Home | History | Annotate | Download | only in av
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains action functions for advanced audio/video main state
     22  *  machine.
     23  *
     24  ******************************************************************************/
     25 
     26 #include "bt_target.h"
     27 #if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE)
     28 
     29 #include <string.h>
     30 #include "bta_av_api.h"
     31 #include "bta_av_int.h"
     32 #include "avdt_api.h"
     33 #include "bd.h"
     34 #include "utl.h"
     35 #include "l2c_api.h"
     36 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
     37 #include "bta_ar_api.h"
     38 #endif
     39 
     40 /*****************************************************************************
     41 **  Constants
     42 *****************************************************************************/
     43 /* the timer in milliseconds to wait for open req after setconfig for incoming connections */
     44 #ifndef BTA_AV_SIG_TIME_VAL
     45 #define BTA_AV_SIG_TIME_VAL 8000
     46 #endif
     47 
     48 /* In millisec to wait for signalling from SNK when it is initiated from SNK.   */
     49 /* If not, we will start signalling from SRC.                                   */
     50 #ifndef BTA_AV_ACP_SIG_TIME_VAL
     51 #define BTA_AV_ACP_SIG_TIME_VAL 2000
     52 #endif
     53 
     54 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle);
     55 
     56 /*******************************************************************************
     57 **
     58 ** Function         bta_av_get_rcb_by_shdl
     59 **
     60 ** Description      find the RCB associated with the given SCB handle.
     61 **
     62 ** Returns          tBTA_AV_RCB
     63 **
     64 *******************************************************************************/
     65 tBTA_AV_RCB * bta_av_get_rcb_by_shdl(UINT8 shdl)
     66 {
     67     tBTA_AV_RCB *p_rcb = NULL;
     68     int         i;
     69 
     70     for (i=0; i<BTA_AV_NUM_RCB; i++)
     71     {
     72         if (bta_av_cb.rcb[i].shdl == shdl && bta_av_cb.rcb[i].handle != BTA_AV_RC_HANDLE_NONE)
     73         {
     74             p_rcb = &bta_av_cb.rcb[i];
     75             break;
     76         }
     77     }
     78     return p_rcb;
     79 }
     80 #define BTA_AV_STS_NO_RSP       0xFF    /* a number not used by tAVRC_STS */
     81 
     82 /*******************************************************************************
     83 **
     84 ** Function         bta_av_del_rc
     85 **
     86 ** Description      delete the given AVRC handle.
     87 **
     88 ** Returns          void
     89 **
     90 *******************************************************************************/
     91 void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
     92 {
     93     tBTA_AV_SCB  *p_scb;
     94     UINT8        rc_handle;      /* connected AVRCP handle */
     95 
     96     if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
     97     {
     98         if(p_rcb->shdl)
     99         {
    100             p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
    101             if(p_scb)
    102             {
    103                 APPL_TRACE_DEBUG3("bta_av_del_rc shdl:%d, srch:%d rc_handle:%d", p_rcb->shdl,
    104                                   p_scb->rc_handle, p_rcb->handle);
    105                 if(p_scb->rc_handle == p_rcb->handle)
    106                     p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
    107                 /* just in case the RC timer is active
    108                 if(bta_av_cb.features & BTA_AV_FEAT_RCCT && p_scb->chnl == BTA_AV_CHNL_AUDIO) */
    109                     bta_sys_stop_timer(&p_scb->timer);
    110             }
    111         }
    112 
    113         APPL_TRACE_EVENT4("bta_av_del_rc  handle: %d status=0x%x, rc_acp_handle:%d, idx:%d",
    114             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, bta_av_cb.rc_acp_idx);
    115         rc_handle = p_rcb->handle;
    116         if(!(p_rcb->status & BTA_AV_RC_CONN_MASK) ||
    117             ((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT) )
    118         {
    119             p_rcb->status = 0;
    120             p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
    121             p_rcb->shdl = 0;
    122             p_rcb->lidx = 0;
    123         }
    124         /* else ACP && connected. do not clear the handle yet */
    125         AVRC_Close(rc_handle);
    126         if (rc_handle == bta_av_cb.rc_acp_handle)
    127             bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
    128         APPL_TRACE_EVENT4("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
    129             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
    130     }
    131 }
    132 
    133 
    134 /*******************************************************************************
    135 **
    136 ** Function         bta_av_close_all_rc
    137 **
    138 ** Description      close the all AVRC handle.
    139 **
    140 ** Returns          void
    141 **
    142 *******************************************************************************/
    143 static void bta_av_close_all_rc(tBTA_AV_CB *p_cb)
    144 {
    145     int i;
    146 
    147     for(i=0; i<BTA_AV_NUM_RCB; i++)
    148     {
    149         if ((p_cb->disabling == TRUE) || (bta_av_cb.rcb[i].shdl != 0))
    150             bta_av_del_rc(&bta_av_cb.rcb[i]);
    151     }
    152 }
    153 
    154 /*******************************************************************************
    155 **
    156 ** Function         bta_av_del_sdp_rec
    157 **
    158 ** Description      delete the given SDP record handle.
    159 **
    160 ** Returns          void
    161 **
    162 *******************************************************************************/
    163 static void bta_av_del_sdp_rec(UINT32 *p_sdp_handle)
    164 {
    165     if(*p_sdp_handle != 0)
    166     {
    167         SDP_DeleteRecord(*p_sdp_handle);
    168         *p_sdp_handle = 0;
    169     }
    170 }
    171 
    172 /*******************************************************************************
    173 **
    174 ** Function         bta_av_avrc_sdp_cback
    175 **
    176 ** Description      AVRCP service discovery callback.
    177 **
    178 ** Returns          void
    179 **
    180 *******************************************************************************/
    181 static void bta_av_avrc_sdp_cback(UINT16 status)
    182 {
    183     BT_HDR *p_msg;
    184 
    185     if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
    186     {
    187         p_msg->event = BTA_AV_SDP_AVRC_DISC_EVT;
    188         bta_sys_sendmsg(p_msg);
    189     }
    190 }
    191 
    192 /*******************************************************************************
    193 **
    194 ** Function         bta_av_rc_ctrl_cback
    195 **
    196 ** Description      AVRCP control callback.
    197 **
    198 ** Returns          void
    199 **
    200 *******************************************************************************/
    201 static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_ADDR peer_addr)
    202 {
    203     tBTA_AV_RC_CONN_CHG *p_msg;
    204     UINT16 msg_event = 0;
    205 
    206 #if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
    207     APPL_TRACE_EVENT2("rc_ctrl handle: %d event=0x%x", handle, event);
    208 #else
    209     APPL_TRACE_EVENT2("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
    210 #endif
    211     if (event == AVRC_OPEN_IND_EVT)
    212     {
    213         /* save handle of opened connection
    214         bta_av_cb.rc_handle = handle;*/
    215 
    216         msg_event = BTA_AV_AVRC_OPEN_EVT;
    217     }
    218     else if (event == AVRC_CLOSE_IND_EVT)
    219     {
    220         msg_event = BTA_AV_AVRC_CLOSE_EVT;
    221     }
    222 
    223     if (msg_event)
    224     {
    225         if ((p_msg = (tBTA_AV_RC_CONN_CHG *) GKI_getbuf(sizeof(tBTA_AV_RC_CONN_CHG))) != NULL)
    226         {
    227             p_msg->hdr.event = msg_event;
    228             p_msg->handle    = handle;
    229             if(peer_addr)
    230                 bdcpy(p_msg->peer_addr, peer_addr);
    231             bta_sys_sendmsg(p_msg);
    232         }
    233     }
    234 }
    235 
    236 /*******************************************************************************
    237 **
    238 ** Function         bta_av_rc_msg_cback
    239 **
    240 ** Description      AVRCP message callback.
