCB *p_scbi;
1096 
1097     started_msk = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
1098     APPL_TRACE_DEBUG ("bta_av_stream_chg started:%d started_msk:x%x chnl:x%x", started,
1099                                                   started_msk, p_scb->chnl);
1100     if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
1101         p_streams = &bta_av_cb.audio_streams;
1102     else
1103         p_streams = &bta_av_cb.video_streams;
1104 
1105     if (started)
1106     {
1107         /* Let L2CAP know this channel is processed with high priority */
1108         L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_HIGH);
1109         (*p_streams) |= started_msk;
1110     }
1111     else
1112     {
1113         (*p_streams) &= ~started_msk;
1114     }
1115 
1116     if (!started)
1117     {
1118         i=0;
1119         if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
1120         {
1121             if (bta_av_cb.video_streams == 0)
1122                 no_streams = TRUE;
1123         }
1124         else
1125         {
1126             no_streams = TRUE;
1127             if ( bta_av_cb.audio_streams )
1128             {
1129                 for (; i<BTA_AV_NUM_STRS; i++)
1130                 {
1131                     p_scbi = bta_av_cb.p_scb[i];
1132                     /* scb is used and started */
1133                     if ( p_scbi && (bta_av_cb.audio_streams & BTA_AV_HNDL_TO_MSK(i))
1134                         && bdcmp(p_scbi->peer_addr, p_scb->peer_addr) == 0)
1135                     {
1136                         no_streams = FALSE;
1137                         break;
1138                     }
1139                 }
1140 
1141             }
1142         }
1143 
1144         APPL_TRACE_DEBUG ("no_streams:%d i:%d, audio_streams:x%x, video_streams:x%x", no_streams, i,
1145                            bta_av_cb.audio_streams, bta_av_cb.video_streams);
1146         if (no_streams)
1147         {
1148             /* Let L2CAP know this channel is processed with low priority */
1149             L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_NORMAL);
1150         }
1151     }
1152 }
1153 
1154 
1155 /*******************************************************************************
1156 **
1157 ** Function         bta_av_conn_chg
1158 **
1159 ** Description      connetion status changed.
1160 **                  Open an AVRCP acceptor channel, if new conn.
1161 **
1162 ** Returns          void
1163 **
1164 *******************************************************************************/
bta_av_conn_chg(tBTA_AV_DATA * p_data)1165 void bta_av_conn_chg(tBTA_AV_DATA *p_data)
1166 {
1167     tBTA_AV_CB   *p_cb = &bta_av_cb;
1168     tBTA_AV_SCB     *p_scb = NULL;
1169     tBTA_AV_SCB     *p_scbi;
1170     UINT8   mask;
1171     UINT8   conn_msk;
1172     UINT8   old_msk;
1173     int i;
1174     int index = (p_data->hdr.layer_specific & BTA_AV_HNDL_MSK) - 1;
1175     tBTA_AV_LCB *p_lcb;
1176     tBTA_AV_LCB *p_lcb_rc;
1177     tBTA_AV_RCB *p_rcb, *p_rcb2;
1178     BOOLEAN     chk_restore = FALSE;
1179 
1180     /* Validate array index*/
1181     if (index < BTA_AV_NUM_STRS)
1182     {
1183         p_scb = p_cb->p_scb[index];
1184     }
1185     mask = BTA_AV_HNDL_TO_MSK(index);
1186     p_lcb = bta_av_find_lcb(p_data->conn_chg.peer_addr, BTA_AV_LCB_FIND);
1187     conn_msk = 1 << (index + 1);
1188     if(p_data->conn_chg.is_up)
1189     {
1190         /* set the conned mask for this channel */
1191         if(p_scb)
1192         {
1193             if(p_lcb)
1194             {
1195                 p_lcb->conn_msk |= conn_msk;
1196                 for (i=0; i<BTA_AV_NUM_RCB; i++)
1197                 {
1198                     if (bta_av_cb.rcb[i].lidx == p_lcb->lidx)
1199                     {
1200                         bta_av_cb.rcb[i].shdl = index + 1;
1201                         APPL_TRACE_DEBUG("conn_chg up[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
1202                                           bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
1203                                           bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
1204                         break;
1205                     }
1206                 }
1207             }
1208             if (p_scb->chnl == BTA_AV_CHNL_AUDIO)
1209             {
1210                 old_msk = p_cb->conn_audio;
1211                 p_cb->conn_audio |= mask;
1212             }
1213             else
1214             {
1215                 old_msk = p_cb->conn_video;
1216                 p_cb->conn_video |= mask;
1217             }
1218 
1219             if ((old_msk & mask) == 0)
1220             {
1221                 /* increase the audio open count, if not set yet */
1222                 bta_av_cb.audio_open_cnt++;
1223             }
1224 
1225 
1226             APPL_TRACE_DEBUG("rc_acp_handle:%d rc_acp_idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
1227             /* check if the AVRCP ACP channel is already connected */
1228             if(p_lcb && p_cb->rc_acp_handle != BTA_AV_RC_HANDLE_NONE && p_cb->rc_acp_idx)
1229             {
1230                 p_lcb_rc = &p_cb->lcb[BTA_AV_NUM_LINKS];
1231                 APPL_TRACE_DEBUG("rc_acp is connected && conn_chg on same addr p_lcb_rc->conn_msk:x%x",
1232                                   p_lcb_rc->conn_msk);
1233                 /* check if the RC is connected to the scb addr */
1234                 APPL_TRACE_DEBUG ("p_lcb_rc->addr: %02x:%02x:%02x:%02x:%02x:%02x",
1235                        p_lcb_rc->addr[0], p_lcb_rc->addr[1], p_lcb_rc->addr[2], p_lcb_rc->addr[3],
1236                        p_lcb_rc->addr[4], p_lcb_rc->addr[5]);
1237                 APPL_TRACE_DEBUG ("conn_chg.peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
1238                        p_data->conn_chg.peer_addr[0], p_data->conn_chg.peer_addr[1],
1239                        p_data->conn_chg.peer_addr[2],
1240                        p_data->conn_chg.peer_addr[3], p_data->conn_chg.peer_addr[4],
1241                        p_data->conn_chg.peer_addr[5]);
1242                 if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0)
1243                 {
1244                     /* AVRCP is already connected.
