avdt_scb_act.c revision 5738f83aeb59361a0a2eda2460113f6dc9194271
1/******************************************************************************
2 *
3 *  Copyright (C) 2002-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/******************************************************************************
20 *
21 *  This module contains the action functions associated with the stream
22 *  control block state machine.
23 *
24 ******************************************************************************/
25
26#include <string.h>
27#include "data_types.h"
28#include "bt_target.h"
29#include "avdt_api.h"
30#include "avdtc_api.h"
31#include "avdt_int.h"
32#include "gki.h"
33#include "btu.h"
34
35/* This table is used to lookup the callback event that matches a particular
36** state machine API request event.  Note that state machine API request
37** events are at the beginning of the event list starting at zero, thus
38** allowing for this table.
39*/
40const UINT8 avdt_scb_cback_evt[] = {
41    0,                          /* API_REMOVE_EVT (no event) */
42    AVDT_WRITE_CFM_EVT,         /* API_WRITE_REQ_EVT */
43    0,                          /* API_GETCONFIG_REQ_EVT (no event) */
44    0,                          /* API_DELAY_RPT_REQ_EVT (no event) */
45    AVDT_OPEN_CFM_EVT,          /* API_SETCONFIG_REQ_EVT */
46    AVDT_OPEN_CFM_EVT,          /* API_OPEN_REQ_EVT */
47    AVDT_CLOSE_CFM_EVT,         /* API_CLOSE_REQ_EVT */
48    AVDT_RECONFIG_CFM_EVT,      /* API_RECONFIG_REQ_EVT */
49    AVDT_SECURITY_CFM_EVT,      /* API_SECURITY_REQ_EVT */
50    0                           /* API_ABORT_REQ_EVT (no event) */
51};
52
53/* This table is used to look up the callback event based on the signaling
54** role when the stream is closed.
55*/
56const UINT8 avdt_scb_role_evt[] = {
57    AVDT_CLOSE_IND_EVT,         /* AVDT_CLOSE_ACP */
58    AVDT_CLOSE_CFM_EVT,         /* AVDT_CLOSE_INT */
59    AVDT_CLOSE_IND_EVT,         /* AVDT_OPEN_ACP */
60    AVDT_OPEN_CFM_EVT           /* AVDT_OPEN_INT */
61};
62
63/*******************************************************************************
64**
65** Function         avdt_scb_gen_ssrc
66**
67** Description      This function generates a SSRC number unique to the stream.
68**
69** Returns          SSRC value.
70**
71*******************************************************************************/
72UINT32 avdt_scb_gen_ssrc(tAVDT_SCB *p_scb)
73{
74    /* combine the value of the media type and codec type of the SCB */
75    return ((UINT32)(p_scb->cs.cfg.codec_info[1] | p_scb->cs.cfg.codec_info[2]));
76}
77
78/*******************************************************************************
79**
80** Function         avdt_scb_hdl_abort_cmd
81**
82** Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
83**                  to initiate sending of an abort response message.
84**
85** Returns          Nothing.
86**
87*******************************************************************************/
88void avdt_scb_hdl_abort_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
89{
90    p_scb->role = AVDT_CLOSE_ACP;
91    avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
92}
93
94/*******************************************************************************
95**
96** Function         avdt_scb_hdl_abort_rsp
97**
98** Description      This function is an empty function; it serves as a
99**                  placeholder for a conformance API action function.
100**
101** Returns          Nothing.
102**
103*******************************************************************************/
104void avdt_scb_hdl_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
105{
106    return;
107}
108
109/*******************************************************************************
110**
111** Function         avdt_scb_hdl_close_cmd
112**
113** Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
114**                  to initiate sending of a close response message.
115**
116** Returns          Nothing.
117**
118*******************************************************************************/
119void avdt_scb_hdl_close_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
120{
121    p_scb->role = AVDT_CLOSE_ACP;
122    avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
123}
124
125/*******************************************************************************
126**
127** Function         avdt_scb_hdl_close_rsp
128**
129** Description      This function sets the close_code variable to the error
130**                  code returned in the close response.
131**
132** Returns          Nothing.
133**
134*******************************************************************************/
135void avdt_scb_hdl_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
136{
137    p_scb->close_code = p_data->msg.hdr.err_code;
138}
139
140/*******************************************************************************
141**
142** Function         avdt_scb_hdl_getconfig_cmd
143**
144** Description      This function retrieves the configuration parameters of
145**                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
146**                  to initiate sending of a get configuration response message.
147**
148** Returns          Nothing.
149**
150*******************************************************************************/
151void avdt_scb_hdl_getconfig_cmd(tAVDT_SCB *p_scb,tAVDT_SCB_EVT *p_data)
152{
153    p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
154
155    avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
156}
157
158/*******************************************************************************
159**
160** Function         avdt_scb_hdl_getconfig_rsp
161**
162** Description      This function is an empty function; it serves as a
163**                  placeholder for a conformance API action function.
164**
165** Returns          Nothing.
166**
167*******************************************************************************/
168void avdt_scb_hdl_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
169{
170    return;
171}
172
173/*******************************************************************************
174**
175** Function         avdt_scb_hdl_open_cmd
176**
177** Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
178**                  to initiate sending of an open response message.
179**
180** Returns          Nothing.
181**
182*******************************************************************************/
183void avdt_scb_hdl_open_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
184{
185    avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
186}
187
188/*******************************************************************************
189**
190** Function         avdt_scb_hdl_open_rej
191**
192** Description      This function calls the application callback function
193**                  indicating the open request has failed.  It initializes
194**                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
195**                  to the CCB.
196**
197** Returns          Nothing.
198**
199*******************************************************************************/
200void avdt_scb_hdl_open_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
201{
202    /* do exactly same as setconfig reject */
203    avdt_scb_hdl_setconfig_rej(p_scb, p_data);
204}
205
206/*******************************************************************************
207**
208** Function         avdt_scb_hdl_open_rsp
209**
210** Description      This function calls avdt_ad_open_req() to initiate
211**                  connection of the transport channel for this stream.
212**
213** Returns          Nothing.
214**
215*******************************************************************************/
216void avdt_scb_hdl_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
217{
218    /* initiate opening of trans channels for this SEID */
219    p_scb->role = AVDT_OPEN_INT;
220    avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
221
222    /* start tc connect timer */
223    btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
224}
225
226/*******************************************************************************
227**
228** Function         avdt_scb_hdl_pkt_no_frag
229**
230** Description
231**
232** Returns          Nothing.
233**
234*******************************************************************************/
235void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
236{
237    UINT8   *p, *p_start;
238    UINT8   o_v, o_p, o_x, o_cc;
239    UINT8   m_pt;
240    UINT8   marker;
241    UINT16  seq;
242    UINT32  time_stamp;
243    UINT32  ssrc;
244    UINT16  offset;
245    UINT16  ex_len;
246    UINT8   pad_len = 0;
247
248    p = p_start = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
249
250    /* parse media packet header */
251    AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
252    AVDT_MSG_PRS_M_PT(p, m_pt, marker);
253    BE_STREAM_TO_UINT16(seq, p);
254    BE_STREAM_TO_UINT32(time_stamp, p);
255    BE_STREAM_TO_UINT32(ssrc, p);
256
257    /* skip over any csrc's in packet */
258    p += o_cc * 4;
259
260    /* check for and skip over extension header */
261    if (o_x)
262    {
263        p += 2;
264        BE_STREAM_TO_UINT16(ex_len, p);
265        p += ex_len * 4;
266    }
267
268    /* save our new offset */
269    offset = (UINT16) (p - p_start);
270
271    /* adjust length for any padding at end of packet */
272    if (o_p)
273    {
274        /* padding length in last byte of packet */
275        pad_len =  *(p_start + p_data->p_pkt->len);
276    }
277
278    /* do sanity check */
279    if ((offset > p_data->p_pkt->len) || ((pad_len + offset) > p_data->p_pkt->len))
280    {
281        AVDT_TRACE_WARNING0("Got bad media packet");
282        GKI_freebuf(p_data->p_pkt);
283    }
284    /* adjust offset and length and send it up */
285    else
286    {
287        p_data->p_pkt->len -= (offset + pad_len);
288        p_data->p_pkt->offset += offset;
289
290        if (p_scb->cs.p_data_cback != NULL)
291        {
292            /* report sequence number */
293            p_data->p_pkt->layer_specific = seq;
294            (*p_scb->cs.p_data_cback)(avdt_scb_to_hdl(p_scb), p_data->p_pkt,
295                time_stamp, (UINT8)(m_pt | (marker<<7)));
296        }
297        else
298        {
299#if AVDT_MULTIPLEXING == TRUE
300            if ((p_scb->cs.p_media_cback != NULL)
301             && (p_scb->p_media_buf != NULL)
302             && (p_scb->media_buf_len > p_data->p_pkt->len))
303            {
304                /* media buffer enough length is assigned by application. Lets use it*/
305                memcpy(p_scb->p_media_buf,(UINT8*)(p_data->p_pkt + 1) + p_data->p_pkt->offset,
306                    p_data->p_pkt->len);
307                (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb),p_scb->p_media_buf,
308                    p_scb->media_buf_len,time_stamp,seq,m_pt,marker);
309            }
310#endif
311            GKI_freebuf(p_data->p_pkt);
312        }
313    }
314}
315
316#if AVDT_REPORTING == TRUE
317/*******************************************************************************
318**
319** Function         avdt_scb_hdl_report
320**
321** Description
322**
323** Returns          Nothing.
