Home | History | Annotate | Download | only in av
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains action functions for advanced audio/video main state
     22  *  machine.
     23  *
     24  ******************************************************************************/
     25 
     26 #include "bt_target.h"
     27 #if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE)
     28 
     29 #include <string.h>
     30 #include "bta_av_api.h"
     31 #include "bta_av_int.h"
     32 #include "avdt_api.h"
     33 #include "bd.h"
     34 #include "utl.h"
     35 #include "l2c_api.h"
     36 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
     37 #include "bta_ar_api.h"
     38 #endif
     39 
     40 /*****************************************************************************
     41 **  Constants
     42 *****************************************************************************/
     43 /* the timer in milliseconds to wait for open req after setconfig for incoming connections */
     44 #ifndef BTA_AV_SIG_TIME_VAL
     45 #define BTA_AV_SIG_TIME_VAL 8000
     46 #endif
     47 
     48 /* In millisec to wait for signalling from SNK when it is initiated from SNK.   */
     49 /* If not, we will start signalling from SRC.                                   */
     50 #ifndef BTA_AV_ACP_SIG_TIME_VAL
     51 #define BTA_AV_ACP_SIG_TIME_VAL 2000
     52 #endif
     53 
     54 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle);
     55 
     56 /*******************************************************************************
     57 **
     58 ** Function         bta_av_get_rcb_by_shdl
     59 **
     60 ** Description      find the RCB associated with the given SCB handle.
     61 **
     62 ** Returns          tBTA_AV_RCB
     63 **
     64 *******************************************************************************/
     65 tBTA_AV_RCB * bta_av_get_rcb_by_shdl(UINT8 shdl)
     66 {
     67     tBTA_AV_RCB *p_rcb = NULL;
     68     int         i;
     69 
     70     for (i=0; i<BTA_AV_NUM_RCB; i++)
     71     {
     72         if (bta_av_cb.rcb[i].shdl == shdl && bta_av_cb.rcb[i].handle != BTA_AV_RC_HANDLE_NONE)
     73         {
     74             p_rcb = &bta_av_cb.rcb[i];
     75             break;
     76         }
     77     }
     78     return p_rcb;
     79 }
     80 #define BTA_AV_STS_NO_RSP       0xFF    /* a number not used by tAVRC_STS */
     81 
     82 /*******************************************************************************
     83 **
     84 ** Function         bta_av_del_rc
     85 **
     86 ** Description      delete the given AVRC handle.
     87 **
     88 ** Returns          void
     89 **
     90 *******************************************************************************/
     91 void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
     92 {
     93     tBTA_AV_SCB  *p_scb;
     94     UINT8        rc_handle;      /* connected AVRCP handle */
     95 
     96     if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
     97     {
     98         if(p_rcb->shdl)
     99         {
    100             p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
    101             if(p_scb)
    102             {
    103                 APPL_TRACE_DEBUG("bta_av_del_rc shdl:%d, srch:%d rc_handle:%d", p_rcb->shdl,
    104                                   p_scb->rc_handle, p_rcb->handle);
    105                 if(p_scb->rc_handle == p_rcb->handle)
    106                     p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
    107                 /* just in case the RC timer is active
    108                 if(bta_av_cb.features & BTA_AV_FEAT_RCCT && p_scb->chnl == BTA_AV_CHNL_AUDIO) */
    109                     bta_sys_stop_timer(&p_scb->timer);
    110             }
    111         }
    112 
    113         APPL_TRACE_EVENT("bta_av_del_rc  handle: %d status=0x%x, rc_acp_handle:%d, idx:%d",
    114             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, bta_av_cb.rc_acp_idx);
    115         rc_handle = p_rcb->handle;
    116         if(!(p_rcb->status & BTA_AV_RC_CONN_MASK) ||
    117             ((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT) )
    118         {
    119             p_rcb->status = 0;
    120             p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
    121             p_rcb->shdl = 0;
    122             p_rcb->lidx = 0;
    123         }
    124         /* else ACP && connected. do not clear the handle yet */
    125         AVRC_Close(rc_handle);
    126         if (rc_handle == bta_av_cb.rc_acp_handle)
    127             bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
    128         APPL_TRACE_EVENT("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
    129             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
    130     }
    131 }
    132 
    133 
    134 /*******************************************************************************
    135 **
    136 ** Function         bta_av_close_all_rc
    137 **
    138 ** Description      close the all AVRC handle.
    139 **
    140 ** Returns          void
    141 **
    142 *******************************************************************************/
    143 static void bta_av_close_all_rc(tBTA_AV_CB *p_cb)
    144 {
    145     int i;
    146 
    147     for(i=0; i<BTA_AV_NUM_RCB; i++)
    148     {
    149         if ((p_cb->disabling == TRUE) || (bta_av_cb.rcb[i].shdl != 0))
    150             bta_av_del_rc(&bta_av_cb.rcb[i]);
    151     }
    152 }
    153 
    154 /*******************************************************************************
    155 **
    156 ** Function         bta_av_del_sdp_rec
    157 **
    158 ** Description      delete the given SDP record handle.
    159 **
    160 ** Returns          void
    161 **
    162 *******************************************************************************/
    163 static void bta_av_del_sdp_rec(UINT32 *p_sdp_handle)
    164 {
    165     if(*p_sdp_handle != 0)
    166     {
    167         SDP_DeleteRecord(*p_sdp_handle);
    168         *p_sdp_handle = 0;
    169     }
    170 }
    171 
    172 /*******************************************************************************
    173 **
    174 ** Function         bta_av_avrc_sdp_cback
    175 **
    176 ** Description      AVRCP service discovery callback.
    177 **
    178 ** Returns          void
    179 **
    180 *******************************************************************************/
    181 static void bta_av_avrc_sdp_cback(UINT16 status)
    182 {
    183     BT_HDR *p_msg;
    184     UNUSED(status);
    185 
    186     if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
    187     {
    188         p_msg->event = BTA_AV_SDP_AVRC_DISC_EVT;
    189         bta_sys_sendmsg(p_msg);
    190     }
    191 }
    192 
    193 /*******************************************************************************
    194 **
    195 ** Function         bta_av_rc_ctrl_cback
    196 **
    197 ** Description      AVRCP control callback.
    198 **
    199 ** Returns          void
    200 **
    201 *******************************************************************************/
    202 static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_ADDR peer_addr)
    203 {
    204     tBTA_AV_RC_CONN_CHG *p_msg;
    205     UINT16 msg_event = 0;
    206     UNUSED(result);
    207 
    208 #if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
    209     APPL_TRACE_EVENT("rc_ctrl handle: %d event=0x%x", handle, event);
    210 #else
    211     APPL_TRACE_EVENT("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
    212 #endif
    213     if (event == AVRC_OPEN_IND_EVT)
    214     {
    215         /* save handle of opened connection
    216         bta_av_cb.rc_handle = handle;*/
    217 
    218         msg_event = BTA_AV_AVRC_OPEN_EVT;
    219     }
    220     else if (event == AVRC_CLOSE_IND_EVT)
    221     {
    222         msg_event = BTA_AV_AVRC_CLOSE_EVT;
    223     }
    224 
    225     if (msg_event)
    226     {
    227         if ((p_msg = (tBTA_AV_RC_CONN_CHG *) GKI_getbuf(sizeof(tBTA_AV_RC_CONN_CHG))) != NULL)
    228         {
    229             p_msg->hdr.event = msg_event;
    230             p_msg->handle    = handle;
    231             if(peer_addr)
    232                 bdcpy(p_msg->peer_addr, peer_addr);
    233             bta_sys_sendmsg(p_msg);
    234         }
    235     }
    236 }
    237 
    238 /*******************************************************************************
    239 **
    240 ** Function         bta_av_rc_msg_cback
    241 **
    242 ** Description      AVRCP message callback.
