Home | History | Annotate | Download | only in avdt
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2002-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This module contains the action functions associated with the stream
     22  *  control block state machine.
     23  *
     24  ******************************************************************************/
     25 
     26 #include <string.h>
     27 #include "data_types.h"
     28 #include "bt_target.h"
     29 #include "avdt_api.h"
     30 #include "avdtc_api.h"
     31 #include "avdt_int.h"
     32 #include "gki.h"
     33 #include "btu.h"
     34 
     35 /* This table is used to lookup the callback event that matches a particular
     36 ** state machine API request event.  Note that state machine API request
     37 ** events are at the beginning of the event list starting at zero, thus
     38 ** allowing for this table.
     39 */
     40 const UINT8 avdt_scb_cback_evt[] = {
     41     0,                          /* API_REMOVE_EVT (no event) */
     42     AVDT_WRITE_CFM_EVT,         /* API_WRITE_REQ_EVT */
     43     0,                          /* API_GETCONFIG_REQ_EVT (no event) */
     44     0,                          /* API_DELAY_RPT_REQ_EVT (no event) */
     45     AVDT_OPEN_CFM_EVT,          /* API_SETCONFIG_REQ_EVT */
     46     AVDT_OPEN_CFM_EVT,          /* API_OPEN_REQ_EVT */
     47     AVDT_CLOSE_CFM_EVT,         /* API_CLOSE_REQ_EVT */
     48     AVDT_RECONFIG_CFM_EVT,      /* API_RECONFIG_REQ_EVT */
     49     AVDT_SECURITY_CFM_EVT,      /* API_SECURITY_REQ_EVT */
     50     0                           /* API_ABORT_REQ_EVT (no event) */
     51 };
     52 
     53 /* This table is used to look up the callback event based on the signaling
     54 ** role when the stream is closed.
     55 */
     56 const UINT8 avdt_scb_role_evt[] = {
     57     AVDT_CLOSE_IND_EVT,         /* AVDT_CLOSE_ACP */
     58     AVDT_CLOSE_CFM_EVT,         /* AVDT_CLOSE_INT */
     59     AVDT_CLOSE_IND_EVT,         /* AVDT_OPEN_ACP */
     60     AVDT_OPEN_CFM_EVT           /* AVDT_OPEN_INT */
     61 };
     62 
     63 /*******************************************************************************
     64 **
     65 ** Function         avdt_scb_gen_ssrc
     66 **
     67 ** Description      This function generates a SSRC number unique to the stream.
     68 **
     69 ** Returns          SSRC value.
     70 **
     71 *******************************************************************************/
     72 UINT32 avdt_scb_gen_ssrc(tAVDT_SCB *p_scb)
     73 {
     74     /* combine the value of the media type and codec type of the SCB */
     75     return ((UINT32)(p_scb->cs.cfg.codec_info[1] | p_scb->cs.cfg.codec_info[2]));
     76 }
     77 
     78 /*******************************************************************************
     79 **
     80 ** Function         avdt_scb_hdl_abort_cmd
     81 **
     82 ** Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
     83 **                  to initiate sending of an abort response message.
     84 **
     85 ** Returns          Nothing.
     86 **
     87 *******************************************************************************/
     88 void avdt_scb_hdl_abort_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
     89 {
     90     p_scb->role = AVDT_CLOSE_ACP;
     91     avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
     92 }
     93 
     94 /*******************************************************************************
     95 **
     96 ** Function         avdt_scb_hdl_abort_rsp
     97 **
     98 ** Description      This function is an empty function; it serves as a
     99 **                  placeholder for a conformance API action function.
    100 **
    101 ** Returns          Nothing.
    102 **
    103 *******************************************************************************/
    104 void avdt_scb_hdl_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    105 {
    106     return;
    107 }
    108 
    109 /*******************************************************************************
    110 **
    111 ** Function         avdt_scb_hdl_close_cmd
    112 **
    113 ** Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
    114 **                  to initiate sending of a close response message.
    115 **
    116 ** Returns          Nothing.
    117 **
    118 *******************************************************************************/
    119 void avdt_scb_hdl_close_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    120 {
    121     p_scb->role = AVDT_CLOSE_ACP;
    122     avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
    123 }
    124 
    125 /*******************************************************************************
    126 **
    127 ** Function         avdt_scb_hdl_close_rsp
    128 **
    129 ** Description      This function sets the close_code variable to the error
    130 **                  code returned in the close response.
    131 **
    132 ** Returns          Nothing.
    133 **
    134 *******************************************************************************/
    135 void avdt_scb_hdl_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    136 {
    137     p_scb->close_code = p_data->msg.hdr.err_code;
    138 }
    139 
    140 /*******************************************************************************
    141 **
    142 ** Function         avdt_scb_hdl_getconfig_cmd
    143 **
    144 ** Description      This function retrieves the configuration parameters of
    145 **                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
    146 **                  to initiate sending of a get configuration response message.
    147 **
    148 ** Returns          Nothing.
    149 **
    150 *******************************************************************************/
    151 void avdt_scb_hdl_getconfig_cmd(tAVDT_SCB *p_scb,tAVDT_SCB_EVT *p_data)
    152 {
    153     p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
    154 
    155     avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
    156 }
    157 
    158 /*******************************************************************************
    159 **
    160 ** Function         avdt_scb_hdl_getconfig_rsp
    161 **
    162 ** Description      This function is an empty function; it serves as a
    163 **                  placeholder for a conformance API action function.
    164 **
    165 ** Returns          Nothing.
    166 **
    167 *******************************************************************************/
    168 void avdt_scb_hdl_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    169 {
    170     return;
    171 }
    172 
    173 /*******************************************************************************
    174 **
    175 ** Function         avdt_scb_hdl_open_cmd
    176 **
    177 ** Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
    178 **                  to initiate sending of an open response message.
    179 **
    180 ** Returns          Nothing.
    181 **
    182 *******************************************************************************/
    183 void avdt_scb_hdl_open_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    184 {
    185     avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
    186 }
    187 
    188 /*******************************************************************************
    189 **
    190 ** Function         avdt_scb_hdl_open_rej
    191 **
    192 ** Description      This function calls the application callback function
    193 **                  indicating the open request has failed.  It initializes
    194 **                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
    195 **                  to the CCB.
    196 **
    197 ** Returns          Nothing.
    198 **
    199 *******************************************************************************/
    200 void avdt_scb_hdl_open_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    201 {
    202     /* do exactly same as setconfig reject */
    203     avdt_scb_hdl_setconfig_rej(p_scb, p_data);
    204 }
    205 
    206 /*******************************************************************************
    207 **
    208 ** Function         avdt_scb_hdl_open_rsp
    209 **
    210 ** Description      This function calls avdt_ad_open_req() to initiate
    211 **                  connection of the transport channel for this stream.
    212 **
    213 ** Returns          Nothing.
    214 **
    215 *******************************************************************************/
    216 void avdt_scb_hdl_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    217 {
    218     /* initiate opening of trans channels for this SEID */
    219     p_scb->role = AVDT_OPEN_INT;
    220     avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
    221 
    222     /* start tc connect timer */
    223     btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
    224 }
    225 
    226 /*******************************************************************************
    227 **
    228 ** Function         avdt_scb_hdl_pkt_no_frag
    229 **
    230 ** Description
    231 **
    232 ** Returns          Nothing.
    233 **
    234 *******************************************************************************/
    235 void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    236 {
    237     UINT8   *p, *p_start;
    238     UINT8   o_v, o_p, o_x, o_cc;
    239     UINT8   m_pt;
    240     UINT8   marker;
    241     UINT16  seq;
    242     UINT32  time_stamp;
    243     UINT32  ssrc;
    244     UINT16  offset;
    245     UINT16  ex_len;
    246     UINT8   pad_len = 0;
    247 
    248     p = p_start = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    249 
    250     /* parse media packet header */
    251     AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
    252     AVDT_MSG_PRS_M_PT(p, m_pt, marker);
    253     BE_STREAM_TO_UINT16(seq, p);
    254     BE_STREAM_TO_UINT32(time_stamp, p);
    255     BE_STREAM_TO_UINT32(ssrc, p);
    256 
    257     /* skip over any csrc's in packet */
    258     p += o_cc * 4;
    259 
    260     /* check for and skip over extension header */
    261     if (o_x)
    262     {
    263         p += 2;
    264         BE_STREAM_TO_UINT16(ex_len, p);
    265         p += ex_len * 4;
    266     }
    267 
    268     /* save our new offset */
    269     offset = (UINT16) (p - p_start);
    270 
    271     /* adjust length for any padding at end of packet */
    272     if (o_p)
    273     {
    274         /* padding length in last byte of packet */
    275         pad_len =  *(p_start + p_data->p_pkt->len);
    276     }
    277 
    278     /* do sanity check */
    279     if ((offset > p_data->p_pkt->len) || ((pad_len + offset) > p_data->p_pkt->len))
    280     {
    281         AVDT_TRACE_WARNING0("Got bad media packet");
    282         GKI_freebuf(p_data->p_pkt);
    283     }
    284     /* adjust offset and length and send it up */
    285     else
    286     {
    287         p_data->p_pkt->len -= (offset + pad_len);
    288         p_data->p_pkt->offset += offset;
    289 
    290         if (p_scb->cs.p_data_cback != NULL)
    291         {
    292             /* report sequence number */
    293             p_data->p_pkt->layer_specific = seq;
    294             (*p_scb->cs.p_data_cback)(avdt_scb_to_hdl(p_scb), p_data->p_pkt,
    295                 time_stamp, (UINT8)(m_pt | (marker<<7)));
    296         }
    297         else
    298         {
    299 #if AVDT_MULTIPLEXING == TRUE
    300             if ((p_scb->cs.p_media_cback != NULL)
    301              && (p_scb->p_media_buf != NULL)
    302              && (p_scb->media_buf_len > p_data->p_pkt->len))
    303             {
    304                 /* media buffer enough length is assigned by application. Lets use it*/
    305                 memcpy(p_scb->p_media_buf,(UINT8*)(p_data->p_pkt + 1) + p_data->p_pkt->offset,
    306                     p_data->p_pkt->len);
    307                 (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb),p_scb->p_media_buf,
    308                     p_scb->media_buf_len,time_stamp,seq,m_pt,marker);
    309             }
    310 #endif
    311             GKI_freebuf(p_data->p_pkt);
    312         }
    313     }
    314 }
    315 
    316 #if AVDT_REPORTING == TRUE
    317 /*******************************************************************************
    318 **
    319 ** Function         avdt_scb_hdl_report
    320 **
    321 ** Description
    322 **
    323 ** Returns          Nothing.