1245                      * need to update the association betwen SCB and RCB */
1246                     p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
1247                     p_lcb_rc->lidx = 0;
1248                     p_scb->rc_handle = p_cb->rc_acp_handle;
1249                     p_rcb = &p_cb->rcb[p_cb->rc_acp_idx - 1];
1250                     p_rcb->shdl = bta_av_get_shdl(p_scb);
1251                     APPL_TRACE_DEBUG("update rc_acp shdl:%d/%d srch:%d", index + 1, p_rcb->shdl,
1252                                       p_scb->rc_handle );
1253 
1254                     p_rcb2 = bta_av_get_rcb_by_shdl(p_rcb->shdl);
1255                     if (p_rcb2)
1256                     {
1257                         /* found the RCB that was created to associated with this SCB */
1258                         p_cb->rc_acp_handle = p_rcb2->handle;
1259                         p_cb->rc_acp_idx = (p_rcb2 - p_cb->rcb) + 1;
1260                         APPL_TRACE_DEBUG("new rc_acp_handle:%d, idx:%d", p_cb->rc_acp_handle,
1261                                            p_cb->rc_acp_idx);
1262                         p_rcb2->lidx = (BTA_AV_NUM_LINKS + 1);
1263                         APPL_TRACE_DEBUG("rc2 handle:%d lidx:%d/%d",p_rcb2->handle, p_rcb2->lidx,
1264                                           p_cb->lcb[p_rcb2->lidx-1].lidx);
1265                     }
1266                     p_rcb->lidx = p_lcb->lidx;
1267                     APPL_TRACE_DEBUG("rc handle:%d lidx:%d/%d",p_rcb->handle, p_rcb->lidx,
1268                                       p_cb->lcb[p_rcb->lidx-1].lidx);
1269                 }
1270             }
1271         }
1272     }
1273     else
1274     {
1275         if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
1276         {
1277             /* this channel is still marked as open. decrease the count */
1278             bta_av_cb.audio_open_cnt--;
1279         }
1280 
1281         /* clear the conned mask for this channel */
1282         p_cb->conn_audio &= ~mask;
1283         p_cb->conn_video &= ~mask;
1284         if(p_scb)
1285         {
1286             /* the stream is closed.
1287              * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
1288             bdcpy(p_scb->peer_addr, bd_addr_null);
1289             if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
1290             {
1291                 if(p_lcb)
1292                 {
1293                     p_lcb->conn_msk &= ~conn_msk;
1294                 }
1295                 /* audio channel is down. make sure the INT channel is down */
1296                 /* just in case the RC timer is active
1297                 if(p_cb->features & BTA_AV_FEAT_RCCT) */
1298                 {
1299                     bta_sys_stop_timer(&p_scb->timer);
1300                 }
1301                 /* one audio channel goes down. check if we need to restore high priority */
1302                 chk_restore = TRUE;
1303             }
1304         }
1305 
1306         APPL_TRACE_DEBUG("bta_av_conn_chg shdl:%d", index + 1);
1307         for (i=0; i<BTA_AV_NUM_RCB; i++)
1308         {
1309             APPL_TRACE_DEBUG("conn_chg dn[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
1310                               bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
1311                               bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
1312             if(bta_av_cb.rcb[i].shdl == index + 1)
1313             {
1314                 bta_av_del_rc(&bta_av_cb.rcb[i]);
1315                 break;
1316             }
1317         }
1318 
1319         if(p_cb->conn_audio == 0 && p_cb->conn_video == 0)
1320         {
1321             /* if both channels are not connected,
1322              * close all RC channels */
1323             bta_av_close_all_rc(p_cb);
1324         }
1325 
1326         /* if the AVRCP is no longer listening, create the listening channel */
1327         if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
1328             bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
1329     }
1330 
1331     APPL_TRACE_DEBUG("bta_av_conn_chg audio:%x video:%x up:%d conn_msk:0x%x chk_restore:%d audio_open_cnt:%d",
1332         p_cb->conn_audio, p_cb->conn_video, p_data->conn_chg.is_up, conn_msk, chk_restore, p_cb->audio_open_cnt);
1333 
1334     if (chk_restore)
1335     {
1336         if (p_cb->audio_open_cnt == 1)
1337         {
1338             /* one audio channel goes down and there's one audio channel remains open.