324**
325*******************************************************************************/
326UINT8 * avdt_scb_hdl_report(tAVDT_SCB *p_scb, UINT8 *p, UINT16 len)
327{
328    UINT16  result = AVDT_SUCCESS;
329    UINT8   *p_start = p;
330    UINT32  ssrc;
331    UINT8   o_v, o_p, o_cc;
332    UINT16  pkt_len;
333    AVDT_REPORT_TYPE    pt;
334    tAVDT_REPORT_DATA   report, *p_rpt;
335
336    AVDT_TRACE_DEBUG0( "avdt_scb_hdl_report");
337    if(p_scb->cs.p_report_cback)
338    {
339        p_rpt = &report;
340        /* parse report packet header */
341        AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
342        pt = *p++;
343        BE_STREAM_TO_UINT16(pkt_len, p);
344        BE_STREAM_TO_UINT32(ssrc, p);
345
346        switch(pt)
347        {
348        case AVDT_RTCP_PT_SR:   /* the packet type - SR (Sender Report) */
349            BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
350            BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
351            BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
352            BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
353            BE_STREAM_TO_UINT32(report.sr.octet_count, p);
354            break;
355
356        case AVDT_RTCP_PT_RR:   /* the packet type - RR (Receiver Report) */
357            report.rr.frag_lost = *p;
358            BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
359            report.rr.packet_lost &= 0xFFFFFF;
360            BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
361            BE_STREAM_TO_UINT32(report.rr.jitter, p);
362            BE_STREAM_TO_UINT32(report.rr.lsr, p);
363            BE_STREAM_TO_UINT32(report.rr.dlsr, p);
364            break;
365
366        case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
367            if(*p == AVDT_RTCP_SDES_CNAME)
368            {
369                p_rpt = (tAVDT_REPORT_DATA *)(p+2);
370            }
371            else
372            {
373                AVDT_TRACE_WARNING5( " - SDES SSRC=0x%08x sc=%d %d len=%d %s",
374                    ssrc, o_cc, *p, *(p+1), p+2);
375                result = AVDT_BUSY;
376            }
377            break;
378
379        default:
380            AVDT_TRACE_ERROR1( "Bad Report pkt - packet type: %d", pt);
381            result = AVDT_BAD_PARAMS;
382        }
383
384        if(result == AVDT_SUCCESS)
385            (*p_scb->cs.p_report_cback)(avdt_scb_to_hdl(p_scb), pt, p_rpt);
386
387    }
388    p_start += len;
389    return p_start;
390}
391#endif
392
393#if AVDT_MULTIPLEXING == TRUE
394/*******************************************************************************
395**
396** Function         avdt_scb_hdl_pkt_frag
397**
398** Description
399**
400** Returns          Nothing.
401**
402*******************************************************************************/
403void avdt_scb_hdl_pkt_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
404{
405    /* Fields of Adaptation Layer Header */
406    UINT8   al_tsid,al_frag,al_lcode;
407    UINT16  al_len;
408    /* media header fields */
409    UINT8   o_v, o_p, o_x, o_cc;
410    UINT8   m_pt;
411    UINT8   marker;
412    UINT16  seq;
413    UINT32  time_stamp;
414    UINT32  ssrc;
415    UINT16  ex_len;
416    UINT8   pad_len;
417    /* other variables */
418    UINT8   *p; /* current pointer */
419    UINT8   *p_end; /* end of all packet */
420    UINT8   *p_payload; /* pointer to media fragment payload in the buffer */
421    UINT32  payload_len; /* payload length */
422    UINT16  frag_len; /* fragment length */
423
424    p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
425    p_end = p + p_data->p_pkt->len;
426    /* parse all fragments */
427    while(p < p_end)
428    {
429        if (p_end - p < 4) /* length check. maximum length of AL header = 4 */
430        {
431            AVDT_TRACE_WARNING2("p_end: 0x%x - p:0x%x < 4", p_end, p);
432            break;
433        }
434
435        /* parse first byte */
436        al_tsid = (*p)>>3;
437        al_frag = ( (*p) >> 2 ) & 0x01;
438        al_lcode = (*p++) & AVDT_ALH_LCODE_MASK;
439
440        /* in case of TSID=00000, a second AL header byte, before the length field,
441        ** is expected and contains the actual TSID, aligned with MSB */
442        if(al_tsid == 0)
443            al_tsid = *p++;
444
445        /* get remaining media length on base of lcode */
446        switch(al_lcode)
447        {
448        case AVDT_ALH_LCODE_NONE:  /* No length field present. Take length from l2cap */
449            al_len = (UINT16)(p_end - p);
450            break;
451        case AVDT_ALH_LCODE_16BIT:  /* 16 bit length field */
452            BE_STREAM_TO_UINT16(al_len, p);
453            break;
454        case AVDT_ALH_LCODE_9BITM0:  /* 9 bit length field, MSB = 0, 8 LSBs in 1 octet following */
455            al_len = *p++;
456            break;
457        default:    /* 9 bit length field, MSB = 1, 8 LSBs in 1 octet following */
458            al_len =(UINT16)*p++ + 0x100;
459        }
460
461        /* max fragment length */
462        frag_len = (UINT16)(p_end - p);
463        /* if it isn't last fragment */
464        if(frag_len >= al_len)
465            frag_len = al_len;
466
467        /* check TSID corresponds to config */
468        if (al_tsid != p_scb->curr_cfg.mux_tsid_media)
469        {
470#if AVDT_REPORTING == TRUE
471            if((p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) &&
472                (al_tsid == p_scb->curr_cfg.mux_tsid_report))
473            {
474                /* parse reporting packet */
475                p = avdt_scb_hdl_report(p_scb, p, frag_len);
476                continue;
477            }
478            else
479#endif
480            {
481                AVDT_TRACE_WARNING2("bad tsid: %d, mux_tsid_media:%d", al_tsid, p_scb->curr_cfg.mux_tsid_media);
482                break;
483            }
484        }
485        /* check are buffer for assembling and related callback set */
486        else if ((p_scb->p_media_buf == NULL) || (p_scb->cs.p_media_cback == NULL))
487        {
488            AVDT_TRACE_WARNING0("NULL p_media_buf or p_media_cback");
489            break;
490        }
491
492
493        /* it is media fragment beginning */
494        if(!al_frag) /* is it first fragment of original media packet */
495        {
496            AVDT_TRACE_DEBUG2("al:%d media:%d",
497                al_len, p_scb->media_buf_len);
498
499            p_scb->frag_off = 0;
500            p_scb->frag_org_len = al_len; /* total length of original media packet */
501            /* length check: minimum length of media header is 12 */
502            if (p_scb->frag_org_len < 12)
503            {
504                AVDT_TRACE_WARNING1("bad al_len: %d(<12)", al_len);
505                break;
506            }
507            /* check that data fit into buffer */
508            if (al_len > p_scb->media_buf_len)
509            {
510                AVDT_TRACE_WARNING2("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
511                break;
512            }
513            /* make sure it is the last fragment in l2cap packet */
514            if (p + al_len < p_end)
515            {
516                AVDT_TRACE_WARNING2("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
517                break;
518            }
519        }
520        else
521        {
522            AVDT_TRACE_DEBUG4("al:%d media:%d frag_org_len:%d frag_off:%d",
523                al_len, p_scb->media_buf_len, p_scb->frag_org_len, p_scb->frag_off);
524
525            /* check that remaining length from AL header equals to original len - length of already received fragments */
526            if(al_len != p_scb->frag_org_len - p_scb->frag_off)
527            {
528                AVDT_TRACE_WARNING4("al_len:%d != (frag_org_len:%d - frag_off:%d) %d",
529                    al_len, p_scb->frag_org_len, p_scb->frag_off,
530                    (p_scb->frag_org_len- p_scb->frag_off));
531                break;
532            }
533
534            /* do sanity check */
535            if (p_scb->frag_off == 0)
536            {
537                AVDT_TRACE_WARNING0("frag_off=0");
538                break;
539            }
540        }
541        /* do common sanity check */
542        if((p_scb->frag_org_len <= p_scb->frag_off) || (p_scb->frag_org_len >= p_scb->media_buf_len))
543        {
544            AVDT_TRACE_WARNING3("common sanity frag_off:%d frag_org_len:%d media_buf_len:%d",
545                p_scb->frag_off, p_scb->frag_org_len, p_scb->media_buf_len);
546            break;
547        }
548
549        AVDT_TRACE_DEBUG4("Received fragment org_len=%d off=%d al_len=%d frag_len=%d",
