1/******************************************************************************
2 *
3 *  Copyright (C) 2004-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/******************************************************************************
20 *
21 *  This file contains action functions for advanced audio/video main state
22 *  machine.
23 *
24 ******************************************************************************/
25
26#include "bt_target.h"
27#if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE)
28
29#include <string.h>
30#include "bta_av_api.h"
31#include "bta_av_int.h"
32#include "avdt_api.h"
33#include "bd.h"
34#include "utl.h"
35#include "l2c_api.h"
36#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
37#include "bta_ar_api.h"
38#endif
39
40/*****************************************************************************
41**  Constants
42*****************************************************************************/
43/* the timer in milliseconds to wait for open req after setconfig for incoming connections */
44#ifndef BTA_AV_SIG_TIME_VAL
45#define BTA_AV_SIG_TIME_VAL 8000
46#endif
47
48/* In millisec to wait for signalling from SNK when it is initiated from SNK.   */
49/* If not, we will start signalling from SRC.                                   */
50#ifndef BTA_AV_ACP_SIG_TIME_VAL
51#define BTA_AV_ACP_SIG_TIME_VAL 2000
52#endif
53
54static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle);
55
56/*******************************************************************************
57**
58** Function         bta_av_get_rcb_by_shdl
59**
60** Description      find the RCB associated with the given SCB handle.
61**
62** Returns          tBTA_AV_RCB
63**
64*******************************************************************************/
65tBTA_AV_RCB * bta_av_get_rcb_by_shdl(UINT8 shdl)
66{
67    tBTA_AV_RCB *p_rcb = NULL;
68    int         i;
69
70    for (i=0; i<BTA_AV_NUM_RCB; i++)
71    {
72        if (bta_av_cb.rcb[i].shdl == shdl && bta_av_cb.rcb[i].handle != BTA_AV_RC_HANDLE_NONE)
73        {
74            p_rcb = &bta_av_cb.rcb[i];
75            break;
76        }
77    }
78    return p_rcb;
79}
80#define BTA_AV_STS_NO_RSP       0xFF    /* a number not used by tAVRC_STS */
81
82/*******************************************************************************
83**
84** Function         bta_av_del_rc
85**
86** Description      delete the given AVRC handle.
87**
88** Returns          void
89**
90*******************************************************************************/
91void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
92{
93    tBTA_AV_SCB  *p_scb;
94    UINT8        rc_handle;      /* connected AVRCP handle */
95
96    if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
97    {
98        if(p_rcb->shdl)
99        {
100            p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
101            if(p_scb)
102            {
103                APPL_TRACE_DEBUG3("bta_av_del_rc shdl:%d, srch:%d rc_handle:%d", p_rcb->shdl,
104                                  p_scb->rc_handle, p_rcb->handle);
105                if(p_scb->rc_handle == p_rcb->handle)
106                    p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
107                /* just in case the RC timer is active
108                if(bta_av_cb.features & BTA_AV_FEAT_RCCT && p_scb->chnl == BTA_AV_CHNL_AUDIO) */
109                    bta_sys_stop_timer(&p_scb->timer);
110            }
111        }
112
113        APPL_TRACE_EVENT4("bta_av_del_rc  handle: %d status=0x%x, rc_acp_handle:%d, idx:%d",
114            p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, bta_av_cb.rc_acp_idx);
115        rc_handle = p_rcb->handle;
116        if(!(p_rcb->status & BTA_AV_RC_CONN_MASK) ||
117            ((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT) )
118        {
119            p_rcb->status = 0;
120            p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
121            p_rcb->shdl = 0;
122            p_rcb->lidx = 0;
123        }
124        /* else ACP && connected. do not clear the handle yet */
125        AVRC_Close(rc_handle);
126        if (rc_handle == bta_av_cb.rc_acp_handle)
127            bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
128        APPL_TRACE_EVENT4("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
129            p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
130    }
131}
132
133
134/*******************************************************************************
135**
136** Function         bta_av_close_all_rc
137**
138** Description      close the all AVRC handle.
139**
140** Returns          void
141**
142*******************************************************************************/
143static void bta_av_close_all_rc(tBTA_AV_CB *p_cb)
144{
145    int i;
146
147    for(i=0; i<BTA_AV_NUM_RCB; i++)
148    {
149        if ((p_cb->disabling == TRUE) || (bta_av_cb.rcb[i].shdl != 0))
150            bta_av_del_rc(&bta_av_cb.rcb[i]);
151    }
152}
153
154/*******************************************************************************
155**
156** Function         bta_av_del_sdp_rec
157**
158** Description      delete the given SDP record handle.
159**
160** Returns          void
161**
162*******************************************************************************/
163static void bta_av_del_sdp_rec(UINT32 *p_sdp_handle)
164{
165    if(*p_sdp_handle != 0)
166    {
167        SDP_DeleteRecord(*p_sdp_handle);
168        *p_sdp_handle = 0;
169    }
170}
171
172/*******************************************************************************
173**
174** Function         bta_av_avrc_sdp_cback
175**
176** Description      AVRCP service discovery callback.
177**
178** Returns          void
179**
180*******************************************************************************/
181static void bta_av_avrc_sdp_cback(UINT16 status)
182{
183    BT_HDR *p_msg;
184
185    if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
186    {
187        p_msg->event = BTA_AV_SDP_AVRC_DISC_EVT;
188        bta_sys_sendmsg(p_msg);
189    }
190}
191
192/*******************************************************************************
193**
194** Function         bta_av_rc_ctrl_cback
195**
196** Description      AVRCP control callback.
197**
198** Returns          void
199**
200*******************************************************************************/
201static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_ADDR peer_addr)
202{
203    tBTA_AV_RC_CONN_CHG *p_msg;
204    UINT16 msg_event = 0;
205
206#if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
207    APPL_TRACE_EVENT2("rc_ctrl handle: %d event=0x%x", handle, event);
208#else
209    APPL_TRACE_EVENT2("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
210#endif
211    if (event == AVRC_OPEN_IND_EVT)
212    {
213        /* save handle of opened connection
214        bta_av_cb.rc_handle = handle;*/
215
216        msg_event = BTA_AV_AVRC_OPEN_EVT;
217    }
218    else if (event == AVRC_CLOSE_IND_EVT)
219    {
220        msg_event = BTA_AV_AVRC_CLOSE_EVT;
221    }
222
223    if (msg_event)
224    {
225        if ((p_msg = (tBTA_AV_RC_CONN_CHG *) GKI_getbuf(sizeof(tBTA_AV_RC_CONN_CHG))) != NULL)
226        {
227            p_msg->hdr.event = msg_event;
228            p_msg->handle    = handle;
229            if(peer_addr)
230                bdcpy(p_msg->peer_addr, peer_addr);
231            bta_sys_sendmsg(p_msg);
232        }
233    }
234}
235
236/*******************************************************************************
237**
238** Function         bta_av_rc_msg_cback
239**
240** Description      AVRCP message callback.