    243 **
    244 ** Returns          void
    245 **
    246 *******************************************************************************/
    247 static void bta_av_rc_msg_cback(UINT8 handle, UINT8 label, UINT8 opcode, tAVRC_MSG *p_msg)
    248 {
    249     tBTA_AV_RC_MSG  *p_buf;
    250     UINT8           *p_data = NULL;
    251     UINT8           **p_p_data = NULL;
    252     UINT16          data_len = 0;
    253 
    254 #if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
    255     APPL_TRACE_ERROR("rc_msg handle: %d opcode=0x%x", handle, opcode);
    256 #else
    257     APPL_TRACE_EVENT("bta_av_rc_msg_cback handle: %d opcode=0x%x", handle, opcode);
    258 #endif
    259     /* determine size of buffer we need */
    260     if (opcode == AVRC_OP_VENDOR && p_msg->vendor.p_vendor_data != NULL)
    261     {
    262         p_data = p_msg->vendor.p_vendor_data;
    263         p_p_data = &p_msg->vendor.p_vendor_data;
    264         data_len = (UINT16) p_msg->vendor.vendor_len;
    265     }
    266     else if (opcode == AVRC_OP_PASS_THRU && p_msg->pass.p_pass_data != NULL)
    267     {
    268         p_data = p_msg->pass.p_pass_data;
    269         p_p_data = &p_msg->pass.p_pass_data;
    270         data_len = (UINT16) p_msg->pass.pass_len;
    271     }
    272 
    273     if ((p_buf = (tBTA_AV_RC_MSG *) GKI_getbuf((UINT16) (sizeof(tBTA_AV_RC_MSG) + data_len))) != NULL)
    274     {
    275         p_buf->hdr.event = BTA_AV_AVRC_MSG_EVT;
    276         p_buf->handle = handle;
    277         p_buf->label = label;
    278         p_buf->opcode = opcode;
    279         memcpy(&p_buf->msg, p_msg, sizeof(tAVRC_MSG));
    280         if (p_data != NULL)
    281         {
    282             memcpy((UINT8 *)(p_buf + 1), p_data, data_len);
    283             *p_p_data = (UINT8 *)(p_buf + 1);
    284         }
    285         bta_sys_sendmsg(p_buf);
    286     }
    287 }
    288 
    289 /*******************************************************************************
    290 **
    291 ** Function         bta_av_rc_create
    292 **
    293 ** Description      alloc RCB and call AVRC_Open
    294 **
    295 ** Returns          the created rc handle
    296 **
    297 *******************************************************************************/
    298 UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
    299 {
    300     tAVRC_CONN_CB ccb;
    301     BD_ADDR_PTR   bda = (BD_ADDR_PTR)bd_addr_any;
    302     UINT8         status = BTA_AV_RC_ROLE_ACP;
    303     tBTA_AV_SCB  *p_scb = p_cb->p_scb[shdl - 1];
    304     int i;
    305     UINT8   rc_handle;
    306     tBTA_AV_RCB *p_rcb;
    307 
    308     if(role == AVCT_INT)
    309     {
    310         bda = p_scb->peer_addr;
    311         status = BTA_AV_RC_ROLE_INT;
    312     }
    313     else
    314     {
    315         if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL )
    316         {
    317             APPL_TRACE_ERROR("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
    318             return p_rcb->handle;
    319         }
    320     }
    321 
    322     ccb.p_ctrl_cback = bta_av_rc_ctrl_cback;
    323     ccb.p_msg_cback = bta_av_rc_msg_cback;
    324     ccb.company_id = p_bta_av_cfg->company_id;
    325     ccb.conn = role;
    326     /* note: BTA_AV_FEAT_RCTG = AVRC_CT_TARGET, BTA_AV_FEAT_RCCT = AVRC_CT_CONTROL */
    327     ccb.control = p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_RCCT | AVRC_CT_PASSIVE);
    328 
    329 
    330     if (AVRC_Open(&rc_handle, &ccb, bda) != AVRC_SUCCESS)
    331         return BTA_AV_RC_HANDLE_NONE;
    332 
    333     i = rc_handle;
    334     p_rcb = &p_cb->rcb[i];
    335 
    336     if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
    337     {
    338         APPL_TRACE_ERROR("bta_av_rc_create found duplicated handle:%d", rc_handle);
    339     }
    340 
    341     p_rcb->handle = rc_handle;
    342     p_rcb->status = status;
    343     p_rcb->shdl = shdl;
    344     p_rcb->lidx = lidx;
    345     p_rcb->peer_features = 0;
    346     if(lidx == (BTA_AV_NUM_LINKS + 1))
    347     {
    348         /* this LIDX is reserved for the AVRCP ACP connection */
    349         p_cb->rc_acp_handle = p_rcb->handle;
    350         p_cb->rc_acp_idx = (i + 1);
    351         APPL_TRACE_DEBUG("rc_acp_handle:%d idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
    352     }
    353     APPL_TRACE_DEBUG("create %d, role: %d, shdl:%d, rc_handle:%d, lidx:%d, status:0x%x",
    354         i, role, shdl, p_rcb->handle, lidx, p_rcb->status);
    355 
    356     return rc_handle;
    357 }
    358 
    359 /*******************************************************************************
    360 **
    361 ** Function         bta_av_valid_group_navi_msg
    362 **
    363 ** Description      Check if it is Group Navigation Msg for Metadata
    364 **
    365 ** Returns          BTA_AV_RSP_ACCEPT or BTA_AV_RSP_NOT_IMPL.
    366 **
    367 *******************************************************************************/
    368 static tBTA_AV_CODE bta_av_group_navi_supported(UINT8 len, UINT8 *p_data, BOOLEAN is_inquiry)
    369 {
    370     tBTA_AV_CODE ret=BTA_AV_RSP_NOT_IMPL;
    371     UINT8 *p_ptr = p_data;
    372     UINT16 u16;
    373     UINT32 u32;
    374 
    375     if (p_bta_av_cfg->avrc_group && len == BTA_GROUP_NAVI_MSG_OP_DATA_LEN)
    376     {
    377         BTA_AV_BE_STREAM_TO_CO_ID(u32, p_ptr);
    378         BE_STREAM_TO_UINT16(u16, p_ptr);
    379 
    380         if (u32 == AVRC_CO_METADATA)
    381         {
    382             if (is_inquiry)
    383             {
    384                 if (u16 <= AVRC_PDU_PREV_GROUP)
    385                     ret = BTA_AV_RSP_IMPL_STBL;
    386             }
    387             else
    388             {
    389                 if (u16 <= AVRC_PDU_PREV_GROUP)
    390                     ret = BTA_AV_RSP_ACCEPT;
    391                 else
    392                     ret = BTA_AV_RSP_REJ;
    393             }
    394         }
    395     }
    396 
    397     return ret;
    398 }
    399 
    400 /*******************************************************************************
    401 **
    402 ** Function         bta_av_op_supported
    403 **
    404 ** Description      Check if remote control operation is supported.
    405 **
    406 ** Returns          BTA_AV_RSP_ACCEPT of supported, BTA_AV_RSP_NOT_IMPL if not.
    407 **
    408 *******************************************************************************/
    409 static tBTA_AV_CODE bta_av_op_supported(tBTA_AV_RC rc_id, BOOLEAN is_inquiry)
    410 {
    411     tBTA_AV_CODE ret_code = BTA_AV_RSP_NOT_IMPL;
    412 
    413     if (p_bta_av_rc_id)
    414     {
    415         if (is_inquiry)
    416         {
    417             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    418             {
    419                 ret_code = BTA_AV_RSP_IMPL_STBL;
    420             }
    421         }
    422         else
    423         {
    424             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    425             {
    426                 ret_code = BTA_AV_RSP_ACCEPT;
    427             }
    428             else if ((p_bta_av_cfg->rc_pass_rsp == BTA_AV_RSP_INTERIM) && p_bta_av_rc_id_ac)
    429             {
    430                 if (p_bta_av_rc_id_ac[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    431                 {
    432                     ret_code = BTA_AV_RSP_INTERIM;
    433                 }
    434             }
    435         }
    436 
    437     }
    438     return ret_code;
    439 }
    440 
    441 /*******************************************************************************
    442 **
    443 ** Function         bta_av_find_lcb
    444 **
    445 ** Description      Given BD_addr, find the associated LCB.
    446 **
    447 ** Returns          NULL, if not found.
    448 **
    449 *******************************************************************************/
    450 tBTA_AV_LCB * bta_av_find_lcb(BD_ADDR addr, UINT8 op)
    451 {
    452     tBTA_AV_CB   *p_cb = &bta_av_cb;
    453     int     xx;
    454     UINT8   mask;
    455     tBTA_AV_LCB *p_lcb = NULL;
    456 
    457     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
    458     {
    459         mask = 1 << xx; /* the used mask for this lcb */
    460         if((mask & p_cb->conn_lcb) && 0 ==( bdcmp(p_cb->lcb[xx].addr, addr)))
    461         {
    462             p_lcb = &p_cb->lcb[xx];
    463             if(op == BTA_AV_LCB_FREE)
    464             {
    465                 p_cb->conn_lcb &= ~mask; /* clear the connect mask */
    466                 APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
    467             }
    468             break;
    469         }
    470     }
    471     return p_lcb;
    472 }
    473 
    474 /*******************************************************************************
    475 **
    476 ** Function         bta_av_rc_opened
    477 **
    478 ** Description      Set AVRCP state to opened.
    479 **
    480 ** Returns          void
    481 **
    482 *******************************************************************************/
    483 void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    484 {
    485     tBTA_AV_RC_OPEN rc_open;
    486     tBTA_AV_SCB     *p_scb;
    487     int         i;
    488     UINT8       shdl = 0;
    489     tBTA_AV_LCB *p_lcb;
    490     tBTA_AV_RCB *p_rcb;
    491     UINT8       tmp;
    492     UINT8       disc = 0;
    493 
    494     /* find the SCB & stop the timer */
    495     for(i=0; i<BTA_AV_NUM_STRS; i++)
    496     {
    497         p_scb = p_cb->p_scb[i];
    498         if(p_scb && bdcmp(p_scb->peer_addr, p_data->rc_conn_chg.peer_addr) == 0)
    499         {
    500             p_scb->rc_handle = p_data->rc_conn_chg.handle;
    501             APPL_TRACE_DEBUG("bta_av_rc_opened shdl:%d, srch %d", i + 1, p_scb->rc_handle);
    502             shdl = i+1;
    503             APPL_TRACE_ERROR("use_rc:%d", p_scb->use_rc);
    504             bta_sys_stop_timer(&p_scb->timer);
    505             disc = p_scb->hndl;
    506             break;
    507         }
    508     }
    509 
    510     i = p_data->rc_conn_chg.handle;
    511     if (p_cb->rcb[i].handle == BTA_AV_RC_HANDLE_NONE)
    512     {
    513         APPL_TRACE_ERROR("not a valid handle:%d any more", i);
    514         return;
    515     }
    516 
    517 
    518     if (p_cb->rcb[i].lidx == (BTA_AV_NUM_LINKS + 1) && shdl != 0)
    519     {
    520         /* rc is opened on the RC only ACP channel, but is for a specific
    521          * SCB -> need to switch RCBs */
    522         p_rcb = bta_av_get_rcb_by_shdl(shdl);
    523         if (p_rcb)
    524         {
    525             p_rcb->shdl = p_cb->rcb[i].shdl;
    526             tmp         = p_rcb->lidx;
    527             p_rcb->lidx = p_cb->rcb[i].lidx;
    528             p_cb->rcb[i].lidx = tmp;
    529             p_cb->rc_acp_handle = p_rcb->handle;
    530             p_cb->rc_acp_idx = (p_rcb - p_cb->rcb) + 1;
    531             APPL_TRACE_DEBUG("switching RCB rc_acp_handle:%d idx:%d",
    532                                p_cb->rc_acp_handle, p_cb->rc_acp_idx);
    533         }
    534     }
    535 
    536     p_cb->rcb[i].shdl = shdl;
    537     rc_open.rc_handle = i;
    538     APPL_TRACE_ERROR("bta_av_rc_opened rcb[%d] shdl:%d lidx:%d/%d",
    539             i, shdl, p_cb->rcb[i].lidx, p_cb->lcb[BTA_AV_NUM_LINKS].lidx);
    540     p_cb->rcb[i].status |= BTA_AV_RC_CONN_MASK;
    541 
    542     if(!shdl && 0 == p_cb->lcb[BTA_AV_NUM_LINKS].lidx)
    543     {
    544         /* no associated SCB -> connected to an RC only device
    545          * update the index to the extra LCB */
    546         p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
    547         bdcpy(p_lcb->addr, p_data->rc_conn_chg.peer_addr);
    548         APPL_TRACE_DEBUG("rc_only bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
    549                       p_lcb->addr[0], p_lcb->addr[1],
    550                       p_lcb->addr[2], p_lcb->addr[3],
    551                       p_lcb->addr[4], p_lcb->addr[5]);
    552         p_lcb->lidx = BTA_AV_NUM_LINKS + 1;
    553             p_cb->rcb[i].lidx = p_lcb->lidx;
    554         p_lcb->conn_msk = 1;
    555         APPL_TRACE_ERROR("rcb[%d].lidx=%d, lcb.conn_msk=x%x",
    556             i, p_cb->rcb[i].lidx, p_lcb->conn_msk);
    557         disc = p_data->rc_conn_chg.handle|BTA_AV_CHNL_MSK;
    558     }
    559 
    560     bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
    561     rc_open.peer_features = p_cb->rcb[i].peer_features;
    562     rc_open.status = BTA_AV_SUCCESS;
    563     APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
    564                       rc_open.peer_features);
    565     if(rc_open.peer_features == 0)
    566     {
    567         /* we have not done SDP on peer RC capabilities.
