Home | History | Annotate | Download | only in avdt
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2002-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This module contains the action functions associated with the stream
     22  *  control block state machine.
     23  *
     24  ******************************************************************************/
     25 
     26 #include <string.h>
     27 #include "bt_types.h"
     28 #include "bt_target.h"
     29 #include "bt_utils.h"
     30 #include "avdt_api.h"
     31 #include "avdtc_api.h"
     32 #include "avdt_int.h"
     33 #include "gki.h"
     34 #include "btu.h"
     35 
     36 /* This table is used to lookup the callback event that matches a particular
     37 ** state machine API request event.  Note that state machine API request
     38 ** events are at the beginning of the event list starting at zero, thus
     39 ** allowing for this table.
     40 */
     41 const UINT8 avdt_scb_cback_evt[] = {
     42     0,                          /* API_REMOVE_EVT (no event) */
     43     AVDT_WRITE_CFM_EVT,         /* API_WRITE_REQ_EVT */
     44     0,                          /* API_GETCONFIG_REQ_EVT (no event) */
     45     0,                          /* API_DELAY_RPT_REQ_EVT (no event) */
     46     AVDT_OPEN_CFM_EVT,          /* API_SETCONFIG_REQ_EVT */
     47     AVDT_OPEN_CFM_EVT,          /* API_OPEN_REQ_EVT */
     48     AVDT_CLOSE_CFM_EVT,         /* API_CLOSE_REQ_EVT */
     49     AVDT_RECONFIG_CFM_EVT,      /* API_RECONFIG_REQ_EVT */
     50     AVDT_SECURITY_CFM_EVT,      /* API_SECURITY_REQ_EVT */
     51     0                           /* API_ABORT_REQ_EVT (no event) */
     52 };
     53 
     54 /* This table is used to look up the callback event based on the signaling
     55 ** role when the stream is closed.
     56 */
     57 const UINT8 avdt_scb_role_evt[] = {
     58     AVDT_CLOSE_IND_EVT,         /* AVDT_CLOSE_ACP */
     59     AVDT_CLOSE_CFM_EVT,         /* AVDT_CLOSE_INT */
     60     AVDT_CLOSE_IND_EVT,         /* AVDT_OPEN_ACP */
     61     AVDT_OPEN_CFM_EVT           /* AVDT_OPEN_INT */
     62 };
     63 
     64 /*******************************************************************************
     65 **
     66 ** Function         avdt_scb_gen_ssrc
     67 **
     68 ** Description      This function generates a SSRC number unique to the stream.
     69 **
     70 ** Returns          SSRC value.
     71 **
     72 *******************************************************************************/
     73 UINT32 avdt_scb_gen_ssrc(tAVDT_SCB *p_scb)
     74 {
     75     /* combine the value of the media type and codec type of the SCB */
     76     return ((UINT32)(p_scb->cs.cfg.codec_info[1] | p_scb->cs.cfg.codec_info[2]));
     77 }
     78 
     79 /*******************************************************************************
     80 **
     81 ** Function         avdt_scb_hdl_abort_cmd
     82 **
     83 ** Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
     84 **                  to initiate sending of an abort response message.
     85 **
     86 ** Returns          Nothing.
     87 **
     88 *******************************************************************************/
     89 void avdt_scb_hdl_abort_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
     90 {
     91     p_scb->role = AVDT_CLOSE_ACP;
     92     avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
     93 }
     94 
     95 /*******************************************************************************
     96 **
     97 ** Function         avdt_scb_hdl_abort_rsp
     98 **
     99 ** Description      This function is an empty function; it serves as a
    100 **                  placeholder for a conformance API action function.
    101 **
    102 ** Returns          Nothing.
    103 **
    104 *******************************************************************************/
    105 void avdt_scb_hdl_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    106 {
    107     UNUSED(p_scb);
    108     UNUSED(p_data);
    109     return;
    110 }
    111 
    112 /*******************************************************************************
    113 **
    114 ** Function         avdt_scb_hdl_close_cmd
    115 **
    116 ** Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
    117 **                  to initiate sending of a close response message.
    118 **
    119 ** Returns          Nothing.
    120 **
    121 *******************************************************************************/
    122 void avdt_scb_hdl_close_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    123 {
    124     p_scb->role = AVDT_CLOSE_ACP;
    125     avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
    126 }
    127 
    128 /*******************************************************************************
    129 **
    130 ** Function         avdt_scb_hdl_close_rsp
    131 **
    132 ** Description      This function sets the close_code variable to the error
    133 **                  code returned in the close response.
    134 **
    135 ** Returns          Nothing.
    136 **
    137 *******************************************************************************/
    138 void avdt_scb_hdl_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    139 {
    140     p_scb->close_code = p_data->msg.hdr.err_code;
    141 }
    142 
    143 /*******************************************************************************
    144 **
    145 ** Function         avdt_scb_hdl_getconfig_cmd
    146 **
    147 ** Description      This function retrieves the configuration parameters of
    148 **                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
    149 **                  to initiate sending of a get configuration response message.
    150 **
    151 ** Returns          Nothing.
    152 **
    153 *******************************************************************************/
    154 void avdt_scb_hdl_getconfig_cmd(tAVDT_SCB *p_scb,tAVDT_SCB_EVT *p_data)
    155 {
    156     p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
    157 
    158     avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
    159 }
    160 
    161 /*******************************************************************************
    162 **
    163 ** Function         avdt_scb_hdl_getconfig_rsp
    164 **
    165 ** Description      This function is an empty function; it serves as a
    166 **                  placeholder for a conformance API action function.
    167 **
    168 ** Returns          Nothing.
    169 **
    170 *******************************************************************************/
    171 void avdt_scb_hdl_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    172 {
    173     UNUSED(p_scb);
    174     UNUSED(p_data);
    175     return;
    176 }
    177 
    178 /*******************************************************************************
    179 **
    180 ** Function         avdt_scb_hdl_open_cmd
    181 **
    182 ** Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
    183 **                  to initiate sending of an open response message.
    184 **
    185 ** Returns          Nothing.
    186 **
    187 *******************************************************************************/
    188 void avdt_scb_hdl_open_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    189 {
    190     avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
    191 }
    192 
    193 /*******************************************************************************
    194 **
    195 ** Function         avdt_scb_hdl_open_rej
    196 **
    197 ** Description      This function calls the application callback function
    198 **                  indicating the open request has failed.  It initializes
    199 **                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
    200 **                  to the CCB.
    201 **
    202 ** Returns          Nothing.
    203 **
    204 *******************************************************************************/
    205 void avdt_scb_hdl_open_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    206 {
    207     /* do exactly same as setconfig reject */
    208     avdt_scb_hdl_setconfig_rej(p_scb, p_data);
    209 }
    210 
    211 /*******************************************************************************
    212 **
    213 ** Function         avdt_scb_hdl_open_rsp
    214 **
    215 ** Description      This function calls avdt_ad_open_req() to initiate
    216 **                  connection of the transport channel for this stream.
    217 **
    218 ** Returns          Nothing.
    219 **
    220 *******************************************************************************/
    221 void avdt_scb_hdl_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    222 {
    223     UNUSED(p_data);
    224 
    225     /* initiate opening of trans channels for this SEID */
    226     p_scb->role = AVDT_OPEN_INT;
    227     avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
    228 
    229     /* start tc connect timer */
    230     btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
    231 }
    232 
    233 /*******************************************************************************
    234 **
    235 ** Function         avdt_scb_hdl_pkt_no_frag
    236 **
    237 ** Description
    238 **
    239 ** Returns          Nothing.
    240 **
    241 *******************************************************************************/
    242 void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    243 {
    244     UINT8   *p, *p_start;
    245     UINT8   o_v, o_p, o_x, o_cc;
    246     UINT8   m_pt;
    247     UINT8   marker;
    248     UINT16  seq;
    249     UINT32  time_stamp;
    250     UINT16  offset;
    251     UINT16  ex_len;
    252     UINT8   pad_len = 0;
    253 
    254     p = p_start = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    255 
    256     /* parse media packet header */
    257     AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
    258     AVDT_MSG_PRS_M_PT(p, m_pt, marker);
    259     BE_STREAM_TO_UINT16(seq, p);
    260     BE_STREAM_TO_UINT32(time_stamp, p);
    261     p += 4;
    262 
    263     UNUSED(o_v);
    264 
    265     /* skip over any csrc's in packet */
    266     p += o_cc * 4;
    267 
    268     /* check for and skip over extension header */
    269     if (o_x)
    270     {
    271         p += 2;
    272         BE_STREAM_TO_UINT16(ex_len, p);
    273         p += ex_len * 4;
    274     }
    275 
    276     /* save our new offset */
    277     offset = (UINT16) (p - p_start);
    278 
    279     /* adjust length for any padding at end of packet */
    280     if (o_p)
    281     {
    282         /* padding length in last byte of packet */
    283         pad_len =  *(p_start + p_data->p_pkt->len);
    284     }
    285 
    286     /* do sanity check */
    287     if ((offset > p_data->p_pkt->len) || ((pad_len + offset) > p_data->p_pkt->len))
    288     {
    289         AVDT_TRACE_WARNING("Got bad media packet");
    290         GKI_freebuf(p_data->p_pkt);
    291     }
    292     /* adjust offset and length and send it up */
    293     else
    294     {
    295         p_data->p_pkt->len -= (offset + pad_len);
    296         p_data->p_pkt->offset += offset;
    297 
    298         if (p_scb->cs.p_data_cback != NULL)
    299         {
    300             /* report sequence number */
    301             p_data->p_pkt->layer_specific = seq;
    302             (*p_scb->cs.p_data_cback)(avdt_scb_to_hdl(p_scb), p_data->p_pkt,
    303                 time_stamp, (UINT8)(m_pt | (marker<<7)));
    304         }
    305         else
    306         {
    307 #if AVDT_MULTIPLEXING == TRUE
    308             if ((p_scb->cs.p_media_cback != NULL)
    309              && (p_scb->p_media_buf != NULL)
    310              && (p_scb->media_buf_len > p_data->p_pkt->len))
    311             {
    312                 /* media buffer enough length is assigned by application. Lets use it*/
    313                 memcpy(p_scb->p_media_buf,(UINT8*)(p_data->p_pkt + 1) + p_data->p_pkt->offset,
    314                     p_data->p_pkt->len);
    315                 (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb),p_scb->p_media_buf,
    316                     p_scb->media_buf_len,time_stamp,seq,m_pt,marker);
    317             }
    318 #endif
    319             GKI_freebuf(p_data->p_pkt);
    320         }
    321     }
    322 }
    323 
    324 #if AVDT_REPORTING == TRUE
    325 /*******************************************************************************
    326 **
    327 ** Function         avdt_scb_hdl_report
    328 **
    329 ** Description
    330 **
    331 ** Returns          Nothing.