    324 **
    325 *******************************************************************************/
    326 UINT8 * avdt_scb_hdl_report(tAVDT_SCB *p_scb, UINT8 *p, UINT16 len)
    327 {
    328     UINT16  result = AVDT_SUCCESS;
    329     UINT8   *p_start = p;
    330     UINT32  ssrc;
    331     UINT8   o_v, o_p, o_cc;
    332     UINT16  pkt_len;
    333     AVDT_REPORT_TYPE    pt;
    334     tAVDT_REPORT_DATA   report, *p_rpt;
    335 
    336     AVDT_TRACE_DEBUG0( "avdt_scb_hdl_report");
    337     if(p_scb->cs.p_report_cback)
    338     {
    339         p_rpt = &report;
    340         /* parse report packet header */
    341         AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
    342         pt = *p++;
    343         BE_STREAM_TO_UINT16(pkt_len, p);
    344         BE_STREAM_TO_UINT32(ssrc, p);
    345 
    346         switch(pt)
    347         {
    348         case AVDT_RTCP_PT_SR:   /* the packet type - SR (Sender Report) */
    349             BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
    350             BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
    351             BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
    352             BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
    353             BE_STREAM_TO_UINT32(report.sr.octet_count, p);
    354             break;
    355 
    356         case AVDT_RTCP_PT_RR:   /* the packet type - RR (Receiver Report) */
    357             report.rr.frag_lost = *p;
    358             BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
    359             report.rr.packet_lost &= 0xFFFFFF;
    360             BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
    361             BE_STREAM_TO_UINT32(report.rr.jitter, p);
    362             BE_STREAM_TO_UINT32(report.rr.lsr, p);
    363             BE_STREAM_TO_UINT32(report.rr.dlsr, p);
    364             break;
    365 
    366         case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
    367             if(*p == AVDT_RTCP_SDES_CNAME)
    368             {
    369                 p_rpt = (tAVDT_REPORT_DATA *)(p+2);
    370             }
    371             else
    372             {
    373                 AVDT_TRACE_WARNING5( " - SDES SSRC=0x%08x sc=%d %d len=%d %s",
    374                     ssrc, o_cc, *p, *(p+1), p+2);
    375                 result = AVDT_BUSY;
    376             }
    377             break;
    378 
    379         default:
    380             AVDT_TRACE_ERROR1( "Bad Report pkt - packet type: %d", pt);
    381             result = AVDT_BAD_PARAMS;
    382         }
    383 
    384         if(result == AVDT_SUCCESS)
    385             (*p_scb->cs.p_report_cback)(avdt_scb_to_hdl(p_scb), pt, p_rpt);
    386 
    387     }
    388     p_start += len;
    389     return p_start;
    390 }
    391 #endif
    392 
    393 #if AVDT_MULTIPLEXING == TRUE
    394 /*******************************************************************************
    395 **
    396 ** Function         avdt_scb_hdl_pkt_frag
    397 **
    398 ** Description
    399 **
    400 ** Returns          Nothing.
    401 **
    402 *******************************************************************************/
    403 void avdt_scb_hdl_pkt_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    404 {
    405     /* Fields of Adaptation Layer Header */
    406     UINT8   al_tsid,al_frag,al_lcode;
    407     UINT16  al_len;
    408     /* media header fields */
    409     UINT8   o_v, o_p, o_x, o_cc;
    410     UINT8   m_pt;
    411     UINT8   marker;
    412     UINT16  seq;
    413     UINT32  time_stamp;
    414     UINT32  ssrc;
    415     UINT16  ex_len;
    416     UINT8   pad_len;
    417     /* other variables */
    418     UINT8   *p; /* current pointer */
    419     UINT8   *p_end; /* end of all packet */
    420     UINT8   *p_payload; /* pointer to media fragment payload in the buffer */
    421     UINT32  payload_len; /* payload length */
    422     UINT16  frag_len; /* fragment length */
    423 
    424     p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    425     p_end = p + p_data->p_pkt->len;
    426     /* parse all fragments */
    427     while(p < p_end)
    428     {
    429         if (p_end - p < 4) /* length check. maximum length of AL header = 4 */
    430         {
    431             AVDT_TRACE_WARNING2("p_end: 0x%x - p:0x%x < 4", p_end, p);
    432             break;
    433         }
    434 
    435         /* parse first byte */
    436         al_tsid = (*p)>>3;
    437         al_frag = ( (*p) >> 2 ) & 0x01;
    438         al_lcode = (*p++) & AVDT_ALH_LCODE_MASK;
    439 
    440         /* in case of TSID=00000, a second AL header byte, before the length field,
    441         ** is expected and contains the actual TSID, aligned with MSB */
    442         if(al_tsid == 0)
    443             al_tsid = *p++;
    444 
    445         /* get remaining media length on base of lcode */
    446         switch(al_lcode)
    447         {
    448         case AVDT_ALH_LCODE_NONE:  /* No length field present. Take length from l2cap */
    449             al_len = (UINT16)(p_end - p);
    450             break;
    451         case AVDT_ALH_LCODE_16BIT:  /* 16 bit length field */
    452             BE_STREAM_TO_UINT16(al_len, p);
    453             break;
    454         case AVDT_ALH_LCODE_9BITM0:  /* 9 bit length field, MSB = 0, 8 LSBs in 1 octet following */
    455             al_len = *p++;
    456             break;
    457         default:    /* 9 bit length field, MSB = 1, 8 LSBs in 1 octet following */
    458             al_len =(UINT16)*p++ + 0x100;
    459         }
    460 
    461         /* max fragment length */
    462         frag_len = (UINT16)(p_end - p);
    463         /* if it isn't last fragment */
    464         if(frag_len >= al_len)
    465             frag_len = al_len;
    466 
    467         /* check TSID corresponds to config */
    468         if (al_tsid != p_scb->curr_cfg.mux_tsid_media)
    469         {
    470 #if AVDT_REPORTING == TRUE
    471             if((p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) &&
    472                 (al_tsid == p_scb->curr_cfg.mux_tsid_report))
    473             {
    474                 /* parse reporting packet */
    475                 p = avdt_scb_hdl_report(p_scb, p, frag_len);
    476                 continue;
    477             }
    478             else
    479 #endif
    480             {
    481                 AVDT_TRACE_WARNING2("bad tsid: %d, mux_tsid_media:%d", al_tsid, p_scb->curr_cfg.mux_tsid_media);
    482                 break;
    483             }
    484         }
    485         /* check are buffer for assembling and related callback set */
    486         else if ((p_scb->p_media_buf == NULL) || (p_scb->cs.p_media_cback == NULL))
    487         {
    488             AVDT_TRACE_WARNING0("NULL p_media_buf or p_media_cback");
    489             break;
    490         }
    491 
    492 
    493         /* it is media fragment beginning */
    494         if(!al_frag) /* is it first fragment of original media packet */
    495         {
    496             AVDT_TRACE_DEBUG2("al:%d media:%d",
    497                 al_len, p_scb->media_buf_len);
    498 
    499             p_scb->frag_off = 0;
    500             p_scb->frag_org_len = al_len; /* total length of original media packet */
    501             /* length check: minimum length of media header is 12 */
    502             if (p_scb->frag_org_len < 12)
    503             {
    504                 AVDT_TRACE_WARNING1("bad al_len: %d(<12)", al_len);
    505                 break;
    506             }
    507             /* check that data fit into buffer */
    508             if (al_len > p_scb->media_buf_len)
    509             {
    510                 AVDT_TRACE_WARNING2("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
    511                 break;
    512             }
    513             /* make sure it is the last fragment in l2cap packet */
    514             if (p + al_len < p_end)
    515             {
    516                 AVDT_TRACE_WARNING2("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
    517                 break;
    518             }
    519         }
    520         else
    521         {
    522             AVDT_TRACE_DEBUG4("al:%d media:%d frag_org_len:%d frag_off:%d",
    523                 al_len, p_scb->media_buf_len, p_scb->frag_org_len, p_scb->frag_off);
    524 
    525             /* check that remaining length from AL header equals to original len - length of already received fragments */
    526             if(al_len != p_scb->frag_org_len - p_scb->frag_off)
    527             {
    528                 AVDT_TRACE_WARNING4("al_len:%d != (frag_org_len:%d - frag_off:%d) %d",
    529                     al_len, p_scb->frag_org_len, p_scb->frag_off,
    530                     (p_scb->frag_org_len- p_scb->frag_off));
    531                 break;
    532             }
    533 
    534             /* do sanity check */
    535             if (p_scb->frag_off == 0)
    536             {
    537                 AVDT_TRACE_WARNING0("frag_off=0");
    538                 break;
    539             }
    540         }
    541         /* do common sanity check */
    542         if((p_scb->frag_org_len <= p_scb->frag_off) || (p_scb->frag_org_len >= p_scb->media_buf_len))
    543         {
    544             AVDT_TRACE_WARNING3("common sanity frag_off:%d frag_org_len:%d media_buf_len:%d",
    545                 p_scb->frag_off, p_scb->frag_org_len, p_scb->media_buf_len);
    546             break;
    547         }
    548 
    549         AVDT_TRACE_DEBUG4("Received fragment org_len=%d off=%d al_len=%d frag_len=%d",