550            p_scb->frag_org_len, p_scb->frag_off, al_len, frag_len);
551
552        /* copy fragment into buffer */
553        memcpy(p_scb->p_media_buf + p_scb->frag_off, p, frag_len);
554        p_scb->frag_off += frag_len;
555        /* move to the next fragment */
556        p += frag_len;
557        /* if it is last fragment in original media packet then process total media pocket */
558        if(p_scb->frag_off == p_scb->frag_org_len)
559        {
560            p_payload = p_scb->p_media_buf;
561
562            /* media header */
563            AVDT_MSG_PRS_OCTET1(p_payload, o_v, o_p, o_x, o_cc);
564            AVDT_MSG_PRS_M_PT(p_payload, m_pt, marker);
565            BE_STREAM_TO_UINT16(seq, p_payload);
566            BE_STREAM_TO_UINT32(time_stamp, p_payload);
567            BE_STREAM_TO_UINT32(ssrc, p_payload);
568
569            /* skip over any csrc's in packet */
570            p_payload += o_cc * 4;
571
572            /* check for and skip over extension header */
573            if (o_x)
574            {
575                if(p_scb->p_media_buf + p_scb->frag_off - p_payload < 4)
576                {
577                    AVDT_TRACE_WARNING3("length check frag_off:%d p_media_buf:%d p_payload:%d",
578                        p_scb->frag_off, p_scb->p_media_buf, p_payload);
579                    break;/* length check */
580                }
581                p_payload += 2;
582                BE_STREAM_TO_UINT16(ex_len, p_payload);
583                p_payload += ex_len * 4;
584            }
585
586            if(p_payload >= p_scb->p_media_buf + p_scb->frag_off)
587            {
588                AVDT_TRACE_WARNING3("length check2 frag_off:%d p_media_buf:%d p_payload:%d",
589                    p_scb->frag_off, p_scb->p_media_buf, p_payload);
590                break;/* length check */
591            }
592
593            /* adjust length for any padding at end of packet */
594            if (o_p)
595            {
596                /* padding length in last byte of packet */
597                pad_len =  *(p_scb->p_media_buf + p_scb->frag_off - 1);
598            }
599            else
600                pad_len =  0;
601            /* payload length */
602            payload_len = (UINT32)(p_scb->p_media_buf + p_scb->frag_off - pad_len - p_payload);
603
604            AVDT_TRACE_DEBUG2("Received last fragment header=%d len=%d",
605                p_payload - p_scb->p_media_buf,payload_len);
606
607            /* send total media packet up */
608            if (p_scb->cs.p_media_cback != NULL)
609            {
610                (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb), p_payload,
611                                           payload_len, time_stamp, seq, m_pt, marker);
612            }
613        }
614    } /* while(p < p_end) */
615
616    if(p < p_end)
617    {
618        AVDT_TRACE_WARNING0("*** Got bad media packet");
619    }
620    GKI_freebuf(p_data->p_pkt);
621}
622#endif
623
624/*******************************************************************************
625**
626** Function         avdt_scb_hdl_pkt
627**
628** Description
629**
630** Returns          Nothing.
631**
632*******************************************************************************/
633void avdt_scb_hdl_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
634{
635#if AVDT_REPORTING == TRUE
636    UINT8 *p;
637#endif
638
639#if AVDT_MULTIPLEXING == TRUE
640    /* select right function in dependance of is fragmentation supported or not */
641    if( 0 != (p_scb->curr_cfg.psc_mask & AVDT_PSC_MUX))
642    {
643        avdt_scb_hdl_pkt_frag(p_scb, p_data);
644    }
645    else
646#endif
647#if AVDT_REPORTING == TRUE
648    if(p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT)
649    {
650        p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
651        avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
652        GKI_freebuf(p_data->p_pkt);
653    }
654    else
655#endif
656        avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
657}
658
659/*******************************************************************************
660**
661** Function         avdt_scb_drop_pkt
662**
663** Description      Drop an incoming media packet.  This function is called if
664**                  a media packet is received in any state besides streaming.
665**
666** Returns          Nothing.
667**
668*******************************************************************************/
669void avdt_scb_drop_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
670{
671    GKI_freebuf(p_data->p_pkt);
672    AVDT_TRACE_WARNING0("Dropped incoming media packet");
673}
674
675/*******************************************************************************
676**
677** Function         avdt_scb_hdl_reconfig_cmd
678**
679** Description      This function calls the application callback function
680**                  with a reconfiguration indication.
681**
682** Returns          Nothing.
683**
684*******************************************************************************/
685void avdt_scb_hdl_reconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
686{
687    /* if command not supported */
688    if (p_scb->cs.nsc_mask & AVDT_NSC_RECONFIG)
689    {
690        /* send reject */
691        p_data->msg.hdr.err_code = AVDT_ERR_NSC;
692        p_data->msg.hdr.err_param = 0;
693        avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
694    }
695    else
696    {
697        /* store requested configuration */
698        memcpy(&p_scb->req_cfg, p_data->msg.reconfig_cmd.p_cfg, sizeof(tAVDT_CFG));
699
700        /* call application callback */
701        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
702                                  NULL,
703                                  AVDT_RECONFIG_IND_EVT,
704                                  (tAVDT_CTRL *) &p_data->msg.reconfig_cmd);
705    }
706}
707
708/*******************************************************************************
709**
710** Function         avdt_scb_hdl_reconfig_rsp
711**
712** Description      This function calls the application callback function
713**                  with a reconfiguration confirm.
714**
715** Returns          Nothing.
716**
717*******************************************************************************/
718void avdt_scb_hdl_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
719{
720    if (p_data->msg.hdr.err_code == 0)
721    {
722        /* store new configuration */
723        if (p_scb->req_cfg.num_codec > 0)
724        {
725            p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
726            memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
727        }
728        if (p_scb->req_cfg.num_protect > 0)
729        {
730            p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
731            memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
732        }
733    }
734
735    p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
736
737    /* call application callback */
738    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
739                              NULL,
740                              AVDT_RECONFIG_CFM_EVT,
741                              (tAVDT_CTRL *) &p_data->msg.svccap);
742}
743
744/*******************************************************************************
745**
746** Function         avdt_scb_hdl_security_cmd
747**
748** Description      This function calls the application callback with a
749**                  security indication.
750**
751** Returns          Nothing.
752**
753*******************************************************************************/
754void avdt_scb_hdl_security_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
755{
756    /* if command not supported */
757    if (p_scb->cs.nsc_mask & AVDT_NSC_SECURITY)
758    {
759        /* send reject */
760        p_data->msg.hdr.err_code = AVDT_ERR_NSC;
761        avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
762    }
763    else
764    {
765        /* call application callback */
766        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
767                                  NULL,
768                                  AVDT_SECURITY_IND_EVT,
769                                  (tAVDT_CTRL *) &p_data->msg.security_cmd);
770    }
771}
772
773/*******************************************************************************
774**
775** Function         avdt_scb_hdl_security_rsp
776**
777** Description      This function calls the application callback with a
778**                  security confirm.