    332 **
    333 *******************************************************************************/
    334 UINT8 * avdt_scb_hdl_report(tAVDT_SCB *p_scb, UINT8 *p, UINT16 len)
    335 {
    336     UINT16  result = AVDT_SUCCESS;
    337     UINT8   *p_start = p;
    338     UINT32  ssrc;
    339     UINT8   o_v, o_p, o_cc;
    340     AVDT_REPORT_TYPE    pt;
    341     tAVDT_REPORT_DATA   report, *p_rpt;
    342 
    343     AVDT_TRACE_DEBUG( "avdt_scb_hdl_report");
    344     if(p_scb->cs.p_report_cback)
    345     {
    346         p_rpt = &report;
    347         /* parse report packet header */
    348         AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
    349         pt = *p++;
    350         p += 2;
    351         BE_STREAM_TO_UINT32(ssrc, p);
    352 
    353         UNUSED(o_p);
    354         UNUSED(o_v);
    355 
    356         switch(pt)
    357         {
    358         case AVDT_RTCP_PT_SR:   /* the packet type - SR (Sender Report) */
    359             BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
    360             BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
    361             BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
    362             BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
    363             BE_STREAM_TO_UINT32(report.sr.octet_count, p);
    364             break;
    365 
    366         case AVDT_RTCP_PT_RR:   /* the packet type - RR (Receiver Report) */
    367             report.rr.frag_lost = *p;
    368             BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
    369             report.rr.packet_lost &= 0xFFFFFF;
    370             BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
    371             BE_STREAM_TO_UINT32(report.rr.jitter, p);
    372             BE_STREAM_TO_UINT32(report.rr.lsr, p);
    373             BE_STREAM_TO_UINT32(report.rr.dlsr, p);
    374             break;
    375 
    376         case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
    377             if(*p == AVDT_RTCP_SDES_CNAME)
    378             {
    379                 p_rpt = (tAVDT_REPORT_DATA *)(p+2);
    380             }
    381             else
    382             {
    383                 AVDT_TRACE_WARNING( " - SDES SSRC=0x%08x sc=%d %d len=%d %s",
    384                     ssrc, o_cc, *p, *(p+1), p+2);
    385                 result = AVDT_BUSY;
    386             }
    387             break;
    388 
    389         default:
    390             AVDT_TRACE_ERROR( "Bad Report pkt - packet type: %d", pt);
    391             result = AVDT_BAD_PARAMS;
    392         }
    393 
    394         if(result == AVDT_SUCCESS)
    395             (*p_scb->cs.p_report_cback)(avdt_scb_to_hdl(p_scb), pt, p_rpt);
    396 
    397     }
    398     p_start += len;
    399     return p_start;
    400 }
    401 #endif
    402 
    403 #if AVDT_MULTIPLEXING == TRUE
    404 /*******************************************************************************
    405 **
    406 ** Function         avdt_scb_hdl_pkt_frag
    407 **
    408 ** Description
    409 **
    410 ** Returns          Nothing.
    411 **
    412 *******************************************************************************/
    413 void avdt_scb_hdl_pkt_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    414 {
    415     /* Fields of Adaptation Layer Header */
    416     UINT8   al_tsid,al_frag,al_lcode;
    417     UINT16  al_len;
    418     /* media header fields */
    419     UINT8   o_v, o_p, o_x, o_cc;
    420     UINT8   m_pt;
    421     UINT8   marker;
    422     UINT16  seq;
    423     UINT32  time_stamp;
    424     UINT32  ssrc;
    425     UINT16  ex_len;
    426     UINT8   pad_len;
    427     /* other variables */
    428     UINT8   *p; /* current pointer */
    429     UINT8   *p_end; /* end of all packet */
    430     UINT8   *p_payload; /* pointer to media fragment payload in the buffer */
    431     UINT32  payload_len; /* payload length */
    432     UINT16  frag_len; /* fragment length */
    433 
    434     p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    435     p_end = p + p_data->p_pkt->len;
    436     /* parse all fragments */
    437     while(p < p_end)
    438     {
    439         if (p_end - p < 4) /* length check. maximum length of AL header = 4 */
    440         {
    441             AVDT_TRACE_WARNING("p_end: 0x%x - p:0x%x < 4", p_end, p);
    442             break;
    443         }
    444 
    445         /* parse first byte */
    446         al_tsid = (*p)>>3;
    447         al_frag = ( (*p) >> 2 ) & 0x01;
    448         al_lcode = (*p++) & AVDT_ALH_LCODE_MASK;
    449 
    450         /* in case of TSID=00000, a second AL header byte, before the length field,
    451         ** is expected and contains the actual TSID, aligned with MSB */
    452         if(al_tsid == 0)
    453             al_tsid = *p++;
    454 
    455         /* get remaining media length on base of lcode */
    456         switch(al_lcode)
    457         {
    458         case AVDT_ALH_LCODE_NONE:  /* No length field present. Take length from l2cap */
    459             al_len = (UINT16)(p_end - p);
    460             break;
    461         case AVDT_ALH_LCODE_16BIT:  /* 16 bit length field */
    462             BE_STREAM_TO_UINT16(al_len, p);
    463             break;
    464         case AVDT_ALH_LCODE_9BITM0:  /* 9 bit length field, MSB = 0, 8 LSBs in 1 octet following */
    465             al_len = *p++;
    466             break;
    467         default:    /* 9 bit length field, MSB = 1, 8 LSBs in 1 octet following */
    468             al_len =(UINT16)*p++ + 0x100;
    469         }
    470 
    471         /* max fragment length */
    472         frag_len = (UINT16)(p_end - p);
    473         /* if it isn't last fragment */
    474         if(frag_len >= al_len)
    475             frag_len = al_len;
    476 
    477         /* check TSID corresponds to config */
    478         if (al_tsid != p_scb->curr_cfg.mux_tsid_media)
    479         {
    480 #if AVDT_REPORTING == TRUE
    481             if((p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) &&
    482                 (al_tsid == p_scb->curr_cfg.mux_tsid_report))
    483             {
    484                 /* parse reporting packet */
    485                 p = avdt_scb_hdl_report(p_scb, p, frag_len);
    486                 continue;
    487             }
    488             else
    489 #endif
    490             {
    491                 AVDT_TRACE_WARNING("bad tsid: %d, mux_tsid_media:%d", al_tsid, p_scb->curr_cfg.mux_tsid_media);
    492                 break;
    493             }
    494         }
    495         /* check are buffer for assembling and related callback set */
    496         else if ((p_scb->p_media_buf == NULL) || (p_scb->cs.p_media_cback == NULL))
    497         {
    498             AVDT_TRACE_WARNING("NULL p_media_buf or p_media_cback");
    499             break;
    500         }
    501 
    502 
    503         /* it is media fragment beginning */
    504         if(!al_frag) /* is it first fragment of original media packet */
    505         {
    506             AVDT_TRACE_DEBUG("al:%d media:%d",
    507                 al_len, p_scb->media_buf_len);
    508 
    509             p_scb->frag_off = 0;
    510             p_scb->frag_org_len = al_len; /* total length of original media packet */
    511             /* length check: minimum length of media header is 12 */
    512             if (p_scb->frag_org_len < 12)
    513             {
    514                 AVDT_TRACE_WARNING("bad al_len: %d(<12)", al_len);
    515                 break;
    516             }
    517             /* check that data fit into buffer */
    518             if (al_len > p_scb->media_buf_len)
    519             {
    520                 AVDT_TRACE_WARNING("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
    521                 break;
    522             }
    523             /* make sure it is the last fragment in l2cap packet */
    524             if (p + al_len < p_end)
    525             {
    526                 AVDT_TRACE_WARNING("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
    527                 break;
    528             }
    529         }
    530         else
    531         {
    532             AVDT_TRACE_DEBUG("al:%d media:%d frag_org_len:%d frag_off:%d",
    533                 al_len, p_scb->media_buf_len, p_scb->frag_org_len, p_scb->frag_off);
    534 
    535             /* check that remaining length from AL header equals to original len - length of already received fragments */
    536             if(al_len != p_scb->frag_org_len - p_scb->frag_off)
    537             {
    538                 AVDT_TRACE_WARNING("al_len:%d != (frag_org_len:%d - frag_off:%d) %d",
    539                     al_len, p_scb->frag_org_len, p_scb->frag_off,
    540                     (p_scb->frag_org_len- p_scb->frag_off));
    541                 break;
    542             }
    543 
    544             /* do sanity check */
    545             if (p_scb->frag_off == 0)
    546             {
    547                 AVDT_TRACE_WARNING("frag_off=0");
    548                 break;
    549             }
    550         }
    551         /* do common sanity check */
    552         if((p_scb->frag_org_len <= p_scb->frag_off) || (p_scb->frag_org_len >= p_scb->media_buf_len))
    553         {
    554             AVDT_TRACE_WARNING("common sanity frag_off:%d frag_org_len:%d media_buf_len:%d",
    555                 p_scb->frag_off, p_scb->frag_org_len, p_scb->media_buf_len);
    556             break;
    557         }
    558 
    559         AVDT_TRACE_DEBUG("Received fragment org_len=%d off=%d al_len=%d frag_len=%d",
    560             p_scb->frag_org_len, p_scb->frag_off, al_len, frag_len);