    241 **
    242 ** Returns          void
    243 **
    244 *******************************************************************************/
    245 static void bta_av_rc_msg_cback(UINT8 handle, UINT8 label, UINT8 opcode, tAVRC_MSG *p_msg)
    246 {
    247     tBTA_AV_RC_MSG  *p_buf;
    248     UINT8           *p_data = NULL;
    249     UINT8           **p_p_data = NULL;
    250     UINT16          data_len = 0;
    251 
    252 #if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
    253     APPL_TRACE_ERROR2("rc_msg handle: %d opcode=0x%x", handle, opcode);
    254 #else
    255     APPL_TRACE_EVENT2("bta_av_rc_msg_cback handle: %d opcode=0x%x", handle, opcode);
    256 #endif
    257     /* determine size of buffer we need */
    258     if (opcode == AVRC_OP_VENDOR && p_msg->vendor.p_vendor_data != NULL)
    259     {
    260         p_data = p_msg->vendor.p_vendor_data;
    261         p_p_data = &p_msg->vendor.p_vendor_data;
    262         data_len = (UINT16) p_msg->vendor.vendor_len;
    263     }
    264     else if (opcode == AVRC_OP_PASS_THRU && p_msg->pass.p_pass_data != NULL)
    265     {
    266         p_data = p_msg->pass.p_pass_data;
    267         p_p_data = &p_msg->pass.p_pass_data;
    268         data_len = (UINT16) p_msg->pass.pass_len;
    269     }
    270 
    271     if ((p_buf = (tBTA_AV_RC_MSG *) GKI_getbuf((UINT16) (sizeof(tBTA_AV_RC_MSG) + data_len))) != NULL)
    272     {
    273         p_buf->hdr.event = BTA_AV_AVRC_MSG_EVT;
    274         p_buf->handle = handle;
    275         p_buf->label = label;
    276         p_buf->opcode = opcode;
    277         memcpy(&p_buf->msg, p_msg, sizeof(tAVRC_MSG));
    278         if (p_data != NULL)
    279         {
    280             memcpy((UINT8 *)(p_buf + 1), p_data, data_len);
    281             *p_p_data = (UINT8 *)(p_buf + 1);
    282         }
    283         bta_sys_sendmsg(p_buf);
    284     }
    285 }
    286 
    287 /*******************************************************************************
    288 **
    289 ** Function         bta_av_rc_create
    290 **
    291 ** Description      alloc RCB and call AVRC_Open
    292 **
    293 ** Returns          the created rc handle
    294 **
    295 *******************************************************************************/
    296 UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
    297 {
    298     tAVRC_CONN_CB ccb;
    299     BD_ADDR_PTR   bda = (BD_ADDR_PTR)bd_addr_any;
    300     UINT8         status = BTA_AV_RC_ROLE_ACP;
    301     tBTA_AV_SCB  *p_scb = p_cb->p_scb[shdl - 1];
    302     int i;
    303     UINT8   rc_handle;
    304     tBTA_AV_RCB *p_rcb;
    305 
    306     if(role == AVCT_INT)
    307     {
    308         bda = p_scb->peer_addr;
    309         status = BTA_AV_RC_ROLE_INT;
    310     }
    311     else
    312     {
    313         if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL )
    314         {
    315             APPL_TRACE_ERROR1("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
    316             return p_rcb->handle;
    317         }
    318     }
    319 
    320     ccb.p_ctrl_cback = bta_av_rc_ctrl_cback;
    321     ccb.p_msg_cback = bta_av_rc_msg_cback;
    322     ccb.company_id = p_bta_av_cfg->company_id;
    323     ccb.conn = role;
    324     /* note: BTA_AV_FEAT_RCTG = AVRC_CT_TARGET, BTA_AV_FEAT_RCCT = AVRC_CT_CONTROL */
    325     ccb.control = p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_RCCT | AVRC_CT_PASSIVE);
    326 
    327 
    328     if (AVRC_Open(&rc_handle, &ccb, bda) != AVRC_SUCCESS)
    329         return BTA_AV_RC_HANDLE_NONE;
    330 
    331     i = rc_handle;
    332     p_rcb = &p_cb->rcb[i];
    333 
    334     if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
    335     {
    336         APPL_TRACE_ERROR1("bta_av_rc_create found duplicated handle:%d", rc_handle);
    337     }
    338 
    339     p_rcb->handle = rc_handle;
    340     p_rcb->status = status;
    341     p_rcb->shdl = shdl;
    342     p_rcb->lidx = lidx;
    343     p_rcb->peer_features = 0;
    344     if(lidx == (BTA_AV_NUM_LINKS + 1))
    345     {
    346         /* this LIDX is reserved for the AVRCP ACP connection */
    347         p_cb->rc_acp_handle = p_rcb->handle;
    348         p_cb->rc_acp_idx = (i + 1);
    349         APPL_TRACE_DEBUG2("rc_acp_handle:%d idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
    350     }
    351     APPL_TRACE_DEBUG6("create %d, role: %d, shdl:%d, rc_handle:%d, lidx:%d, status:0x%x",
    352         i, role, shdl, p_rcb->handle, lidx, p_rcb->status);
    353 
    354     return rc_handle;
    355 }
    356 
    357 /*******************************************************************************
    358 **
    359 ** Function         bta_av_valid_group_navi_msg
    360 **
    361 ** Description      Check if it is Group Navigation Msg for Metadata
    362 **
    363 ** Returns          BTA_AV_RSP_ACCEPT or BTA_AV_RSP_NOT_IMPL.
    364 **
    365 *******************************************************************************/
    366 static tBTA_AV_CODE bta_av_group_navi_supported(UINT8 len, UINT8 *p_data, BOOLEAN is_inquiry)
    367 {
    368     tBTA_AV_CODE ret=BTA_AV_RSP_NOT_IMPL;
    369     UINT8 *p_ptr = p_data;
    370     UINT16 u16;
    371     UINT32 u32;
    372 
    373     if (p_bta_av_cfg->avrc_group && len == BTA_GROUP_NAVI_MSG_OP_DATA_LEN)
    374     {
    375         BTA_AV_BE_STREAM_TO_CO_ID(u32, p_ptr);
    376         BE_STREAM_TO_UINT16(u16, p_ptr);
    377 
    378         if (u32 == AVRC_CO_METADATA)
    379         {
    380             if (is_inquiry)
    381             {
    382                 if (u16 <= AVRC_PDU_PREV_GROUP)
    383                     ret = BTA_AV_RSP_IMPL_STBL;
    384             }
    385             else
    386             {
    387                 if (u16 <= AVRC_PDU_PREV_GROUP)
    388                     ret = BTA_AV_RSP_ACCEPT;
    389                 else
    390                     ret = BTA_AV_RSP_REJ;
    391             }
    392         }
    393     }
    394 
    395     return ret;
    396 }
    397 
    398 /*******************************************************************************
    399 **
    400 ** Function         bta_av_op_supported
    401 **
    402 ** Description      Check if remote control operation is supported.
    403 **
    404 ** Returns          BTA_AV_RSP_ACCEPT of supported, BTA_AV_RSP_NOT_IMPL if not.
    405 **
    406 *******************************************************************************/
    407 static tBTA_AV_CODE bta_av_op_supported(tBTA_AV_RC rc_id, BOOLEAN is_inquiry)
    408 {
    409     tBTA_AV_CODE ret_code = BTA_AV_RSP_NOT_IMPL;
    410 
    411     if (p_bta_av_rc_id)
    412     {
    413         if (is_inquiry)
    414         {
    415             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    416             {
    417                 ret_code = BTA_AV_RSP_IMPL_STBL;
    418             }
    419         }
    420         else
    421         {
    422             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    423             {
    424                 ret_code = BTA_AV_RSP_ACCEPT;
    425             }
    426             else if ((p_bta_av_cfg->rc_pass_rsp == BTA_AV_RSP_INTERIM) && p_bta_av_rc_id_ac)
    427             {
    428                 if (p_bta_av_rc_id_ac[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    429                 {
    430                     ret_code = BTA_AV_RSP_INTERIM;
    431                 }
    432             }
    433         }
    434 
    435     }
    436     return ret_code;
    437 }
    438 
    439 /*******************************************************************************
    440 **
    441 ** Function         bta_av_find_lcb
    442 **
    443 ** Description      Given BD_addr, find the associated LCB.
    444 **
    445 ** Returns          NULL, if not found.
    446 **
    447 *******************************************************************************/
    448 tBTA_AV_LCB * bta_av_find_lcb(BD_ADDR addr, UINT8 op)
    449 {
    450     tBTA_AV_CB   *p_cb = &bta_av_cb;
    451     int     xx;
    452     UINT8   mask;
    453     tBTA_AV_LCB *p_lcb = NULL;
    454 
    455     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
    456     {
    457         mask = 1 << xx; /* the used mask for this lcb */
    458         if((mask & p_cb->conn_lcb) && 0 ==( bdcmp(p_cb->lcb[xx].addr, addr)))
    459         {
    460             p_lcb = &p_cb->lcb[xx];
    461             if(op == BTA_AV_LCB_FREE)
    462             {
    463                 p_cb->conn_lcb &= ~mask; /* clear the connect mask */
    464                 APPL_TRACE_DEBUG1("conn_lcb: 0x%x", p_cb->conn_lcb);
    465             }
    466             break;
    467         }
    468     }
    469     return p_lcb;
    470 }
    471 
    472 /*******************************************************************************
    473 **
    474 ** Function         bta_av_rc_opened
    475 **
    476 ** Description      Set AVRCP state to opened.
    477 **
    478 ** Returns          void
    479 **
    480 *******************************************************************************/
    481 void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    482 {
    483     tBTA_AV_RC_OPEN rc_open;
    484     tBTA_AV_SCB     *p_scb;
    485     int         i;
    486     UINT8       shdl = 0;
    487     tBTA_AV_LCB *p_lcb;
    488     tBTA_AV_RCB *p_rcb;
    489     UINT8       tmp;
    490     UINT8       disc = 0;
    491 
    492     /* find the SCB & stop the timer */
    493     for(i=0; i<BTA_AV_NUM_STRS; i++)
    494     {
    495         p_scb = p_cb->p_scb[i];
    496         if(p_scb && bdcmp(p_scb->peer_addr, p_data->rc_conn_chg.peer_addr) == 0)
    497         {
    498             p_scb->rc_handle = p_data->rc_conn_chg.handle;
    499             APPL_TRACE_DEBUG2("bta_av_rc_opened shdl:%d, srch %d", i + 1, p_scb->rc_handle);
    500             shdl = i+1;
    501             APPL_TRACE_ERROR1("use_rc:%d", p_scb->use_rc);
    502             bta_sys_stop_timer(&p_scb->timer);
    503             disc = p_scb->hndl;
    504             break;
    505         }
    506     }
    507 
    508     i = p_data->rc_conn_chg.handle;
    509     if (p_cb->rcb[i].handle == BTA_AV_RC_HANDLE_NONE)
    510     {
    511         APPL_TRACE_ERROR1("not a valid handle:%d any more", i);
    512         return;
    513     }
    514 
    515 
    516     if (p_cb->rcb[i].lidx == (BTA_AV_NUM_LINKS + 1) && shdl != 0)
    517     {
    518         /* rc is opened on the RC only ACP channel, but is for a specific
    519          * SCB -> need to switch RCBs */
    520         p_rcb = bta_av_get_rcb_by_shdl(shdl);
    521         if (p_rcb)
    522         {
    523             p_rcb->shdl = p_cb->rcb[i].shdl;
    524             tmp         = p_rcb->lidx;
    525             p_rcb->lidx = p_cb->rcb[i].lidx;
    526             p_cb->rcb[i].lidx = tmp;
    527             p_cb->rc_acp_handle = p_rcb->handle;
    528             p_cb->rc_acp_idx = (p_rcb - p_cb->rcb) + 1;
    529             APPL_TRACE_DEBUG2("switching RCB rc_acp_handle:%d idx:%d",
    530                                p_cb->rc_acp_handle, p_cb->rc_acp_idx);
    531         }
    532     }
    533 
    534     p_cb->rcb[i].shdl = shdl;
    535     rc_open.rc_handle = i;
    536     APPL_TRACE_ERROR4("bta_av_rc_opened rcb[%d] shdl:%d lidx:%d/%d",
    537             i, shdl, p_cb->rcb[i].lidx, p_cb->lcb[BTA_AV_NUM_LINKS].lidx);
    538     p_cb->rcb[i].status |= BTA_AV_RC_CONN_MASK;
    539 
    540     if(!shdl && 0 == p_cb->lcb[BTA_AV_NUM_LINKS].lidx)
    541     {
    542         /* no associated SCB -> connected to an RC only device
    543          * update the index to the extra LCB */
    544         p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
    545         bdcpy(p_lcb->addr, p_data->rc_conn_chg.peer_addr);
    546         APPL_TRACE_DEBUG6("rc_only bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
    547                       p_lcb->addr[0], p_lcb->addr[1],
    548                       p_lcb->addr[2], p_lcb->addr[3],
    549                       p_lcb->addr[4], p_lcb->addr[5]);
    550         p_lcb->lidx = BTA_AV_NUM_LINKS + 1;
    551             p_cb->rcb[i].lidx = p_lcb->lidx;
    552         p_lcb->conn_msk = 1;
    553         APPL_TRACE_ERROR3("rcb[%d].lidx=%d, lcb.conn_msk=x%x",
    554             i, p_cb->rcb[i].lidx, p_lcb->conn_msk);
    555         disc = p_data->rc_conn_chg.handle|BTA_AV_CHNL_MSK;
    556     }
    557 
    558     bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
    559     rc_open.peer_features = p_cb->rcb[i].peer_features;
    560     rc_open.status = BTA_AV_SUCCESS;
    561     APPL_TRACE_DEBUG2("local features:x%x peer_features:x%x", p_cb->features,
    562                       rc_open.peer_features);
    563     if(rc_open.peer_features == 0)
    564     {
    565         /* we have not done SDP on peer RC capabilities.