    550             p_scb->frag_org_len, p_scb->frag_off, al_len, frag_len);
    551 
    552         /* copy fragment into buffer */
    553         memcpy(p_scb->p_media_buf + p_scb->frag_off, p, frag_len);
    554         p_scb->frag_off += frag_len;
    555         /* move to the next fragment */
    556         p += frag_len;
    557         /* if it is last fragment in original media packet then process total media pocket */
    558         if(p_scb->frag_off == p_scb->frag_org_len)
    559         {
    560             p_payload = p_scb->p_media_buf;
    561 
    562             /* media header */
    563             AVDT_MSG_PRS_OCTET1(p_payload, o_v, o_p, o_x, o_cc);
    564             AVDT_MSG_PRS_M_PT(p_payload, m_pt, marker);
    565             BE_STREAM_TO_UINT16(seq, p_payload);
    566             BE_STREAM_TO_UINT32(time_stamp, p_payload);
    567             BE_STREAM_TO_UINT32(ssrc, p_payload);
    568 
    569             /* skip over any csrc's in packet */
    570             p_payload += o_cc * 4;
    571 
    572             /* check for and skip over extension header */
    573             if (o_x)
    574             {
    575                 if(p_scb->p_media_buf + p_scb->frag_off - p_payload < 4)
    576                 {
    577                     AVDT_TRACE_WARNING3("length check frag_off:%d p_media_buf:%d p_payload:%d",
    578                         p_scb->frag_off, p_scb->p_media_buf, p_payload);
    579                     break;/* length check */
    580                 }
    581                 p_payload += 2;
    582                 BE_STREAM_TO_UINT16(ex_len, p_payload);
    583                 p_payload += ex_len * 4;
    584             }
    585 
    586             if(p_payload >= p_scb->p_media_buf + p_scb->frag_off)
    587             {
    588                 AVDT_TRACE_WARNING3("length check2 frag_off:%d p_media_buf:%d p_payload:%d",
    589                     p_scb->frag_off, p_scb->p_media_buf, p_payload);
    590                 break;/* length check */
    591             }
    592 
    593             /* adjust length for any padding at end of packet */
    594             if (o_p)
    595             {
    596                 /* padding length in last byte of packet */
    597                 pad_len =  *(p_scb->p_media_buf + p_scb->frag_off - 1);
    598             }
    599             else
    600                 pad_len =  0;
    601             /* payload length */
    602             payload_len = (UINT32)(p_scb->p_media_buf + p_scb->frag_off - pad_len - p_payload);
    603 
    604             AVDT_TRACE_DEBUG2("Received last fragment header=%d len=%d",
    605                 p_payload - p_scb->p_media_buf,payload_len);
    606 
    607             /* send total media packet up */
    608             if (p_scb->cs.p_media_cback != NULL)
    609             {
    610                 (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb), p_payload,
    611                                            payload_len, time_stamp, seq, m_pt, marker);
    612             }
    613         }
    614     } /* while(p < p_end) */
    615 
    616     if(p < p_end)
    617     {
    618         AVDT_TRACE_WARNING0("*** Got bad media packet");
    619     }
    620     GKI_freebuf(p_data->p_pkt);
    621 }
    622 #endif
    623 
    624 /*******************************************************************************
    625 **
    626 ** Function         avdt_scb_hdl_pkt
    627 **
    628 ** Description
    629 **
    630 ** Returns          Nothing.
    631 **
    632 *******************************************************************************/
    633 void avdt_scb_hdl_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    634 {
    635 #if AVDT_REPORTING == TRUE
    636     UINT8 *p;
    637 #endif
    638 
    639 #if AVDT_MULTIPLEXING == TRUE
    640     /* select right function in dependance of is fragmentation supported or not */
    641     if( 0 != (p_scb->curr_cfg.psc_mask & AVDT_PSC_MUX))
    642     {
    643         avdt_scb_hdl_pkt_frag(p_scb, p_data);
    644     }
    645     else
    646 #endif
    647 #if AVDT_REPORTING == TRUE
    648     if(p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT)
    649     {
    650         p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    651         avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
    652         GKI_freebuf(p_data->p_pkt);
    653     }
    654     else
    655 #endif
    656         avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
    657 }
    658 
    659 /*******************************************************************************
    660 **
    661 ** Function         avdt_scb_drop_pkt
    662 **
    663 ** Description      Drop an incoming media packet.  This function is called if
    664 **                  a media packet is received in any state besides streaming.
    665 **
    666 ** Returns          Nothing.
    667 **
    668 *******************************************************************************/
    669 void avdt_scb_drop_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    670 {
    671     GKI_freebuf(p_data->p_pkt);
    672     AVDT_TRACE_WARNING0("Dropped incoming media packet");
    673 }
    674 
    675 /*******************************************************************************
    676 **
    677 ** Function         avdt_scb_hdl_reconfig_cmd
    678 **
    679 ** Description      This function calls the application callback function
    680 **                  with a reconfiguration indication.
    681 **
    682 ** Returns          Nothing.
    683 **
    684 *******************************************************************************/
    685 void avdt_scb_hdl_reconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    686 {
    687     /* if command not supported */
    688     if (p_scb->cs.nsc_mask & AVDT_NSC_RECONFIG)
    689     {
    690         /* send reject */
    691         p_data->msg.hdr.err_code = AVDT_ERR_NSC;
    692         p_data->msg.hdr.err_param = 0;
    693         avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
    694     }
    695     else
    696     {
    697         /* store requested configuration */
    698         memcpy(&p_scb->req_cfg, p_data->msg.reconfig_cmd.p_cfg, sizeof(tAVDT_CFG));
    699 
    700         /* call application callback */
    701         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    702                                   NULL,
    703                                   AVDT_RECONFIG_IND_EVT,
    704                                   (tAVDT_CTRL *) &p_data->msg.reconfig_cmd);
    705     }
    706 }
    707 
    708 /*******************************************************************************
    709 **
    710 ** Function         avdt_scb_hdl_reconfig_rsp
    711 **
    712 ** Description      This function calls the application callback function
    713 **                  with a reconfiguration confirm.
    714 **
    715 ** Returns          Nothing.
    716 **
    717 *******************************************************************************/
    718 void avdt_scb_hdl_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    719 {
    720     if (p_data->msg.hdr.err_code == 0)
    721     {
    722         /* store new configuration */
    723         if (p_scb->req_cfg.num_codec > 0)
    724         {
    725             p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
    726             memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
    727         }
    728         if (p_scb->req_cfg.num_protect > 0)
    729         {
    730             p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
    731             memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
    732         }
    733     }
    734 
    735     p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
    736 
    737     /* call application callback */
    738     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    739                               NULL,
    740                               AVDT_RECONFIG_CFM_EVT,
    741                               (tAVDT_CTRL *) &p_data->msg.svccap);
    742 }
    743 
    744 /*******************************************************************************
    745 **
    746 ** Function         avdt_scb_hdl_security_cmd
    747 **
    748 ** Description      This function calls the application callback with a
    749 **                  security indication.
    750 **
    751 ** Returns          Nothing.
    752 **
    753 *******************************************************************************/
    754 void avdt_scb_hdl_security_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    755 {
    756     /* if command not supported */
    757     if (p_scb->cs.nsc_mask & AVDT_NSC_SECURITY)
    758     {
    759         /* send reject */
    760         p_data->msg.hdr.err_code = AVDT_ERR_NSC;
    761         avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
    762     }
    763     else
    764     {
    765         /* call application callback */
    766         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    767                                   NULL,
    768                                   AVDT_SECURITY_IND_EVT,
    769                                   (tAVDT_CTRL *) &p_data->msg.security_cmd);
    770     }
    771 }
    772 
    773 /*******************************************************************************
    774 **
    775 ** Function         avdt_scb_hdl_security_rsp
    776 **
    777 ** Description      This function calls the application callback with a
    778 **                  security confirm.
    779 **
    780 ** Returns          Nothing.
