Home | History | Annotate | Download | only in avdt
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2002-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This module contains the action functions associated with the stream
     22  *  control block state machine.
     23  *
     24  ******************************************************************************/
     25 
     26 #include <string.h>
     27 #include "bt_types.h"
     28 #include "bt_target.h"
     29 #include "bt_utils.h"
     30 #include "avdt_api.h"
     31 #include "avdtc_api.h"
     32 #include "avdt_int.h"
     33 #include "bt_common.h"
     34 #include "btu.h"
     35 
     36 
     37 extern fixed_queue_t *btu_general_alarm_queue;
     38 
     39 /* This table is used to lookup the callback event that matches a particular
     40 ** state machine API request event.  Note that state machine API request
     41 ** events are at the beginning of the event list starting at zero, thus
     42 ** allowing for this table.
     43 */
     44 const UINT8 avdt_scb_cback_evt[] = {
     45     0,                          /* API_REMOVE_EVT (no event) */
     46     AVDT_WRITE_CFM_EVT,         /* API_WRITE_REQ_EVT */
     47     0,                          /* API_GETCONFIG_REQ_EVT (no event) */
     48     0,                          /* API_DELAY_RPT_REQ_EVT (no event) */
     49     AVDT_OPEN_CFM_EVT,          /* API_SETCONFIG_REQ_EVT */
     50     AVDT_OPEN_CFM_EVT,          /* API_OPEN_REQ_EVT */
     51     AVDT_CLOSE_CFM_EVT,         /* API_CLOSE_REQ_EVT */
     52     AVDT_RECONFIG_CFM_EVT,      /* API_RECONFIG_REQ_EVT */
     53     AVDT_SECURITY_CFM_EVT,      /* API_SECURITY_REQ_EVT */
     54     0                           /* API_ABORT_REQ_EVT (no event) */
     55 };
     56 
     57 /* This table is used to look up the callback event based on the signaling
     58 ** role when the stream is closed.
     59 */
     60 const UINT8 avdt_scb_role_evt[] = {
     61     AVDT_CLOSE_IND_EVT,         /* AVDT_CLOSE_ACP */
     62     AVDT_CLOSE_CFM_EVT,         /* AVDT_CLOSE_INT */
     63     AVDT_CLOSE_IND_EVT,         /* AVDT_OPEN_ACP */
     64     AVDT_OPEN_CFM_EVT           /* AVDT_OPEN_INT */
     65 };
     66 
     67 /*******************************************************************************
     68 **
     69 ** Function         avdt_scb_gen_ssrc
     70 **
     71 ** Description      This function generates a SSRC number unique to the stream.
     72 **
     73 ** Returns          SSRC value.
     74 **
     75 *******************************************************************************/
     76 UINT32 avdt_scb_gen_ssrc(tAVDT_SCB *p_scb)
     77 {
     78     /* combine the value of the media type and codec type of the SCB */
     79     return ((UINT32)(p_scb->cs.cfg.codec_info[1] | p_scb->cs.cfg.codec_info[2]));
     80 }
     81 
     82 /*******************************************************************************
     83 **
     84 ** Function         avdt_scb_hdl_abort_cmd
     85 **
     86 ** Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
     87 **                  to initiate sending of an abort response message.
     88 **
     89 ** Returns          Nothing.
     90 **
     91 *******************************************************************************/
     92 void avdt_scb_hdl_abort_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
     93 {
     94     p_scb->role = AVDT_CLOSE_ACP;
     95     avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
     96 }
     97 
     98 /*******************************************************************************
     99 **
    100 ** Function         avdt_scb_hdl_abort_rsp
    101 **
    102 ** Description      This function is an empty function; it serves as a
    103 **                  placeholder for a conformance API action function.
    104 **
    105 ** Returns          Nothing.
    106 **
    107 *******************************************************************************/
    108 void avdt_scb_hdl_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    109 {
    110     UNUSED(p_scb);
    111     UNUSED(p_data);
    112     return;
    113 }
    114 
    115 /*******************************************************************************
    116 **
    117 ** Function         avdt_scb_hdl_close_cmd
    118 **
    119 ** Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
    120 **                  to initiate sending of a close response message.
    121 **
    122 ** Returns          Nothing.
    123 **
    124 *******************************************************************************/
    125 void avdt_scb_hdl_close_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    126 {
    127     p_scb->role = AVDT_CLOSE_ACP;
    128     avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
    129 }
    130 
    131 /*******************************************************************************
    132 **
    133 ** Function         avdt_scb_hdl_close_rsp
    134 **
    135 ** Description      This function sets the close_code variable to the error
    136 **                  code returned in the close response.
    137 **
    138 ** Returns          Nothing.
    139 **
    140 *******************************************************************************/
    141 void avdt_scb_hdl_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    142 {
    143     p_scb->close_code = p_data->msg.hdr.err_code;
    144 }
    145 
    146 /*******************************************************************************
    147 **
    148 ** Function         avdt_scb_hdl_getconfig_cmd
    149 **
    150 ** Description      This function retrieves the configuration parameters of
    151 **                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
    152 **                  to initiate sending of a get configuration response message.
    153 **
    154 ** Returns          Nothing.
    155 **
    156 *******************************************************************************/
    157 void avdt_scb_hdl_getconfig_cmd(tAVDT_SCB *p_scb,tAVDT_SCB_EVT *p_data)
    158 {
    159     p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
    160 
    161     avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
    162 }
    163 
    164 /*******************************************************************************
    165 **
    166 ** Function         avdt_scb_hdl_getconfig_rsp
    167 **
    168 ** Description      This function is an empty function; it serves as a
    169 **                  placeholder for a conformance API action function.
    170 **
    171 ** Returns          Nothing.
    172 **
    173 *******************************************************************************/
    174 void avdt_scb_hdl_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    175 {
    176     UNUSED(p_scb);
    177     UNUSED(p_data);
    178     return;
    179 }
    180 
    181 /*******************************************************************************
    182 **
    183 ** Function         avdt_scb_hdl_open_cmd
    184 **
    185 ** Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
    186 **                  to initiate sending of an open response message.
    187 **
    188 ** Returns          Nothing.
    189 **
    190 *******************************************************************************/
    191 void avdt_scb_hdl_open_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    192 {
    193     avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
    194 }
    195 
    196 /*******************************************************************************
    197 **
    198 ** Function         avdt_scb_hdl_open_rej
    199 **
    200 ** Description      This function calls the application callback function
    201 **                  indicating the open request has failed.  It initializes
    202 **                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
    203 **                  to the CCB.
    204 **
    205 ** Returns          Nothing.
    206 **
    207 *******************************************************************************/
    208 void avdt_scb_hdl_open_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    209 {
    210     /* do exactly same as setconfig reject */
    211     avdt_scb_hdl_setconfig_rej(p_scb, p_data);
    212 }
    213 
    214 /*******************************************************************************
    215 **
    216 ** Function         avdt_scb_hdl_open_rsp
    217 **
    218 ** Description      This function calls avdt_ad_open_req() to initiate
    219 **                  connection of the transport channel for this stream.
    220 **
    221 ** Returns          Nothing.
    222 **
    223 *******************************************************************************/
    224 void avdt_scb_hdl_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    225 {
    226     UNUSED(p_data);
    227 
    228     /* initiate opening of trans channels for this SEID */
    229     p_scb->role = AVDT_OPEN_INT;
    230     avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
    231 
    232     /* start tc connect timer */
    233     alarm_set_on_queue(p_scb->transport_channel_timer,
    234                        AVDT_SCB_TC_CONN_TIMEOUT_MS,
    235                        avdt_scb_transport_channel_timer_timeout, p_scb,
    236                        btu_general_alarm_queue);
    237 }
    238 
    239 /*******************************************************************************
    240 **
    241 ** Function         avdt_scb_hdl_pkt_no_frag
    242 **
    243 ** Description
    244 **
    245 ** Returns          Nothing.