    568          * peer must have initiated the RC connection */
    569         rc_open.peer_features = BTA_AV_FEAT_RCCT;
    570         bta_av_rc_disc(disc);
    571     }
    572     (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
    573 
    574 }
    575 
    576 
    577 /*******************************************************************************
    578 **
    579 ** Function         bta_av_rc_remote_cmd
    580 **
    581 ** Description      Send an AVRCP remote control command.
    582 **
    583 ** Returns          void
    584 **
    585 *******************************************************************************/
    586 void bta_av_rc_remote_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    587 {
    588     tBTA_AV_RCB    *p_rcb;
    589     if (p_cb->features & BTA_AV_FEAT_RCCT)
    590     {
    591         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    592         {
    593             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    594             if(p_rcb->status & BTA_AV_RC_CONN_MASK)
    595             {
    596                 AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
    597                      &p_data->api_remote_cmd.msg);
    598             }
    599         }
    600     }
    601 }
    602 
    603 /*******************************************************************************
    604 **
    605 ** Function         bta_av_rc_vendor_cmd
    606 **
    607 ** Description      Send an AVRCP vendor specific command.
    608 **
    609 ** Returns          void
    610 **
    611 *******************************************************************************/
    612 void bta_av_rc_vendor_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    613 {
    614     tBTA_AV_RCB    *p_rcb;
    615     if ( (p_cb->features & (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR)) ==
    616          (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR))
    617     {
    618         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    619         {
    620             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    621             AVRC_VendorCmd(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
    622         }
    623     }
    624 }
    625 
    626 /*******************************************************************************
    627 **
    628 ** Function         bta_av_rc_vendor_rsp
    629 **
    630 ** Description      Send an AVRCP vendor specific response.
    631 **
    632 ** Returns          void
    633 **
    634 *******************************************************************************/
    635 void bta_av_rc_vendor_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    636 {
    637     tBTA_AV_RCB    *p_rcb;
    638     if ( (p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
    639          (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR))
    640     {
    641         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    642         {
    643             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    644             AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
    645         }
    646     }
    647 }
    648 
    649 /*******************************************************************************
    650 **
    651 ** Function         bta_av_rc_meta_rsp
    652 **
    653 ** Description      Send an AVRCP metadata/advanced control command/response.
    654 **
    655 ** Returns          void
    656 **
    657 *******************************************************************************/
    658 void bta_av_rc_meta_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    659 {
    660     tBTA_AV_RCB *p_rcb;
    661     BOOLEAN         free = TRUE;
    662 
    663     if ((p_cb->features & BTA_AV_FEAT_METADATA) && (p_data->hdr.layer_specific < BTA_AV_NUM_RCB))
    664     {
    665         if ((p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCTG)) ||
    666             (!p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCCT)) )
    667         {
    668             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    669             if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE) {
    670                 AVRC_MsgReq(p_rcb->handle, p_data->api_meta_rsp.label,
    671                             p_data->api_meta_rsp.rsp_code,
    672                             p_data->api_meta_rsp.p_pkt);
    673                 free = FALSE;
    674             }
    675         }
    676     }
    677 
    678     if (free)
    679         GKI_freebuf (p_data->api_meta_rsp.p_pkt);
    680 }
    681 
    682 /*******************************************************************************
    683 **
    684 ** Function         bta_av_rc_free_rsp
    685 **
    686 ** Description      free an AVRCP metadata command buffer.
    687 **
    688 ** Returns          void
    689 **
    690 *******************************************************************************/
    691 void bta_av_rc_free_rsp (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    692 {
    693     UNUSED(p_cb);
    694 
    695     GKI_freebuf (p_data->api_meta_rsp.p_pkt);
    696 }
    697 
    698 /*******************************************************************************
    699 **
    700 ** Function         bta_av_rc_meta_req
    701 **
    702 ** Description      Send an AVRCP metadata command.
    703 **
    704 ** Returns          void
    705 **
    706 *******************************************************************************/
    707 void bta_av_rc_free_msg (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    708 {
    709     UNUSED(p_cb);
    710     UNUSED(p_data);
    711 }
    712 
    713 
    714 
    715 /*******************************************************************************
    716 **
    717 ** Function         bta_av_chk_notif_evt_id
    718 **
    719 ** Description      make sure the requested player id is valid.
    720 **
    721 ** Returns          BTA_AV_STS_NO_RSP, if no error
    722 **
    723 *******************************************************************************/
    724 static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
    725 {
    726     tAVRC_STS   status = BTA_AV_STS_NO_RSP;
    727     UINT8       xx;
    728     UINT16      u16;
    729     UINT8       *p = p_vendor->p_vendor_data + 2;
    730 
    731     BE_STREAM_TO_UINT16 (u16, p);
    732     /* double check the fixed length */
    733     if ((u16 != 5) || (p_vendor->vendor_len != 9))
    734     {
    735         status = AVRC_STS_INTERNAL_ERR;
    736     }
    737     else
    738     {
    739         /* make sure the player_id is valid */
    740         for (xx=0; xx<p_bta_av_cfg->num_evt_ids; xx++)
    741         {
    742             if (*p == p_bta_av_cfg->p_meta_evt_ids[xx])
    743             {
    744                 break;
    745             }
    746         }
    747         if (xx == p_bta_av_cfg->num_evt_ids)
    748         {
    749             status = AVRC_STS_BAD_PARAM;
    750         }
    751     }
    752 
    753     return status;
    754 }
    755 
    756 /*******************************************************************************
    757 **
    758 ** Function         bta_av_proc_meta_cmd
    759 **
    760 ** Description      Process an AVRCP metadata command from the peer.
    761 **
    762 ** Returns          TRUE to respond immediately
    763 **
    764 *******************************************************************************/
    765 tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE  *p_rc_rsp, tBTA_AV_RC_MSG *p_msg, UINT8 *p_ctype)
    766 {
    767     tBTA_AV_EVT evt = BTA_AV_META_MSG_EVT;
    768     UINT8       u8, pdu, *p;
    769     UINT16      u16;
    770     tAVRC_MSG_VENDOR    *p_vendor = &p_msg->msg.vendor;
    771 
    772 #if (AVRC_METADATA_INCLUDED == TRUE)
    773 
    774     pdu = *(p_vendor->p_vendor_data);
    775     p_rc_rsp->pdu = pdu;
    776     *p_ctype = AVRC_RSP_REJ;
    777     /* Metadata messages only use PANEL sub-unit type */
    778     if (p_vendor->hdr.subunit_type != AVRC_SUB_PANEL)
    779     {
    780         APPL_TRACE_DEBUG("SUBUNIT must be PANEL");
    781         /* reject it */
    782         evt=0;
    783         p_vendor->hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    784         AVRC_VendorRsp(p_msg->handle, p_msg->label, &p_msg->msg.vendor);
    785     }
    786     else if (!AVRC_IsValidAvcType(pdu, p_vendor->hdr.ctype) )
    787     {
    788         APPL_TRACE_DEBUG("Invalid pdu/ctype: 0x%x, %d", pdu, p_vendor->hdr.ctype);
    789         /* reject invalid message without reporting to app */
    790         evt = 0;
    791         p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
    792     }
    793     else
    794     {
    795         switch (pdu)
    796         {
    797         case AVRC_PDU_GET_CAPABILITIES:
    798             /* process GetCapabilities command without reporting the event to app */
    799             evt = 0;
    800             u8 = *(p_vendor->p_vendor_data + 4);
    801             p = p_vendor->p_vendor_data + 2;
    802             p_rc_rsp->get_caps.capability_id = u8;
    803             BE_STREAM_TO_UINT16 (u16, p);
    804             if ((u16 != 1) || (p_vendor->vendor_len != 5))
    805             {
    806                 p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
    807             }
    808             else
    809             {
    810                 p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;
    811                 if (u8 == AVRC_CAP_COMPANY_ID)
    812                 {
    813                     *p_ctype = AVRC_RSP_IMPL_STBL;
    814                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_co_ids;
    815                     memcpy(p_rc_rsp->get_caps.param.company_id, p_bta_av_cfg->p_meta_co_ids,
    816                            (p_bta_av_cfg->num_co_ids << 2));
    817                 }
    818                 else if (u8 == AVRC_CAP_EVENTS_SUPPORTED)
    819                 {
    820                     *p_ctype = AVRC_RSP_IMPL_STBL;
    821                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_evt_ids;
    822                     memcpy(p_rc_rsp->get_caps.param.event_id, p_bta_av_cfg->p_meta_evt_ids,
    823                            p_bta_av_cfg->num_evt_ids);
    824                 }
    825                 else
    826                 {
    827                     APPL_TRACE_DEBUG("Invalid capability ID: 0x%x", u8);
    828                     /* reject - unknown capability ID */
    829                     p_rc_rsp->get_caps.status = AVRC_STS_BAD_PARAM;
    830                 }
    831             }
    832             break;
    833 
    834 
    835         case AVRC_PDU_REGISTER_NOTIFICATION:
    836             /* make sure the event_id is implemented */
    837             p_rc_rsp->rsp.status = bta_av_chk_notif_evt_id (p_vendor);
    838             if (p_rc_rsp->rsp.status != BTA_AV_STS_NO_RSP)
    839                 evt = 0;
    840             break;
    841 
    842         }
    843     }
    844 #else
    845     APPL_TRACE_DEBUG("AVRCP 1.3 Metadata not supporteed. Reject command.");
    846     /* reject invalid message without reporting to app */
    847     evt = 0;
    848     p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
    849 #endif
    850 
    851     return evt;
    852 }
    853 
    854 
    855 /*******************************************************************************
    856 **
    857 ** Function         bta_av_rc_msg
    858 **
    859 ** Description      Process an AVRCP message from the peer.
