Home | History | Annotate | Download | only in av
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains action functions for advanced audio/video main state
     22  *  machine.
     23  *
     24  ******************************************************************************/
     25 
     26 #include "bt_target.h"
     27 #if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE)
     28 
     29 #include <string.h>
     30 #include "bta_av_api.h"
     31 #include "bta_av_int.h"
     32 #include "avdt_api.h"
     33 #include "utl.h"
     34 #include "l2c_api.h"
     35 #include "osi/include/list.h"
     36 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
     37 #include "bta_ar_api.h"
     38 #endif
     39 
     40 #define LOG_TAG "bt_bta_av"
     41 #include "osi/include/log.h"
     42 
     43 /*****************************************************************************
     44 **  Constants
     45 *****************************************************************************/
     46 /* the timer in milliseconds to wait for open req after setconfig for incoming connections */
     47 #ifndef BTA_AV_SIG_TIME_VAL
     48 #define BTA_AV_SIG_TIME_VAL 8000
     49 #endif
     50 
     51 /* In millisec to wait for signalling from SNK when it is initiated from SNK.   */
     52 /* If not, we will start signalling from SRC.                                   */
     53 #ifndef BTA_AV_ACP_SIG_TIME_VAL
     54 #define BTA_AV_ACP_SIG_TIME_VAL 2000
     55 #endif
     56 
     57 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle);
     58 
     59 /*******************************************************************************
     60 **
     61 ** Function         bta_av_get_rcb_by_shdl
     62 **
     63 ** Description      find the RCB associated with the given SCB handle.
     64 **
     65 ** Returns          tBTA_AV_RCB
     66 **
     67 *******************************************************************************/
     68 tBTA_AV_RCB * bta_av_get_rcb_by_shdl(UINT8 shdl)
     69 {
     70     tBTA_AV_RCB *p_rcb = NULL;
     71     int         i;
     72 
     73     for (i=0; i<BTA_AV_NUM_RCB; i++)
     74     {
     75         if (bta_av_cb.rcb[i].shdl == shdl && bta_av_cb.rcb[i].handle != BTA_AV_RC_HANDLE_NONE)
     76         {
     77             p_rcb = &bta_av_cb.rcb[i];
     78             break;
     79         }
     80     }
     81     return p_rcb;
     82 }
     83 #define BTA_AV_STS_NO_RSP       0xFF    /* a number not used by tAVRC_STS */
     84 
     85 /*******************************************************************************
     86 **
     87 ** Function         bta_av_del_rc
     88 **
     89 ** Description      delete the given AVRC handle.
     90 **
     91 ** Returns          void
     92 **
     93 *******************************************************************************/
     94 void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
     95 {
     96     tBTA_AV_SCB  *p_scb;
     97     UINT8        rc_handle;      /* connected AVRCP handle */
     98 
     99     p_scb = NULL;
    100     if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
    101     {
    102         if(p_rcb->shdl)
    103         {
    104             /* Validate array index*/
    105             if ((p_rcb->shdl - 1) < BTA_AV_NUM_STRS)
    106             {
    107                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
    108             }
    109             if(p_scb)
    110             {
    111                 APPL_TRACE_DEBUG("bta_av_del_rc shdl:%d, srch:%d rc_handle:%d", p_rcb->shdl,
    112                                   p_scb->rc_handle, p_rcb->handle);
    113                 if(p_scb->rc_handle == p_rcb->handle)
    114                     p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
    115                 /* just in case the RC timer is active
    116                 if(bta_av_cb.features & BTA_AV_FEAT_RCCT && p_scb->chnl == BTA_AV_CHNL_AUDIO) */
    117                     bta_sys_stop_timer(&p_scb->timer);
    118             }
    119         }
    120 
    121         APPL_TRACE_EVENT("bta_av_del_rc  handle: %d status=0x%x, rc_acp_handle:%d, idx:%d",
    122             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, bta_av_cb.rc_acp_idx);
    123         rc_handle = p_rcb->handle;
    124         if(!(p_rcb->status & BTA_AV_RC_CONN_MASK) ||
    125             ((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT) )
    126         {
    127             p_rcb->status = 0;
    128             p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
    129             p_rcb->shdl = 0;
    130             p_rcb->lidx = 0;
    131         }
    132         /* else ACP && connected. do not clear the handle yet */
    133         AVRC_Close(rc_handle);
    134         if (rc_handle == bta_av_cb.rc_acp_handle)
    135             bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
    136         APPL_TRACE_EVENT("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
    137             p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
    138     }
    139 }
    140 
    141 
    142 /*******************************************************************************
    143 **
    144 ** Function         bta_av_close_all_rc
    145 **
    146 ** Description      close the all AVRC handle.
    147 **
    148 ** Returns          void
    149 **
    150 *******************************************************************************/
    151 static void bta_av_close_all_rc(tBTA_AV_CB *p_cb)
    152 {
    153     int i;
    154 
    155     for(i=0; i<BTA_AV_NUM_RCB; i++)
    156     {
    157         if ((p_cb->disabling == TRUE) || (bta_av_cb.rcb[i].shdl != 0))
    158             bta_av_del_rc(&bta_av_cb.rcb[i]);
    159     }
    160 }
    161 
    162 /*******************************************************************************
    163 **
    164 ** Function         bta_av_del_sdp_rec
    165 **
    166 ** Description      delete the given SDP record handle.
    167 **
    168 ** Returns          void
    169 **
    170 *******************************************************************************/
    171 static void bta_av_del_sdp_rec(UINT32 *p_sdp_handle)
    172 {
    173     if(*p_sdp_handle != 0)
    174     {
    175         SDP_DeleteRecord(*p_sdp_handle);
    176         *p_sdp_handle = 0;
    177     }
    178 }
    179 
    180 /*******************************************************************************
    181 **
    182 ** Function         bta_av_avrc_sdp_cback
    183 **
    184 ** Description      AVRCP service discovery callback.
    185 **
    186 ** Returns          void
    187 **
    188 *******************************************************************************/
    189 static void bta_av_avrc_sdp_cback(UINT16 status)
    190 {
    191     BT_HDR *p_msg;
    192     UNUSED(status);
    193 
    194     if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
    195     {
    196         p_msg->event = BTA_AV_SDP_AVRC_DISC_EVT;
    197         bta_sys_sendmsg(p_msg);
    198     }
    199 }
    200 
    201 /*******************************************************************************
    202 **
    203 ** Function         bta_av_rc_ctrl_cback
    204 **
    205 ** Description      AVRCP control callback.
    206 **
    207 ** Returns          void
    208 **
    209 *******************************************************************************/
    210 static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_ADDR peer_addr)
    211 {
    212     tBTA_AV_RC_CONN_CHG *p_msg;
    213     UINT16 msg_event = 0;
    214     UNUSED(result);
    215 
    216 #if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
    217     APPL_TRACE_EVENT("rc_ctrl handle: %d event=0x%x", handle, event);
    218 #else
    219     APPL_TRACE_EVENT("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
    220 #endif
    221     if (event == AVRC_OPEN_IND_EVT)
    222     {
    223         /* save handle of opened connection
    224         bta_av_cb.rc_handle = handle;*/
    225 
    226         msg_event = BTA_AV_AVRC_OPEN_EVT;
    227     }
    228     else if (event == AVRC_CLOSE_IND_EVT)
    229     {
    230         msg_event = BTA_AV_AVRC_CLOSE_EVT;
    231     }
    232 
    233     if (msg_event)
    234     {
    235         if ((p_msg = (tBTA_AV_RC_CONN_CHG *) GKI_getbuf(sizeof(tBTA_AV_RC_CONN_CHG))) != NULL)
    236         {
    237             p_msg->hdr.event = msg_event;
    238             p_msg->handle    = handle;
    239             if(peer_addr)
    240                 bdcpy(p_msg->peer_addr, peer_addr);
    241             bta_sys_sendmsg(p_msg);
    242         }
    243     }
    244 }
    245 
    246 /*******************************************************************************
    247 **
    248 ** Function         bta_av_rc_msg_cback
    249 **
    250 ** Description      AVRCP message callback.