    246 **
    247 *******************************************************************************/
    248 void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    249 {
    250     UINT8   *p, *p_start;
    251     UINT8   o_v, o_p, o_x, o_cc;
    252     UINT8   m_pt;
    253     UINT8   marker;
    254     UINT16  seq;
    255     UINT32  time_stamp;
    256     UINT16  offset;
    257     UINT16  ex_len;
    258     UINT8   pad_len = 0;
    259 
    260     p = p_start = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    261 
    262     /* parse media packet header */
    263     AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
    264     AVDT_MSG_PRS_M_PT(p, m_pt, marker);
    265     BE_STREAM_TO_UINT16(seq, p);
    266     BE_STREAM_TO_UINT32(time_stamp, p);
    267     p += 4;
    268 
    269     UNUSED(o_v);
    270 
    271     /* skip over any csrc's in packet */
    272     p += o_cc * 4;
    273 
    274     /* check for and skip over extension header */
    275     if (o_x)
    276     {
    277         p += 2;
    278         BE_STREAM_TO_UINT16(ex_len, p);
    279         p += ex_len * 4;
    280     }
    281 
    282     /* save our new offset */
    283     offset = (UINT16) (p - p_start);
    284 
    285     /* adjust length for any padding at end of packet */
    286     if (o_p)
    287     {
    288         /* padding length in last byte of packet */
    289         pad_len =  *(p_start + p_data->p_pkt->len);
    290     }
    291 
    292     /* do sanity check */
    293     if ((offset > p_data->p_pkt->len) || ((pad_len + offset) > p_data->p_pkt->len))
    294     {
    295         AVDT_TRACE_WARNING("Got bad media packet");
    296         osi_free_and_reset((void **)&p_data->p_pkt);
    297     }
    298     /* adjust offset and length and send it up */
    299     else
    300     {
    301         p_data->p_pkt->len -= (offset + pad_len);
    302         p_data->p_pkt->offset += offset;
    303 
    304         if (p_scb->cs.p_data_cback != NULL)
    305         {
    306             /* report sequence number */
    307             p_data->p_pkt->layer_specific = seq;
    308             (*p_scb->cs.p_data_cback)(avdt_scb_to_hdl(p_scb), p_data->p_pkt,
    309                 time_stamp, (UINT8)(m_pt | (marker<<7)));
    310         }
    311         else
    312         {
    313 #if AVDT_MULTIPLEXING == TRUE
    314             if ((p_scb->cs.p_media_cback != NULL)
    315              && (p_scb->p_media_buf != NULL)
    316              && (p_scb->media_buf_len > p_data->p_pkt->len))
    317             {
    318                 /* media buffer enough length is assigned by application. Lets use it*/
    319                 memcpy(p_scb->p_media_buf,(UINT8*)(p_data->p_pkt + 1) + p_data->p_pkt->offset,
    320                     p_data->p_pkt->len);
    321                 (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb),p_scb->p_media_buf,
    322                     p_scb->media_buf_len,time_stamp,seq,m_pt,marker);
    323             }
    324 #endif
    325             osi_free_and_reset((void **)&p_data->p_pkt);
    326         }
    327     }
    328 }
    329 
    330 #if AVDT_REPORTING == TRUE
    331 /*******************************************************************************
    332 **
    333 ** Function         avdt_scb_hdl_report
    334 **
    335 ** Description
    336 **
    337 ** Returns          Nothing.
    338 **
    339 *******************************************************************************/
    340 UINT8 * avdt_scb_hdl_report(tAVDT_SCB *p_scb, UINT8 *p, UINT16 len)
    341 {
    342     UINT16  result = AVDT_SUCCESS;
    343     UINT8   *p_start = p;
    344     UINT32  ssrc;
    345     UINT8   o_v, o_p, o_cc;
    346     AVDT_REPORT_TYPE    pt;
    347     tAVDT_REPORT_DATA   report, *p_rpt;
    348 
    349     AVDT_TRACE_DEBUG( "avdt_scb_hdl_report");
    350     if(p_scb->cs.p_report_cback)
    351     {
    352         p_rpt = &report;
    353         /* parse report packet header */
    354         AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
    355         pt = *p++;
    356         p += 2;
    357         BE_STREAM_TO_UINT32(ssrc, p);
    358 
    359         UNUSED(o_p);
    360         UNUSED(o_v);
    361 
    362         switch(pt)
    363         {
    364         case AVDT_RTCP_PT_SR:   /* the packet type - SR (Sender Report) */
    365             BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
    366             BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
    367             BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
    368             BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
    369             BE_STREAM_TO_UINT32(report.sr.octet_count, p);
    370             break;
    371 
    372         case AVDT_RTCP_PT_RR:   /* the packet type - RR (Receiver Report) */
    373             report.rr.frag_lost = *p;
    374             BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
    375             report.rr.packet_lost &= 0xFFFFFF;
    376             BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
    377             BE_STREAM_TO_UINT32(report.rr.jitter, p);
    378             BE_STREAM_TO_UINT32(report.rr.lsr, p);
    379             BE_STREAM_TO_UINT32(report.rr.dlsr, p);
    380             break;
    381 
    382         case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
    383             if(*p == AVDT_RTCP_SDES_CNAME)
    384             {
    385                 p_rpt = (tAVDT_REPORT_DATA *)(p+2);
    386             }
    387             else
    388             {
    389                 AVDT_TRACE_WARNING( " - SDES SSRC=0x%08x sc=%d %d len=%d %s",
    390                     ssrc, o_cc, *p, *(p+1), p+2);
    391                 result = AVDT_BUSY;
    392             }
    393             break;
    394 
    395         default:
    396             AVDT_TRACE_ERROR( "Bad Report pkt - packet type: %d", pt);
    397             result = AVDT_BAD_PARAMS;
    398         }
    399 
    400         if(result == AVDT_SUCCESS)
    401             (*p_scb->cs.p_report_cback)(avdt_scb_to_hdl(p_scb), pt, p_rpt);
    402 
    403     }
    404     p_start += len;
    405     return p_start;
    406 }
    407 #endif
    408 
    409 #if AVDT_MULTIPLEXING == TRUE
    410 /*******************************************************************************
    411 **
    412 ** Function         avdt_scb_hdl_pkt_frag
    413 **
    414 ** Description
    415 **
    416 ** Returns          Nothing.
    417 **
    418 *******************************************************************************/
    419 void avdt_scb_hdl_pkt_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    420 {
    421     /* Fields of Adaptation Layer Header */
    422     UINT8   al_tsid,al_frag,al_lcode;
    423     UINT16  al_len;
    424     /* media header fields */
    425     UINT8   o_v, o_p, o_x, o_cc;
    426     UINT8   m_pt;
    427     UINT8   marker;
    428     UINT16  seq;
    429     UINT32  time_stamp;
    430     UINT32  ssrc;
    431     UINT16  ex_len;
    432     UINT8   pad_len;
    433     /* other variables */
    434     UINT8   *p; /* current pointer */
    435     UINT8   *p_end; /* end of all packet */
    436     UINT8   *p_payload; /* pointer to media fragment payload in the buffer */
    437     UINT32  payload_len; /* payload length */
    438     UINT16  frag_len; /* fragment length */
    439 
    440     p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    441     p_end = p + p_data->p_pkt->len;
    442     /* parse all fragments */
    443     while(p < p_end)
    444     {
    445         if (p_end - p < 4) /* length check. maximum length of AL header = 4 */
    446         {
    447             AVDT_TRACE_WARNING("p_end: 0x%x - p:0x%x < 4", p_end, p);
    448             break;
    449         }
    450 
    451         /* parse first byte */
    452         al_tsid = (*p)>>3;
    453         al_frag = ( (*p) >> 2 ) & 0x01;
    454         al_lcode = (*p++) & AVDT_ALH_LCODE_MASK;
    455 
    456         /* in case of TSID=00000, a second AL header byte, before the length field,
    457         ** is expected and contains the actual TSID, aligned with MSB */
    458         if(al_tsid == 0)
    459             al_tsid = *p++;
    460 
    461         /* get remaining media length on base of lcode */
    462         switch(al_lcode)
    463         {
    464         case AVDT_ALH_LCODE_NONE:  /* No length field present. Take length from l2cap */
    465             al_len = (UINT16)(p_end - p);
    466             break;
    467         case AVDT_ALH_LCODE_16BIT:  /* 16 bit length field */
    468             BE_STREAM_TO_UINT16(al_len, p);
    469             break;
    470         case AVDT_ALH_LCODE_9BITM0:  /* 9 bit length field, MSB = 0, 8 LSBs in 1 octet following */
    471             al_len = *p++;
    472             break;
    473         default:    /* 9 bit length field, MSB = 1, 8 LSBs in 1 octet following */
    474             al_len =(UINT16)*p++ + 0x100;
    475         }
    476 
    477         /* max fragment length */
    478         frag_len = (UINT16)(p_end - p);
    479         /* if it isn't last fragment */
    480         if(frag_len >= al_len)
    481             frag_len = al_len;
    482 
    483         /* check TSID corresponds to config */
    484         if (al_tsid != p_scb->curr_cfg.mux_tsid_media)
    485         {
    486 #if AVDT_REPORTING == TRUE
    487             if((p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) &&
    488                 (al_tsid == p_scb->curr_cfg.mux_tsid_report))
    489             {
    490                 /* parse reporting packet */
    491                 p = avdt_scb_hdl_report(p_scb, p, frag_len);
    492                 continue;
    493             }
    494             else
    495 #endif
    496             {
    497                 AVDT_TRACE_WARNING("bad tsid: %d, mux_tsid_media:%d", al_tsid, p_scb->curr_cfg.mux_tsid_media);
    498                 break;
    499             }
    500         }
    501         /* check are buffer for assembling and related callback set */
    502         else if ((p_scb->p_media_buf == NULL) || (p_scb->cs.p_media_cback == NULL))
    503         {
    504             AVDT_TRACE_WARNING("NULL p_media_buf or p_media_cback");
    505             break;
    506         }
    507 
    508 
    509         /* it is media fragment beginning */
    510         if(!al_frag) /* is it first fragment of original media packet */
    511         {
    512             AVDT_TRACE_DEBUG("al:%d media:%d",
    513                 al_len, p_scb->media_buf_len);
    514 
    515             p_scb->frag_off = 0;
    516             p_scb->frag_org_len = al_len; /* total length of original media packet */
    517             /* length check: minimum length of media header is 12 */
    518             if (p_scb->frag_org_len < 12)
    519             {
    520                 AVDT_TRACE_WARNING("bad al_len: %d(<12)", al_len);
    521                 break;
    522             }
    523             /* check that data fit into buffer */
    524             if (al_len > p_scb->media_buf_len)
    525             {
    526                 AVDT_TRACE_WARNING("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
    527                 break;
    528             }
    529             /* make sure it is the last fragment in l2cap packet */
    530             if (p + al_len < p_end)
    531             {