    860 **
    861 ** Returns          void
    862 **
    863 *******************************************************************************/
    864 void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    865 {
    866     tBTA_AV_EVT evt = 0;
    867     tBTA_AV     av;
    868     BT_HDR      *p_pkt = NULL;
    869     tAVRC_MSG_VENDOR    *p_vendor = &p_data->rc_msg.msg.vendor;
    870     BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
    871 #if (AVRC_METADATA_INCLUDED == TRUE)
    872     tAVRC_STS   res;
    873     UINT8       ctype = 0;
    874     tAVRC_RESPONSE  rc_rsp;
    875 
    876     rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
    877 #endif
    878 
    879     if (p_data->rc_msg.opcode == AVRC_OP_PASS_THRU)
    880     {
    881     /* if this is a pass thru command */
    882         if ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_CTRL) ||
    883             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) ||
    884             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ)
    885             )
    886         {
    887         /* check if operation is supported */
    888             if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR)
    889             {
    890                 p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    891 #if (AVRC_METADATA_INCLUDED == TRUE)
    892                 if (p_cb->features & BTA_AV_FEAT_METADATA)
    893                     p_data->rc_msg.msg.hdr.ctype =
    894                         bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
    895                         p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
    896 #endif
    897             }
    898             else
    899             {
    900                 p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
    901             }
    902 
    903             APPL_TRACE_DEBUG("ctype %d",p_data->rc_msg.msg.hdr.ctype)
    904 
    905             /* send response */
    906             if (p_data->rc_msg.msg.hdr.ctype != BTA_AV_RSP_INTERIM)
    907                 AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
    908 
    909             /* set up for callback if supported */
    910             if (p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_ACCEPT || p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_INTERIM)
    911             {
    912                 evt = BTA_AV_REMOTE_CMD_EVT;
    913                 av.remote_cmd.rc_id = p_data->rc_msg.msg.pass.op_id;
    914                 av.remote_cmd.key_state = p_data->rc_msg.msg.pass.state;
    915                 av.remote_cmd.p_data = p_data->rc_msg.msg.pass.p_pass_data;
    916                 av.remote_cmd.len = p_data->rc_msg.msg.pass.pass_len;
    917                 memcpy(&av.remote_cmd.hdr, &p_data->rc_msg.msg.hdr, sizeof (tAVRC_HDR));
    918                 av.remote_cmd.label = p_data->rc_msg.label;
    919             }
    920         }
    921         /* else if this is a pass thru response */
    922         else if (p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
    923         {
    924             /* set up for callback */
    925             evt = BTA_AV_REMOTE_RSP_EVT;
    926             av.remote_rsp.rc_id = p_data->rc_msg.msg.pass.op_id;
    927             av.remote_rsp.key_state = p_data->rc_msg.msg.pass.state;
    928             av.remote_rsp.rsp_code = p_data->rc_msg.msg.hdr.ctype;
    929             av.remote_rsp.label = p_data->rc_msg.label;
    930         }
    931         /* must be a bad ctype -> reject*/
    932         else
    933         {
    934             p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
    935             AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
    936         }
    937     }
    938     /* else if this is a vendor specific command or response */
    939     else if (p_data->rc_msg.opcode == AVRC_OP_VENDOR)
    940     {
    941         /* set up for callback */
    942         av.vendor_cmd.code = p_data->rc_msg.msg.hdr.ctype;
    943         av.vendor_cmd.company_id = p_vendor->company_id;
    944         av.vendor_cmd.label = p_data->rc_msg.label;
    945         av.vendor_cmd.p_data = p_vendor->p_vendor_data;
    946         av.vendor_cmd.len = p_vendor->vendor_len;
    947 
    948         /* if configured to support vendor specific and it's a command */
    949         if ((p_cb->features & BTA_AV_FEAT_VENDOR)  &&
    950             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
    951         {
    952 #if (AVRC_METADATA_INCLUDED == TRUE)
    953             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
    954                (p_vendor->company_id == AVRC_CO_METADATA))
    955             {
    956                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
    957                 evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
    958             }
    959             else
    960 #endif
    961                 evt = BTA_AV_VENDOR_CMD_EVT;
    962         }
    963         /* else if configured to support vendor specific and it's a response */
    964         else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
    965                  p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
    966         {
    967 #if (AVRC_METADATA_INCLUDED == TRUE)
    968             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
    969                (p_vendor->company_id == AVRC_CO_METADATA))
    970             {
    971                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
    972                 evt = BTA_AV_META_MSG_EVT;
    973             }
    974             else
    975 #endif
    976                 evt = BTA_AV_VENDOR_RSP_EVT;
    977 
    978         }
    979         /* else if not configured to support vendor specific and it's a command */
    980         else if (!(p_cb->features & BTA_AV_FEAT_VENDOR)  &&
    981             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
    982         {
    983            if(p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID)
    984            {
    985            /* reject it */
    986               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
    987               p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
    988            }
    989            else
    990               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    991            AVRC_VendorRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.vendor);
    992         }
    993     }
    994 #if (AVRC_METADATA_INCLUDED == TRUE)
    995     if (evt == 0 && rc_rsp.rsp.status != BTA_AV_STS_NO_RSP)
    996     {
    997         if (!p_pkt)
    998         {
    999             rc_rsp.rsp.opcode = p_data->rc_msg.opcode;
   1000             res = AVRC_BldResponse (0, &rc_rsp, &p_pkt);
   1001         }
   1002         if (p_pkt)
   1003             AVRC_MsgReq (p_data->rc_msg.handle, p_data->rc_msg.label, ctype, p_pkt);
   1004     }
   1005 #endif
   1006 
   1007     /* call callback */
   1008     if (evt != 0)
   1009     {
   1010         av.remote_cmd.rc_handle = p_data->rc_msg.handle;
   1011         (*p_cb->p_cback)(evt, &av);
   1012     }
   1013 }
   1014 
   1015 /*******************************************************************************
   1016 **
   1017 ** Function         bta_av_rc_close
   1018 **
   1019 ** Description      close the specified AVRC handle.
   1020 **
   1021 ** Returns          void
   1022 **
   1023 *******************************************************************************/
   1024 void bta_av_rc_close (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
   1025 {
   1026     UINT16 handle = p_data->hdr.layer_specific;
   1027     tBTA_AV_SCB  *p_scb;
   1028     tBTA_AV_RCB *p_rcb;
   1029 
   1030     if(handle < BTA_AV_NUM_RCB)
   1031     {
   1032         p_rcb = &p_cb->rcb[handle];
   1033 
   1034         APPL_TRACE_DEBUG("bta_av_rc_close handle: %d, status=0x%x", p_rcb->handle, p_rcb->status);
   1035         if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
   1036         {
   1037             if(p_rcb->shdl)
   1038             {
   1039                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
   1040                 if(p_scb)
   1041                 {
   1042                     /* just in case the RC timer is active
   1043                     if(bta_av_cb.features & BTA_AV_FEAT_RCCT &&
   1044                        p_scb->chnl == BTA_AV_CHNL_AUDIO) */
   1045                         bta_sys_stop_timer(&p_scb->timer);
   1046                 }
   1047             }
   1048 
   1049             AVRC_Close(p_rcb->handle);
   1050         }
   1051     }
   1052 }
   1053 
   1054 /*******************************************************************************
   1055 **
   1056 ** Function         bta_av_get_shdl
   1057 **
   1058 ** Returns          The index to p_scb[]
   1059 **
   1060 *******************************************************************************/
   1061 static UINT8 bta_av_get_shdl(tBTA_AV_SCB *p_scb)
   1062 {
   1063     int     i;
   1064     UINT8   shdl = 0;
   1065     /* find the SCB & stop the timer */
   1066     for(i=0; i<BTA_AV_NUM_STRS; i++)
   1067     {
   1068         if(p_scb == bta_av_cb.p_scb[i])
   1069         {
   1070             shdl = i+1;
   1071             break;
   1072         }
   1073     }
   1074     return shdl;
   1075 }
   1076 
   1077 /*******************************************************************************
   1078 **
   1079 ** Function         bta_av_stream_chg
   1080 **
   1081 ** Description      audio streaming status changed.