241**
242** Returns          void
243**
244*******************************************************************************/
245static void bta_av_rc_msg_cback(UINT8 handle, UINT8 label, UINT8 opcode, tAVRC_MSG *p_msg)
246{
247    tBTA_AV_RC_MSG  *p_buf;
248    UINT8           *p_data = NULL;
249    UINT8           **p_p_data = NULL;
250    UINT16          data_len = 0;
251
252#if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
253    APPL_TRACE_ERROR2("rc_msg handle: %d opcode=0x%x", handle, opcode);
254#else
255    APPL_TRACE_EVENT2("bta_av_rc_msg_cback handle: %d opcode=0x%x", handle, opcode);
256#endif
257    /* determine size of buffer we need */
258    if (opcode == AVRC_OP_VENDOR && p_msg->vendor.p_vendor_data != NULL)
259    {
260        p_data = p_msg->vendor.p_vendor_data;
261        p_p_data = &p_msg->vendor.p_vendor_data;
262        data_len = (UINT16) p_msg->vendor.vendor_len;
263    }
264    else if (opcode == AVRC_OP_PASS_THRU && p_msg->pass.p_pass_data != NULL)
265    {
266        p_data = p_msg->pass.p_pass_data;
267        p_p_data = &p_msg->pass.p_pass_data;
268        data_len = (UINT16) p_msg->pass.pass_len;
269    }
270
271    if ((p_buf = (tBTA_AV_RC_MSG *) GKI_getbuf((UINT16) (sizeof(tBTA_AV_RC_MSG) + data_len))) != NULL)
272    {
273        p_buf->hdr.event = BTA_AV_AVRC_MSG_EVT;
274        p_buf->handle = handle;
275        p_buf->label = label;
276        p_buf->opcode = opcode;
277        memcpy(&p_buf->msg, p_msg, sizeof(tAVRC_MSG));
278        if (p_data != NULL)
279        {
280            memcpy((UINT8 *)(p_buf + 1), p_data, data_len);
281            *p_p_data = (UINT8 *)(p_buf + 1);
282        }
283        bta_sys_sendmsg(p_buf);
284    }
285}
286
287/*******************************************************************************
288**
289** Function         bta_av_rc_create
290**
291** Description      alloc RCB and call AVRC_Open
292**
293** Returns          the created rc handle
294**
295*******************************************************************************/
296UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
297{
298    tAVRC_CONN_CB ccb;
299    BD_ADDR_PTR   bda = (BD_ADDR_PTR)bd_addr_any;
300    UINT8         status = BTA_AV_RC_ROLE_ACP;
301    tBTA_AV_SCB  *p_scb = p_cb->p_scb[shdl - 1];
302    int i;
303    UINT8   rc_handle;
304    tBTA_AV_RCB *p_rcb;
305
306    if(role == AVCT_INT)
307    {
308        bda = p_scb->peer_addr;
309        status = BTA_AV_RC_ROLE_INT;
310    }
311    else
312    {
313        if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL )
314        {
315            APPL_TRACE_ERROR1("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
316            return p_rcb->handle;
317        }
318    }
319
320    ccb.p_ctrl_cback = bta_av_rc_ctrl_cback;
321    ccb.p_msg_cback = bta_av_rc_msg_cback;
322    ccb.company_id = p_bta_av_cfg->company_id;
323    ccb.conn = role;
324    /* note: BTA_AV_FEAT_RCTG = AVRC_CT_TARGET, BTA_AV_FEAT_RCCT = AVRC_CT_CONTROL */
325    ccb.control = p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_RCCT | AVRC_CT_PASSIVE);
326
327
328    if (AVRC_Open(&rc_handle, &ccb, bda) != AVRC_SUCCESS)
329        return BTA_AV_RC_HANDLE_NONE;
330
331    i = rc_handle;
332    p_rcb = &p_cb->rcb[i];
333
334    if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
335    {
336        APPL_TRACE_ERROR1("bta_av_rc_create found duplicated handle:%d", rc_handle);
337    }
338
339    p_rcb->handle = rc_handle;
340    p_rcb->status = status;
341    p_rcb->shdl = shdl;
342    p_rcb->lidx = lidx;
343    p_rcb->peer_features = 0;
344    if(lidx == (BTA_AV_NUM_LINKS + 1))
345    {
346        /* this LIDX is reserved for the AVRCP ACP connection */
347        p_cb->rc_acp_handle = p_rcb->handle;
348        p_cb->rc_acp_idx = (i + 1);
349        APPL_TRACE_DEBUG2("rc_acp_handle:%d idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
350    }
351    APPL_TRACE_DEBUG6("create %d, role: %d, shdl:%d, rc_handle:%d, lidx:%d, status:0x%x",
352        i, role, shdl, p_rcb->handle, lidx, p_rcb->status);
353
354    return rc_handle;
355}
356
357/*******************************************************************************
358**
359** Function         bta_av_valid_group_navi_msg
360**
361** Description      Check if it is Group Navigation Msg for Metadata
362**
363** Returns          BTA_AV_RSP_ACCEPT or BTA_AV_RSP_NOT_IMPL.
364**
365*******************************************************************************/
366static tBTA_AV_CODE bta_av_group_navi_supported(UINT8 len, UINT8 *p_data, BOOLEAN is_inquiry)
367{
368    tBTA_AV_CODE ret=BTA_AV_RSP_NOT_IMPL;
369    UINT8 *p_ptr = p_data;
370    UINT16 u16;
371    UINT32 u32;
372
373    if (p_bta_av_cfg->avrc_group && len == BTA_GROUP_NAVI_MSG_OP_DATA_LEN)
374    {
375        BTA_AV_BE_STREAM_TO_CO_ID(u32, p_ptr);
376        BE_STREAM_TO_UINT16(u16, p_ptr);
377
378        if (u32 == AVRC_CO_METADATA)
379        {
380            if (is_inquiry)
381            {
382                if (u16 <= AVRC_PDU_PREV_GROUP)
383                    ret = BTA_AV_RSP_IMPL_STBL;
384            }
385            else
386            {
387                if (u16 <= AVRC_PDU_PREV_GROUP)
388                    ret = BTA_AV_RSP_ACCEPT;
389                else
390                    ret = BTA_AV_RSP_REJ;
391            }
392        }
393    }
394
395    return ret;
396}
397
398/*******************************************************************************
399**
400** Function         bta_av_op_supported
401**
402** Description      Check if remote control operation is supported.
403**
404** Returns          BTA_AV_RSP_ACCEPT of supported, BTA_AV_RSP_NOT_IMPL if not.
405**
406*******************************************************************************/
407static tBTA_AV_CODE bta_av_op_supported(tBTA_AV_RC rc_id, BOOLEAN is_inquiry)
408{
409    tBTA_AV_CODE ret_code = BTA_AV_RSP_NOT_IMPL;
410
411    if (p_bta_av_rc_id)
412    {
413        if (is_inquiry)
414        {
415            if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
416            {
417                ret_code = BTA_AV_RSP_IMPL_STBL;
418            }
419        }
420        else
421        {
422            if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
423            {
424                ret_code = BTA_AV_RSP_ACCEPT;
425            }
426            else if ((p_bta_av_cfg->rc_pass_rsp == BTA_AV_RSP_INTERIM) && p_bta_av_rc_id_ac)
427            {
428                if (p_bta_av_rc_id_ac[rc_id >> 4] & (1 << (rc_id & 0x0F)))
429                {
430                    ret_code = BTA_AV_RSP_INTERIM;
431                }
432            }
433        }
434
435    }
436    return ret_code;
437}
438
439/*******************************************************************************
440**
441** Function         bta_av_find_lcb
442**
443** Description      Given BD_addr, find the associated LCB.
444**
445** Returns          NULL, if not found.
446**
447*******************************************************************************/
448tBTA_AV_LCB * bta_av_find_lcb(BD_ADDR addr, UINT8 op)
449{
450    tBTA_AV_CB   *p_cb = &bta_av_cb;
451    int     xx;
452    UINT8   mask;
453    tBTA_AV_LCB *p_lcb = NULL;
454
455    for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
456    {
457        mask = 1 << xx; /* the used mask for this lcb */
458        if((mask & p_cb->conn_lcb) && 0 ==( bdcmp(p_cb->lcb[xx].addr, addr)))
459        {
460            p_lcb = &p_cb->lcb[xx];
461            if(op == BTA_AV_LCB_FREE)
462            {
463                p_cb->conn_lcb &= ~mask; /* clear the connect mask */
464                APPL_TRACE_DEBUG1("conn_lcb: 0x%x", p_cb->conn_lcb);
465            }
466            break;
467        }
468    }
469    return p_lcb;
470}
471
472/*******************************************************************************
473**
474** Function         bta_av_rc_opened
475**
476** Description      Set AVRCP state to opened.
477**
478** Returns          void
479**
480*******************************************************************************/
481void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
482{
483    tBTA_AV_RC_OPEN rc_open;
484    tBTA_AV_SCB     *p_scb;
485    int         i;
486    UINT8       shdl = 0;
487    tBTA_AV_LCB *p_lcb;
488    tBTA_AV_RCB *p_rcb;
489    UINT8       tmp;
490    UINT8       disc = 0;
491
492    /* find the SCB & stop the timer */
493    for(i=0; i<BTA_AV_NUM_STRS; i++)
494    {
495        p_scb = p_cb->p_scb[i];
496        if(p_scb && bdcmp(p_scb->peer_addr, p_data->rc_conn_chg.peer_addr) == 0)
497        {
498            p_scb->rc_handle = p_data->rc_conn_chg.handle;
499            APPL_TRACE_DEBUG2("bta_av_rc_opened shdl:%d, srch %d", i + 1, p_scb->rc_handle);
500            shdl = i+1;
501            APPL_TRACE_ERROR1("use_rc:%d", p_scb->use_rc);
502            bta_sys_stop_timer(&p_scb->timer);
503            disc = p_scb->hndl;
504            break;
505        }
506    }
507
508    i = p_data->rc_conn_chg.handle;
509    if (p_cb->rcb[i].handle == BTA_AV_RC_HANDLE_NONE)
510    {
511        APPL_TRACE_ERROR1("not a valid handle:%d any more", i);
512        return;
513    }
514
515
516    if (p_cb->rcb[i].lidx == (BTA_AV_NUM_LINKS + 1) && shdl != 0)
517    {
518        /* rc is opened on the RC only ACP channel, but is for a specific
519         * SCB -> need to switch RCBs */
520        p_rcb = bta_av_get_rcb_by_shdl(shdl);
521        if (p_rcb)
522        {
523            p_rcb->shdl = p_cb->rcb[i].shdl;
524            tmp         = p_rcb->lidx;
525            p_rcb->lidx = p_cb->rcb[i].lidx;
526            p_cb->rcb[i].lidx = tmp;
527            p_cb->rc_acp_handle = p_rcb->handle;
528            p_cb->rc_acp_idx = (p_rcb - p_cb->rcb) + 1;
529            APPL_TRACE_DEBUG2("switching RCB rc_acp_handle:%d idx:%d",
530                               p_cb->rc_acp_handle, p_cb->rc_acp_idx);
531        }
532    }
533
534    p_cb->rcb[i].shdl = shdl;
535    rc_open.rc_handle = i;
536    APPL_TRACE_ERROR4("bta_av_rc_opened rcb[%d] shdl:%d lidx:%d/%d",
537            i, shdl, p_cb->rcb[i].lidx, p_cb->lcb[BTA_AV_NUM_LINKS].lidx);
538    p_cb->rcb[i].status |= BTA_AV_RC_CONN_MASK;
539
540    if(!shdl && 0 == p_cb->lcb[BTA_AV_NUM_LINKS].lidx)
541    {
542        /* no associated SCB -> connected to an RC only device
543         * update the index to the extra LCB */
544        p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
545        bdcpy(p_lcb->addr, p_data->rc_conn_chg.peer_addr);
546        APPL_TRACE_DEBUG6("rc_only bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
547                      p_lcb->addr[0], p_lcb->addr[1],
548                      p_lcb->addr[2], p_lcb->addr[3],
549                      p_lcb->addr[4], p_lcb->addr[5]);
550        p_lcb->lidx = BTA_AV_NUM_LINKS + 1;
551            p_cb->rcb[i].lidx = p_lcb->lidx;
552        p_lcb->conn_msk = 1;
553        APPL_TRACE_ERROR3("rcb[%d].lidx=%d, lcb.conn_msk=x%x",
554            i, p_cb->rcb[i].lidx, p_lcb->conn_msk);
555        disc = p_data->rc_conn_chg.handle|BTA_AV_CHNL_MSK;
556    }
557
558    bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
559    rc_open.peer_features = p_cb->rcb[i].peer_features;
560    rc_open.status = BTA_AV_SUCCESS;
561    APPL_TRACE_DEBUG2("local features:x%x peer_features:x%x", p_cb->features,
562                      rc_open.peer_features);
563    if(rc_open.peer_features == 0)
564    {
565        /* we have not done SDP on peer RC capabilities.