    532                 AVDT_TRACE_WARNING("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
    533                 break;
    534             }
    535         }
    536         else
    537         {
    538             AVDT_TRACE_DEBUG("al:%d media:%d frag_org_len:%d frag_off:%d",
    539                 al_len, p_scb->media_buf_len, p_scb->frag_org_len, p_scb->frag_off);
    540 
    541             /* check that remaining length from AL header equals to original len - length of already received fragments */
    542             if(al_len != p_scb->frag_org_len - p_scb->frag_off)
    543             {
    544                 AVDT_TRACE_WARNING("al_len:%d != (frag_org_len:%d - frag_off:%d) %d",
    545                     al_len, p_scb->frag_org_len, p_scb->frag_off,
    546                     (p_scb->frag_org_len- p_scb->frag_off));
    547                 break;
    548             }
    549 
    550             /* do sanity check */
    551             if (p_scb->frag_off == 0)
    552             {
    553                 AVDT_TRACE_WARNING("frag_off=0");
    554                 break;
    555             }
    556         }
    557         /* do common sanity check */
    558         if((p_scb->frag_org_len <= p_scb->frag_off) || (p_scb->frag_org_len >= p_scb->media_buf_len))
    559         {
    560             AVDT_TRACE_WARNING("common sanity frag_off:%d frag_org_len:%d media_buf_len:%d",
    561                 p_scb->frag_off, p_scb->frag_org_len, p_scb->media_buf_len);
    562             break;
    563         }
    564 
    565         AVDT_TRACE_DEBUG("Received fragment org_len=%d off=%d al_len=%d frag_len=%d",
    566             p_scb->frag_org_len, p_scb->frag_off, al_len, frag_len);
    567 
    568         /* copy fragment into buffer */
    569         memcpy(p_scb->p_media_buf + p_scb->frag_off, p, frag_len);
    570         p_scb->frag_off += frag_len;
    571         /* move to the next fragment */
    572         p += frag_len;
    573         /* if it is last fragment in original media packet then process total media pocket */
    574         if(p_scb->frag_off == p_scb->frag_org_len)
    575         {
    576             p_payload = p_scb->p_media_buf;
    577 
    578             /* media header */
    579             AVDT_MSG_PRS_OCTET1(p_payload, o_v, o_p, o_x, o_cc);
    580             AVDT_MSG_PRS_M_PT(p_payload, m_pt, marker);
    581             BE_STREAM_TO_UINT16(seq, p_payload);
    582             BE_STREAM_TO_UINT32(time_stamp, p_payload);
    583             BE_STREAM_TO_UINT32(ssrc, p_payload);
    584 
    585             UNUSED(o_v);
    586             UNUSED(ssrc);
    587 
    588             /* skip over any csrc's in packet */
    589             p_payload += o_cc * 4;
    590 
    591             /* check for and skip over extension header */
    592             if (o_x)
    593             {
    594                 if(p_scb->p_media_buf + p_scb->frag_off - p_payload < 4)
    595                 {
    596                     AVDT_TRACE_WARNING("length check frag_off:%d p_media_buf:%d p_payload:%d",
    597                         p_scb->frag_off, p_scb->p_media_buf, p_payload);
    598                     break;/* length check */
    599                 }
    600                 p_payload += 2;
    601                 BE_STREAM_TO_UINT16(ex_len, p_payload);
    602                 p_payload += ex_len * 4;
    603             }
    604 
    605             if(p_payload >= p_scb->p_media_buf + p_scb->frag_off)
    606             {
    607                 AVDT_TRACE_WARNING("length check2 frag_off:%d p_media_buf:%d p_payload:%d",
    608                     p_scb->frag_off, p_scb->p_media_buf, p_payload);
    609                 break;/* length check */
    610             }
    611 
    612             /* adjust length for any padding at end of packet */
    613             if (o_p)
    614             {
    615                 /* padding length in last byte of packet */
    616                 pad_len =  *(p_scb->p_media_buf + p_scb->frag_off - 1);
    617             }
    618             else
    619                 pad_len =  0;
    620             /* payload length */
    621             payload_len = (UINT32)(p_scb->p_media_buf + p_scb->frag_off - pad_len - p_payload);
    622 
    623             AVDT_TRACE_DEBUG("Received last fragment header=%d len=%d",
    624                 p_payload - p_scb->p_media_buf,payload_len);
    625 
    626             /* send total media packet up */
    627             if (p_scb->cs.p_media_cback != NULL)
    628             {
    629                 (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb), p_payload,
    630                                            payload_len, time_stamp, seq, m_pt, marker);
    631             }
    632         }
    633     } /* while(p < p_end) */
    634 
    635     if(p < p_end)
    636     {
    637         AVDT_TRACE_WARNING("*** Got bad media packet");
    638     }
    639     osi_free_and_reset((void **)&p_data->p_pkt);
    640 }
    641 #endif
    642 
    643 /*******************************************************************************
    644 **
    645 ** Function         avdt_scb_hdl_pkt
    646 **
    647 ** Description
    648 **
    649 ** Returns          Nothing.
    650 **
    651 *******************************************************************************/
    652 void avdt_scb_hdl_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    653 {
    654 #if AVDT_REPORTING == TRUE
    655     UINT8 *p;
    656 #endif
    657 
    658 #if AVDT_MULTIPLEXING == TRUE
    659     /* select right function in dependance of is fragmentation supported or not */
    660     if( 0 != (p_scb->curr_cfg.psc_mask & AVDT_PSC_MUX))
    661     {
    662         avdt_scb_hdl_pkt_frag(p_scb, p_data);
    663     }
    664     else
    665 #endif
    666 #if AVDT_REPORTING == TRUE
    667     if(p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT)
    668     {
    669         p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
    670         avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
    671         osi_free_and_reset((void **)&p_data->p_pkt);
    672     }
    673     else
    674 #endif
    675         avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
    676 }
    677 
    678 /*******************************************************************************
    679 **
    680 ** Function         avdt_scb_drop_pkt
    681 **
    682 ** Description      Drop an incoming media packet.  This function is called if
    683 **                  a media packet is received in any state besides streaming.
    684 **
    685 ** Returns          Nothing.
    686 **
    687 *******************************************************************************/
    688 void avdt_scb_drop_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    689 {
    690     UNUSED(p_scb);
    691 
    692     AVDT_TRACE_ERROR("%s dropped incoming media packet", __func__);
    693     osi_free_and_reset((void **)&p_data->p_pkt);
    694 }
    695 
    696 /*******************************************************************************
    697 **
    698 ** Function         avdt_scb_hdl_reconfig_cmd
    699 **
    700 ** Description      This function calls the application callback function
    701 **                  with a reconfiguration indication.
    702 **
    703 ** Returns          Nothing.
    704 **
    705 *******************************************************************************/
    706 void avdt_scb_hdl_reconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    707 {
    708     /* if command not supported */
    709     if (p_scb->cs.nsc_mask & AVDT_NSC_RECONFIG)
    710     {
    711         /* send reject */
    712         p_data->msg.hdr.err_code = AVDT_ERR_NSC;
    713         p_data->msg.hdr.err_param = 0;
    714         avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
    715     }
    716     else
    717     {
    718         /* store requested configuration */
    719         memcpy(&p_scb->req_cfg, p_data->msg.reconfig_cmd.p_cfg, sizeof(tAVDT_CFG));
    720 
    721         /* call application callback */
    722         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    723                                   NULL,
    724                                   AVDT_RECONFIG_IND_EVT,
    725                                   (tAVDT_CTRL *) &p_data->msg.reconfig_cmd);
    726     }
    727 }
    728 
    729 /*******************************************************************************
    730 **
    731 ** Function         avdt_scb_hdl_reconfig_rsp
    732 **
    733 ** Description      This function calls the application callback function
    734 **                  with a reconfiguration confirm.
    735 **
    736 ** Returns          Nothing.
    737 **
    738 *******************************************************************************/
    739 void avdt_scb_hdl_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    740 {
    741     if (p_data->msg.hdr.err_code == 0)
    742     {
    743         /* store new configuration */
    744         if (p_scb->req_cfg.num_codec > 0)
    745         {
    746             p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
    747             memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
    748         }
    749         if (p_scb->req_cfg.num_protect > 0)
    750         {
    751             p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
    752             memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
    753         }
    754     }
    755 
    756     p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
    757 
    758     /* call application callback */
    759     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    760                               NULL,
    761                               AVDT_RECONFIG_CFM_EVT,
    762                               (tAVDT_CTRL *) &p_data->msg.svccap);
    763 }
    764 
    765 /*******************************************************************************
    766 **
    767 ** Function         avdt_scb_hdl_security_cmd
    768 **
    769 ** Description      This function calls the application callback with a
    770 **                  security indication.
    771 **
    772 ** Returns          Nothing.
    773 **
    774 *******************************************************************************/
    775 void avdt_scb_hdl_security_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    776 {
    777     /* if command not supported */
    778     if (p_scb->cs.nsc_mask & AVDT_NSC_SECURITY)
    779     {
    780         /* send reject */
    781         p_data->msg.hdr.err_code = AVDT_ERR_NSC;
    782         avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
    783     }
    784     else
    785     {
    786         /* call application callback */
    787         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    788                                   NULL,
    789                                   AVDT_SECURITY_IND_EVT,
    790                                   (tAVDT_CTRL *) &p_data->msg.security_cmd);
    791     }
    792 }
    793 
    794 /*******************************************************************************
    795 **
    796 ** Function         avdt_scb_hdl_security_rsp
    797 **
    798 ** Description      This function calls the application callback with a
    799 **                  security confirm.
    800 **
    801 ** Returns          Nothing.