    781 **
    782 *******************************************************************************/
    783 void avdt_scb_hdl_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    784 {
    785     /* call application callback */
    786     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    787                               NULL,
    788                               AVDT_SECURITY_CFM_EVT,
    789                               (tAVDT_CTRL *) &p_data->msg.security_cmd);
    790 }
    791 
    792 /*******************************************************************************
    793 **
    794 ** Function         avdt_scb_hdl_setconfig_cmd
    795 **
    796 ** Description      This function marks the SCB as in use and copies the
    797 **                  configuration and peer SEID to the SCB.  It then calls
    798 **                  the application callback with a configuration indication.
    799 **
    800 ** Returns          Nothing.
    801 **
    802 *******************************************************************************/
    803 void avdt_scb_hdl_setconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    804 {
    805     tAVDT_CFG *p_cfg;
    806 
    807     if (!p_scb->in_use)
    808     {
    809         p_cfg = p_data->msg.config_cmd.p_cfg;
    810         if(p_scb->cs.cfg.codec_info[AVDT_CODEC_TYPE_INDEX] == p_cfg->codec_info[AVDT_CODEC_TYPE_INDEX])
    811         {
    812             /* set sep as in use */
    813             p_scb->in_use = TRUE;
    814 
    815             /* copy info to scb */
    816             p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
    817             p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
    818             memcpy(&p_scb->req_cfg, p_cfg, sizeof(tAVDT_CFG));
    819             /* call app callback */
    820             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    821                                       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    822                                       AVDT_CONFIG_IND_EVT,
    823                                       (tAVDT_CTRL *) &p_data->msg.config_cmd);
    824         }
    825         else
    826         {
    827             p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
    828             p_data->msg.hdr.err_param = 0;
    829             avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
    830                               p_data->msg.hdr.sig_id, &p_data->msg);
    831         }
    832     }
    833     else
    834     {
    835         avdt_scb_rej_in_use(p_scb, p_data);
    836     }
    837 }
    838 
    839 /*******************************************************************************
    840 **
    841 ** Function         avdt_scb_hdl_setconfig_rej
    842 **
    843 ** Description      This function marks the SCB as not in use and calls the
    844 **                  application callback with an open confirm indicating failure.
    845 **
    846 ** Returns          Nothing.
    847 **
    848 *******************************************************************************/
    849 void avdt_scb_hdl_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    850 {
    851     /* clear scb variables */
    852     avdt_scb_clr_vars(p_scb, p_data);
    853 
    854     /* tell ccb we're done with signaling channel */
    855     avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_CCB_UL_CLOSE_EVT, NULL);
    856 
    857     /* call application callback */
    858     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    859                               NULL,
    860                               AVDT_OPEN_CFM_EVT,
    861                               (tAVDT_CTRL *) &p_data->msg.hdr);
    862 }
    863 
    864 /*******************************************************************************
    865 **
    866 ** Function         avdt_scb_hdl_setconfig_rsp
    867 **
    868 ** Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
    869 **                  to initiate sending of an open command message.
    870 **
    871 ** Returns          Nothing.
    872 **
    873 *******************************************************************************/
    874 void avdt_scb_hdl_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    875 {
    876     tAVDT_EVT_HDR   single;
    877 
    878     if (p_scb->p_ccb != NULL)
    879     {
    880         /* save configuration */
    881         memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
    882 
    883         /* initiate open */
    884         single.seid = p_scb->peer_seid;
    885         avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, (tAVDT_SCB_EVT *) &single);
    886     }
    887 }
    888 
    889 /*******************************************************************************
    890 **
    891 ** Function         avdt_scb_hdl_start_cmd
    892 **
    893 ** Description      This function calls the application callback with a
    894 **                  start indication.
    895 **
    896 ** Returns          Nothing.
    897 **
    898 *******************************************************************************/
    899 void avdt_scb_hdl_start_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    900 {
    901     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    902                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    903                               AVDT_START_IND_EVT,
    904                               NULL);
    905 }
    906 
    907 /*******************************************************************************
    908 **
    909 ** Function         avdt_scb_hdl_start_rsp
    910 **
    911 ** Description      This function calls the application callback with a
    912 **                  start confirm.
    913 **
    914 ** Returns          Nothing.
    915 **
    916 *******************************************************************************/
    917 void avdt_scb_hdl_start_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    918 {
    919     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    920                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    921                               AVDT_START_CFM_EVT,
    922                               (tAVDT_CTRL *) &p_data->msg.hdr);
    923 }
    924 
    925 /*******************************************************************************
    926 **
    927 ** Function         avdt_scb_hdl_suspend_cmd
    928 **
    929 ** Description      This function calls the application callback with a suspend
    930 **                  indication.
    931 **
    932 ** Returns          Nothing.
    933 **
    934 *******************************************************************************/
    935 void avdt_scb_hdl_suspend_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    936 {
    937     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    938                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    939                               AVDT_SUSPEND_IND_EVT,
    940                               NULL);
    941 }
    942 
    943 /*******************************************************************************
    944 **
    945 ** Function         avdt_scb_hdl_suspend_rsp
    946 **
    947 ** Description      This function calls the application callback with a suspend
    948 **                  confirm.
    949 **
    950 ** Returns          Nothing.
    951 **
    952 *******************************************************************************/
    953 void avdt_scb_hdl_suspend_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    954 {
    955     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    956                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    957                               AVDT_SUSPEND_CFM_EVT,
    958                               (tAVDT_CTRL *) &p_data->msg.hdr);
    959 }
    960 
    961 /*******************************************************************************
    962 **
    963 ** Function         avdt_scb_hdl_tc_close
    964 **
    965 ** Description      This function is called when the transport channel is
    966 **                  closed.  It marks the SCB as not in use and
    967 **                  initializes certain SCB parameters.  It then sends
    968 **                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
    969 **                  initiated the close.  It then checks to see if the SCB
    970 **                  is to be removed.  If it is it deallocates the SCB.  Finally,
    971 **                  it calls the application callback with a close indication.
    972 **
    973 ** Returns          Nothing.
    974 **
    975 *******************************************************************************/
    976 void avdt_scb_hdl_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    977 {
    978     UINT8               hdl = avdt_scb_to_hdl(p_scb);
    979     tAVDT_CTRL_CBACK    *p_ctrl_cback = p_scb->cs.p_ctrl_cback;
    980     tAVDT_CTRL          avdt_ctrl;
    981     UINT8               event;
    982     tAVDT_CCB           *p_ccb = p_scb->p_ccb;
    983     BD_ADDR remote_addr;
    984 
    985 
    986     memcpy (remote_addr, p_ccb->peer_addr, BD_ADDR_LEN);
    987 
    988     /* set up hdr */
    989     avdt_ctrl.hdr.err_code = p_scb->close_code;
    990 
    991     /* clear sep variables */
    992     avdt_scb_clr_vars(p_scb, p_data);
    993     p_scb->media_seq = 0;
    994     p_scb->cong = FALSE;
    995 
    996     /* free pkt we're holding, if any */
    997     if (p_scb->p_pkt != NULL)
    998     {
    999         GKI_freebuf(p_scb->p_pkt);
   1000         p_scb->p_pkt = NULL;
   1001     }
   1002 
   1003     /* stop transport channel timer */
   1004     btu_stop_timer(&p_scb->timer_entry);
   1005 
   1006     if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT))
   1007     {
   1008         /* tell ccb we're done with signaling channel */
   1009         avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
   1010     }
   1011     event = (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
   1012     p_scb->role = AVDT_CLOSE_ACP;
   1013 
   1014     if (p_scb->remove)
   1015     {
   1016         avdt_scb_dealloc(p_scb, NULL);
   1017     }
   1018 
   1019     /* call app callback */
   1020     (*p_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl);
   1021 }
   1022 
   1023 /*******************************************************************************
   1024 **
   1025 ** Function         avdt_scb_snd_delay_rpt_req
   1026 **
   1027 ** Description      This function calls the application callback with a delay
   1028 **                  report.
   1029 **
   1030 ** Returns          Nothing.
   1031 **
   1032 *******************************************************************************/
   1033 void avdt_scb_snd_delay_rpt_req (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1034 {
   1035     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT, (tAVDT_MSG *) &p_data->apidelay);
   1036 }
   1037 
   1038 /*******************************************************************************
   1039 **
   1040 ** Function         avdt_scb_hdl_delay_rpt_cmd
   1041 **
   1042 ** Description      This function calls the application callback with a delay
   1043 **                  report.
   1044 **
   1045 ** Returns          Nothing.
   1046 **
   1047 *******************************************************************************/
   1048 void avdt_scb_hdl_delay_rpt_cmd (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1049 {
   1050     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1051                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1052                               AVDT_DELAY_REPORT_EVT,
   1053                               (tAVDT_CTRL *) &p_data->msg.hdr);
   1054 
   1055     if (p_scb->p_ccb)
   1056         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
   1057     else
   1058         avdt_scb_rej_not_in_use(p_scb, p_data);
   1059 }
   1060 
   1061 /*******************************************************************************
   1062 **
   1063 ** Function         avdt_scb_hdl_delay_rpt_rsp
   1064 **
   1065 ** Description      This function calls the application callback with a delay
   1066 **                  report.
   1067 **
   1068 ** Returns          Nothing.