779**
780** Returns          Nothing.
781**
782*******************************************************************************/
783void avdt_scb_hdl_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
784{
785    /* call application callback */
786    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
787                              NULL,
788                              AVDT_SECURITY_CFM_EVT,
789                              (tAVDT_CTRL *) &p_data->msg.security_cmd);
790}
791
792/*******************************************************************************
793**
794** Function         avdt_scb_hdl_setconfig_cmd
795**
796** Description      This function marks the SCB as in use and copies the
797**                  configuration and peer SEID to the SCB.  It then calls
798**                  the application callback with a configuration indication.
799**
800** Returns          Nothing.
801**
802*******************************************************************************/
803void avdt_scb_hdl_setconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
804{
805    tAVDT_CFG *p_cfg;
806
807    if (!p_scb->in_use)
808    {
809        p_cfg = p_data->msg.config_cmd.p_cfg;
810        if(p_scb->cs.cfg.codec_info[AVDT_CODEC_TYPE_INDEX] == p_cfg->codec_info[AVDT_CODEC_TYPE_INDEX])
811        {
812            /* set sep as in use */
813            p_scb->in_use = TRUE;
814
815            /* copy info to scb */
816            p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
817            p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
818            memcpy(&p_scb->req_cfg, p_cfg, sizeof(tAVDT_CFG));
819            /* call app callback */
820            (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
821                                      p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
822                                      AVDT_CONFIG_IND_EVT,
823                                      (tAVDT_CTRL *) &p_data->msg.config_cmd);
824        }
825        else
826        {
827            p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
828            p_data->msg.hdr.err_param = 0;
829            avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
830                              p_data->msg.hdr.sig_id, &p_data->msg);
831        }
832    }
833    else
834    {
835        avdt_scb_rej_in_use(p_scb, p_data);
836    }
837}
838
839/*******************************************************************************
840**
841** Function         avdt_scb_hdl_setconfig_rej
842**
843** Description      This function marks the SCB as not in use and calls the
844**                  application callback with an open confirm indicating failure.
845**
846** Returns          Nothing.
847**
848*******************************************************************************/
849void avdt_scb_hdl_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
850{
851    /* clear scb variables */
852    avdt_scb_clr_vars(p_scb, p_data);
853
854    /* tell ccb we're done with signaling channel */
855    avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_CCB_UL_CLOSE_EVT, NULL);
856
857    /* call application callback */
858    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
859                              NULL,
860                              AVDT_OPEN_CFM_EVT,
861                              (tAVDT_CTRL *) &p_data->msg.hdr);
862}
863
864/*******************************************************************************
865**
866** Function         avdt_scb_hdl_setconfig_rsp
867**
868** Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
869**                  to initiate sending of an open command message.
870**
871** Returns          Nothing.
872**
873*******************************************************************************/
874void avdt_scb_hdl_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
875{
876    tAVDT_EVT_HDR   single;
877
878    if (p_scb->p_ccb != NULL)
879    {
880        /* save configuration */
881        memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
882
883        /* initiate open */
884        single.seid = p_scb->peer_seid;
885        avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, (tAVDT_SCB_EVT *) &single);
886    }
887}
888
889/*******************************************************************************
890**
891** Function         avdt_scb_hdl_start_cmd
892**
893** Description      This function calls the application callback with a
894**                  start indication.
895**
896** Returns          Nothing.
897**
898*******************************************************************************/
899void avdt_scb_hdl_start_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
900{
901    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
902                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
903                              AVDT_START_IND_EVT,
904                              NULL);
905}
906
907/*******************************************************************************
908**
909** Function         avdt_scb_hdl_start_rsp
910**
911** Description      This function calls the application callback with a
912**                  start confirm.
913**
914** Returns          Nothing.
915**
916*******************************************************************************/
917void avdt_scb_hdl_start_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
918{
919    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
920                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
921                              AVDT_START_CFM_EVT,
922                              (tAVDT_CTRL *) &p_data->msg.hdr);
923}
924
925/*******************************************************************************
926**
927** Function         avdt_scb_hdl_suspend_cmd
928**
929** Description      This function calls the application callback with a suspend
930**                  indication.
931**
932** Returns          Nothing.
933**
934*******************************************************************************/
935void avdt_scb_hdl_suspend_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
936{
937    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
938                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
939                              AVDT_SUSPEND_IND_EVT,
940                              NULL);
941}
942
943/*******************************************************************************
944**
945** Function         avdt_scb_hdl_suspend_rsp
946**
947** Description      This function calls the application callback with a suspend
948**                  confirm.
949**
950** Returns          Nothing.
951**
952*******************************************************************************/
953void avdt_scb_hdl_suspend_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
954{
955    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
956                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
957                              AVDT_SUSPEND_CFM_EVT,
958                              (tAVDT_CTRL *) &p_data->msg.hdr);
959}
960
961/*******************************************************************************
962**
963** Function         avdt_scb_hdl_tc_close
964**
965** Description      This function is called when the transport channel is
966**                  closed.  It marks the SCB as not in use and
967**                  initializes certain SCB parameters.  It then sends
968**                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
969**                  initiated the close.  It then checks to see if the SCB
970**                  is to be removed.  If it is it deallocates the SCB.  Finally,
971**                  it calls the application callback with a close indication.
972**
973** Returns          Nothing.
974**
975*******************************************************************************/
976void avdt_scb_hdl_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
977{
978    UINT8               hdl = avdt_scb_to_hdl(p_scb);
979    tAVDT_CTRL_CBACK    *p_ctrl_cback = p_scb->cs.p_ctrl_cback;
980    tAVDT_CTRL          avdt_ctrl;
981    UINT8               event;
982    tAVDT_CCB           *p_ccb = p_scb->p_ccb;
983    BD_ADDR remote_addr;
984
985
986    memcpy (remote_addr, p_ccb->peer_addr, BD_ADDR_LEN);
987
988    /* set up hdr */
989    avdt_ctrl.hdr.err_code = p_scb->close_code;
990
991    /* clear sep variables */
992    avdt_scb_clr_vars(p_scb, p_data);
993    p_scb->media_seq = 0;
994    p_scb->cong = FALSE;
995
996    /* free pkt we're holding, if any */
997    if (p_scb->p_pkt != NULL)
998    {
999        GKI_freebuf(p_scb->p_pkt);
1000        p_scb->p_pkt = NULL;
1001    }
1002
1003    /* stop transport channel timer */
1004    btu_stop_timer(&p_scb->timer_entry);
1005
1006    if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT))
1007    {
1008        /* tell ccb we're done with signaling channel */
1009        avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
1010    }
1011    event = (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
1012    p_scb->role = AVDT_CLOSE_ACP;
1013
1014    if (p_scb->remove)
1015    {
1016        avdt_scb_dealloc(p_scb, NULL);
1017    }
1018
1019    /* call app callback */
1020    (*p_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl);
1021}
1022
1023/*******************************************************************************
1024**
1025** Function         avdt_scb_snd_delay_rpt_req
1026**
1027** Description      This function calls the application callback with a delay
1028**                  report.
1029**
1030** Returns          Nothing.
1031**
1032*******************************************************************************/
1033void avdt_scb_snd_delay_rpt_req (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1034{
1035    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT, (tAVDT_MSG *) &p_data->apidelay);
1036}
1037
1038/*******************************************************************************
1039**
1040** Function         avdt_scb_hdl_delay_rpt_cmd
1041**
1042** Description      This function calls the application callback with a delay
1043**                  report.
1044**
1045** Returns          Nothing.
1046**
1047*******************************************************************************/
1048void avdt_scb_hdl_delay_rpt_cmd (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1049{
1050    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1051                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1052                              AVDT_DELAY_REPORT_EVT,
1053                              (tAVDT_CTRL *) &p_data->msg.hdr);
1054
1055    if (p_scb->p_ccb)
1056        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
1057    else
1058        avdt_scb_rej_not_in_use(p_scb, p_data);
1059}
1060
1061/*******************************************************************************
1062**
1063** Function         avdt_scb_hdl_delay_rpt_rsp
1064**
1065** Description      This function calls the application callback with a delay
1066**                  report.