    566          * peer must have initiated the RC connection */
    567         rc_open.peer_features = BTA_AV_FEAT_RCCT;
    568         bta_av_rc_disc(disc);
    569     }
    570     (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
    571 
    572 }
    573 
    574 
    575 /*******************************************************************************
    576 **
    577 ** Function         bta_av_rc_remote_cmd
    578 **
    579 ** Description      Send an AVRCP remote control command.
    580 **
    581 ** Returns          void
    582 **
    583 *******************************************************************************/
    584 void bta_av_rc_remote_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    585 {
    586     tBTA_AV_RCB    *p_rcb;
    587     if (p_cb->features & BTA_AV_FEAT_RCCT)
    588     {
    589         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    590         {
    591             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    592             if(p_rcb->status & BTA_AV_RC_CONN_MASK)
    593             {
    594                 AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
    595                      &p_data->api_remote_cmd.msg);
    596             }
    597         }
    598     }
    599 }
    600 
    601 /*******************************************************************************
    602 **
    603 ** Function         bta_av_rc_vendor_cmd
    604 **
    605 ** Description      Send an AVRCP vendor specific command.
    606 **
    607 ** Returns          void
    608 **
    609 *******************************************************************************/
    610 void bta_av_rc_vendor_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    611 {
    612     tBTA_AV_RCB    *p_rcb;
    613     if ( (p_cb->features & (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR)) ==
    614          (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR))
    615     {
    616         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    617         {
    618             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    619             AVRC_VendorCmd(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
    620         }
    621     }
    622 }
    623 
    624 /*******************************************************************************
    625 **
    626 ** Function         bta_av_rc_vendor_rsp
    627 **
    628 ** Description      Send an AVRCP vendor specific response.
    629 **
    630 ** Returns          void
    631 **
    632 *******************************************************************************/
    633 void bta_av_rc_vendor_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    634 {
    635     tBTA_AV_RCB    *p_rcb;
    636     if ( (p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
    637          (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR))
    638     {
    639         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    640         {
    641             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    642             AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
    643         }
    644     }
    645 }
    646 
    647 /*******************************************************************************
    648 **
    649 ** Function         bta_av_rc_meta_rsp
    650 **
    651 ** Description      Send an AVRCP metadata/advanced control command/response.
    652 **
    653 ** Returns          void
    654 **
    655 *******************************************************************************/
    656 void bta_av_rc_meta_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    657 {
    658     tBTA_AV_RCB *p_rcb;
    659     BOOLEAN         free = TRUE;
    660 
    661     if ((p_cb->features & BTA_AV_FEAT_METADATA) && (p_data->hdr.layer_specific < BTA_AV_NUM_RCB))
    662     {
    663         if ((p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCTG)) ||
    664             (!p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCCT)) )
    665         {
    666             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    667             if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE) {
    668                 AVRC_MsgReq(p_rcb->handle, p_data->api_meta_rsp.label,
    669                             p_data->api_meta_rsp.rsp_code,
    670                             p_data->api_meta_rsp.p_pkt);
    671                 free = FALSE;
    672             }
    673         }
    674     }
    675 
    676     if (free)
    677         GKI_freebuf (p_data->api_meta_rsp.p_pkt);
    678 }
    679 
    680 /*******************************************************************************
    681 **
    682 ** Function         bta_av_rc_free_rsp
    683 **
    684 ** Description      free an AVRCP metadata command buffer.
    685 **
    686 ** Returns          void
    687 **
    688 *******************************************************************************/
    689 void bta_av_rc_free_rsp (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    690 {
    691     GKI_freebuf (p_data->api_meta_rsp.p_pkt);
    692 }
    693 
    694 /*******************************************************************************
    695 **
    696 ** Function         bta_av_rc_meta_req
    697 **
    698 ** Description      Send an AVRCP metadata command.
    699 **
    700 ** Returns          void
    701 **
    702 *******************************************************************************/
    703 void bta_av_rc_free_msg (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    704 {
    705 }
    706 
    707 
    708 
    709 /*******************************************************************************
    710 **
    711 ** Function         bta_av_chk_notif_evt_id
    712 **
    713 ** Description      make sure the requested player id is valid.
    714 **
    715 ** Returns          BTA_AV_STS_NO_RSP, if no error
    716 **
    717 *******************************************************************************/
    718 static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
    719 {
    720     tAVRC_STS   status = BTA_AV_STS_NO_RSP;
    721     UINT8       xx;
    722     UINT16      u16;
    723     UINT8       *p = p_vendor->p_vendor_data + 2;
    724 
    725     BE_STREAM_TO_UINT16 (u16, p);
    726     /* double check the fixed length */
    727     if ((u16 != 5) || (p_vendor->vendor_len != 9))
    728     {
    729         status = AVRC_STS_INTERNAL_ERR;
    730     }
    731     else
    732     {
    733         /* make sure the player_id is valid */
    734         for (xx=0; xx<p_bta_av_cfg->num_evt_ids; xx++)
    735         {
    736             if (*p == p_bta_av_cfg->p_meta_evt_ids[xx])
    737             {
    738                 break;
    739             }
    740         }
    741         if (xx == p_bta_av_cfg->num_evt_ids)
    742         {
    743             status = AVRC_STS_BAD_PARAM;
    744         }
    745     }
    746 
    747     return status;
    748 }
    749 
    750 /*******************************************************************************
    751 **
    752 ** Function         bta_av_proc_meta_cmd
    753 **
    754 ** Description      Process an AVRCP metadata command from the peer.
    755 **
    756 ** Returns          TRUE to respond immediately
    757 **
    758 *******************************************************************************/
    759 tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE  *p_rc_rsp, tBTA_AV_RC_MSG *p_msg, UINT8 *p_ctype)
    760 {
    761     tBTA_AV_EVT evt = BTA_AV_META_MSG_EVT;
    762     UINT8       u8, pdu, *p;
    763     UINT16      u16;
    764     tAVRC_MSG_VENDOR    *p_vendor = &p_msg->msg.vendor;
    765 
    766 #if (AVRC_METADATA_INCLUDED == TRUE)
    767 
    768     pdu = *(p_vendor->p_vendor_data);
    769     p_rc_rsp->pdu = pdu;
    770     *p_ctype = AVRC_RSP_REJ;
    771     /* Metadata messages only use PANEL sub-unit type */
    772     if (p_vendor->hdr.subunit_type != AVRC_SUB_PANEL)
    773     {
    774         APPL_TRACE_DEBUG0("SUBUNIT must be PANEL");
    775         /* reject it */
    776         evt=0;
    777         p_vendor->hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    778         AVRC_VendorRsp(p_msg->handle, p_msg->label, &p_msg->msg.vendor);
    779     }
    780     else if (!AVRC_IsValidAvcType(pdu, p_vendor->hdr.ctype) )
    781     {
    782         APPL_TRACE_DEBUG2("Invalid pdu/ctype: 0x%x, %d", pdu, p_vendor->hdr.ctype);
    783         /* reject invalid message without reporting to app */
    784         evt = 0;
    785         p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
    786     }
    787     else
    788     {
    789         switch (pdu)
    790         {
    791         case AVRC_PDU_GET_CAPABILITIES:
    792             /* process GetCapabilities command without reporting the event to app */
    793             evt = 0;
    794             u8 = *(p_vendor->p_vendor_data + 4);
    795             p = p_vendor->p_vendor_data + 2;
    796             p_rc_rsp->get_caps.capability_id = u8;
    797             BE_STREAM_TO_UINT16 (u16, p);
    798             if ((u16 != 1) || (p_vendor->vendor_len != 5))
    799             {
    800                 p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
    801             }
    802             else
    803             {
    804                 p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;
    805                 if (u8 == AVRC_CAP_COMPANY_ID)
    806                 {
    807                     *p_ctype = AVRC_RSP_IMPL_STBL;
    808                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_co_ids;
    809                     memcpy(p_rc_rsp->get_caps.param.company_id, p_bta_av_cfg->p_meta_co_ids,
    810                            (p_bta_av_cfg->num_co_ids << 2));
    811                 }
    812                 else if (u8 == AVRC_CAP_EVENTS_SUPPORTED)
    813                 {
    814                     *p_ctype = AVRC_RSP_IMPL_STBL;
    815                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_evt_ids;
    816                     memcpy(p_rc_rsp->get_caps.param.event_id, p_bta_av_cfg->p_meta_evt_ids,
    817                            p_bta_av_cfg->num_evt_ids);
    818                 }
    819                 else
    820                 {
    821                     APPL_TRACE_DEBUG1("Invalid capability ID: 0x%x", u8);
    822                     /* reject - unknown capability ID */
    823                     p_rc_rsp->get_caps.status = AVRC_STS_BAD_PARAM;
    824                 }
    825             }
    826             break;
    827 
    828 
    829         case AVRC_PDU_REGISTER_NOTIFICATION:
    830             /* make sure the event_id is implemented */
    831             p_rc_rsp->rsp.status = bta_av_chk_notif_evt_id (p_vendor);
    832             if (p_rc_rsp->rsp.status != BTA_AV_STS_NO_RSP)
    833                 evt = 0;
    834             break;
    835 
    836         }
    837     }
    838 #else
    839     APPL_TRACE_DEBUG0("AVRCP 1.3 Metadata not supporteed. Reject command.");
    840     /* reject invalid message without reporting to app */
    841     evt = 0;
    842     p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
    843 #endif
    844 
    845     return evt;
    846 }
    847 
    848 
    849 /*******************************************************************************
    850 **
    851 ** Function         bta_av_rc_msg
    852 **
    853 ** Description      Process an AVRCP message from the peer.