566         * peer must have initiated the RC connection */
567        rc_open.peer_features = BTA_AV_FEAT_RCCT;
568        bta_av_rc_disc(disc);
569    }
570    (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
571
572}
573
574
575/*******************************************************************************
576**
577** Function         bta_av_rc_remote_cmd
578**
579** Description      Send an AVRCP remote control command.
580**
581** Returns          void
582**
583*******************************************************************************/
584void bta_av_rc_remote_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
585{
586    tBTA_AV_RCB    *p_rcb;
587    if (p_cb->features & BTA_AV_FEAT_RCCT)
588    {
589        if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
590        {
591            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
592            if(p_rcb->status & BTA_AV_RC_CONN_MASK)
593            {
594                AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
595                     &p_data->api_remote_cmd.msg);
596            }
597        }
598    }
599}
600
601/*******************************************************************************
602**
603** Function         bta_av_rc_vendor_cmd
604**
605** Description      Send an AVRCP vendor specific command.
606**
607** Returns          void
608**
609*******************************************************************************/
610void bta_av_rc_vendor_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
611{
612    tBTA_AV_RCB    *p_rcb;
613    if ( (p_cb->features & (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR)) ==
614         (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR))
615    {
616        if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
617        {
618            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
619            AVRC_VendorCmd(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
620        }
621    }
622}
623
624/*******************************************************************************
625**
626** Function         bta_av_rc_vendor_rsp
627**
628** Description      Send an AVRCP vendor specific response.
629**
630** Returns          void
631**
632*******************************************************************************/
633void bta_av_rc_vendor_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
634{
635    tBTA_AV_RCB    *p_rcb;
636    if ( (p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
637         (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR))
638    {
639        if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
640        {
641            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
642            AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
643        }
644    }
645}
646
647/*******************************************************************************
648**
649** Function         bta_av_rc_meta_rsp
650**
651** Description      Send an AVRCP metadata/advanced control command/response.
652**
653** Returns          void
654**
655*******************************************************************************/
656void bta_av_rc_meta_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
657{
658    tBTA_AV_RCB *p_rcb;
659    BOOLEAN         free = TRUE;
660
661    if ((p_cb->features & BTA_AV_FEAT_METADATA) && (p_data->hdr.layer_specific < BTA_AV_NUM_RCB))
662    {
663        if ((p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCTG)) ||
664            (!p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCCT)) )
665        {
666            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
667            if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE) {
668                AVRC_MsgReq(p_rcb->handle, p_data->api_meta_rsp.label,
669                            p_data->api_meta_rsp.rsp_code,
670                            p_data->api_meta_rsp.p_pkt);
671                free = FALSE;
672            }
673        }
674    }
675
676    if (free)
677        GKI_freebuf (p_data->api_meta_rsp.p_pkt);
678}
679
680/*******************************************************************************
681**
682** Function         bta_av_rc_free_rsp
683**
684** Description      free an AVRCP metadata command buffer.
685**
686** Returns          void
687**
688*******************************************************************************/
689void bta_av_rc_free_rsp (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
690{
691    GKI_freebuf (p_data->api_meta_rsp.p_pkt);
692}
693
694/*******************************************************************************
695**
696** Function         bta_av_rc_meta_req
697**
698** Description      Send an AVRCP metadata command.
699**
700** Returns          void
701**
702*******************************************************************************/
703void bta_av_rc_free_msg (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
704{
705}
706
707
708
709/*******************************************************************************
710**
711** Function         bta_av_chk_notif_evt_id
712**
713** Description      make sure the requested player id is valid.
714**
715** Returns          BTA_AV_STS_NO_RSP, if no error
716**
717*******************************************************************************/
718static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
719{
720    tAVRC_STS   status = BTA_AV_STS_NO_RSP;
721    UINT8       xx;
722    UINT16      u16;
723    UINT8       *p = p_vendor->p_vendor_data + 2;
724
725    BE_STREAM_TO_UINT16 (u16, p);
726    /* double check the fixed length */
727    if ((u16 != 5) || (p_vendor->vendor_len != 9))
728    {
729        status = AVRC_STS_INTERNAL_ERR;
730    }
731    else
732    {
733        /* make sure the player_id is valid */
734        for (xx=0; xx<p_bta_av_cfg->num_evt_ids; xx++)
735        {
736            if (*p == p_bta_av_cfg->p_meta_evt_ids[xx])
737            {
738                break;
739            }
740        }
741        if (xx == p_bta_av_cfg->num_evt_ids)
742        {
743            status = AVRC_STS_BAD_PARAM;
744        }
745    }
746
747    return status;
748}
749
750/*******************************************************************************
751**
752** Function         bta_av_proc_meta_cmd
753**
754** Description      Process an AVRCP metadata command from the peer.
755**
756** Returns          TRUE to respond immediately
757**
758*******************************************************************************/
759tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE  *p_rc_rsp, tBTA_AV_RC_MSG *p_msg, UINT8 *p_ctype)
760{
761    tBTA_AV_EVT evt = BTA_AV_META_MSG_EVT;
762    UINT8       u8, pdu, *p;
763    UINT16      u16;
764    tAVRC_MSG_VENDOR    *p_vendor = &p_msg->msg.vendor;
765
766#if (AVRC_METADATA_INCLUDED == TRUE)
767
768    pdu = *(p_vendor->p_vendor_data);
769    p_rc_rsp->pdu = pdu;
770    *p_ctype = AVRC_RSP_REJ;
771    /* Metadata messages only use PANEL sub-unit type */
772    if (p_vendor->hdr.subunit_type != AVRC_SUB_PANEL)
773    {
774        APPL_TRACE_DEBUG0("SUBUNIT must be PANEL");
775        /* reject it */
776        evt=0;
777        p_vendor->hdr.ctype = BTA_AV_RSP_NOT_IMPL;
778        AVRC_VendorRsp(p_msg->handle, p_msg->label, &p_msg->msg.vendor);
779    }
780    else if (!AVRC_IsValidAvcType(pdu, p_vendor->hdr.ctype) )
781    {
782        APPL_TRACE_DEBUG2("Invalid pdu/ctype: 0x%x, %d", pdu, p_vendor->hdr.ctype);
783        /* reject invalid message without reporting to app */
784        evt = 0;
785        p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
786    }
787    else
788    {
789        switch (pdu)
790        {
791        case AVRC_PDU_GET_CAPABILITIES:
792            /* process GetCapabilities command without reporting the event to app */
793            evt = 0;
794            u8 = *(p_vendor->p_vendor_data + 4);
795            p = p_vendor->p_vendor_data + 2;
796            p_rc_rsp->get_caps.capability_id = u8;
797            BE_STREAM_TO_UINT16 (u16, p);
798            if ((u16 != 1) || (p_vendor->vendor_len != 5))
799            {
800                p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
801            }
802            else
803            {
804                p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;
805                if (u8 == AVRC_CAP_COMPANY_ID)
806                {
807                    *p_ctype = AVRC_RSP_IMPL_STBL;
808                    p_rc_rsp->get_caps.count = p_bta_av_cfg->num_co_ids;
809                    memcpy(p_rc_rsp->get_caps.param.company_id, p_bta_av_cfg->p_meta_co_ids,
810                           (p_bta_av_cfg->num_co_ids << 2));
811                }
812                else if (u8 == AVRC_CAP_EVENTS_SUPPORTED)
813                {
814                    *p_ctype = AVRC_RSP_IMPL_STBL;
815                    p_rc_rsp->get_caps.count = p_bta_av_cfg->num_evt_ids;
816                    memcpy(p_rc_rsp->get_caps.param.event_id, p_bta_av_cfg->p_meta_evt_ids,
817                           p_bta_av_cfg->num_evt_ids);
818                }
819                else
820                {
821                    APPL_TRACE_DEBUG1("Invalid capability ID: 0x%x", u8);
822                    /* reject - unknown capability ID */
823                    p_rc_rsp->get_caps.status = AVRC_STS_BAD_PARAM;
824                }
825            }
826            break;
827
828
829        case AVRC_PDU_REGISTER_NOTIFICATION:
830            /* make sure the event_id is implemented */
831            p_rc_rsp->rsp.status = bta_av_chk_notif_evt_id (p_vendor);
832            if (p_rc_rsp->rsp.status != BTA_AV_STS_NO_RSP)
833                evt = 0;
834            break;
835
836        }
837    }
838#else
839    APPL_TRACE_DEBUG0("AVRCP 1.3 Metadata not supporteed. Reject command.");
840    /* reject invalid message without reporting to app */
841    evt = 0;
842    p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
843#endif
844
845    return evt;
846}
847
848
849/*******************************************************************************
850**
851** Function         bta_av_rc_msg
852**
853** Description      Process an AVRCP message from the peer.