    251 **
    252 ** Returns          void
    253 **
    254 *******************************************************************************/
    255 static void bta_av_rc_msg_cback(UINT8 handle, UINT8 label, UINT8 opcode, tAVRC_MSG *p_msg)
    256 {
    257     UINT8           *p_data_src = NULL;
    258     UINT16          data_len = 0;
    259 
    260     APPL_TRACE_DEBUG("%s handle: %u opcode=0x%x", __func__, handle, opcode);
    261 
    262     /* Determine the size of the buffer we need */
    263     if (opcode == AVRC_OP_VENDOR && p_msg->vendor.p_vendor_data != NULL) {
    264         p_data_src = p_msg->vendor.p_vendor_data;
    265         data_len = (UINT16) p_msg->vendor.vendor_len;
    266     } else if (opcode == AVRC_OP_PASS_THRU && p_msg->pass.p_pass_data != NULL) {
    267         p_data_src = p_msg->pass.p_pass_data;
    268         data_len = (UINT16) p_msg->pass.pass_len;
    269     }
    270 
    271     /* Create a copy of the message */
    272     tBTA_AV_RC_MSG *p_buf =
    273         (tBTA_AV_RC_MSG *)GKI_getbuf((UINT16)(sizeof(tBTA_AV_RC_MSG) + data_len));
    274     if (p_buf != NULL) {
    275         p_buf->hdr.event = BTA_AV_AVRC_MSG_EVT;
    276         p_buf->handle = handle;
    277         p_buf->label = label;
    278         p_buf->opcode = opcode;
    279         memcpy(&p_buf->msg, p_msg, sizeof(tAVRC_MSG));
    280         /* Copy the data payload, and set the pointer to it */
    281         if (p_data_src != NULL) {
    282             UINT8 *p_data_dst = (UINT8 *)(p_buf + 1);
    283             memcpy(p_data_dst, p_data_src, data_len);
    284             if (opcode == AVRC_OP_VENDOR)
    285                 p_buf->msg.vendor.p_vendor_data = p_data_dst;
    286             else if (opcode == AVRC_OP_PASS_THRU)
    287                 p_buf->msg.pass.p_pass_data = p_data_dst;
    288         }
    289         bta_sys_sendmsg(p_buf);
    290     }
    291 }
    292 
    293 /*******************************************************************************
    294 **
    295 ** Function         bta_av_rc_create
    296 **
    297 ** Description      alloc RCB and call AVRC_Open
    298 **
    299 ** Returns          the created rc handle
    300 **
    301 *******************************************************************************/
    302 UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
    303 {
    304     tAVRC_CONN_CB ccb;
    305     BD_ADDR_PTR   bda = (BD_ADDR_PTR)bd_addr_any;
    306     UINT8         status = BTA_AV_RC_ROLE_ACP;
    307     tBTA_AV_SCB  *p_scb = p_cb->p_scb[shdl - 1];
    308     int i;
    309     UINT8   rc_handle;
    310     tBTA_AV_RCB *p_rcb;
    311 
    312     if(role == AVCT_INT)
    313     {
    314         bda = p_scb->peer_addr;
    315         status = BTA_AV_RC_ROLE_INT;
    316     }
    317     else
    318     {
    319         if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL )
    320         {
    321             APPL_TRACE_ERROR("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
    322             return p_rcb->handle;
    323         }
    324     }
    325 
    326     ccb.p_ctrl_cback = bta_av_rc_ctrl_cback;
    327     ccb.p_msg_cback = bta_av_rc_msg_cback;
    328     ccb.company_id = p_bta_av_cfg->company_id;
    329     ccb.conn = role;
    330     /* note: BTA_AV_FEAT_RCTG = AVRC_CT_TARGET, BTA_AV_FEAT_RCCT = AVRC_CT_CONTROL */
    331     ccb.control = p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_RCCT | AVRC_CT_PASSIVE);
    332 
    333 
    334     if (AVRC_Open(&rc_handle, &ccb, bda) != AVRC_SUCCESS)
    335         return BTA_AV_RC_HANDLE_NONE;
    336 
    337     i = rc_handle;
    338     p_rcb = &p_cb->rcb[i];
    339 
    340     if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
    341     {
    342         APPL_TRACE_ERROR("bta_av_rc_create found duplicated handle:%d", rc_handle);
    343     }
    344 
    345     p_rcb->handle = rc_handle;
    346     p_rcb->status = status;
    347     p_rcb->shdl = shdl;
    348     p_rcb->lidx = lidx;
    349     p_rcb->peer_features = 0;
    350     if(lidx == (BTA_AV_NUM_LINKS + 1))
    351     {
    352         /* this LIDX is reserved for the AVRCP ACP connection */
    353         p_cb->rc_acp_handle = p_rcb->handle;
    354         p_cb->rc_acp_idx = (i + 1);
    355         APPL_TRACE_DEBUG("rc_acp_handle:%d idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
    356     }
    357     APPL_TRACE_DEBUG("create %d, role: %d, shdl:%d, rc_handle:%d, lidx:%d, status:0x%x",
    358         i, role, shdl, p_rcb->handle, lidx, p_rcb->status);
    359 
    360     return rc_handle;
    361 }
    362 
    363 /*******************************************************************************
    364 **
    365 ** Function         bta_av_valid_group_navi_msg
    366 **
    367 ** Description      Check if it is Group Navigation Msg for Metadata
    368 **
    369 ** Returns          BTA_AV_RSP_ACCEPT or BTA_AV_RSP_NOT_IMPL.
    370 **
    371 *******************************************************************************/
    372 static tBTA_AV_CODE bta_av_group_navi_supported(UINT8 len, UINT8 *p_data, BOOLEAN is_inquiry)
    373 {
    374     tBTA_AV_CODE ret=BTA_AV_RSP_NOT_IMPL;
    375     UINT8 *p_ptr = p_data;
    376     UINT16 u16;
    377     UINT32 u32;
    378 
    379     if (p_bta_av_cfg->avrc_group && len == BTA_GROUP_NAVI_MSG_OP_DATA_LEN)
    380     {
    381         BTA_AV_BE_STREAM_TO_CO_ID(u32, p_ptr);
    382         BE_STREAM_TO_UINT16(u16, p_ptr);
    383 
    384         if (u32 == AVRC_CO_METADATA)
    385         {
    386             if (is_inquiry)
    387             {
    388                 if (u16 <= AVRC_PDU_PREV_GROUP)
    389                     ret = BTA_AV_RSP_IMPL_STBL;
    390             }
    391             else
    392             {
    393                 if (u16 <= AVRC_PDU_PREV_GROUP)
    394                     ret = BTA_AV_RSP_ACCEPT;
    395                 else
    396                     ret = BTA_AV_RSP_REJ;
    397             }
    398         }
    399     }
    400 
    401     return ret;
    402 }
    403 
    404 /*******************************************************************************
    405 **
    406 ** Function         bta_av_op_supported
    407 **
    408 ** Description      Check if remote control operation is supported.
    409 **
    410 ** Returns          BTA_AV_RSP_ACCEPT of supported, BTA_AV_RSP_NOT_IMPL if not.
    411 **
    412 *******************************************************************************/
    413 static tBTA_AV_CODE bta_av_op_supported(tBTA_AV_RC rc_id, BOOLEAN is_inquiry)
    414 {
    415     tBTA_AV_CODE ret_code = BTA_AV_RSP_NOT_IMPL;
    416 
    417     if (p_bta_av_rc_id)
    418     {
    419         if (is_inquiry)
    420         {
    421             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    422             {
    423                 ret_code = BTA_AV_RSP_IMPL_STBL;
    424             }
    425         }
    426         else
    427         {
    428             if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    429             {
    430                 ret_code = BTA_AV_RSP_ACCEPT;
    431             }
    432             else if ((p_bta_av_cfg->rc_pass_rsp == BTA_AV_RSP_INTERIM) && p_bta_av_rc_id_ac)
    433             {
    434                 if (p_bta_av_rc_id_ac[rc_id >> 4] & (1 << (rc_id & 0x0F)))
    435                 {
    436                     ret_code = BTA_AV_RSP_INTERIM;
    437                 }
    438             }
    439         }
    440 
    441     }
    442     return ret_code;
    443 }
    444 
    445 /*******************************************************************************
    446 **
    447 ** Function         bta_av_find_lcb
    448 **
    449 ** Description      Given BD_addr, find the associated LCB.
    450 **
    451 ** Returns          NULL, if not found.
    452 **
    453 *******************************************************************************/
    454 tBTA_AV_LCB * bta_av_find_lcb(BD_ADDR addr, UINT8 op)
    455 {
    456     tBTA_AV_CB   *p_cb = &bta_av_cb;
    457     int     xx;
    458     UINT8   mask;
    459     tBTA_AV_LCB *p_lcb = NULL;
    460 
    461     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
    462     {
    463         mask = 1 << xx; /* the used mask for this lcb */
    464         if((mask & p_cb->conn_lcb) && 0 ==( bdcmp(p_cb->lcb[xx].addr, addr)))
    465         {
    466             p_lcb = &p_cb->lcb[xx];
    467             if(op == BTA_AV_LCB_FREE)
    468             {
    469                 p_cb->conn_lcb &= ~mask; /* clear the connect mask */
    470                 APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
    471             }
    472             break;
    473         }
    474     }
    475     return p_lcb;
    476 }
    477 
    478 /*******************************************************************************
    479 **
    480 ** Function         bta_av_rc_opened
    481 **
    482 ** Description      Set AVRCP state to opened.
    483 **
    484 ** Returns          void
    485 **
    486 *******************************************************************************/
    487 void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    488 {
    489     tBTA_AV_RC_OPEN rc_open;
    490     tBTA_AV_SCB     *p_scb;
    491     int         i;
    492     UINT8       shdl = 0;
    493     tBTA_AV_LCB *p_lcb;
    494     tBTA_AV_RCB *p_rcb;
    495     UINT8       tmp;
    496     UINT8       disc = 0;
    497 
    498     /* find the SCB & stop the timer */
    499     for(i=0; i<BTA_AV_NUM_STRS; i++)
    500     {
    501         p_scb = p_cb->p_scb[i];
    502         if(p_scb && bdcmp(p_scb->peer_addr, p_data->rc_conn_chg.peer_addr) == 0)
    503         {
    504             p_scb->rc_handle = p_data->rc_conn_chg.handle;
    505             APPL_TRACE_DEBUG("bta_av_rc_opened shdl:%d, srch %d", i + 1, p_scb->rc_handle);
    506             shdl = i+1;
    507             LOG_INFO("%s allow incoming AVRCP connections:%d", __func__, p_scb->use_rc);
    508             bta_sys_stop_timer(&p_scb->timer);
    509             disc = p_scb->hndl;
    510             break;
    511         }
    512     }
    513 
    514     i = p_data->rc_conn_chg.handle;
    515     if (p_cb->rcb[i].handle == BTA_AV_RC_HANDLE_NONE)
    516     {
    517         APPL_TRACE_ERROR("not a valid handle:%d any more", i);
    518         return;
    519     }
    520 
    521 
    522     if (p_cb->rcb[i].lidx == (BTA_AV_NUM_LINKS + 1) && shdl != 0)
    523     {
    524         /* rc is opened on the RC only ACP channel, but is for a specific
    525          * SCB -> need to switch RCBs */
    526         p_rcb = bta_av_get_rcb_by_shdl(shdl);
    527         if (p_rcb)
    528         {
    529             p_rcb->shdl = p_cb->rcb[i].shdl;
    530             tmp         = p_rcb->lidx;
    531             p_rcb->lidx = p_cb->rcb[i].lidx;
    532             p_cb->rcb[i].lidx = tmp;
    533             p_cb->rc_acp_handle = p_rcb->handle;
    534             p_cb->rc_acp_idx = (p_rcb - p_cb->rcb) + 1;
    535             APPL_TRACE_DEBUG("switching RCB rc_acp_handle:%d idx:%d",
    536                                p_cb->rc_acp_handle, p_cb->rc_acp_idx);
    537         }
    538     }
    539 
    540     p_cb->rcb[i].shdl = shdl;
    541     rc_open.rc_handle = i;
    542     APPL_TRACE_ERROR("bta_av_rc_opened rcb[%d] shdl:%d lidx:%d/%d",
    543             i, shdl, p_cb->rcb[i].lidx, p_cb->lcb[BTA_AV_NUM_LINKS].lidx);
    544     p_cb->rcb[i].status |= BTA_AV_RC_CONN_MASK;
    545 
    546     if(!shdl && 0 == p_cb->lcb[BTA_AV_NUM_LINKS].lidx)
    547     {
    548         /* no associated SCB -> connected to an RC only device
    549          * update the index to the extra LCB */
    550         p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
    551         bdcpy(p_lcb->addr, p_data->rc_conn_chg.peer_addr);
    552         APPL_TRACE_DEBUG("rc_only bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
    553                       p_lcb->addr[0], p_lcb->addr[1],
    554                       p_lcb->addr[2], p_lcb->addr[3],
    555                       p_lcb->addr[4], p_lcb->addr[5]);
    556         p_lcb->lidx = BTA_AV_NUM_LINKS + 1;
    557             p_cb->rcb[i].lidx = p_lcb->lidx;
    558         p_lcb->conn_msk = 1;
    559         APPL_TRACE_ERROR("rcb[%d].lidx=%d, lcb.conn_msk=x%x",
    560             i, p_cb->rcb[i].lidx, p_lcb->conn_msk);
    561         disc = p_data->rc_conn_chg.handle|BTA_AV_CHNL_MSK;
    562     }
    563 
    564     bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
    565     rc_open.peer_features = p_cb->rcb[i].peer_features;
    566     rc_open.status = BTA_AV_SUCCESS;
    567     APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
    568                       rc_open.peer_features);
    569     if(rc_open.peer_features == 0)
    570     {
    571         /* we have not done SDP on peer RC capabilities.
