btif_sock_rfc.c revision 181adbef76c194e257639daecb486bfc9a0ad037
1/******************************************************************************
2 *
3 *  Copyright (C) 2009-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/************************************************************************************
20 *
21 *  Filename:      btif_sock_rfc.c
22 *
23 *  Description:   Handsfree Profile Bluetooth Interface
24 *
25 ***********************************************************************************/
26#include <hardware/bluetooth.h>
27#include <hardware/bt_sock.h>
28#include <sys/types.h>
29#include <sys/socket.h>
30#include <errno.h>
31#include <sys/ioctl.h>
32
33#define LOG_TAG "BTIF_SOCK"
34#include "btif_common.h"
35#include "btif_util.h"
36
37#include "bd.h"
38
39#include "bta_api.h"
40#include "btif_sock_thread.h"
41#include "btif_sock_sdp.h"
42#include "btif_sock_util.h"
43
44#include "bt_target.h"
45#include "gki.h"
46#include "hcimsgs.h"
47#include "sdp_api.h"
48#include "btu.h"
49#include "btm_api.h"
50#include "btm_int.h"
51#include "bta_jv_api.h"
52#include "bta_jv_co.h"
53#include "port_api.h"
54
55#include <cutils/log.h>
56#include <hardware/bluetooth.h>
57#define asrt(s) if(!(s)) APPL_TRACE_ERROR3("## %s assert %s failed at line:%d ##",__FUNCTION__, #s, __LINE__)
58
59extern void uuid_to_string(bt_uuid_t *p_uuid, char *str);
60static inline void logu(const char* title, const uint8_t * p_uuid)
61{
62    char uuids[128];
63    uuid_to_string((bt_uuid_t*)p_uuid, uuids);
64    ALOGD("%s: %s", title, uuids);
65}
66
67
68
69#define MAX_RFC_CHANNEL 30
70#define MAX_RFC_SESSION BTA_JV_MAX_RFC_SR_SESSION //3 by default
71typedef struct {
72    int outgoing_congest : 1;
73    int pending_sdp_request : 1;
74    int doing_sdp_request : 1;
75    int server : 1;
76    int connected : 1;
77    int closing : 1;
78} flags_t;
79
80typedef struct {
81  flags_t f;
82  uint32_t id;
83  int security;
84  int scn;
85  bt_bdaddr_t addr;
86  uint8_t service_uuid[16];
87  char service_name[256];
88  int fd, app_fd;
89  int mtu;
90  uint8_t* packet;
91  int sdp_handle;
92  int rfc_handle;
93  int rfc_port_handle;
94  int role;
95  BUFFER_Q incoming_que;
96} rfc_slot_t;
97
98static rfc_slot_t rfc_slots[MAX_RFC_CHANNEL];
99static uint32_t rfc_slot_id;
100static volatile int pth = -1; //poll thread handle
101static void jv_dm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data);
102static void cleanup_rfc_slot(rfc_slot_t* rs);
103static inline void close_rfc_connection(int rfc_handle, int server);
104static bt_status_t dm_get_remote_service_record(bt_bdaddr_t *remote_addr,
105                                                    bt_uuid_t *uuid);
106static void *rfcomm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data);
107static inline BOOLEAN send_app_scn(rfc_slot_t* rs);
108static pthread_mutex_t slot_lock;
109#define is_init_done() (pth != -1)
110static inline void clear_slot_flag(flags_t* f)
111{
112    memset(f, 0, sizeof(*f));
113}
114
115static inline void bd_copy(UINT8* dest, UINT8* src, BOOLEAN swap)
116{
117    if (swap)
118    {
119        int i;
120        for (i =0; i < 6 ;i++)
121            dest[i]= src[5-i];
122    }
123    else memcpy(dest, src, 6);
124}
125static inline void free_gki_que(BUFFER_Q* q)
126{
127    while(!GKI_queue_is_empty(q))
128           GKI_freebuf(GKI_dequeue(q));
129}
130static void init_rfc_slots()
131{
132    int i;
133    memset(rfc_slots, 0, sizeof(rfc_slot_t)*MAX_RFC_CHANNEL);
134    for(i = 0; i < MAX_RFC_CHANNEL; i++)
135    {
136        rfc_slots[i].scn = -1;
137        rfc_slots[i].sdp_handle = 0;
138        rfc_slots[i].fd = rfc_slots[i].app_fd = -1;
139        GKI_init_q(&rfc_slots[i].incoming_que);
140    }
141    BTA_JvEnable(jv_dm_cback);
142    init_slot_lock(&slot_lock);
143}
144bt_status_t btsock_rfc_init(int poll_thread_handle)
145{
146    pth = poll_thread_handle;
147    init_rfc_slots();
148    return BT_STATUS_SUCCESS;
149}
150void btsock_rfc_cleanup()
151{
152    int curr_pth = pth;
153    pth = -1;
154    btsock_thread_exit(curr_pth);
155    lock_slot(&slot_lock);
156    int i;
157    for(i = 0; i < MAX_RFC_CHANNEL; i++)
158    {
159        if(rfc_slots[i].id)
160            cleanup_rfc_slot(&rfc_slots[i]);
161    }
162    unlock_slot(&slot_lock);
163}
164static inline rfc_slot_t* find_free_slot()
165{
166    int i;