    802 **
    803 *******************************************************************************/
    804 void avdt_scb_hdl_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    805 {
    806     /* call application callback */
    807     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    808                               NULL,
    809                               AVDT_SECURITY_CFM_EVT,
    810                               (tAVDT_CTRL *) &p_data->msg.security_cmd);
    811 }
    812 
    813 /*******************************************************************************
    814 **
    815 ** Function         avdt_scb_hdl_setconfig_cmd
    816 **
    817 ** Description      This function marks the SCB as in use and copies the
    818 **                  configuration and peer SEID to the SCB.  It then calls
    819 **                  the application callback with a configuration indication.
    820 **
    821 ** Returns          Nothing.
    822 **
    823 *******************************************************************************/
    824 void avdt_scb_hdl_setconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    825 {
    826     tAVDT_CFG *p_cfg;
    827 
    828     if (!p_scb->in_use)
    829     {
    830         p_cfg = p_data->msg.config_cmd.p_cfg;
    831         if(p_scb->cs.cfg.codec_info[AVDT_CODEC_TYPE_INDEX] == p_cfg->codec_info[AVDT_CODEC_TYPE_INDEX])
    832         {
    833             /* set sep as in use */
    834             p_scb->in_use = TRUE;
    835 
    836             /* copy info to scb */
    837             p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
    838             p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
    839             memcpy(&p_scb->req_cfg, p_cfg, sizeof(tAVDT_CFG));
    840             /* call app callback */
    841             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), /* handle of scb- which is same as sep handle of bta_av_cb.p_scb*/
    842                                       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    843                                       AVDT_CONFIG_IND_EVT,
    844                                       (tAVDT_CTRL *) &p_data->msg.config_cmd);
    845         }
    846         else
    847         {
    848             p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
    849             p_data->msg.hdr.err_param = 0;
    850             avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
    851                               p_data->msg.hdr.sig_id, &p_data->msg);
    852         }
    853     }
    854     else
    855     {
    856         avdt_scb_rej_in_use(p_scb, p_data);
    857     }
    858 }
    859 
    860 /*******************************************************************************
    861 **
    862 ** Function         avdt_scb_hdl_setconfig_rej
    863 **
    864 ** Description      This function marks the SCB as not in use and calls the
    865 **                  application callback with an open confirm indicating failure.
    866 **
    867 ** Returns          Nothing.
    868 **
    869 *******************************************************************************/
    870 void avdt_scb_hdl_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    871 {
    872     /* clear scb variables */
    873     avdt_scb_clr_vars(p_scb, p_data);
    874 
    875     /* tell ccb we're done with signaling channel */
    876     avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_CCB_UL_CLOSE_EVT, NULL);
    877 
    878     /* call application callback */
    879     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    880                               NULL,
    881                               AVDT_OPEN_CFM_EVT,
    882                               (tAVDT_CTRL *) &p_data->msg.hdr);
    883 }
    884 
    885 /*******************************************************************************
    886 **
    887 ** Function         avdt_scb_hdl_setconfig_rsp
    888 **
    889 ** Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
    890 **                  to initiate sending of an open command message.
    891 **
    892 ** Returns          Nothing.
    893 **
    894 *******************************************************************************/
    895 void avdt_scb_hdl_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    896 {
    897     tAVDT_EVT_HDR   single;
    898     UNUSED(p_data);
    899 
    900     if (p_scb->p_ccb != NULL)
    901     {
    902         /* save configuration */
    903         memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
    904 
    905         /* initiate open */
    906         single.seid = p_scb->peer_seid;
    907         avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, (tAVDT_SCB_EVT *) &single);
    908     }
    909 }
    910 
    911 /*******************************************************************************
    912 **
    913 ** Function         avdt_scb_hdl_start_cmd
    914 **
    915 ** Description      This function calls the application callback with a
    916 **                  start indication.
    917 **
    918 ** Returns          Nothing.
    919 **
    920 *******************************************************************************/
    921 void avdt_scb_hdl_start_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    922 {
    923     UNUSED(p_data);
    924 
    925     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    926                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    927                               AVDT_START_IND_EVT,
    928                               NULL);
    929 }
    930 
    931 /*******************************************************************************
    932 **
    933 ** Function         avdt_scb_hdl_start_rsp
    934 **
    935 ** Description      This function calls the application callback with a
    936 **                  start confirm.
    937 **
    938 ** Returns          Nothing.
    939 **
    940 *******************************************************************************/
    941 void avdt_scb_hdl_start_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    942 {
    943     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    944                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    945                               AVDT_START_CFM_EVT,
    946                               (tAVDT_CTRL *) &p_data->msg.hdr);
    947 }
    948 
    949 /*******************************************************************************
    950 **
    951 ** Function         avdt_scb_hdl_suspend_cmd
    952 **
    953 ** Description      This function calls the application callback with a suspend
    954 **                  indication.
    955 **
    956 ** Returns          Nothing.
    957 **
    958 *******************************************************************************/
    959 void avdt_scb_hdl_suspend_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    960 {
    961     UNUSED(p_data);
    962 
    963     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    964                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    965                               AVDT_SUSPEND_IND_EVT,
    966                               NULL);
    967 }
    968 
    969 /*******************************************************************************
    970 **
    971 ** Function         avdt_scb_hdl_suspend_rsp
    972 **
    973 ** Description      This function calls the application callback with a suspend
    974 **                  confirm.
    975 **
    976 ** Returns          Nothing.
    977 **
    978 *******************************************************************************/
    979 void avdt_scb_hdl_suspend_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
    980 {
    981     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
    982                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
    983                               AVDT_SUSPEND_CFM_EVT,
    984                               (tAVDT_CTRL *) &p_data->msg.hdr);
    985 }
    986 
    987 /*******************************************************************************
    988 **
    989 ** Function         avdt_scb_hdl_tc_close
    990 **
    991 ** Description      This function is called when the transport channel is
    992 **                  closed.  It marks the SCB as not in use and
    993 **                  initializes certain SCB parameters.  It then sends
    994 **                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
    995 **                  initiated the close.  It then checks to see if the SCB
    996 **                  is to be removed.  If it is it deallocates the SCB.  Finally,
    997 **                  it calls the application callback with a close indication.
    998 **
    999 ** Returns          Nothing.
   1000 **
   1001 *******************************************************************************/
   1002 void avdt_scb_hdl_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1003 {
   1004     UINT8               hdl = avdt_scb_to_hdl(p_scb);
   1005     tAVDT_CTRL_CBACK    *p_ctrl_cback = p_scb->cs.p_ctrl_cback;
   1006     tAVDT_CTRL          avdt_ctrl;
   1007     UINT8               event;
   1008     tAVDT_CCB           *p_ccb = p_scb->p_ccb;
   1009     BD_ADDR remote_addr;
   1010 
   1011 
   1012     memcpy (remote_addr, p_ccb->peer_addr, BD_ADDR_LEN);
   1013 
   1014     /* set up hdr */
   1015     avdt_ctrl.hdr.err_code = p_scb->close_code;
   1016 
   1017     /* clear sep variables */
   1018     avdt_scb_clr_vars(p_scb, p_data);
   1019     p_scb->media_seq = 0;
   1020     p_scb->cong = FALSE;
   1021 
   1022     /* free pkt we're holding, if any */
   1023     osi_free_and_reset((void **)&p_scb->p_pkt);
   1024 
   1025     alarm_cancel(p_scb->transport_channel_timer);
   1026 
   1027     if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT))
   1028     {
   1029         /* tell ccb we're done with signaling channel */
   1030         avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
   1031     }
   1032     event = (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
   1033     p_scb->role = AVDT_CLOSE_ACP;
   1034 
   1035     if (p_scb->remove)
   1036     {
   1037         avdt_scb_dealloc(p_scb, NULL);
   1038     }
   1039 
   1040     /* call app callback */
   1041     (*p_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl);
   1042 }
   1043 
   1044 /*******************************************************************************
   1045 **
   1046 ** Function         avdt_scb_snd_delay_rpt_req
   1047 **
   1048 ** Description      This function calls the application callback with a delay
   1049 **                  report.
   1050 **
   1051 ** Returns          Nothing.
   1052 **
   1053 *******************************************************************************/
   1054 void avdt_scb_snd_delay_rpt_req (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1055 {
   1056     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT, (tAVDT_MSG *) &p_data->apidelay);
   1057 }
   1058 
   1059 /*******************************************************************************
   1060 **
   1061 ** Function         avdt_scb_hdl_delay_rpt_cmd
   1062 **
   1063 ** Description      This function calls the application callback with a delay
   1064 **                  report.
   1065 **
   1066 ** Returns          Nothing.
   1067 **
   1068 *******************************************************************************/
   1069 void avdt_scb_hdl_delay_rpt_cmd (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1070 {
   1071     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1072                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1073                               AVDT_DELAY_REPORT_EVT,
   1074                               (tAVDT_CTRL *) &p_data->msg.hdr);
   1075 
   1076     if (p_scb->p_ccb)
   1077         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
   1078     else
   1079         avdt_scb_rej_not_in_use(p_scb, p_data);
   1080 }
   1081 
   1082 /*******************************************************************************
   1083 **
   1084 ** Function         avdt_scb_hdl_delay_rpt_rsp
   1085 **
   1086 ** Description      This function calls the application callback with a delay
   1087 **                  report.
   1088 **
   1089 ** Returns          Nothing.