1339              * restore the switch role in default link policy */
1340             bta_sys_set_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
1341             /* allow role switch, if this is the last connection */
1342             bta_av_restore_switch();
1343         }
1344         if (p_cb->audio_open_cnt)
1345         {
1346             /* adjust flush timeout settings to longer period */
1347             for (i=0; i<BTA_AV_NUM_STRS; i++)
1348             {
1349                 p_scbi = bta_av_cb.p_scb[i];
1350                 if (p_scbi && p_scbi->chnl == BTA_AV_CHNL_AUDIO && p_scbi->co_started)
1351                 {
1352                     /* may need to update the flush timeout of this already started stream */
1353                     if (p_scbi->co_started != bta_av_cb.audio_open_cnt)
1354                     {
1355                         p_scbi->co_started = bta_av_cb.audio_open_cnt;
1356                         L2CA_SetFlushTimeout(p_scbi->peer_addr, p_bta_av_cfg->p_audio_flush_to[p_scbi->co_started - 1] );
1357                     }
1358                 }
1359             }
1360         }
1361     }
1362 }
1363 
1364 /*******************************************************************************
1365 **
1366 ** Function         bta_av_disable
1367 **
1368 ** Description      disable AV.
1369 **
1370 ** Returns          void
1371 **
1372 *******************************************************************************/
bta_av_disable(tBTA_AV_CB * p_cb,tBTA_AV_DATA * p_data)1373 void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
1374 {
1375     BT_HDR  hdr;
1376     UINT16  xx;
1377     UNUSED(p_data);
1378 
1379     p_cb->disabling = TRUE;
1380 
1381     bta_av_close_all_rc(p_cb);
1382 
1383     utl_freebuf((void **) &p_cb->p_disc_db);
1384 
1385     /* disable audio/video - de-register all channels,
1386      * expect BTA_AV_DEREG_COMP_EVT when deregister is complete */
1387     for(xx=0; xx<BTA_AV_NUM_STRS; xx++)
1388     {
1389         hdr.layer_specific = xx + 1;
1390         bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
1391     }
1392 }
1393 
1394 /*******************************************************************************
1395 **
1396 ** Function         bta_av_api_disconnect
1397 **
1398 ** Description      .
1399 **
1400 ** Returns          void
1401 **
1402 *******************************************************************************/
bta_av_api_disconnect(tBTA_AV_DATA * p_data)1403 void bta_av_api_disconnect(tBTA_AV_DATA *p_data)
1404 {
1405     AVDT_DisconnectReq(p_data->api_discnt.bd_addr, bta_av_conn_cback);
1406     bta_sys_stop_timer(&bta_av_cb.sig_tmr);
1407 }
1408 
1409 /*******************************************************************************
1410 **
1411 ** Function         bta_av_sig_chg
1412 **
1413 ** Description      process AVDT signal channel up/down.
1414 **
1415 ** Returns          void
1416 **
1417 *******************************************************************************/
bta_av_sig_chg(tBTA_AV_DATA * p_data)1418 void bta_av_sig_chg(tBTA_AV_DATA *p_data)
1419 {
1420     UINT16 event = p_data->str_msg.hdr.layer_specific;
1421     tBTA_AV_CB   *p_cb = &bta_av_cb;
1422     int     xx;
1423     UINT8   mask;
1424     tBTA_AV_LCB *p_lcb = NULL;
1425 
1426     APPL_TRACE_DEBUG("bta_av_sig_chg event: %d", event);
1427     if(event == AVDT_CONNECT_IND_EVT)
1428     {
1429         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FIND);
1430         if(!p_lcb)
1431         {
1432             /* if the address does not have an LCB yet, alloc one */
1433             for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
1434             {
1435                 mask = 1 << xx;
1436                 APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
1437 
1438                 /* look for a p_lcb with its p_scb registered */
1439                 if((!(mask & p_cb->conn_lcb)) && (p_cb->p_scb[xx] != NULL))
1440                 {
1441                     p_lcb = &p_cb->lcb[xx];
1442                     p_lcb->lidx = xx + 1;
1443                     bdcpy(p_lcb->addr, p_data->str_msg.bd_addr);
1444                     p_lcb->conn_msk = 0; /* clear the connect mask */
1445                     /* start listening when the signal channel is open */
1446                     if (p_cb->features & BTA_AV_FEAT_RCTG)
1447                     {
1448                         bta_av_rc_create(p_cb, AVCT_ACP, 0, p_lcb->lidx);
1449                     }
1450                     /* this entry is not used yet. */
1451                     p_cb->conn_lcb |= mask;     /* mark it as used */
1452                     APPL_TRACE_DEBUG("start sig timer %d", p_data->hdr.offset);
1453                     if (p_data->hdr.offset == AVDT_ACP)
1454                     {
1455                         APPL_TRACE_DEBUG("Incoming L2CAP acquired, set state as incoming", NULL);
1456                         bdcpy(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr);
1457                         p_cb->p_scb[xx]->use_rc = TRUE;     /* allowing RC for incoming connection */
1458                         bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_ACP_CONNECT_EVT, p_data);
1459 
1460                         /* The Pending Event should be sent as soon as the L2CAP signalling channel
1461                          * is set up, which is NOW. Earlier this was done only after
1462                          * BTA_AV_SIG_TIME_VAL milliseconds.