    572          * peer must have initiated the RC connection */
    573         rc_open.peer_features = BTA_AV_FEAT_RCCT;
    574         bta_av_rc_disc(disc);
    575     }
    576     (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
    577 
    578 }
    579 
    580 
    581 /*******************************************************************************
    582 **
    583 ** Function         bta_av_rc_remote_cmd
    584 **
    585 ** Description      Send an AVRCP remote control command.
    586 **
    587 ** Returns          void
    588 **
    589 *******************************************************************************/
    590 void bta_av_rc_remote_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    591 {
    592     tBTA_AV_RCB    *p_rcb;
    593     if (p_cb->features & BTA_AV_FEAT_RCCT)
    594     {
    595         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    596         {
    597             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    598             if(p_rcb->status & BTA_AV_RC_CONN_MASK)
    599             {
    600                 AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
    601                      &p_data->api_remote_cmd.msg);
    602             }
    603         }
    604     }
    605 }
    606 
    607 /*******************************************************************************
    608 **
    609 ** Function         bta_av_rc_vendor_cmd
    610 **
    611 ** Description      Send an AVRCP vendor specific command.
    612 **
    613 ** Returns          void
    614 **
    615 *******************************************************************************/
    616 void bta_av_rc_vendor_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    617 {
    618     tBTA_AV_RCB    *p_rcb;
    619     if ( (p_cb->features & (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR)) ==
    620          (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR))
    621     {
    622         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    623         {
    624             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    625             AVRC_VendorCmd(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
    626         }
    627     }
    628 }
    629 
    630 /*******************************************************************************
    631 **
    632 ** Function         bta_av_rc_vendor_rsp
    633 **
    634 ** Description      Send an AVRCP vendor specific response.
    635 **
    636 ** Returns          void
    637 **
    638 *******************************************************************************/
    639 void bta_av_rc_vendor_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    640 {
    641     tBTA_AV_RCB    *p_rcb;
    642     if ( (p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
    643          (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR))
    644     {
    645         if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
    646         {
    647             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    648             AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
    649         }
    650     }
    651 }
    652 
    653 /*******************************************************************************
    654 **
    655 ** Function         bta_av_rc_meta_rsp
    656 **
    657 ** Description      Send an AVRCP metadata/advanced control command/response.
    658 **
    659 ** Returns          void
    660 **
    661 *******************************************************************************/
    662 void bta_av_rc_meta_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    663 {
    664     tBTA_AV_RCB *p_rcb;
    665     BOOLEAN         do_free = TRUE;
    666 
    667     if ((p_cb->features & BTA_AV_FEAT_METADATA) && (p_data->hdr.layer_specific < BTA_AV_NUM_RCB))
    668     {
    669         if ((p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCTG)) ||
    670             (!p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCCT)) )
    671         {
    672             p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
    673             if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE) {
    674                 AVRC_MsgReq(p_rcb->handle, p_data->api_meta_rsp.label,
    675                             p_data->api_meta_rsp.rsp_code,
    676                             p_data->api_meta_rsp.p_pkt);
    677                 do_free = FALSE;
    678             }
    679         }
    680     }
    681 
    682     if (do_free)
    683         GKI_freebuf (p_data->api_meta_rsp.p_pkt);
    684 }
    685 
    686 /*******************************************************************************
    687 **
    688 ** Function         bta_av_rc_free_rsp
    689 **
    690 ** Description      free an AVRCP metadata command buffer.
    691 **
    692 ** Returns          void
    693 **
    694 *******************************************************************************/
    695 void bta_av_rc_free_rsp (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    696 {
    697     UNUSED(p_cb);
    698 
    699     GKI_freebuf (p_data->api_meta_rsp.p_pkt);
    700 }
    701 
    702 /*******************************************************************************
    703 **
    704 ** Function         bta_av_rc_meta_req
    705 **
    706 ** Description      Send an AVRCP metadata command.
    707 **
    708 ** Returns          void
    709 **
    710 *******************************************************************************/
    711 void bta_av_rc_free_msg (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    712 {
    713     UNUSED(p_cb);
    714     UNUSED(p_data);
    715 }
    716 
    717 
    718 
    719 /*******************************************************************************
    720 **
    721 ** Function         bta_av_chk_notif_evt_id
    722 **
    723 ** Description      make sure the requested player id is valid.
    724 **
    725 ** Returns          BTA_AV_STS_NO_RSP, if no error
    726 **
    727 *******************************************************************************/
    728 static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
    729 {
    730     tAVRC_STS   status = BTA_AV_STS_NO_RSP;
    731     UINT8       xx;
    732     UINT16      u16;
    733     UINT8       *p = p_vendor->p_vendor_data + 2;
    734 
    735     BE_STREAM_TO_UINT16 (u16, p);
    736     /* double check the fixed length */
    737     if ((u16 != 5) || (p_vendor->vendor_len != 9))
    738     {
    739         status = AVRC_STS_INTERNAL_ERR;
    740     }
    741     else
    742     {
    743         /* make sure the player_id is valid */
    744         for (xx=0; xx<p_bta_av_cfg->num_evt_ids; xx++)
    745         {
    746             if (*p == p_bta_av_cfg->p_meta_evt_ids[xx])
    747             {
    748                 break;
    749             }
    750         }
    751         if (xx == p_bta_av_cfg->num_evt_ids)
    752         {
    753             status = AVRC_STS_BAD_PARAM;
    754         }
    755     }
    756 
    757     return status;
    758 }
    759 
    760 /*******************************************************************************
    761 **
    762 ** Function         bta_av_proc_meta_cmd
    763 **
    764 ** Description      Process an AVRCP metadata command from the peer.
    765 **
    766 ** Returns          TRUE to respond immediately
    767 **
    768 *******************************************************************************/
    769 tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE  *p_rc_rsp, tBTA_AV_RC_MSG *p_msg, UINT8 *p_ctype)
    770 {
    771     tBTA_AV_EVT evt = BTA_AV_META_MSG_EVT;
    772     UINT8       u8, pdu, *p;
    773     UINT16      u16;
    774     tAVRC_MSG_VENDOR    *p_vendor = &p_msg->msg.vendor;
    775 
    776 #if (AVRC_METADATA_INCLUDED == TRUE)
    777 
    778     pdu = *(p_vendor->p_vendor_data);
    779     p_rc_rsp->pdu = pdu;
    780     *p_ctype = AVRC_RSP_REJ;
    781     /* Metadata messages only use PANEL sub-unit type */
    782     if (p_vendor->hdr.subunit_type != AVRC_SUB_PANEL)
    783     {
    784         APPL_TRACE_DEBUG("SUBUNIT must be PANEL");
    785         /* reject it */
    786         evt=0;
    787         p_vendor->hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    788         AVRC_VendorRsp(p_msg->handle, p_msg->label, &p_msg->msg.vendor);
    789     }
    790     else if (!AVRC_IsValidAvcType(pdu, p_vendor->hdr.ctype) )
    791     {
    792         APPL_TRACE_DEBUG("Invalid pdu/ctype: 0x%x, %d", pdu, p_vendor->hdr.ctype);
    793         /* reject invalid message without reporting to app */
    794         evt = 0;
    795         p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
    796     }
    797     else
    798     {
    799         switch (pdu)
    800         {
    801         case AVRC_PDU_GET_CAPABILITIES:
    802             /* process GetCapabilities command without reporting the event to app */
    803             evt = 0;
    804             u8 = *(p_vendor->p_vendor_data + 4);
    805             p = p_vendor->p_vendor_data + 2;
    806             p_rc_rsp->get_caps.capability_id = u8;
    807             BE_STREAM_TO_UINT16 (u16, p);
    808             if ((u16 != 1) || (p_vendor->vendor_len != 5))
    809             {
    810                 p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
    811             }
    812             else
    813             {
    814                 p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;
    815                 if (u8 == AVRC_CAP_COMPANY_ID)
    816                 {
    817                     *p_ctype = AVRC_RSP_IMPL_STBL;
    818                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_co_ids;
    819                     memcpy(p_rc_rsp->get_caps.param.company_id, p_bta_av_cfg->p_meta_co_ids,
    820                            (p_bta_av_cfg->num_co_ids << 2));
    821                 }
    822                 else if (u8 == AVRC_CAP_EVENTS_SUPPORTED)
    823                 {
    824                     *p_ctype = AVRC_RSP_IMPL_STBL;
    825                     p_rc_rsp->get_caps.count = p_bta_av_cfg->num_evt_ids;
    826                     memcpy(p_rc_rsp->get_caps.param.event_id, p_bta_av_cfg->p_meta_evt_ids,
    827                            p_bta_av_cfg->num_evt_ids);
    828                 }
    829                 else
    830                 {
    831                     APPL_TRACE_DEBUG("Invalid capability ID: 0x%x", u8);
    832                     /* reject - unknown capability ID */
    833                     p_rc_rsp->get_caps.status = AVRC_STS_BAD_PARAM;
    834                 }
    835             }
    836             break;
    837 
    838 
    839         case AVRC_PDU_REGISTER_NOTIFICATION:
    840             /* make sure the event_id is implemented */
    841             p_rc_rsp->rsp.status = bta_av_chk_notif_evt_id (p_vendor);
    842             if (p_rc_rsp->rsp.status != BTA_AV_STS_NO_RSP)
    843                 evt = 0;
    844             break;
    845 
    846         }
    847     }
    848 #else
    849     APPL_TRACE_DEBUG("AVRCP 1.3 Metadata not supporteed. Reject command.");
    850     /* reject invalid message without reporting to app */
    851     evt = 0;
    852     p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
    853 #endif
    854 
    855     return evt;
    856 }
    857 
    858 
    859 /*******************************************************************************
    860 **
    861 ** Function         bta_av_rc_msg
    862 **
    863 ** Description      Process an AVRCP message from the peer.