   1090 **
   1091 *******************************************************************************/
   1092 void avdt_scb_hdl_delay_rpt_rsp (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1093 {
   1094     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1095                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1096                               AVDT_DELAY_REPORT_CFM_EVT,
   1097                               (tAVDT_CTRL *) &p_data->msg.hdr);
   1098 }
   1099 
   1100 #if AVDT_REPORTING == TRUE
   1101 /*******************************************************************************
   1102 **
   1103 ** Function         avdt_scb_hdl_tc_close_sto
   1104 **
   1105 ** Description      This function is called when a channel is closed in OPEN
   1106 **                  state.  Check the channel type and process accordingly.
   1107 **
   1108 ** Returns          Nothing.
   1109 **
   1110 *******************************************************************************/
   1111 void avdt_scb_hdl_tc_close_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1112 {
   1113     tAVDT_CTRL          avdt_ctrl;
   1114     /* AVDT_CHAN_SIG does not visit this action */
   1115     if(p_data && p_data->close.type != AVDT_CHAN_MEDIA)
   1116     {
   1117         /* it's reporting or recovery channel,
   1118          * the channel close in open state means the peer does not support it */
   1119         if(p_data->close.old_tc_state == AVDT_AD_ST_OPEN)
   1120         {
   1121             avdt_ctrl.hdr.err_code = 0;
   1122             avdt_ctrl.hdr.err_param = 0;
   1123             /* call app callback */
   1124             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1125                                       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1126                                       AVDT_REPORT_DISCONN_EVT, &avdt_ctrl);
   1127         }
   1128     }
   1129     else
   1130     {
   1131         /* must be in OPEN state. need to go back to idle */
   1132         avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
   1133         avdt_scb_hdl_tc_close(p_scb, p_data);
   1134     }
   1135 }
   1136 #endif
   1137 
   1138 /*******************************************************************************
   1139 **
   1140 ** Function         avdt_scb_hdl_tc_open
   1141 **
   1142 ** Description      This function is called when the transport channel is
   1143 **                  opened while in the opening state.  It calls the
   1144 **                  application callback with an open indication or open
   1145 **                  confirm depending on who initiated the open procedure.
   1146 **
   1147 ** Returns          Nothing.
   1148 **
   1149 *******************************************************************************/
   1150 void avdt_scb_hdl_tc_open(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1151 {
   1152     UINT8   event;
   1153 #if AVDT_REPORTING == TRUE
   1154     UINT8   role;
   1155 #endif
   1156 
   1157     alarm_cancel(p_scb->transport_channel_timer);
   1158 
   1159     event = (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
   1160     p_data->open.hdr.err_code = 0;
   1161 
   1162     AVDT_TRACE_DEBUG("psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x",
   1163         p_scb->cs.cfg.psc_mask, p_scb->req_cfg.psc_mask, p_scb->curr_cfg.psc_mask);
   1164 #if AVDT_REPORTING == TRUE
   1165     if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
   1166     {
   1167         /* open the reporting channel, if both devices support it */
   1168         role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
   1169         avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
   1170     }
   1171 #endif
   1172 
   1173     /* call app callback */
   1174     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1175                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1176                               event,
   1177                               (tAVDT_CTRL *) &p_data->open);
   1178 }
   1179 
   1180 #if AVDT_REPORTING == TRUE
   1181 /*******************************************************************************
   1182 **
   1183 ** Function         avdt_scb_hdl_tc_open_sto
   1184 **
   1185 ** Description      This function is called when the transport channel is
   1186 **                  opened while in the opening state.  It calls the
   1187 **                  application callback with an open indication or open
   1188 **                  confirm depending on who initiated the open procedure.
   1189 **
   1190 ** Returns          Nothing.
   1191 **
   1192 *******************************************************************************/
   1193 void avdt_scb_hdl_tc_open_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1194 {
   1195     tAVDT_CTRL          avdt_ctrl;
   1196     /* open reporting channel here, when it is implemented */
   1197 
   1198     /* call app callback */
   1199     if(p_data->open.hdr.err_code == AVDT_CHAN_REPORT)
   1200     {
   1201         avdt_ctrl.hdr.err_code = 0;
   1202         avdt_ctrl.hdr.err_param = 1;
   1203         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1204                               p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
   1205                               AVDT_REPORT_CONN_EVT, &avdt_ctrl);
   1206     }
   1207 }
   1208 #endif
   1209 
   1210 /*******************************************************************************
   1211 **
   1212 ** Function         avdt_scb_hdl_write_req_no_frag
   1213 **
   1214 ** Description      This function frees the media packet currently stored in
   1215 **                  the SCB, if any.  Then it builds a new media packet from
   1216 **                  with the passed in buffer and stores it in the SCB.
   1217 **
   1218 ** Returns          Nothing.
   1219 **
   1220 *******************************************************************************/
   1221 void avdt_scb_hdl_write_req_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1222 {
   1223     UINT8   *p;
   1224     UINT32  ssrc;
   1225 
   1226     /* free packet we're holding, if any; to be replaced with new */
   1227     if (p_scb->p_pkt != NULL) {
   1228         /* this shouldn't be happening */
   1229         AVDT_TRACE_WARNING("Dropped media packet; congested");
   1230     }
   1231     osi_free_and_reset((void **)&p_scb->p_pkt);
   1232 
   1233     /* build a media packet */
   1234     /* Add RTP header if required */
   1235     if ( !(p_data->apiwrite.opt & AVDT_DATA_OPT_NO_RTP) )
   1236     {
   1237         ssrc = avdt_scb_gen_ssrc(p_scb);
   1238 
   1239         p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
   1240         p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
   1241         p_scb->media_seq++;
   1242         p = (UINT8 *)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
   1243 
   1244         UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
   1245         UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
   1246         UINT16_TO_BE_STREAM(p, p_scb->media_seq);
   1247         UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
   1248         UINT32_TO_BE_STREAM(p, ssrc);
   1249     }
   1250 
   1251     /* store it */
   1252     p_scb->p_pkt = p_data->apiwrite.p_buf;
   1253 }
   1254 
   1255 #if AVDT_MULTIPLEXING == TRUE
   1256 /*******************************************************************************
   1257 **
   1258 ** Function         avdt_scb_hdl_write_req_frag
   1259 **
   1260 ** Description      This function builds a new fragments of media packet from
   1261 **                  the passed in buffers and stores them in the SCB.
   1262 **
   1263 ** Returns          Nothing.
   1264 **
   1265 *******************************************************************************/
   1266 void avdt_scb_hdl_write_req_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1267 {
   1268     UINT8   *p;
   1269     UINT32  ssrc;
   1270 
   1271     /* free fragments we're holding, if any; it shouldn't happen */
   1272     if (!fixed_queue_is_empty(p_scb->frag_q))
   1273     {
   1274         /* this shouldn't be happening */
   1275         AVDT_TRACE_WARNING("*** Dropped media packet; congested");
   1276         BT_HDR *p_frag;
   1277         while ((p_frag = (BT_HDR*)fixed_queue_try_dequeue(p_scb->frag_q)) != NULL)
   1278              osi_free(p_frag);
   1279     }
   1280 
   1281     /* build a media fragments */
   1282     p_scb->frag_off = p_data->apiwrite.data_len;
   1283     p_scb->p_next_frag = p_data->apiwrite.p_data;
   1284 
   1285     ssrc = avdt_scb_gen_ssrc(p_scb);
   1286 
   1287     if (! fixed_queue_is_empty(p_scb->frag_q)) {
   1288         list_t *list = fixed_queue_get_list(p_scb->frag_q);
   1289         const list_node_t *node = list_begin(list);
   1290         if (node != list_end(list)) {
   1291             BT_HDR *p_frag = (BT_HDR *)list_node(node);
   1292             node = list_next(node);
   1293 
   1294             /* get first packet */
   1295             /* posit on Adaptation Layer header */
   1296             p_frag->len += AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
   1297             p_frag->offset -= AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
   1298             p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   1299 
   1300             /* Adaptation Layer header */
   1301             /* TSID, no-fragment bit and coding of length (in 2 length octets
   1302              * following)
   1303              */
   1304             *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | AVDT_ALH_LCODE_16BIT;
   1305 
   1306             /* length of all remaining transport packet */
   1307             UINT16_TO_BE_STREAM(p, p_frag->layer_specific + AVDT_MEDIA_HDR_SIZE );
   1308             /* media header */
   1309             UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
   1310             UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
   1311             UINT16_TO_BE_STREAM(p, p_scb->media_seq);
   1312             UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
   1313             UINT32_TO_BE_STREAM(p, ssrc);
   1314             p_scb->media_seq++;
   1315         }
   1316 
   1317         for ( ; node != list_end(list); node = list_next(node)) {
   1318             BT_HDR *p_frag = (BT_HDR *)list_node(node);
   1319 
   1320             /* posit on Adaptation Layer header */
   1321             p_frag->len += AVDT_AL_HDR_SIZE;
   1322             p_frag->offset -= AVDT_AL_HDR_SIZE;
   1323             p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   1324             /* Adaptation Layer header */
   1325             /* TSID, fragment bit and coding of length (in 2 length octets
   1326              * following)
   1327              */
   1328             *p++ = (p_scb->curr_cfg.mux_tsid_media << 3) |
   1329                 (AVDT_ALH_FRAG_MASK | AVDT_ALH_LCODE_16BIT);
   1330 
   1331             /* length of all remaining transport packet */
   1332             UINT16_TO_BE_STREAM(p, p_frag->layer_specific);
   1333         }
   1334     }
   1335 }
   1336 #endif
   1337 
   1338 
   1339 /*******************************************************************************
   1340 **
   1341 ** Function         avdt_scb_hdl_write_req
   1342 **
   1343 ** Description      This function calls one of the two versions of building functions
   1344 **                  for case with and without fragmentation
   1345 **
   1346 ** Returns          Nothing.