167    for(i = 0; i < MAX_RFC_CHANNEL; i++)
168    {
169        if(rfc_slots[i].fd == -1)
170        {
171             return &rfc_slots[i];
172        }
173    }
174    return NULL;
175}
176static inline rfc_slot_t* find_rfc_slot_by_id(uint32_t id)
177{
178    int i;
179    if(id)
180    {
181        for(i = 0; i < MAX_RFC_CHANNEL; i++)
182        {
183            if(rfc_slots[i].id == id)
184            {
185                return &rfc_slots[i];
186            }
187        }
188    }
189    APPL_TRACE_WARNING1("invalid rfc slot id: %d", id);
190    return NULL;
191}
192static inline rfc_slot_t* find_rfc_slot_by_pending_sdp()
193{
194    uint32_t min_id = (uint32_t)-1;
195    int slot = -1;
196    int i;
197    for(i = 0; i < MAX_RFC_CHANNEL; i++)
198    {
199        if(rfc_slots[i].id && rfc_slots[i].f.pending_sdp_request)
200        {
201            if(rfc_slots[i].id < min_id)
202            {
203                min_id = rfc_slots[i].id;
204                slot = i;
205            }
206        }
207    }
208    if(0<= slot && slot < MAX_RFC_CHANNEL)
209        return &rfc_slots[slot];
210    return NULL;
211}
212static inline rfc_slot_t* find_rfc_slot_requesting_sdp()
213{
214    int i;
215    for(i = 0; i < MAX_RFC_CHANNEL; i++)
216    {
217        if(rfc_slots[i].id && rfc_slots[i].f.doing_sdp_request)
218                return &rfc_slots[i];
219    }
220    APPL_TRACE_DEBUG0("can not find any slot is requesting sdp");
221    return NULL;
222}
223
224static inline rfc_slot_t* find_rfc_slot_by_fd(int fd)
225{
226    int i;
227    if(fd >= 0)
228    {
229        for(i = 0; i < MAX_RFC_CHANNEL; i++)
230        {
231            if(rfc_slots[i].fd == fd)
232            {
233                if(rfc_slots[i].id)
234                    return &rfc_slots[i];
235                else
236                {
237                    APPL_TRACE_ERROR0("invalid rfc slot id, cannot be 0");
238                    break;
239                }
240            }
241        }
242    }
243    return NULL;
244}
245static rfc_slot_t* alloc_rfc_slot(const bt_bdaddr_t *addr, const char* name, const uint8_t* uuid, int channel, int flags, BOOLEAN server)
246{
247    int security = 0;
248    if(flags & BTSOCK_FLAG_ENCRYPT)
249        security |= server ? BTM_SEC_IN_ENCRYPT : BTM_SEC_OUT_ENCRYPT;
250    if(flags & BTSOCK_FLAG_AUTH)
251        security |= server ? BTM_SEC_IN_AUTHENTICATE : BTM_SEC_OUT_AUTHENTICATE;
252
253    rfc_slot_t* rs = find_free_slot();
254    if(rs)
255    {
256        int fds[2] = {-1, -1};
257        if(socketpair(AF_LOCAL, SOCK_STREAM, 0, fds))
258        {
259            APPL_TRACE_ERROR1("socketpair failed, errno:%d", errno);
260            return NULL;
261        }
262        rs->fd = fds[0];
263        rs->app_fd = fds[1];
264        rs->security = security;
265        rs->scn = channel;
266        if(uuid)
267            memcpy(rs->service_uuid, uuid, sizeof(rs->service_uuid));
268        else memset(rs->service_uuid, 0, sizeof(rs->service_uuid));
269        if(name && *name)
270            strncpy(rs->service_name, name, sizeof(rs->service_name) -1);
271        if(addr)
272            rs->addr = *addr;
273        ++rfc_slot_id;
274        if(rfc_slot_id == 0)
275            rfc_slot_id = 1; //skip 0 when wrapped
276        rs->id = rfc_slot_id;
277        rs->f.server = server;
278    }
279    return rs;
280}
281// rfc_slot_t* accept_rs = create_srv_accept_rfc_slot(srv_rs, p_open->rem_bda,p_opne->handle,  p_open->new_listen_handle);
282static inline rfc_slot_t* create_srv_accept_rfc_slot(rfc_slot_t* srv_rs, const bt_bdaddr_t* addr,
283                                        int open_handle, int new_listen_handle)
284{
285    rfc_slot_t *accept_rs = alloc_rfc_slot(addr, srv_rs->service_name, srv_rs->service_uuid, srv_rs->scn, 0, FALSE);
286    clear_slot_flag(&accept_rs->f);
287    accept_rs->f.server = FALSE;
288    accept_rs->f.connected = TRUE;
289    accept_rs->security = srv_rs->security;
290    accept_rs->mtu = srv_rs->mtu;
291    accept_rs->role = srv_rs->role;
292    accept_rs->rfc_handle = open_handle;
293    accept_rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(open_handle);
294     //now update listen rfc_handle of server slot
295    srv_rs->rfc_handle = new_listen_handle;
296    srv_rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(new_listen_handle);