854**
855** Returns          void
856**
857*******************************************************************************/
858void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
859{
860    tBTA_AV_EVT evt = 0;
861    tBTA_AV     av;
862    BT_HDR      *p_pkt = NULL;
863    tAVRC_MSG_VENDOR    *p_vendor = &p_data->rc_msg.msg.vendor;
864    BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
865#if (AVRC_METADATA_INCLUDED == TRUE)
866    tAVRC_STS   res;
867    UINT8       ctype;
868    tAVRC_RESPONSE  rc_rsp;
869
870    rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
871#endif
872
873    if (p_data->rc_msg.opcode == AVRC_OP_PASS_THRU)
874    {
875    /* if this is a pass thru command */
876        if ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_CTRL) ||
877            (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) ||
878            (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ)
879            )
880        {
881        /* check if operation is supported */
882            if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR)
883            {
884                p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
885#if (AVRC_METADATA_INCLUDED == TRUE)
886                if (p_cb->features & BTA_AV_FEAT_METADATA)
887                    p_data->rc_msg.msg.hdr.ctype =
888                        bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
889                        p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
890#endif
891            }
892            else
893            {
894                p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
895            }
896
897            APPL_TRACE_DEBUG1("ctype %d",p_data->rc_msg.msg.hdr.ctype)
898
899            /* send response */
900            if (p_data->rc_msg.msg.hdr.ctype != BTA_AV_RSP_INTERIM)
901                AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
902
903            /* set up for callback if supported */
904            if (p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_ACCEPT || p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_INTERIM)
905            {
906                evt = BTA_AV_REMOTE_CMD_EVT;
907                av.remote_cmd.rc_id = p_data->rc_msg.msg.pass.op_id;
908                av.remote_cmd.key_state = p_data->rc_msg.msg.pass.state;
909                av.remote_cmd.p_data = p_data->rc_msg.msg.pass.p_pass_data;
910                av.remote_cmd.len = p_data->rc_msg.msg.pass.pass_len;
911                memcpy(&av.remote_cmd.hdr, &p_data->rc_msg.msg.hdr, sizeof (tAVRC_HDR));
912                av.remote_cmd.label = p_data->rc_msg.label;
913            }
914        }
915        /* else if this is a pass thru response */
916        else if (p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
917        {
918            /* set up for callback */
919            evt = BTA_AV_REMOTE_RSP_EVT;
920            av.remote_rsp.rc_id = p_data->rc_msg.msg.pass.op_id;
921            av.remote_rsp.key_state = p_data->rc_msg.msg.pass.state;
922            av.remote_rsp.rsp_code = p_data->rc_msg.msg.hdr.ctype;
923            av.remote_rsp.label = p_data->rc_msg.label;
924        }
925        /* must be a bad ctype -> reject*/
926        else
927        {
928            p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
929            AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
930        }
931    }
932    /* else if this is a vendor specific command or response */
933    else if (p_data->rc_msg.opcode == AVRC_OP_VENDOR)
934    {
935        /* set up for callback */
936        av.vendor_cmd.code = p_data->rc_msg.msg.hdr.ctype;
937        av.vendor_cmd.company_id = p_vendor->company_id;
938        av.vendor_cmd.label = p_data->rc_msg.label;
939        av.vendor_cmd.p_data = p_vendor->p_vendor_data;
940        av.vendor_cmd.len = p_vendor->vendor_len;
941
942        /* if configured to support vendor specific and it's a command */
943        if ((p_cb->features & BTA_AV_FEAT_VENDOR)  &&
944            p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
945        {
946#if (AVRC_METADATA_INCLUDED == TRUE)
947            if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
948               (p_vendor->company_id == AVRC_CO_METADATA))
949            {
950                av.meta_msg.p_msg = &p_data->rc_msg.msg;
951                evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
952            }
953            else
954#endif
955                evt = BTA_AV_VENDOR_CMD_EVT;
956        }
957        /* else if configured to support vendor specific and it's a response */
958        else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
959                 p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
960        {
961#if (AVRC_METADATA_INCLUDED == TRUE)
962            if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
963               (p_vendor->company_id == AVRC_CO_METADATA))
964            {
965                av.meta_msg.p_msg = &p_data->rc_msg.msg;
966                evt = BTA_AV_META_MSG_EVT;
967            }
968            else
969#endif
970                evt = BTA_AV_VENDOR_RSP_EVT;
971
972        }
973        /* else if not configured to support vendor specific and it's a command */
974        else if (!(p_cb->features & BTA_AV_FEAT_VENDOR)  &&
975            p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
976        {
977           if(p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID)
978           {
979           /* reject it */
980              p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
981              p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
982           }
983           else
984              p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
985           AVRC_VendorRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.vendor);
986        }
987    }
988#if (AVRC_METADATA_INCLUDED == TRUE)
989    if (evt == 0 && rc_rsp.rsp.status != BTA_AV_STS_NO_RSP)
990    {
991        if (!p_pkt)
992        {
993            rc_rsp.rsp.opcode = p_data->rc_msg.opcode;
994            res = AVRC_BldResponse (0, &rc_rsp, &p_pkt);
995        }
996        if (p_pkt)
997            AVRC_MsgReq (p_data->rc_msg.handle, p_data->rc_msg.label, ctype, p_pkt);
998    }
999#endif
1000
1001    /* call callback */
1002    if (evt != 0)
1003    {
1004        av.remote_cmd.rc_handle = p_data->rc_msg.handle;
1005        (*p_cb->p_cback)(evt, &av);
1006    }
1007}
1008
1009/*******************************************************************************
1010**
1011** Function         bta_av_rc_close
1012**
1013** Description      close the specified AVRC handle.
1014**
1015** Returns          void
1016**
1017*******************************************************************************/
1018void bta_av_rc_close (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
1019{
1020    UINT16 handle = p_data->hdr.layer_specific;
1021    tBTA_AV_SCB  *p_scb;
1022    tBTA_AV_RCB *p_rcb;
1023
1024    if(handle < BTA_AV_NUM_RCB)
1025    {
1026        p_rcb = &p_cb->rcb[handle];
1027
1028        APPL_TRACE_DEBUG2("bta_av_rc_close handle: %d, status=0x%x", p_rcb->handle, p_rcb->status);
1029        if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
1030        {
1031            if(p_rcb->shdl)
1032            {
1033                p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
1034                if(p_scb)
1035                {
1036                    /* just in case the RC timer is active
1037                    if(bta_av_cb.features & BTA_AV_FEAT_RCCT &&
1038                       p_scb->chnl == BTA_AV_CHNL_AUDIO) */
1039                        bta_sys_stop_timer(&p_scb->timer);
1040                }
1041            }
1042
1043            AVRC_Close(p_rcb->handle);
1044        }
1045    }
1046}
1047
1048/*******************************************************************************
1049**
1050** Function         bta_av_get_shdl
1051**
1052** Returns          The index to p_scb[]
1053**
1054*******************************************************************************/
1055static UINT8 bta_av_get_shdl(tBTA_AV_SCB *p_scb)
1056{
1057    int     i;
1058    UINT8   shdl = 0;
1059    /* find the SCB & stop the timer */
1060    for(i=0; i<BTA_AV_NUM_STRS; i++)
1061    {
1062        if(p_scb == bta_av_cb.p_scb[i])
1063        {
1064            shdl = i+1;
1065            break;
1066        }
1067    }
1068    return shdl;
1069}
1070
1071/*******************************************************************************
1072**
1073** Function         bta_av_stream_chg
1074**
1075** Description      audio streaming status changed.