1067**
1068** Returns          Nothing.
1069**
1070*******************************************************************************/
1071void avdt_scb_hdl_delay_rpt_rsp (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1072{
1073    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1074                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1075                              AVDT_DELAY_REPORT_CFM_EVT,
1076                              (tAVDT_CTRL *) &p_data->msg.hdr);
1077}
1078
1079#if AVDT_REPORTING == TRUE
1080/*******************************************************************************
1081**
1082** Function         avdt_scb_hdl_tc_close_sto
1083**
1084** Description      This function is called when a channel is closed in OPEN
1085**                  state.  Check the channel type and process accordingly.
1086**
1087** Returns          Nothing.
1088**
1089*******************************************************************************/
1090void avdt_scb_hdl_tc_close_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1091{
1092    tAVDT_CTRL          avdt_ctrl;
1093    /* AVDT_CHAN_SIG does not visit this action */
1094    if(p_data && p_data->close.type != AVDT_CHAN_MEDIA)
1095    {
1096        /* it's reporting or recovery channel,
1097         * the channel close in open state means the peer does not support it */
1098        if(p_data->close.old_tc_state == AVDT_AD_ST_OPEN)
1099        {
1100            avdt_ctrl.hdr.err_code = 0;
1101            avdt_ctrl.hdr.err_param = 0;
1102            /* call app callback */
1103            (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1104                                      p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1105                                      AVDT_REPORT_DISCONN_EVT, &avdt_ctrl);
1106        }
1107    }
1108    else
1109    {
1110        /* must be in OPEN state. need to go back to idle */
1111        avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
1112        avdt_scb_hdl_tc_close(p_scb, p_data);
1113    }
1114}
1115#endif
1116
1117/*******************************************************************************
1118**
1119** Function         avdt_scb_hdl_tc_open
1120**
1121** Description      This function is called when the transport channel is
1122**                  opened while in the opening state.  It calls the
1123**                  application callback with an open indication or open
1124**                  confirm depending on who initiated the open procedure.
1125**
1126** Returns          Nothing.
1127**
1128*******************************************************************************/
1129void avdt_scb_hdl_tc_open(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1130{
1131    UINT8   event;
1132#if AVDT_REPORTING == TRUE
1133    UINT8   role;
1134#endif
1135
1136    /* stop transport channel connect timer */
1137    btu_stop_timer(&p_scb->timer_entry);
1138
1139    event = (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
1140    p_data->open.hdr.err_code = 0;
1141
1142    AVDT_TRACE_DEBUG3("psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x",
1143        p_scb->cs.cfg.psc_mask, p_scb->req_cfg.psc_mask, p_scb->curr_cfg.psc_mask);
1144#if AVDT_REPORTING == TRUE
1145    if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
1146    {
1147        /* open the reporting channel, if both devices support it */
1148        role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
1149        avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
1150    }
1151#endif
1152
1153    /* call app callback */
1154    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1155                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1156                              event,
1157                              (tAVDT_CTRL *) &p_data->open);
1158}
1159
1160#if AVDT_REPORTING == TRUE
1161/*******************************************************************************
1162**
1163** Function         avdt_scb_hdl_tc_open_sto
1164**
1165** Description      This function is called when the transport channel is
1166**                  opened while in the opening state.  It calls the
1167**                  application callback with an open indication or open
1168**                  confirm depending on who initiated the open procedure.
1169**
1170** Returns          Nothing.
1171**
1172*******************************************************************************/
1173void avdt_scb_hdl_tc_open_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1174{
1175    tAVDT_CTRL          avdt_ctrl;
1176    /* open reporting channel here, when it is implemented */
1177
1178    /* call app callback */
1179    if(p_data->open.hdr.err_code == AVDT_CHAN_REPORT)
1180    {
1181        avdt_ctrl.hdr.err_code = 0;
1182        avdt_ctrl.hdr.err_param = 1;
1183        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1184                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1185                              AVDT_REPORT_CONN_EVT, &avdt_ctrl);
1186    }
1187}
1188#endif
1189
1190/*******************************************************************************
1191**
1192** Function         avdt_scb_hdl_write_req_no_frag
1193**
1194** Description      This function frees the media packet currently stored in
1195**                  the SCB, if any.  Then it builds a new media packet from
1196**                  with the passed in buffer and stores it in the SCB.
1197**
1198** Returns          Nothing.
1199**
1200*******************************************************************************/
1201void avdt_scb_hdl_write_req_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1202{
1203    UINT8   *p;
1204    UINT32  ssrc;
1205
1206    /* free packet we're holding, if any; to be replaced with new */
1207    if (p_scb->p_pkt != NULL)
1208    {
1209        GKI_freebuf(p_scb->p_pkt);
1210
1211        /* this shouldn't be happening */
1212        AVDT_TRACE_WARNING0("Dropped media packet; congested");
1213    }
1214
1215    /* build a media packet */
1216
1217    ssrc = avdt_scb_gen_ssrc(p_scb);
1218
1219    p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
1220    p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
1221
1222    p = (UINT8 *)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
1223
1224    UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
1225    UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
1226    UINT16_TO_BE_STREAM(p, p_scb->media_seq);
1227    UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
1228    UINT32_TO_BE_STREAM(p, ssrc);
1229
1230    p_scb->media_seq++;
1231
1232    /* store it */
1233    p_scb->p_pkt = p_data->apiwrite.p_buf;
1234}
1235
1236#if AVDT_MULTIPLEXING == TRUE
1237/*******************************************************************************
1238**
1239** Function         avdt_scb_hdl_write_req_frag
1240**
1241** Description      This function builds a new fragments of media packet from
1242**                  the passed in buffers and stores them in the SCB.
1243**
1244** Returns          Nothing.
1245**
1246*******************************************************************************/
1247void avdt_scb_hdl_write_req_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1248{
1249    UINT8   *p;
1250    UINT32  ssrc;
1251    BT_HDR  *p_frag;
1252
1253    /* free fragments we're holding, if any; it shouldn't happen */
1254    if (!GKI_queue_is_empty(&p_scb->frag_q))
1255    {
1256        while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1257            GKI_freebuf(p_frag);
1258
1259        /* this shouldn't be happening */
1260        AVDT_TRACE_WARNING0("*** Dropped media packet; congested");
1261    }
1262
1263    /* build a media fragments */
1264    p_scb->frag_off = p_data->apiwrite.data_len;
1265    p_scb->p_next_frag = p_data->apiwrite.p_data;
1266
1267    ssrc = avdt_scb_gen_ssrc(p_scb);
1268
1269    /* get first packet */
1270    p_frag = (BT_HDR*)GKI_getfirst (&p_data->apiwrite.frag_q);
1271    /* posit on Adaptation Layer header */
1272    p_frag->len += AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
1273    p_frag->offset -= AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
1274    p = (UINT8 *)(p_frag + 1) + p_frag->offset;
1275
1276    /* Adaptation Layer header */
1277    /* TSID, no-fragment bit and coding of length(in 2 length octets following) */
1278    *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | AVDT_ALH_LCODE_16BIT;
1279
1280    /* length of all remaining transport packet */
1281    UINT16_TO_BE_STREAM(p, p_frag->layer_specific+AVDT_MEDIA_HDR_SIZE );
1282    /* media header */
1283    UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
1284    UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
1285    UINT16_TO_BE_STREAM(p, p_scb->media_seq);
1286    UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
1287    UINT32_TO_BE_STREAM(p, ssrc);
1288    p_scb->media_seq++;
1289
1290    while((p_frag = (BT_HDR*)GKI_getnext (p_frag)) != NULL)
1291    {
1292        /* posit on Adaptation Layer header */
1293        p_frag->len += AVDT_AL_HDR_SIZE;
1294        p_frag->offset -= AVDT_AL_HDR_SIZE;
1295        p = (UINT8 *)(p_frag + 1) + p_frag->offset;
1296        /* Adaptation Layer header */
1297        /* TSID, fragment bit and coding of length(in 2 length octets following) */
1298        *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
1299
1300        /* length of all remaining transport packet */
1301        UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
1302    }
1303
1304    /* store it */
1305    p_scb->frag_q = p_data->apiwrite.frag_q;
1306}
1307#endif
1308
1309
1310/*******************************************************************************
1311**
1312** Function         avdt_scb_hdl_write_req
1313**
1314** Description      This function calls one of the two versions of building functions
1315**                  for case with and without fragmentation
1316**
1317** Returns          Nothing.