   1082 **
   1083 ** Returns          void
   1084 **
   1085 *******************************************************************************/
   1086 void bta_av_stream_chg(tBTA_AV_SCB *p_scb, BOOLEAN started)
   1087 {
   1088     UINT8   started_msk;
   1089     int     i;
   1090     UINT8   *p_streams;
   1091     BOOLEAN no_streams = FALSE;
   1092     tBTA_AV_SCB *p_scbi;
   1093 
   1094     started_msk = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
   1095     APPL_TRACE_DEBUG ("bta_av_stream_chg started:%d started_msk:x%x chnl:x%x", started,
   1096                                                   started_msk, p_scb->chnl);
   1097     if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
   1098         p_streams = &bta_av_cb.audio_streams;
   1099     else
   1100         p_streams = &bta_av_cb.video_streams;
   1101 
   1102     if (started)
   1103     {
   1104         /* Let L2CAP know this channel is processed with high priority */
   1105         L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_HIGH);
   1106         (*p_streams) |= started_msk;
   1107     }
   1108     else
   1109     {
   1110         (*p_streams) &= ~started_msk;
   1111     }
   1112 
   1113     if (!started)
   1114     {
   1115         i=0;
   1116         if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
   1117         {
   1118             if (bta_av_cb.video_streams == 0)
   1119                 no_streams = TRUE;
   1120         }
   1121         else
   1122         {
   1123             no_streams = TRUE;
   1124             if ( bta_av_cb.audio_streams )
   1125             {
   1126                 for (; i<BTA_AV_NUM_STRS; i++)
   1127                 {
   1128                     p_scbi = bta_av_cb.p_scb[i];
   1129                     /* scb is used and started */
   1130                     if ( p_scbi && (bta_av_cb.audio_streams & BTA_AV_HNDL_TO_MSK(i))
   1131                         && bdcmp(p_scbi->peer_addr, p_scb->peer_addr) == 0)
   1132                     {
   1133                         no_streams = FALSE;
   1134                         break;
   1135                     }
   1136                 }
   1137 
   1138             }
   1139         }
   1140 
   1141         APPL_TRACE_DEBUG ("no_streams:%d i:%d, audio_streams:x%x, video_streams:x%x", no_streams, i,
   1142                            bta_av_cb.audio_streams, bta_av_cb.video_streams);
   1143         if (no_streams)
   1144         {
   1145             /* Let L2CAP know this channel is processed with low priority */
   1146             L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_NORMAL);
   1147         }
   1148     }
   1149 }
   1150 
   1151 
   1152 /*******************************************************************************
   1153 **
   1154 ** Function         bta_av_conn_chg
   1155 **
   1156 ** Description      connetion status changed.
   1157 **                  Open an AVRCP acceptor channel, if new conn.
   1158 **
   1159 ** Returns          void
   1160 **
   1161 *******************************************************************************/
   1162 void bta_av_conn_chg(tBTA_AV_DATA *p_data)
   1163 {
   1164     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1165     tBTA_AV_SCB     *p_scb;
   1166     tBTA_AV_SCB     *p_scbi;
   1167     UINT8   mask;
   1168     UINT8   conn_msk;
   1169     UINT8   old_msk;
   1170     int i;
   1171     int index = (p_data->hdr.layer_specific & BTA_AV_HNDL_MSK) - 1;
   1172     tBTA_AV_LCB *p_lcb;
   1173     tBTA_AV_LCB *p_lcb_rc;
   1174     tBTA_AV_RCB *p_rcb, *p_rcb2;
   1175     BOOLEAN     chk_restore = FALSE;
   1176 
   1177     p_scb = p_cb->p_scb[index];
   1178 
   1179     mask = BTA_AV_HNDL_TO_MSK(index);
   1180     p_lcb = bta_av_find_lcb(p_data->conn_chg.peer_addr, BTA_AV_LCB_FIND);
   1181     conn_msk = 1 << (index + 1);
   1182     if(p_data->conn_chg.is_up)
   1183     {
   1184         /* set the conned mask for this channel */
   1185         if(p_scb)
   1186         {
   1187             if(p_lcb)
   1188             {
   1189                 p_lcb->conn_msk |= conn_msk;
   1190                 for (i=0; i<BTA_AV_NUM_RCB; i++)
   1191                 {
   1192                     if (bta_av_cb.rcb[i].lidx == p_lcb->lidx)
   1193                     {
   1194                         bta_av_cb.rcb[i].shdl = index + 1;
   1195                         APPL_TRACE_DEBUG("conn_chg up[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
   1196                                           bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
   1197                                           bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
   1198                         break;
   1199                     }
   1200                 }
   1201             }
   1202             if (p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1203             {
   1204                 old_msk = p_cb->conn_audio;
   1205                 p_cb->conn_audio |= mask;
   1206             }
   1207             else
   1208             {
   1209                 old_msk = p_cb->conn_video;
   1210                 p_cb->conn_video |= mask;
   1211             }
   1212 
   1213             if ((old_msk & mask) == 0)
   1214             {
   1215                 /* increase the audio open count, if not set yet */
   1216                 bta_av_cb.audio_open_cnt++;
   1217             }
   1218 
   1219 
   1220             APPL_TRACE_DEBUG("rc_acp_handle:%d rc_acp_idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
   1221             /* check if the AVRCP ACP channel is already connected */
   1222             if(p_lcb && p_cb->rc_acp_handle != BTA_AV_RC_HANDLE_NONE && p_cb->rc_acp_idx)
   1223             {
   1224                 p_lcb_rc = &p_cb->lcb[BTA_AV_NUM_LINKS];
   1225                 APPL_TRACE_DEBUG("rc_acp is connected && conn_chg on same addr p_lcb_rc->conn_msk:x%x",
   1226                                   p_lcb_rc->conn_msk);
   1227                 /* check if the RC is connected to the scb addr */
   1228                 APPL_TRACE_DEBUG ("p_lcb_rc->addr: %02x:%02x:%02x:%02x:%02x:%02x",
   1229                        p_lcb_rc->addr[0], p_lcb_rc->addr[1], p_lcb_rc->addr[2], p_lcb_rc->addr[3],
   1230                        p_lcb_rc->addr[4], p_lcb_rc->addr[5]);
   1231                 APPL_TRACE_DEBUG ("conn_chg.peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
   1232                        p_data->conn_chg.peer_addr[0], p_data->conn_chg.peer_addr[1],
   1233                        p_data->conn_chg.peer_addr[2],
   1234                        p_data->conn_chg.peer_addr[3], p_data->conn_chg.peer_addr[4],
   1235                        p_data->conn_chg.peer_addr[5]);
   1236                 if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0)
   1237                 {
   1238                     /* AVRCP is already connected.
   1239                      * need to update the association betwen SCB and RCB */
   1240                     p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
   1241                     p_lcb_rc->lidx = 0;
   1242                     p_scb->rc_handle = p_cb->rc_acp_handle;
   1243                     p_rcb = &p_cb->rcb[p_cb->rc_acp_idx - 1];
   1244                     p_rcb->shdl = bta_av_get_shdl(p_scb);
   1245                     APPL_TRACE_DEBUG("update rc_acp shdl:%d/%d srch:%d", index + 1, p_rcb->shdl,
   1246                                       p_scb->rc_handle );
   1247 
   1248                     p_rcb2 = bta_av_get_rcb_by_shdl(p_rcb->shdl);
   1249                     if (p_rcb2)
   1250                     {
   1251                         /* found the RCB that was created to associated with this SCB */
   1252                         p_cb->rc_acp_handle = p_rcb2->handle;
   1253                         p_cb->rc_acp_idx = (p_rcb2 - p_cb->rcb) + 1;
   1254                         APPL_TRACE_DEBUG("new rc_acp_handle:%d, idx:%d", p_cb->rc_acp_handle,
   1255                                            p_cb->rc_acp_idx);
   1256                         p_rcb2->lidx = (BTA_AV_NUM_LINKS + 1);
   1257                         APPL_TRACE_DEBUG("rc2 handle:%d lidx:%d/%d",p_rcb2->handle, p_rcb2->lidx,
   1258                                           p_cb->lcb[p_rcb2->lidx-1].lidx);
   1259                     }
   1260                     p_rcb->lidx = p_lcb->lidx;
   1261                     APPL_TRACE_DEBUG("rc handle:%d lidx:%d/%d",p_rcb->handle, p_rcb->lidx,
   1262                                       p_cb->lcb[p_rcb->lidx-1].lidx);
   1263                 }
   1264             }
   1265         }
   1266     }
   1267     else
   1268     {
   1269         if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
   1270         {
   1271             /* this channel is still marked as open. decrease the count */
   1272             bta_av_cb.audio_open_cnt--;
   1273         }
   1274 
   1275         /* clear the conned mask for this channel */
   1276         p_cb->conn_audio &= ~mask;
   1277         p_cb->conn_video &= ~mask;
   1278         if(p_scb)
   1279         {
   1280             /* the stream is closed.
   1281              * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
   1282             bdcpy(p_scb->peer_addr, bd_addr_null);
   1283             if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1284             {
   1285                 if(p_lcb)
   1286                 {
   1287                     p_lcb->conn_msk &= ~conn_msk;
   1288                 }
   1289                 /* audio channel is down. make sure the INT channel is down */
   1290                 /* just in case the RC timer is active
   1291                 if(p_cb->features & BTA_AV_FEAT_RCCT) */
   1292                 {
   1293                     bta_sys_stop_timer(&p_scb->timer);
   1294                 }
   1295                 /* one audio channel goes down. check if we need to restore high priority */
   1296                 chk_restore = TRUE;
   1297             }
   1298         }
   1299 
   1300         APPL_TRACE_DEBUG("bta_av_conn_chg shdl:%d", index + 1);
   1301         for (i=0; i<BTA_AV_NUM_RCB; i++)
   1302         {
   1303             APPL_TRACE_DEBUG("conn_chg dn[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
   1304                               bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
   1305                               bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
   1306             if(bta_av_cb.rcb[i].shdl == index + 1)
   1307             {
   1308                 bta_av_del_rc(&bta_av_cb.rcb[i]);
   1309                 break;
   1310             }
   1311         }
   1312 
   1313         if(p_cb->conn_audio == 0 && p_cb->conn_video == 0)
   1314         {
   1315             /* if both channels are not connected,
   1316              * close all RC channels */
   1317             bta_av_close_all_rc(p_cb);
   1318         }
   1319 
   1320         /* if the AVRCP is no longer listening, create the listening channel */
   1321         if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
   1322             bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
   1323     }
   1324 
   1325     APPL_TRACE_DEBUG("bta_av_conn_chg audio:%x video:%x up:%d conn_msk:0x%x chk_restore:%d audio_open_cnt:%d",
   1326         p_cb->conn_audio, p_cb->conn_video, p_data->conn_chg.is_up, conn_msk, chk_restore, p_cb->audio_open_cnt);
   1327 
   1328     if (chk_restore)
   1329     {
   1330         if (p_cb->audio_open_cnt == 1)
   1331         {
   1332             /* one audio channel goes down and there's one audio channel remains open.