    561 
    562         /* copy fragment into buffer */
    563         memcpy(p_scb->p_media_buf + p_scb->frag_off, p, frag_len);
    564         p_scb->frag_off += frag_len;
    565         /* move to the next fragment */
    566         p += frag_len;
    567         /* if it is last fragment in original media packet then process total media pocket */
    568         if(p_scb->frag_off == p_scb->frag_org_len)
    569         {
    570             p_payload = p_scb->p_media_buf;
    571 
    572             /* media header */
    573             AVDT_MSG_PRS_OCTET1(p_payload, o_v, o_p, o_x, o_cc);
    574             AVDT_MSG_PRS_M_PT(p_payload, m_pt, marker);
    575             BE_STREAM_TO_UINT16(seq, p_payload);
    576             BE_STREAM_TO_UINT32(time_stamp, p_payload);
    577             BE_STREAM_TO_UINT32(ssrc, p_payload);
    578 
    579             UNUSED(o_v);
    580             UNUSED(ssrc);
    581 
    582             /* skip over any csrc's in packet */
    583             p_payload += o_cc * 4;
    584 
    585             /* check for and skip over extension header */
    586             if (o_x)
    587             {
    588                 if(p_scb->p_media_buf + p_scb->frag_off - p_payload < 4)
    589                 {
    590                     AVDT_TRACE_WARNING("length check frag_off:%d p_media_buf:%d p_payload:%d",
    591                         p_scb->frag_off, p_scb->p_media_buf, p_payload);
    592                     break;/* length check */
    593                 }
    594                 p_payload += 2;
    595                 BE_STREAM_TO_UINT16(ex_len, p_payload);
    596                 p_payload += ex_len * 4;
    597             }
    598 
    599             if(p_payload >= p_scb->p_media_buf + p_scb->frag_off)
    600             {
    601                 AVDT_TRACE_WARNING("length check2 frag_off:%d p_media_buf:%d p_payload:%d",
    602                     p_scb->frag_off, p_scb->p_media_buf, p_payload);
    603                 break;/* length check */
    604             }
    605 
    606             /* adjust length for any padding at end of packet */
    607             if (o_p)
    608             {
    609                 /* padding length in last byte of packet */
    610                 pad_len =  *(p_scb->p_media_buf + p_scb->frag_off - 1);
    611             }
    612             else
    613                 pad_len =  0;
    614             /* payload length */
    615             payload_len = (UINT32)(p_scb->p_media_buf + p_scb->frag_off - pad_len - p_payload);
    616 
    617             AVDT_TRACE_DEBUG("Received last fragment header=%d len=%d",
    618                 p_payload - p_scb->p_media_buf,payload_len);
    619 
    620             /* send total media packet up */
    621             if (p_scb->cs.p_media_cback != NULL)
    622             {
    623                 (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb), p_payload,
    624                                            payload_len, time_stamp, seq, m_pt, marker);
    625             }
    626         }
    627     } /* while(p < p_end) */
    628 
    629     if(p < p_end)
    630     {
    631         AVDT_TRACE_WARNING("*** Got bad media packet");
    632     }
    633     GKI_freebuf(p_data->p_pkt);
    634 }
    635 #endif
    636 
    637 /*******************************************************************************
    638 **
    639 ** Function         avdt_scb_hdl_pkt
    640 **
    641 ** Description
    642 **
    643 ** Returns          Nothing.
    644 **
    645 *******************************************************************************/
    646 void avdt_scb_hdl_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    647 {
    648 #if AVDT_REPORTING == TRUE
    649     UINT8 *p;
    650 #endif
    651 
    652 #if AVDT_MULTIPLEXING == TRUE
    653     /* select right function in dependance of is fragmentation supported or not */
    654     if( 0 != (p_scb->curr_cfg.psc_mask & AVDT_PSC_MUX))
    655     {
    656         avdt_scb_hdl_pkt_frag(p_scb, p_data);
    657     }
    658     else
    659 #endif
    660 #if AVDT_REPORTING == TRUE
    661     if(p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT)
    662     {
    663         p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    664         avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
    665         GKI_freebuf(p_data->p_pkt);
    666     }
    667     else
    668 #endif
    669         avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
    670 }
    671 
    672 /*******************************************************************************
    673 **
    674 ** Function         avdt_scb_drop_pkt
    675 **
    676 ** Description      Drop an incoming media packet.  This function is called if
    677 **                  a media packet is received in any state besides streaming.
    678 **
    679 ** Returns          Nothing.
    680 **
    681 *******************************************************************************/
    682 void avdt_scb_drop_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    683 {
    684     UNUSED(p_scb);
    685 
    686     GKI_freebuf(p_data->p_pkt);
    687     AVDT_TRACE_ERROR(" avdt_scb_drop_pkt Dropped incoming media packet");
    688 }
    689 
    690 /*******************************************************************************
    691 **
    692 ** Function         avdt_scb_hdl_reconfig_cmd
    693 **
    694 ** Description      This function calls the application callback function
    695 **                  with a reconfiguration indication.
    696 **
    697 ** Returns          Nothing.
    698 **
    699 *******************************************************************************/
    700 void avdt_scb_hdl_reconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    701 {
    702     /* if command not supported */
    703     if (p_scb->cs.nsc_mask & AVDT_NSC_RECONFIG)
    704     {
    705         /* send reject */
    706         p_data->msg.hdr.err_code = AVDT_ERR_NSC;
    707         p_data->msg.hdr.err_param = 0;
    708         avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
    709     }
    710     else
    711     {
    712         /* store requested configuration */
    713         memcpy(&p_scb->req_cfg, p_data->msg.reconfig_cmd.p_cfg, sizeof(tAVDT_CFG));
    714 
    715         /* call application callback */
    716         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    717                                   NULL,
    718                                   AVDT_RECONFIG_IND_EVT,
    719                                   (tAVDT_CTRL *) &p_data->msg.reconfig_cmd);
    720     }
    721 }
    722 
    723 /*******************************************************************************
    724 **
    725 ** Function         avdt_scb_hdl_reconfig_rsp
    726 **
    727 ** Description      This function calls the application callback function
    728 **                  with a reconfiguration confirm.
    729 **
    730 ** Returns          Nothing.
    731 **
    732 *******************************************************************************/
    733 void avdt_scb_hdl_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    734 {
    735     if (p_data->msg.hdr.err_code == 0)
    736     {
    737         /* store new configuration */
    738         if (p_scb->req_cfg.num_codec > 0)
    739         {
    740             p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
    741             memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
    742         }
    743         if (p_scb->req_cfg.num_protect > 0)
    744         {
    745             p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
    746             memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
    747         }
    748     }
    749 
    750     p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
    751 
    752     /* call application callback */
    753     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    754                               NULL,
    755                               AVDT_RECONFIG_CFM_EVT,
    756                               (tAVDT_CTRL *) &p_data->msg.svccap);
    757 }
    758 
    759 /*******************************************************************************
    760 **
    761 ** Function         avdt_scb_hdl_security_cmd
    762 **
    763 ** Description      This function calls the application callback with a
    764 **                  security indication.
    765 **
    766 ** Returns          Nothing.
    767 **
    768 *******************************************************************************/
    769 void avdt_scb_hdl_security_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    770 {
    771     /* if command not supported */
    772     if (p_scb->cs.nsc_mask & AVDT_NSC_SECURITY)
    773     {
    774         /* send reject */
    775         p_data->msg.hdr.err_code = AVDT_ERR_NSC;
    776         avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
    777     }
    778     else
    779     {
    780         /* call application callback */
    781         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    782                                   NULL,
    783                                   AVDT_SECURITY_IND_EVT,
    784                                   (tAVDT_CTRL *) &p_data->msg.security_cmd);
    785     }
    786 }
    787 
    788 /*******************************************************************************
    789 **
    790 ** Function         avdt_scb_hdl_security_rsp
    791 **
    792 ** Description      This function calls the application callback with a
    793 **                  security confirm.
    794 **
    795 ** Returns          Nothing.