    854 **
    855 ** Returns          void
    856 **
    857 *******************************************************************************/
    858 void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    859 {
    860     tBTA_AV_EVT evt = 0;
    861     tBTA_AV     av;
    862     BT_HDR      *p_pkt = NULL;
    863     tAVRC_MSG_VENDOR    *p_vendor = &p_data->rc_msg.msg.vendor;
    864     BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
    865 #if (AVRC_METADATA_INCLUDED == TRUE)
    866     tAVRC_STS   res;
    867     UINT8       ctype;
    868     tAVRC_RESPONSE  rc_rsp;
    869 
    870     rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
    871 #endif
    872 
    873     if (p_data->rc_msg.opcode == AVRC_OP_PASS_THRU)
    874     {
    875     /* if this is a pass thru command */
    876         if ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_CTRL) ||
    877             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) ||
    878             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ)
    879             )
    880         {
    881         /* check if operation is supported */
    882             if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR)
    883             {
    884                 p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    885 #if (AVRC_METADATA_INCLUDED == TRUE)
    886                 if (p_cb->features & BTA_AV_FEAT_METADATA)
    887                     p_data->rc_msg.msg.hdr.ctype =
    888                         bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
    889                         p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
    890 #endif
    891             }
    892             else
    893             {
    894                 p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
    895             }
    896 
    897             APPL_TRACE_DEBUG1("ctype %d",p_data->rc_msg.msg.hdr.ctype)
    898 
    899             /* send response */
    900             if (p_data->rc_msg.msg.hdr.ctype != BTA_AV_RSP_INTERIM)
    901                 AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
    902 
    903             /* set up for callback if supported */
    904             if (p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_ACCEPT || p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_INTERIM)
    905             {
    906                 evt = BTA_AV_REMOTE_CMD_EVT;
    907                 av.remote_cmd.rc_id = p_data->rc_msg.msg.pass.op_id;
    908                 av.remote_cmd.key_state = p_data->rc_msg.msg.pass.state;
    909                 av.remote_cmd.p_data = p_data->rc_msg.msg.pass.p_pass_data;
    910                 av.remote_cmd.len = p_data->rc_msg.msg.pass.pass_len;
    911                 memcpy(&av.remote_cmd.hdr, &p_data->rc_msg.msg.hdr, sizeof (tAVRC_HDR));
    912                 av.remote_cmd.label = p_data->rc_msg.label;
    913             }
    914         }
    915         /* else if this is a pass thru response */
    916         else if (p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
    917         {
    918             /* set up for callback */
    919             evt = BTA_AV_REMOTE_RSP_EVT;
    920             av.remote_rsp.rc_id = p_data->rc_msg.msg.pass.op_id;
    921             av.remote_rsp.key_state = p_data->rc_msg.msg.pass.state;
    922             av.remote_rsp.rsp_code = p_data->rc_msg.msg.hdr.ctype;
    923             av.remote_rsp.label = p_data->rc_msg.label;
    924         }
    925         /* must be a bad ctype -> reject*/
    926         else
    927         {
    928             p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
    929             AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
    930         }
    931     }
    932     /* else if this is a vendor specific command or response */
    933     else if (p_data->rc_msg.opcode == AVRC_OP_VENDOR)
    934     {
    935         /* set up for callback */
    936         av.vendor_cmd.code = p_data->rc_msg.msg.hdr.ctype;
    937         av.vendor_cmd.company_id = p_vendor->company_id;
    938         av.vendor_cmd.label = p_data->rc_msg.label;
    939         av.vendor_cmd.p_data = p_vendor->p_vendor_data;
    940         av.vendor_cmd.len = p_vendor->vendor_len;
    941 
    942         /* if configured to support vendor specific and it's a command */
    943         if ((p_cb->features & BTA_AV_FEAT_VENDOR)  &&
    944             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
    945         {
    946 #if (AVRC_METADATA_INCLUDED == TRUE)
    947             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
    948                (p_vendor->company_id == AVRC_CO_METADATA))
    949             {
    950                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
    951                 evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
    952             }
    953             else
    954 #endif
    955                 evt = BTA_AV_VENDOR_CMD_EVT;
    956         }
    957         /* else if configured to support vendor specific and it's a response */
    958         else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
    959                  p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
    960         {
    961 #if (AVRC_METADATA_INCLUDED == TRUE)
    962             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
    963                (p_vendor->company_id == AVRC_CO_METADATA))
    964             {
    965                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
    966                 evt = BTA_AV_META_MSG_EVT;
    967             }
    968             else
    969 #endif
    970                 evt = BTA_AV_VENDOR_RSP_EVT;
    971 
    972         }
    973         /* else if not configured to support vendor specific and it's a command */
    974         else if (!(p_cb->features & BTA_AV_FEAT_VENDOR)  &&
    975             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
    976         {
    977            if(p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID)
    978            {
    979            /* reject it */
    980               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
    981               p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
    982            }
    983            else
    984               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    985            AVRC_VendorRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.vendor);
    986         }
    987     }
    988 #if (AVRC_METADATA_INCLUDED == TRUE)
    989     if (evt == 0 && rc_rsp.rsp.status != BTA_AV_STS_NO_RSP)
    990     {
    991         if (!p_pkt)
    992         {
    993             rc_rsp.rsp.opcode = p_data->rc_msg.opcode;
    994             res = AVRC_BldResponse (0, &rc_rsp, &p_pkt);
    995         }
    996         if (p_pkt)
    997             AVRC_MsgReq (p_data->rc_msg.handle, p_data->rc_msg.label, ctype, p_pkt);
    998     }
    999 #endif
   1000 
   1001     /* call callback */
   1002     if (evt != 0)
   1003     {
   1004         av.remote_cmd.rc_handle = p_data->rc_msg.handle;
   1005         (*p_cb->p_cback)(evt, &av);
   1006     }
   1007 }
   1008 
   1009 /*******************************************************************************
   1010 **
   1011 ** Function         bta_av_rc_close
   1012 **
   1013 ** Description      close the specified AVRC handle.
   1014 **
   1015 ** Returns          void
   1016 **
   1017 *******************************************************************************/
   1018 void bta_av_rc_close (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
   1019 {
   1020     UINT16 handle = p_data->hdr.layer_specific;
   1021     tBTA_AV_SCB  *p_scb;
   1022     tBTA_AV_RCB *p_rcb;
   1023 
   1024     if(handle < BTA_AV_NUM_RCB)
   1025     {
   1026         p_rcb = &p_cb->rcb[handle];
   1027 
   1028         APPL_TRACE_DEBUG2("bta_av_rc_close handle: %d, status=0x%x", p_rcb->handle, p_rcb->status);
   1029         if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
   1030         {
   1031             if(p_rcb->shdl)
   1032             {
   1033                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
   1034                 if(p_scb)
   1035                 {
   1036                     /* just in case the RC timer is active
   1037                     if(bta_av_cb.features & BTA_AV_FEAT_RCCT &&
   1038                        p_scb->chnl == BTA_AV_CHNL_AUDIO) */
   1039                         bta_sys_stop_timer(&p_scb->timer);
   1040                 }
   1041             }
   1042 
   1043             AVRC_Close(p_rcb->handle);
   1044         }
   1045     }
   1046 }
   1047 
   1048 /*******************************************************************************
   1049 **
   1050 ** Function         bta_av_get_shdl
   1051 **
   1052 ** Returns          The index to p_scb[]
   1053 **
   1054 *******************************************************************************/
   1055 static UINT8 bta_av_get_shdl(tBTA_AV_SCB *p_scb)
   1056 {
   1057     int     i;
   1058     UINT8   shdl = 0;
   1059     /* find the SCB & stop the timer */
   1060     for(i=0; i<BTA_AV_NUM_STRS; i++)
   1061     {
   1062         if(p_scb == bta_av_cb.p_scb[i])
   1063         {
   1064             shdl = i+1;
   1065             break;
   1066         }
   1067     }
   1068     return shdl;
   1069 }
   1070 
   1071 /*******************************************************************************
   1072 **
   1073 ** Function         bta_av_stream_chg
   1074 **
   1075 ** Description      audio streaming status changed.