1318**
1319*******************************************************************************/
1320void avdt_scb_hdl_write_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1321{
1322#if AVDT_MULTIPLEXING == TRUE
1323    if (GKI_queue_is_empty(&p_data->apiwrite.frag_q))
1324#endif
1325        avdt_scb_hdl_write_req_no_frag(p_scb, p_data);
1326#if AVDT_MULTIPLEXING == TRUE
1327    else
1328        avdt_scb_hdl_write_req_frag(p_scb, p_data);
1329#endif
1330}
1331
1332/*******************************************************************************
1333**
1334** Function         avdt_scb_snd_abort_req
1335**
1336** Description      This function sends an abort command message.
1337**
1338** Returns          Nothing.
1339**
1340*******************************************************************************/
1341void avdt_scb_snd_abort_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1342{
1343    tAVDT_EVT_HDR   hdr;
1344
1345    if (p_scb->p_ccb != NULL)
1346    {
1347        p_scb->role = AVDT_CLOSE_INT;
1348
1349        hdr.seid = p_scb->peer_seid;
1350
1351        avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, (tAVDT_MSG *) &hdr);
1352    }
1353}
1354
1355/*******************************************************************************
1356**
1357** Function         avdt_scb_snd_abort_rsp
1358**
1359** Description      This function sends an abort response message.
1360**
1361** Returns          Nothing.
1362**
1363*******************************************************************************/
1364void avdt_scb_snd_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1365{
1366    avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
1367                      &p_data->msg);
1368}
1369
1370/*******************************************************************************
1371**
1372** Function         avdt_scb_snd_close_req
1373**
1374** Description      This function sends a close command message.
1375**
1376** Returns          Nothing.
1377**
1378*******************************************************************************/
1379void avdt_scb_snd_close_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1380{
1381    tAVDT_EVT_HDR   hdr;
1382
1383    p_scb->role = AVDT_CLOSE_INT;
1384
1385    hdr.seid = p_scb->peer_seid;
1386
1387    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, (tAVDT_MSG *) &hdr);
1388}
1389
1390/*******************************************************************************
1391**
1392** Function         avdt_scb_snd_stream_close
1393**
1394** Description      This function sends a close command message.
1395**
1396** Returns          Nothing.
1397**
1398*******************************************************************************/
1399void avdt_scb_snd_stream_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1400{
1401#if AVDT_MULTIPLEXING == TRUE
1402    BT_HDR          *p_frag;
1403
1404    AVDT_TRACE_WARNING2("avdt_scb_snd_stream_close c:%d, off:%d",
1405        p_scb->frag_q.count, p_scb->frag_off);
1406    /* clean fragments queue */
1407    while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1408         GKI_freebuf(p_frag);
1409    p_scb->frag_off = 0;
1410#endif
1411    if (p_scb->p_pkt)
1412    {
1413        GKI_freebuf(p_scb->p_pkt);
1414        p_scb->p_pkt = NULL;
1415    }
1416
1417#if 0
1418    if(p_scb->cong)
1419        p_scb->cong = FALSE;
1420
1421    /* p_scb->curr_cfg.mux_tsid_media == 0 */
1422#endif
1423    avdt_scb_snd_close_req(p_scb, p_data);
1424}
1425
1426/*******************************************************************************
1427**
1428** Function         avdt_scb_snd_close_rsp
1429**
1430** Description      This function sends a close response message.
1431**
1432** Returns          Nothing.
1433**
1434*******************************************************************************/
1435void avdt_scb_snd_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1436{
1437    avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
1438}
1439
1440/*******************************************************************************
1441**
1442** Function         avdt_scb_snd_getconfig_req
1443**
1444** Description      This function sends a get configuration command message.
1445**
1446** Returns          Nothing.
1447**
1448*******************************************************************************/
1449void avdt_scb_snd_getconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1450{
1451    tAVDT_EVT_HDR   hdr;
1452
1453    hdr.seid = p_scb->peer_seid;
1454
1455    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, (tAVDT_MSG *) &hdr);
1456}
1457
1458/*******************************************************************************
1459**
1460** Function         avdt_scb_snd_getconfig_rsp
1461**
1462** Description      This function sends a get configuration response message.
1463**
1464** Returns          Nothing.
1465**
1466*******************************************************************************/
1467void avdt_scb_snd_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1468{
1469    avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
1470}
1471
1472/*******************************************************************************
1473**
1474** Function         avdt_scb_snd_open_req
1475**
1476** Description      This function sends an open command message.
1477**
1478** Returns          Nothing.
1479**
1480*******************************************************************************/
1481void avdt_scb_snd_open_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1482{
1483    tAVDT_EVT_HDR   hdr;
1484
1485    hdr.seid = p_scb->peer_seid;
1486
1487    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, (tAVDT_MSG *) &hdr);
1488}
1489
1490/*******************************************************************************
1491**
1492** Function         avdt_scb_snd_open_rsp
1493**
1494** Description      This function sends an open response message.  It also
1495**                  calls avdt_ad_open_req() to accept a transport channel
1496**                  connection.
1497**
1498** Returns          Nothing.
1499**
1500*******************************************************************************/
1501void avdt_scb_snd_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1502{
1503    /* notify adaption that we're waiting for transport channel open */
1504    p_scb->role = AVDT_OPEN_ACP;
1505    avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
1506
1507    /* send response */
1508    avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
1509
1510    /* start tc connect timer */
1511    btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
1512}
1513
1514/*******************************************************************************
1515**
1516** Function         avdt_scb_snd_reconfig_req
1517**
1518** Description      This function stores the configuration parameters in the
1519**                  SCB and sends a reconfiguration command message.
1520**
1521** Returns          Nothing.
1522**
1523*******************************************************************************/
1524void avdt_scb_snd_reconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1525{
1526    memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
1527    p_data->msg.hdr.seid = p_scb->peer_seid;
1528    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
1529}
1530
1531/*******************************************************************************
1532**
1533** Function         avdt_scb_snd_reconfig_rsp
1534**
1535** Description      This function stores the configuration parameters in the
1536**                  SCB and sends a reconfiguration response message.
1537**
1538** Returns          Nothing.
1539**
1540*******************************************************************************/
1541void avdt_scb_snd_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1542{
1543    if (p_data->msg.hdr.err_code == 0)
1544    {
1545        /* store new configuration */
1546        if (p_scb->req_cfg.num_codec > 0)
1547        {
1548            p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
1549            memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
1550        }
1551        if (p_scb->req_cfg.num_protect > 0)
1552        {
1553            p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
1554            memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
1555        }
1556
1557        /* send response */
1558        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1559    }
1560    else
1561    {
1562        /* send reject */
1563        avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1564    }
1565}
1566
1567/*******************************************************************************
1568**
1569** Function         avdt_scb_snd_security_req
1570**
1571** Description      This function sends a security command message.
1572**
1573** Returns          Nothing.
1574**
1575*******************************************************************************/
1576void avdt_scb_snd_security_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1577{
1578    p_data->msg.hdr.seid = p_scb->peer_seid;
1579    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
1580}
1581
1582/*******************************************************************************
1583**
1584** Function         avdt_scb_snd_security_rsp
1585**
1586** Description      This function sends a security response message.
1587**
1588** Returns          Nothing.
1589**
1590*******************************************************************************/
1591void avdt_scb_snd_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1592{
1593    if (p_data->msg.hdr.err_code == 0)
1594    {
1595        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1596    }
1597    else
1598    {
1599        avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1600    }
1601}
1602
1603/*******************************************************************************
1604**
1605** Function         avdt_scb_snd_setconfig_rej
1606**
1607** Description      This function marks the SCB as not in use and sends a
1608**                  set configuration reject message.
1609**
1610** Returns          Nothing.
1611**
1612*******************************************************************************/
1613void avdt_scb_snd_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1614{
1615    if (p_scb->p_ccb != NULL)
1616    {
1617        avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1618
1619        /* clear scb variables */
1620        avdt_scb_clr_vars(p_scb, p_data);
1621    }
1622}
1623
1624/*******************************************************************************
1625**
1626** Function         avdt_scb_snd_setconfig_req
1627**
1628** Description      This function marks the SCB as in use and copies the
1629**                  configuration parameters to the SCB.  Then the function
1630**                  sends a set configuration command message and initiates
1631**                  opening of the signaling channel.