    796 **
    797 *******************************************************************************/
    798 void avdt_scb_hdl_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    799 {
    800     /* call application callback */
    801     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    802                               NULL,
    803                               AVDT_SECURITY_CFM_EVT,
    804                               (tAVDT_CTRL *) &p_data->msg.security_cmd);
    805 }
    806 
    807 /*******************************************************************************
    808 **
    809 ** Function         avdt_scb_hdl_setconfig_cmd
    810 **
    811 ** Description      This function marks the SCB as in use and copies the
    812 **                  configuration and peer SEID to the SCB.  It then calls
    813 **                  the application callback with a configuration indication.
    814 **
    815 ** Returns          Nothing.
    816 **
    817 *******************************************************************************/
    818 void avdt_scb_hdl_setconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    819 {
    820     tAVDT_CFG *p_cfg;
    821 
    822     if (!p_scb->in_use)
    823     {
    824         p_cfg = p_data->msg.config_cmd.p_cfg;
    825         if(p_scb->cs.cfg.codec_info[AVDT_CODEC_TYPE_INDEX] == p_cfg->codec_info[AVDT_CODEC_TYPE_INDEX])
    826         {
    827             /* set sep as in use */
    828             p_scb->in_use = TRUE;
    829 
    830             /* copy info to scb */
    831             p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
    832             p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
    833             memcpy(&p_scb->req_cfg, p_cfg, sizeof(tAVDT_CFG));
    834             /* call app callback */
    835             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), /* handle of scb- which is same as sep handle of bta_av_cb.p_scb*/
    836                                       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    837                                       AVDT_CONFIG_IND_EVT,
    838                                       (tAVDT_CTRL *) &p_data->msg.config_cmd);
    839         }
    840         else
    841         {
    842             p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
    843             p_data->msg.hdr.err_param = 0;
    844             avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
    845                               p_data->msg.hdr.sig_id, &p_data->msg);
    846         }
    847     }
    848     else
    849     {
    850         avdt_scb_rej_in_use(p_scb, p_data);
    851     }
    852 }
    853 
    854 /*******************************************************************************
    855 **
    856 ** Function         avdt_scb_hdl_setconfig_rej
    857 **
    858 ** Description      This function marks the SCB as not in use and calls the
    859 **                  application callback with an open confirm indicating failure.
    860 **
    861 ** Returns          Nothing.
    862 **
    863 *******************************************************************************/
    864 void avdt_scb_hdl_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    865 {
    866     /* clear scb variables */
    867     avdt_scb_clr_vars(p_scb, p_data);
    868 
    869     /* tell ccb we're done with signaling channel */
    870     avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_CCB_UL_CLOSE_EVT, NULL);
    871 
    872     /* call application callback */
    873     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    874                               NULL,
    875                               AVDT_OPEN_CFM_EVT,
    876                               (tAVDT_CTRL *) &p_data->msg.hdr);
    877 }
    878 
    879 /*******************************************************************************
    880 **
    881 ** Function         avdt_scb_hdl_setconfig_rsp
    882 **
    883 ** Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
    884 **                  to initiate sending of an open command message.
    885 **
    886 ** Returns          Nothing.
    887 **
    888 *******************************************************************************/
    889 void avdt_scb_hdl_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    890 {
    891     tAVDT_EVT_HDR   single;
    892     UNUSED(p_data);
    893 
    894     if (p_scb->p_ccb != NULL)
    895     {
    896         /* save configuration */
    897         memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
    898 
    899         /* initiate open */
    900         single.seid = p_scb->peer_seid;
    901         avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, (tAVDT_SCB_EVT *) &single);
    902     }
    903 }
    904 
    905 /*******************************************************************************
    906 **
    907 ** Function         avdt_scb_hdl_start_cmd
    908 **
    909 ** Description      This function calls the application callback with a
    910 **                  start indication.
    911 **
    912 ** Returns          Nothing.
    913 **
    914 *******************************************************************************/
    915 void avdt_scb_hdl_start_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    916 {
    917     UNUSED(p_data);
    918 
    919     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    920                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    921                               AVDT_START_IND_EVT,
    922                               NULL);
    923 }
    924 
    925 /*******************************************************************************
    926 **
    927 ** Function         avdt_scb_hdl_start_rsp
    928 **
    929 ** Description      This function calls the application callback with a
    930 **                  start confirm.
    931 **
    932 ** Returns          Nothing.
    933 **
    934 *******************************************************************************/
    935 void avdt_scb_hdl_start_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    936 {
    937     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    938                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    939                               AVDT_START_CFM_EVT,
    940                               (tAVDT_CTRL *) &p_data->msg.hdr);
    941 }
    942 
    943 /*******************************************************************************
    944 **
    945 ** Function         avdt_scb_hdl_suspend_cmd
    946 **
    947 ** Description      This function calls the application callback with a suspend
    948 **                  indication.
    949 **
    950 ** Returns          Nothing.
    951 **
    952 *******************************************************************************/
    953 void avdt_scb_hdl_suspend_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    954 {
    955     UNUSED(p_data);
    956 
    957     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    958                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    959                               AVDT_SUSPEND_IND_EVT,
    960                               NULL);
    961 }
    962 
    963 /*******************************************************************************
    964 **
    965 ** Function         avdt_scb_hdl_suspend_rsp
    966 **
    967 ** Description      This function calls the application callback with a suspend
    968 **                  confirm.
    969 **
    970 ** Returns          Nothing.
    971 **
    972 *******************************************************************************/
    973 void avdt_scb_hdl_suspend_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    974 {
    975     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    976                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    977                               AVDT_SUSPEND_CFM_EVT,
    978                               (tAVDT_CTRL *) &p_data->msg.hdr);
    979 }
    980 
    981 /*******************************************************************************
    982 **
    983 ** Function         avdt_scb_hdl_tc_close
    984 **
    985 ** Description      This function is called when the transport channel is
    986 **                  closed.  It marks the SCB as not in use and
    987 **                  initializes certain SCB parameters.  It then sends
    988 **                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
    989 **                  initiated the close.  It then checks to see if the SCB
    990 **                  is to be removed.  If it is it deallocates the SCB.  Finally,
    991 **                  it calls the application callback with a close indication.
    992 **
    993 ** Returns          Nothing.
    994 **
    995 *******************************************************************************/
    996 void avdt_scb_hdl_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    997 {
    998     UINT8               hdl = avdt_scb_to_hdl(p_scb);
    999     tAVDT_CTRL_CBACK    *p_ctrl_cback = p_scb->cs.p_ctrl_cback;
   1000     tAVDT_CTRL          avdt_ctrl;
   1001     UINT8               event;
   1002     tAVDT_CCB           *p_ccb = p_scb->p_ccb;
   1003     BD_ADDR remote_addr;
   1004 
   1005 
   1006     memcpy (remote_addr, p_ccb->peer_addr, BD_ADDR_LEN);
   1007 
   1008     /* set up hdr */
   1009     avdt_ctrl.hdr.err_code = p_scb->close_code;
   1010 
   1011     /* clear sep variables */
   1012     avdt_scb_clr_vars(p_scb, p_data);
   1013     p_scb->media_seq = 0;
   1014     p_scb->cong = FALSE;
   1015 
   1016     /* free pkt we're holding, if any */
   1017     if (p_scb->p_pkt != NULL)
   1018     {
   1019         GKI_freebuf(p_scb->p_pkt);
   1020         p_scb->p_pkt = NULL;
   1021     }
   1022 
   1023     /* stop transport channel timer */
   1024     btu_stop_timer(&p_scb->timer_entry);
   1025 
   1026     if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT))
   1027     {
   1028         /* tell ccb we're done with signaling channel */
   1029         avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
   1030     }
   1031     event = (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
   1032     p_scb->role = AVDT_CLOSE_ACP;
   1033 
   1034     if (p_scb->remove)
   1035     {
   1036         avdt_scb_dealloc(p_scb, NULL);
   1037     }
   1038 
   1039     /* call app callback */
   1040     (*p_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl);
   1041 }
   1042 
   1043 /*******************************************************************************
   1044 **
   1045 ** Function         avdt_scb_snd_delay_rpt_req
   1046 **
   1047 ** Description      This function calls the application callback with a delay
   1048 **                  report.
   1049 **
   1050 ** Returns          Nothing.
   1051 **
   1052 *******************************************************************************/
   1053 void avdt_scb_snd_delay_rpt_req (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1054 {
   1055     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT, (tAVDT_MSG *) &p_data->apidelay);
   1056 }
   1057 
   1058 /*******************************************************************************
   1059 **
   1060 ** Function         avdt_scb_hdl_delay_rpt_cmd
   1061 **
   1062 ** Description      This function calls the application callback with a delay
   1063 **                  report.
   1064 **
   1065 ** Returns          Nothing.
   1066 **
   1067 *******************************************************************************/
   1068 void avdt_scb_hdl_delay_rpt_cmd (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1069 {
   1070     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1071                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1072                               AVDT_DELAY_REPORT_EVT,
   1073                               (tAVDT_CTRL *) &p_data->msg.hdr);
   1074 
   1075     if (p_scb->p_ccb)
   1076         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
   1077     else
   1078         avdt_scb_rej_not_in_use(p_scb, p_data);
   1079 }
   1080 
   1081 /*******************************************************************************
   1082 **
   1083 ** Function         avdt_scb_hdl_delay_rpt_rsp
   1084 **
   1085 ** Description      This function calls the application callback with a delay
   1086 **                  report.
   1087 **
   1088 ** Returns          Nothing.