   1076 **
   1077 ** Returns          void
   1078 **
   1079 *******************************************************************************/
   1080 void bta_av_stream_chg(tBTA_AV_SCB *p_scb, BOOLEAN started)
   1081 {
   1082     UINT8   started_msk;
   1083     int     i;
   1084     UINT8   *p_streams;
   1085     BOOLEAN no_streams = FALSE;
   1086     tBTA_AV_SCB *p_scbi;
   1087 
   1088     started_msk = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
   1089     APPL_TRACE_DEBUG3 ("bta_av_stream_chg started:%d started_msk:x%x chnl:x%x", started,
   1090                                                   started_msk, p_scb->chnl);
   1091     if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
   1092         p_streams = &bta_av_cb.audio_streams;
   1093     else
   1094         p_streams = &bta_av_cb.video_streams;
   1095 
   1096     if (started)
   1097     {
   1098         /* Let L2CAP know this channel is processed with high priority */
   1099         L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_HIGH);
   1100         (*p_streams) |= started_msk;
   1101     }
   1102     else
   1103     {
   1104         (*p_streams) &= ~started_msk;
   1105     }
   1106 
   1107     if (!started)
   1108     {
   1109         i=0;
   1110         if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
   1111         {
   1112             if (bta_av_cb.video_streams == 0)
   1113                 no_streams = TRUE;
   1114         }
   1115         else
   1116         {
   1117             no_streams = TRUE;
   1118             if ( bta_av_cb.audio_streams )
   1119             {
   1120                 for (; i<BTA_AV_NUM_STRS; i++)
   1121                 {
   1122                     p_scbi = bta_av_cb.p_scb[i];
   1123                     /* scb is used and started */
   1124                     if ( p_scbi && (bta_av_cb.audio_streams & BTA_AV_HNDL_TO_MSK(i))
   1125                         && bdcmp(p_scbi->peer_addr, p_scb->peer_addr) == 0)
   1126                     {
   1127                         no_streams = FALSE;
   1128                         break;
   1129                     }
   1130                 }
   1131 
   1132             }
   1133         }
   1134 
   1135         APPL_TRACE_DEBUG4 ("no_streams:%d i:%d, audio_streams:x%x, video_streams:x%x", no_streams, i,
   1136                            bta_av_cb.audio_streams, bta_av_cb.video_streams);
   1137         if (no_streams)
   1138         {
   1139             /* Let L2CAP know this channel is processed with low priority */
   1140             L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_NORMAL);
   1141         }
   1142     }
   1143 }
   1144 
   1145 
   1146 /*******************************************************************************
   1147 **
   1148 ** Function         bta_av_conn_chg
   1149 **
   1150 ** Description      connetion status changed.
   1151 **                  Open an AVRCP acceptor channel, if new conn.
   1152 **
   1153 ** Returns          void
   1154 **
   1155 *******************************************************************************/
   1156 void bta_av_conn_chg(tBTA_AV_DATA *p_data)
   1157 {
   1158     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1159     tBTA_AV_SCB     *p_scb;
   1160     tBTA_AV_SCB     *p_scbi;
   1161     UINT8   mask;
   1162     UINT8   conn_msk;
   1163     UINT8   old_msk;
   1164     int i;
   1165     int index = (p_data->hdr.layer_specific & BTA_AV_HNDL_MSK) - 1;
   1166     tBTA_AV_LCB *p_lcb;
   1167     tBTA_AV_LCB *p_lcb_rc;
   1168     tBTA_AV_RCB *p_rcb, *p_rcb2;
   1169     BOOLEAN     chk_restore = FALSE;
   1170 
   1171     p_scb = p_cb->p_scb[index];
   1172 
   1173     mask = BTA_AV_HNDL_TO_MSK(index);
   1174     p_lcb = bta_av_find_lcb(p_data->conn_chg.peer_addr, BTA_AV_LCB_FIND);
   1175     conn_msk = 1 << (index + 1);
   1176     if(p_data->conn_chg.is_up)
   1177     {
   1178         /* set the conned mask for this channel */
   1179         if(p_scb)
   1180         {
   1181             if(p_lcb)
   1182             {
   1183                 p_lcb->conn_msk |= conn_msk;
   1184                 for (i=0; i<BTA_AV_NUM_RCB; i++)
   1185                 {
   1186                     if (bta_av_cb.rcb[i].lidx == p_lcb->lidx)
   1187                     {
   1188                         bta_av_cb.rcb[i].shdl = index + 1;
   1189                         APPL_TRACE_DEBUG5("conn_chg up[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
   1190                                           bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
   1191                                           bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
   1192                         break;
   1193                     }
   1194                 }
   1195             }
   1196             if (p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1197             {
   1198                 old_msk = p_cb->conn_audio;
   1199                 p_cb->conn_audio |= mask;
   1200             }
   1201             else
   1202             {
   1203                 old_msk = p_cb->conn_video;
   1204                 p_cb->conn_video |= mask;
   1205             }
   1206 
   1207             if ((old_msk & mask) == 0)
   1208             {
   1209                 /* increase the audio open count, if not set yet */
   1210                 bta_av_cb.audio_open_cnt++;
   1211             }
   1212 
   1213 
   1214             APPL_TRACE_DEBUG2("rc_acp_handle:%d rc_acp_idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
   1215             /* check if the AVRCP ACP channel is already connected */
   1216             if(p_lcb && p_cb->rc_acp_handle != BTA_AV_RC_HANDLE_NONE && p_cb->rc_acp_idx)
   1217             {
   1218                 p_lcb_rc = &p_cb->lcb[BTA_AV_NUM_LINKS];
   1219                 APPL_TRACE_DEBUG1("rc_acp is connected && conn_chg on same addr p_lcb_rc->conn_msk:x%x",
   1220                                   p_lcb_rc->conn_msk);
   1221                 /* check if the RC is connected to the scb addr */
   1222                 APPL_TRACE_DEBUG6 ("p_lcb_rc->addr: %02x:%02x:%02x:%02x:%02x:%02x",
   1223                        p_lcb_rc->addr[0], p_lcb_rc->addr[1], p_lcb_rc->addr[2], p_lcb_rc->addr[3],
   1224                        p_lcb_rc->addr[4], p_lcb_rc->addr[5]);
   1225                 APPL_TRACE_DEBUG6 ("conn_chg.peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
   1226                        p_data->conn_chg.peer_addr[0], p_data->conn_chg.peer_addr[1],
   1227                        p_data->conn_chg.peer_addr[2],
   1228                        p_data->conn_chg.peer_addr[3], p_data->conn_chg.peer_addr[4],
   1229                        p_data->conn_chg.peer_addr[5]);
   1230                 if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0)
   1231                 {
   1232                     /* AVRCP is already connected.
   1233                      * need to update the association betwen SCB and RCB */
   1234                     p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
   1235                     p_lcb_rc->lidx = 0;
   1236                     p_scb->rc_handle = p_cb->rc_acp_handle;
   1237                     p_rcb = &p_cb->rcb[p_cb->rc_acp_idx - 1];
   1238                     p_rcb->shdl = bta_av_get_shdl(p_scb);
   1239                     APPL_TRACE_DEBUG3("update rc_acp shdl:%d/%d srch:%d", index + 1, p_rcb->shdl,
   1240                                       p_scb->rc_handle );
   1241 
   1242                     p_rcb2 = bta_av_get_rcb_by_shdl(p_rcb->shdl);
   1243                     if (p_rcb2)
   1244                     {
   1245                         /* found the RCB that was created to associated with this SCB */
   1246                         p_cb->rc_acp_handle = p_rcb2->handle;
   1247                         p_cb->rc_acp_idx = (p_rcb2 - p_cb->rcb) + 1;
   1248                         APPL_TRACE_DEBUG2("new rc_acp_handle:%d, idx:%d", p_cb->rc_acp_handle,
   1249                                            p_cb->rc_acp_idx);
   1250                         p_rcb2->lidx = (BTA_AV_NUM_LINKS + 1);
   1251                         APPL_TRACE_DEBUG3("rc2 handle:%d lidx:%d/%d",p_rcb2->handle, p_rcb2->lidx,
   1252                                           p_cb->lcb[p_rcb2->lidx-1].lidx);
   1253                     }
   1254                     p_rcb->lidx = p_lcb->lidx;
   1255                     APPL_TRACE_DEBUG3("rc handle:%d lidx:%d/%d",p_rcb->handle, p_rcb->lidx,
   1256                                       p_cb->lcb[p_rcb->lidx-1].lidx);
   1257                 }
   1258             }
   1259         }
   1260     }
   1261     else
   1262     {
   1263         if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
   1264         {
   1265             /* this channel is still marked as open. decrease the count */
   1266             bta_av_cb.audio_open_cnt--;
   1267         }
   1268 
   1269         /* clear the conned mask for this channel */
   1270         p_cb->conn_audio &= ~mask;
   1271         p_cb->conn_video &= ~mask;
   1272         if(p_scb)
   1273         {
   1274             /* the stream is closed.
   1275              * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
   1276             bdcpy(p_scb->peer_addr, bd_addr_null);
   1277             if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1278             {
   1279                 if(p_lcb)
   1280                 {
   1281                     p_lcb->conn_msk &= ~conn_msk;
   1282                 }
   1283                 /* audio channel is down. make sure the INT channel is down */
   1284                 /* just in case the RC timer is active
   1285                 if(p_cb->features & BTA_AV_FEAT_RCCT) */
   1286                 {
   1287                     bta_sys_stop_timer(&p_scb->timer);
   1288                 }
   1289                 /* one audio channel goes down. check if we need to restore high priority */
   1290                 chk_restore = TRUE;
   1291             }
   1292         }
   1293 
   1294         APPL_TRACE_DEBUG1("bta_av_conn_chg shdl:%d", index + 1);
   1295         for (i=0; i<BTA_AV_NUM_RCB; i++)
   1296         {
   1297             APPL_TRACE_DEBUG5("conn_chg dn[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
   1298                               bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
   1299                               bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
   1300             if(bta_av_cb.rcb[i].shdl == index + 1)
   1301             {
   1302                 bta_av_del_rc(&bta_av_cb.rcb[i]);
   1303                 break;
   1304             }
   1305         }
   1306 
   1307         if(p_cb->conn_audio == 0 && p_cb->conn_video == 0)
   1308         {
   1309             /* if both channels are not connected,
   1310              * close all RC channels */
   1311             bta_av_close_all_rc(p_cb);
   1312         }
   1313 
   1314         /* if the AVRCP is no longer listening, create the listening channel */
   1315         if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
   1316             bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
   1317     }
   1318 
   1319     APPL_TRACE_DEBUG6("bta_av_conn_chg audio:%x video:%x up:%d conn_msk:0x%x chk_restore:%d audio_open_cnt:%d",
   1320         p_cb->conn_audio, p_cb->conn_video, p_data->conn_chg.is_up, conn_msk, chk_restore, p_cb->audio_open_cnt);
   1321 
   1322     if (chk_restore)
   1323     {
   1324         if (p_cb->audio_open_cnt == 1)
   1325         {
   1326             /* one audio channel goes down and there's one audio channel remains open.