   1333              * restore the switch role in default link policy */
   1334             bta_sys_set_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
   1335             /* allow role switch, if this is the last connection */
   1336             bta_av_restore_switch();
   1337         }
   1338         if (p_cb->audio_open_cnt)
   1339         {
   1340             /* adjust flush timeout settings to longer period */
   1341             for (i=0; i<BTA_AV_NUM_STRS; i++)
   1342             {
   1343                 p_scbi = bta_av_cb.p_scb[i];
   1344                 if (p_scbi && p_scbi->chnl == BTA_AV_CHNL_AUDIO && p_scbi->co_started)
   1345                 {
   1346                     /* may need to update the flush timeout of this already started stream */
   1347                     if (p_scbi->co_started != bta_av_cb.audio_open_cnt)
   1348                     {
   1349                         p_scbi->co_started = bta_av_cb.audio_open_cnt;
   1350                         L2CA_SetFlushTimeout(p_scbi->peer_addr, p_bta_av_cfg->p_audio_flush_to[p_scbi->co_started - 1] );
   1351                     }
   1352                 }
   1353             }
   1354         }
   1355     }
   1356 }
   1357 
   1358 /*******************************************************************************
   1359 **
   1360 ** Function         bta_av_disable
   1361 **
   1362 ** Description      disable AV.
   1363 **
   1364 ** Returns          void
   1365 **
   1366 *******************************************************************************/
   1367 void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
   1368 {
   1369     BT_HDR  hdr;
   1370     UINT16  xx;
   1371     UNUSED(p_data);
   1372 
   1373     p_cb->disabling = TRUE;
   1374 
   1375     bta_av_close_all_rc(p_cb);
   1376 
   1377     utl_freebuf((void **) &p_cb->p_disc_db);
   1378 
   1379     /* disable audio/video - de-register all channels,
   1380      * expect BTA_AV_DEREG_COMP_EVT when deregister is complete */
   1381     for(xx=0; xx<BTA_AV_NUM_STRS; xx++)
   1382     {
   1383         hdr.layer_specific = xx + 1;
   1384         bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
   1385     }
   1386 }
   1387 
   1388 /*******************************************************************************
   1389 **
   1390 ** Function         bta_av_api_disconnect
   1391 **
   1392 ** Description      .
   1393 **
   1394 ** Returns          void
   1395 **
   1396 *******************************************************************************/
   1397 void bta_av_api_disconnect(tBTA_AV_DATA *p_data)
   1398 {
   1399     AVDT_DisconnectReq(p_data->api_discnt.bd_addr, bta_av_conn_cback);
   1400     bta_sys_stop_timer(&bta_av_cb.sig_tmr);
   1401 }
   1402 
   1403 /*******************************************************************************
   1404 **
   1405 ** Function         bta_av_sig_chg
   1406 **
   1407 ** Description      process AVDT signal channel up/down.
   1408 **
   1409 ** Returns          void
   1410 **
   1411 *******************************************************************************/
   1412 void bta_av_sig_chg(tBTA_AV_DATA *p_data)
   1413 {
   1414     UINT16 event = p_data->str_msg.hdr.layer_specific;
   1415     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1416     int     xx;
   1417     UINT8   mask;
   1418     tBTA_AV_LCB *p_lcb = NULL;
   1419 
   1420     APPL_TRACE_DEBUG("bta_av_sig_chg event: %d", event);
   1421     if(event == AVDT_CONNECT_IND_EVT)
   1422     {
   1423         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FIND);
   1424         if(!p_lcb)
   1425         {
   1426             /* if the address does not have an LCB yet, alloc one */
   1427             for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
   1428             {
   1429                 mask = 1 << xx;
   1430                 APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
   1431 
   1432                 /* look for a p_lcb with its p_scb registered */
   1433                 if((!(mask & p_cb->conn_lcb)) && (p_cb->p_scb[xx] != NULL))
   1434                 {
   1435                     p_lcb = &p_cb->lcb[xx];
   1436                     p_lcb->lidx = xx + 1;
   1437                     bdcpy(p_lcb->addr, p_data->str_msg.bd_addr);
   1438                     p_lcb->conn_msk = 0; /* clear the connect mask */
   1439                     /* start listening when the signal channel is open */
   1440                     if (p_cb->features & BTA_AV_FEAT_RCTG)
   1441                     {
   1442                         bta_av_rc_create(p_cb, AVCT_ACP, 0, p_lcb->lidx);
   1443                     }
   1444                     /* this entry is not used yet. */
   1445                     p_cb->conn_lcb |= mask;     /* mark it as used */
   1446                     APPL_TRACE_DEBUG("start sig timer %d", p_data->hdr.offset);
   1447                     if (p_data->hdr.offset == AVDT_ACP)
   1448                     {
   1449                         APPL_TRACE_DEBUG("Incoming L2CAP acquired, set state as incoming", NULL);
   1450                         bdcpy(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr);
   1451                         p_cb->p_scb[xx]->use_rc = TRUE;     /* allowing RC for incoming connection */
   1452                         bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_ACP_CONNECT_EVT, p_data);
   1453 
   1454                         /* The Pending Event should be sent as soon as the L2CAP signalling channel
   1455                          * is set up, which is NOW. Earlier this was done only after
   1456                          * BTA_AV_SIG_TIME_VAL milliseconds.
   1457                          * The following function shall send the event and start the recurring timer
   1458                          */
   1459                         bta_av_sig_timer(NULL);
   1460 
   1461                         /* Possible collision : need to avoid outgoing processing while the timer is running */
   1462                         p_cb->p_scb[xx]->coll_mask = BTA_AV_COLL_INC_TMR;
   1463 
   1464                         p_cb->acp_sig_tmr.param = (UINT32)xx;
   1465                         p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK*)&bta_av_acp_sig_timer_cback;
   1466                         bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
   1467                     }
   1468                     break;
   1469                 }
   1470             }
   1471 
   1472             /* check if we found something */
   1473             if (xx == BTA_AV_NUM_LINKS)
   1474             {
   1475                 /* We do not have scb for this avdt connection.     */
   1476                 /* Silently close the connection.                   */
   1477                 APPL_TRACE_ERROR("av scb not available for avdt connection");
   1478                 AVDT_DisconnectReq (p_data->str_msg.bd_addr, NULL);
   1479                 return;
   1480             }
   1481         }
   1482     }
   1483 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   1484     else if (event == BTA_AR_AVDT_CONN_EVT)
   1485     {
   1486         bta_sys_stop_timer(&bta_av_cb.sig_tmr);
   1487     }
   1488 #endif
   1489     else
   1490     {
   1491         /* disconnected. */
   1492         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FREE);
   1493         if(p_lcb && p_lcb->conn_msk)
   1494         {
   1495             APPL_TRACE_DEBUG("conn_msk: 0x%x", p_lcb->conn_msk);
   1496             /* clean up ssm  */
   1497             for(xx=0; xx < BTA_AV_NUM_STRS; xx++)
   1498             {
   1499                 mask = 1 << (xx + 1);
   1500                 if ((mask & p_lcb->conn_msk) && (p_cb->p_scb[xx]) &&
   1501                     (bdcmp(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr) == 0))
   1502                 {
   1503                     bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_AVDT_DISCONNECT_EVT, NULL);
   1504                 }
   1505             }
   1506         }
   1507     }
   1508     APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
   1509 }
   1510 
   1511 /*******************************************************************************
   1512 **
   1513 ** Function         bta_av_sig_timer
   1514 **
   1515 ** Description      process the signal channel timer. This timer is started
   1516 **                  when the AVDTP signal channel is connected. If no profile
   1517 **                  is connected, the timer goes off every BTA_AV_SIG_TIME_VAL
   1518 **
   1519 ** Returns          void
   1520 **
   1521 *******************************************************************************/
   1522 void bta_av_sig_timer(tBTA_AV_DATA *p_data)
   1523 {
   1524     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1525     int     xx;
   1526     UINT8   mask;
   1527     tBTA_AV_LCB *p_lcb = NULL;
   1528     tBTA_AV_PEND pend;
   1529     UNUSED(p_data);
   1530 
   1531     APPL_TRACE_DEBUG("bta_av_sig_timer");
   1532     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
   1533     {
   1534         mask = 1 << xx;
   1535         if(mask & p_cb->conn_lcb)
   1536         {
   1537             /* this entry is used. check if it is connected */
   1538             p_lcb = &p_cb->lcb[xx];
   1539             if(!p_lcb->conn_msk)
   1540             {
   1541                 bta_sys_start_timer(&p_cb->sig_tmr, BTA_AV_SIG_TIMER_EVT, BTA_AV_SIG_TIME_VAL);
   1542                 bdcpy(pend.bd_addr, p_lcb->addr);
   1543                 (*p_cb->p_cback)(BTA_AV_PENDING_EVT, (tBTA_AV *) &pend);
   1544             }
   1545         }
   1546     }
   1547 }
   1548 
   1549 /*******************************************************************************
   1550 **
   1551 ** Function         bta_av_acp_sig_timer_cback
   1552 **
   1553 ** Description      Process the timeout when SRC is accepting connection
   1554 **                  and SNK did not start signalling.