   1089 **
   1090 *******************************************************************************/
   1091 void avdt_scb_hdl_delay_rpt_rsp (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1092 {
   1093     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1094                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1095                               AVDT_DELAY_REPORT_CFM_EVT,
   1096                               (tAVDT_CTRL *) &p_data->msg.hdr);
   1097 }
   1098 
   1099 #if AVDT_REPORTING == TRUE
   1100 /*******************************************************************************
   1101 **
   1102 ** Function         avdt_scb_hdl_tc_close_sto
   1103 **
   1104 ** Description      This function is called when a channel is closed in OPEN
   1105 **                  state.  Check the channel type and process accordingly.
   1106 **
   1107 ** Returns          Nothing.
   1108 **
   1109 *******************************************************************************/
   1110 void avdt_scb_hdl_tc_close_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1111 {
   1112     tAVDT_CTRL          avdt_ctrl;
   1113     /* AVDT_CHAN_SIG does not visit this action */
   1114     if(p_data && p_data->close.type != AVDT_CHAN_MEDIA)
   1115     {
   1116         /* it's reporting or recovery channel,
   1117          * the channel close in open state means the peer does not support it */
   1118         if(p_data->close.old_tc_state == AVDT_AD_ST_OPEN)
   1119         {
   1120             avdt_ctrl.hdr.err_code = 0;
   1121             avdt_ctrl.hdr.err_param = 0;
   1122             /* call app callback */
   1123             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1124                                       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1125                                       AVDT_REPORT_DISCONN_EVT, &avdt_ctrl);
   1126         }
   1127     }
   1128     else
   1129     {
   1130         /* must be in OPEN state. need to go back to idle */
   1131         avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
   1132         avdt_scb_hdl_tc_close(p_scb, p_data);
   1133     }
   1134 }
   1135 #endif
   1136 
   1137 /*******************************************************************************
   1138 **
   1139 ** Function         avdt_scb_hdl_tc_open
   1140 **
   1141 ** Description      This function is called when the transport channel is
   1142 **                  opened while in the opening state.  It calls the
   1143 **                  application callback with an open indication or open
   1144 **                  confirm depending on who initiated the open procedure.
   1145 **
   1146 ** Returns          Nothing.
   1147 **
   1148 *******************************************************************************/
   1149 void avdt_scb_hdl_tc_open(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1150 {
   1151     UINT8   event;
   1152 #if AVDT_REPORTING == TRUE
   1153     UINT8   role;
   1154 #endif
   1155 
   1156     /* stop transport channel connect timer */
   1157     btu_stop_timer(&p_scb->timer_entry);
   1158 
   1159     event = (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
   1160     p_data->open.hdr.err_code = 0;
   1161 
   1162     AVDT_TRACE_DEBUG("psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x",
   1163         p_scb->cs.cfg.psc_mask, p_scb->req_cfg.psc_mask, p_scb->curr_cfg.psc_mask);
   1164 #if AVDT_REPORTING == TRUE
   1165     if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
   1166     {
   1167         /* open the reporting channel, if both devices support it */
   1168         role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
   1169         avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
   1170     }
   1171 #endif
   1172 
   1173     /* call app callback */
   1174     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1175                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1176                               event,
   1177                               (tAVDT_CTRL *) &p_data->open);
   1178 }
   1179 
   1180 #if AVDT_REPORTING == TRUE
   1181 /*******************************************************************************
   1182 **
   1183 ** Function         avdt_scb_hdl_tc_open_sto
   1184 **
   1185 ** Description      This function is called when the transport channel is
   1186 **                  opened while in the opening state.  It calls the
   1187 **                  application callback with an open indication or open
   1188 **                  confirm depending on who initiated the open procedure.
   1189 **
   1190 ** Returns          Nothing.
   1191 **
   1192 *******************************************************************************/
   1193 void avdt_scb_hdl_tc_open_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1194 {
   1195     tAVDT_CTRL          avdt_ctrl;
   1196     /* open reporting channel here, when it is implemented */
   1197 
   1198     /* call app callback */
   1199     if(p_data->open.hdr.err_code == AVDT_CHAN_REPORT)
   1200     {
   1201         avdt_ctrl.hdr.err_code = 0;
   1202         avdt_ctrl.hdr.err_param = 1;
   1203         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1204                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1205                               AVDT_REPORT_CONN_EVT, &avdt_ctrl);
   1206     }
   1207 }
   1208 #endif
   1209 
   1210 /*******************************************************************************
   1211 **
   1212 ** Function         avdt_scb_hdl_write_req_no_frag
   1213 **
   1214 ** Description      This function frees the media packet currently stored in
   1215 **                  the SCB, if any.  Then it builds a new media packet from
   1216 **                  with the passed in buffer and stores it in the SCB.
   1217 **
   1218 ** Returns          Nothing.
   1219 **
   1220 *******************************************************************************/
   1221 void avdt_scb_hdl_write_req_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1222 {
   1223     UINT8   *p;
   1224     UINT32  ssrc;
   1225 
   1226     /* free packet we're holding, if any; to be replaced with new */
   1227     if (p_scb->p_pkt != NULL)
   1228     {
   1229         GKI_freebuf(p_scb->p_pkt);
   1230 
   1231         /* this shouldn't be happening */
   1232         AVDT_TRACE_WARNING("Dropped media packet; congested");
   1233     }
   1234 
   1235     /* build a media packet */
   1236     /* Add RTP header if required */
   1237     if ( !(p_data->apiwrite.opt & AVDT_DATA_OPT_NO_RTP) )
   1238     {
   1239         ssrc = avdt_scb_gen_ssrc(p_scb);
   1240 
   1241         p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
   1242         p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
   1243         p_scb->media_seq++;
   1244         p = (UINT8 *)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
   1245 
   1246         UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
   1247         UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
   1248         UINT16_TO_BE_STREAM(p, p_scb->media_seq);
   1249         UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
   1250         UINT32_TO_BE_STREAM(p, ssrc);
   1251     }
   1252 
   1253     /* store it */
   1254     p_scb->p_pkt = p_data->apiwrite.p_buf;
   1255 }
   1256 
   1257 #if AVDT_MULTIPLEXING == TRUE
   1258 /*******************************************************************************
   1259 **
   1260 ** Function         avdt_scb_hdl_write_req_frag
   1261 **
   1262 ** Description      This function builds a new fragments of media packet from
   1263 **                  the passed in buffers and stores them in the SCB.
   1264 **
   1265 ** Returns          Nothing.
   1266 **
   1267 *******************************************************************************/
   1268 void avdt_scb_hdl_write_req_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1269 {
   1270     UINT8   *p;
   1271     UINT32  ssrc;
   1272     BT_HDR  *p_frag;
   1273 
   1274     /* free fragments we're holding, if any; it shouldn't happen */
   1275     if (!GKI_queue_is_empty(&p_scb->frag_q))
   1276     {
   1277         while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1278             GKI_freebuf(p_frag);
   1279 
   1280         /* this shouldn't be happening */
   1281         AVDT_TRACE_WARNING("*** Dropped media packet; congested");
   1282     }
   1283 
   1284     /* build a media fragments */
   1285     p_scb->frag_off = p_data->apiwrite.data_len;
   1286     p_scb->p_next_frag = p_data->apiwrite.p_data;
   1287 
   1288     ssrc = avdt_scb_gen_ssrc(p_scb);
   1289 
   1290     /* get first packet */
   1291     p_frag = (BT_HDR*)GKI_getfirst (&p_data->apiwrite.frag_q);
   1292     /* posit on Adaptation Layer header */
   1293     p_frag->len += AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
   1294     p_frag->offset -= AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
   1295     p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   1296 
   1297     /* Adaptation Layer header */
   1298     /* TSID, no-fragment bit and coding of length(in 2 length octets following) */
   1299     *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | AVDT_ALH_LCODE_16BIT;
   1300 
   1301     /* length of all remaining transport packet */
   1302     UINT16_TO_BE_STREAM(p, p_frag->layer_specific+AVDT_MEDIA_HDR_SIZE );
   1303     /* media header */
   1304     UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
   1305     UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
   1306     UINT16_TO_BE_STREAM(p, p_scb->media_seq);
   1307     UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
   1308     UINT32_TO_BE_STREAM(p, ssrc);
   1309     p_scb->media_seq++;
   1310 
   1311     while((p_frag = (BT_HDR*)GKI_getnext (p_frag)) != NULL)
   1312     {
   1313         /* posit on Adaptation Layer header */
   1314         p_frag->len += AVDT_AL_HDR_SIZE;
   1315         p_frag->offset -= AVDT_AL_HDR_SIZE;
   1316         p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   1317         /* Adaptation Layer header */
   1318         /* TSID, fragment bit and coding of length(in 2 length octets following) */
   1319         *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
   1320 
   1321         /* length of all remaining transport packet */
   1322         UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
   1323     }
   1324 
   1325     /* store it */
   1326     p_scb->frag_q = p_data->apiwrite.frag_q;
   1327 }
   1328 #endif
   1329 
   1330 
   1331 /*******************************************************************************
   1332 **
   1333 ** Function         avdt_scb_hdl_write_req
   1334 **
   1335 ** Description      This function calls one of the two versions of building functions
   1336 **                  for case with and without fragmentation
   1337 **
   1338 ** Returns          Nothing.