1076**
1077** Returns          void
1078**
1079*******************************************************************************/
1080void bta_av_stream_chg(tBTA_AV_SCB *p_scb, BOOLEAN started)
1081{
1082    UINT8   started_msk;
1083    int     i;
1084    UINT8   *p_streams;
1085    BOOLEAN no_streams = FALSE;
1086    tBTA_AV_SCB *p_scbi;
1087
1088    started_msk = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
1089    APPL_TRACE_DEBUG3 ("bta_av_stream_chg started:%d started_msk:x%x chnl:x%x", started,
1090                                                  started_msk, p_scb->chnl);
1091    if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
1092        p_streams = &bta_av_cb.audio_streams;
1093    else
1094        p_streams = &bta_av_cb.video_streams;
1095
1096    if (started)
1097    {
1098        /* Let L2CAP know this channel is processed with high priority */
1099        L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_HIGH);
1100        (*p_streams) |= started_msk;
1101    }
1102    else
1103    {
1104        (*p_streams) &= ~started_msk;
1105    }
1106
1107    if (!started)
1108    {
1109        i=0;
1110        if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
1111        {
1112            if (bta_av_cb.video_streams == 0)
1113                no_streams = TRUE;
1114        }
1115        else
1116        {
1117            no_streams = TRUE;
1118            if ( bta_av_cb.audio_streams )
1119            {
1120                for (; i<BTA_AV_NUM_STRS; i++)
1121                {
1122                    p_scbi = bta_av_cb.p_scb[i];
1123                    /* scb is used and started */
1124                    if ( p_scbi && (bta_av_cb.audio_streams & BTA_AV_HNDL_TO_MSK(i))
1125                        && bdcmp(p_scbi->peer_addr, p_scb->peer_addr) == 0)
1126                    {
1127                        no_streams = FALSE;
1128                        break;
1129                    }
1130                }
1131
1132            }
1133        }
1134
1135        APPL_TRACE_DEBUG4 ("no_streams:%d i:%d, audio_streams:x%x, video_streams:x%x", no_streams, i,
1136                           bta_av_cb.audio_streams, bta_av_cb.video_streams);
1137        if (no_streams)
1138        {
1139            /* Let L2CAP know this channel is processed with low priority */
1140            L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_NORMAL);
1141        }
1142    }
1143}
1144
1145
1146/*******************************************************************************
1147**
1148** Function         bta_av_conn_chg
1149**
1150** Description      connetion status changed.
1151**                  Open an AVRCP acceptor channel, if new conn.
1152**
1153** Returns          void
1154**
1155*******************************************************************************/
1156void bta_av_conn_chg(tBTA_AV_DATA *p_data)
1157{
1158    tBTA_AV_CB   *p_cb = &bta_av_cb;
1159    tBTA_AV_SCB     *p_scb;
1160    tBTA_AV_SCB     *p_scbi;
1161    UINT8   mask;
1162    UINT8   conn_msk;
1163    UINT8   old_msk;
1164    int i;
1165    int index = (p_data->hdr.layer_specific & BTA_AV_HNDL_MSK) - 1;
1166    tBTA_AV_LCB *p_lcb;
1167    tBTA_AV_LCB *p_lcb_rc;
1168    tBTA_AV_RCB *p_rcb, *p_rcb2;
1169    BOOLEAN     chk_restore = FALSE;
1170
1171    p_scb = p_cb->p_scb[index];
1172
1173    mask = BTA_AV_HNDL_TO_MSK(index);
1174    p_lcb = bta_av_find_lcb(p_data->conn_chg.peer_addr, BTA_AV_LCB_FIND);
1175    conn_msk = 1 << (index + 1);
1176    if(p_data->conn_chg.is_up)
1177    {
1178        /* set the conned mask for this channel */
1179        if(p_scb)
1180        {
1181            if(p_lcb)
1182            {
1183                p_lcb->conn_msk |= conn_msk;
1184                for (i=0; i<BTA_AV_NUM_RCB; i++)
1185                {
1186                    if (bta_av_cb.rcb[i].lidx == p_lcb->lidx)
1187                    {
1188                        bta_av_cb.rcb[i].shdl = index + 1;
1189                        APPL_TRACE_DEBUG5("conn_chg up[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
1190                                          bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
1191                                          bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
1192                        break;
1193                    }
1194                }
1195            }
1196            if (p_scb->chnl == BTA_AV_CHNL_AUDIO)
1197            {
1198                old_msk = p_cb->conn_audio;
1199                p_cb->conn_audio |= mask;
1200            }
1201            else
1202            {
1203                old_msk = p_cb->conn_video;
1204                p_cb->conn_video |= mask;
1205            }
1206
1207            if ((old_msk & mask) == 0)
1208            {
1209                /* increase the audio open count, if not set yet */
1210                bta_av_cb.audio_open_cnt++;
1211            }
1212
1213
1214            APPL_TRACE_DEBUG2("rc_acp_handle:%d rc_acp_idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
1215            /* check if the AVRCP ACP channel is already connected */
1216            if(p_lcb && p_cb->rc_acp_handle != BTA_AV_RC_HANDLE_NONE && p_cb->rc_acp_idx)
1217            {
1218                p_lcb_rc = &p_cb->lcb[BTA_AV_NUM_LINKS];
1219                APPL_TRACE_DEBUG1("rc_acp is connected && conn_chg on same addr p_lcb_rc->conn_msk:x%x",
1220                                  p_lcb_rc->conn_msk);
1221                /* check if the RC is connected to the scb addr */
1222                APPL_TRACE_DEBUG6 ("p_lcb_rc->addr: %02x:%02x:%02x:%02x:%02x:%02x",
1223                       p_lcb_rc->addr[0], p_lcb_rc->addr[1], p_lcb_rc->addr[2], p_lcb_rc->addr[3],
1224                       p_lcb_rc->addr[4], p_lcb_rc->addr[5]);
1225                APPL_TRACE_DEBUG6 ("conn_chg.peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
1226                       p_data->conn_chg.peer_addr[0], p_data->conn_chg.peer_addr[1],
1227                       p_data->conn_chg.peer_addr[2],
1228                       p_data->conn_chg.peer_addr[3], p_data->conn_chg.peer_addr[4],
1229                       p_data->conn_chg.peer_addr[5]);
1230                if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0)
1231                {
1232                    /* AVRCP is already connected.
1233                     * need to update the association betwen SCB and RCB */
1234                    p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
1235                    p_lcb_rc->lidx = 0;
1236                    p_scb->rc_handle = p_cb->rc_acp_handle;
1237                    p_rcb = &p_cb->rcb[p_cb->rc_acp_idx - 1];
1238                    p_rcb->shdl = bta_av_get_shdl(p_scb);
1239                    APPL_TRACE_DEBUG3("update rc_acp shdl:%d/%d srch:%d", index + 1, p_rcb->shdl,
1240                                      p_scb->rc_handle );
1241
1242                    p_rcb2 = bta_av_get_rcb_by_shdl(p_rcb->shdl);
1243                    if (p_rcb2)
1244                    {
1245                        /* found the RCB that was created to associated with this SCB */
1246                        p_cb->rc_acp_handle = p_rcb2->handle;
1247                        p_cb->rc_acp_idx = (p_rcb2 - p_cb->rcb) + 1;
1248                        APPL_TRACE_DEBUG2("new rc_acp_handle:%d, idx:%d", p_cb->rc_acp_handle,
1249                                           p_cb->rc_acp_idx);
1250                        p_rcb2->lidx = (BTA_AV_NUM_LINKS + 1);
1251                        APPL_TRACE_DEBUG3("rc2 handle:%d lidx:%d/%d",p_rcb2->handle, p_rcb2->lidx,
1252                                          p_cb->lcb[p_rcb2->lidx-1].lidx);
1253                    }
1254                    p_rcb->lidx = p_lcb->lidx;
1255                    APPL_TRACE_DEBUG3("rc handle:%d lidx:%d/%d",p_rcb->handle, p_rcb->lidx,
1256                                      p_cb->lcb[p_rcb->lidx-1].lidx);
1257                }
1258            }
1259        }
1260    }
1261    else
1262    {
1263        if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
1264        {
1265            /* this channel is still marked as open. decrease the count */
1266            bta_av_cb.audio_open_cnt--;
1267        }
1268
1269        /* clear the conned mask for this channel */
1270        p_cb->conn_audio &= ~mask;
1271        p_cb->conn_video &= ~mask;
1272        if(p_scb)
1273        {
1274            /* the stream is closed.
1275             * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
1276            bdcpy(p_scb->peer_addr, bd_addr_null);
1277            if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
1278            {
1279                if(p_lcb)
1280                {
1281                    p_lcb->conn_msk &= ~conn_msk;
1282                }
1283                /* audio channel is down. make sure the INT channel is down */
1284                /* just in case the RC timer is active
1285                if(p_cb->features & BTA_AV_FEAT_RCCT) */
1286                {
1287                    bta_sys_stop_timer(&p_scb->timer);
1288                }
1289                /* one audio channel goes down. check if we need to restore high priority */
1290                chk_restore = TRUE;
1291            }
1292        }
1293
1294        APPL_TRACE_DEBUG1("bta_av_conn_chg shdl:%d", index + 1);
1295        for (i=0; i<BTA_AV_NUM_RCB; i++)
1296        {
1297            APPL_TRACE_DEBUG5("conn_chg dn[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
1298                              bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
1299                              bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
1300            if(bta_av_cb.rcb[i].shdl == index + 1)
1301            {
1302                bta_av_del_rc(&bta_av_cb.rcb[i]);
1303                break;
1304            }
1305        }
1306
1307        if(p_cb->conn_audio == 0 && p_cb->conn_video == 0)
1308        {
1309            /* if both channels are not connected,
1310             * close all RC channels */
1311            bta_av_close_all_rc(p_cb);
1312        }
1313
1314        /* if the AVRCP is no longer listening, create the listening channel */
1315        if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
1316            bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
1317    }
1318
1319    APPL_TRACE_DEBUG6("bta_av_conn_chg audio:%x video:%x up:%d conn_msk:0x%x chk_restore:%d audio_open_cnt:%d",
1320        p_cb->conn_audio, p_cb->conn_video, p_data->conn_chg.is_up, conn_msk, chk_restore, p_cb->audio_open_cnt);
1321
1322    if (chk_restore)
1323    {
1324        if (p_cb->audio_open_cnt == 1)
1325        {
1326            /* one audio channel goes down and there's one audio channel remains open.