297    BTIF_TRACE_DEBUG4("create_srv_accept__rfc_slot(open_handle: 0x%x, new_listen_handle:"
298            "0x%x) accept_rs->rfc_handle:0x%x, srv_rs_listen->rfc_handle:0x%x"
299      ,open_handle, new_listen_handle, accept_rs->rfc_port_handle, srv_rs->rfc_port_handle);
300    asrt(accept_rs->rfc_port_handle != srv_rs->rfc_port_handle);
301  //now swap the slot id
302    uint32_t new_listen_id = accept_rs->id;
303    accept_rs->id = srv_rs->id;
304    srv_rs->id = new_listen_id;
305    return accept_rs;
306}
307bt_status_t btsock_rfc_listen(const char* service_name, const uint8_t* service_uuid, int channel,
308                            int* sock_fd, int flags)
309{
310
311    APPL_TRACE_DEBUG1("btsock_rfc_listen, service_name:%s", service_name);
312    if(sock_fd == NULL || (service_uuid == NULL && (channel < 1 || channel > 30)))
313    {
314        APPL_TRACE_ERROR3("invalid rfc channel:%d or sock_fd:%p, uuid:%p", channel, sock_fd, service_uuid);
315        return BT_STATUS_PARM_INVALID;
316    }
317    *sock_fd = -1;
318    if(!is_init_done())
319        return BT_STATUS_NOT_READY;
320    if(is_uuid_empty(service_uuid))
321        service_uuid = UUID_SPP; //use serial port profile to listen to specified channel
322    else
323    {
324        //Check the service_uuid. overwrite the channel # if reserved
325        int reserved_channel = get_reserved_rfc_channel(service_uuid);
326        if(reserved_channel > 0)
327        {
328            channel = reserved_channel;
329        }
330    }
331    int status = BT_STATUS_FAIL;
332    lock_slot(&slot_lock);
333    rfc_slot_t* rs = alloc_rfc_slot(NULL, service_name, service_uuid, channel, flags, TRUE);
334    if(rs)
335    {
336        APPL_TRACE_DEBUG1("BTA_JvCreateRecordByUser:%s", service_name);
337        BTA_JvCreateRecordByUser((void *)rs->id);
338        *sock_fd = rs->app_fd;
339        rs->app_fd = -1; //the fd ownership is transferred to app
340        status = BT_STATUS_SUCCESS;
341        btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_EXCEPTION, rs->id);
342    }
343    unlock_slot(&slot_lock);
344    return status;
345}
346bt_status_t btsock_rfc_connect(const bt_bdaddr_t *bd_addr, const uint8_t* service_uuid,
347        int channel, int* sock_fd, int flags)
348{
349    if(sock_fd == NULL || (service_uuid == NULL && (channel < 1 || channel > 30)))
350    {
351        APPL_TRACE_ERROR3("invalid rfc channel:%d or sock_fd:%p, uuid:%p", channel, sock_fd,
352                          service_uuid);
353        return BT_STATUS_PARM_INVALID;
354    }
355    *sock_fd = -1;
356    if(!is_init_done())
357        return BT_STATUS_NOT_READY;
358    int status = BT_STATUS_FAIL;
359    lock_slot(&slot_lock);
360    rfc_slot_t* rs = alloc_rfc_slot(bd_addr, NULL, service_uuid, channel, flags, FALSE);
361    if(rs)
362    {
363        if(is_uuid_empty(service_uuid))
364        {
365            APPL_TRACE_DEBUG1("connecting to rfcomm channel:%d without service discovery", channel);
366            if(BTA_JvRfcommConnect(rs->security, rs->role, rs->scn, rs->addr.address,
367                        rfcomm_cback, (void*)rs->id) == BTA_JV_SUCCESS)
368            {
369                if(send_app_scn(rs))
370                {
371                    btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM,
372                                                        SOCK_THREAD_FD_RD, rs->id);
373                    *sock_fd = rs->app_fd;
374                    rs->app_fd = -1; //the fd ownership is transferred to app
375                    status = BT_STATUS_SUCCESS;
376                }
377                else cleanup_rfc_slot(rs);
378            }
379            else cleanup_rfc_slot(rs);
380        }
381        else
382        {
383            tSDP_UUID sdp_uuid;
384            sdp_uuid.len = 16;
385            memcpy(sdp_uuid.uu.uuid128, service_uuid, sizeof(sdp_uuid.uu.uuid128));
386            logu("service_uuid", service_uuid);
387            *sock_fd = rs->app_fd;
388            rs->app_fd = -1; //the fd ownership is transferred to app
389            status = BT_STATUS_SUCCESS;
390            rfc_slot_t* rs_doing_sdp = find_rfc_slot_requesting_sdp();
391            if(rs_doing_sdp == NULL)
392            {
393                BTA_JvStartDiscovery((UINT8*)bd_addr->address, 1, &sdp_uuid, (void*)rs->id);
394                rs->f.pending_sdp_request = FALSE;