1632**
1633** Returns          Nothing.
1634**
1635*******************************************************************************/
1636void avdt_scb_snd_setconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1637{
1638    tAVDT_CFG *p_req, *p_cfg;
1639
1640    /* copy API parameters to scb, set scb as in use */
1641    p_scb->in_use = TRUE;
1642    p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
1643    p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
1644    p_req = p_data->msg.config_cmd.p_cfg;
1645    p_cfg = &p_scb->cs.cfg;
1646#if AVDT_MULTIPLEXING == TRUE
1647    p_req->mux_tsid_media = p_cfg->mux_tsid_media;
1648    p_req->mux_tcid_media = p_cfg->mux_tcid_media;
1649    if(p_req->psc_mask & AVDT_PSC_REPORT)
1650    {
1651        p_req->mux_tsid_report = p_cfg->mux_tsid_report;
1652        p_req->mux_tcid_report = p_cfg->mux_tcid_report;
1653    }
1654#endif
1655    memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
1656
1657    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
1658
1659    /* tell ccb to open channel */
1660    avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
1661}
1662
1663/*******************************************************************************
1664**
1665** Function         avdt_scb_snd_setconfig_rsp
1666**
1667** Description      This function copies the requested configuration into the
1668**                  current configuration and sends a set configuration
1669**                  response message.
1670**
1671** Returns          Nothing.
1672**
1673*******************************************************************************/
1674void avdt_scb_snd_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1675{
1676    if (p_scb->p_ccb != NULL)
1677    {
1678        memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
1679
1680        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1681    }
1682}
1683
1684/*******************************************************************************
1685**
1686** Function         avdt_scb_snd_tc_close
1687**
1688** Description      This function calls avdt_ad_close_req() to close the
1689**                  transport channel for this SCB.
1690**
1691** Returns          Nothing.
1692**
1693*******************************************************************************/
1694void avdt_scb_snd_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1695{
1696#if AVDT_REPORTING == TRUE
1697    if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
1698        avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
1699#endif
1700    avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
1701}
1702
1703/*******************************************************************************
1704**
1705** Function         avdt_scb_cb_err
1706**
1707** Description      This function calls the application callback function
1708**                  indicating an error.
1709**
1710** Returns          Nothing.
1711**
1712*******************************************************************************/
1713void avdt_scb_cb_err(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1714{
1715    tAVDT_CTRL          avdt_ctrl;
1716
1717    /* set error code and parameter */
1718    avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1719    avdt_ctrl.hdr.err_param = 0;
1720
1721    /* call callback, using lookup table to get callback event */
1722    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1723                              NULL,
1724                              avdt_scb_cback_evt[p_scb->curr_evt],
1725                              &avdt_ctrl);
1726}
1727
1728/*******************************************************************************
1729**
1730** Function         avdt_scb_cong_state
1731**
1732** Description      This function sets the congestion state of the SCB media
1733**                  transport channel.
1734**
1735** Returns          Nothing.
1736**
1737*******************************************************************************/
1738void avdt_scb_cong_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1739{
1740    p_scb->cong = p_data->llcong;
1741}
1742
1743/*******************************************************************************
1744**
1745** Function         avdt_scb_rej_state
1746**
1747** Description      This function sends a reject message to the peer indicating
1748**                  incorrect state for the received command message.
1749**
1750** Returns          Nothing.
1751**
1752*******************************************************************************/
1753void avdt_scb_rej_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1754{
1755    p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
1756    p_data->msg.hdr.err_param = 0;
1757    avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1758                      p_data->msg.hdr.sig_id, &p_data->msg);
1759}
1760
1761/*******************************************************************************
1762**
1763** Function         avdt_scb_rej_in_use
1764**
1765** Description      This function sends a reject message to the peer indicating
1766**                  the stream is in use.
1767**
1768** Returns          Nothing.
1769**
1770*******************************************************************************/
1771void avdt_scb_rej_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1772{
1773    p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
1774    p_data->msg.hdr.err_param = 0;
1775    avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1776                      p_data->msg.hdr.sig_id, &p_data->msg);
1777}
1778
1779/*******************************************************************************
1780**
1781** Function         avdt_scb_rej_not_in_use
1782**
1783** Description      This function sends a reject message to the peer indicating
1784**                  the stream is in use.
1785**
1786** Returns          Nothing.
1787**
1788*******************************************************************************/
1789void avdt_scb_rej_not_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1790{
1791    p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
1792    p_data->msg.hdr.err_param = 0;
1793    avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1794                      p_data->msg.hdr.sig_id, &p_data->msg);
1795}
1796
1797/*******************************************************************************
1798**
1799** Function         avdt_scb_set_remove
1800**
1801** Description      This function marks an SCB to be removed.
1802**
1803** Returns          Nothing.
1804**
1805*******************************************************************************/
1806void avdt_scb_set_remove(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1807{
1808    p_scb->remove = TRUE;
1809}
1810
1811/*******************************************************************************
1812**
1813** Function         avdt_scb_free_pkt
1814**
1815** Description      This function frees the media packet passed in.
1816**
1817** Returns          Nothing.
1818**
1819*******************************************************************************/
1820void avdt_scb_free_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1821{
1822    tAVDT_CTRL      avdt_ctrl;
1823#if AVDT_MULTIPLEXING == TRUE
1824    BT_HDR          *p_frag;
1825#endif
1826
1827    /* set error code and parameter */
1828    avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1829    avdt_ctrl.hdr.err_param = 0;
1830
1831    /* p_buf can be NULL in case using of fragments queue frag_q */
1832    if(p_data->apiwrite.p_buf)
1833        GKI_freebuf(p_data->apiwrite.p_buf);
1834
1835#if AVDT_MULTIPLEXING == TRUE
1836    /* clean fragments queue */
1837    while((p_frag = (BT_HDR*)GKI_dequeue (&p_data->apiwrite.frag_q)) != NULL)
1838         GKI_freebuf(p_frag);
1839#endif
1840
1841    AVDT_TRACE_WARNING0("Dropped media packet");
1842
1843    /* we need to call callback to keep data flow going */
1844    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
1845                              &avdt_ctrl);
1846}
1847
1848/*******************************************************************************
1849**
1850** Function         avdt_scb_clr_pkt
1851**
1852** Description      This function frees the media packet stored in the SCB.
1853**
1854** Returns          Nothing.
1855**
1856*******************************************************************************/
1857void avdt_scb_clr_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1858{
1859    tAVDT_CTRL      avdt_ctrl;
1860    tAVDT_CCB       *p_ccb;
1861    UINT8           tcid;
1862    UINT16          lcid;
1863#if AVDT_MULTIPLEXING == TRUE
1864    BT_HDR          *p_frag;
1865#endif
1866
1867    /* set error code and parameter */
1868    avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1869    avdt_ctrl.hdr.err_param = 0;
1870    /* flush the media data queued at L2CAP */
1871    if((p_ccb = p_scb->p_ccb) != NULL)
1872    {
1873        /* get tcid from type, scb */
1874        tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
1875
1876        lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
1877        L2CA_FlushChannel (lcid, L2CAP_FLUSH_CHANS_ALL);
1878    }
1879
1880    if (p_scb->p_pkt != NULL)
1881    {
1882        GKI_freebuf(p_scb->p_pkt);
1883        p_scb->p_pkt = NULL;
1884
1885        AVDT_TRACE_DEBUG0("Dropped stored media packet");
1886
1887        /* we need to call callback to keep data flow going */
1888        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
1889                                  &avdt_ctrl);
1890    }
1891#if AVDT_MULTIPLEXING == TRUE
1892    else if(!GKI_queue_is_empty (&p_scb->frag_q))
1893    {
1894        AVDT_TRACE_DEBUG0("Dropped fragments queue");
1895        /* clean fragments queue */
1896        while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1897             GKI_freebuf(p_frag);
1898
1899        p_scb->frag_off = 0;
1900
1901        /* we need to call callback to keep data flow going */
1902        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
1903                                  &avdt_ctrl);
1904    }
1905#endif
1906}
1907
1908
1909/*******************************************************************************
1910**
1911** Function         avdt_scb_chk_snd_pkt
1912**
1913** Description      This function checks if the SCB is congested, and if not
1914**                  congested it sends a stored media packet, if any.  After it
1915**                  sends the packet it calls the application callback function
1916**                  with a write confirm.