1463                          * The following function shall send the event and start the recurring timer
1464                          */
1465                         bta_av_sig_timer(NULL);
1466 
1467                         /* Possible collision : need to avoid outgoing processing while the timer is running */
1468                         p_cb->p_scb[xx]->coll_mask = BTA_AV_COLL_INC_TMR;
1469 
1470                         p_cb->acp_sig_tmr.param = (UINT32)xx;
1471                         p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK*)&bta_av_acp_sig_timer_cback;
1472                         bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
1473                     }
1474                     break;
1475                 }
1476             }
1477 
1478             /* check if we found something */
1479             if (xx == BTA_AV_NUM_LINKS)
1480             {
1481                 /* We do not have scb for this avdt connection.     */
1482                 /* Silently close the connection.                   */
1483                 APPL_TRACE_ERROR("av scb not available for avdt connection");
1484                 AVDT_DisconnectReq (p_data->str_msg.bd_addr, NULL);
1485                 return;
1486             }
1487         }
1488     }
1489 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
1490     else if (event == BTA_AR_AVDT_CONN_EVT)
1491     {
1492         bta_sys_stop_timer(&bta_av_cb.sig_tmr);
1493     }
1494 #endif
1495     else
1496     {
1497         /* disconnected. */
1498         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FREE);
1499         if(p_lcb && p_lcb->conn_msk)
1500         {
1501             APPL_TRACE_DEBUG("conn_msk: 0x%x", p_lcb->conn_msk);
1502             /* clean up ssm  */
1503             for(xx=0; xx < BTA_AV_NUM_STRS; xx++)
1504             {
1505                 mask = 1 << (xx + 1);
1506                 if ((mask & p_lcb->conn_msk) && (p_cb->p_scb[xx]) &&
1507                     (bdcmp(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr) == 0))
1508                 {
1509                     bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_AVDT_DISCONNECT_EVT, NULL);
1510                 }
1511             }
1512         }
1513     }
1514     APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
1515 }
1516 
1517 /*******************************************************************************
1518 **
1519 ** Function         bta_av_sig_timer
1520 **
1521 ** Description      process the signal channel timer. This timer is started
1522 **                  when the AVDTP signal channel is connected. If no profile
1523 **                  is connected, the timer goes off every BTA_AV_SIG_TIME_VAL
1524 **
1525 ** Returns          void
1526 **
1527 *******************************************************************************/
bta_av_sig_timer(tBTA_AV_DATA * p_data)1528 void bta_av_sig_timer(tBTA_AV_DATA *p_data)
1529 {
1530     tBTA_AV_CB   *p_cb = &bta_av_cb;
1531     int     xx;
1532     UINT8   mask;
1533     tBTA_AV_LCB *p_lcb = NULL;
1534     tBTA_AV_PEND pend;
1535     UNUSED(p_data);
1536 
1537     APPL_TRACE_DEBUG("bta_av_sig_timer");
1538     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
1539     {
1540         mask = 1 << xx;
1541         if(mask & p_cb->conn_lcb)
1542         {
1543             /* this entry is used. check if it is connected */
1544             p_lcb = &p_cb->lcb[xx];
1545             if(!p_lcb->conn_msk)
1546             {
1547                 bta_sys_start_timer(&p_cb->sig_tmr, BTA_AV_SIG_TIMER_EVT, BTA_AV_SIG_TIME_VAL);
1548                 bdcpy(pend.bd_addr, p_lcb->addr);
1549                 (*p_cb->p_cback)(BTA_AV_PENDING_EVT, (tBTA_AV *) &pend);
1550             }
1551         }
1552     }
1553 }
1554 
1555 /*******************************************************************************
1556 **
1557 ** Function         bta_av_acp_sig_timer_cback
1558 **
1559 ** Description      Process the timeout when SRC is accepting connection
1560 **                  and SNK did not start signalling.