395                rs->f.doing_sdp_request = TRUE;
396            }
397            else
398            {
399                rs->f.pending_sdp_request = TRUE;
400                rs->f.doing_sdp_request = FALSE;
401            }
402            btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_RD, rs->id);
403        }
404    }
405    unlock_slot(&slot_lock);
406    return status;
407}
408
409static int create_server_sdp_record(rfc_slot_t* rs)
410{
411    int scn = rs->scn;
412    if(rs->scn > 0)
413    {
414        if(BTM_TryAllocateSCN(rs->scn) == FALSE)
415        {
416            APPL_TRACE_ERROR1("rfc channel:%d already in use", scn);
417            return FALSE;
418        }
419    }
420    else if((rs->scn = BTM_AllocateSCN()) == 0)
421    {
422        APPL_TRACE_ERROR0("run out of rfc channels");
423        return FALSE;
424    }
425    if((rs->sdp_handle = add_rfc_sdp_rec(rs->service_name, rs->service_uuid, rs->scn)) <= 0)
426    {
427        return FALSE;
428    }
429    return TRUE;
430}
431const char * jv_evt[] = {
432    "BTA_JV_ENABLE_EVT",
433    "BTA_JV_SET_DISCOVER_EVT",
434    "BTA_JV_LOCAL_ADDR_EVT",
435    "BTA_JV_LOCAL_NAME_EVT",
436    "BTA_JV_REMOTE_NAME_EVT",
437    "BTA_JV_SET_ENCRYPTION_EVT",
438    "BTA_JV_GET_SCN_EVT",
439    "BTA_JV_GET_PSM_EVT",
440    "BTA_JV_DISCOVERY_COMP_EVT",
441    "BTA_JV_SERVICES_LEN_EVT",
442    "BTA_JV_SERVICE_SEL_EVT",
443    "BTA_JV_CREATE_RECORD_EVT",
444    "BTA_JV_UPDATE_RECORD_EVT",
445    "BTA_JV_ADD_ATTR_EVT",
446    "BTA_JV_DELETE_ATTR_EVT",
447    "BTA_JV_CANCEL_DISCVRY_EVT",
448
449    "BTA_JV_L2CAP_OPEN_EVT",
450    "BTA_JV_L2CAP_CLOSE_EVT",
451    "BTA_JV_L2CAP_START_EVT",
452    "BTA_JV_L2CAP_CL_INIT_EVT",
453    "BTA_JV_L2CAP_DATA_IND_EVT",
454    "BTA_JV_L2CAP_CONG_EVT",
455    "BTA_JV_L2CAP_READ_EVT",
456    "BTA_JV_L2CAP_RECEIVE_EVT",
457    "BTA_JV_L2CAP_WRITE_EVT",
458
459    "BTA_JV_RFCOMM_OPEN_EVT",
460    "BTA_JV_RFCOMM_CLOSE_EVT",
461    "BTA_JV_RFCOMM_START_EVT",
462    "BTA_JV_RFCOMM_CL_INIT_EVT",
463    "BTA_JV_RFCOMM_DATA_IND_EVT",
464    "BTA_JV_RFCOMM_CONG_EVT",
465    "BTA_JV_RFCOMM_READ_EVT",
466    "BTA_JV_RFCOMM_WRITE_EVT",
467    "BTA_JV_RFCOMM_SRV_OPEN_EVT", //  33 /* open status of Server RFCOMM connection */
468    "BTA_JV_MAX_EVT"
469};
470static inline void free_rfc_slot_scn(rfc_slot_t* rs)
471{
472    if(rs->scn > 0)
473    {
474        if(rs->f.server && !rs->f.closing && rs->rfc_handle)
475        {
476            BTA_JvRfcommStopServer(rs->rfc_handle, (void*)rs->id);
477            rs->rfc_handle = 0;
478        }
479        if(rs->f.server)
480            BTM_FreeSCN(rs->scn);
481        rs->scn = 0;
482    }
483}
484static void cleanup_rfc_slot(rfc_slot_t* rs)
485{
486    APPL_TRACE_DEBUG4("cleanup slot:%d, fd:%d, scn:%d, sdp_handle:0x%x", rs->id, rs->fd, rs->scn, rs->sdp_handle);
487    if(rs->fd != -1)
488    {
489        shutdown(rs->fd, 2);
490        close(rs->fd);
491        rs->fd = -1;
492    }
493    if(rs->app_fd != -1)
494    {
495        close(rs->app_fd);
496        rs->app_fd = -1;
497    }
498    if(rs->sdp_handle > 0)
499    {
500        del_rfc_sdp_rec(rs->sdp_handle);
501        rs->sdp_handle = 0;
502    }
503    if(rs->rfc_handle && !rs->f.closing && !rs->f.server)
504    {
505        APPL_TRACE_DEBUG1("closing rfcomm connection, rfc_handle:0x%x", rs->rfc_handle);
506        BTA_JvRfcommClose(rs->rfc_handle, (void*)rs->id);
507        rs->rfc_handle = 0;
508    }
509    free_rfc_slot_scn(rs);
510    free_gki_que(&rs->incoming_que);
511
512    rs->rfc_port_handle = 0;
513    //cleanup the flag
514    memset(&rs->f, 0, sizeof(rs->f));
515    rs->id = 0;
516}
517static inline BOOLEAN send_app_scn(rfc_slot_t* rs)
518{
519    if(sock_send_all(rs->fd, (const uint8_t*)&rs->scn, sizeof(rs->scn)) == sizeof(rs->scn))
520    {
521        return TRUE;
522    }
523
524    return FALSE;
525}
526static BOOLEAN send_app_connect_signal(int fd, const bt_bdaddr_t* addr, int channel, int status, int send_fd)
527{
528/*
529    typedef struct {
530    short size;
531    bt_bdaddr_t bd_addr;
532    int channel;
533    int status;
534} __attribute__((packed)) sock_connect_signal_t;
535*/
536    sock_connect_signal_t cs;
537    cs.size = sizeof(cs);
538    cs.bd_addr = *addr;
539    cs.channel = channel;
540    cs.status = status;
541    if(send_fd != -1)