    864 **
    865 ** Returns          void
    866 **
    867 *******************************************************************************/
    868 void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
    869 {
    870     tBTA_AV_EVT evt = 0;
    871     tBTA_AV     av;
    872     BT_HDR      *p_pkt = NULL;
    873     tAVRC_MSG_VENDOR    *p_vendor = &p_data->rc_msg.msg.vendor;
    874     BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
    875 #if (AVRC_METADATA_INCLUDED == TRUE)
    876     UINT8       ctype = 0;
    877     tAVRC_RESPONSE  rc_rsp;
    878 
    879     rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
    880 #endif
    881 
    882     if (p_data->rc_msg.opcode == AVRC_OP_PASS_THRU)
    883     {
    884     /* if this is a pass thru command */
    885         if ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_CTRL) ||
    886             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) ||
    887             (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ)
    888             )
    889         {
    890         /* check if operation is supported */
    891             if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR)
    892             {
    893                 p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    894 #if (AVRC_METADATA_INCLUDED == TRUE)
    895                 if (p_cb->features & BTA_AV_FEAT_METADATA)
    896                     p_data->rc_msg.msg.hdr.ctype =
    897                         bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
    898                         p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
    899 #endif
    900             }
    901             else
    902             {
    903                 p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
    904             }
    905 
    906             APPL_TRACE_DEBUG("ctype %d",p_data->rc_msg.msg.hdr.ctype)
    907 
    908             /* send response */
    909             if (p_data->rc_msg.msg.hdr.ctype != BTA_AV_RSP_INTERIM)
    910                 AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
    911 
    912             /* set up for callback if supported */
    913             if (p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_ACCEPT || p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_INTERIM)
    914             {
    915                 evt = BTA_AV_REMOTE_CMD_EVT;
    916                 av.remote_cmd.rc_id = p_data->rc_msg.msg.pass.op_id;
    917                 av.remote_cmd.key_state = p_data->rc_msg.msg.pass.state;
    918                 av.remote_cmd.p_data = p_data->rc_msg.msg.pass.p_pass_data;
    919                 av.remote_cmd.len = p_data->rc_msg.msg.pass.pass_len;
    920                 memcpy(&av.remote_cmd.hdr, &p_data->rc_msg.msg.hdr, sizeof (tAVRC_HDR));
    921                 av.remote_cmd.label = p_data->rc_msg.label;
    922             }
    923         }
    924         /* else if this is a pass thru response */
    925         else if (p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
    926         {
    927             /* set up for callback */
    928             evt = BTA_AV_REMOTE_RSP_EVT;
    929             av.remote_rsp.rc_id = p_data->rc_msg.msg.pass.op_id;
    930             av.remote_rsp.key_state = p_data->rc_msg.msg.pass.state;
    931             av.remote_rsp.rsp_code = p_data->rc_msg.msg.hdr.ctype;
    932             av.remote_rsp.label = p_data->rc_msg.label;
    933         }
    934         /* must be a bad ctype -> reject*/
    935         else
    936         {
    937             p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
    938             AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
    939         }
    940     }
    941     /* else if this is a vendor specific command or response */
    942     else if (p_data->rc_msg.opcode == AVRC_OP_VENDOR)
    943     {
    944         /* set up for callback */
    945         av.vendor_cmd.code = p_data->rc_msg.msg.hdr.ctype;
    946         av.vendor_cmd.company_id = p_vendor->company_id;
    947         av.vendor_cmd.label = p_data->rc_msg.label;
    948         av.vendor_cmd.p_data = p_vendor->p_vendor_data;
    949         av.vendor_cmd.len = p_vendor->vendor_len;
    950 
    951         /* if configured to support vendor specific and it's a command */
    952         if ((p_cb->features & BTA_AV_FEAT_VENDOR)  &&
    953             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
    954         {
    955 #if (AVRC_METADATA_INCLUDED == TRUE)
    956             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
    957                (p_vendor->company_id == AVRC_CO_METADATA))
    958             {
    959                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
    960                 evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
    961             }
    962             else
    963 #endif
    964                 evt = BTA_AV_VENDOR_CMD_EVT;
    965         }
    966         /* else if configured to support vendor specific and it's a response */
    967         else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
    968                  p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
    969         {
    970 #if (AVRC_METADATA_INCLUDED == TRUE)
    971             if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
    972                (p_vendor->company_id == AVRC_CO_METADATA))
    973             {
    974                 av.meta_msg.p_msg = &p_data->rc_msg.msg;
    975                 evt = BTA_AV_META_MSG_EVT;
    976             }
    977             else
    978 #endif
    979                 evt = BTA_AV_VENDOR_RSP_EVT;
    980 
    981         }
    982         /* else if not configured to support vendor specific and it's a command */
    983         else if (!(p_cb->features & BTA_AV_FEAT_VENDOR)  &&
    984             p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
    985         {
    986            if(p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID)
    987            {
    988            /* reject it */
    989               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
    990               p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
    991            }
    992            else
    993               p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
    994            AVRC_VendorRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.vendor);
    995         }
    996     }
    997 #if (AVRC_METADATA_INCLUDED == TRUE)
    998     if (evt == 0 && rc_rsp.rsp.status != BTA_AV_STS_NO_RSP)
    999     {
   1000         if (!p_pkt)
   1001         {
   1002             rc_rsp.rsp.opcode = p_data->rc_msg.opcode;
   1003             AVRC_BldResponse (0, &rc_rsp, &p_pkt);
   1004         }
   1005         if (p_pkt)
   1006             AVRC_MsgReq (p_data->rc_msg.handle, p_data->rc_msg.label, ctype, p_pkt);
   1007     }
   1008 #endif
   1009 
   1010     /* call callback */
   1011     if (evt != 0)
   1012     {
   1013         av.remote_cmd.rc_handle = p_data->rc_msg.handle;
   1014         (*p_cb->p_cback)(evt, &av);
   1015     }
   1016 }
   1017 
   1018 /*******************************************************************************
   1019 **
   1020 ** Function         bta_av_rc_close
   1021 **
   1022 ** Description      close the specified AVRC handle.
   1023 **
   1024 ** Returns          void
   1025 **
   1026 *******************************************************************************/
   1027 void bta_av_rc_close (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
   1028 {
   1029     UINT16 handle = p_data->hdr.layer_specific;
   1030     tBTA_AV_SCB  *p_scb;
   1031     tBTA_AV_RCB *p_rcb;
   1032 
   1033     if(handle < BTA_AV_NUM_RCB)
   1034     {
   1035         p_rcb = &p_cb->rcb[handle];
   1036 
   1037         APPL_TRACE_DEBUG("bta_av_rc_close handle: %d, status=0x%x", p_rcb->handle, p_rcb->status);
   1038         if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
   1039         {
   1040             if(p_rcb->shdl)
   1041             {
   1042                 p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
   1043                 if(p_scb)
   1044                 {
   1045                     /* just in case the RC timer is active
   1046                     if(bta_av_cb.features & BTA_AV_FEAT_RCCT &&
   1047                        p_scb->chnl == BTA_AV_CHNL_AUDIO) */
   1048                         bta_sys_stop_timer(&p_scb->timer);
   1049                 }
   1050             }
   1051 
   1052             AVRC_Close(p_rcb->handle);
   1053         }
   1054     }
   1055 }
   1056 
   1057 /*******************************************************************************
   1058 **
   1059 ** Function         bta_av_get_shdl
   1060 **
   1061 ** Returns          The index to p_scb[]
   1062 **
   1063 *******************************************************************************/
   1064 static UINT8 bta_av_get_shdl(tBTA_AV_SCB *p_scb)
   1065 {
   1066     int     i;
   1067     UINT8   shdl = 0;
   1068     /* find the SCB & stop the timer */
   1069     for(i=0; i<BTA_AV_NUM_STRS; i++)
   1070     {
   1071         if(p_scb == bta_av_cb.p_scb[i])
   1072         {
   1073             shdl = i+1;
   1074             break;
   1075         }
   1076     }
   1077     return shdl;
   1078 }
   1079 
   1080 /*******************************************************************************
   1081 **
   1082 ** Function         bta_av_stream_chg
   1083 **
   1084 ** Description      audio streaming status changed.