   1347 **
   1348 *******************************************************************************/
   1349 void avdt_scb_hdl_write_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1350 {
   1351 #if AVDT_MULTIPLEXING == TRUE
   1352     if (fixed_queue_is_empty(p_scb->frag_q))
   1353 #endif
   1354         avdt_scb_hdl_write_req_no_frag(p_scb, p_data);
   1355 #if AVDT_MULTIPLEXING == TRUE
   1356     else
   1357         avdt_scb_hdl_write_req_frag(p_scb, p_data);
   1358 #endif
   1359 }
   1360 
   1361 /*******************************************************************************
   1362 **
   1363 ** Function         avdt_scb_snd_abort_req
   1364 **
   1365 ** Description      This function sends an abort command message.
   1366 **
   1367 ** Returns          Nothing.
   1368 **
   1369 *******************************************************************************/
   1370 void avdt_scb_snd_abort_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1371 {
   1372     tAVDT_EVT_HDR   hdr;
   1373     UNUSED(p_data);
   1374 
   1375     if (p_scb->p_ccb != NULL)
   1376     {
   1377         p_scb->role = AVDT_CLOSE_INT;
   1378 
   1379         hdr.seid = p_scb->peer_seid;
   1380 
   1381         avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, (tAVDT_MSG *) &hdr);
   1382     }
   1383 }
   1384 
   1385 /*******************************************************************************
   1386 **
   1387 ** Function         avdt_scb_snd_abort_rsp
   1388 **
   1389 ** Description      This function sends an abort response message.
   1390 **
   1391 ** Returns          Nothing.
   1392 **
   1393 *******************************************************************************/
   1394 void avdt_scb_snd_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1395 {
   1396     UNUSED(p_scb);
   1397 
   1398     avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
   1399                       &p_data->msg);
   1400 }
   1401 
   1402 /*******************************************************************************
   1403 **
   1404 ** Function         avdt_scb_snd_close_req
   1405 **
   1406 ** Description      This function sends a close command message.
   1407 **
   1408 ** Returns          Nothing.
   1409 **
   1410 *******************************************************************************/
   1411 void avdt_scb_snd_close_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1412 {
   1413     tAVDT_EVT_HDR   hdr;
   1414     UNUSED(p_data);
   1415 
   1416     p_scb->role = AVDT_CLOSE_INT;
   1417 
   1418     hdr.seid = p_scb->peer_seid;
   1419 
   1420     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, (tAVDT_MSG *) &hdr);
   1421 }
   1422 
   1423 /*******************************************************************************
   1424 **
   1425 ** Function         avdt_scb_snd_stream_close
   1426 **
   1427 ** Description      This function sends a close command message.
   1428 **
   1429 ** Returns          Nothing.
   1430 **
   1431 *******************************************************************************/
   1432 void avdt_scb_snd_stream_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1433 {
   1434 #if AVDT_MULTIPLEXING == TRUE
   1435     AVDT_TRACE_WARNING("%s c:%d, off:%d", __func__,
   1436         fixed_queue_length(p_scb->frag_q), p_scb->frag_off);
   1437 
   1438     /* clean fragments queue */
   1439     BT_HDR *p_frag;
   1440     while ((p_frag = (BT_HDR*)fixed_queue_try_dequeue(p_scb->frag_q)) != NULL)
   1441         osi_free(p_frag);
   1442 
   1443     p_scb->frag_off = 0;
   1444 #endif
   1445     osi_free_and_reset((void **)&p_scb->p_pkt);
   1446 
   1447     avdt_scb_snd_close_req(p_scb, p_data);
   1448 }
   1449 
   1450 /*******************************************************************************
   1451 **
   1452 ** Function         avdt_scb_snd_close_rsp
   1453 **
   1454 ** Description      This function sends a close response message.
   1455 **
   1456 ** Returns          Nothing.
   1457 **
   1458 *******************************************************************************/
   1459 void avdt_scb_snd_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1460 {
   1461     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
   1462 }
   1463 
   1464 /*******************************************************************************
   1465 **
   1466 ** Function         avdt_scb_snd_getconfig_req
   1467 **
   1468 ** Description      This function sends a get configuration command message.
   1469 **
   1470 ** Returns          Nothing.
   1471 **
   1472 *******************************************************************************/
   1473 void avdt_scb_snd_getconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1474 {
   1475     tAVDT_EVT_HDR   hdr;
   1476     UNUSED(p_data);
   1477 
   1478     hdr.seid = p_scb->peer_seid;
   1479 
   1480     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, (tAVDT_MSG *) &hdr);
   1481 }
   1482 
   1483 /*******************************************************************************
   1484 **
   1485 ** Function         avdt_scb_snd_getconfig_rsp
   1486 **
   1487 ** Description      This function sends a get configuration response message.
   1488 **
   1489 ** Returns          Nothing.
   1490 **
   1491 *******************************************************************************/
   1492 void avdt_scb_snd_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1493 {
   1494     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
   1495 }
   1496 
   1497 /*******************************************************************************
   1498 **
   1499 ** Function         avdt_scb_snd_open_req
   1500 **
   1501 ** Description      This function sends an open command message.
   1502 **
   1503 ** Returns          Nothing.
   1504 **
   1505 *******************************************************************************/
   1506 void avdt_scb_snd_open_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1507 {
   1508     tAVDT_EVT_HDR   hdr;
   1509     UNUSED(p_data);
   1510 
   1511     hdr.seid = p_scb->peer_seid;
   1512 
   1513     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, (tAVDT_MSG *) &hdr);
   1514 }
   1515 
   1516 /*******************************************************************************
   1517 **
   1518 ** Function         avdt_scb_snd_open_rsp
   1519 **
   1520 ** Description      This function sends an open response message.  It also
   1521 **                  calls avdt_ad_open_req() to accept a transport channel
   1522 **                  connection.
   1523 **
   1524 ** Returns          Nothing.
   1525 **
   1526 *******************************************************************************/
   1527 void avdt_scb_snd_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1528 {
   1529     /* notify adaption that we're waiting for transport channel open */
   1530     p_scb->role = AVDT_OPEN_ACP;
   1531     avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
   1532 
   1533     /* send response */
   1534     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
   1535 
   1536     alarm_set_on_queue(p_scb->transport_channel_timer,
   1537                        AVDT_SCB_TC_CONN_TIMEOUT_MS,
   1538                        avdt_scb_transport_channel_timer_timeout, p_scb,
   1539                        btu_general_alarm_queue);
   1540 }
   1541 
   1542 /*******************************************************************************
   1543 **
   1544 ** Function         avdt_scb_snd_reconfig_req
   1545 **
   1546 ** Description      This function stores the configuration parameters in the
   1547 **                  SCB and sends a reconfiguration command message.
   1548 **
   1549 ** Returns          Nothing.
   1550 **
   1551 *******************************************************************************/
   1552 void avdt_scb_snd_reconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1553 {
   1554     memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
   1555     p_data->msg.hdr.seid = p_scb->peer_seid;
   1556     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
   1557 }
   1558 
   1559 /*******************************************************************************
   1560 **
   1561 ** Function         avdt_scb_snd_reconfig_rsp
   1562 **
   1563 ** Description      This function stores the configuration parameters in the
   1564 **                  SCB and sends a reconfiguration response message.
   1565 **
   1566 ** Returns          Nothing.
   1567 **
   1568 *******************************************************************************/
   1569 void avdt_scb_snd_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1570 {
   1571     if (p_data->msg.hdr.err_code == 0)
   1572     {
   1573         /* store new configuration */
   1574         if (p_scb->req_cfg.num_codec > 0)
   1575         {
   1576             p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
   1577             memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
   1578         }
   1579         if (p_scb->req_cfg.num_protect > 0)
   1580         {
   1581             p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
   1582             memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
   1583         }
   1584 
   1585         /* send response */
   1586         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
   1587     }
   1588     else
   1589     {
   1590         /* send reject */
   1591         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
   1592     }
   1593 }
   1594 
   1595 /*******************************************************************************
   1596 **
   1597 ** Function         avdt_scb_snd_security_req
   1598 **
   1599 ** Description      This function sends a security command message.
   1600 **
   1601 ** Returns          Nothing.
   1602 **
   1603 *******************************************************************************/
   1604 void avdt_scb_snd_security_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1605 {
   1606     p_data->msg.hdr.seid = p_scb->peer_seid;
   1607     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
   1608 }
   1609 
   1610 /*******************************************************************************
   1611 **
   1612 ** Function         avdt_scb_snd_security_rsp
   1613 **
   1614 ** Description      This function sends a security response message.
   1615 **
   1616 ** Returns          Nothing.
   1617 **
   1618 *******************************************************************************/
   1619 void avdt_scb_snd_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1620 {
   1621     if (p_data->msg.hdr.err_code == 0)
   1622     {
   1623         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
   1624     }
   1625     else
   1626     {
   1627         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
   1628     }
   1629 }
   1630 
   1631 /*******************************************************************************
   1632 **
   1633 ** Function         avdt_scb_snd_setconfig_rej
   1634 **
   1635 ** Description      This function marks the SCB as not in use and sends a
   1636 **                  set configuration reject message.
   1637 **
   1638 ** Returns          Nothing.