   1555 **
   1556 ** Returns          void
   1557 **
   1558 *******************************************************************************/
   1559 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle)
   1560 {
   1561     UINT8   inx = (UINT8)p_tle->param;
   1562     tBTA_AV_CB  *p_cb = &bta_av_cb;
   1563     tBTA_AV_SCB *p_scb = p_cb->p_scb[inx];
   1564     tBTA_AV_API_OPEN  *p_buf;
   1565 
   1566     if (p_scb)
   1567     {
   1568         APPL_TRACE_DEBUG("bta_av_acp_sig_timer_cback, coll_mask = 0x%02X", p_scb->coll_mask);
   1569 
   1570         if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)
   1571         {
   1572             p_scb->coll_mask &= ~BTA_AV_COLL_INC_TMR;
   1573 
   1574             if (bta_av_is_scb_opening(p_scb))
   1575             {
   1576                 if (p_scb->p_disc_db)
   1577                 {
   1578                     /* We are still doing SDP. Run the timer again. */
   1579                     p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;
   1580 
   1581                     p_cb->acp_sig_tmr.param = (UINT32)inx;
   1582                     p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK *)&bta_av_acp_sig_timer_cback;
   1583                     bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
   1584                 }
   1585                 else
   1586                 {
   1587                     /* SNK did not start signalling, resume signalling process. */
   1588                     bta_av_discover_req (p_scb, NULL);
   1589                 }
   1590             }
   1591             else if (bta_av_is_scb_incoming(p_scb))
   1592             {
   1593                 /* Stay in incoming state if SNK does not start signalling */
   1594 
   1595                 /* API open was called right after SNK opened L2C connection. */
   1596                 if (p_scb->coll_mask & BTA_AV_COLL_API_CALLED)
   1597                 {
   1598                     p_scb->coll_mask &= ~BTA_AV_COLL_API_CALLED;
   1599 
   1600                     /* BTA_AV_API_OPEN_EVT */
   1601                     if ((p_buf = (tBTA_AV_API_OPEN *) GKI_getbuf(sizeof(tBTA_AV_API_OPEN))) != NULL)
   1602                     {
   1603                         memcpy(p_buf, &(p_scb->open_api), sizeof(tBTA_AV_API_OPEN));
   1604                         bta_sys_sendmsg(p_buf);
   1605                     }
   1606                 }
   1607             }
   1608         }
   1609     }
   1610 }
   1611 
   1612 /*******************************************************************************
   1613 **
   1614 ** Function         bta_av_check_peer_features
   1615 **
   1616 ** Description      check supported features on the peer device from the SDP record
   1617 **                  and return the feature mask
   1618 **
   1619 ** Returns          tBTA_AV_FEAT peer device feature mask
   1620 **
   1621 *******************************************************************************/
   1622 tBTA_AV_FEAT bta_av_check_peer_features (UINT16 service_uuid)
   1623 {
   1624     tBTA_AV_FEAT peer_features = 0;
   1625     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1626     tSDP_DISC_REC       *p_rec = NULL;
   1627     tSDP_DISC_ATTR      *p_attr;
   1628     UINT16              peer_rc_version=0;
   1629     UINT16              categories = 0;
   1630 
   1631     APPL_TRACE_DEBUG("bta_av_check_peer_features service_uuid:x%x", service_uuid);
   1632     /* loop through all records we found */
   1633     while (TRUE)
   1634     {
   1635         /* get next record; if none found, we're done */
   1636         if ((p_rec = SDP_FindServiceInDb(p_cb->p_disc_db, service_uuid, p_rec)) == NULL)
   1637         {
   1638             break;
   1639         }
   1640 
   1641         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_CLASS_ID_LIST)) != NULL)
   1642         {
   1643             /* find peer features */
   1644             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL))
   1645             {
   1646                 peer_features |= BTA_AV_FEAT_RCCT;
   1647             }
   1648             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REM_CTRL_TARGET, NULL))
   1649             {
   1650                 peer_features |= BTA_AV_FEAT_RCTG;
   1651             }
   1652         }
   1653 
   1654         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST)) != NULL)
   1655         {
   1656             /* get profile version (if failure, version parameter is not updated) */
   1657             SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL, &peer_rc_version);
   1658             APPL_TRACE_DEBUG("peer_rc_version 0x%x", peer_rc_version);
   1659 
   1660             if (peer_rc_version >= AVRC_REV_1_3)
   1661                 peer_features |= (BTA_AV_FEAT_VENDOR | BTA_AV_FEAT_METADATA);
   1662 
   1663             if (peer_rc_version >= AVRC_REV_1_4)
   1664             {
   1665                 peer_features |= (BTA_AV_FEAT_ADV_CTRL);
   1666                 /* get supported categories */
   1667                 if ((p_attr = SDP_FindAttributeInRec(p_rec,
   1668                                 ATTR_ID_SUPPORTED_FEATURES)) != NULL)
   1669                 {
   1670                     categories = p_attr->attr_value.v.u16;
   1671                     if (categories & AVRC_SUPF_CT_BROWSE)
   1672                         peer_features |= (BTA_AV_FEAT_BROWSE);
   1673                 }
   1674             }
   1675         }
   1676     }
   1677     APPL_TRACE_DEBUG("peer_features:x%x", peer_features);
   1678     return peer_features;
   1679 }
   1680 
   1681 /*******************************************************************************
   1682 **
   1683 ** Function         bta_av_rc_disc_done
   1684 **
   1685 ** Description      Handle AVRCP service discovery results.  If matching
   1686 **                  service found, open AVRCP connection.
   1687 **
   1688 ** Returns          void
   1689 **
   1690 *******************************************************************************/
   1691 void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
   1692 {
   1693     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1694     tBTA_AV_SCB  *p_scb = NULL;
   1695     tBTA_AV_LCB  *p_lcb;
   1696     tBTA_AV_RC_OPEN rc_open;
   1697     tBTA_AV_RC_FEAT rc_feat;
   1698     UINT8               rc_handle;
   1699     tBTA_AV_FEAT        peer_features;  /* peer features mask */
   1700     UNUSED(p_data);
   1701 
   1702     APPL_TRACE_DEBUG("bta_av_rc_disc_done disc:x%x", p_cb->disc);
   1703     if (!p_cb->disc)
   1704     {
   1705         return;
   1706     }
   1707 
   1708     if ((p_cb->disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
   1709     {
   1710         /* this is the rc handle/index to tBTA_AV_RCB */
   1711         rc_handle = p_cb->disc & (~BTA_AV_CHNL_MSK);
   1712     }
   1713     else
   1714     {
   1715         p_scb = p_cb->p_scb[(p_cb->disc & BTA_AV_HNDL_MSK) - 1];
   1716         if (p_scb)
   1717             rc_handle = p_scb->rc_handle;
   1718         else
   1719         {
   1720             p_cb->disc = 0;
   1721             return;
   1722         }
   1723     }
   1724 
   1725     APPL_TRACE_DEBUG("rc_handle %d", rc_handle);
   1726     /* check peer version and whether support CT and TG role */
   1727     peer_features = bta_av_check_peer_features (UUID_SERVCLASS_AV_REMOTE_CONTROL);
   1728     if ((p_cb->features & BTA_AV_FEAT_ADV_CTRL) && ((peer_features&BTA_AV_FEAT_ADV_CTRL) == 0))
   1729     {
   1730         /* if we support advance control and peer does not, check their support on TG role
   1731          * some implementation uses 1.3 on CT ans 1.4 on TG */
   1732         peer_features |= bta_av_check_peer_features (UUID_SERVCLASS_AV_REM_CTRL_TARGET);
   1733     }
   1734 
   1735     p_cb->disc = 0;
   1736     utl_freebuf((void **) &p_cb->p_disc_db);
   1737 
   1738     APPL_TRACE_DEBUG("peer_features 0x%x, features 0x%x", peer_features, p_cb->features);
   1739 
   1740     /* if we have no rc connection */
   1741     if (rc_handle == BTA_AV_RC_HANDLE_NONE)
   1742     {
   1743         if (p_scb)
   1744         {
   1745             /* if peer remote control service matches ours and USE_RC is TRUE */
   1746             if ((((p_cb->features & BTA_AV_FEAT_RCCT) && (peer_features & BTA_AV_FEAT_RCTG)) ||
   1747                  ((p_cb->features & BTA_AV_FEAT_RCTG) && (peer_features & BTA_AV_FEAT_RCCT))) )
   1748             {
   1749                 p_lcb = bta_av_find_lcb(p_scb->peer_addr, BTA_AV_LCB_FIND);
   1750                 if(p_lcb)
   1751                 {
   1752                     rc_handle = bta_av_rc_create(p_cb, AVCT_INT, (UINT8)(p_scb->hdi + 1), p_lcb->lidx);
   1753                     p_cb->rcb[rc_handle].peer_features = peer_features;
   1754                 }
   1755 #if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
   1756                 else
   1757                 {
   1758                     APPL_TRACE_ERROR("can not find LCB!!");
   1759                 }
   1760 #endif
   1761             }
   1762             else if(p_scb->use_rc)
   1763             {
   1764                 /* can not find AVRC on peer device. report failure */
   1765                 p_scb->use_rc = FALSE;
   1766                 bdcpy(rc_open.peer_addr, p_scb->peer_addr);
   1767                 rc_open.peer_features = 0;
   1768                 rc_open.status = BTA_AV_FAIL_SDP;
   1769                 (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
   1770             }
   1771         }
   1772     }
   1773     else
   1774     {
   1775         p_cb->rcb[rc_handle].peer_features = peer_features;
   1776         rc_feat.rc_handle =  rc_handle;
   1777         rc_feat.peer_features = peer_features;
   1778         (*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
   1779     }
   1780 }
   1781 
   1782 /*******************************************************************************
   1783 **
   1784 ** Function         bta_av_rc_closed
   1785 **
   1786 ** Description      Set AVRCP state to closed.