   1085 **
   1086 ** Returns          void
   1087 **
   1088 *******************************************************************************/
   1089 void bta_av_stream_chg(tBTA_AV_SCB *p_scb, BOOLEAN started)
   1090 {
   1091     UINT8   started_msk;
   1092     int     i;
   1093     UINT8   *p_streams;
   1094     BOOLEAN no_streams = FALSE;
   1095     tBTA_AV_SCB *p_scbi;
   1096 
   1097     started_msk = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
   1098     APPL_TRACE_DEBUG ("bta_av_stream_chg started:%d started_msk:x%x chnl:x%x", started,
   1099                                                   started_msk, p_scb->chnl);
   1100     if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
   1101         p_streams = &bta_av_cb.audio_streams;
   1102     else
   1103         p_streams = &bta_av_cb.video_streams;
   1104 
   1105     if (started)
   1106     {
   1107         /* Let L2CAP know this channel is processed with high priority */
   1108         L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_HIGH);
   1109         (*p_streams) |= started_msk;
   1110     }
   1111     else
   1112     {
   1113         (*p_streams) &= ~started_msk;
   1114     }
   1115 
   1116     if (!started)
   1117     {
   1118         i=0;
   1119         if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
   1120         {
   1121             if (bta_av_cb.video_streams == 0)
   1122                 no_streams = TRUE;
   1123         }
   1124         else
   1125         {
   1126             no_streams = TRUE;
   1127             if ( bta_av_cb.audio_streams )
   1128             {
   1129                 for (; i<BTA_AV_NUM_STRS; i++)
   1130                 {
   1131                     p_scbi = bta_av_cb.p_scb[i];
   1132                     /* scb is used and started */
   1133                     if ( p_scbi && (bta_av_cb.audio_streams & BTA_AV_HNDL_TO_MSK(i))
   1134                         && bdcmp(p_scbi->peer_addr, p_scb->peer_addr) == 0)
   1135                     {
   1136                         no_streams = FALSE;
   1137                         break;
   1138                     }
   1139                 }
   1140 
   1141             }
   1142         }
   1143 
   1144         APPL_TRACE_DEBUG ("no_streams:%d i:%d, audio_streams:x%x, video_streams:x%x", no_streams, i,
   1145                            bta_av_cb.audio_streams, bta_av_cb.video_streams);
   1146         if (no_streams)
   1147         {
   1148             /* Let L2CAP know this channel is processed with low priority */
   1149             L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_NORMAL);
   1150         }
   1151     }
   1152 }
   1153 
   1154 
   1155 /*******************************************************************************
   1156 **
   1157 ** Function         bta_av_conn_chg
   1158 **
   1159 ** Description      connetion status changed.
   1160 **                  Open an AVRCP acceptor channel, if new conn.
   1161 **
   1162 ** Returns          void
   1163 **
   1164 *******************************************************************************/
   1165 void bta_av_conn_chg(tBTA_AV_DATA *p_data)
   1166 {
   1167     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1168     tBTA_AV_SCB     *p_scb = NULL;
   1169     tBTA_AV_SCB     *p_scbi;
   1170     UINT8   mask;
   1171     UINT8   conn_msk;
   1172     UINT8   old_msk;
   1173     int i;
   1174     int index = (p_data->hdr.layer_specific & BTA_AV_HNDL_MSK) - 1;
   1175     tBTA_AV_LCB *p_lcb;
   1176     tBTA_AV_LCB *p_lcb_rc;
   1177     tBTA_AV_RCB *p_rcb, *p_rcb2;
   1178     BOOLEAN     chk_restore = FALSE;
   1179 
   1180     /* Validate array index*/
   1181     if (index < BTA_AV_NUM_STRS)
   1182     {
   1183         p_scb = p_cb->p_scb[index];
   1184     }
   1185     mask = BTA_AV_HNDL_TO_MSK(index);
   1186     p_lcb = bta_av_find_lcb(p_data->conn_chg.peer_addr, BTA_AV_LCB_FIND);
   1187     conn_msk = 1 << (index + 1);
   1188     if(p_data->conn_chg.is_up)
   1189     {
   1190         /* set the conned mask for this channel */
   1191         if(p_scb)
   1192         {
   1193             if(p_lcb)
   1194             {
   1195                 p_lcb->conn_msk |= conn_msk;
   1196                 for (i=0; i<BTA_AV_NUM_RCB; i++)
   1197                 {
   1198                     if (bta_av_cb.rcb[i].lidx == p_lcb->lidx)
   1199                     {
   1200                         bta_av_cb.rcb[i].shdl = index + 1;
   1201                         APPL_TRACE_DEBUG("conn_chg up[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
   1202                                           bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
   1203                                           bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
   1204                         break;
   1205                     }
   1206                 }
   1207             }
   1208             if (p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1209             {
   1210                 old_msk = p_cb->conn_audio;
   1211                 p_cb->conn_audio |= mask;
   1212             }
   1213             else
   1214             {
   1215                 old_msk = p_cb->conn_video;
   1216                 p_cb->conn_video |= mask;
   1217             }
   1218 
   1219             if ((old_msk & mask) == 0)
   1220             {
   1221                 /* increase the audio open count, if not set yet */
   1222                 bta_av_cb.audio_open_cnt++;
   1223             }
   1224 
   1225 
   1226             APPL_TRACE_DEBUG("rc_acp_handle:%d rc_acp_idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
   1227             /* check if the AVRCP ACP channel is already connected */
   1228             if(p_lcb && p_cb->rc_acp_handle != BTA_AV_RC_HANDLE_NONE && p_cb->rc_acp_idx)
   1229             {
   1230                 p_lcb_rc = &p_cb->lcb[BTA_AV_NUM_LINKS];
   1231                 APPL_TRACE_DEBUG("rc_acp is connected && conn_chg on same addr p_lcb_rc->conn_msk:x%x",
   1232                                   p_lcb_rc->conn_msk);
   1233                 /* check if the RC is connected to the scb addr */
   1234                 APPL_TRACE_DEBUG ("p_lcb_rc->addr: %02x:%02x:%02x:%02x:%02x:%02x",
   1235                        p_lcb_rc->addr[0], p_lcb_rc->addr[1], p_lcb_rc->addr[2], p_lcb_rc->addr[3],
   1236                        p_lcb_rc->addr[4], p_lcb_rc->addr[5]);
   1237                 APPL_TRACE_DEBUG ("conn_chg.peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
   1238                        p_data->conn_chg.peer_addr[0], p_data->conn_chg.peer_addr[1],
   1239                        p_data->conn_chg.peer_addr[2],
   1240                        p_data->conn_chg.peer_addr[3], p_data->conn_chg.peer_addr[4],
   1241                        p_data->conn_chg.peer_addr[5]);
   1242                 if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0)
   1243                 {
   1244                     /* AVRCP is already connected.
   1245                      * need to update the association betwen SCB and RCB */
   1246                     p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
   1247                     p_lcb_rc->lidx = 0;
   1248                     p_scb->rc_handle = p_cb->rc_acp_handle;
   1249                     p_rcb = &p_cb->rcb[p_cb->rc_acp_idx - 1];
   1250                     p_rcb->shdl = bta_av_get_shdl(p_scb);
   1251                     APPL_TRACE_DEBUG("update rc_acp shdl:%d/%d srch:%d", index + 1, p_rcb->shdl,
   1252                                       p_scb->rc_handle );
   1253 
   1254                     p_rcb2 = bta_av_get_rcb_by_shdl(p_rcb->shdl);
   1255                     if (p_rcb2)
   1256                     {
   1257                         /* found the RCB that was created to associated with this SCB */
   1258                         p_cb->rc_acp_handle = p_rcb2->handle;
   1259                         p_cb->rc_acp_idx = (p_rcb2 - p_cb->rcb) + 1;
   1260                         APPL_TRACE_DEBUG("new rc_acp_handle:%d, idx:%d", p_cb->rc_acp_handle,
   1261                                            p_cb->rc_acp_idx);
   1262                         p_rcb2->lidx = (BTA_AV_NUM_LINKS + 1);
   1263                         APPL_TRACE_DEBUG("rc2 handle:%d lidx:%d/%d",p_rcb2->handle, p_rcb2->lidx,
   1264                                           p_cb->lcb[p_rcb2->lidx-1].lidx);
   1265                     }
   1266                     p_rcb->lidx = p_lcb->lidx;
   1267                     APPL_TRACE_DEBUG("rc handle:%d lidx:%d/%d",p_rcb->handle, p_rcb->lidx,
   1268                                       p_cb->lcb[p_rcb->lidx-1].lidx);
   1269                 }
   1270             }
   1271         }
   1272     }
   1273     else
   1274     {
   1275         if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
   1276         {
   1277             /* this channel is still marked as open. decrease the count */
   1278             bta_av_cb.audio_open_cnt--;
   1279         }
   1280 
   1281         /* clear the conned mask for this channel */
   1282         p_cb->conn_audio &= ~mask;
   1283         p_cb->conn_video &= ~mask;
   1284         if(p_scb)
   1285         {
   1286             /* the stream is closed.
   1287              * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
   1288             bdcpy(p_scb->peer_addr, bd_addr_null);
   1289             if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1290             {
   1291                 if(p_lcb)
   1292                 {
   1293                     p_lcb->conn_msk &= ~conn_msk;
   1294                 }
   1295                 /* audio channel is down. make sure the INT channel is down */
   1296                 /* just in case the RC timer is active
   1297                 if(p_cb->features & BTA_AV_FEAT_RCCT) */
   1298                 {
   1299                     bta_sys_stop_timer(&p_scb->timer);
   1300                 }
   1301                 /* one audio channel goes down. check if we need to restore high priority */
   1302                 chk_restore = TRUE;
   1303             }
   1304         }
   1305 
   1306         APPL_TRACE_DEBUG("bta_av_conn_chg shdl:%d", index + 1);
   1307         for (i=0; i<BTA_AV_NUM_RCB; i++)
   1308         {
   1309             APPL_TRACE_DEBUG("conn_chg dn[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
   1310                               bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
   1311                               bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
   1312             if(bta_av_cb.rcb[i].shdl == index + 1)
   1313             {
   1314                 bta_av_del_rc(&bta_av_cb.rcb[i]);
   1315                 break;
   1316             }
   1317         }
   1318 
   1319         if(p_cb->conn_audio == 0 && p_cb->conn_video == 0)
   1320         {
   1321             /* if both channels are not connected,
   1322              * close all RC channels */
   1323             bta_av_close_all_rc(p_cb);
   1324         }
   1325 
   1326         /* if the AVRCP is no longer listening, create the listening channel */
   1327         if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
   1328             bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
   1329     }
   1330 
   1331     APPL_TRACE_DEBUG("bta_av_conn_chg audio:%x video:%x up:%d conn_msk:0x%x chk_restore:%d audio_open_cnt:%d",
   1332         p_cb->conn_audio, p_cb->conn_video, p_data->conn_chg.is_up, conn_msk, chk_restore, p_cb->audio_open_cnt);
   1333 
   1334     if (chk_restore)
   1335     {
   1336         if (p_cb->audio_open_cnt == 1)
   1337         {
   1338             /* one audio channel goes down and there's one audio channel remains open.