   1327              * restore the switch role in default link policy */
   1328             bta_sys_set_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
   1329             /* allow role switch, if this is the last connection */
   1330             bta_av_restore_switch();
   1331         }
   1332         if (p_cb->audio_open_cnt)
   1333         {
   1334             /* adjust flush timeout settings to longer period */
   1335             for (i=0; i<BTA_AV_NUM_STRS; i++)
   1336             {
   1337                 p_scbi = bta_av_cb.p_scb[i];
   1338                 if (p_scbi && p_scbi->chnl == BTA_AV_CHNL_AUDIO && p_scbi->co_started)
   1339                 {
   1340                     /* may need to update the flush timeout of this already started stream */
   1341                     if (p_scbi->co_started != bta_av_cb.audio_open_cnt)
   1342                     {
   1343                         p_scbi->co_started = bta_av_cb.audio_open_cnt;
   1344                         L2CA_SetFlushTimeout(p_scbi->peer_addr, p_bta_av_cfg->p_audio_flush_to[p_scbi->co_started - 1] );
   1345                     }
   1346                 }
   1347             }
   1348         }
   1349     }
   1350 }
   1351 
   1352 /*******************************************************************************
   1353 **
   1354 ** Function         bta_av_disable
   1355 **
   1356 ** Description      disable AV.
   1357 **
   1358 ** Returns          void
   1359 **
   1360 *******************************************************************************/
   1361 void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
   1362 {
   1363     BT_HDR  hdr;
   1364     UINT16  xx;
   1365 
   1366     p_cb->disabling = TRUE;
   1367 
   1368     bta_av_close_all_rc(p_cb);
   1369 
   1370     utl_freebuf((void **) &p_cb->p_disc_db);
   1371 
   1372     /* disable audio/video - de-register all channels,
   1373      * expect BTA_AV_DEREG_COMP_EVT when deregister is complete */
   1374     for(xx=0; xx<BTA_AV_NUM_STRS; xx++)
   1375     {
   1376         hdr.layer_specific = xx + 1;
   1377         bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
   1378     }
   1379 }
   1380 
   1381 /*******************************************************************************
   1382 **
   1383 ** Function         bta_av_api_disconnect
   1384 **
   1385 ** Description      .
   1386 **
   1387 ** Returns          void
   1388 **
   1389 *******************************************************************************/
   1390 void bta_av_api_disconnect(tBTA_AV_DATA *p_data)
   1391 {
   1392     AVDT_DisconnectReq(p_data->api_discnt.bd_addr, bta_av_conn_cback);
   1393     bta_sys_stop_timer(&bta_av_cb.sig_tmr);
   1394 }
   1395 
   1396 /*******************************************************************************
   1397 **
   1398 ** Function         bta_av_sig_chg
   1399 **
   1400 ** Description      process AVDT signal channel up/down.
   1401 **
   1402 ** Returns          void
   1403 **
   1404 *******************************************************************************/
   1405 void bta_av_sig_chg(tBTA_AV_DATA *p_data)
   1406 {
   1407     UINT16 event = p_data->str_msg.hdr.layer_specific;
   1408     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1409     int     xx;
   1410     UINT8   mask;
   1411     tBTA_AV_LCB *p_lcb = NULL;
   1412 
   1413     APPL_TRACE_DEBUG1("bta_av_sig_chg event: %d", event);
   1414     if(event == AVDT_CONNECT_IND_EVT)
   1415     {
   1416         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FIND);
   1417         if(!p_lcb)
   1418         {
   1419             /* if the address does not have an LCB yet, alloc one */
   1420             for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
   1421             {
   1422                 mask = 1 << xx;
   1423                 APPL_TRACE_DEBUG1("conn_lcb: 0x%x", p_cb->conn_lcb);
   1424 
   1425                 /* look for a p_lcb with its p_scb registered */
   1426                 if((!(mask & p_cb->conn_lcb)) && (p_cb->p_scb[xx] != NULL))
   1427                 {
   1428                     p_lcb = &p_cb->lcb[xx];
   1429                     p_lcb->lidx = xx + 1;
   1430                     bdcpy(p_lcb->addr, p_data->str_msg.bd_addr);
   1431                     p_lcb->conn_msk = 0; /* clear the connect mask */
   1432                     /* start listening when the signal channel is open */
   1433                     if (p_cb->features & BTA_AV_FEAT_RCTG)
   1434                     {
   1435                         bta_av_rc_create(p_cb, AVCT_ACP, 0, p_lcb->lidx);
   1436                     }
   1437                     /* this entry is not used yet. */
   1438                     p_cb->conn_lcb |= mask;     /* mark it as used */
   1439                     APPL_TRACE_DEBUG1("start sig timer %d", p_data->hdr.offset);
   1440                     if (p_data->hdr.offset == AVDT_ACP)
   1441                     {
   1442                         APPL_TRACE_DEBUG1("Incoming L2CAP acquired, set state as incoming", NULL);
   1443                         bdcpy(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr);
   1444                         p_cb->p_scb[xx]->use_rc = TRUE;     /* allowing RC for incoming connection */
   1445                         bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_ACP_CONNECT_EVT, p_data);
   1446 
   1447                         /* The Pending Event should be sent as soon as the L2CAP signalling channel
   1448                          * is set up, which is NOW. Earlier this was done only after
   1449                          * BTA_AV_SIG_TIME_VAL milliseconds.
   1450                          * The following function shall send the event and start the recurring timer
   1451                          */
   1452                         bta_av_sig_timer(NULL);
   1453 
   1454                         /* Possible collision : need to avoid outgoing processing while the timer is running */
   1455                         p_cb->p_scb[xx]->coll_mask = BTA_AV_COLL_INC_TMR;
   1456 
   1457                         p_cb->acp_sig_tmr.param = (UINT32)xx;
   1458                         p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK*)&bta_av_acp_sig_timer_cback;
   1459                         bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
   1460                     }
   1461                     break;
   1462                 }
   1463             }
   1464 
   1465             /* check if we found something */
   1466             if (xx == BTA_AV_NUM_LINKS)
   1467             {
   1468                 /* We do not have scb for this avdt connection.     */
   1469                 /* Silently close the connection.                   */
   1470                 APPL_TRACE_ERROR0("av scb not available for avdt connection");
   1471                 AVDT_DisconnectReq (p_data->str_msg.bd_addr, NULL);
   1472                 return;
   1473             }
   1474         }
   1475     }
   1476 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   1477     else if (event == BTA_AR_AVDT_CONN_EVT)
   1478     {
   1479         bta_sys_stop_timer(&bta_av_cb.sig_tmr);
   1480     }
   1481 #endif
   1482     else
   1483     {
   1484         /* disconnected. */
   1485         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FREE);
   1486         if(p_lcb && p_lcb->conn_msk)
   1487         {
   1488             APPL_TRACE_DEBUG1("conn_msk: 0x%x", p_lcb->conn_msk);
   1489             /* clean up ssm  */
   1490             for(xx=0; xx < BTA_AV_NUM_STRS; xx++)
   1491             {
   1492                 mask = 1 << (xx + 1);
   1493                 if ((mask & p_lcb->conn_msk) && (p_cb->p_scb[xx]) &&
   1494                     (bdcmp(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr) == 0))
   1495                 {
   1496                     bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_AVDT_DISCONNECT_EVT, NULL);
   1497                 }
   1498             }
   1499         }
   1500     }
   1501     APPL_TRACE_DEBUG1("conn_lcb: 0x%x", p_cb->conn_lcb);
   1502 }
   1503 
   1504 /*******************************************************************************
   1505 **
   1506 ** Function         bta_av_sig_timer
   1507 **
   1508 ** Description      process the signal channel timer. This timer is started
   1509 **                  when the AVDTP signal channel is connected. If no profile
   1510 **                  is connected, the timer goes off every BTA_AV_SIG_TIME_VAL
   1511 **
   1512 ** Returns          void
   1513 **
   1514 *******************************************************************************/
   1515 void bta_av_sig_timer(tBTA_AV_DATA *p_data)
   1516 {
   1517     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1518     int     xx;
   1519     UINT8   mask;
   1520     tBTA_AV_LCB *p_lcb = NULL;
   1521     tBTA_AV_PEND pend;
   1522 
   1523     APPL_TRACE_DEBUG0("bta_av_sig_timer");
   1524     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
   1525     {
   1526         mask = 1 << xx;
   1527         if(mask & p_cb->conn_lcb)
   1528         {
   1529             /* this entry is used. check if it is connected */
   1530             p_lcb = &p_cb->lcb[xx];
   1531             if(!p_lcb->conn_msk)
   1532             {
   1533                 bta_sys_start_timer(&p_cb->sig_tmr, BTA_AV_SIG_TIMER_EVT, BTA_AV_SIG_TIME_VAL);
   1534                 bdcpy(pend.bd_addr, p_lcb->addr);
   1535                 (*p_cb->p_cback)(BTA_AV_PENDING_EVT, (tBTA_AV *) &pend);
   1536             }
   1537         }
   1538     }
   1539 }
   1540 
   1541 /*******************************************************************************
   1542 **
   1543 ** Function         bta_av_acp_sig_timer_cback
   1544 **
   1545 ** Description      Process the timeout when SRC is accepting connection
   1546 **                  and SNK did not start signalling.