   1339 **
   1340 *******************************************************************************/
   1341 void avdt_scb_hdl_write_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1342 {
   1343 #if AVDT_MULTIPLEXING == TRUE
   1344     if (GKI_queue_is_empty(&p_data->apiwrite.frag_q))
   1345 #endif
   1346         avdt_scb_hdl_write_req_no_frag(p_scb, p_data);
   1347 #if AVDT_MULTIPLEXING == TRUE
   1348     else
   1349         avdt_scb_hdl_write_req_frag(p_scb, p_data);
   1350 #endif
   1351 }
   1352 
   1353 /*******************************************************************************
   1354 **
   1355 ** Function         avdt_scb_snd_abort_req
   1356 **
   1357 ** Description      This function sends an abort command message.
   1358 **
   1359 ** Returns          Nothing.
   1360 **
   1361 *******************************************************************************/
   1362 void avdt_scb_snd_abort_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1363 {
   1364     tAVDT_EVT_HDR   hdr;
   1365     UNUSED(p_data);
   1366 
   1367     if (p_scb->p_ccb != NULL)
   1368     {
   1369         p_scb->role = AVDT_CLOSE_INT;
   1370 
   1371         hdr.seid = p_scb->peer_seid;
   1372 
   1373         avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, (tAVDT_MSG *) &hdr);
   1374     }
   1375 }
   1376 
   1377 /*******************************************************************************
   1378 **
   1379 ** Function         avdt_scb_snd_abort_rsp
   1380 **
   1381 ** Description      This function sends an abort response message.
   1382 **
   1383 ** Returns          Nothing.
   1384 **
   1385 *******************************************************************************/
   1386 void avdt_scb_snd_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1387 {
   1388     UNUSED(p_scb);
   1389 
   1390     avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
   1391                       &p_data->msg);
   1392 }
   1393 
   1394 /*******************************************************************************
   1395 **
   1396 ** Function         avdt_scb_snd_close_req
   1397 **
   1398 ** Description      This function sends a close command message.
   1399 **
   1400 ** Returns          Nothing.
   1401 **
   1402 *******************************************************************************/
   1403 void avdt_scb_snd_close_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1404 {
   1405     tAVDT_EVT_HDR   hdr;
   1406     UNUSED(p_data);
   1407 
   1408     p_scb->role = AVDT_CLOSE_INT;
   1409 
   1410     hdr.seid = p_scb->peer_seid;
   1411 
   1412     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, (tAVDT_MSG *) &hdr);
   1413 }
   1414 
   1415 /*******************************************************************************
   1416 **
   1417 ** Function         avdt_scb_snd_stream_close
   1418 **
   1419 ** Description      This function sends a close command message.
   1420 **
   1421 ** Returns          Nothing.
   1422 **
   1423 *******************************************************************************/
   1424 void avdt_scb_snd_stream_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1425 {
   1426 #if AVDT_MULTIPLEXING == TRUE
   1427     BT_HDR          *p_frag;
   1428 
   1429     AVDT_TRACE_WARNING("avdt_scb_snd_stream_close c:%d, off:%d",
   1430         GKI_queue_length(&p_scb->frag_q), p_scb->frag_off);
   1431     /* clean fragments queue */
   1432     while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1433          GKI_freebuf(p_frag);
   1434     p_scb->frag_off = 0;
   1435 #endif
   1436     if (p_scb->p_pkt)
   1437     {
   1438         GKI_freebuf(p_scb->p_pkt);
   1439         p_scb->p_pkt = NULL;
   1440     }
   1441 
   1442 #if 0
   1443     if(p_scb->cong)
   1444         p_scb->cong = FALSE;
   1445 
   1446     /* p_scb->curr_cfg.mux_tsid_media == 0 */
   1447 #endif
   1448     avdt_scb_snd_close_req(p_scb, p_data);
   1449 }
   1450 
   1451 /*******************************************************************************
   1452 **
   1453 ** Function         avdt_scb_snd_close_rsp
   1454 **
   1455 ** Description      This function sends a close response message.
   1456 **
   1457 ** Returns          Nothing.
   1458 **
   1459 *******************************************************************************/
   1460 void avdt_scb_snd_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1461 {
   1462     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
   1463 }
   1464 
   1465 /*******************************************************************************
   1466 **
   1467 ** Function         avdt_scb_snd_getconfig_req
   1468 **
   1469 ** Description      This function sends a get configuration command message.
   1470 **
   1471 ** Returns          Nothing.
   1472 **
   1473 *******************************************************************************/
   1474 void avdt_scb_snd_getconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1475 {
   1476     tAVDT_EVT_HDR   hdr;
   1477     UNUSED(p_data);
   1478 
   1479     hdr.seid = p_scb->peer_seid;
   1480 
   1481     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, (tAVDT_MSG *) &hdr);
   1482 }
   1483 
   1484 /*******************************************************************************
   1485 **
   1486 ** Function         avdt_scb_snd_getconfig_rsp
   1487 **
   1488 ** Description      This function sends a get configuration response message.
   1489 **
   1490 ** Returns          Nothing.
   1491 **
   1492 *******************************************************************************/
   1493 void avdt_scb_snd_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1494 {
   1495     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
   1496 }
   1497 
   1498 /*******************************************************************************
   1499 **
   1500 ** Function         avdt_scb_snd_open_req
   1501 **
   1502 ** Description      This function sends an open command message.
   1503 **
   1504 ** Returns          Nothing.
   1505 **
   1506 *******************************************************************************/
   1507 void avdt_scb_snd_open_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1508 {
   1509     tAVDT_EVT_HDR   hdr;
   1510     UNUSED(p_data);
   1511 
   1512     hdr.seid = p_scb->peer_seid;
   1513 
   1514     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, (tAVDT_MSG *) &hdr);
   1515 }
   1516 
   1517 /*******************************************************************************
   1518 **
   1519 ** Function         avdt_scb_snd_open_rsp
   1520 **
   1521 ** Description      This function sends an open response message.  It also
   1522 **                  calls avdt_ad_open_req() to accept a transport channel
   1523 **                  connection.
   1524 **
   1525 ** Returns          Nothing.
   1526 **
   1527 *******************************************************************************/
   1528 void avdt_scb_snd_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1529 {
   1530     /* notify adaption that we're waiting for transport channel open */
   1531     p_scb->role = AVDT_OPEN_ACP;
   1532     avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
   1533 
   1534     /* send response */
   1535     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
   1536 
   1537     /* start tc connect timer */
   1538     btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
   1539 }
   1540 
   1541 /*******************************************************************************
   1542 **
   1543 ** Function         avdt_scb_snd_reconfig_req
   1544 **
   1545 ** Description      This function stores the configuration parameters in the
   1546 **                  SCB and sends a reconfiguration command message.
   1547 **
   1548 ** Returns          Nothing.
   1549 **
   1550 *******************************************************************************/
   1551 void avdt_scb_snd_reconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1552 {
   1553     memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
   1554     p_data->msg.hdr.seid = p_scb->peer_seid;
   1555     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
   1556 }
   1557 
   1558 /*******************************************************************************
   1559 **
   1560 ** Function         avdt_scb_snd_reconfig_rsp
   1561 **
   1562 ** Description      This function stores the configuration parameters in the
   1563 **                  SCB and sends a reconfiguration response message.
   1564 **
   1565 ** Returns          Nothing.
   1566 **
   1567 *******************************************************************************/
   1568 void avdt_scb_snd_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1569 {
   1570     if (p_data->msg.hdr.err_code == 0)
   1571     {
   1572         /* store new configuration */
   1573         if (p_scb->req_cfg.num_codec > 0)
   1574         {
   1575             p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
   1576             memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
   1577         }
   1578         if (p_scb->req_cfg.num_protect > 0)
   1579         {
   1580             p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
   1581             memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
   1582         }
   1583 
   1584         /* send response */
   1585         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
   1586     }
   1587     else
   1588     {
   1589         /* send reject */
   1590         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
   1591     }
   1592 }
   1593 
   1594 /*******************************************************************************
   1595 **
   1596 ** Function         avdt_scb_snd_security_req
   1597 **
   1598 ** Description      This function sends a security command message.
   1599 **
   1600 ** Returns          Nothing.
   1601 **
   1602 *******************************************************************************/
   1603 void avdt_scb_snd_security_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1604 {
   1605     p_data->msg.hdr.seid = p_scb->peer_seid;
   1606     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
   1607 }
   1608 
   1609 /*******************************************************************************
   1610 **
   1611 ** Function         avdt_scb_snd_security_rsp
   1612 **
   1613 ** Description      This function sends a security response message.
   1614 **
   1615 ** Returns          Nothing.
   1616 **
   1617 *******************************************************************************/
   1618 void avdt_scb_snd_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1619 {
   1620     if (p_data->msg.hdr.err_code == 0)
   1621     {
   1622         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
   1623     }
   1624     else
   1625     {
   1626         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
   1627     }
   1628 }
   1629 
   1630 /*******************************************************************************
   1631 **
   1632 ** Function         avdt_scb_snd_setconfig_rej
   1633 **
   1634 ** Description      This function marks the SCB as not in use and sends a
   1635 **                  set configuration reject message.
   1636 **
   1637 ** Returns          Nothing.
   1638 **
   1639 *******************************************************************************/
   1640 void avdt_scb_snd_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1641 {
   1642     if (p_scb->p_ccb != NULL)
   1643     {
   1644         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1645 
   1646         /* clear scb variables */
   1647         avdt_scb_clr_vars(p_scb, p_data);
   1648     }
   1649 }
   1650 
   1651 /*******************************************************************************
   1652 **
   1653 ** Function         avdt_scb_snd_setconfig_req
   1654 **
   1655 ** Description      This function marks the SCB as in use and copies the
   1656 **                  configuration parameters to the SCB.  Then the function
   1657 **                  sends a set configuration command message and initiates
   1658 **                  opening of the signaling channel.