542    {
543        if(sock_send_fd(fd, (const uint8_t*)&cs, sizeof(cs), send_fd) == sizeof(cs))
544            return TRUE;
545        else APPL_TRACE_ERROR2("sock_send_fd failed, fd:%d, send_fd:%d", fd, send_fd);
546    }
547    else if(sock_send_all(fd, (const uint8_t*)&cs, sizeof(cs)) == sizeof(cs))
548    {
549        return TRUE;
550    }
551    return FALSE;
552}
553static void on_cl_rfc_init(tBTA_JV_RFCOMM_CL_INIT *p_init, uint32_t id)
554{
555   lock_slot(&slot_lock);
556    rfc_slot_t* rs = find_rfc_slot_by_id(id);
557    if(rs)
558    {
559        if (p_init->status != BTA_JV_SUCCESS)
560            cleanup_rfc_slot(rs);
561        else
562        {
563            rs->rfc_handle = p_init->handle;
564        }
565    }
566    unlock_slot(&slot_lock);
567}
568static void  on_srv_rfc_listen_started(tBTA_JV_RFCOMM_START *p_start, uint32_t id)
569{
570    lock_slot(&slot_lock);
571    rfc_slot_t* rs = find_rfc_slot_by_id(id);
572    if(rs)
573    {
574        if (p_start->status != BTA_JV_SUCCESS)
575            cleanup_rfc_slot(rs);
576        else
577        {
578            rs->rfc_handle = p_start->handle;
579
580            if(!send_app_scn(rs))
581            {
582                //closed
583                APPL_TRACE_DEBUG1("send_app_scn() failed, close rs->id:%d", rs->id);
584                cleanup_rfc_slot(rs);
585            }
586        }
587    }
588    unlock_slot(&slot_lock);
589}
590static uint32_t on_srv_rfc_connect(tBTA_JV_RFCOMM_SRV_OPEN *p_open, uint32_t id)
591{
592    uint32_t new_listen_slot_id = 0;
593    lock_slot(&slot_lock);
594    rfc_slot_t* srv_rs = find_rfc_slot_by_id(id);
595    if(srv_rs)
596    {
597        rfc_slot_t* accept_rs = create_srv_accept_rfc_slot(srv_rs, (const bt_bdaddr_t*)p_open->rem_bda,
598                                                           p_open->handle, p_open->new_listen_handle);
599        if(accept_rs)
600        {
601            //start monitor the socket
602            btsock_thread_add_fd(pth, srv_rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_EXCEPTION, srv_rs->id);
603            btsock_thread_add_fd(pth, accept_rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_RD, accept_rs->id);
604            APPL_TRACE_DEBUG1("sending connect signal & app fd:%dto app server to accept() the connection",
605                             accept_rs->app_fd);
606            APPL_TRACE_DEBUG2("server fd:%d, scn:%d", srv_rs->fd, srv_rs->scn);
607            send_app_connect_signal(srv_rs->fd, &accept_rs->addr, srv_rs->scn, 0, accept_rs->app_fd);
608            accept_rs->app_fd = -1; //the fd is closed after sent to app
609            new_listen_slot_id = srv_rs->id;
610        }
611    }
612    unlock_slot(&slot_lock);
613    return new_listen_slot_id;
614}
615static void on_cli_rfc_connect(tBTA_JV_RFCOMM_OPEN *p_open, uint32_t id)
616{
617    lock_slot(&slot_lock);
618    rfc_slot_t* rs = find_rfc_slot_by_id(id);
619    if(rs && p_open->status == BTA_JV_SUCCESS)
620    {
621        rs->rfc_port_handle = BTA_JvRfcommGetPortHdl(p_open->handle);
622        bd_copy(rs->addr.address, p_open->rem_bda, 0);
623        //notify app rfc is connected
624        APPL_TRACE_DEBUG4("call send_app_connect_signal, slot id:%d, fd:%d, rfc scn:%d, server:%d",
625                         rs->id, rs->fd, rs->scn, rs->f.server);
626        if(send_app_connect_signal(rs->fd, &rs->addr, rs->scn, 0, -1))
627        {
628            //start monitoring the socketpair to get call back when app writing data
629            APPL_TRACE_DEBUG3("on_rfc_connect_ind, connect signal sent, slot id:%d, rfc scn:%d, server:%d",
630                             rs->id, rs->scn, rs->f.server);
631            rs->f.connected = TRUE;
632        }
633        else APPL_TRACE_ERROR0("send_app_connect_signal failed");
634    }
635    else if(rs)
636        cleanup_rfc_slot(rs);
637    unlock_slot(&slot_lock);
638}
639static void on_rfc_close(tBTA_JV_RFCOMM_CLOSE * p_close, uint32_t id)
640{
641    lock_slot(&slot_lock);
642    rfc_slot_t* rs = find_rfc_slot_by_id(id);
643    if(rs)
644    {
645        APPL_TRACE_DEBUG4("on_rfc_close, slot id:%d, fd:%d, rfc scn:%d, server:%d",
646                         rs->id, rs->fd, rs->scn, rs->f.server);
647        free_rfc_slot_scn(rs);
648        // rfc_handle already closed when receiving rfcomm close event from stack.