   1547 **
   1548 ** Returns          void
   1549 **
   1550 *******************************************************************************/
   1551 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle)
   1552 {
   1553     UINT8   inx = (UINT8)p_tle->param;
   1554     tBTA_AV_CB  *p_cb = &bta_av_cb;
   1555     tBTA_AV_SCB *p_scb = p_cb->p_scb[inx];
   1556     tBTA_AV_API_OPEN  *p_buf;
   1557 
   1558     if (p_scb)
   1559     {
   1560         APPL_TRACE_DEBUG1("bta_av_acp_sig_timer_cback, coll_mask = 0x%02X", p_scb->coll_mask);
   1561 
   1562         if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)
   1563         {
   1564             p_scb->coll_mask &= ~BTA_AV_COLL_INC_TMR;
   1565 
   1566             if (bta_av_is_scb_opening(p_scb))
   1567             {
   1568                 if (p_scb->p_disc_db)
   1569                 {
   1570                     /* We are still doing SDP. Run the timer again. */
   1571                     p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;
   1572 
   1573                     p_cb->acp_sig_tmr.param = (UINT32)inx;
   1574                     p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK *)&bta_av_acp_sig_timer_cback;
   1575                     bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
   1576                 }
   1577                 else
   1578                 {
   1579                     /* SNK did not start signalling, resume signalling process. */
   1580                     bta_av_discover_req (p_scb, NULL);
   1581                 }
   1582             }
   1583             else if (bta_av_is_scb_incoming(p_scb))
   1584             {
   1585                 /* Stay in incoming state if SNK does not start signalling */
   1586 
   1587                 /* API open was called right after SNK opened L2C connection. */
   1588                 if (p_scb->coll_mask & BTA_AV_COLL_API_CALLED)
   1589                 {
   1590                     p_scb->coll_mask &= ~BTA_AV_COLL_API_CALLED;
   1591 
   1592                     /* BTA_AV_API_OPEN_EVT */
   1593                     if ((p_buf = (tBTA_AV_API_OPEN *) GKI_getbuf(sizeof(tBTA_AV_API_OPEN))) != NULL)
   1594                     {
   1595                         memcpy(p_buf, &(p_scb->open_api), sizeof(tBTA_AV_API_OPEN));
   1596                         bta_sys_sendmsg(p_buf);
   1597                     }
   1598                 }
   1599             }
   1600         }
   1601     }
   1602 }
   1603 
   1604 /*******************************************************************************
   1605 **
   1606 ** Function         bta_av_check_peer_features
   1607 **
   1608 ** Description      check supported features on the peer device from the SDP record
   1609 **                  and return the feature mask
   1610 **
   1611 ** Returns          tBTA_AV_FEAT peer device feature mask
   1612 **
   1613 *******************************************************************************/
   1614 tBTA_AV_FEAT bta_av_check_peer_features (UINT16 service_uuid)
   1615 {
   1616     tBTA_AV_FEAT peer_features = 0;
   1617     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1618     tSDP_DISC_REC       *p_rec = NULL;
   1619     tSDP_DISC_ATTR      *p_attr;
   1620     UINT16              peer_rc_version=0;
   1621     UINT16              categories = 0;
   1622 
   1623     APPL_TRACE_DEBUG1("bta_av_check_peer_features service_uuid:x%x", service_uuid);
   1624     /* loop through all records we found */
   1625     while (TRUE)
   1626     {
   1627         /* get next record; if none found, we're done */
   1628         if ((p_rec = SDP_FindServiceInDb(p_cb->p_disc_db, service_uuid, p_rec)) == NULL)
   1629         {
   1630             break;
   1631         }
   1632 
   1633         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_CLASS_ID_LIST)) != NULL)
   1634         {
   1635             /* find peer features */
   1636             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL))
   1637             {
   1638                 peer_features |= BTA_AV_FEAT_RCCT;
   1639             }
   1640             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REM_CTRL_TARGET, NULL))
   1641             {
   1642                 peer_features |= BTA_AV_FEAT_RCTG;
   1643             }
   1644         }
   1645 
   1646         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST)) != NULL)
   1647         {
   1648             /* get profile version (if failure, version parameter is not updated) */
   1649             SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL, &peer_rc_version);
   1650             APPL_TRACE_DEBUG1("peer_rc_version 0x%x", peer_rc_version);
   1651 
   1652             if (peer_rc_version >= AVRC_REV_1_3)
   1653                 peer_features |= (BTA_AV_FEAT_VENDOR | BTA_AV_FEAT_METADATA);
   1654 
   1655             if (peer_rc_version >= AVRC_REV_1_4)
   1656             {
   1657                 peer_features |= (BTA_AV_FEAT_ADV_CTRL);
   1658                 /* get supported categories */
   1659                 if ((p_attr = SDP_FindAttributeInRec(p_rec,
   1660                                 ATTR_ID_SUPPORTED_FEATURES)) != NULL)
   1661                 {
   1662                     categories = p_attr->attr_value.v.u16;
   1663                     if (categories & AVRC_SUPF_CT_BROWSE)
   1664                         peer_features |= (BTA_AV_FEAT_BROWSE);
   1665                 }
   1666             }
   1667         }
   1668     }
   1669     APPL_TRACE_DEBUG1("peer_features:x%x", peer_features);
   1670     return peer_features;
   1671 }
   1672 
   1673 /*******************************************************************************
   1674 **
   1675 ** Function         bta_av_rc_disc_done
   1676 **
   1677 ** Description      Handle AVRCP service discovery results.  If matching
   1678 **                  service found, open AVRCP connection.
   1679 **
   1680 ** Returns          void
   1681 **
   1682 *******************************************************************************/
   1683 void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
   1684 {
   1685     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1686     tBTA_AV_SCB  *p_scb = NULL;
   1687     tBTA_AV_LCB  *p_lcb;
   1688     tBTA_AV_RC_OPEN rc_open;
   1689     tBTA_AV_RC_FEAT rc_feat;
   1690     UINT8               rc_handle;
   1691     tBTA_AV_FEAT        peer_features;  /* peer features mask */
   1692 
   1693     APPL_TRACE_DEBUG1("bta_av_rc_disc_done disc:x%x", p_cb->disc);
   1694     if (!p_cb->disc)
   1695     {
   1696         return;
   1697     }
   1698 
   1699     if ((p_cb->disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
   1700     {
   1701         /* this is the rc handle/index to tBTA_AV_RCB */
   1702         rc_handle = p_cb->disc & (~BTA_AV_CHNL_MSK);
   1703     }
   1704     else
   1705     {
   1706         p_scb = p_cb->p_scb[(p_cb->disc & BTA_AV_HNDL_MSK) - 1];
   1707         if (p_scb)
   1708             rc_handle = p_scb->rc_handle;
   1709         else
   1710         {
   1711             p_cb->disc = 0;
   1712             return;
   1713         }
   1714     }
   1715 
   1716     APPL_TRACE_DEBUG1("rc_handle %d", rc_handle);
   1717     /* check peer version and whether support CT and TG role */
   1718     peer_features = bta_av_check_peer_features (UUID_SERVCLASS_AV_REMOTE_CONTROL);
   1719     if ((p_cb->features & BTA_AV_FEAT_ADV_CTRL) && ((peer_features&BTA_AV_FEAT_ADV_CTRL) == 0))
   1720     {
   1721         /* if we support advance control and peer does not, check their support on TG role
   1722          * some implementation uses 1.3 on CT ans 1.4 on TG */
   1723         peer_features |= bta_av_check_peer_features (UUID_SERVCLASS_AV_REM_CTRL_TARGET);
   1724     }
   1725 
   1726     p_cb->disc = 0;
   1727     utl_freebuf((void **) &p_cb->p_disc_db);
   1728 
   1729     APPL_TRACE_DEBUG2("peer_features 0x%x, features 0x%x", peer_features, p_cb->features);
   1730 
   1731     /* if we have no rc connection */
   1732     if (rc_handle == BTA_AV_RC_HANDLE_NONE)
   1733     {
   1734         if (p_scb)
   1735         {
   1736             /* if peer remote control service matches ours and USE_RC is TRUE */
   1737             if ((((p_cb->features & BTA_AV_FEAT_RCCT) && (peer_features & BTA_AV_FEAT_RCTG)) ||
   1738                  ((p_cb->features & BTA_AV_FEAT_RCTG) && (peer_features & BTA_AV_FEAT_RCCT))) )
   1739             {
   1740                 p_lcb = bta_av_find_lcb(p_scb->peer_addr, BTA_AV_LCB_FIND);
   1741                 if(p_lcb)
   1742                 {
   1743                     rc_handle = bta_av_rc_create(p_cb, AVCT_INT, (UINT8)(p_scb->hdi + 1), p_lcb->lidx);
   1744                     p_cb->rcb[rc_handle].peer_features = peer_features;
   1745                 }
   1746 #if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
   1747                 else
   1748                 {
   1749                     APPL_TRACE_ERROR0("can not find LCB!!");
   1750                 }
   1751 #endif
   1752             }
   1753             else if(p_scb->use_rc)
   1754             {
   1755                 /* can not find AVRC on peer device. report failure */
   1756                 p_scb->use_rc = FALSE;
   1757                 bdcpy(rc_open.peer_addr, p_scb->peer_addr);
   1758                 rc_open.peer_features = 0;
   1759                 rc_open.status = BTA_AV_FAIL_SDP;
   1760                 (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
   1761             }
   1762         }
   1763     }
   1764     else
   1765     {
   1766         p_cb->rcb[rc_handle].peer_features = peer_features;
   1767         rc_feat.rc_handle =  rc_handle;
   1768         rc_feat.peer_features = peer_features;
   1769         (*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
   1770     }
   1771 }
   1772 
   1773 /*******************************************************************************
   1774 **
   1775 ** Function         bta_av_rc_closed
   1776 **
   1777 ** Description      Set AVRCP state to closed.