   1069 **
   1070 *******************************************************************************/
   1071 void avdt_scb_hdl_delay_rpt_rsp (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1072 {
   1073     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1074                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1075                               AVDT_DELAY_REPORT_CFM_EVT,
   1076                               (tAVDT_CTRL *) &p_data->msg.hdr);
   1077 }
   1078 
   1079 #if AVDT_REPORTING == TRUE
   1080 /*******************************************************************************
   1081 **
   1082 ** Function         avdt_scb_hdl_tc_close_sto
   1083 **
   1084 ** Description      This function is called when a channel is closed in OPEN
   1085 **                  state.  Check the channel type and process accordingly.
   1086 **
   1087 ** Returns          Nothing.
   1088 **
   1089 *******************************************************************************/
   1090 void avdt_scb_hdl_tc_close_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1091 {
   1092     tAVDT_CTRL          avdt_ctrl;
   1093     /* AVDT_CHAN_SIG does not visit this action */
   1094     if(p_data && p_data->close.type != AVDT_CHAN_MEDIA)
   1095     {
   1096         /* it's reporting or recovery channel,
   1097          * the channel close in open state means the peer does not support it */
   1098         if(p_data->close.old_tc_state == AVDT_AD_ST_OPEN)
   1099         {
   1100             avdt_ctrl.hdr.err_code = 0;
   1101             avdt_ctrl.hdr.err_param = 0;
   1102             /* call app callback */
   1103             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1104                                       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1105                                       AVDT_REPORT_DISCONN_EVT, &avdt_ctrl);
   1106         }
   1107     }
   1108     else
   1109     {
   1110         /* must be in OPEN state. need to go back to idle */
   1111         avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
   1112         avdt_scb_hdl_tc_close(p_scb, p_data);
   1113     }
   1114 }
   1115 #endif
   1116 
   1117 /*******************************************************************************
   1118 **
   1119 ** Function         avdt_scb_hdl_tc_open
   1120 **
   1121 ** Description      This function is called when the transport channel is
   1122 **                  opened while in the opening state.  It calls the
   1123 **                  application callback with an open indication or open
   1124 **                  confirm depending on who initiated the open procedure.
   1125 **
   1126 ** Returns          Nothing.
   1127 **
   1128 *******************************************************************************/
   1129 void avdt_scb_hdl_tc_open(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1130 {
   1131     UINT8   event;
   1132 #if AVDT_REPORTING == TRUE
   1133     UINT8   role;
   1134 #endif
   1135 
   1136     /* stop transport channel connect timer */
   1137     btu_stop_timer(&p_scb->timer_entry);
   1138 
   1139     event = (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
   1140     p_data->open.hdr.err_code = 0;
   1141 
   1142     AVDT_TRACE_DEBUG3("psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x",
   1143         p_scb->cs.cfg.psc_mask, p_scb->req_cfg.psc_mask, p_scb->curr_cfg.psc_mask);
   1144 #if AVDT_REPORTING == TRUE
   1145     if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
   1146     {
   1147         /* open the reporting channel, if both devices support it */
   1148         role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
   1149         avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
   1150     }
   1151 #endif
   1152 
   1153     /* call app callback */
   1154     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1155                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1156                               event,
   1157                               (tAVDT_CTRL *) &p_data->open);
   1158 }
   1159 
   1160 #if AVDT_REPORTING == TRUE
   1161 /*******************************************************************************
   1162 **
   1163 ** Function         avdt_scb_hdl_tc_open_sto
   1164 **
   1165 ** Description      This function is called when the transport channel is
   1166 **                  opened while in the opening state.  It calls the
   1167 **                  application callback with an open indication or open
   1168 **                  confirm depending on who initiated the open procedure.
   1169 **
   1170 ** Returns          Nothing.
   1171 **
   1172 *******************************************************************************/
   1173 void avdt_scb_hdl_tc_open_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1174 {
   1175     tAVDT_CTRL          avdt_ctrl;
   1176     /* open reporting channel here, when it is implemented */
   1177 
   1178     /* call app callback */
   1179     if(p_data->open.hdr.err_code == AVDT_CHAN_REPORT)
   1180     {
   1181         avdt_ctrl.hdr.err_code = 0;
   1182         avdt_ctrl.hdr.err_param = 1;
   1183         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1184                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1185                               AVDT_REPORT_CONN_EVT, &avdt_ctrl);
   1186     }
   1187 }
   1188 #endif
   1189 
   1190 /*******************************************************************************
   1191 **
   1192 ** Function         avdt_scb_hdl_write_req_no_frag
   1193 **
   1194 ** Description      This function frees the media packet currently stored in
   1195 **                  the SCB, if any.  Then it builds a new media packet from
   1196 **                  with the passed in buffer and stores it in the SCB.
   1197 **
   1198 ** Returns          Nothing.
   1199 **
   1200 *******************************************************************************/
   1201 void avdt_scb_hdl_write_req_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1202 {
   1203     UINT8   *p;
   1204     UINT32  ssrc;
   1205 
   1206     /* free packet we're holding, if any; to be replaced with new */
   1207     if (p_scb->p_pkt != NULL)
   1208     {
   1209         GKI_freebuf(p_scb->p_pkt);
   1210 
   1211         /* this shouldn't be happening */
   1212         AVDT_TRACE_WARNING0("Dropped media packet; congested");
   1213     }
   1214 
   1215     /* build a media packet */
   1216     /* Add RTP header if required */
   1217     if ( !(p_data->apiwrite.opt & AVDT_DATA_OPT_NO_RTP) )
   1218     {
   1219         ssrc = avdt_scb_gen_ssrc(p_scb);
   1220 
   1221         p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
   1222         p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
   1223 
   1224         p = (UINT8 *)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
   1225 
   1226         UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
   1227         UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
   1228         UINT16_TO_BE_STREAM(p, p_scb->media_seq);
   1229         UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
   1230         UINT32_TO_BE_STREAM(p, ssrc);
   1231     }
   1232 
   1233     p_scb->media_seq++;
   1234 
   1235     /* store it */
   1236     p_scb->p_pkt = p_data->apiwrite.p_buf;
   1237 }
   1238 
   1239 #if AVDT_MULTIPLEXING == TRUE
   1240 /*******************************************************************************
   1241 **
   1242 ** Function         avdt_scb_hdl_write_req_frag
   1243 **
   1244 ** Description      This function builds a new fragments of media packet from
   1245 **                  the passed in buffers and stores them in the SCB.
   1246 **
   1247 ** Returns          Nothing.
   1248 **
   1249 *******************************************************************************/
   1250 void avdt_scb_hdl_write_req_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1251 {
   1252     UINT8   *p;
   1253     UINT32  ssrc;
   1254     BT_HDR  *p_frag;
   1255 
   1256     /* free fragments we're holding, if any; it shouldn't happen */
   1257     if (!GKI_queue_is_empty(&p_scb->frag_q))
   1258     {
   1259         while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1260             GKI_freebuf(p_frag);
   1261 
   1262         /* this shouldn't be happening */
   1263         AVDT_TRACE_WARNING0("*** Dropped media packet; congested");
   1264     }
   1265 
   1266     /* build a media fragments */
   1267     p_scb->frag_off = p_data->apiwrite.data_len;
   1268     p_scb->p_next_frag = p_data->apiwrite.p_data;
   1269 
   1270     ssrc = avdt_scb_gen_ssrc(p_scb);
   1271 
   1272     /* get first packet */
   1273     p_frag = (BT_HDR*)GKI_getfirst (&p_data->apiwrite.frag_q);
   1274     /* posit on Adaptation Layer header */
   1275     p_frag->len += AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
   1276     p_frag->offset -= AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
   1277     p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   1278 
   1279     /* Adaptation Layer header */
   1280     /* TSID, no-fragment bit and coding of length(in 2 length octets following) */
   1281     *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | AVDT_ALH_LCODE_16BIT;
   1282 
   1283     /* length of all remaining transport packet */
   1284     UINT16_TO_BE_STREAM(p, p_frag->layer_specific+AVDT_MEDIA_HDR_SIZE );
   1285     /* media header */
   1286     UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
   1287     UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
   1288     UINT16_TO_BE_STREAM(p, p_scb->media_seq);
   1289     UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
   1290     UINT32_TO_BE_STREAM(p, ssrc);
   1291     p_scb->media_seq++;
   1292 
   1293     while((p_frag = (BT_HDR*)GKI_getnext (p_frag)) != NULL)
   1294     {
   1295         /* posit on Adaptation Layer header */
   1296         p_frag->len += AVDT_AL_HDR_SIZE;
   1297         p_frag->offset -= AVDT_AL_HDR_SIZE;
   1298         p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   1299         /* Adaptation Layer header */
   1300         /* TSID, fragment bit and coding of length(in 2 length octets following) */
   1301         *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
   1302 
   1303         /* length of all remaining transport packet */
   1304         UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
   1305     }
   1306 
   1307     /* store it */
   1308     p_scb->frag_q = p_data->apiwrite.frag_q;
   1309 }
   1310 #endif
   1311 
   1312 
   1313 /*******************************************************************************
   1314 **
   1315 ** Function         avdt_scb_hdl_write_req
   1316 **
   1317 ** Description      This function calls one of the two versions of building functions
   1318 **                  for case with and without fragmentation
   1319 **
   1320 ** Returns          Nothing.