649        rs->f.connected = FALSE;
650        cleanup_rfc_slot(rs);
651    }
652    unlock_slot(&slot_lock);
653}
654static void on_rfc_write_done(tBTA_JV_RFCOMM_WRITE *p, uint32_t id)
655{
656    lock_slot(&slot_lock);
657    rfc_slot_t* rs = find_rfc_slot_by_id(id);
658    if(rs && !rs->f.outgoing_congest)
659    {
660        //mointer the fd for any outgoing data
661        btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_RD, rs->id);
662    }
663    unlock_slot(&slot_lock);
664}
665static void on_rfc_outgoing_congest(tBTA_JV_RFCOMM_CONG *p, uint32_t id)
666{
667    lock_slot(&slot_lock);
668    rfc_slot_t* rs = find_rfc_slot_by_id(id);
669    if(rs)
670    {
671        rs->f.outgoing_congest = p->cong ? 1 : 0;
672        //mointer the fd for any outgoing data
673        if(!rs->f.outgoing_congest)
674            btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_RD, rs->id);
675    }
676    unlock_slot(&slot_lock);
677}
678
679static void *rfcomm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data)
680{
681    int rc;
682    void* new_user_data = NULL;
683    APPL_TRACE_DEBUG1("event=%s", jv_evt[event]);
684
685    switch (event)
686    {
687    case BTA_JV_RFCOMM_START_EVT:
688        on_srv_rfc_listen_started(&p_data->rfc_start, (uint32_t)user_data);
689        break;
690
691    case BTA_JV_RFCOMM_CL_INIT_EVT:
692        on_cl_rfc_init(&p_data->rfc_cl_init, (uint32_t)user_data);
693        break;
694
695    case BTA_JV_RFCOMM_OPEN_EVT:
696        BTA_JvSetPmProfile(p_data->rfc_open.handle,BTA_JV_PM_ID_1,BTA_JV_CONN_OPEN);
697        on_cli_rfc_connect(&p_data->rfc_open, (uint32_t)user_data);
698        break;
699    case BTA_JV_RFCOMM_SRV_OPEN_EVT:
700        BTA_JvSetPmProfile(p_data->rfc_srv_open.handle,BTA_JV_PM_ALL,BTA_JV_CONN_OPEN);
701        new_user_data = (void*)on_srv_rfc_connect(&p_data->rfc_srv_open, (uint32_t)user_data);
702        break;
703
704    case BTA_JV_RFCOMM_CLOSE_EVT:
705        APPL_TRACE_DEBUG1("BTA_JV_RFCOMM_CLOSE_EVT: user_data:%d", (uint32_t)user_data);
706        on_rfc_close(&p_data->rfc_close, (uint32_t)user_data);
707        break;
708
709    case BTA_JV_RFCOMM_READ_EVT:
710        APPL_TRACE_DEBUG0("BTA_JV_RFCOMM_READ_EVT not used");
711        break;
712
713    case BTA_JV_RFCOMM_WRITE_EVT:
714        on_rfc_write_done(&p_data->rfc_write, (uint32_t)user_data);
715        break;
716
717    case BTA_JV_RFCOMM_DATA_IND_EVT:
718        APPL_TRACE_DEBUG0("BTA_JV_RFCOMM_DATA_IND_EVT not used");
719        break;
720
721    case BTA_JV_RFCOMM_CONG_EVT:
722        //on_rfc_cong(&p_data->rfc_cong);
723        on_rfc_outgoing_congest(&p_data->rfc_cong, (uint32_t)user_data);
724        break;
725    default:
726        APPL_TRACE_ERROR2("unhandled event %d, slot id:%d", event, (uint32_t)user_data);
727        break;
728    }
729    return new_user_data;
730}
731
732static void jv_dm_cback(tBTA_JV_EVT event, tBTA_JV *p_data, void *user_data)
733{
734    uint32_t id = (uint32_t)user_data;
735    APPL_TRACE_DEBUG2("jv_dm_cback: event:%d, slot id:%d", event, id);
736    switch(event)
737    {
738        case BTA_JV_CREATE_RECORD_EVT:
739            {
740                lock_slot(&slot_lock);
741                rfc_slot_t* rs = find_rfc_slot_by_id(id);
742                if(rs && create_server_sdp_record(rs))
743                {
744                    //now start the rfcomm server after sdp & channel # assigned
745                    BTA_JvRfcommStartServer(rs->security, rs->role, rs->scn, MAX_RFC_SESSION, rfcomm_cback,
746                                            (void*)rs->id);
747                }
748                else if(rs)
749                {
750                    APPL_TRACE_ERROR1("jv_dm_cback: cannot start server, slot found:%p", rs);
751                    cleanup_rfc_slot(rs);
752                }
753                unlock_slot(&slot_lock);
754                break;
755            }
756        case BTA_JV_DISCOVERY_COMP_EVT:
757            {
758                rfc_slot_t* rs = NULL;
759                lock_slot(&slot_lock);
760                if(p_data->disc_comp.status == BTA_JV_SUCCESS && p_data->disc_comp.scn)
761                {
762                    APPL_TRACE_DEBUG3("BTA_JV_DISCOVERY_COMP_EVT, slot id:%d, status:%d, scn:%d",
763                                      id, p_data->disc_comp.status, p_data->disc_comp.scn);
764
765                    rs = find_rfc_slot_by_id(id);
766                    if(rs && rs->f.doing_sdp_request)
767                    {
768                        if(BTA_JvRfcommConnect(rs->security, rs->role, p_data->disc_comp.scn, rs->addr.address,
769                                    rfcomm_cback, (void*)rs->id) == BTA_JV_SUCCESS)
770                        {