1561 **
1562 ** Returns          void
1563 **
1564 *******************************************************************************/
bta_av_acp_sig_timer_cback(TIMER_LIST_ENT * p_tle)1565 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle)
1566 {
1567     UINT8   inx = (UINT8)p_tle->param;
1568     tBTA_AV_CB  *p_cb = &bta_av_cb;
1569     tBTA_AV_SCB *p_scb = NULL;
1570     tBTA_AV_API_OPEN  *p_buf;
1571     if (inx < BTA_AV_NUM_STRS)
1572     {
1573         p_scb = p_cb->p_scb[inx];
1574     }
1575     if (p_scb)
1576     {
1577         APPL_TRACE_DEBUG("bta_av_acp_sig_timer_cback, coll_mask = 0x%02X", p_scb->coll_mask);
1578 
1579         if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)
1580         {
1581             p_scb->coll_mask &= ~BTA_AV_COLL_INC_TMR;
1582 
1583             if (bta_av_is_scb_opening(p_scb))
1584             {
1585                 if (p_scb->p_disc_db)
1586                 {
1587                     /* We are still doing SDP. Run the timer again. */
1588                     p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;
1589 
1590                     p_cb->acp_sig_tmr.param = (UINT32)inx;
1591                     p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK *)&bta_av_acp_sig_timer_cback;
1592                     bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
1593                 }
1594                 else
1595                 {
1596                     /* SNK did not start signalling, resume signalling process. */
1597                     bta_av_discover_req (p_scb, NULL);
1598                 }
1599             }
1600             else if (bta_av_is_scb_incoming(p_scb))
1601             {
1602                 /* Stay in incoming state if SNK does not start signalling */
1603 
1604                 /* API open was called right after SNK opened L2C connection. */
1605                 if (p_scb->coll_mask & BTA_AV_COLL_API_CALLED)
1606                 {
1607                     p_scb->coll_mask &= ~BTA_AV_COLL_API_CALLED;
1608 
1609                     /* BTA_AV_API_OPEN_EVT */
1610                     if ((p_buf = (tBTA_AV_API_OPEN *) GKI_getbuf(sizeof(tBTA_AV_API_OPEN))) != NULL)
1611                     {
1612                         memcpy(p_buf, &(p_scb->open_api), sizeof(tBTA_AV_API_OPEN));
1613                         bta_sys_sendmsg(p_buf);
1614                     }
1615                 }
1616             }
1617         }
1618     }
1619 }
1620 
1621 /*******************************************************************************
1622 **
1623 ** Function         bta_av_check_peer_features
1624 **
1625 ** Description      check supported features on the peer device from the SDP record
1626 **                  and return the feature mask
1627 **
1628 ** Returns          tBTA_AV_FEAT peer device feature mask
1629 **
1630 *******************************************************************************/
bta_av_check_peer_features(UINT16 service_uuid)1631 tBTA_AV_FEAT bta_av_check_peer_features (UINT16 service_uuid)
1632 {
1633     tBTA_AV_FEAT peer_features = 0;
1634     tBTA_AV_CB   *p_cb = &bta_av_cb;
1635     tSDP_DISC_REC       *p_rec = NULL;
1636     tSDP_DISC_ATTR      *p_attr;
1637     UINT16              peer_rc_version=0;
1638     UINT16              categories = 0;
1639 
1640     APPL_TRACE_DEBUG("bta_av_check_peer_features service_uuid:x%x", service_uuid);
1641     /* loop through all records we found */
1642     while (TRUE)
1643     {
1644         /* get next record; if none found, we're done */
1645         if ((p_rec = SDP_FindServiceInDb(p_cb->p_disc_db, service_uuid, p_rec)) == NULL)
1646         {
1647             break;
1648         }
1649 
1650         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_CLASS_ID_LIST)) != NULL)
1651         {
1652             /* find peer features */
1653             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL))
1654             {
1655                 peer_features |= BTA_AV_FEAT_RCCT;
1656             }
1657             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REM_CTRL_TARGET, NULL))
1658             {
1659                 peer_features |= BTA_AV_FEAT_RCTG;
1660             }
1661         }
1662 
1663         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST)) != NULL)
1664         {
1665             /* get profile version (if failure, version parameter is not updated) */
1666             SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL, &peer_rc_version);
1667             APPL_TRACE_DEBUG("peer_rc_version 0x%x", peer_rc_version);
1668 
1669             if (peer_rc_version >= AVRC_REV_1_3)
1670                 peer_features |= (BTA_AV_FEAT_VENDOR | BTA_AV_FEAT_METADATA);
1671 
1672             if (peer_rc_version >= AVRC_REV_1_4)
1673             {
1674                 peer_features |= (BTA_AV_FEAT_ADV_CTRL);
1675                 /* get supported categories */
1676                 if ((p_attr = SDP_FindAttributeInRec(p_rec,
1677                                 ATTR_ID_SUPPORTED_FEATURES)) != NULL)
1678                 {
1679                     categories = p_attr->attr_value.v.u16;
1680                     if (categories & AVRC_SUPF_CT_BROWSE)
1681                         peer_features |= (BTA_AV_FEAT_BROWSE);
1682                 }
1683             }
1684         }
1685     }
1686     APPL_TRACE_DEBUG("peer_features:x%x", peer_features);
1687     return peer_features;
1688 }
1689 
1690 /*******************************************************************************
1691 **
1692 ** Function         bta_av_rc_disc_done
1693 **
1694 ** Description      Handle AVRCP service discovery results.  If matching
1695 **                  service found, open AVRCP connection.