1327             * restore the switch role in default link policy */
1328            bta_sys_set_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
1329            /* allow role switch, if this is the last connection */
1330            bta_av_restore_switch();
1331        }
1332        if (p_cb->audio_open_cnt)
1333        {
1334            /* adjust flush timeout settings to longer period */
1335            for (i=0; i<BTA_AV_NUM_STRS; i++)
1336            {
1337                p_scbi = bta_av_cb.p_scb[i];
1338                if (p_scbi && p_scbi->chnl == BTA_AV_CHNL_AUDIO && p_scbi->co_started)
1339                {
1340                    /* may need to update the flush timeout of this already started stream */
1341                    if (p_scbi->co_started != bta_av_cb.audio_open_cnt)
1342                    {
1343                        p_scbi->co_started = bta_av_cb.audio_open_cnt;
1344                        L2CA_SetFlushTimeout(p_scbi->peer_addr, p_bta_av_cfg->p_audio_flush_to[p_scbi->co_started - 1] );
1345                    }
1346                }
1347            }
1348        }
1349    }
1350}
1351
1352/*******************************************************************************
1353**
1354** Function         bta_av_disable
1355**
1356** Description      disable AV.
1357**
1358** Returns          void
1359**
1360*******************************************************************************/
1361void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
1362{
1363    BT_HDR  hdr;
1364    UINT16  xx;
1365
1366    p_cb->disabling = TRUE;
1367
1368    bta_av_close_all_rc(p_cb);
1369
1370    utl_freebuf((void **) &p_cb->p_disc_db);
1371
1372    /* disable audio/video - de-register all channels,
1373     * expect BTA_AV_DEREG_COMP_EVT when deregister is complete */
1374    for(xx=0; xx<BTA_AV_NUM_STRS; xx++)
1375    {
1376        hdr.layer_specific = xx + 1;
1377        bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
1378    }
1379}
1380
1381/*******************************************************************************
1382**
1383** Function         bta_av_api_disconnect
1384**
1385** Description      .
1386**
1387** Returns          void
1388**
1389*******************************************************************************/
1390void bta_av_api_disconnect(tBTA_AV_DATA *p_data)
1391{
1392    AVDT_DisconnectReq(p_data->api_discnt.bd_addr, bta_av_conn_cback);
1393    bta_sys_stop_timer(&bta_av_cb.sig_tmr);
1394}
1395
1396/*******************************************************************************
1397**
1398** Function         bta_av_sig_chg
1399**
1400** Description      process AVDT signal channel up/down.
1401**
1402** Returns          void
1403**
1404*******************************************************************************/
1405void bta_av_sig_chg(tBTA_AV_DATA *p_data)
1406{
1407    UINT16 event = p_data->str_msg.hdr.layer_specific;
1408    tBTA_AV_CB   *p_cb = &bta_av_cb;
1409    int     xx;
1410    UINT8   mask;
1411    tBTA_AV_LCB *p_lcb = NULL;
1412
1413    APPL_TRACE_DEBUG1("bta_av_sig_chg event: %d", event);
1414    if(event == AVDT_CONNECT_IND_EVT)
1415    {
1416        p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FIND);
1417        if(!p_lcb)
1418        {
1419            /* if the address does not have an LCB yet, alloc one */
1420            for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
1421            {
1422                mask = 1 << xx;
1423                APPL_TRACE_DEBUG1("conn_lcb: 0x%x", p_cb->conn_lcb);
1424
1425                /* look for a p_lcb with its p_scb registered */
1426                if((!(mask & p_cb->conn_lcb)) && (p_cb->p_scb[xx] != NULL))
1427                {
1428                    p_lcb = &p_cb->lcb[xx];
1429                    p_lcb->lidx = xx + 1;
1430                    bdcpy(p_lcb->addr, p_data->str_msg.bd_addr);
1431                    p_lcb->conn_msk = 0; /* clear the connect mask */
1432                    /* start listening when the signal channel is open */
1433                    if (p_cb->features & BTA_AV_FEAT_RCTG)
1434                    {
1435                        bta_av_rc_create(p_cb, AVCT_ACP, 0, p_lcb->lidx);
1436                    }
1437                    /* this entry is not used yet. */
1438                    p_cb->conn_lcb |= mask;     /* mark it as used */
1439                    APPL_TRACE_DEBUG1("start sig timer %d", p_data->hdr.offset);
1440                    if (p_data->hdr.offset == AVDT_ACP)
1441                    {
1442                        APPL_TRACE_DEBUG1("Incoming L2CAP acquired, set state as incoming", NULL);
1443                        bdcpy(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr);
1444                        p_cb->p_scb[xx]->use_rc = TRUE;     /* allowing RC for incoming connection */
1445                        bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_ACP_CONNECT_EVT, p_data);
1446
1447                        /* The Pending Event should be sent as soon as the L2CAP signalling channel
1448                         * is set up, which is NOW. Earlier this was done only after
1449                         * BTA_AV_SIG_TIME_VAL milliseconds.
1450                         * The following function shall send the event and start the recurring timer
1451                         */
1452                        bta_av_sig_timer(NULL);
1453
1454                        /* Possible collision : need to avoid outgoing processing while the timer is running */
1455                        p_cb->p_scb[xx]->coll_mask = BTA_AV_COLL_INC_TMR;
1456
1457                        p_cb->acp_sig_tmr.param = (UINT32)xx;
1458                        p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK*)&bta_av_acp_sig_timer_cback;
1459                        bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
1460                    }
1461                    break;
1462                }
1463            }
1464
1465            /* check if we found something */
1466            if (xx == BTA_AV_NUM_LINKS)
1467            {
1468                /* We do not have scb for this avdt connection.     */
1469                /* Silently close the connection.                   */
1470                APPL_TRACE_ERROR0("av scb not available for avdt connection");
1471                AVDT_DisconnectReq (p_data->str_msg.bd_addr, NULL);
1472                return;
1473            }
1474        }
1475    }
1476#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
1477    else if (event == BTA_AR_AVDT_CONN_EVT)
1478    {
1479        bta_sys_stop_timer(&bta_av_cb.sig_tmr);
1480    }
1481#endif
1482    else
1483    {
1484        /* disconnected. */
1485        p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FREE);
1486        if(p_lcb && p_lcb->conn_msk)
1487        {
1488            APPL_TRACE_DEBUG1("conn_msk: 0x%x", p_lcb->conn_msk);
1489            /* clean up ssm  */
1490            for(xx=0; xx < BTA_AV_NUM_STRS; xx++)
1491            {
1492                mask = 1 << (xx + 1);
1493                if ((mask & p_lcb->conn_msk) && (p_cb->p_scb[xx]) &&
1494                    (bdcmp(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr) == 0))
1495                {
1496                    bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_AVDT_DISCONNECT_EVT, NULL);
1497                }
1498            }
1499        }
1500    }
1501    APPL_TRACE_DEBUG1("conn_lcb: 0x%x", p_cb->conn_lcb);
1502}
1503
1504/*******************************************************************************
1505**
1506** Function         bta_av_sig_timer
1507**
1508** Description      process the signal channel timer. This timer is started
1509**                  when the AVDTP signal channel is connected. If no profile
1510**                  is connected, the timer goes off every BTA_AV_SIG_TIME_VAL
1511**
1512** Returns          void
1513**
1514*******************************************************************************/
1515void bta_av_sig_timer(tBTA_AV_DATA *p_data)
1516{
1517    tBTA_AV_CB   *p_cb = &bta_av_cb;
1518    int     xx;
1519    UINT8   mask;
1520    tBTA_AV_LCB *p_lcb = NULL;
1521    tBTA_AV_PEND pend;
1522
1523    APPL_TRACE_DEBUG0("bta_av_sig_timer");
1524    for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
1525    {
1526        mask = 1 << xx;
1527        if(mask & p_cb->conn_lcb)
1528        {
1529            /* this entry is used. check if it is connected */
1530            p_lcb = &p_cb->lcb[xx];
1531            if(!p_lcb->conn_msk)
1532            {
1533                bta_sys_start_timer(&p_cb->sig_tmr, BTA_AV_SIG_TIMER_EVT, BTA_AV_SIG_TIME_VAL);
1534                bdcpy(pend.bd_addr, p_lcb->addr);
1535                (*p_cb->p_cback)(BTA_AV_PENDING_EVT, (tBTA_AV *) &pend);
1536            }
1537        }
1538    }
1539}
1540
1541/*******************************************************************************
1542**
1543** Function         bta_av_acp_sig_timer_cback
1544**
1545** Description      Process the timeout when SRC is accepting connection
1546**                  and SNK did not start signalling.