771                            rs->scn = p_data->disc_comp.scn;
772                            rs->f.doing_sdp_request = FALSE;
773                            if(!send_app_scn(rs))
774                                cleanup_rfc_slot(rs);
775                        }
776                        else cleanup_rfc_slot(rs);
777                    }
778                    else if(rs)
779                    {
780                        APPL_TRACE_ERROR3("DISCOVERY_COMP_EVT no pending sdp request, slot id:%d, \
781                                flag sdp pending:%d, flag sdp doing:%d",
782                                id, rs->f.pending_sdp_request, rs->f.doing_sdp_request);
783                    }
784                }
785                else
786                {
787                    APPL_TRACE_ERROR3("DISCOVERY_COMP_EVT slot id:%d, failed to find channle, \
788                                      status:%d, scn:%d", id, p_data->disc_comp.status,
789                                      p_data->disc_comp.scn);
790                    rs = find_rfc_slot_by_id(id);
791                    if(rs)
792                        cleanup_rfc_slot(rs);
793                }
794                rs = find_rfc_slot_by_pending_sdp();
795                if(rs)
796                {
797                    APPL_TRACE_DEBUG0("BTA_JV_DISCOVERY_COMP_EVT, start another pending scn sdp request");
798                    tSDP_UUID sdp_uuid;
799                    sdp_uuid.len = 16;
800                    memcpy(sdp_uuid.uu.uuid128, rs->service_uuid, sizeof(sdp_uuid.uu.uuid128));
801                    BTA_JvStartDiscovery((UINT8*)rs->addr.address, 1, &sdp_uuid, (void*)rs->id);
802                    rs->f.pending_sdp_request = FALSE;
803                    rs->f.doing_sdp_request = TRUE;
804                }
805                unlock_slot(&slot_lock);
806                break;
807            }
808        default:
809            APPL_TRACE_DEBUG2("unhandled event:%d, slot id:%d", event, id);
810            break;
811    }
812
813}
814#define SENT_ALL 2
815#define SENT_PARTIAL 1
816#define SENT_NONE 0
817#define SENT_FAILED (-1)
818static int send_data_to_app(int fd, BT_HDR *p_buf)
819{
820    if(p_buf->len == 0)
821        return SENT_ALL;
822    int sent = send(fd, (UINT8 *)(p_buf + 1) + p_buf->offset,  p_buf->len, MSG_DONTWAIT);
823    if(sent == p_buf->len)
824        return SENT_ALL;
825
826    if(sent > 0 && sent < p_buf->len)
827    {
828        //sent partial
829        APPL_TRACE_ERROR2("send partial, sent:%d, p_buf->len:%d", sent, p_buf->len);
830        p_buf->offset += sent;
831        p_buf->len -= sent;
832        return SENT_PARTIAL;
833
834    }
835    if(sent < 0 &&
836        (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
837    {
838        APPL_TRACE_ERROR1("send none, EAGAIN or EWOULDBLOCK, errno:%d", errno);
839        return SENT_NONE;
840    }
841    APPL_TRACE_ERROR3("unknown send() error, sent:%d, p_buf->len:%d,  errno:%d", sent, p_buf->len, errno);
842    return SENT_FAILED;
843}
844static BOOLEAN flush_incoming_que_on_wr_signal(rfc_slot_t* rs)
845{
846    while(!GKI_queue_is_empty(&rs->incoming_que))
847    {
848        BT_HDR *p_buf = GKI_dequeue(&rs->incoming_que);
849        int sent = send_data_to_app(rs->fd, p_buf);
850        switch(sent)
851        {
852            case SENT_NONE:
853            case SENT_PARTIAL:
854                //add it back to the queue at same position
855                GKI_enqueue_head (&rs->incoming_que, p_buf);
856                //monitor the fd to get callback when app is ready to receive data
857                btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_WR, rs->id);
858                return TRUE;
859            case SENT_ALL:
860                GKI_freebuf(p_buf);
861                break;
862            case SENT_FAILED:
863                GKI_freebuf(p_buf);
864                return FALSE;
865        }
866    }
867
868    //app is ready to receive data, tell stack to start the data flow
869    //fix me: need a jv flow control api to serialize the call in stack
870    APPL_TRACE_DEBUG3("enable data flow, rfc_handle:0x%x, rfc_port_handle:0x%x, user_id:%d",
871                        rs->rfc_handle, rs->rfc_port_handle, rs->id);
872    extern int PORT_FlowControl_MaxCredit(UINT16 handle, BOOLEAN enable);
873    PORT_FlowControl_MaxCredit(rs->rfc_port_handle, TRUE);
874    return TRUE;
875}
876void btsock_rfc_signaled(int fd, int flags, uint32_t user_id)
877{
878    lock_slot(&slot_lock);
879    rfc_slot_t* rs = find_rfc_slot_by_id(user_id);
880    if(rs)
881    {
882        APPL_TRACE_DEBUG3("rfc slot id:%d, fd:%d, flags:%x", rs->id, fd, flags);
883        BOOLEAN need_close = FALSE;
884        if(flags & SOCK_THREAD_FD_RD)
885        {