1917**
1918** Returns          Nothing.
1919**
1920*******************************************************************************/
1921void avdt_scb_chk_snd_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1922{
1923    tAVDT_CTRL      avdt_ctrl;
1924    BT_HDR          *p_pkt;
1925#if AVDT_MULTIPLEXING == TRUE
1926    BOOLEAN         sent = FALSE;
1927    UINT8   res = AVDT_AD_SUCCESS;
1928    tAVDT_SCB_EVT data;
1929#endif
1930
1931    avdt_ctrl.hdr.err_code = 0;
1932
1933    if (!p_scb->cong)
1934    {
1935        if (p_scb->p_pkt != NULL)
1936        {
1937            p_pkt = p_scb->p_pkt;
1938            p_scb->p_pkt = NULL;
1939            avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
1940
1941            (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
1942        }
1943#if AVDT_MULTIPLEXING == TRUE
1944        else
1945        {
1946#if 0
1947            AVDT_TRACE_DEBUG1("num_q=%d",
1948                L2CA_FlushChannel(avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb)].lcid),
1949                                  L2CAP_FLUSH_CHANS_GET);
1950#endif
1951            while((p_pkt = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1952            {
1953                sent = TRUE;
1954                AVDT_TRACE_DEBUG1("Send fragment len=%d",p_pkt->len);
1955                /* fragments queue contains fragment to send */
1956                res = avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
1957                if(AVDT_AD_CONGESTED == res)
1958                {
1959                    p_scb->cong = TRUE;
1960                    AVDT_TRACE_DEBUG0("avdt/l2c congested!!");
1961                    break;/* exit loop if channel became congested */
1962            }
1963            }
1964            AVDT_TRACE_DEBUG2("res=%d left=%d",res, p_scb->frag_off);
1965
1966            if(p_scb->frag_off)
1967            {
1968                if(AVDT_AD_SUCCESS == res || GKI_queue_is_empty (&p_scb->frag_q))
1969                {
1970                    /* all buffers were sent to L2CAP, compose more to queue */
1971                    avdt_scb_queue_frags(p_scb, &p_scb->p_next_frag, &p_scb->frag_off, &p_scb->frag_q);
1972                    if(!GKI_queue_is_empty (&p_scb->frag_q))
1973                    {
1974                        data.llcong = p_scb->cong;
1975                        avdt_scb_event(p_scb, AVDT_SCB_TC_CONG_EVT, &data);
1976                    }
1977                }
1978            }
1979
1980            /* Send event AVDT_WRITE_CFM_EVT if it was last fragment */
1981            else if (sent && GKI_queue_is_empty (&p_scb->frag_q))
1982            {
1983                (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
1984            }
1985        }
1986#endif
1987    }
1988}
1989
1990/*******************************************************************************
1991**
1992** Function         avdt_scb_tc_timer
1993**
1994** Description      This function is called to start a timer when the peer
1995**                  initiates closing of the stream.  The timer verifies that
1996**                  the peer disconnects the transport channel.
1997**
1998** Returns          Nothing.
1999**
2000*******************************************************************************/
2001void avdt_scb_tc_timer(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
2002{
2003    btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_DISC_TOUT);
2004}
2005
2006/*******************************************************************************
2007**
2008** Function         avdt_scb_clr_vars
2009**
2010** Description      This function initializes certain SCB variables.
2011**
2012** Returns          Nothing.
2013**
2014*******************************************************************************/
2015void avdt_scb_clr_vars(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
2016{
2017    p_scb->in_use = FALSE;
2018    p_scb->p_ccb = NULL;
2019    p_scb->peer_seid = 0;
2020}
2021
2022#if AVDT_MULTIPLEXING == TRUE
2023/*******************************************************************************
2024**
2025** Function         avdt_scb_queue_frags
2026**
2027** Description      This function breaks media payload into fragments
2028**                  and put the fragments in the given queue.
2029**
2030** Returns          Nothing.
2031**
2032*******************************************************************************/
2033void avdt_scb_queue_frags(tAVDT_SCB *p_scb, UINT8 **pp_data, UINT32 *p_data_len, BUFFER_Q *pq)
2034{
2035    UINT16  lcid;
2036    UINT16  num_frag;
2037    UINT16  mtu_used;
2038    UINT8   *p;
2039    BOOLEAN al_hdr = FALSE;
2040    UINT8   tcid;
2041    tAVDT_TC_TBL    *p_tbl;
2042    UINT16          buf_size;
2043    UINT16          offset = AVDT_MEDIA_OFFSET + AVDT_AL_HDR_SIZE;
2044    UINT16          cont_offset = offset - AVDT_MEDIA_HDR_SIZE;
2045    BT_HDR          *p_frag;
2046
2047    tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
2048    lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][tcid].lcid;
2049
2050    if( p_scb->frag_off != 0)
2051    {
2052        /* continuing process is usually triggered by un-congest event.
2053         * the number of buffers at L2CAP is very small (if not 0).
2054         * we do not need to L2CA_FlushChannel() */
2055        offset = cont_offset;
2056        al_hdr = TRUE;
2057        num_frag = AVDT_MAX_FRAG_COUNT;
2058    }
2059    else
2060    {
2061        num_frag = L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_GET);
2062        AVDT_TRACE_DEBUG2("num_q=%d lcid=%d", num_frag, lcid);
2063        if(num_frag >= AVDT_MAX_FRAG_COUNT)
2064        {
2065            num_frag = 0;
2066        }
2067        else
2068        {
2069            num_frag = AVDT_MAX_FRAG_COUNT - num_frag;
2070        }
2071    }
2072
2073    /* look up transport channel table entry to get peer mtu */
2074    p_tbl = avdt_ad_tc_tbl_by_type(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
2075    buf_size = p_tbl->peer_mtu + BT_HDR_SIZE;
2076    AVDT_TRACE_DEBUG3("peer_mtu: %d, buf_size: %d num_frag=%d",
2077        p_tbl->peer_mtu, buf_size, num_frag);
2078
2079    if(buf_size > AVDT_DATA_POOL_SIZE)
2080        buf_size = AVDT_DATA_POOL_SIZE;
2081
2082    mtu_used = buf_size - BT_HDR_SIZE;
2083
2084    while(*p_data_len && num_frag)
2085    {
2086        /* allocate buffer for fragment */
2087        if(NULL == (p_frag = (BT_HDR*)GKI_getbuf(buf_size)))
2088        {
2089            AVDT_TRACE_WARNING1("avdt_scb_queue_frags len=%d(out of GKI buffers)",*p_data_len);
2090            break;
2091        }
2092        /* fill fragment by chunk of media payload */
2093        p_frag->layer_specific = *p_data_len;/* length of all remaining transport packet */
2094        p_frag->offset = offset;
2095        /* adjust packet offset for continuing packets */
2096        offset = cont_offset;
2097
2098        p_frag->len = mtu_used - p_frag->offset;
2099        if(p_frag->len > *p_data_len)
2100            p_frag->len = *p_data_len;
2101        memcpy((UINT8*)(p_frag+1) + p_frag->offset, *pp_data, p_frag->len);
2102        *pp_data += p_frag->len;
2103        *p_data_len -= p_frag->len;
2104        AVDT_TRACE_DEBUG1("Prepared fragment len=%d", p_frag->len);
2105
2106        if(al_hdr)
2107        {
2108            /* Adaptation Layer header */
2109            p_frag->len += AVDT_AL_HDR_SIZE;
2110            p_frag->offset -= AVDT_AL_HDR_SIZE;
2111            p = (UINT8 *)(p_frag + 1) + p_frag->offset;
2112            /* TSID, fragment bit and coding of length(in 2 length octets following) */
2113            *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
2114
2115            /* length of all remaining transport packet */
2116            UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
2117        }
2118        /* put fragment into gueue */
2119        GKI_enqueue(pq, p_frag);
2120        num_frag--;
2121    }
2122}
2123#endif
2124
2125