   1339              * restore the switch role in default link policy */
   1340             bta_sys_set_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
   1341             /* allow role switch, if this is the last connection */
   1342             bta_av_restore_switch();
   1343         }
   1344         if (p_cb->audio_open_cnt)
   1345         {
   1346             /* adjust flush timeout settings to longer period */
   1347             for (i=0; i<BTA_AV_NUM_STRS; i++)
   1348             {
   1349                 p_scbi = bta_av_cb.p_scb[i];
   1350                 if (p_scbi && p_scbi->chnl == BTA_AV_CHNL_AUDIO && p_scbi->co_started)
   1351                 {
   1352                     /* may need to update the flush timeout of this already started stream */
   1353                     if (p_scbi->co_started != bta_av_cb.audio_open_cnt)
   1354                     {
   1355                         p_scbi->co_started = bta_av_cb.audio_open_cnt;
   1356                         L2CA_SetFlushTimeout(p_scbi->peer_addr, p_bta_av_cfg->p_audio_flush_to[p_scbi->co_started - 1] );
   1357                     }
   1358                 }
   1359             }
   1360         }
   1361     }
   1362 }
   1363 
   1364 /*******************************************************************************
   1365 **
   1366 ** Function         bta_av_disable
   1367 **
   1368 ** Description      disable AV.
   1369 **
   1370 ** Returns          void
   1371 **
   1372 *******************************************************************************/
   1373 void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
   1374 {
   1375     BT_HDR  hdr;
   1376     UINT16  xx;
   1377     UNUSED(p_data);
   1378 
   1379     p_cb->disabling = TRUE;
   1380 
   1381     bta_av_close_all_rc(p_cb);
   1382 
   1383     utl_freebuf((void **) &p_cb->p_disc_db);
   1384 
   1385     /* disable audio/video - de-register all channels,
   1386      * expect BTA_AV_DEREG_COMP_EVT when deregister is complete */
   1387     for(xx=0; xx<BTA_AV_NUM_STRS; xx++)
   1388     {
   1389         hdr.layer_specific = xx + 1;
   1390         bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
   1391     }
   1392 }
   1393 
   1394 /*******************************************************************************
   1395 **
   1396 ** Function         bta_av_api_disconnect
   1397 **
   1398 ** Description      .
   1399 **
   1400 ** Returns          void
   1401 **
   1402 *******************************************************************************/
   1403 void bta_av_api_disconnect(tBTA_AV_DATA *p_data)
   1404 {
   1405     AVDT_DisconnectReq(p_data->api_discnt.bd_addr, bta_av_conn_cback);
   1406     bta_sys_stop_timer(&bta_av_cb.sig_tmr);
   1407 }
   1408 
   1409 /*******************************************************************************
   1410 **
   1411 ** Function         bta_av_sig_chg
   1412 **
   1413 ** Description      process AVDT signal channel up/down.
   1414 **
   1415 ** Returns          void
   1416 **
   1417 *******************************************************************************/
   1418 void bta_av_sig_chg(tBTA_AV_DATA *p_data)
   1419 {
   1420     UINT16 event = p_data->str_msg.hdr.layer_specific;
   1421     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1422     int     xx;
   1423     UINT8   mask;
   1424     tBTA_AV_LCB *p_lcb = NULL;
   1425 
   1426     APPL_TRACE_DEBUG("bta_av_sig_chg event: %d", event);
   1427     if(event == AVDT_CONNECT_IND_EVT)
   1428     {
   1429         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FIND);
   1430         if(!p_lcb)
   1431         {
   1432             /* if the address does not have an LCB yet, alloc one */
   1433             for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
   1434             {
   1435                 mask = 1 << xx;
   1436                 APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
   1437 
   1438                 /* look for a p_lcb with its p_scb registered */
   1439                 if((!(mask & p_cb->conn_lcb)) && (p_cb->p_scb[xx] != NULL))
   1440                 {
   1441                     p_lcb = &p_cb->lcb[xx];
   1442                     p_lcb->lidx = xx + 1;
   1443                     bdcpy(p_lcb->addr, p_data->str_msg.bd_addr);
   1444                     p_lcb->conn_msk = 0; /* clear the connect mask */
   1445                     /* start listening when the signal channel is open */
   1446                     if (p_cb->features & BTA_AV_FEAT_RCTG)
   1447                     {
   1448                         bta_av_rc_create(p_cb, AVCT_ACP, 0, p_lcb->lidx);
   1449                     }
   1450                     /* this entry is not used yet. */
   1451                     p_cb->conn_lcb |= mask;     /* mark it as used */
   1452                     APPL_TRACE_DEBUG("start sig timer %d", p_data->hdr.offset);
   1453                     if (p_data->hdr.offset == AVDT_ACP)
   1454                     {
   1455                         APPL_TRACE_DEBUG("Incoming L2CAP acquired, set state as incoming", NULL);
   1456                         bdcpy(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr);
   1457                         p_cb->p_scb[xx]->use_rc = TRUE;     /* allowing RC for incoming connection */
   1458                         bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_ACP_CONNECT_EVT, p_data);
   1459 
   1460                         /* The Pending Event should be sent as soon as the L2CAP signalling channel
   1461                          * is set up, which is NOW. Earlier this was done only after
   1462                          * BTA_AV_SIG_TIME_VAL milliseconds.
   1463                          * The following function shall send the event and start the recurring timer
   1464                          */
   1465                         bta_av_sig_timer(NULL);
   1466 
   1467                         /* Possible collision : need to avoid outgoing processing while the timer is running */
   1468                         p_cb->p_scb[xx]->coll_mask = BTA_AV_COLL_INC_TMR;
   1469 
   1470                         p_cb->acp_sig_tmr.param = (UINT32)xx;
   1471                         p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK*)&bta_av_acp_sig_timer_cback;
   1472                         bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
   1473                     }
   1474                     break;
   1475                 }
   1476             }
   1477 
   1478             /* check if we found something */
   1479             if (xx == BTA_AV_NUM_LINKS)
   1480             {
   1481                 /* We do not have scb for this avdt connection.     */
   1482                 /* Silently close the connection.                   */
   1483                 APPL_TRACE_ERROR("av scb not available for avdt connection");
   1484                 AVDT_DisconnectReq (p_data->str_msg.bd_addr, NULL);
   1485                 return;
   1486             }
   1487         }
   1488     }
   1489 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   1490     else if (event == BTA_AR_AVDT_CONN_EVT)
   1491     {
   1492         bta_sys_stop_timer(&bta_av_cb.sig_tmr);
   1493     }
   1494 #endif
   1495     else
   1496     {
   1497         /* disconnected. */
   1498         p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FREE);
   1499         if(p_lcb && p_lcb->conn_msk)
   1500         {
   1501             APPL_TRACE_DEBUG("conn_msk: 0x%x", p_lcb->conn_msk);
   1502             /* clean up ssm  */
   1503             for(xx=0; xx < BTA_AV_NUM_STRS; xx++)
   1504             {
   1505                 mask = 1 << (xx + 1);
   1506                 if ((mask & p_lcb->conn_msk) && (p_cb->p_scb[xx]) &&
   1507                     (bdcmp(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr) == 0))
   1508                 {
   1509                     bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_AVDT_DISCONNECT_EVT, NULL);
   1510                 }
   1511             }
   1512         }
   1513     }
   1514     APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
   1515 }
   1516 
   1517 /*******************************************************************************
   1518 **
   1519 ** Function         bta_av_sig_timer
   1520 **
   1521 ** Description      process the signal channel timer. This timer is started
   1522 **                  when the AVDTP signal channel is connected. If no profile
   1523 **                  is connected, the timer goes off every BTA_AV_SIG_TIME_VAL
   1524 **
   1525 ** Returns          void
   1526 **
   1527 *******************************************************************************/
   1528 void bta_av_sig_timer(tBTA_AV_DATA *p_data)
   1529 {
   1530     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1531     int     xx;
   1532     UINT8   mask;
   1533     tBTA_AV_LCB *p_lcb = NULL;
   1534     tBTA_AV_PEND pend;
   1535     UNUSED(p_data);
   1536 
   1537     APPL_TRACE_DEBUG("bta_av_sig_timer");
   1538     for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
   1539     {
   1540         mask = 1 << xx;
   1541         if(mask & p_cb->conn_lcb)
   1542         {
   1543             /* this entry is used. check if it is connected */
   1544             p_lcb = &p_cb->lcb[xx];
   1545             if(!p_lcb->conn_msk)
   1546             {
   1547                 bta_sys_start_timer(&p_cb->sig_tmr, BTA_AV_SIG_TIMER_EVT, BTA_AV_SIG_TIME_VAL);
   1548                 bdcpy(pend.bd_addr, p_lcb->addr);
   1549                 (*p_cb->p_cback)(BTA_AV_PENDING_EVT, (tBTA_AV *) &pend);
   1550             }
   1551         }
   1552     }
   1553 }
   1554 
   1555 /*******************************************************************************
   1556 **
   1557 ** Function         bta_av_acp_sig_timer_cback
   1558 **
   1559 ** Description      Process the timeout when SRC is accepting connection
   1560 **                  and SNK did not start signalling.