   1659 **
   1660 ** Returns          Nothing.
   1661 **
   1662 *******************************************************************************/
   1663 void avdt_scb_snd_setconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1664 {
   1665     tAVDT_CFG *p_req, *p_cfg;
   1666 
   1667     /* copy API parameters to scb, set scb as in use */
   1668     p_scb->in_use = TRUE;
   1669     p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
   1670     p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
   1671     p_req = p_data->msg.config_cmd.p_cfg;
   1672     p_cfg = &p_scb->cs.cfg;
   1673 #if AVDT_MULTIPLEXING == TRUE
   1674     p_req->mux_tsid_media = p_cfg->mux_tsid_media;
   1675     p_req->mux_tcid_media = p_cfg->mux_tcid_media;
   1676     if(p_req->psc_mask & AVDT_PSC_REPORT)
   1677     {
   1678         p_req->mux_tsid_report = p_cfg->mux_tsid_report;
   1679         p_req->mux_tcid_report = p_cfg->mux_tcid_report;
   1680     }
   1681 #endif
   1682     memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
   1683 
   1684     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1685 
   1686     /* tell ccb to open channel */
   1687     avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
   1688 }
   1689 
   1690 /*******************************************************************************
   1691 **
   1692 ** Function         avdt_scb_snd_setconfig_rsp
   1693 **
   1694 ** Description      This function copies the requested configuration into the
   1695 **                  current configuration and sends a set configuration
   1696 **                  response message.
   1697 **
   1698 ** Returns          Nothing.
   1699 **
   1700 *******************************************************************************/
   1701 void avdt_scb_snd_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1702 {
   1703     if (p_scb->p_ccb != NULL)
   1704     {
   1705         memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
   1706 
   1707         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1708     }
   1709 }
   1710 
   1711 /*******************************************************************************
   1712 **
   1713 ** Function         avdt_scb_snd_tc_close
   1714 **
   1715 ** Description      This function calls avdt_ad_close_req() to close the
   1716 **                  transport channel for this SCB.
   1717 **
   1718 ** Returns          Nothing.
   1719 **
   1720 *******************************************************************************/
   1721 void avdt_scb_snd_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1722 {
   1723     UNUSED(p_data);
   1724 
   1725 #if AVDT_REPORTING == TRUE
   1726     if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
   1727         avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
   1728 #endif
   1729     avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
   1730 }
   1731 
   1732 /*******************************************************************************
   1733 **
   1734 ** Function         avdt_scb_cb_err
   1735 **
   1736 ** Description      This function calls the application callback function
   1737 **                  indicating an error.
   1738 **
   1739 ** Returns          Nothing.
   1740 **
   1741 *******************************************************************************/
   1742 void avdt_scb_cb_err(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1743 {
   1744     tAVDT_CTRL          avdt_ctrl;
   1745     UNUSED(p_data);
   1746 
   1747     /* set error code and parameter */
   1748     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1749     avdt_ctrl.hdr.err_param = 0;
   1750 
   1751     /* call callback, using lookup table to get callback event */
   1752     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1753                               NULL,
   1754                               avdt_scb_cback_evt[p_scb->curr_evt],
   1755                               &avdt_ctrl);
   1756 }
   1757 
   1758 /*******************************************************************************
   1759 **
   1760 ** Function         avdt_scb_cong_state
   1761 **
   1762 ** Description      This function sets the congestion state of the SCB media
   1763 **                  transport channel.
   1764 **
   1765 ** Returns          Nothing.
   1766 **
   1767 *******************************************************************************/
   1768 void avdt_scb_cong_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1769 {
   1770     p_scb->cong = p_data->llcong;
   1771 }
   1772 
   1773 /*******************************************************************************
   1774 **
   1775 ** Function         avdt_scb_rej_state
   1776 **
   1777 ** Description      This function sends a reject message to the peer indicating
   1778 **                  incorrect state for the received command message.
   1779 **
   1780 ** Returns          Nothing.
   1781 **
   1782 *******************************************************************************/
   1783 void avdt_scb_rej_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1784 {
   1785     UNUSED(p_scb);
   1786 
   1787     p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
   1788     p_data->msg.hdr.err_param = 0;
   1789     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1790                       p_data->msg.hdr.sig_id, &p_data->msg);
   1791 }
   1792 
   1793 /*******************************************************************************
   1794 **
   1795 ** Function         avdt_scb_rej_in_use
   1796 **
   1797 ** Description      This function sends a reject message to the peer indicating
   1798 **                  the stream is in use.
   1799 **
   1800 ** Returns          Nothing.
   1801 **
   1802 *******************************************************************************/
   1803 void avdt_scb_rej_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1804 {
   1805     UNUSED(p_scb);
   1806 
   1807     p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
   1808     p_data->msg.hdr.err_param = 0;
   1809     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1810                       p_data->msg.hdr.sig_id, &p_data->msg);
   1811 }
   1812 
   1813 /*******************************************************************************
   1814 **
   1815 ** Function         avdt_scb_rej_not_in_use
   1816 **
   1817 ** Description      This function sends a reject message to the peer indicating
   1818 **                  the stream is in use.
   1819 **
   1820 ** Returns          Nothing.
   1821 **
   1822 *******************************************************************************/
   1823 void avdt_scb_rej_not_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1824 {
   1825     UNUSED(p_scb);
   1826 
   1827     p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
   1828     p_data->msg.hdr.err_param = 0;
   1829     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1830                       p_data->msg.hdr.sig_id, &p_data->msg);
   1831 }
   1832 
   1833 /*******************************************************************************
   1834 **
   1835 ** Function         avdt_scb_set_remove
   1836 **
   1837 ** Description      This function marks an SCB to be removed.
   1838 **
   1839 ** Returns          Nothing.
   1840 **
   1841 *******************************************************************************/
   1842 void avdt_scb_set_remove(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1843 {
   1844     UNUSED(p_data);
   1845 
   1846     p_scb->remove = TRUE;
   1847 }
   1848 
   1849 /*******************************************************************************
   1850 **
   1851 ** Function         avdt_scb_free_pkt
   1852 **
   1853 ** Description      This function frees the media packet passed in.
   1854 **
   1855 ** Returns          Nothing.
   1856 **
   1857 *******************************************************************************/
   1858 void avdt_scb_free_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1859 {
   1860     tAVDT_CTRL      avdt_ctrl;
   1861 #if AVDT_MULTIPLEXING == TRUE
   1862     BT_HDR          *p_frag;
   1863 #endif
   1864 
   1865     /* set error code and parameter */
   1866     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1867     avdt_ctrl.hdr.err_param = 0;
   1868 
   1869     /* p_buf can be NULL in case using of fragments queue frag_q */
   1870     if(p_data->apiwrite.p_buf)
   1871         GKI_freebuf(p_data->apiwrite.p_buf);
   1872 
   1873 #if AVDT_MULTIPLEXING == TRUE
   1874     /* clean fragments queue */
   1875     while((p_frag = (BT_HDR*)GKI_dequeue (&p_data->apiwrite.frag_q)) != NULL)
   1876          GKI_freebuf(p_frag);
   1877 #endif
   1878 
   1879     AVDT_TRACE_WARNING("Dropped media packet");
   1880 
   1881     /* we need to call callback to keep data flow going */
   1882     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1883                               &avdt_ctrl);
   1884 }
   1885 
   1886 /*******************************************************************************
   1887 **
   1888 ** Function         avdt_scb_clr_pkt
   1889 **
   1890 ** Description      This function frees the media packet stored in the SCB.
   1891 **
   1892 ** Returns          Nothing.
   1893 **
   1894 *******************************************************************************/
   1895 void avdt_scb_clr_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1896 {
   1897     tAVDT_CTRL      avdt_ctrl;
   1898     tAVDT_CCB       *p_ccb;
   1899     UINT8           tcid;
   1900     UINT16          lcid;
   1901 #if AVDT_MULTIPLEXING == TRUE
   1902     BT_HDR          *p_frag;
   1903 #endif
   1904     UNUSED(p_data);
   1905 
   1906     /* set error code and parameter */
   1907     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1908     avdt_ctrl.hdr.err_param = 0;
   1909     /* flush the media data queued at L2CAP */
   1910     if((p_ccb = p_scb->p_ccb) != NULL)
   1911     {
   1912         /* get tcid from type, scb */
   1913         tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
   1914 
   1915         lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
   1916         L2CA_FlushChannel (lcid, L2CAP_FLUSH_CHANS_ALL);
   1917     }
   1918 
   1919     if (p_scb->p_pkt != NULL)
   1920     {
   1921         GKI_freebuf(p_scb->p_pkt);
   1922         p_scb->p_pkt = NULL;
   1923 
   1924         AVDT_TRACE_DEBUG("Dropped stored media packet");
   1925 
   1926         /* we need to call callback to keep data flow going */
   1927         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1928                                   &avdt_ctrl);
   1929     }
   1930 #if AVDT_MULTIPLEXING == TRUE
   1931     else if(!GKI_queue_is_empty (&p_scb->frag_q))
   1932     {
   1933         AVDT_TRACE_DEBUG("Dropped fragments queue");
   1934         /* clean fragments queue */
   1935         while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1936              GKI_freebuf(p_frag);
   1937 
   1938         p_scb->frag_off = 0;
   1939 
   1940         /* we need to call callback to keep data flow going */
   1941         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1942                                   &avdt_ctrl);
   1943     }
   1944 #endif
   1945 }
   1946 
   1947 
   1948 /*******************************************************************************
   1949 **
   1950 ** Function         avdt_scb_chk_snd_pkt
   1951 **
   1952 ** Description      This function checks if the SCB is congested, and if not
   1953 **                  congested it sends a stored media packet, if any.  After it
   1954 **                  sends the packet it calls the application callback function
   1955 **                  with a write confirm.