   1321 **
   1322 *******************************************************************************/
   1323 void avdt_scb_hdl_write_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1324 {
   1325 #if AVDT_MULTIPLEXING == TRUE
   1326     if (GKI_queue_is_empty(&p_data->apiwrite.frag_q))
   1327 #endif
   1328         avdt_scb_hdl_write_req_no_frag(p_scb, p_data);
   1329 #if AVDT_MULTIPLEXING == TRUE
   1330     else
   1331         avdt_scb_hdl_write_req_frag(p_scb, p_data);
   1332 #endif
   1333 }
   1334 
   1335 /*******************************************************************************
   1336 **
   1337 ** Function         avdt_scb_snd_abort_req
   1338 **
   1339 ** Description      This function sends an abort command message.
   1340 **
   1341 ** Returns          Nothing.
   1342 **
   1343 *******************************************************************************/
   1344 void avdt_scb_snd_abort_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1345 {
   1346     tAVDT_EVT_HDR   hdr;
   1347 
   1348     if (p_scb->p_ccb != NULL)
   1349     {
   1350         p_scb->role = AVDT_CLOSE_INT;
   1351 
   1352         hdr.seid = p_scb->peer_seid;
   1353 
   1354         avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, (tAVDT_MSG *) &hdr);
   1355     }
   1356 }
   1357 
   1358 /*******************************************************************************
   1359 **
   1360 ** Function         avdt_scb_snd_abort_rsp
   1361 **
   1362 ** Description      This function sends an abort response message.
   1363 **
   1364 ** Returns          Nothing.
   1365 **
   1366 *******************************************************************************/
   1367 void avdt_scb_snd_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1368 {
   1369     avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
   1370                       &p_data->msg);
   1371 }
   1372 
   1373 /*******************************************************************************
   1374 **
   1375 ** Function         avdt_scb_snd_close_req
   1376 **
   1377 ** Description      This function sends a close command message.
   1378 **
   1379 ** Returns          Nothing.
   1380 **
   1381 *******************************************************************************/
   1382 void avdt_scb_snd_close_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1383 {
   1384     tAVDT_EVT_HDR   hdr;
   1385 
   1386     p_scb->role = AVDT_CLOSE_INT;
   1387 
   1388     hdr.seid = p_scb->peer_seid;
   1389 
   1390     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, (tAVDT_MSG *) &hdr);
   1391 }
   1392 
   1393 /*******************************************************************************
   1394 **
   1395 ** Function         avdt_scb_snd_stream_close
   1396 **
   1397 ** Description      This function sends a close command message.
   1398 **
   1399 ** Returns          Nothing.
   1400 **
   1401 *******************************************************************************/
   1402 void avdt_scb_snd_stream_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1403 {
   1404 #if AVDT_MULTIPLEXING == TRUE
   1405     BT_HDR          *p_frag;
   1406 
   1407     AVDT_TRACE_WARNING2("avdt_scb_snd_stream_close c:%d, off:%d",
   1408         p_scb->frag_q.count, p_scb->frag_off);
   1409     /* clean fragments queue */
   1410     while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1411          GKI_freebuf(p_frag);
   1412     p_scb->frag_off = 0;
   1413 #endif
   1414     if (p_scb->p_pkt)
   1415     {
   1416         GKI_freebuf(p_scb->p_pkt);
   1417         p_scb->p_pkt = NULL;
   1418     }
   1419 
   1420 #if 0
   1421     if(p_scb->cong)
   1422         p_scb->cong = FALSE;
   1423 
   1424     /* p_scb->curr_cfg.mux_tsid_media == 0 */
   1425 #endif
   1426     avdt_scb_snd_close_req(p_scb, p_data);
   1427 }
   1428 
   1429 /*******************************************************************************
   1430 **
   1431 ** Function         avdt_scb_snd_close_rsp
   1432 **
   1433 ** Description      This function sends a close response message.
   1434 **
   1435 ** Returns          Nothing.
   1436 **
   1437 *******************************************************************************/
   1438 void avdt_scb_snd_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1439 {
   1440     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
   1441 }
   1442 
   1443 /*******************************************************************************
   1444 **
   1445 ** Function         avdt_scb_snd_getconfig_req
   1446 **
   1447 ** Description      This function sends a get configuration command message.
   1448 **
   1449 ** Returns          Nothing.
   1450 **
   1451 *******************************************************************************/
   1452 void avdt_scb_snd_getconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1453 {
   1454     tAVDT_EVT_HDR   hdr;
   1455 
   1456     hdr.seid = p_scb->peer_seid;
   1457 
   1458     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, (tAVDT_MSG *) &hdr);
   1459 }
   1460 
   1461 /*******************************************************************************
   1462 **
   1463 ** Function         avdt_scb_snd_getconfig_rsp
   1464 **
   1465 ** Description      This function sends a get configuration response message.
   1466 **
   1467 ** Returns          Nothing.
   1468 **
   1469 *******************************************************************************/
   1470 void avdt_scb_snd_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1471 {
   1472     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
   1473 }
   1474 
   1475 /*******************************************************************************
   1476 **
   1477 ** Function         avdt_scb_snd_open_req
   1478 **
   1479 ** Description      This function sends an open command message.
   1480 **
   1481 ** Returns          Nothing.
   1482 **
   1483 *******************************************************************************/
   1484 void avdt_scb_snd_open_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1485 {
   1486     tAVDT_EVT_HDR   hdr;
   1487 
   1488     hdr.seid = p_scb->peer_seid;
   1489 
   1490     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, (tAVDT_MSG *) &hdr);
   1491 }
   1492 
   1493 /*******************************************************************************
   1494 **
   1495 ** Function         avdt_scb_snd_open_rsp
   1496 **
   1497 ** Description      This function sends an open response message.  It also
   1498 **                  calls avdt_ad_open_req() to accept a transport channel
   1499 **                  connection.
   1500 **
   1501 ** Returns          Nothing.
   1502 **
   1503 *******************************************************************************/
   1504 void avdt_scb_snd_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1505 {
   1506     /* notify adaption that we're waiting for transport channel open */
   1507     p_scb->role = AVDT_OPEN_ACP;
   1508     avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
   1509 
   1510     /* send response */
   1511     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
   1512 
   1513     /* start tc connect timer */
   1514     btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
   1515 }
   1516 
   1517 /*******************************************************************************
   1518 **
   1519 ** Function         avdt_scb_snd_reconfig_req
   1520 **
   1521 ** Description      This function stores the configuration parameters in the
   1522 **                  SCB and sends a reconfiguration command message.
   1523 **
   1524 ** Returns          Nothing.
   1525 **
   1526 *******************************************************************************/
   1527 void avdt_scb_snd_reconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1528 {
   1529     memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
   1530     p_data->msg.hdr.seid = p_scb->peer_seid;
   1531     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
   1532 }
   1533 
   1534 /*******************************************************************************
   1535 **
   1536 ** Function         avdt_scb_snd_reconfig_rsp
   1537 **
   1538 ** Description      This function stores the configuration parameters in the
   1539 **                  SCB and sends a reconfiguration response message.
   1540 **
   1541 ** Returns          Nothing.
   1542 **
   1543 *******************************************************************************/
   1544 void avdt_scb_snd_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1545 {
   1546     if (p_data->msg.hdr.err_code == 0)
   1547     {
   1548         /* store new configuration */
   1549         if (p_scb->req_cfg.num_codec > 0)
   1550         {
   1551             p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
   1552             memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
   1553         }
   1554         if (p_scb->req_cfg.num_protect > 0)
   1555         {
   1556             p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
   1557             memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
   1558         }
   1559 
   1560         /* send response */
   1561         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
   1562     }
   1563     else
   1564     {
   1565         /* send reject */
   1566         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
   1567     }
   1568 }
   1569 
   1570 /*******************************************************************************
   1571 **
   1572 ** Function         avdt_scb_snd_security_req
   1573 **
   1574 ** Description      This function sends a security command message.
   1575 **
   1576 ** Returns          Nothing.
   1577 **
   1578 *******************************************************************************/
   1579 void avdt_scb_snd_security_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1580 {
   1581     p_data->msg.hdr.seid = p_scb->peer_seid;
   1582     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
   1583 }
   1584 
   1585 /*******************************************************************************
   1586 **
   1587 ** Function         avdt_scb_snd_security_rsp
   1588 **
   1589 ** Description      This function sends a security response message.
   1590 **
   1591 ** Returns          Nothing.
   1592 **
   1593 *******************************************************************************/
   1594 void avdt_scb_snd_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1595 {
   1596     if (p_data->msg.hdr.err_code == 0)
   1597     {
   1598         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
   1599     }
   1600     else
   1601     {
   1602         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
   1603     }
   1604 }
   1605 
   1606 /*******************************************************************************
   1607 **
   1608 ** Function         avdt_scb_snd_setconfig_rej
   1609 **
   1610 ** Description      This function marks the SCB as not in use and sends a
   1611 **                  set configuration reject message.
   1612 **
   1613 ** Returns          Nothing.