   1561 **
   1562 ** Returns          void
   1563 **
   1564 *******************************************************************************/
   1565 static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle)
   1566 {
   1567     UINT8   inx = (UINT8)p_tle->param;
   1568     tBTA_AV_CB  *p_cb = &bta_av_cb;
   1569     tBTA_AV_SCB *p_scb = NULL;
   1570     tBTA_AV_API_OPEN  *p_buf;
   1571     if (inx < BTA_AV_NUM_STRS)
   1572     {
   1573         p_scb = p_cb->p_scb[inx];
   1574     }
   1575     if (p_scb)
   1576     {
   1577         APPL_TRACE_DEBUG("bta_av_acp_sig_timer_cback, coll_mask = 0x%02X", p_scb->coll_mask);
   1578 
   1579         if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)
   1580         {
   1581             p_scb->coll_mask &= ~BTA_AV_COLL_INC_TMR;
   1582 
   1583             if (bta_av_is_scb_opening(p_scb))
   1584             {
   1585                 if (p_scb->p_disc_db)
   1586                 {
   1587                     /* We are still doing SDP. Run the timer again. */
   1588                     p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;
   1589 
   1590                     p_cb->acp_sig_tmr.param = (UINT32)inx;
   1591                     p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK *)&bta_av_acp_sig_timer_cback;
   1592                     bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
   1593                 }
   1594                 else
   1595                 {
   1596                     /* SNK did not start signalling, resume signalling process. */
   1597                     bta_av_discover_req (p_scb, NULL);
   1598                 }
   1599             }
   1600             else if (bta_av_is_scb_incoming(p_scb))
   1601             {
   1602                 /* Stay in incoming state if SNK does not start signalling */
   1603 
   1604                 /* API open was called right after SNK opened L2C connection. */
   1605                 if (p_scb->coll_mask & BTA_AV_COLL_API_CALLED)
   1606                 {
   1607                     p_scb->coll_mask &= ~BTA_AV_COLL_API_CALLED;
   1608 
   1609                     /* BTA_AV_API_OPEN_EVT */
   1610                     if ((p_buf = (tBTA_AV_API_OPEN *) GKI_getbuf(sizeof(tBTA_AV_API_OPEN))) != NULL)
   1611                     {
   1612                         memcpy(p_buf, &(p_scb->open_api), sizeof(tBTA_AV_API_OPEN));
   1613                         bta_sys_sendmsg(p_buf);
   1614                     }
   1615                 }
   1616             }
   1617         }
   1618     }
   1619 }
   1620 
   1621 /*******************************************************************************
   1622 **
   1623 ** Function         bta_av_check_peer_features
   1624 **
   1625 ** Description      check supported features on the peer device from the SDP record
   1626 **                  and return the feature mask
   1627 **
   1628 ** Returns          tBTA_AV_FEAT peer device feature mask
   1629 **
   1630 *******************************************************************************/
   1631 tBTA_AV_FEAT bta_av_check_peer_features (UINT16 service_uuid)
   1632 {
   1633     tBTA_AV_FEAT peer_features = 0;
   1634     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1635     tSDP_DISC_REC       *p_rec = NULL;
   1636     tSDP_DISC_ATTR      *p_attr;
   1637     UINT16              peer_rc_version=0;
   1638     UINT16              categories = 0;
   1639 
   1640     APPL_TRACE_DEBUG("bta_av_check_peer_features service_uuid:x%x", service_uuid);
   1641     /* loop through all records we found */
   1642     while (TRUE)
   1643     {
   1644         /* get next record; if none found, we're done */
   1645         if ((p_rec = SDP_FindServiceInDb(p_cb->p_disc_db, service_uuid, p_rec)) == NULL)
   1646         {
   1647             break;
   1648         }
   1649 
   1650         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_CLASS_ID_LIST)) != NULL)
   1651         {
   1652             /* find peer features */
   1653             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL))
   1654             {
   1655                 peer_features |= BTA_AV_FEAT_RCCT;
   1656             }
   1657             if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REM_CTRL_TARGET, NULL))
   1658             {
   1659                 peer_features |= BTA_AV_FEAT_RCTG;
   1660             }
   1661         }
   1662 
   1663         if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST)) != NULL)
   1664         {
   1665             /* get profile version (if failure, version parameter is not updated) */
   1666             SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL, &peer_rc_version);
   1667             APPL_TRACE_DEBUG("peer_rc_version 0x%x", peer_rc_version);
   1668 
   1669             if (peer_rc_version >= AVRC_REV_1_3)
   1670                 peer_features |= (BTA_AV_FEAT_VENDOR | BTA_AV_FEAT_METADATA);
   1671 
   1672             if (peer_rc_version >= AVRC_REV_1_4)
   1673             {
   1674                 peer_features |= (BTA_AV_FEAT_ADV_CTRL);
   1675                 /* get supported categories */
   1676                 if ((p_attr = SDP_FindAttributeInRec(p_rec,
   1677                                 ATTR_ID_SUPPORTED_FEATURES)) != NULL)
   1678                 {
   1679                     categories = p_attr->attr_value.v.u16;
   1680                     if (categories & AVRC_SUPF_CT_BROWSE)
   1681                         peer_features |= (BTA_AV_FEAT_BROWSE);
   1682                 }
   1683             }
   1684         }
   1685     }
   1686     APPL_TRACE_DEBUG("peer_features:x%x", peer_features);
   1687     return peer_features;
   1688 }
   1689 
   1690 /*******************************************************************************
   1691 **
   1692 ** Function         bta_av_rc_disc_done
   1693 **
   1694 ** Description      Handle AVRCP service discovery results.  If matching
   1695 **                  service found, open AVRCP connection.
   1696 **
   1697 ** Returns          void
   1698 **
   1699 *******************************************************************************/
   1700 void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
   1701 {
   1702     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1703     tBTA_AV_SCB  *p_scb = NULL;
   1704     tBTA_AV_LCB  *p_lcb;
   1705     tBTA_AV_RC_OPEN rc_open;
   1706     tBTA_AV_RC_FEAT rc_feat;
   1707     UINT8               rc_handle;
   1708     tBTA_AV_FEAT        peer_features;  /* peer features mask */
   1709     UNUSED(p_data);
   1710 
   1711     APPL_TRACE_DEBUG("bta_av_rc_disc_done disc:x%x", p_cb->disc);
   1712     if (!p_cb->disc)
   1713     {
   1714         return;
   1715     }
   1716 
   1717     if ((p_cb->disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
   1718     {
   1719         /* this is the rc handle/index to tBTA_AV_RCB */
   1720         rc_handle = p_cb->disc & (~BTA_AV_CHNL_MSK);
   1721     }
   1722     else
   1723     {
   1724         /* Validate array index*/
   1725         if (((p_cb->disc & BTA_AV_HNDL_MSK) - 1) < BTA_AV_NUM_STRS)
   1726         {
   1727             p_scb = p_cb->p_scb[(p_cb->disc & BTA_AV_HNDL_MSK) - 1];
   1728         }
   1729         if (p_scb)
   1730             rc_handle = p_scb->rc_handle;
   1731         else
   1732         {
   1733             p_cb->disc = 0;
   1734             return;
   1735         }
   1736     }
   1737 
   1738     APPL_TRACE_DEBUG("rc_handle %d", rc_handle);
   1739     /* check peer version and whether support CT and TG role */
   1740     peer_features = bta_av_check_peer_features (UUID_SERVCLASS_AV_REMOTE_CONTROL);
   1741     if ((p_cb->features & BTA_AV_FEAT_ADV_CTRL) && ((peer_features&BTA_AV_FEAT_ADV_CTRL) == 0))
   1742     {
   1743         /* if we support advance control and peer does not, check their support on TG role
   1744          * some implementation uses 1.3 on CT ans 1.4 on TG */
   1745         peer_features |= bta_av_check_peer_features (UUID_SERVCLASS_AV_REM_CTRL_TARGET);
   1746     }
   1747 
   1748     p_cb->disc = 0;
   1749     utl_freebuf((void **) &p_cb->p_disc_db);
   1750 
   1751     APPL_TRACE_DEBUG("peer_features 0x%x, features 0x%x", peer_features, p_cb->features);
   1752 
   1753     /* if we have no rc connection */
   1754     if (rc_handle == BTA_AV_RC_HANDLE_NONE)
   1755     {
   1756         if (p_scb)
   1757         {
   1758             /* if peer remote control service matches ours and USE_RC is TRUE */
   1759             if ((((p_cb->features & BTA_AV_FEAT_RCCT) && (peer_features & BTA_AV_FEAT_RCTG)) ||
   1760                  ((p_cb->features & BTA_AV_FEAT_RCTG) && (peer_features & BTA_AV_FEAT_RCCT))) )
   1761             {
   1762                 p_lcb = bta_av_find_lcb(p_scb->peer_addr, BTA_AV_LCB_FIND);
   1763                 if(p_lcb)
   1764                 {
   1765                     rc_handle = bta_av_rc_create(p_cb, AVCT_INT, (UINT8)(p_scb->hdi + 1), p_lcb->lidx);
   1766                     p_cb->rcb[rc_handle].peer_features = peer_features;
   1767                 }
   1768 #if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
   1769                 else
   1770                 {
   1771                     APPL_TRACE_ERROR("can not find LCB!!");
   1772                 }
   1773 #endif
   1774             }
   1775             else if(p_scb->use_rc)
   1776             {
   1777                 /* can not find AVRC on peer device. report failure */
   1778                 p_scb->use_rc = FALSE;
   1779                 bdcpy(rc_open.peer_addr, p_scb->peer_addr);
   1780                 rc_open.peer_features = 0;
   1781                 rc_open.status = BTA_AV_FAIL_SDP;
   1782                 (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
   1783             }
   1784         }
   1785     }
   1786     else
   1787     {
   1788         p_cb->rcb[rc_handle].peer_features = peer_features;
   1789         rc_feat.rc_handle =  rc_handle;
   1790         rc_feat.peer_features = peer_features;
   1791         (*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
   1792     }
   1793 }
   1794 
   1795 /*******************************************************************************
   1796 **
   1797 ** Function         bta_av_rc_closed
   1798 **
   1799 ** Description      Set AVRCP state to closed.