   1778 **
   1779 ** Returns          void
   1780 **
   1781 *******************************************************************************/
   1782 void bta_av_rc_closed(tBTA_AV_DATA *p_data)
   1783 {
   1784     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1785     tBTA_AV_RC_CLOSE rc_close;
   1786     tBTA_AV_RC_CONN_CHG *p_msg = (tBTA_AV_RC_CONN_CHG *)p_data;
   1787     tBTA_AV_RCB    *p_rcb;
   1788     tBTA_AV_SCB    *p_scb;
   1789     int i;
   1790     BOOLEAN conn = FALSE;
   1791     tBTA_AV_LCB *p_lcb;
   1792 
   1793     rc_close.rc_handle = BTA_AV_RC_HANDLE_NONE;
   1794     APPL_TRACE_DEBUG1("bta_av_rc_closed rc_handle:%d", p_msg->handle);
   1795     for(i=0; i<BTA_AV_NUM_RCB; i++)
   1796     {
   1797         p_rcb = &p_cb->rcb[i];
   1798         APPL_TRACE_DEBUG3("bta_av_rc_closed rcb[%d] rc_handle:%d, status=0x%x", i, p_rcb->handle, p_rcb->status);
   1799         if(p_rcb->handle == p_msg->handle)
   1800         {
   1801             rc_close.rc_handle = i;
   1802             p_rcb->status &= ~BTA_AV_RC_CONN_MASK;
   1803             p_rcb->peer_features = 0;
   1804             APPL_TRACE_DEBUG2("       shdl:%d, lidx:%d", p_rcb->shdl, p_rcb->lidx);
   1805             if(p_rcb->shdl)
   1806             {
   1807                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
   1808                 if(p_scb)
   1809                 {
   1810                     bdcpy(rc_close.peer_addr, p_scb->peer_addr);
   1811                     if(p_scb->rc_handle == p_rcb->handle)
   1812                         p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
   1813                     APPL_TRACE_DEBUG2("shdl:%d, srch:%d", p_rcb->shdl, p_scb->rc_handle);
   1814                 }
   1815                 p_rcb->shdl = 0;
   1816             }
   1817             else if(p_rcb->lidx == (BTA_AV_NUM_LINKS + 1) )
   1818             {
   1819                 /* if the RCB uses the extra LCB, use the addr for event and clean it */
   1820                 p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
   1821                 bdcpy(rc_close.peer_addr, p_msg->peer_addr);
   1822                 APPL_TRACE_DEBUG6("rc_only closed bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
   1823                               p_msg->peer_addr[0], p_msg->peer_addr[1],
   1824                               p_msg->peer_addr[2], p_msg->peer_addr[3],
   1825                               p_msg->peer_addr[4], p_msg->peer_addr[5]);
   1826                 p_lcb->conn_msk = 0;
   1827                 p_lcb->lidx = 0;
   1828             }
   1829             p_rcb->lidx = 0;
   1830 
   1831             if((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT)
   1832             {
   1833                 /* AVCT CCB is deallocated */
   1834                 p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
   1835                 p_rcb->status = 0;
   1836             }
   1837             else
   1838             {
   1839                 /* AVCT CCB is still there. dealloc */
   1840                 bta_av_del_rc(p_rcb);
   1841 
   1842                 /* if the AVRCP is no longer listening, create the listening channel */
   1843                 if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
   1844                     bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
   1845             }
   1846         }
   1847         else if((p_rcb->handle != BTA_AV_RC_HANDLE_NONE) && (p_rcb->status & BTA_AV_RC_CONN_MASK))
   1848         {
   1849             /* at least one channel is still connected */
   1850             conn = TRUE;
   1851         }
   1852     }
   1853 
   1854     if(!conn)
   1855     {
   1856         /* no AVRC channels are connected, go back to INIT state */
   1857         bta_av_sm_execute(p_cb, BTA_AV_AVRC_NONE_EVT, NULL);
   1858     }
   1859 
   1860     if (rc_close.rc_handle == BTA_AV_RC_HANDLE_NONE)
   1861     {
   1862         rc_close.rc_handle = p_msg->handle;
   1863         bdcpy(rc_close.peer_addr, p_msg->peer_addr);
   1864     }
   1865     (*p_cb->p_cback)(BTA_AV_RC_CLOSE_EVT, (tBTA_AV *) &rc_close);
   1866 }
   1867 
   1868 /*******************************************************************************
   1869 **
   1870 ** Function         bta_av_rc_disc
   1871 **
   1872 ** Description      start AVRC SDP discovery.
   1873 **
   1874 ** Returns          void
   1875 **
   1876 *******************************************************************************/
   1877 void bta_av_rc_disc(UINT8 disc)
   1878 {
   1879     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1880     tAVRC_SDP_DB_PARAMS db_params;
   1881       UINT16              attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST,
   1882                                        ATTR_ID_BT_PROFILE_DESC_LIST,
   1883                                        ATTR_ID_SUPPORTED_FEATURES};
   1884     UINT8       hdi;
   1885     tBTA_AV_SCB *p_scb;
   1886     UINT8       *p_addr = NULL;
   1887     UINT8       rc_handle;
   1888 
   1889     APPL_TRACE_DEBUG2("bta_av_rc_disc 0x%x, %d", disc, bta_av_cb.disc);
   1890     if ((bta_av_cb.disc != 0) || (disc == 0))
   1891         return;
   1892 
   1893     if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
   1894     {
   1895         /* this is the rc handle/index to tBTA_AV_RCB */
   1896         rc_handle = disc & (~BTA_AV_CHNL_MSK);
   1897         if (p_cb->rcb[rc_handle].lidx)
   1898         {
   1899             p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx-1].addr;
   1900         }
   1901     }
   1902     else
   1903     {
   1904         hdi = (disc & BTA_AV_HNDL_MSK) - 1;
   1905         p_scb = p_cb->p_scb[hdi];
   1906 
   1907         if (p_scb)
   1908         {
   1909             APPL_TRACE_DEBUG1("rc_handle %d", p_scb->rc_handle);
   1910             p_addr = p_scb->peer_addr;
   1911         }
   1912     }
   1913 
   1914     if (p_addr)
   1915     {
   1916         /* allocate discovery database */
   1917         if (p_cb->p_disc_db == NULL)
   1918         {
   1919             p_cb->p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(BTA_AV_DISC_BUF_SIZE);
   1920         }
   1921 
   1922         if (p_cb->p_disc_db)
   1923         {
   1924             /* set up parameters */
   1925             db_params.db_len = BTA_AV_DISC_BUF_SIZE;
   1926             db_params.num_attr = 3;
   1927             db_params.p_db = p_cb->p_disc_db;
   1928             db_params.p_attrs = attr_list;
   1929 
   1930             /* searching for UUID_SERVCLASS_AV_REMOTE_CONTROL gets both TG and CT */
   1931             if (AVRC_FindService(UUID_SERVCLASS_AV_REMOTE_CONTROL, p_addr, &db_params,
   1932                             bta_av_avrc_sdp_cback) == AVRC_SUCCESS)
   1933             {
   1934                 p_cb->disc = disc;
   1935                 APPL_TRACE_DEBUG1("disc %d", p_cb->disc);
   1936             }
   1937         }
   1938     }
   1939 }
   1940 
   1941 /*******************************************************************************
   1942 **
   1943 ** Function         bta_av_dereg_comp
   1944 **
   1945 ** Description      deregister complete. free the stream control block.
   1946 **
   1947 ** Returns          void
   1948 **
   1949 *******************************************************************************/
   1950 void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
   1951 {
   1952     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1953     tBTA_AV_SCB  *p_scb;
   1954     tBTA_UTL_COD    cod;
   1955     UINT8   mask;
   1956     BT_HDR  *p_buf;
   1957 
   1958     /* find the stream control block */
   1959     p_scb = bta_av_hndl_to_scb(p_data->hdr.layer_specific);
   1960 
   1961     if(p_scb)
   1962     {
   1963         APPL_TRACE_DEBUG2("deregistered %d(h%d)", p_scb->chnl, p_scb->hndl);
   1964         mask = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
   1965         if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1966         {
   1967             p_cb->reg_audio  &= ~mask;
   1968             if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
   1969             {
   1970                 /* this channel is still marked as open. decrease the count */
   1971                 bta_av_cb.audio_open_cnt--;
   1972             }
   1973             p_cb->conn_audio &= ~mask;
   1974 
   1975             if (p_scb->q_tag == BTA_AV_Q_TAG_STREAM)
   1976             {
   1977             /* make sure no buffers are in q_info.a2d */
   1978             while((p_buf = (BT_HDR*)GKI_dequeue (&p_scb->q_info.a2d)) != NULL)
   1979                 GKI_freebuf(p_buf);
   1980             }
   1981 
   1982             /* remove the A2DP SDP record, if no more audio stream is left */
   1983             if(!p_cb->reg_audio)
   1984             {
   1985 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   1986                 bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REMOTE_CONTROL, BTA_ID_AV);
   1987 #endif
   1988                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_handle);
   1989                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
   1990             }
   1991         }
   1992         else
   1993         {
   1994             p_cb->reg_video  &= ~mask;
   1995             /* make sure that this channel is not connected */
   1996             p_cb->conn_video &= ~mask;
   1997             /* remove the VDP SDP record, (only one video stream at most) */
   1998             bta_av_del_sdp_rec(&p_cb->sdp_vdp_handle);
   1999             bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
   2000         }
   2001 
   2002         /* make sure that the timer is not active */
   2003         bta_sys_stop_timer(&p_scb->timer);
   2004         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
   2005     }
   2006 
   2007     APPL_TRACE_DEBUG3("audio 0x%x, video: 0x%x, disable:%d",
   2008         p_cb->reg_audio, p_cb->reg_video, p_cb->disabling);
   2009     /* if no stream control block is active */
   2010     if((p_cb->reg_audio + p_cb->reg_video) == 0)
   2011     {
   2012 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   2013         /* deregister from AVDT */
   2014         bta_ar_dereg_avdt(BTA_ID_AV);
   2015 
   2016         /* deregister from AVCT */
   2017         bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REM_CTRL_TARGET, BTA_ID_AV);
   2018         bta_ar_dereg_avct(BTA_ID_AV);
   2019 #endif
   2020 
   2021         if(p_cb->disabling)
   2022         {
   2023             p_cb->disabling     = FALSE;
   2024             bta_av_cb.features  = 0;
   2025         }
   2026 
   2027         /* Clear the Capturing service class bit */
   2028         cod.service = BTM_COD_SERVICE_CAPTURING;
   2029         utl_set_device_class(&cod, BTA_UTL_CLR_COD_SERVICE_CLASS);
   2030     }
   2031 }
   2032 #endif /* BTA_AV_INCLUDED */
   2033