   1639 **
   1640 *******************************************************************************/
   1641 void avdt_scb_snd_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1642 {
   1643     if (p_scb->p_ccb != NULL)
   1644     {
   1645         avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1646 
   1647         /* clear scb variables */
   1648         avdt_scb_clr_vars(p_scb, p_data);
   1649     }
   1650 }
   1651 
   1652 /*******************************************************************************
   1653 **
   1654 ** Function         avdt_scb_snd_setconfig_req
   1655 **
   1656 ** Description      This function marks the SCB as in use and copies the
   1657 **                  configuration parameters to the SCB.  Then the function
   1658 **                  sends a set configuration command message and initiates
   1659 **                  opening of the signaling channel.
   1660 **
   1661 ** Returns          Nothing.
   1662 **
   1663 *******************************************************************************/
   1664 void avdt_scb_snd_setconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1665 {
   1666     tAVDT_CFG *p_req, *p_cfg;
   1667 
   1668     /* copy API parameters to scb, set scb as in use */
   1669     p_scb->in_use = TRUE;
   1670     p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
   1671     p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
   1672     p_req = p_data->msg.config_cmd.p_cfg;
   1673     p_cfg = &p_scb->cs.cfg;
   1674 #if AVDT_MULTIPLEXING == TRUE
   1675     p_req->mux_tsid_media = p_cfg->mux_tsid_media;
   1676     p_req->mux_tcid_media = p_cfg->mux_tcid_media;
   1677     if(p_req->psc_mask & AVDT_PSC_REPORT)
   1678     {
   1679         p_req->mux_tsid_report = p_cfg->mux_tsid_report;
   1680         p_req->mux_tcid_report = p_cfg->mux_tcid_report;
   1681     }
   1682 #endif
   1683     memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
   1684 
   1685     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1686 
   1687     /* tell ccb to open channel */
   1688     avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
   1689 }
   1690 
   1691 /*******************************************************************************
   1692 **
   1693 ** Function         avdt_scb_snd_setconfig_rsp
   1694 **
   1695 ** Description      This function copies the requested configuration into the
   1696 **                  current configuration and sends a set configuration
   1697 **                  response message.
   1698 **
   1699 ** Returns          Nothing.
   1700 **
   1701 *******************************************************************************/
   1702 void avdt_scb_snd_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1703 {
   1704     if (p_scb->p_ccb != NULL)
   1705     {
   1706         memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
   1707 
   1708         avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
   1709     }
   1710 }
   1711 
   1712 /*******************************************************************************
   1713 **
   1714 ** Function         avdt_scb_snd_tc_close
   1715 **
   1716 ** Description      This function calls avdt_ad_close_req() to close the
   1717 **                  transport channel for this SCB.
   1718 **
   1719 ** Returns          Nothing.
   1720 **
   1721 *******************************************************************************/
   1722 void avdt_scb_snd_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1723 {
   1724     UNUSED(p_data);
   1725 
   1726 #if AVDT_REPORTING == TRUE
   1727     if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
   1728         avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
   1729 #endif
   1730     avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
   1731 }
   1732 
   1733 /*******************************************************************************
   1734 **
   1735 ** Function         avdt_scb_cb_err
   1736 **
   1737 ** Description      This function calls the application callback function
   1738 **                  indicating an error.
   1739 **
   1740 ** Returns          Nothing.
   1741 **
   1742 *******************************************************************************/
   1743 void avdt_scb_cb_err(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1744 {
   1745     tAVDT_CTRL          avdt_ctrl;
   1746     UNUSED(p_data);
   1747 
   1748     /* set error code and parameter */
   1749     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1750     avdt_ctrl.hdr.err_param = 0;
   1751 
   1752     /* call callback, using lookup table to get callback event */
   1753     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
   1754                               NULL,
   1755                               avdt_scb_cback_evt[p_scb->curr_evt],
   1756                               &avdt_ctrl);
   1757 }
   1758 
   1759 /*******************************************************************************
   1760 **
   1761 ** Function         avdt_scb_cong_state
   1762 **
   1763 ** Description      This function sets the congestion state of the SCB media
   1764 **                  transport channel.
   1765 **
   1766 ** Returns          Nothing.
   1767 **
   1768 *******************************************************************************/
   1769 void avdt_scb_cong_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1770 {
   1771     p_scb->cong = p_data->llcong;
   1772 }
   1773 
   1774 /*******************************************************************************
   1775 **
   1776 ** Function         avdt_scb_rej_state
   1777 **
   1778 ** Description      This function sends a reject message to the peer indicating
   1779 **                  incorrect state for the received command message.
   1780 **
   1781 ** Returns          Nothing.
   1782 **
   1783 *******************************************************************************/
   1784 void avdt_scb_rej_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1785 {
   1786     UNUSED(p_scb);
   1787 
   1788     p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
   1789     p_data->msg.hdr.err_param = 0;
   1790     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1791                       p_data->msg.hdr.sig_id, &p_data->msg);
   1792 }
   1793 
   1794 /*******************************************************************************
   1795 **
   1796 ** Function         avdt_scb_rej_in_use
   1797 **
   1798 ** Description      This function sends a reject message to the peer indicating
   1799 **                  the stream is in use.
   1800 **
   1801 ** Returns          Nothing.
   1802 **
   1803 *******************************************************************************/
   1804 void avdt_scb_rej_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1805 {
   1806     UNUSED(p_scb);
   1807 
   1808     p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
   1809     p_data->msg.hdr.err_param = 0;
   1810     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1811                       p_data->msg.hdr.sig_id, &p_data->msg);
   1812 }
   1813 
   1814 /*******************************************************************************
   1815 **
   1816 ** Function         avdt_scb_rej_not_in_use
   1817 **
   1818 ** Description      This function sends a reject message to the peer indicating
   1819 **                  the stream is in use.
   1820 **
   1821 ** Returns          Nothing.
   1822 **
   1823 *******************************************************************************/
   1824 void avdt_scb_rej_not_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1825 {
   1826     UNUSED(p_scb);
   1827 
   1828     p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
   1829     p_data->msg.hdr.err_param = 0;
   1830     avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
   1831                       p_data->msg.hdr.sig_id, &p_data->msg);
   1832 }
   1833 
   1834 /*******************************************************************************
   1835 **
   1836 ** Function         avdt_scb_set_remove
   1837 **
   1838 ** Description      This function marks an SCB to be removed.
   1839 **
   1840 ** Returns          Nothing.
   1841 **
   1842 *******************************************************************************/
   1843 void avdt_scb_set_remove(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1844 {
   1845     UNUSED(p_data);
   1846 
   1847     p_scb->remove = TRUE;
   1848 }
   1849 
   1850 /*******************************************************************************
   1851 **
   1852 ** Function         avdt_scb_free_pkt
   1853 **
   1854 ** Description      This function frees the media packet passed in.
   1855 **
   1856 ** Returns          Nothing.
   1857 **
   1858 *******************************************************************************/
   1859 void avdt_scb_free_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1860 {
   1861     tAVDT_CTRL      avdt_ctrl;
   1862 
   1863     /* set error code and parameter */
   1864     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1865     avdt_ctrl.hdr.err_param = 0;
   1866 
   1867     /* p_buf can be NULL in case using of fragments queue frag_q */
   1868     osi_free_and_reset((void **)&p_data->apiwrite.p_buf);
   1869 
   1870 #if AVDT_MULTIPLEXING == TRUE
   1871     /* clean fragments queue */
   1872     BT_HDR          *p_frag;
   1873     while ((p_frag = (BT_HDR*)fixed_queue_try_dequeue(p_scb->frag_q)) != NULL)
   1874          osi_free(p_frag);
   1875 #endif
   1876 
   1877     AVDT_TRACE_WARNING("Dropped media packet");
   1878 
   1879     /* we need to call callback to keep data flow going */
   1880     (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1881                               &avdt_ctrl);
   1882 }
   1883 
   1884 /*******************************************************************************
   1885 **
   1886 ** Function         avdt_scb_clr_pkt
   1887 **
   1888 ** Description      This function frees the media packet stored in the SCB.
   1889 **
   1890 ** Returns          Nothing.
   1891 **
   1892 *******************************************************************************/
   1893 void avdt_scb_clr_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1894 {
   1895     tAVDT_CTRL      avdt_ctrl;
   1896     tAVDT_CCB       *p_ccb;
   1897     UINT8           tcid;
   1898     UINT16          lcid;
   1899     UNUSED(p_data);
   1900 
   1901     /* set error code and parameter */
   1902     avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
   1903     avdt_ctrl.hdr.err_param = 0;
   1904     /* flush the media data queued at L2CAP */
   1905     if((p_ccb = p_scb->p_ccb) != NULL)
   1906     {
   1907         /* get tcid from type, scb */
   1908         tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
   1909 
   1910         lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
   1911         L2CA_FlushChannel (lcid, L2CAP_FLUSH_CHANS_ALL);
   1912     }
   1913 
   1914     if (p_scb->p_pkt != NULL)
   1915     {
   1916         osi_free_and_reset((void **)&p_scb->p_pkt);
   1917 
   1918         AVDT_TRACE_DEBUG("Dropped stored media packet");
   1919 
   1920         /* we need to call callback to keep data flow going */
   1921         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1922                                   &avdt_ctrl);
   1923     }
   1924 #if AVDT_MULTIPLEXING == TRUE
   1925     else if (!fixed_queue_is_empty(p_scb->frag_q))
   1926     {
   1927         AVDT_TRACE_DEBUG("Dropped fragments queue");
   1928         /* clean fragments queue */
   1929         BT_HDR *p_frag;
   1930         while ((p_frag = (BT_HDR*)fixed_queue_try_dequeue(p_scb->frag_q)) != NULL)
   1931              osi_free(p_frag);
   1932         p_scb->frag_off = 0;
   1933 
   1934         /* we need to call callback to keep data flow going */
   1935         (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
   1936                                   &avdt_ctrl);
   1937     }
   1938 #endif
   1939 }
   1940 
   1941 
   1942 /*******************************************************************************
   1943 **
   1944 ** Function         avdt_scb_chk_snd_pkt
   1945 **
   1946 ** Description      This function checks if the SCB is congested, and if not
   1947 **                  congested it sends a stored media packet, if any.  After it
   1948 **                  sends the packet it calls the application callback function
   1949 **                  with a write confirm.