   1614 **
   1615 *******************************************************************************/
   1616 void avdt_scb_snd_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1617 {
   1618     if (p_scb->p_ccb != NULL)
   1619     {
   1620         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1621 
   1622         /* clear scb variables */
   1623         avdt_scb_clr_vars(p_scb, p_data);
   1624     }
   1625 }
   1626 
   1627 /*******************************************************************************
   1628 **
   1629 ** Function         avdt_scb_snd_setconfig_req
   1630 **
   1631 ** Description      This function marks the SCB as in use and copies the
   1632 **                  configuration parameters to the SCB.  Then the function
   1633 **                  sends a set configuration command message and initiates
   1634 **                  opening of the signaling channel.
   1635 **
   1636 ** Returns          Nothing.
   1637 **
   1638 *******************************************************************************/
   1639 void avdt_scb_snd_setconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1640 {
   1641     tAVDT_CFG *p_req, *p_cfg;
   1642 
   1643     /* copy API parameters to scb, set scb as in use */
   1644     p_scb->in_use = TRUE;
   1645     p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
   1646     p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
   1647     p_req = p_data->msg.config_cmd.p_cfg;
   1648     p_cfg = &p_scb->cs.cfg;
   1649 #if AVDT_MULTIPLEXING == TRUE
   1650     p_req->mux_tsid_media = p_cfg->mux_tsid_media;
   1651     p_req->mux_tcid_media = p_cfg->mux_tcid_media;
   1652     if(p_req->psc_mask & AVDT_PSC_REPORT)
   1653     {
   1654         p_req->mux_tsid_report = p_cfg->mux_tsid_report;
   1655         p_req->mux_tcid_report = p_cfg->mux_tcid_report;
   1656     }
   1657 #endif
   1658     memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
   1659 
   1660     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1661 
   1662     /* tell ccb to open channel */
   1663     avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
   1664 }
   1665 
   1666 /*******************************************************************************
   1667 **
   1668 ** Function         avdt_scb_snd_setconfig_rsp
   1669 **
   1670 ** Description      This function copies the requested configuration into the
   1671 **                  current configuration and sends a set configuration
   1672 **                  response message.
   1673 **
   1674 ** Returns          Nothing.
   1675 **
   1676 *******************************************************************************/
   1677 void avdt_scb_snd_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1678 {
   1679     if (p_scb->p_ccb != NULL)
   1680     {
   1681         memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
   1682 
   1683         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1684     }
   1685 }
   1686 
   1687 /*******************************************************************************
   1688 **
   1689 ** Function         avdt_scb_snd_tc_close
   1690 **
   1691 ** Description      This function calls avdt_ad_close_req() to close the
   1692 **                  transport channel for this SCB.
   1693 **
   1694 ** Returns          Nothing.
   1695 **
   1696 *******************************************************************************/
   1697 void avdt_scb_snd_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1698 {
   1699 #if AVDT_REPORTING == TRUE
   1700     if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
   1701         avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
   1702 #endif
   1703     avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
   1704 }
   1705 
   1706 /*******************************************************************************
   1707 **
   1708 ** Function         avdt_scb_cb_err
   1709 **
   1710 ** Description      This function calls the application callback function
   1711 **                  indicating an error.
   1712 **
   1713 ** Returns          Nothing.
   1714 **
   1715 *******************************************************************************/
   1716 void avdt_scb_cb_err(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1717 {
   1718     tAVDT_CTRL          avdt_ctrl;
   1719 
   1720     /* set error code and parameter */
   1721     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1722     avdt_ctrl.hdr.err_param = 0;
   1723 
   1724     /* call callback, using lookup table to get callback event */
   1725     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1726                               NULL,
   1727                               avdt_scb_cback_evt[p_scb->curr_evt],
   1728                               &avdt_ctrl);
   1729 }
   1730 
   1731 /*******************************************************************************
   1732 **
   1733 ** Function         avdt_scb_cong_state
   1734 **
   1735 ** Description      This function sets the congestion state of the SCB media
   1736 **                  transport channel.
   1737 **
   1738 ** Returns          Nothing.
   1739 **
   1740 *******************************************************************************/
   1741 void avdt_scb_cong_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1742 {
   1743     p_scb->cong = p_data->llcong;
   1744 }
   1745 
   1746 /*******************************************************************************
   1747 **
   1748 ** Function         avdt_scb_rej_state
   1749 **
   1750 ** Description      This function sends a reject message to the peer indicating
   1751 **                  incorrect state for the received command message.
   1752 **
   1753 ** Returns          Nothing.
   1754 **
   1755 *******************************************************************************/
   1756 void avdt_scb_rej_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1757 {
   1758     p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
   1759     p_data->msg.hdr.err_param = 0;
   1760     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1761                       p_data->msg.hdr.sig_id, &p_data->msg);
   1762 }
   1763 
   1764 /*******************************************************************************
   1765 **
   1766 ** Function         avdt_scb_rej_in_use
   1767 **
   1768 ** Description      This function sends a reject message to the peer indicating
   1769 **                  the stream is in use.
   1770 **
   1771 ** Returns          Nothing.
   1772 **
   1773 *******************************************************************************/
   1774 void avdt_scb_rej_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1775 {
   1776     p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
   1777     p_data->msg.hdr.err_param = 0;
   1778     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1779                       p_data->msg.hdr.sig_id, &p_data->msg);
   1780 }
   1781 
   1782 /*******************************************************************************
   1783 **
   1784 ** Function         avdt_scb_rej_not_in_use
   1785 **
   1786 ** Description      This function sends a reject message to the peer indicating
   1787 **                  the stream is in use.
   1788 **
   1789 ** Returns          Nothing.
   1790 **
   1791 *******************************************************************************/
   1792 void avdt_scb_rej_not_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1793 {
   1794     p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
   1795     p_data->msg.hdr.err_param = 0;
   1796     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1797                       p_data->msg.hdr.sig_id, &p_data->msg);
   1798 }
   1799 
   1800 /*******************************************************************************
   1801 **
   1802 ** Function         avdt_scb_set_remove
   1803 **
   1804 ** Description      This function marks an SCB to be removed.
   1805 **
   1806 ** Returns          Nothing.
   1807 **
   1808 *******************************************************************************/
   1809 void avdt_scb_set_remove(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1810 {
   1811     p_scb->remove = TRUE;
   1812 }
   1813 
   1814 /*******************************************************************************
   1815 **
   1816 ** Function         avdt_scb_free_pkt
   1817 **
   1818 ** Description      This function frees the media packet passed in.
   1819 **
   1820 ** Returns          Nothing.
   1821 **
   1822 *******************************************************************************/
   1823 void avdt_scb_free_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1824 {
   1825     tAVDT_CTRL      avdt_ctrl;
   1826 #if AVDT_MULTIPLEXING == TRUE
   1827     BT_HDR          *p_frag;
   1828 #endif
   1829 
   1830     /* set error code and parameter */
   1831     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1832     avdt_ctrl.hdr.err_param = 0;
   1833 
   1834     /* p_buf can be NULL in case using of fragments queue frag_q */
   1835     if(p_data->apiwrite.p_buf)
   1836         GKI_freebuf(p_data->apiwrite.p_buf);
   1837 
   1838 #if AVDT_MULTIPLEXING == TRUE
   1839     /* clean fragments queue */
   1840     while((p_frag = (BT_HDR*)GKI_dequeue (&p_data->apiwrite.frag_q)) != NULL)
   1841          GKI_freebuf(p_frag);
   1842 #endif
   1843 
   1844     AVDT_TRACE_WARNING0("Dropped media packet");
   1845 
   1846     /* we need to call callback to keep data flow going */
   1847     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1848                               &avdt_ctrl);
   1849 }
   1850 
   1851 /*******************************************************************************
   1852 **
   1853 ** Function         avdt_scb_clr_pkt
   1854 **
   1855 ** Description      This function frees the media packet stored in the SCB.
   1856 **
   1857 ** Returns          Nothing.
   1858 **
   1859 *******************************************************************************/
   1860 void avdt_scb_clr_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1861 {
   1862     tAVDT_CTRL      avdt_ctrl;
   1863     tAVDT_CCB       *p_ccb;
   1864     UINT8           tcid;
   1865     UINT16          lcid;
   1866 #if AVDT_MULTIPLEXING == TRUE
   1867     BT_HDR          *p_frag;
   1868 #endif
   1869 
   1870     /* set error code and parameter */
   1871     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1872     avdt_ctrl.hdr.err_param = 0;
   1873     /* flush the media data queued at L2CAP */
   1874     if((p_ccb = p_scb->p_ccb) != NULL)
   1875     {
   1876         /* get tcid from type, scb */
   1877         tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
   1878 
   1879         lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
   1880         L2CA_FlushChannel (lcid, L2CAP_FLUSH_CHANS_ALL);
   1881     }
   1882 
   1883     if (p_scb->p_pkt != NULL)
   1884     {
   1885         GKI_freebuf(p_scb->p_pkt);
   1886         p_scb->p_pkt = NULL;
   1887 
   1888         AVDT_TRACE_DEBUG0("Dropped stored media packet");
   1889 
   1890         /* we need to call callback to keep data flow going */
   1891         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1892                                   &avdt_ctrl);
   1893     }
   1894 #if AVDT_MULTIPLEXING == TRUE
   1895     else if(!GKI_queue_is_empty (&p_scb->frag_q))
   1896     {
   1897         AVDT_TRACE_DEBUG0("Dropped fragments queue");
   1898         /* clean fragments queue */
   1899         while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1900              GKI_freebuf(p_frag);
   1901 
   1902         p_scb->frag_off = 0;
   1903 
   1904         /* we need to call callback to keep data flow going */
   1905         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1906                                   &avdt_ctrl);
   1907     }
   1908 #endif
   1909 }
   1910 
   1911 
   1912 /*******************************************************************************
   1913 **
   1914 ** Function         avdt_scb_chk_snd_pkt
   1915 **
   1916 ** Description      This function checks if the SCB is congested, and if not
   1917 **                  congested it sends a stored media packet, if any.  After it
   1918 **                  sends the packet it calls the application callback function
   1919 **                  with a write confirm.