886            //data available from app, tell stack we have outgoing data
887            if(!rs->f.server)
888            {
889                if(rs->f.connected)
890                {
891                    int size = 0;
892                    //make sure there's data pending in case the peer closed the socket
893                    if(!(flags & SOCK_THREAD_FD_EXCEPTION) ||
894                                (ioctl(rs->fd, FIONREAD, &size) == 0 && size))
895                        BTA_JvRfcommWrite(rs->rfc_handle, (UINT32)rs->id);
896                }
897                else
898                {
899                    APPL_TRACE_ERROR2("SOCK_THREAD_FD_RD signaled when rfc is not connected, \
900                                      slot id:%d, channel:%d", rs->id, rs->scn);
901                    need_close = TRUE;
902                }
903            }
904        }
905        if(flags & SOCK_THREAD_FD_WR)
906        {
907            //app is ready to receive more data, tell stack to enable the data flow
908            if(!rs->f.connected || !flush_incoming_que_on_wr_signal(rs))
909            {
910                need_close = TRUE;
911                APPL_TRACE_ERROR2("SOCK_THREAD_FD_WR signaled when rfc is not connected \
912                                  or app closed fd, slot id:%d, channel:%d", rs->id, rs->scn);
913            }
914
915        }
916        if(need_close || (flags & SOCK_THREAD_FD_EXCEPTION))
917        {
918            int size = 0;
919            if(need_close || ioctl(rs->fd, FIONREAD, &size) != 0 || size == 0 )
920            {
921                //cleanup when no data pending
922                APPL_TRACE_DEBUG3("SOCK_THREAD_FD_EXCEPTION, cleanup, flags:%x, need_close:%d, pending size:%d",
923                                flags, need_close, size);
924                cleanup_rfc_slot(rs);
925            }
926            else
927                APPL_TRACE_DEBUG3("SOCK_THREAD_FD_EXCEPTION, cleanup pending, flags:%x, need_close:%d, pending size:%d",
928                                flags, need_close, size);
929        }
930    }
931    unlock_slot(&slot_lock);
932}
933
934int bta_co_rfc_data_incoming(void *user_data, BT_HDR *p_buf)
935{
936    uint32_t id = (uint32_t)user_data;
937    int ret = 0;
938    lock_slot(&slot_lock);
939    rfc_slot_t* rs = find_rfc_slot_by_id(id);
940    if(rs)
941    {
942
943        int sent = send_data_to_app(rs->fd, p_buf);
944        switch(sent)
945        {
946            case SENT_NONE:
947            case SENT_PARTIAL:
948                //add it to the end of the queue
949                GKI_enqueue(&rs->incoming_que, p_buf);
950                //monitor the fd to get callback when app is ready to receive data
951                btsock_thread_add_fd(pth, rs->fd, BTSOCK_RFCOMM, SOCK_THREAD_FD_WR, rs->id);
952                break;
953            case SENT_ALL:
954                GKI_freebuf(p_buf);
955                ret = 1;//enable the data flow
956                break;
957            case SENT_FAILED:
958                GKI_freebuf(p_buf);
959                cleanup_rfc_slot(rs);
960                break;
961        }
962     }
963    unlock_slot(&slot_lock);
964    return ret;//return 0 to disable data flow
965}
966int bta_co_rfc_data_outgoing_size(void *user_data, int *size)
967{
968    uint32_t id = (uint32_t)user_data;
969    int ret = FALSE;
970    *size = 0;
971    lock_slot(&slot_lock);
972    rfc_slot_t* rs = find_rfc_slot_by_id(id);
973    if(rs)
974    {
975        if(ioctl(rs->fd, FIONREAD, size) == 0)
976        {
977            APPL_TRACE_DEBUG2("ioctl read avaiable size:%d, fd:%d", *size, rs->fd);
978            ret = TRUE;
979        }
980        else
981        {
982            APPL_TRACE_ERROR2("ioctl FIONREAD error, errno:%d, fd:%d", errno, rs->fd);
983            cleanup_rfc_slot(rs);
984        }
985    }
986    else APPL_TRACE_ERROR1("bta_co_rfc_data_outgoing_size, invalid slot id:%d", id);
987    unlock_slot(&slot_lock);
988    return ret;
989}
990int bta_co_rfc_data_outgoing(void *user_data, UINT8* buf, UINT16 size)
991{
992    uint32_t id = (uint32_t)user_data;
993    int ret = FALSE;
994    lock_slot(&slot_lock);
995    rfc_slot_t* rs = find_rfc_slot_by_id(id);
996    if(rs)
997    {
998        int received = recv(rs->fd, buf, size, 0);
999        if(received == size)
1000            ret = TRUE;
1001        else
1002        {
1003            APPL_TRACE_ERROR4("recv error, errno:%d, fd:%d, size:%d, received:%d",
1004                             errno, rs->fd, size, received);
1005            cleanup_rfc_slot(rs);
1006        }
1007    }
1008    else APPL_TRACE_ERROR1("bta_co_rfc_data_outgoing, invalid slot id:%d", id);
1009    unlock_slot(&slot_lock);
1010    return ret;
1011}
1012
1013