   1956 **
   1957 ** Returns          Nothing.
   1958 **
   1959 *******************************************************************************/
   1960 void avdt_scb_chk_snd_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1961 {
   1962     tAVDT_CTRL      avdt_ctrl;
   1963     BT_HDR          *p_pkt;
   1964 #if AVDT_MULTIPLEXING == TRUE
   1965     BOOLEAN         sent = FALSE;
   1966     UINT8   res = AVDT_AD_SUCCESS;
   1967     tAVDT_SCB_EVT data;
   1968 #endif
   1969     UNUSED(p_data);
   1970 
   1971     avdt_ctrl.hdr.err_code = 0;
   1972 
   1973     if (!p_scb->cong)
   1974     {
   1975         if (p_scb->p_pkt != NULL)
   1976         {
   1977             p_pkt = p_scb->p_pkt;
   1978             p_scb->p_pkt = NULL;
   1979             avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
   1980 
   1981             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
   1982         }
   1983 #if AVDT_MULTIPLEXING == TRUE
   1984         else
   1985         {
   1986 #if 0
   1987             AVDT_TRACE_DEBUG("num_q=%d",
   1988                 L2CA_FlushChannel(avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb)].lcid),
   1989                                   L2CAP_FLUSH_CHANS_GET);
   1990 #endif
   1991             while((p_pkt = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
   1992             {
   1993                 sent = TRUE;
   1994                 AVDT_TRACE_DEBUG("Send fragment len=%d",p_pkt->len);
   1995                 /* fragments queue contains fragment to send */
   1996                 res = avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
   1997                 if(AVDT_AD_CONGESTED == res)
   1998                 {
   1999                     p_scb->cong = TRUE;
   2000                     AVDT_TRACE_DEBUG("avdt/l2c congested!!");
   2001                     break;/* exit loop if channel became congested */
   2002             }
   2003             }
   2004             AVDT_TRACE_DEBUG("res=%d left=%d",res, p_scb->frag_off);
   2005 
   2006             if(p_scb->frag_off)
   2007             {
   2008                 if(AVDT_AD_SUCCESS == res || GKI_queue_is_empty (&p_scb->frag_q))
   2009                 {
   2010                     /* all buffers were sent to L2CAP, compose more to queue */
   2011                     avdt_scb_queue_frags(p_scb, &p_scb->p_next_frag, &p_scb->frag_off, &p_scb->frag_q);
   2012                     if(!GKI_queue_is_empty (&p_scb->frag_q))
   2013                     {
   2014                         data.llcong = p_scb->cong;
   2015                         avdt_scb_event(p_scb, AVDT_SCB_TC_CONG_EVT, &data);
   2016                     }
   2017                 }
   2018             }
   2019 
   2020             /* Send event AVDT_WRITE_CFM_EVT if it was last fragment */
   2021             else if (sent && GKI_queue_is_empty (&p_scb->frag_q))
   2022             {
   2023                 (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
   2024             }
   2025         }
   2026 #endif
   2027     }
   2028 }
   2029 
   2030 /*******************************************************************************
   2031 **
   2032 ** Function         avdt_scb_tc_timer
   2033 **
   2034 ** Description      This function is called to start a timer when the peer
   2035 **                  initiates closing of the stream.  The timer verifies that
   2036 **                  the peer disconnects the transport channel.
   2037 **
   2038 ** Returns          Nothing.
   2039 **
   2040 *******************************************************************************/
   2041 void avdt_scb_tc_timer(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   2042 {
   2043     UNUSED(p_data);
   2044 
   2045     btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_DISC_TOUT);
   2046 }
   2047 
   2048 /*******************************************************************************
   2049 **
   2050 ** Function         avdt_scb_clr_vars
   2051 **
   2052 ** Description      This function initializes certain SCB variables.
   2053 **
   2054 ** Returns          Nothing.
   2055 **
   2056 *******************************************************************************/
   2057 void avdt_scb_clr_vars(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   2058 {
   2059     UNUSED(p_data);
   2060 
   2061     if ((p_scb->cs.tsep == AVDT_TSEP_SNK) && (!p_scb->sink_activated))
   2062     {
   2063         p_scb->in_use = TRUE;
   2064     }
   2065     else
   2066     {
   2067         p_scb->in_use = FALSE;
   2068     }
   2069     p_scb->p_ccb = NULL;
   2070     p_scb->peer_seid = 0;
   2071 }
   2072 
   2073 #if AVDT_MULTIPLEXING == TRUE
   2074 /*******************************************************************************
   2075 **
   2076 ** Function         avdt_scb_queue_frags
   2077 **
   2078 ** Description      This function breaks media payload into fragments
   2079 **                  and put the fragments in the given queue.
   2080 **
   2081 ** Returns          Nothing.
   2082 **
   2083 *******************************************************************************/
   2084 void avdt_scb_queue_frags(tAVDT_SCB *p_scb, UINT8 **pp_data, UINT32 *p_data_len, BUFFER_Q *pq)
   2085 {
   2086     UINT16  lcid;
   2087     UINT16  num_frag;
   2088     UINT16  mtu_used;
   2089     UINT8   *p;
   2090     BOOLEAN al_hdr = FALSE;
   2091     UINT8   tcid;
   2092     tAVDT_TC_TBL    *p_tbl;
   2093     UINT16          buf_size;
   2094     UINT16          offset = AVDT_MEDIA_OFFSET + AVDT_AL_HDR_SIZE;
   2095     UINT16          cont_offset = offset - AVDT_MEDIA_HDR_SIZE;
   2096     BT_HDR          *p_frag;
   2097 
   2098     tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
   2099     lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][tcid].lcid;
   2100 
   2101     if( p_scb->frag_off != 0)
   2102     {
   2103         /* continuing process is usually triggered by un-congest event.
   2104          * the number of buffers at L2CAP is very small (if not 0).
   2105          * we do not need to L2CA_FlushChannel() */
   2106         offset = cont_offset;
   2107         al_hdr = TRUE;
   2108         num_frag = AVDT_MAX_FRAG_COUNT;
   2109     }
   2110     else
   2111     {
   2112         num_frag = L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_GET);
   2113         AVDT_TRACE_DEBUG("num_q=%d lcid=%d", num_frag, lcid);
   2114         if(num_frag >= AVDT_MAX_FRAG_COUNT)
   2115         {
   2116             num_frag = 0;
   2117         }
   2118         else
   2119         {
   2120             num_frag = AVDT_MAX_FRAG_COUNT - num_frag;
   2121         }
   2122     }
   2123 
   2124     /* look up transport channel table entry to get peer mtu */
   2125     p_tbl = avdt_ad_tc_tbl_by_type(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
   2126     buf_size = p_tbl->peer_mtu + BT_HDR_SIZE;
   2127     AVDT_TRACE_DEBUG("peer_mtu: %d, buf_size: %d num_frag=%d",
   2128         p_tbl->peer_mtu, buf_size, num_frag);
   2129 
   2130     if(buf_size > AVDT_DATA_POOL_SIZE)
   2131         buf_size = AVDT_DATA_POOL_SIZE;
   2132 
   2133     mtu_used = buf_size - BT_HDR_SIZE;
   2134 
   2135     while(*p_data_len && num_frag)
   2136     {
   2137         /* allocate buffer for fragment */
   2138         if(NULL == (p_frag = (BT_HDR*)GKI_getbuf(buf_size)))
   2139         {
   2140             AVDT_TRACE_WARNING("avdt_scb_queue_frags len=%d(out of GKI buffers)",*p_data_len);
   2141             break;
   2142         }
   2143         /* fill fragment by chunk of media payload */
   2144         p_frag->layer_specific = *p_data_len;/* length of all remaining transport packet */
   2145         p_frag->offset = offset;
   2146         /* adjust packet offset for continuing packets */
   2147         offset = cont_offset;
   2148 
   2149         p_frag->len = mtu_used - p_frag->offset;
   2150         if(p_frag->len > *p_data_len)
   2151             p_frag->len = *p_data_len;
   2152         memcpy((UINT8*)(p_frag+1) + p_frag->offset, *pp_data, p_frag->len);
   2153         *pp_data += p_frag->len;
   2154         *p_data_len -= p_frag->len;
   2155         AVDT_TRACE_DEBUG("Prepared fragment len=%d", p_frag->len);
   2156 
   2157         if(al_hdr)
   2158         {
   2159             /* Adaptation Layer header */
   2160             p_frag->len += AVDT_AL_HDR_SIZE;
   2161             p_frag->offset -= AVDT_AL_HDR_SIZE;
   2162             p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   2163             /* TSID, fragment bit and coding of length(in 2 length octets following) */
   2164             *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
   2165 
   2166             /* length of all remaining transport packet */
   2167             UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
   2168         }
   2169         /* put fragment into gueue */
   2170         GKI_enqueue(pq, p_frag);
   2171         num_frag--;
   2172     }
   2173 }
   2174 #endif
   2175 
   2176