   1950 **
   1951 ** Returns          Nothing.
   1952 **
   1953 *******************************************************************************/
   1954 void avdt_scb_chk_snd_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   1955 {
   1956     tAVDT_CTRL      avdt_ctrl;
   1957     BT_HDR          *p_pkt;
   1958 #if AVDT_MULTIPLEXING == TRUE
   1959     BOOLEAN         sent = FALSE;
   1960     UINT8   res = AVDT_AD_SUCCESS;
   1961     tAVDT_SCB_EVT data;
   1962 #endif
   1963     UNUSED(p_data);
   1964 
   1965     avdt_ctrl.hdr.err_code = 0;
   1966 
   1967     if (!p_scb->cong)
   1968     {
   1969         if (p_scb->p_pkt != NULL)
   1970         {
   1971             p_pkt = p_scb->p_pkt;
   1972             p_scb->p_pkt = NULL;
   1973             avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
   1974 
   1975             (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
   1976         }
   1977 #if AVDT_MULTIPLEXING == TRUE
   1978         else
   1979         {
   1980 #if 0
   1981             AVDT_TRACE_DEBUG("num_q=%d",
   1982                 L2CA_FlushChannel(avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb)].lcid),
   1983                                   L2CAP_FLUSH_CHANS_GET);
   1984 #endif
   1985             while ((p_pkt = (BT_HDR*)fixed_queue_try_dequeue(p_scb->frag_q)) != NULL)
   1986             {
   1987                 sent = TRUE;
   1988                 AVDT_TRACE_DEBUG("Send fragment len=%d",p_pkt->len);
   1989                 /* fragments queue contains fragment to send */
   1990                 res = avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
   1991                 if(AVDT_AD_CONGESTED == res)
   1992                 {
   1993                     p_scb->cong = TRUE;
   1994                     AVDT_TRACE_DEBUG("avdt/l2c congested!!");
   1995                     break;/* exit loop if channel became congested */
   1996             }
   1997             }
   1998             AVDT_TRACE_DEBUG("res=%d left=%d",res, p_scb->frag_off);
   1999 
   2000             if(p_scb->frag_off)
   2001             {
   2002                 if (AVDT_AD_SUCCESS == res || fixed_queue_is_empty(p_scb->frag_q))
   2003                 {
   2004                     /* all buffers were sent to L2CAP, compose more to queue */
   2005                     avdt_scb_queue_frags(p_scb, &p_scb->p_next_frag, &p_scb->frag_off);
   2006                     if (!fixed_queue_is_empty(p_scb->frag_q))
   2007                     {
   2008                         data.llcong = p_scb->cong;
   2009                         avdt_scb_event(p_scb, AVDT_SCB_TC_CONG_EVT, &data);
   2010                     }
   2011                 }
   2012             }
   2013 
   2014             /* Send event AVDT_WRITE_CFM_EVT if it was last fragment */
   2015             else if (sent && fixed_queue_is_empty(p_scb->frag_q))
   2016             {
   2017                 (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
   2018             }
   2019         }
   2020 #endif
   2021     }
   2022 }
   2023 
   2024 /*******************************************************************************
   2025 **
   2026 ** Function         avdt_scb_transport_channel_timer
   2027 **
   2028 ** Description      This function is called to start a timer when the peer
   2029 **                  initiates closing of the stream.  The timer verifies that
   2030 **                  the peer disconnects the transport channel.
   2031 **
   2032 ** Returns          Nothing.
   2033 **
   2034 *******************************************************************************/
   2035 void avdt_scb_transport_channel_timer(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   2036 {
   2037     UNUSED(p_data);
   2038 
   2039     alarm_set_on_queue(p_scb->transport_channel_timer,
   2040                        AVDT_SCB_TC_DISC_TIMEOUT_MS,
   2041                        avdt_scb_transport_channel_timer_timeout, p_scb,
   2042                        btu_general_alarm_queue);
   2043 }
   2044 
   2045 /*******************************************************************************
   2046 **
   2047 ** Function         avdt_scb_clr_vars
   2048 **
   2049 ** Description      This function initializes certain SCB variables.
   2050 **
   2051 ** Returns          Nothing.
   2052 **
   2053 *******************************************************************************/
   2054 void avdt_scb_clr_vars(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
   2055 {
   2056     UNUSED(p_data);
   2057     p_scb->in_use = FALSE;
   2058     p_scb->p_ccb = NULL;
   2059     p_scb->peer_seid = 0;
   2060 }
   2061 
   2062 #if AVDT_MULTIPLEXING == TRUE
   2063 /*******************************************************************************
   2064 **
   2065 ** Function         avdt_scb_queue_frags
   2066 **
   2067 ** Description      This function breaks media payload into fragments
   2068 **                  and put the fragments in the given queue.
   2069 **
   2070 ** Returns          Nothing.
   2071 **
   2072 *******************************************************************************/
   2073 void avdt_scb_queue_frags(tAVDT_SCB *p_scb, UINT8 **pp_data,
   2074                           UINT32 *p_data_len)
   2075 {
   2076     UINT16  lcid;
   2077     UINT16  num_frag;
   2078     UINT16  mtu_used;
   2079     UINT8   *p;
   2080     BOOLEAN al_hdr = FALSE;
   2081     UINT8   tcid;
   2082     tAVDT_TC_TBL    *p_tbl;
   2083     UINT16          buf_size;
   2084     UINT16          offset = AVDT_MEDIA_OFFSET + AVDT_AL_HDR_SIZE;
   2085     UINT16          cont_offset = offset - AVDT_MEDIA_HDR_SIZE;
   2086 
   2087     tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
   2088     lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][tcid].lcid;
   2089 
   2090     if( p_scb->frag_off != 0)
   2091     {
   2092         /* continuing process is usually triggered by un-congest event.
   2093          * the number of buffers at L2CAP is very small (if not 0).
   2094          * we do not need to L2CA_FlushChannel() */
   2095         offset = cont_offset;
   2096         al_hdr = TRUE;
   2097         num_frag = AVDT_MAX_FRAG_COUNT;
   2098     }
   2099     else
   2100     {
   2101         num_frag = L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_GET);
   2102         AVDT_TRACE_DEBUG("num_q=%d lcid=%d", num_frag, lcid);
   2103         if(num_frag >= AVDT_MAX_FRAG_COUNT)
   2104         {
   2105             num_frag = 0;
   2106         }
   2107         else
   2108         {
   2109             num_frag = AVDT_MAX_FRAG_COUNT - num_frag;
   2110         }
   2111     }
   2112 
   2113     /* look up transport channel table entry to get peer mtu */
   2114     p_tbl = avdt_ad_tc_tbl_by_type(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
   2115     buf_size = p_tbl->peer_mtu + BT_HDR_SIZE;
   2116     AVDT_TRACE_DEBUG("peer_mtu: %d, buf_size: %d num_frag=%d",
   2117         p_tbl->peer_mtu, buf_size, num_frag);
   2118 
   2119     if (buf_size > AVDT_DATA_BUF_SIZE)
   2120         buf_size = AVDT_DATA_BUF_SIZE;
   2121 
   2122     mtu_used = buf_size - BT_HDR_SIZE;
   2123 
   2124     while (*p_data_len && num_frag) {
   2125         /* allocate buffer for fragment */
   2126         BT_HDR *p_frag = (BT_HDR *)osi_malloc(buf_size);
   2127 
   2128         /* fill fragment by chunk of media payload */
   2129         p_frag->layer_specific = *p_data_len;/* length of all remaining transport packet */
   2130         p_frag->offset = offset;
   2131         /* adjust packet offset for continuing packets */
   2132         offset = cont_offset;
   2133 
   2134         p_frag->len = mtu_used - p_frag->offset;
   2135         if(p_frag->len > *p_data_len)
   2136             p_frag->len = *p_data_len;
   2137         memcpy((UINT8*)(p_frag+1) + p_frag->offset, *pp_data, p_frag->len);
   2138         *pp_data += p_frag->len;
   2139         *p_data_len -= p_frag->len;
   2140         AVDT_TRACE_DEBUG("Prepared fragment len=%d", p_frag->len);
   2141 
   2142         if(al_hdr)
   2143         {
   2144             /* Adaptation Layer header */
   2145             p_frag->len += AVDT_AL_HDR_SIZE;
   2146             p_frag->offset -= AVDT_AL_HDR_SIZE;
   2147             p = (UINT8 *)(p_frag + 1) + p_frag->offset;
   2148             /* TSID, fragment bit and coding of length(in 2 length octets following) */
   2149             *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
   2150 
   2151             /* length of all remaining transport packet */
   2152             UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
   2153         }
   2154         /* put fragment into gueue */
   2155         fixed_queue_enqueue(p_scb->frag_q, p_frag);
   2156         num_frag--;
   2157     }
   2158 }
   2159 #endif
   2160 
   2161