1696 **
1697 ** Returns          void
1698 **
1699 *******************************************************************************/
bta_av_rc_disc_done(tBTA_AV_DATA * p_data)1700 void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
1701 {
1702     tBTA_AV_CB   *p_cb = &bta_av_cb;
1703     tBTA_AV_SCB  *p_scb = NULL;
1704     tBTA_AV_LCB  *p_lcb;
1705     tBTA_AV_RC_OPEN rc_open;
1706     tBTA_AV_RC_FEAT rc_feat;
1707     UINT8               rc_handle;
1708     tBTA_AV_FEAT        peer_features;  /* peer features mask */
1709     UNUSED(p_data);
1710 
1711     APPL_TRACE_DEBUG("bta_av_rc_disc_done disc:x%x", p_cb->disc);
1712     if (!p_cb->disc)
1713     {
1714         return;
1715     }
1716 
1717     if ((p_cb->disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
1718     {
1719         /* this is the rc handle/index to tBTA_AV_RCB */
1720         rc_handle = p_cb->disc & (~BTA_AV_CHNL_MSK);
1721     }
1722     else
1723     {
1724         /* Validate array index*/
1725         if (((p_cb->disc & BTA_AV_HNDL_MSK) - 1) < BTA_AV_NUM_STRS)
1726         {
1727             p_scb = p_cb->p_scb[(p_cb->disc & BTA_AV_HNDL_MSK) - 1];
1728         }
1729         if (p_scb)
1730             rc_handle = p_scb->rc_handle;
1731         else
1732         {
1733             p_cb->disc = 0;
1734             return;
1735         }
1736     }
1737 
1738     APPL_TRACE_DEBUG("rc_handle %d", rc_handle);
1739     /* check peer version and whether support CT and TG role */
1740     peer_features = bta_av_check_peer_features (UUID_SERVCLASS_AV_REMOTE_CONTROL);
1741     if ((p_cb->features & BTA_AV_FEAT_ADV_CTRL) && ((peer_features&BTA_AV_FEAT_ADV_CTRL) == 0))
1742     {
1743         /* if we support advance control and peer does not, check their support on TG role
1744          * some implementation uses 1.3 on CT ans 1.4 on TG */
1745         peer_features |= bta_av_check_peer_features (UUID_SERVCLASS_AV_REM_CTRL_TARGET);
1746     }
1747 
1748     p_cb->disc = 0;
1749     utl_freebuf((void **) &p_cb->p_disc_db);
1750 
1751     APPL_TRACE_DEBUG("peer_features 0x%x, features 0x%x", peer_features, p_cb->features);
1752 
1753     /* if we have no rc connection */
1754     if (rc_handle == BTA_AV_RC_HANDLE_NONE)
1755     {
1756         if (p_scb)
1757         {
1758             /* if peer remote control service matches ours and USE_RC is TRUE */
1759             if ((((p_cb->features & BTA_AV_FEAT_RCCT) && (peer_features & BTA_AV_FEAT_RCTG)) ||
1760                  ((p_cb->features & BTA_AV_FEAT_RCTG) && (peer_features & BTA_AV_FEAT_RCCT))) )
1761             {
1762                 p_lcb = bta_av_find_lcb(p_scb->peer_addr, BTA_AV_LCB_FIND);
1763                 if(p_lcb)
1764                 {
1765                     rc_handle = bta_av_rc_create(p_cb, AVCT_INT, (UINT8)(p_scb->hdi + 1), p_lcb->lidx);
1766                     p_cb->rcb[rc_handle].peer_features = peer_features;
1767                 }
1768 #if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
1769                 else
1770                 {
1771                     APPL_TRACE_ERROR("can not find LCB!!");
1772                 }
1773 #endif
1774             }
1775             else if(p_scb->use_rc)
1776             {
1777                 /* can not find AVRC on peer device. report failure */
1778                 p_scb->use_rc = FALSE;
1779                 bdcpy(rc_open.peer_addr, p_scb->peer_addr);
1780                 rc_open.peer_features = 0;
1781                 rc_open.status = BTA_AV_FAIL_SDP;
1782                 (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
1783             }
1784         }
1785     }
1786     else
1787     {
1788         p_cb->rcb[rc_handle].peer_features = peer_features;
1789         rc_feat.rc_handle =  rc_handle;
1790         rc_feat.peer_features = peer_features;
1791         (*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
1792     }
1793 }
1794 
1795 /*******************************************************************************
1796 **
1797 ** Function         bta_av_rc_closed
1798 **
1799 ** Description      Set AVRCP state to closed.