1547**
1548** Returns          void
1549**
1550*******************************************************************************/
1551static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle)
1552{
1553    UINT8   inx = (UINT8)p_tle->param;
1554    tBTA_AV_CB  *p_cb = &bta_av_cb;
1555    tBTA_AV_SCB *p_scb = p_cb->p_scb[inx];
1556    tBTA_AV_API_OPEN  *p_buf;
1557
1558    if (p_scb)
1559    {
1560        APPL_TRACE_DEBUG1("bta_av_acp_sig_timer_cback, coll_mask = 0x%02X", p_scb->coll_mask);
1561
1562        if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)
1563        {
1564            p_scb->coll_mask &= ~BTA_AV_COLL_INC_TMR;
1565
1566            if (bta_av_is_scb_opening(p_scb))
1567            {
1568                if (p_scb->p_disc_db)
1569                {
1570                    /* We are still doing SDP. Run the timer again. */
1571                    p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;
1572
1573                    p_cb->acp_sig_tmr.param = (UINT32)inx;
1574                    p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK *)&bta_av_acp_sig_timer_cback;
1575                    bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
1576                }
1577                else
1578                {
1579                    /* SNK did not start signalling, resume signalling process. */
1580                    bta_av_discover_req (p_scb, NULL);
1581                }
1582            }
1583            else if (bta_av_is_scb_incoming(p_scb))
1584            {
1585                /* Stay in incoming state if SNK does not start signalling */
1586
1587                /* API open was called right after SNK opened L2C connection. */
1588                if (p_scb->coll_mask & BTA_AV_COLL_API_CALLED)
1589                {
1590                    p_scb->coll_mask &= ~BTA_AV_COLL_API_CALLED;
1591
1592                    /* BTA_AV_API_OPEN_EVT */
1593                    if ((p_buf = (tBTA_AV_API_OPEN *) GKI_getbuf(sizeof(tBTA_AV_API_OPEN))) != NULL)
1594                    {
1595                        memcpy(p_buf, &(p_scb->open_api), sizeof(tBTA_AV_API_OPEN));
1596                        bta_sys_sendmsg(p_buf);
1597                    }
1598                }
1599            }
1600        }
1601    }
1602}
1603
1604/*******************************************************************************
1605**
1606** Function         bta_av_check_peer_features
1607**
1608** Description      check supported features on the peer device from the SDP record
1609**                  and return the feature mask
1610**
1611** Returns          tBTA_AV_FEAT peer device feature mask
1612**
1613*******************************************************************************/
1614tBTA_AV_FEAT bta_av_check_peer_features (UINT16 service_uuid)
1615{
1616    tBTA_AV_FEAT peer_features = 0;
1617    tBTA_AV_CB   *p_cb = &bta_av_cb;
1618    tSDP_DISC_REC       *p_rec = NULL;
1619    tSDP_DISC_ATTR      *p_attr;
1620    UINT16              peer_rc_version=0;
1621    UINT16              categories = 0;
1622
1623    APPL_TRACE_DEBUG1("bta_av_check_peer_features service_uuid:x%x", service_uuid);
1624    /* loop through all records we found */
1625    while (TRUE)
1626    {
1627        /* get next record; if none found, we're done */
1628        if ((p_rec = SDP_FindServiceInDb(p_cb->p_disc_db, service_uuid, p_rec)) == NULL)
1629        {
1630            break;
1631        }
1632
1633        if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_CLASS_ID_LIST)) != NULL)
1634        {
1635            /* find peer features */
1636            if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL))
1637            {
1638                peer_features |= BTA_AV_FEAT_RCCT;
1639            }
1640            if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REM_CTRL_TARGET, NULL))
1641            {
1642                peer_features |= BTA_AV_FEAT_RCTG;
1643            }
1644        }
1645
1646        if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST)) != NULL)
1647        {
1648            /* get profile version (if failure, version parameter is not updated) */
1649            SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL, &peer_rc_version);
1650            APPL_TRACE_DEBUG1("peer_rc_version 0x%x", peer_rc_version);
1651
1652            if (peer_rc_version >= AVRC_REV_1_3)
1653                peer_features |= (BTA_AV_FEAT_VENDOR | BTA_AV_FEAT_METADATA);
1654
1655            if (peer_rc_version >= AVRC_REV_1_4)
1656            {
1657                peer_features |= (BTA_AV_FEAT_ADV_CTRL);
1658                /* get supported categories */
1659                if ((p_attr = SDP_FindAttributeInRec(p_rec,
1660                                ATTR_ID_SUPPORTED_FEATURES)) != NULL)
1661                {
1662                    categories = p_attr->attr_value.v.u16;
1663                    if (categories & AVRC_SUPF_CT_BROWSE)
1664                        peer_features |= (BTA_AV_FEAT_BROWSE);
1665                }
1666            }
1667        }
1668    }
1669    APPL_TRACE_DEBUG1("peer_features:x%x", peer_features);
1670    return peer_features;
1671}
1672
1673/*******************************************************************************
1674**
1675** Function         bta_av_rc_disc_done
1676**
1677** Description      Handle AVRCP service discovery results.  If matching
1678**                  service found, open AVRCP connection.
1679**
1680** Returns          void
1681**
1682*******************************************************************************/
1683void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
1684{
1685    tBTA_AV_CB   *p_cb = &bta_av_cb;
1686    tBTA_AV_SCB  *p_scb = NULL;
1687    tBTA_AV_LCB  *p_lcb;
1688    tBTA_AV_RC_OPEN rc_open;
1689    tBTA_AV_RC_FEAT rc_feat;
1690    UINT8               rc_handle;
1691    tBTA_AV_FEAT        peer_features;  /* peer features mask */
1692
1693    APPL_TRACE_DEBUG1("bta_av_rc_disc_done disc:x%x", p_cb->disc);
1694    if (!p_cb->disc)
1695    {
1696        return;
1697    }
1698
1699    if ((p_cb->disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
1700    {
1701        /* this is the rc handle/index to tBTA_AV_RCB */
1702        rc_handle = p_cb->disc & (~BTA_AV_CHNL_MSK);
1703    }
1704    else
1705    {
1706        p_scb = p_cb->p_scb[(p_cb->disc & BTA_AV_HNDL_MSK) - 1];
1707        if (p_scb)
1708            rc_handle = p_scb->rc_handle;
1709        else
1710        {
1711            p_cb->disc = 0;
1712            return;
1713        }
1714    }
1715
1716    APPL_TRACE_DEBUG1("rc_handle %d", rc_handle);
1717    /* check peer version and whether support CT and TG role */
1718    peer_features = bta_av_check_peer_features (UUID_SERVCLASS_AV_REMOTE_CONTROL);
1719    if ((p_cb->features & BTA_AV_FEAT_ADV_CTRL) && ((peer_features&BTA_AV_FEAT_ADV_CTRL) == 0))
1720    {
1721        /* if we support advance control and peer does not, check their support on TG role
1722         * some implementation uses 1.3 on CT ans 1.4 on TG */
1723        peer_features |= bta_av_check_peer_features (UUID_SERVCLASS_AV_REM_CTRL_TARGET);
1724    }
1725
1726    p_cb->disc = 0;
1727    utl_freebuf((void **) &p_cb->p_disc_db);
1728
1729    APPL_TRACE_DEBUG2("peer_features 0x%x, features 0x%x", peer_features, p_cb->features);
1730
1731    /* if we have no rc connection */
1732    if (rc_handle == BTA_AV_RC_HANDLE_NONE)
1733    {
1734        if (p_scb)
1735        {
1736            /* if peer remote control service matches ours and USE_RC is TRUE */
1737            if ((((p_cb->features & BTA_AV_FEAT_RCCT) && (peer_features & BTA_AV_FEAT_RCTG)) ||
1738                 ((p_cb->features & BTA_AV_FEAT_RCTG) && (peer_features & BTA_AV_FEAT_RCCT))) )
1739            {
1740                p_lcb = bta_av_find_lcb(p_scb->peer_addr, BTA_AV_LCB_FIND);
1741                if(p_lcb)
1742                {
1743                    rc_handle = bta_av_rc_create(p_cb, AVCT_INT, (UINT8)(p_scb->hdi + 1), p_lcb->lidx);
1744                    p_cb->rcb[rc_handle].peer_features = peer_features;
1745                }
1746#if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
1747                else
1748                {
1749                    APPL_TRACE_ERROR0("can not find LCB!!");
1750                }
1751#endif
1752            }
1753            else if(p_scb->use_rc)
1754            {
1755                /* can not find AVRC on peer device. report failure */
1756                p_scb->use_rc = FALSE;
1757                bdcpy(rc_open.peer_addr, p_scb->peer_addr);
1758                rc_open.peer_features = 0;
1759                rc_open.status = BTA_AV_FAIL_SDP;
1760                (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
1761            }
1762        }
1763    }
1764    else
1765    {
1766        p_cb->rcb[rc_handle].peer_features = peer_features;
1767        rc_feat.rc_handle =  rc_handle;
1768        rc_feat.peer_features = peer_features;
1769        (*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
1770    }
1771}
1772
1773/*******************************************************************************
1774**
1775** Function         bta_av_rc_closed
1776**
1777** Description      Set AVRCP state to closed.