   1787 **
   1788 ** Returns          void
   1789 **
   1790 *******************************************************************************/
   1791 void bta_av_rc_closed(tBTA_AV_DATA *p_data)
   1792 {
   1793     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1794     tBTA_AV_RC_CLOSE rc_close;
   1795     tBTA_AV_RC_CONN_CHG *p_msg = (tBTA_AV_RC_CONN_CHG *)p_data;
   1796     tBTA_AV_RCB    *p_rcb;
   1797     tBTA_AV_SCB    *p_scb;
   1798     int i;
   1799     BOOLEAN conn = FALSE;
   1800     tBTA_AV_LCB *p_lcb;
   1801 
   1802     rc_close.rc_handle = BTA_AV_RC_HANDLE_NONE;
   1803     APPL_TRACE_DEBUG("bta_av_rc_closed rc_handle:%d", p_msg->handle);
   1804     for(i=0; i<BTA_AV_NUM_RCB; i++)
   1805     {
   1806         p_rcb = &p_cb->rcb[i];
   1807         APPL_TRACE_DEBUG("bta_av_rc_closed rcb[%d] rc_handle:%d, status=0x%x", i, p_rcb->handle, p_rcb->status);
   1808         if(p_rcb->handle == p_msg->handle)
   1809         {
   1810             rc_close.rc_handle = i;
   1811             p_rcb->status &= ~BTA_AV_RC_CONN_MASK;
   1812             p_rcb->peer_features = 0;
   1813             APPL_TRACE_DEBUG("       shdl:%d, lidx:%d", p_rcb->shdl, p_rcb->lidx);
   1814             if(p_rcb->shdl)
   1815             {
   1816                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
   1817                 if(p_scb)
   1818                 {
   1819                     bdcpy(rc_close.peer_addr, p_scb->peer_addr);
   1820                     if(p_scb->rc_handle == p_rcb->handle)
   1821                         p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
   1822                     APPL_TRACE_DEBUG("shdl:%d, srch:%d", p_rcb->shdl, p_scb->rc_handle);
   1823                 }
   1824                 p_rcb->shdl = 0;
   1825             }
   1826             else if(p_rcb->lidx == (BTA_AV_NUM_LINKS + 1) )
   1827             {
   1828                 /* if the RCB uses the extra LCB, use the addr for event and clean it */
   1829                 p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
   1830                 bdcpy(rc_close.peer_addr, p_msg->peer_addr);
   1831                 APPL_TRACE_DEBUG("rc_only closed bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
   1832                               p_msg->peer_addr[0], p_msg->peer_addr[1],
   1833                               p_msg->peer_addr[2], p_msg->peer_addr[3],
   1834                               p_msg->peer_addr[4], p_msg->peer_addr[5]);
   1835                 p_lcb->conn_msk = 0;
   1836                 p_lcb->lidx = 0;
   1837             }
   1838             p_rcb->lidx = 0;
   1839 
   1840             if((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT)
   1841             {
   1842                 /* AVCT CCB is deallocated */
   1843                 p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
   1844                 p_rcb->status = 0;
   1845             }
   1846             else
   1847             {
   1848                 /* AVCT CCB is still there. dealloc */
   1849                 bta_av_del_rc(p_rcb);
   1850 
   1851                 /* if the AVRCP is no longer listening, create the listening channel */
   1852                 if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
   1853                     bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
   1854             }
   1855         }
   1856         else if((p_rcb->handle != BTA_AV_RC_HANDLE_NONE) && (p_rcb->status & BTA_AV_RC_CONN_MASK))
   1857         {
   1858             /* at least one channel is still connected */
   1859             conn = TRUE;
   1860         }
   1861     }
   1862 
   1863     if(!conn)
   1864     {
   1865         /* no AVRC channels are connected, go back to INIT state */
   1866         bta_av_sm_execute(p_cb, BTA_AV_AVRC_NONE_EVT, NULL);
   1867     }
   1868 
   1869     if (rc_close.rc_handle == BTA_AV_RC_HANDLE_NONE)
   1870     {
   1871         rc_close.rc_handle = p_msg->handle;
   1872         bdcpy(rc_close.peer_addr, p_msg->peer_addr);
   1873     }
   1874     (*p_cb->p_cback)(BTA_AV_RC_CLOSE_EVT, (tBTA_AV *) &rc_close);
   1875 }
   1876 
   1877 /*******************************************************************************
   1878 **
   1879 ** Function         bta_av_rc_disc
   1880 **
   1881 ** Description      start AVRC SDP discovery.
   1882 **
   1883 ** Returns          void
   1884 **
   1885 *******************************************************************************/
   1886 void bta_av_rc_disc(UINT8 disc)
   1887 {
   1888     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1889     tAVRC_SDP_DB_PARAMS db_params;
   1890       UINT16              attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST,
   1891                                        ATTR_ID_BT_PROFILE_DESC_LIST,
   1892                                        ATTR_ID_SUPPORTED_FEATURES};
   1893     UINT8       hdi;
   1894     tBTA_AV_SCB *p_scb;
   1895     UINT8       *p_addr = NULL;
   1896     UINT8       rc_handle;
   1897 
   1898     APPL_TRACE_DEBUG("bta_av_rc_disc 0x%x, %d", disc, bta_av_cb.disc);
   1899     if ((bta_av_cb.disc != 0) || (disc == 0))
   1900         return;
   1901 
   1902     if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
   1903     {
   1904         /* this is the rc handle/index to tBTA_AV_RCB */
   1905         rc_handle = disc & (~BTA_AV_CHNL_MSK);
   1906         if (p_cb->rcb[rc_handle].lidx)
   1907         {
   1908             p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx-1].addr;
   1909         }
   1910     }
   1911     else
   1912     {
   1913         hdi = (disc & BTA_AV_HNDL_MSK) - 1;
   1914         p_scb = p_cb->p_scb[hdi];
   1915 
   1916         if (p_scb)
   1917         {
   1918             APPL_TRACE_DEBUG("rc_handle %d", p_scb->rc_handle);
   1919             p_addr = p_scb->peer_addr;
   1920         }
   1921     }
   1922 
   1923     if (p_addr)
   1924     {
   1925         /* allocate discovery database */
   1926         if (p_cb->p_disc_db == NULL)
   1927         {
   1928             p_cb->p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(BTA_AV_DISC_BUF_SIZE);
   1929         }
   1930 
   1931         if (p_cb->p_disc_db)
   1932         {
   1933             /* set up parameters */
   1934             db_params.db_len = BTA_AV_DISC_BUF_SIZE;
   1935             db_params.num_attr = 3;
   1936             db_params.p_db = p_cb->p_disc_db;
   1937             db_params.p_attrs = attr_list;
   1938 
   1939             /* searching for UUID_SERVCLASS_AV_REMOTE_CONTROL gets both TG and CT */
   1940             if (AVRC_FindService(UUID_SERVCLASS_AV_REMOTE_CONTROL, p_addr, &db_params,
   1941                             bta_av_avrc_sdp_cback) == AVRC_SUCCESS)
   1942             {
   1943                 p_cb->disc = disc;
   1944                 APPL_TRACE_DEBUG("disc %d", p_cb->disc);
   1945             }
   1946         }
   1947     }
   1948 }
   1949 
   1950 /*******************************************************************************
   1951 **
   1952 ** Function         bta_av_dereg_comp
   1953 **
   1954 ** Description      deregister complete. free the stream control block.
   1955 **
   1956 ** Returns          void
   1957 **
   1958 *******************************************************************************/
   1959 void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
   1960 {
   1961     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1962     tBTA_AV_SCB  *p_scb;
   1963     tBTA_UTL_COD    cod;
   1964     UINT8   mask;
   1965     BT_HDR  *p_buf;
   1966 
   1967     /* find the stream control block */
   1968     p_scb = bta_av_hndl_to_scb(p_data->hdr.layer_specific);
   1969 
   1970     if(p_scb)
   1971     {
   1972         APPL_TRACE_DEBUG("deregistered %d(h%d)", p_scb->chnl, p_scb->hndl);
   1973         mask = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
   1974         if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1975         {
   1976             p_cb->reg_audio  &= ~mask;
   1977             if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
   1978             {
   1979                 /* this channel is still marked as open. decrease the count */
   1980                 bta_av_cb.audio_open_cnt--;
   1981             }
   1982             p_cb->conn_audio &= ~mask;
   1983 
   1984             if (p_scb->q_tag == BTA_AV_Q_TAG_STREAM)
   1985             {
   1986             /* make sure no buffers are in q_info.a2d */
   1987             while((p_buf = (BT_HDR*)GKI_dequeue (&p_scb->q_info.a2d)) != NULL)
   1988                 GKI_freebuf(p_buf);
   1989             }
   1990 
   1991             /* remove the A2DP SDP record, if no more audio stream is left */
   1992             if(!p_cb->reg_audio)
   1993             {
   1994 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   1995                 bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REMOTE_CONTROL, BTA_ID_AV);
   1996 #endif
   1997                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_handle);
   1998                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
   1999 
   2000 #if (BTA_AV_SINK_INCLUDED == TRUE)
   2001                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_snk_handle);
   2002                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SINK);
   2003 #endif
   2004             }
   2005         }
   2006         else
   2007         {
   2008             p_cb->reg_video  &= ~mask;
   2009             /* make sure that this channel is not connected */
   2010             p_cb->conn_video &= ~mask;
   2011             /* remove the VDP SDP record, (only one video stream at most) */
   2012             bta_av_del_sdp_rec(&p_cb->sdp_vdp_handle);
   2013             bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
   2014         }
   2015 
   2016         /* make sure that the timer is not active */
   2017         bta_sys_stop_timer(&p_scb->timer);
   2018         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
   2019     }
   2020 
   2021     APPL_TRACE_DEBUG("audio 0x%x, video: 0x%x, disable:%d",
   2022         p_cb->reg_audio, p_cb->reg_video, p_cb->disabling);
   2023     /* if no stream control block is active */
   2024     if((p_cb->reg_audio + p_cb->reg_video) == 0)
   2025     {
   2026 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   2027         /* deregister from AVDT */
   2028         bta_ar_dereg_avdt(BTA_ID_AV);
   2029 
   2030         /* deregister from AVCT */
   2031         bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REM_CTRL_TARGET, BTA_ID_AV);
   2032         bta_ar_dereg_avct(BTA_ID_AV);
   2033 #endif
   2034 
   2035         if(p_cb->disabling)
   2036         {
   2037             p_cb->disabling     = FALSE;
   2038             bta_av_cb.features  = 0;
   2039         }
   2040 
   2041         /* Clear the Capturing service class bit */
   2042         cod.service = BTM_COD_SERVICE_CAPTURING;
   2043         utl_set_device_class(&cod, BTA_UTL_CLR_COD_SERVICE_CLASS);
   2044     }
   2045 }
   2046 #endif /* BTA_AV_INCLUDED */
   2047