1800 **
1801 ** Returns          void
1802 **
1803 *******************************************************************************/
bta_av_rc_closed(tBTA_AV_DATA * p_data)1804 void bta_av_rc_closed(tBTA_AV_DATA *p_data)
1805 {
1806     tBTA_AV_CB   *p_cb = &bta_av_cb;
1807     tBTA_AV_RC_CLOSE rc_close;
1808     tBTA_AV_RC_CONN_CHG *p_msg = (tBTA_AV_RC_CONN_CHG *)p_data;
1809     tBTA_AV_RCB    *p_rcb;
1810     tBTA_AV_SCB    *p_scb;
1811     int i;
1812     BOOLEAN conn = FALSE;
1813     tBTA_AV_LCB *p_lcb;
1814 
1815     rc_close.rc_handle = BTA_AV_RC_HANDLE_NONE;
1816     p_scb = NULL;
1817     APPL_TRACE_DEBUG("bta_av_rc_closed rc_handle:%d", p_msg->handle);
1818     for(i=0; i<BTA_AV_NUM_RCB; i++)
1819     {
1820         p_rcb = &p_cb->rcb[i];
1821         APPL_TRACE_DEBUG("bta_av_rc_closed rcb[%d] rc_handle:%d, status=0x%x", i, p_rcb->handle, p_rcb->status);
1822         if(p_rcb->handle == p_msg->handle)
1823         {
1824             rc_close.rc_handle = i;
1825             p_rcb->status &= ~BTA_AV_RC_CONN_MASK;
1826             p_rcb->peer_features = 0;
1827             APPL_TRACE_DEBUG("       shdl:%d, lidx:%d", p_rcb->shdl, p_rcb->lidx);
1828             if(p_rcb->shdl)
1829             {
1830                 if ((p_rcb->shdl - 1) < BTA_AV_NUM_STRS)
1831                 {
1832                     p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
1833                 }
1834                 if(p_scb)
1835                 {
1836                     bdcpy(rc_close.peer_addr, p_scb->peer_addr);
1837                     if(p_scb->rc_handle == p_rcb->handle)
1838                         p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
1839                     APPL_TRACE_DEBUG("shdl:%d, srch:%d", p_rcb->shdl, p_scb->rc_handle);
1840                 }
1841                 p_rcb->shdl = 0;
1842             }
1843             else if(p_rcb->lidx == (BTA_AV_NUM_LINKS + 1) )
1844             {
1845                 /* if the RCB uses the extra LCB, use the addr for event and clean it */
1846                 p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
1847                 bdcpy(rc_close.peer_addr, p_msg->peer_addr);
1848                 APPL_TRACE_DEBUG("rc_only closed bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
1849                               p_msg->peer_addr[0], p_msg->peer_addr[1],
1850                               p_msg->peer_addr[2], p_msg->peer_addr[3],
1851                               p_msg->peer_addr[4], p_msg->peer_addr[5]);
1852                 p_lcb->conn_msk = 0;
1853                 p_lcb->lidx = 0;
1854             }
1855             p_rcb->lidx = 0;
1856 
1857             if((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT)
1858             {
1859                 /* AVCT CCB is deallocated */
1860                 p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
1861                 p_rcb->status = 0;
1862             }
1863             else
1864             {
1865                 /* AVCT CCB is still there. dealloc */
1866                 bta_av_del_rc(p_rcb);
1867 
1868                 /* if the AVRCP is no longer listening, create the listening channel */
1869                 if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
1870                     bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
1871             }
1872         }
1873         else if((p_rcb->handle != BTA_AV_RC_HANDLE_NONE) && (p_rcb->status & BTA_AV_RC_CONN_MASK))
1874         {
1875             /* at least one channel is still connected */
1876             conn = TRUE;
1877         }
1878     }
1879 
1880     if(!conn)
1881     {
1882         /* no AVRC channels are connected, go back to INIT state */
1883         bta_av_sm_execute(p_cb, BTA_AV_AVRC_NONE_EVT, NULL);
1884     }
1885 
1886     if (rc_close.rc_handle == BTA_AV_RC_HANDLE_NONE)
1887     {
1888         rc_close.rc_handle = p_msg->handle;
1889         bdcpy(rc_close.peer_addr, p_msg->peer_addr);
1890     }
1891     (*p_cb->p_cback)(BTA_AV_RC_CLOSE_EVT, (tBTA_AV *) &rc_close);
1892 }
1893 
1894 /*******************************************************************************
1895 **
1896 ** Function         bta_av_rc_disc
1897 **
1898 ** Description      start AVRC SDP discovery.