   1920 **
   1921 ** Returns          Nothing.
   1922 **
   1923 *******************************************************************************/
   1924 void avdt_scb_chk_snd_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1925 {
   1926     tAVDT_CTRL      avdt_ctrl;
   1927     BT_HDR          *p_pkt;
   1928 #if AVDT_MULTIPLEXING == TRUE
   1929     BOOLEAN         sent = FALSE;
   1930     UINT8   res = AVDT_AD_SUCCESS;
   1931     tAVDT_SCB_EVT data;
   1932 #endif
   1933 
   1934     avdt_ctrl.hdr.err_code = 0;
   1935 
   1936     if (!p_scb->cong)
   1937     {
   1938         if (p_scb->p_pkt != NULL)
   1939         {
   1940             p_pkt = p_scb->p_pkt;
   1941             p_scb->p_pkt = NULL;
   1942             avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
   1943 
   1944             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
   1945         }
   1946 #if AVDT_MULTIPLEXING == TRUE
   1947         else
   1948         {
   1949 #if 0
   1950             AVDT_TRACE_DEBUG1("num_q=%d",
   1951                 L2CA_FlushChannel(avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb)].lcid),
   1952                                   L2CAP_FLUSH_CHANS_GET);
   1953 #endif
   1954             while((p_pkt = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1955             {
   1956                 sent = TRUE;
   1957                 AVDT_TRACE_DEBUG1("Send fragment len=%d",p_pkt->len);
   1958                 /* fragments queue contains fragment to send */
   1959                 res = avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
   1960                 if(AVDT_AD_CONGESTED == res)
   1961                 {
   1962                     p_scb->cong = TRUE;
   1963                     AVDT_TRACE_DEBUG0("avdt/l2c congested!!");
   1964                     break;/* exit loop if channel became congested */
   1965             }
   1966             }
   1967             AVDT_TRACE_DEBUG2("res=%d left=%d",res, p_scb->frag_off);
   1968 
   1969             if(p_scb->frag_off)
   1970             {
   1971                 if(AVDT_AD_SUCCESS == res || GKI_queue_is_empty (&p_scb->frag_q))
   1972                 {
   1973                     /* all buffers were sent to L2CAP, compose more to queue */
   1974                     avdt_scb_queue_frags(p_scb, &p_scb->p_next_frag, &p_scb->frag_off, &p_scb->frag_q);
   1975                     if(!GKI_queue_is_empty (&p_scb->frag_q))
   1976                     {
   1977                         data.llcong = p_scb->cong;
   1978                         avdt_scb_event(p_scb, AVDT_SCB_TC_CONG_EVT, &data);
   1979                     }
   1980                 }
   1981             }
   1982 
   1983             /* Send event AVDT_WRITE_CFM_EVT if it was last fragment */
   1984             else if (sent && GKI_queue_is_empty (&p_scb->frag_q))
   1985             {
   1986                 (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
   1987             }
   1988         }
   1989 #endif
   1990     }
   1991 }
   1992 
   1993 /*******************************************************************************
   1994 **
   1995 ** Function         avdt_scb_tc_timer
   1996 **
   1997 ** Description      This function is called to start a timer when the peer
   1998 **                  initiates closing of the stream.  The timer verifies that
   1999 **                  the peer disconnects the transport channel.
   2000 **
   2001 ** Returns          Nothing.
   2002 **
   2003 *******************************************************************************/
   2004 void avdt_scb_tc_timer(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   2005 {
   2006     btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_DISC_TOUT);
   2007 }
   2008 
   2009 /*******************************************************************************
   2010 **
   2011 ** Function         avdt_scb_clr_vars
   2012 **
   2013 ** Description      This function initializes certain SCB variables.
   2014 **
   2015 ** Returns          Nothing.
   2016 **
   2017 *******************************************************************************/
   2018 void avdt_scb_clr_vars(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   2019 {
   2020     p_scb->in_use = FALSE;
   2021     p_scb->p_ccb = NULL;
   2022     p_scb->peer_seid = 0;
   2023 }
   2024 
   2025 #if AVDT_MULTIPLEXING == TRUE
   2026 /*******************************************************************************
   2027 **
   2028 ** Function         avdt_scb_queue_frags
   2029 **
   2030 ** Description      This function breaks media payload into fragments
   2031 **                  and put the fragments in the given queue.
   2032 **
   2033 ** Returns          Nothing.
   2034 **
   2035 *******************************************************************************/
   2036 void avdt_scb_queue_frags(tAVDT_SCB *p_scb, UINT8 **pp_data, UINT32 *p_data_len, BUFFER_Q *pq)
   2037 {
   2038     UINT16  lcid;
   2039     UINT16  num_frag;
   2040     UINT16  mtu_used;
   2041     UINT8   *p;
   2042     BOOLEAN al_hdr = FALSE;
   2043     UINT8   tcid;
   2044     tAVDT_TC_TBL    *p_tbl;
   2045     UINT16          buf_size;
   2046     UINT16          offset = AVDT_MEDIA_OFFSET + AVDT_AL_HDR_SIZE;
   2047     UINT16          cont_offset = offset - AVDT_MEDIA_HDR_SIZE;
   2048     BT_HDR          *p_frag;
   2049 
   2050     tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
   2051     lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][tcid].lcid;
   2052 
   2053     if( p_scb->frag_off != 0)
   2054     {
   2055         /* continuing process is usually triggered by un-congest event.
   2056          * the number of buffers at L2CAP is very small (if not 0).
   2057          * we do not need to L2CA_FlushChannel() */
   2058         offset = cont_offset;
   2059         al_hdr = TRUE;
   2060         num_frag = AVDT_MAX_FRAG_COUNT;
   2061     }
   2062     else
   2063     {
   2064         num_frag = L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_GET);
   2065         AVDT_TRACE_DEBUG2("num_q=%d lcid=%d", num_frag, lcid);
   2066         if(num_frag >= AVDT_MAX_FRAG_COUNT)
   2067         {
   2068             num_frag = 0;
   2069         }
   2070         else
   2071         {
   2072             num_frag = AVDT_MAX_FRAG_COUNT - num_frag;
   2073         }
   2074     }
   2075 
   2076     /* look up transport channel table entry to get peer mtu */
   2077     p_tbl = avdt_ad_tc_tbl_by_type(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
   2078     buf_size = p_tbl->peer_mtu + BT_HDR_SIZE;
   2079     AVDT_TRACE_DEBUG3("peer_mtu: %d, buf_size: %d num_frag=%d",
   2080         p_tbl->peer_mtu, buf_size, num_frag);
   2081 
   2082     if(buf_size > AVDT_DATA_POOL_SIZE)
   2083         buf_size = AVDT_DATA_POOL_SIZE;
   2084 
   2085     mtu_used = buf_size - BT_HDR_SIZE;
   2086 
   2087     while(*p_data_len && num_frag)
   2088     {
   2089         /* allocate buffer for fragment */
   2090         if(NULL == (p_frag = (BT_HDR*)GKI_getbuf(buf_size)))
   2091         {
   2092             AVDT_TRACE_WARNING1("avdt_scb_queue_frags len=%d(out of GKI buffers)",*p_data_len);
   2093             break;
   2094         }
   2095         /* fill fragment by chunk of media payload */
   2096         p_frag->layer_specific = *p_data_len;/* length of all remaining transport packet */
   2097         p_frag->offset = offset;
   2098         /* adjust packet offset for continuing packets */
   2099         offset = cont_offset;
   2100 
   2101         p_frag->len = mtu_used - p_frag->offset;
   2102         if(p_frag->len > *p_data_len)
   2103             p_frag->len = *p_data_len;
   2104         memcpy((UINT8*)(p_frag+1) + p_frag->offset, *pp_data, p_frag->len);
   2105         *pp_data += p_frag->len;
   2106         *p_data_len -= p_frag->len;
   2107         AVDT_TRACE_DEBUG1("Prepared fragment len=%d", p_frag->len);
   2108 
   2109         if(al_hdr)
   2110         {
   2111             /* Adaptation Layer header */
   2112             p_frag->len += AVDT_AL_HDR_SIZE;
   2113             p_frag->offset -= AVDT_AL_HDR_SIZE;
   2114             p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   2115             /* TSID, fragment bit and coding of length(in 2 length octets following) */
   2116             *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
   2117 
   2118             /* length of all remaining transport packet */
   2119             UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
   2120         }
   2121         /* put fragment into gueue */
   2122         GKI_enqueue(pq, p_frag);
   2123         num_frag--;
   2124     }
   2125 }
   2126 #endif
   2127 
   2128