1778**
1779** Returns          void
1780**
1781*******************************************************************************/
1782void bta_av_rc_closed(tBTA_AV_DATA *p_data)
1783{
1784    tBTA_AV_CB   *p_cb = &bta_av_cb;
1785    tBTA_AV_RC_CLOSE rc_close;
1786    tBTA_AV_RC_CONN_CHG *p_msg = (tBTA_AV_RC_CONN_CHG *)p_data;
1787    tBTA_AV_RCB    *p_rcb;
1788    tBTA_AV_SCB    *p_scb;
1789    int i;
1790    BOOLEAN conn = FALSE;
1791    tBTA_AV_LCB *p_lcb;
1792
1793    rc_close.rc_handle = BTA_AV_RC_HANDLE_NONE;
1794    APPL_TRACE_DEBUG1("bta_av_rc_closed rc_handle:%d", p_msg->handle);
1795    for(i=0; i<BTA_AV_NUM_RCB; i++)
1796    {
1797        p_rcb = &p_cb->rcb[i];
1798        APPL_TRACE_DEBUG3("bta_av_rc_closed rcb[%d] rc_handle:%d, status=0x%x", i, p_rcb->handle, p_rcb->status);
1799        if(p_rcb->handle == p_msg->handle)
1800        {
1801            rc_close.rc_handle = i;
1802            p_rcb->status &= ~BTA_AV_RC_CONN_MASK;
1803            p_rcb->peer_features = 0;
1804            APPL_TRACE_DEBUG2("       shdl:%d, lidx:%d", p_rcb->shdl, p_rcb->lidx);
1805            if(p_rcb->shdl)
1806            {
1807                p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
1808                if(p_scb)
1809                {
1810                    bdcpy(rc_close.peer_addr, p_scb->peer_addr);
1811                    if(p_scb->rc_handle == p_rcb->handle)
1812                        p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
1813                    APPL_TRACE_DEBUG2("shdl:%d, srch:%d", p_rcb->shdl, p_scb->rc_handle);
1814                }
1815                p_rcb->shdl = 0;
1816            }
1817            else if(p_rcb->lidx == (BTA_AV_NUM_LINKS + 1) )
1818            {
1819                /* if the RCB uses the extra LCB, use the addr for event and clean it */
1820                p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
1821                bdcpy(rc_close.peer_addr, p_msg->peer_addr);
1822                APPL_TRACE_DEBUG6("rc_only closed bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
1823                              p_msg->peer_addr[0], p_msg->peer_addr[1],
1824                              p_msg->peer_addr[2], p_msg->peer_addr[3],
1825                              p_msg->peer_addr[4], p_msg->peer_addr[5]);
1826                p_lcb->conn_msk = 0;
1827                p_lcb->lidx = 0;
1828            }
1829            p_rcb->lidx = 0;
1830
1831            if((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT)
1832            {
1833                /* AVCT CCB is deallocated */
1834                p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
1835                p_rcb->status = 0;
1836            }
1837            else
1838            {
1839                /* AVCT CCB is still there. dealloc */
1840                bta_av_del_rc(p_rcb);
1841
1842                /* if the AVRCP is no longer listening, create the listening channel */
1843                if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
1844                    bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
1845            }
1846        }
1847        else if((p_rcb->handle != BTA_AV_RC_HANDLE_NONE) && (p_rcb->status & BTA_AV_RC_CONN_MASK))
1848        {
1849            /* at least one channel is still connected */
1850            conn = TRUE;
1851        }
1852    }
1853
1854    if(!conn)
1855    {
1856        /* no AVRC channels are connected, go back to INIT state */
1857        bta_av_sm_execute(p_cb, BTA_AV_AVRC_NONE_EVT, NULL);
1858    }
1859
1860    if (rc_close.rc_handle == BTA_AV_RC_HANDLE_NONE)
1861    {
1862        rc_close.rc_handle = p_msg->handle;
1863        bdcpy(rc_close.peer_addr, p_msg->peer_addr);
1864    }
1865    (*p_cb->p_cback)(BTA_AV_RC_CLOSE_EVT, (tBTA_AV *) &rc_close);
1866}
1867
1868/*******************************************************************************
1869**
1870** Function         bta_av_rc_disc
1871**
1872** Description      start AVRC SDP discovery.
1873**
1874** Returns          void
1875**
1876*******************************************************************************/
1877void bta_av_rc_disc(UINT8 disc)
1878{
1879    tBTA_AV_CB   *p_cb = &bta_av_cb;
1880    tAVRC_SDP_DB_PARAMS db_params;
1881      UINT16              attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST,
1882                                       ATTR_ID_BT_PROFILE_DESC_LIST,
1883                                       ATTR_ID_SUPPORTED_FEATURES};
1884    UINT8       hdi;
1885    tBTA_AV_SCB *p_scb;
1886    UINT8       *p_addr = NULL;
1887    UINT8       rc_handle;
1888
1889    APPL_TRACE_DEBUG2("bta_av_rc_disc 0x%x, %d", disc, bta_av_cb.disc);
1890    if ((bta_av_cb.disc != 0) || (disc == 0))
1891        return;
1892
1893    if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
1894    {
1895        /* this is the rc handle/index to tBTA_AV_RCB */
1896        rc_handle = disc & (~BTA_AV_CHNL_MSK);
1897        if (p_cb->rcb[rc_handle].lidx)
1898        {
1899            p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx-1].addr;
1900        }
1901    }
1902    else
1903    {
1904        hdi = (disc & BTA_AV_HNDL_MSK) - 1;
1905        p_scb = p_cb->p_scb[hdi];
1906
1907        if (p_scb)
1908        {
1909            APPL_TRACE_DEBUG1("rc_handle %d", p_scb->rc_handle);
1910            p_addr = p_scb->peer_addr;
1911        }
1912    }
1913
1914    if (p_addr)
1915    {
1916        /* allocate discovery database */
1917        if (p_cb->p_disc_db == NULL)
1918        {
1919            p_cb->p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(BTA_AV_DISC_BUF_SIZE);
1920        }
1921
1922        if (p_cb->p_disc_db)
1923        {
1924            /* set up parameters */
1925            db_params.db_len = BTA_AV_DISC_BUF_SIZE;
1926            db_params.num_attr = 3;
1927            db_params.p_db = p_cb->p_disc_db;
1928            db_params.p_attrs = attr_list;
1929
1930            /* searching for UUID_SERVCLASS_AV_REMOTE_CONTROL gets both TG and CT */
1931            if (AVRC_FindService(UUID_SERVCLASS_AV_REMOTE_CONTROL, p_addr, &db_params,
1932                            bta_av_avrc_sdp_cback) == AVRC_SUCCESS)
1933            {
1934                p_cb->disc = disc;
1935                APPL_TRACE_DEBUG1("disc %d", p_cb->disc);
1936            }
1937        }
1938    }
1939}
1940
1941/*******************************************************************************
1942**
1943** Function         bta_av_dereg_comp
1944**
1945** Description      deregister complete. free the stream control block.
1946**
1947** Returns          void
1948**
1949*******************************************************************************/
1950void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
1951{
1952    tBTA_AV_CB   *p_cb = &bta_av_cb;
1953    tBTA_AV_SCB  *p_scb;
1954    tBTA_UTL_COD    cod;
1955    UINT8   mask;
1956    BT_HDR  *p_buf;
1957
1958    /* find the stream control block */
1959    p_scb = bta_av_hndl_to_scb(p_data->hdr.layer_specific);
1960
1961    if(p_scb)
1962    {
1963        APPL_TRACE_DEBUG2("deregistered %d(h%d)", p_scb->chnl, p_scb->hndl);
1964        mask = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
1965        if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
1966        {
1967            p_cb->reg_audio  &= ~mask;
1968            if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
1969            {
1970                /* this channel is still marked as open. decrease the count */
1971                bta_av_cb.audio_open_cnt--;
1972            }
1973            p_cb->conn_audio &= ~mask;
1974
1975            if (p_scb->q_tag == BTA_AV_Q_TAG_STREAM)
1976            {
1977            /* make sure no buffers are in q_info.a2d */
1978            while((p_buf = (BT_HDR*)GKI_dequeue (&p_scb->q_info.a2d)) != NULL)
1979                GKI_freebuf(p_buf);
1980            }
1981
1982            /* remove the A2DP SDP record, if no more audio stream is left */
1983            if(!p_cb->reg_audio)
1984            {
1985#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
1986                bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REMOTE_CONTROL, BTA_ID_AV);
1987#endif
1988                bta_av_del_sdp_rec(&p_cb->sdp_a2d_handle);
1989                bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
1990            }
1991        }
1992        else
1993        {
1994            p_cb->reg_video  &= ~mask;
1995            /* make sure that this channel is not connected */
1996            p_cb->conn_video &= ~mask;
1997            /* remove the VDP SDP record, (only one video stream at most) */
1998            bta_av_del_sdp_rec(&p_cb->sdp_vdp_handle);
1999            bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
2000        }
2001
2002        /* make sure that the timer is not active */
2003        bta_sys_stop_timer(&p_scb->timer);
2004        utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
2005    }
2006
2007    APPL_TRACE_DEBUG3("audio 0x%x, video: 0x%x, disable:%d",
2008        p_cb->reg_audio, p_cb->reg_video, p_cb->disabling);
2009    /* if no stream control block is active */
2010    if((p_cb->reg_audio + p_cb->reg_video) == 0)
2011    {
2012#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
2013        /* deregister from AVDT */
2014        bta_ar_dereg_avdt(BTA_ID_AV);
2015
2016        /* deregister from AVCT */
2017        bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REM_CTRL_TARGET, BTA_ID_AV);
2018        bta_ar_dereg_avct(BTA_ID_AV);
2019#endif
2020
2021        if(p_cb->disabling)
2022        {
2023            p_cb->disabling     = FALSE;
2024            bta_av_cb.features  = 0;
2025        }
2026
2027        /* Clear the Capturing service class bit */
2028        cod.service = BTM_COD_SERVICE_CAPTURING;
2029        utl_set_device_class(&cod, BTA_UTL_CLR_COD_SERVICE_CLASS);
2030    }
2031}
2032#endif /* BTA_AV_INCLUDED */
2033