1899 **
1900 ** Returns          void
1901 **
1902 *******************************************************************************/
bta_av_rc_disc(UINT8 disc)1903 void bta_av_rc_disc(UINT8 disc)
1904 {
1905     tBTA_AV_CB   *p_cb = &bta_av_cb;
1906     tAVRC_SDP_DB_PARAMS db_params;
1907       UINT16              attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST,
1908                                        ATTR_ID_BT_PROFILE_DESC_LIST,
1909                                        ATTR_ID_SUPPORTED_FEATURES};
1910     UINT8       hdi;
1911     tBTA_AV_SCB *p_scb;
1912     UINT8       *p_addr = NULL;
1913     UINT8       rc_handle;
1914 
1915     APPL_TRACE_DEBUG("bta_av_rc_disc 0x%x, %d", disc, bta_av_cb.disc);
1916     if ((bta_av_cb.disc != 0) || (disc == 0))
1917         return;
1918 
1919     if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
1920     {
1921         /* this is the rc handle/index to tBTA_AV_RCB */
1922         rc_handle = disc & (~BTA_AV_CHNL_MSK);
1923         if (p_cb->rcb[rc_handle].lidx)
1924         {
1925             p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx-1].addr;
1926         }
1927     }
1928     else
1929     {
1930         hdi = (disc & BTA_AV_HNDL_MSK) - 1;
1931         p_scb = p_cb->p_scb[hdi];
1932 
1933         if (p_scb)
1934         {
1935             APPL_TRACE_DEBUG("rc_handle %d", p_scb->rc_handle);
1936             p_addr = p_scb->peer_addr;
1937         }
1938     }
1939 
1940     if (p_addr)
1941     {
1942         /* allocate discovery database */
1943         if (p_cb->p_disc_db == NULL)
1944         {
1945             p_cb->p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(BTA_AV_DISC_BUF_SIZE);
1946         }
1947 
1948         if (p_cb->p_disc_db)
1949         {
1950             /* set up parameters */
1951             db_params.db_len = BTA_AV_DISC_BUF_SIZE;
1952             db_params.num_attr = 3;
1953             db_params.p_db = p_cb->p_disc_db;
1954             db_params.p_attrs = attr_list;
1955 
1956             /* searching for UUID_SERVCLASS_AV_REMOTE_CONTROL gets both TG and CT */
1957             if (AVRC_FindService(UUID_SERVCLASS_AV_REMOTE_CONTROL, p_addr, &db_params,
1958                             bta_av_avrc_sdp_cback) == AVRC_SUCCESS)
1959             {
1960                 p_cb->disc = disc;
1961                 APPL_TRACE_DEBUG("disc %d", p_cb->disc);
1962             }
1963         }
1964     }
1965 }
1966 
1967 /*******************************************************************************
1968 **
1969 ** Function         bta_av_dereg_comp
1970 **
1971 ** Description      deregister complete. free the stream control block.
1972 **
1973 ** Returns          void
1974 **
1975 *******************************************************************************/
bta_av_dereg_comp(tBTA_AV_DATA * p_data)1976 void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
1977 {
1978     tBTA_AV_CB   *p_cb = &bta_av_cb;
1979     tBTA_AV_SCB  *p_scb;
1980     tBTA_UTL_COD    cod;
1981     UINT8   mask;
1982     BT_HDR  *p_buf;
1983 
1984     /* find the stream control block */
1985     p_scb = bta_av_hndl_to_scb(p_data->hdr.layer_specific);
1986 
1987     if(p_scb)
1988     {
1989         APPL_TRACE_DEBUG("deregistered %d(h%d)", p_scb->chnl, p_scb->hndl);
1990         mask = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
1991         if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
1992         {
1993             p_cb->reg_audio  &= ~mask;
1994             if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
1995             {
1996                 /* this channel is still marked as open. decrease the count */
1997                 bta_av_cb.audio_open_cnt--;
1998             }
1999             p_cb->conn_audio &= ~mask;
2000 
2001             if (p_scb->q_tag == BTA_AV_Q_TAG_STREAM && p_scb->a2d_list) {
2002                 /* make sure no buffers are in a2d_list */
2003                 while (!list_is_empty(p_scb->a2d_list)) {
2004                     p_buf = (BT_HDR*)list_front(p_scb->a2d_list);
2005                     list_remove(p_scb->a2d_list, p_buf);
2006                     GKI_freebuf(p_buf);
2007                 }
2008             }
2009 
2010             /* remove the A2DP SDP record, if no more audio stream is left */
2011             if(!p_cb->reg_audio)
2012             {
2013 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
2014                 bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REMOTE_CONTROL, BTA_ID_AV);
2015 #endif
2016                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_handle);
2017                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
2018 
2019 #if (BTA_AV_SINK_INCLUDED == TRUE)
2020                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_snk_handle);
2021                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SINK);
2022 #endif
2023             }
2024         }
2025         else
2026         {
2027             p_cb->reg_video  &= ~mask;
2028             /* make sure that this channel is not connected */
2029             p_cb->conn_video &= ~mask;
2030             /* remove the VDP SDP record, (only one video stream at most) */
2031             bta_av_del_sdp_rec(&p_cb->sdp_vdp_handle);
2032             bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
2033         }
2034 
2035         /* make sure that the timer is not active */
2036         bta_sys_stop_timer(&p_scb->timer);
2037         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
2038     }
2039 
2040     APPL_TRACE_DEBUG("audio 0x%x, video: 0x%x, disable:%d",
2041         p_cb->reg_audio, p_cb->reg_video, p_cb->disabling);
2042     /* if no stream control block is active */
2043     if((p_cb->reg_audio + p_cb->reg_video) == 0)
2044     {
2045 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
2046         /* deregister from AVDT */
2047         bta_ar_dereg_avdt(BTA_ID_AV);
2048 
2049         /* deregister from AVCT */
2050         bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REM_CTRL_TARGET, BTA_ID_AV);
2051         bta_ar_dereg_avct(BTA_ID_AV);
2052 #endif
2053 
2054         if(p_cb->disabling)
2055         {
2056             p_cb->disabling     = FALSE;
2057             bta_av_cb.features  = 0;
2058         }
2059 
2060         /* Clear the Capturing service class bit */
2061         cod.service = BTM_COD_SERVICE_CAPTURING;
2062         utl_set_device_class(&cod, BTA_UTL_CLR_COD_SERVICE_CLASS);
2063     }
2064 }
2065 #endif /* BTA_AV_INCLUDED */
2066