   1800 **
   1801 ** Returns          void
   1802 **
   1803 *******************************************************************************/
   1804 void bta_av_rc_closed(tBTA_AV_DATA *p_data)
   1805 {
   1806     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1807     tBTA_AV_RC_CLOSE rc_close;
   1808     tBTA_AV_RC_CONN_CHG *p_msg = (tBTA_AV_RC_CONN_CHG *)p_data;
   1809     tBTA_AV_RCB    *p_rcb;
   1810     tBTA_AV_SCB    *p_scb;
   1811     int i;
   1812     BOOLEAN conn = FALSE;
   1813     tBTA_AV_LCB *p_lcb;
   1814 
   1815     rc_close.rc_handle = BTA_AV_RC_HANDLE_NONE;
   1816     p_scb = NULL;
   1817     APPL_TRACE_DEBUG("bta_av_rc_closed rc_handle:%d", p_msg->handle);
   1818     for(i=0; i<BTA_AV_NUM_RCB; i++)
   1819     {
   1820         p_rcb = &p_cb->rcb[i];
   1821         APPL_TRACE_DEBUG("bta_av_rc_closed rcb[%d] rc_handle:%d, status=0x%x", i, p_rcb->handle, p_rcb->status);
   1822         if(p_rcb->handle == p_msg->handle)
   1823         {
   1824             rc_close.rc_handle = i;
   1825             p_rcb->status &= ~BTA_AV_RC_CONN_MASK;
   1826             p_rcb->peer_features = 0;
   1827             APPL_TRACE_DEBUG("       shdl:%d, lidx:%d", p_rcb->shdl, p_rcb->lidx);
   1828             if(p_rcb->shdl)
   1829             {
   1830                 if ((p_rcb->shdl - 1) < BTA_AV_NUM_STRS)
   1831                 {
   1832                     p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
   1833                 }
   1834                 if(p_scb)
   1835                 {
   1836                     bdcpy(rc_close.peer_addr, p_scb->peer_addr);
   1837                     if(p_scb->rc_handle == p_rcb->handle)
   1838                         p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
   1839                     APPL_TRACE_DEBUG("shdl:%d, srch:%d", p_rcb->shdl, p_scb->rc_handle);
   1840                 }
   1841                 p_rcb->shdl = 0;
   1842             }
   1843             else if(p_rcb->lidx == (BTA_AV_NUM_LINKS + 1) )
   1844             {
   1845                 /* if the RCB uses the extra LCB, use the addr for event and clean it */
   1846                 p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
   1847                 bdcpy(rc_close.peer_addr, p_msg->peer_addr);
   1848                 APPL_TRACE_DEBUG("rc_only closed bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
   1849                               p_msg->peer_addr[0], p_msg->peer_addr[1],
   1850                               p_msg->peer_addr[2], p_msg->peer_addr[3],
   1851                               p_msg->peer_addr[4], p_msg->peer_addr[5]);
   1852                 p_lcb->conn_msk = 0;
   1853                 p_lcb->lidx = 0;
   1854             }
   1855             p_rcb->lidx = 0;
   1856 
   1857             if((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT)
   1858             {
   1859                 /* AVCT CCB is deallocated */
   1860                 p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
   1861                 p_rcb->status = 0;
   1862             }
   1863             else
   1864             {
   1865                 /* AVCT CCB is still there. dealloc */
   1866                 bta_av_del_rc(p_rcb);
   1867 
   1868                 /* if the AVRCP is no longer listening, create the listening channel */
   1869                 if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
   1870                     bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
   1871             }
   1872         }
   1873         else if((p_rcb->handle != BTA_AV_RC_HANDLE_NONE) && (p_rcb->status & BTA_AV_RC_CONN_MASK))
   1874         {
   1875             /* at least one channel is still connected */
   1876             conn = TRUE;
   1877         }
   1878     }
   1879 
   1880     if(!conn)
   1881     {
   1882         /* no AVRC channels are connected, go back to INIT state */
   1883         bta_av_sm_execute(p_cb, BTA_AV_AVRC_NONE_EVT, NULL);
   1884     }
   1885 
   1886     if (rc_close.rc_handle == BTA_AV_RC_HANDLE_NONE)
   1887     {
   1888         rc_close.rc_handle = p_msg->handle;
   1889         bdcpy(rc_close.peer_addr, p_msg->peer_addr);
   1890     }
   1891     (*p_cb->p_cback)(BTA_AV_RC_CLOSE_EVT, (tBTA_AV *) &rc_close);
   1892 }
   1893 
   1894 /*******************************************************************************
   1895 **
   1896 ** Function         bta_av_rc_disc
   1897 **
   1898 ** Description      start AVRC SDP discovery.
   1899 **
   1900 ** Returns          void
   1901 **
   1902 *******************************************************************************/
   1903 void bta_av_rc_disc(UINT8 disc)
   1904 {
   1905     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1906     tAVRC_SDP_DB_PARAMS db_params;
   1907       UINT16              attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST,
   1908                                        ATTR_ID_BT_PROFILE_DESC_LIST,
   1909                                        ATTR_ID_SUPPORTED_FEATURES};
   1910     UINT8       hdi;
   1911     tBTA_AV_SCB *p_scb;
   1912     UINT8       *p_addr = NULL;
   1913     UINT8       rc_handle;
   1914 
   1915     APPL_TRACE_DEBUG("bta_av_rc_disc 0x%x, %d", disc, bta_av_cb.disc);
   1916     if ((bta_av_cb.disc != 0) || (disc == 0))
   1917         return;
   1918 
   1919     if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
   1920     {
   1921         /* this is the rc handle/index to tBTA_AV_RCB */
   1922         rc_handle = disc & (~BTA_AV_CHNL_MSK);
   1923         if (p_cb->rcb[rc_handle].lidx)
   1924         {
   1925             p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx-1].addr;
   1926         }
   1927     }
   1928     else
   1929     {
   1930         hdi = (disc & BTA_AV_HNDL_MSK) - 1;
   1931         p_scb = p_cb->p_scb[hdi];
   1932 
   1933         if (p_scb)
   1934         {
   1935             APPL_TRACE_DEBUG("rc_handle %d", p_scb->rc_handle);
   1936             p_addr = p_scb->peer_addr;
   1937         }
   1938     }
   1939 
   1940     if (p_addr)
   1941     {
   1942         /* allocate discovery database */
   1943         if (p_cb->p_disc_db == NULL)
   1944         {
   1945             p_cb->p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(BTA_AV_DISC_BUF_SIZE);
   1946         }
   1947 
   1948         if (p_cb->p_disc_db)
   1949         {
   1950             /* set up parameters */
   1951             db_params.db_len = BTA_AV_DISC_BUF_SIZE;
   1952             db_params.num_attr = 3;
   1953             db_params.p_db = p_cb->p_disc_db;
   1954             db_params.p_attrs = attr_list;
   1955 
   1956             /* searching for UUID_SERVCLASS_AV_REMOTE_CONTROL gets both TG and CT */
   1957             if (AVRC_FindService(UUID_SERVCLASS_AV_REMOTE_CONTROL, p_addr, &db_params,
   1958                             bta_av_avrc_sdp_cback) == AVRC_SUCCESS)
   1959             {
   1960                 p_cb->disc = disc;
   1961                 APPL_TRACE_DEBUG("disc %d", p_cb->disc);
   1962             }
   1963         }
   1964     }
   1965 }
   1966 
   1967 /*******************************************************************************
   1968 **
   1969 ** Function         bta_av_dereg_comp
   1970 **
   1971 ** Description      deregister complete. free the stream control block.
   1972 **
   1973 ** Returns          void
   1974 **
   1975 *******************************************************************************/
   1976 void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
   1977 {
   1978     tBTA_AV_CB   *p_cb = &bta_av_cb;
   1979     tBTA_AV_SCB  *p_scb;
   1980     tBTA_UTL_COD    cod;
   1981     UINT8   mask;
   1982     BT_HDR  *p_buf;
   1983 
   1984     /* find the stream control block */
   1985     p_scb = bta_av_hndl_to_scb(p_data->hdr.layer_specific);
   1986 
   1987     if(p_scb)
   1988     {
   1989         APPL_TRACE_DEBUG("deregistered %d(h%d)", p_scb->chnl, p_scb->hndl);
   1990         mask = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
   1991         if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
   1992         {
   1993             p_cb->reg_audio  &= ~mask;
   1994             if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
   1995             {
   1996                 /* this channel is still marked as open. decrease the count */
   1997                 bta_av_cb.audio_open_cnt--;
   1998             }
   1999             p_cb->conn_audio &= ~mask;
   2000 
   2001             if (p_scb->q_tag == BTA_AV_Q_TAG_STREAM && p_scb->a2d_list) {
   2002                 /* make sure no buffers are in a2d_list */
   2003                 while (!list_is_empty(p_scb->a2d_list)) {
   2004                     p_buf = (BT_HDR*)list_front(p_scb->a2d_list);
   2005                     list_remove(p_scb->a2d_list, p_buf);
   2006                     GKI_freebuf(p_buf);
   2007                 }
   2008             }
   2009 
   2010             /* remove the A2DP SDP record, if no more audio stream is left */
   2011             if(!p_cb->reg_audio)
   2012             {
   2013 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   2014                 bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REMOTE_CONTROL, BTA_ID_AV);
   2015 #endif
   2016                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_handle);
   2017                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
   2018 
   2019 #if (BTA_AV_SINK_INCLUDED == TRUE)
   2020                 bta_av_del_sdp_rec(&p_cb->sdp_a2d_snk_handle);
   2021                 bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SINK);
   2022 #endif
   2023             }
   2024         }
   2025         else
   2026         {
   2027             p_cb->reg_video  &= ~mask;
   2028             /* make sure that this channel is not connected */
   2029             p_cb->conn_video &= ~mask;
   2030             /* remove the VDP SDP record, (only one video stream at most) */
   2031             bta_av_del_sdp_rec(&p_cb->sdp_vdp_handle);
   2032             bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
   2033         }
   2034 
   2035         /* make sure that the timer is not active */
   2036         bta_sys_stop_timer(&p_scb->timer);
   2037         utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
   2038     }
   2039 
   2040     APPL_TRACE_DEBUG("audio 0x%x, video: 0x%x, disable:%d",
   2041         p_cb->reg_audio, p_cb->reg_video, p_cb->disabling);
   2042     /* if no stream control block is active */
   2043     if((p_cb->reg_audio + p_cb->reg_video) == 0)
   2044     {
   2045 #if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
   2046         /* deregister from AVDT */
   2047         bta_ar_dereg_avdt(BTA_ID_AV);
   2048 
   2049         /* deregister from AVCT */
   2050         bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REM_CTRL_TARGET, BTA_ID_AV);
   2051         bta_ar_dereg_avct(BTA_ID_AV);
   2052 #endif
   2053 
   2054         if(p_cb->disabling)
   2055         {
   2056             p_cb->disabling     = FALSE;
   2057             bta_av_cb.features  = 0;
   2058         }
   2059 
   2060         /* Clear the Capturing service class bit */
   2061         cod.service = BTM_COD_SERVICE_CAPTURING;
   2062         utl_set_device_class(&cod, BTA_UTL_CLR_COD_SERVICE_CLASS);
   2063     }
   2064 }
   2065 #endif /* BTA_AV_INCLUDED */
   2066